diff --git a/.github/workflows/vale-autofix.yml b/.github/workflows/vale-autofix.yml
index 0864b83ea9..fa34ff0db0 100644
--- a/.github/workflows/vale-autofix.yml
+++ b/.github/workflows/vale-autofix.yml
@@ -10,12 +10,43 @@ on:
- '!docs/**/CLAUDE.md'
- '!docs/**/SKILL.md'
- '!docs/kb/**'
+ - 'scripts/**'
+ - 'package.json'
concurrency:
group: vale-autofix-${{ github.event.pull_request.number }}
jobs:
+ test-scripts:
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 0
+
+ - name: Check if scripts changed
+ id: scripts-changed
+ run: |
+ CHANGED=$(git diff --name-only origin/dev...HEAD -- scripts/ package.json)
+ if [ -z "$CHANGED" ]; then
+ echo "changed=false" >> "$GITHUB_OUTPUT"
+ else
+ echo "changed=true" >> "$GITHUB_OUTPUT"
+ fi
+
+ - name: Test anchor/slugify scripts
+ if: steps.scripts-changed.outputs.changed == 'true'
+ run: npm run test:scripts
+
vale-autofix:
+ needs: test-scripts
+ if: >-
+ github.event.pull_request.head.repo.fork == false &&
+ github.actor != 'dependabot[bot]'
runs-on: ubuntu-latest
permissions:
contents: write
@@ -60,11 +91,9 @@ jobs:
- name: Get changed markdown files
id: changed-files
if: steps.bot-check.outputs.skip != 'true'
- env:
- GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
- PR_NUMBER=${{ github.event.pull_request.number }}
- CHANGED_MD_FILES=$(gh pr diff "$PR_NUMBER" --name-only | grep -E '^docs/.*\.md$' | grep -v '/CLAUDE\.md$' | grep -v '/SKILL\.md$' | grep -v '^docs/kb/' || true)
+ DIFF_OUTPUT=$(git diff --name-only origin/dev...HEAD -- docs/)
+ CHANGED_MD_FILES=$(printf '%s\n' "$DIFF_OUTPUT" | grep -E '^docs/.*\.md$' | grep -v '/CLAUDE\.md$' | grep -v '/SKILL\.md$' | grep -v '^docs/kb/' || true)
if [ -z "$CHANGED_MD_FILES" ]; then
echo "No docs markdown files changed"
echo "count=0" >> "$GITHUB_OUTPUT"
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/computerdetails.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/computerdetails.md
index 14798ebe26..8e9d086842 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/computerdetails.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/computerdetails.md
@@ -12,14 +12,14 @@ Use the Computers Details page to select computer attributes to change.
Highlight the attribute to edit:
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then click
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then click
the blue arrow to insert the item into the Value box. The executed action replaces the AD Object
property with the specified value from the source table.
- Add Attribute – Adds a custom attribute to the Computer Details attribute list
- Remove Attribute – Removes a selected attribute Computer Details attribute list
- Edit Attribute – Click this icon to change the name of the selected custom attribute
-- Import Attribute – Opens the Import Custom Attributes Import Wizard where one or more custom
- attributes can be imported. See the
+- Import Attribute – Opens the Import Custom Attributes Import Wizard, where you can import one or
+ more custom attributes. See the
[Custom Attribute Import Wizard](#custom-attribute-import-wizard) topic for additional
information.
- Value – This field contains selections from the Insert field. If the Manager attribute is
@@ -30,8 +30,7 @@ Highlight the attribute to edit:
## Custom Attribute Import Wizard
-The Custom Attributes Import Wizard is used to import a list of custom attributes. Follow the steps
-to use the Custom Attributes Import Wizard.
+Use the Custom Attributes Import Wizard to import a list of custom attributes.
**Step 1 –** On the Computer Details page of the Active Directory Action Module Wizard, click
**Import**. The Custom Attribute Import Wizard opens.
@@ -39,7 +38,7 @@ to use the Custom Attributes Import Wizard.
**Step 2 –** On the Credentials page, identify a domain either by entering one manually or selecting
-one from the **Domain Name** drop-down menu which displays a list of domains trusted by the one in
+one from the **Domain Name** dropdown menu which displays a list of domains trusted by the one in
which the Enterprise Auditor Console server resides. Then set the credentials for reading the
attributes list from the domain:
@@ -52,11 +51,11 @@ attributes list from the domain:
**Step 4 –** The wizard populates available attributes from the domain specified on the Attributes
-page. Expand the desired object class and select the checkboxes for the custom attributes to be
+page. Expand the object class you want and select the checkboxes for the custom attributes to be
imported. Then click **Next**.
**Step 5 –** On the Completion page, click **Finish**.
-The selected attributes have been added to the attribute list on the Computer Details page.
+The wizard adds the selected attributes to the attribute list on the Computer Details page.
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/creategroups.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/creategroups.md
index 968a2496e5..4b090d5590 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/creategroups.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/creategroups.md
@@ -12,12 +12,12 @@ Use the Create Groups page to configure the action to create groups on the selec
Use the following options to configure the action:
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then,
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then,
click the blue arrow to insert the item into the OU, Group name, or Group name (pre Windows 2000)
boxes.
- OU – The organizational unit that contains the group
- - Create target OU location if it does not already exist – Select this checkbox to create the
+ - Create target OU location if it doesn't already exist – Select this checkbox to create the
target OU
- Group Name – The name of the group that being created. This field is required.
@@ -27,10 +27,10 @@ Use the following options to configure the action:
- Universal
- Global
- DomainLocal
- - SqlField – Enter a value from the drop-down list
+ - SqlField – Enter a value from the dropdown list
- Group type – The type of group being created. Select from the following:
- Security
- Distribution
- - SqlField – Enter a value from the drop-down list
+ - SqlField – Enter a value from the dropdown list
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/createusers.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/createusers.md
index a16d6e3572..788d9b0691 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/createusers.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/createusers.md
@@ -12,11 +12,11 @@ Use the Create Users page to create users on the selected target.
Use the following options to configure the action:
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then,
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then,
click the blue arrow to insert the item into the selected box.
- OU – The organizational unit in which to create the user
- - Create target OU location if it does not already exist - Select this checkbox to create the
+ - Create target OU location if it doesn't already exist - Select this checkbox to create the
target OU.
- First Name – The first name of the user being created
@@ -31,6 +31,6 @@ Optionally, select from the following checkboxes:
- User must change password at next logon – Require the user to change the password at the next
logon
-- User cannot change password
+- User can't change password
- Password never expires
- Account is disabled
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/disableenablecomputers.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/disableenablecomputers.md
index 5c327b7414..a594d4ea81 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/disableenablecomputers.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/disableenablecomputers.md
@@ -11,7 +11,7 @@ options on target computers.
-Select the radio button for the desired option:
+Select the radio button for the option you want:
- Enable – Enables users' operation options
- Disable – Disables users' operation options
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/disableenableusers.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/disableenableusers.md
index 7df84ae685..b62217fc0c 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/disableenableusers.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/disableenableusers.md
@@ -10,7 +10,7 @@ Use the Disable/Enable Users page to enable or disable target users.
-Select the radio button for the desired option:
+Select the radio button for the option you want:
- Disable – Select this radio button to disable users' operation options
- Enable – Select this radio button to enable users' operation options
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/groupdetails.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/groupdetails.md
index 352dce77b3..22adcf16bd 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/groupdetails.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/groupdetails.md
@@ -18,13 +18,13 @@ The options at the bottom of the page vary based on the highlighted attribute.
:::
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then,
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then,
click the blue arrow to insert the item into the Value box.
- Add Attribute – Adds a custom attribute to the Computer Details attribute list
- Remove Attribute – Removes a selected attribute from the action
- Edit Attribute – Click this icon to change the name of the selected custom attribute
-- Import Attribute – Opens the Import Custom Attributes Import Wizard where current attributes for
- an object is viewed and can be imported for editing. See the
+- Import Attribute – Opens the Import Custom Attributes Import Wizard, where you can view an
+ object's current attributes and import them for editing. See the
[Custom Attribute Import Wizard](#custom-attribute-import-wizard) topic for additional
information.
- Value/Name – This field derives its name from selections made on the page. It can contain
@@ -36,8 +36,7 @@ the action.
## Custom Attribute Import Wizard
-The Custom Attributes Import Wizard is used to import a list of custom attributes. Follow the steps
-to use the Custom Attributes Import Wizard.
+Use the Custom Attributes Import Wizard to import a list of custom attributes.
**Step 1 –** On the Group Details page of the Active Directory Action Module Wizard, click
**Import**. The Custom Attribute Import Wizard opens.
@@ -45,7 +44,7 @@ to use the Custom Attributes Import Wizard.
**Step 2 –** On the Credentials page, identify a domain either by entering one manually or selecting
-one from the **Domain Name** drop-down menu which displays a list of domains trusted by the one in
+one from the **Domain Name** dropdown menu which displays a list of domains trusted by the one in
which the Enterprise Auditor Console server resides. Then set the credentials for reading the
attributes list from the domain:
@@ -58,11 +57,11 @@ attributes list from the domain:
**Step 4 –** The wizard populates available attributes from the domain specified on the Attributes
-page. Expand the desired object class and select the checkboxes for the custom attributes to be
+page. Expand the object class you want and select the checkboxes for the custom attributes to be
imported. Then click **Next**.
-**Step 5 –** On the Completion page, click **Finish**. On the Completion page, click **Finish**.
+**Step 5 –** On the Completion page, click **Finish**.
-The selected attributes have been added to the attribute list on the Group Details page.
+The wizard adds the selected attributes to the attribute list on the Group Details page.
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/groupmembership.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/groupmembership.md
index 2221b605e4..7fca0421cb 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/groupmembership.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/groupmembership.md
@@ -13,7 +13,7 @@ be used to specify if the object will be added or removed.
Use the following options to configure the action:
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then,
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then,
click the blue arrow to insert the item into the selected box.
- Select one of the following:
@@ -22,18 +22,18 @@ Use the following options to configure the action:
- OU – The organizational unit that contains the group. This field is required.
- - Create target OU location if it does not already exist – Select this checkbox to create the
+ - Create target OU location if it doesn't already exist – Select this checkbox to create the
target OU.
- Group (CN, not a pre-Windows 2000 name) – The group to create. This field is required.
- - Create target Group if it does not already exist
+ - Create target Group if it doesn't already exist
- Select one of the following:
- Add members
- Remove members
- - Add/Remove members – Enables the ChangeType Column drop down list
+ - Add/Remove members – Enables the ChangeType Column dropdown list
- ChangeType Column – The value to use from the source table to specify if the object is added or
removed. The contents of the ChangeType column should be a 0 for Add or a 1 for Remove.
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/moveobjects.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/moveobjects.md
index fb6dc814b4..7841f7e8bf 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/moveobjects.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/moveobjects.md
@@ -13,8 +13,8 @@ Use the Move Objects page to specify the OU in which to move objects.
Use the following options to configure the action:
- Insert Field – Contains available values from populated from the source table
-- OU – Use the drop-down list to select a field (column) from the source table. Then, click the blue
+- OU – Use the dropdown list to select a field (column) from the source table. Then, click the blue
arrow to insert the item into the OU box.
- - Create target OU location if it does not already exist – Select this checkbox to create the
+ - Create target OU location if it doesn't already exist – Select this checkbox to create the
target OU
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/operations.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/operations.md
index fa857d4cbd..ec41ad6a70 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/operations.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/operations.md
@@ -11,7 +11,7 @@ Active Directory objects. Some operations have wizard pages to specify the confi
-The Operations drop-down menu contains the following operations:
+The Operations dropdown menu contains the following operations:
- [Clear/Set SID History ](/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/sidhistory.md)
- [Computer Details](/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/computerdetails.md)
@@ -28,7 +28,7 @@ The Operations drop-down menu contains the following operations:
- [Unlock Users ](#unlock-users)
- [Users Details ](/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/usersdetails.md)
-Select an operation from the drop-down list and then click **Add**. The selection appears in the
+Select an operation from the dropdown list and then click **Add**. The selection appears in the
Selections pane as well as the navigation pane if there is an associated configuration page. If
performing multiple operations, the action executes the operations in the order in which they appear
here. To change the order, select an operation and use the **Down** and **Up** buttons.
@@ -36,20 +36,20 @@ here. To change the order, select an operation and use the **Down** and **Up** b
## Delete Objects
:::warning
-Once deleted, objects from Active Directory cannot be restored.
+Once deleted, objects from Active Directory can't be restored.
:::
Select this operation to delete objects from Active Directory, such as users, groups, or computers.
-The source table determines which objects are deleted from the Active Directory. Therefore, this
-operation does not possess its own wizard window.
+The source table determines which objects the action deletes from Active Directory. This operation
+doesn't have its own wizard window.
## Groups Remove All Members
-Select this operation to remove all members from groups located in the source table. There is not a
-wizard window associated with this operation. No configuration is required.
+Select this operation to remove all members from groups located in the source table. This operation
+doesn't have an associated wizard window and requires no configuration.
## Unlock Users
-Select this operation to unlock the account of the specified users in the source table. There is not
-a wizard window associated with this operation. No configuration is required.
+Select this operation to unlock the account of the specified users in the source table. This
+operation doesn't have an associated wizard window and requires no configuration.
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/setresetpassword.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/setresetpassword.md
index 0935607c8d..cc2205ca77 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/setresetpassword.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/setresetpassword.md
@@ -12,7 +12,7 @@ Use the Set/Reset Users Password page to set or reset user passwords with the sp
Use the following options to configure the action:
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then,
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then,
click the blue arrow to insert the item into the Password box.
- Password – The field with the passwords to set or reset. This field is required.
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/sidhistory.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/sidhistory.md
index e3be5ab370..d7c122b5b6 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/sidhistory.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/operations/sidhistory.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Clear/Set SID History
Use the Clear/Set SID History page to overwrite or append to the SID history for targeted objects.
-Please review the restrictions for this operation in the Notes box.
+review the restrictions for this operation in the Notes box.
The source table used for this operation must contain a column with the following information:
@@ -20,15 +20,15 @@ Configure the action with the following options:
- Overwrite – Overwrites the SID History
- Append – Adds to the SID History
- Clear – Clears the SID History
-- Insert Field – This drop-down list is enabled when the Overwrite or Append radio buttons are
- selected. Use the drop-down list to select a field (column) from the source table. Then, click the
- blue arrow to insert the item into the SID History box. The SID history is overwritten with the
- selected fields or appended to with the selected fields depending on the selected radio button.
-- SID History – This box is enabled by selecting the Overwrite or Append radio buttons. The SID
- history is overwritten or appended to with the inserted fields, depending on the selected radio
- button. Populate the SID History box using either of the following methods:
-
- - Select one or more fields at the Insert Field drop-down menu
+- Insert Field – Selecting the Overwrite or Append radio button enables this dropdown list. Use the
+ dropdown list to select a field (column) from the source table. Then, click the blue arrow to
+ insert the item into the SID History box. Depending on which radio button you select, the action
+ overwrites the SID history with the selected fields or appends the selected fields to it.
+- SID History – Selecting the Overwrite or Append radio button enables this box. Depending on which
+ radio button you select, the action overwrites the SID history with the inserted fields or appends
+ the inserted fields to it. Populate the SID History box using either of the following methods:
+
+ - Select one or more fields at the Insert Field dropdown menu
- Click the **ellipsis (…)** to access the Select Users or Groups window to populate this field
- Reference link – Accesses a Microsoft web page called Using DsAddSidHistory containing important
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/options.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/options.md
index 2ff644ec16..431cfb729f 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/options.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/options.md
@@ -6,14 +6,13 @@ sidebar_position: 30
# Active Directory Action Options
-The Options page provides the option to select to use the default domain or specific a domain to
-use.
+Use the Options page to select the default domain or specify a domain to use.
Use the following options to configure the action:
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then,
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then,
click the blue arrow to insert the item into the **Specify domain (controller) to use** box.
- Use default domain (controller) – Use the default domain controller for the action
- Specify domain (controller) to use – Click the ellipsis to open the Browse for Domain window and
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/overview.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/overview.md
index e3ced73024..7ebef66c05 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/overview.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/overview.md
@@ -11,9 +11,8 @@ Use the Active Directory Action Module to make bulk changes to objects in Micros
Auditor license.
:::warning
-Be careful when using this action module. Make sure that only the changes required are
-applied and only to those target systems desired. Actions perform their functions on all rows in a
-table.
+Be careful when using this action module. Apply only the changes you need, and only to the target
+systems you intend. Actions perform their functions on all rows in a table.
:::
@@ -27,7 +26,7 @@ requirements for the type of data contained in the columns in the source table.
Active Directory object, group, user, or computer, the source table columns must contain values that
uniquely identify each Active Directory object referenced. Active Directory objects correspond to
rows in a Enterprise Auditor source table. Active Directory object attributes correspond to columns.
-Once the source table has been scoped, use the Target page to specify the field that identifies the
+After you scope the source table, use the Target page to specify the field that identifies the
target objects along with the field type to indicate the type of data contained in the field.
The Operations page lists the operations that may be performed by the Active Directory Action
@@ -39,7 +38,7 @@ Module. Each operation may have its own source table column requirements as foll
| Computer Details | No specific columns required |
| Disable/Enable Computers | No specific columns required |
| Create Groups | No specific columns required |
-| Create Users | Column containing the user logon name
**_RECOMMENDED:_** It is recommended that the source table has columns containing the following information: - First Name
- Last name
- Initials
- Full name
- Password
- OU in which to create the user (This can also be created on the Create Users page)
|
+| Create Users | Column containing the user logon name
**_RECOMMENDED:_** The source table should have columns containing the following information: - First Name
- Last name
- Initials
- Full name
- Password
- OU in which to create the user (This can also be created on the Create Users page)
|
| Delete Objects (Users, Groups, Computers, etc.) | No specific columns required |
| Disable/Enable Users | No specific columns required |
| Group Details | No specific columns required |
@@ -67,6 +66,8 @@ introductory and caution information about the Active Directory Action Module.
-The navigation pane contains links to the pages in the wizard. Note that the operations added on the
-Operations page will affect the list of pages in the navigation pane. Several operations have
-associated configuration pages.
+The navigation pane contains links to the pages in the wizard.
+
+:::note
+Operations added on the Operations page affect the list of pages in the navigation pane. Several operations have associated configuration pages.
+:::
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/summary.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/summary.md
index 16c584b531..be4ad14acb 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/summary.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured settings for the action.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Active Directory Action Module Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the Active Directory Action Module Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/action/activedirectory/target.md b/docs/accessanalyzer/11.6/admin/action/activedirectory/target.md
index bc90bf11c5..be0eaa73d3 100644
--- a/docs/accessanalyzer/11.6/admin/action/activedirectory/target.md
+++ b/docs/accessanalyzer/11.6/admin/action/activedirectory/target.md
@@ -9,7 +9,7 @@ sidebar_position: 10
Use the Target (Identification Criteria) page to select one or more fields (columns) in the
Enterprise Auditor source table that uniquely identifies the target Active Directory objects upon
which to perform the action. This process enables Enterprise Auditor to locate those objects within
-Active Directory. Added fields are displayed in the textbox.
+Active Directory. The textbox displays added fields.
@@ -19,12 +19,12 @@ Use the following options to configure the action:
- Delete – Removes the highlighted operation from the Selection pane
- Field – The name of the column in the Enterprise Auditor source table. Select the field that
uniquely identifies the target AD objects (represented by rows in the Enterprise Auditor table).
- The drop-down list displays the fields from the source data table specified on the Action
- Properties page. The list excludes any default fields such as HOSTSTATUS, on which actions cannot
- be performed.
+ The dropdown list displays the fields from the source data table specified on the Action
+ Properties page. The list excludes any default fields such as HOSTSTATUS, on which you can't
+ perform actions.
- Field Type – The type of data contained in the specified field. Enterprise Auditor must know the
- data type of the field selected above. Otherwise, errors may appear upon execution of the action
- and report results may be incomplete. The drop-down list contains the following field types:
+ data type of the selected field. Otherwise, errors may appear upon execution of the action
+ and report results may be incomplete. The dropdown list contains the following field types:
- Distinguished Name or DN
- GUID
@@ -34,7 +34,6 @@ Use the following options to configure the action:
- Employee (employeeID)
:::note
-While one field is usually sufficient to identify AD objects, if specifying multiple
-fields, each field type can only be used once.
-
+While one field is usually sufficient to identify AD objects, if you specify multiple fields, you
+can use each field type only once.
:::
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/action.md b/docs/accessanalyzer/11.6/admin/action/filesystem/action.md
index 9f8b3c0f0c..2d21457d7a 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/action.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/action.md
@@ -6,19 +6,19 @@ sidebar_position: 10
# File System Action: Action
-On the Action page, select the type of action to be configured, define a new action, and additional
+On the Action page, select the type of action to configure, define a new action, and additional
capabilities.
The following options are available:
-- Define a new action – Enables the Operation page where operations are selected on which the action
- is based
-- Rollback a previously executed action – Enables the Prior Actions page where lists of previously
- executed actions and rollback actions can be selected. Not all operations support rollback. Enable
- the Support Rollback option prior to execution for the action in order to perform a rollback.
+- Define a new action – Enables the Operation page, where you select the operations the action is
+ based on
+- Rollback a previously executed action – Enables the Prior Actions page, where you can select lists
+ of previously executed actions and rollback actions. Not all operations support rollback. Enable
+ the Support Rollback option before execution for the action to perform a rollback.
- Remove the applet service from a host – If an executed action installs an applet service on a host
- from a Enterprise Auditor Console, it remains installed after the action is completed for other
- Enterprise Auditor consoles to perform actions using the same applet service. This setting removes
+ from a Enterprise Auditor Console, it remains installed after the action completes so other
+ Enterprise Auditor consoles can perform actions using the same applet service. This setting removes
the action’s applet service from that host.
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/appletsettings.md b/docs/accessanalyzer/11.6/admin/action/filesystem/appletsettings.md
index d29f67bc20..046f63e835 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/appletsettings.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/appletsettings.md
@@ -16,21 +16,21 @@ Specify how the operations will be executed:
- Local Enterprise Auditor server
- Specific remote server:
- - Fields – Use the drop-down list to select a field (column) from the source table, then click
+ - Fields – Use the dropdown list to select a field (column) from the source table, then click
the blue arrow to insert the item into the **Remote server** field
- - Environment Variables – Select an item from the drop-down list, then click the blue arrow to
+ - Environment Variables – Select an item from the dropdown list, then click the blue arrow to
insert the item into the **Remote Server** field
- Remote Server – Enter the path to the server
- Click the **ellipsis (…)** to browse for server
- Click the **tick** icon to show a preview of the path
- Click the **Help** icon for additional information
-- Preview – Shows what the compound path specified will be resolved in to. The text here is used to
- initialize the path specification selection dialog.
+- Preview – Shows what the specified compound path resolves to. The text here initializes the path
+ specification selection dialog.
- Specific remote servers – Click the **ellipsis (…)** to browse for servers
- Click **Add** to add the server
- Click **Remove** to remove the server
-- Fall back to the local Enterprise Auditor server if an applet cannot start – Check to enable this
+- Fall back to the local Enterprise Auditor server if an applet can't start – Check to enable this
option
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/destination.md b/docs/accessanalyzer/11.6/admin/action/filesystem/destination.md
index 5d89170892..832f75a13b 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/destination.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/destination.md
@@ -12,18 +12,18 @@ The Destination page is available only if the following operations are selected:
- Move
- Rename
-Define the destination location of the files that will be copied, moved, or renamed by building the
-destination path using the Fields and Environment Variables options as needed.
+Define the destination location for the files to copy, move, or rename by building the destination
+path using the Fields and Environment Variables options as needed.
-Use the fields provided to select destination items and hosts from the drop-down lists and populate
+Use the fields provided to select destination items and hosts from the dropdown lists and populate
the Destination field, or edit the field manually. The Preview field updates based on the contents
of the Destination field.
-- Fields – Use the drop-down list to select a field (column) from the source table, then click the
+- Fields – Use the dropdown list to select a field (column) from the source table, then click the
blue arrow to insert the item into the **Destination** field
-- Environment Variables – Select an item from the drop-down list, then click the blue arrow to
+- Environment Variables – Select an item from the dropdown list, then click the blue arrow to
insert the item into the **Destination** field
- Target Items – Enter the path to the target file or folder
@@ -31,11 +31,11 @@ of the Destination field.
- Click the **tick** icon to show a preview of the specified path
- Click the **Help** icon for additional information
-- Host – Select the field that identifies the systems or manually type the host destination
+- Host – Select the field that identifies the systems or manually enter the host destination
- Use path type – Choose from the following options:
- Local – Uses the local path
- UNC – Uses the UNC path
-- Preview – Shows what the compound path specified will be resolved in to. The text here is used to
- initialize the file specification selection dialog.
+- Preview – Shows what the specified compound path resolves to. The text here initializes the file
+ specification selection dialog.
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/environment.md b/docs/accessanalyzer/11.6/admin/action/filesystem/environment.md
index 13a5e3f11e..90bf0d3d04 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/environment.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/environment.md
@@ -7,11 +7,11 @@ sidebar_position: 40
# File System Action: Environment
The Environment (Environment Variables) page is available only if the selected operation requires
-the selection of a sample host.
+selecting a sample host.
-Use this page to select and connect to a sample host, via which a set of remote environment
-variables for use in scoping the action are loaded. Then, on the Target page, use the environment
-variables to build dynamic file path locations for the selected operation.
+Use this page to select and connect to a sample host, which loads a set of remote environment
+variables that you use to scope the action. Then, on the Target page, use the environment variables
+to build dynamic file path locations for the selected operation.
:::note
The environment variables from the local system load by default.
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/operation.md b/docs/accessanalyzer/11.6/admin/action/filesystem/operation.md
index 1d12d268f7..c3399755e6 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/operation.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/operation.md
@@ -7,11 +7,11 @@ sidebar_position: 20
# File System Action: Operation
The Operation page is available when **Define a new action** is selected on the Action page. On the
-Operation page, define the action by selecting an operation from the drop-down list.
+Operation page, define the action by selecting an operation from the dropdown list.
-At the Available Operations drop-down selection list, choose the operation for the action to
+At the Available Operations dropdown selection list, choose the operation for the action to
perform. The selection determines which pages are available in the wizard. The following operations
are available:
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/options.md b/docs/accessanalyzer/11.6/admin/action/filesystem/options.md
index 69b5c57a7b..820fc017cc 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/options.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/options.md
@@ -14,50 +14,48 @@ available.
Select from the following additional operations:
-- Delete locked files on reboot – Files that are locked can be queued to be deleted at the next
- system start up
-- Overwrite existing files – Files in the destination location are overwritten. This action cannot
- be undone.
-- Terminate associated process – Files that are locked cannot be actively moved, renamed or deleted
- without stopping the associated process. If selected, this may cause an interruption to any users
- of that target system and service.
-- Create shortcuts to the moved files in the source directory – A shortcut will be created in the
- source directory that points to the new location of a moved file
+- Delete locked files on reboot – Queues locked files for deletion at the next system startup
+- Overwrite existing files – Overwrites files in the destination location. This action can't be
+ undone.
+- Terminate associated process – You can't move, rename, or delete locked files without stopping the
+ associated process. Selecting this option may interrupt any users of that target system and
+ service.
+- Create shortcuts to the moved files in the source directory – Creates a shortcut in the source
+ directory that points to the new location of a moved file
- Preserve file access – Copy the file ACL from the source directory to the destination to preserve
file access. Child objects, with inherited permissions or broken inheritance, targeted by copy or
- move actions retain their permissions. Parent folders with inherited permissions are changed to
- explicit.
-- Enable SACL modification – Request system security access when opening files in order to make SACL
+ move actions retain their permissions. Parent folders with inherited permissions become explicit.
+- Enable SACL modification – Request system security access when opening files to make SACL
changes
- Retry failed rows – Enter the following information:
- Number of times to retry
- - Do not retry error codes – Rows of data with error codes listed within this textbox are
- excluded from the action performed. Common errors are included for certain actions, and may be
- customized to add or remove error codes. See the Microsoft
+ - Don't retry error codes – Excludes rows of data with error codes listed in this textbox from
+ the action performed. The action already includes common error codes for certain actions; you
+ can customize the list to add or remove error codes. See the Microsoft
[System Error Codes](https://docs.microsoft.com/en-us/windows/desktop/Debug/system-error-codes)
article for additional information.
- Delay between retries
- Enable batching – (For big data sets) Enabling batching breaks the data set into batches so the
- action does not attempt to execute all lines at once. Actions performed on tables with a large
- number of input rows may fail due to network failure, and it is difficult to determine the actions
- that were executed before the failure.
+ action doesn't attempt to execute all lines at once. Actions performed on tables with a large
+ number of input rows may fail due to network failure, making it hard to determine which actions
+ ran before the failure.
- Batch size – Specify the batch size.
**Start Process**
-Select the desired start process.
+Select the start process you want.
:::warning
-Due to system security limitations, some applications and programs cannot be restarted
+Due to system security limitations, some applications and programs can't be restarted
or run remotely using this option. Additionally, starting interactive processes (such as Word,
Excel, and so on) will load them into memory, but may not make them available for interaction by the
end user.
:::
-Use the fields provided to select target items and hosts from the drop-down lists and populate the
+Use the fields provided to select target items and hosts from the dropdown lists and populate the
Set working directory field, or edit the field manually. The Preview field updates based on the
contents of the Set working directory field.
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/overview.md b/docs/accessanalyzer/11.6/admin/action/filesystem/overview.md
index 15cf335f21..2de10f6efe 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/overview.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/overview.md
@@ -13,9 +13,8 @@ moving, and renaming file system contents. It is available with a special Enterp
license.
:::warning
-Be careful when using this Action Module. Make sure that only the changes required are
-applied and only to those target systems desired. Actions perform their functions on all rows in a
-table.
+Be careful when using this Action Module. Apply only the changes you need, and only to the target
+systems you intend. Actions perform their functions on all rows in a table.
:::
@@ -61,12 +60,12 @@ is present. Otherwise, applets are deployed to `C:\Program Files (x86)\STEALTHbi
Individual action modules, including File System Action Module, may have their own column
requirements. To take action on a file system resource, the source table must contain a column with
values to uniquely identify it. File System resources correspond to rows in a Enterprise Auditor
-table. File System attributes correspond to columns. Once the source table has been scoped, use the
+table. File System attributes correspond to columns. After you scope the source table, use the
Target page to specify the field that identifies the target attribute along with any environmental
variables.
-These columns are required to use the File System Action Module. Otherwise, errors may occur upon
-execution of the action and with analysis and reports downstream.
+The File System Action Module requires these columns. Otherwise, errors may occur upon execution of
+the action and with analysis and reports downstream.
| Required Columns | Description |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------------- |
@@ -75,11 +74,11 @@ execution of the action and with analysis and reports downstream.
:::tip
Remember, the individual File System actions may have their own column requirements in addition to
-the above. These columns are made available through the File System Action Module wizard.
+these. The File System Action Module wizard makes these columns available.
:::
-The Operations page lists the operations that may be performed by the File System Action Module.
+The Operations page lists the operations that the File System Action Module can perform.
Each operation has its own source table column requirements as follows:
| Operation | Column requirements |
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/addtags.md b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/addtags.md
index b9aca251d5..577e54059b 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/addtags.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/addtags.md
@@ -10,7 +10,7 @@ Use the Parameters page to specify the file tags the action adds.
-Use the fields provided to select tags from the drop-down lists and populate the Tag field, or edit
+Use the fields provided to select tags from the dropdown lists and populate the Tag field, or edit
the field manually. The Preview field updates based on the contents of the Tag field.
- Add Mode:
@@ -19,16 +19,15 @@ the field manually. The Preview field updates based on the contents of the Tag f
- Overwrite existing tags - Removes all existing tags before adding newly configured tags
:::note
-If choosing the option to overwrite tags, the action module will clear out both normal
-tags and Boldon James tags and then proceed to apply the tags configured for overwrite. If choosing
-the option to remove all tags, the action module will clear out both normal tags and Boldon James
-tags.
+If you choose the option to overwrite tags, the action module clears out both normal tags and
+Boldon James tags, then applies the tags configured for overwrite. If you choose the option to
+remove all tags, the action module clears out both normal tags and Boldon James tags.
:::
-- Fields – Use the drop-down list to select a field (column) from the source table, then click the
+- Fields – Use the dropdown list to select a field (column) from the source table, then click the
blue arrow to insert the item into the **Tag** field
-- Environment Variables – Select an item from the drop-down list, then click the blue arrow to
+- Environment Variables – Select an item from the dropdown list, then click the blue arrow to
insert the item into the **Tag** field
- Preview – Shows what the compound path specified will be resolved in to
- Click **Add** to add the tag field to the list
@@ -36,15 +35,14 @@ tags.
-- Type - Select which type of tag to add. The two types of tags that can be added are:
+- Type - Select which type of tag to add. The two types of tags you can add are:
- Regular - Configure new tag as a regular tag
- Boldon James - Configure new tag as a Boldon James tag
:::note
The Boldon James column indicates whether a file tag is a regular tag or a Boldon
- James tag. Regular tags will be identified with **0**. Boldon James tags will be identified
- with **1**.
+ James tag. The column marks regular tags with **0** and Boldon James tags with **1**.
:::
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changeowner.md b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changeowner.md
index fa06f14d31..26642e31d0 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changeowner.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changeowner.md
@@ -12,7 +12,7 @@ Use the Change Owner Parameters page to select a trustee to be the new owner.
Use the options to enter the trustees:
-- Insert field – Use the drop-down list to select a field (column) from the source table, then click
+- Insert field – Use the dropdown list to select a field (column) from the source table, then click
the blue arrow
- Alternatively click **Select** to select a user or group object
- Replace owner on all child objects – Check to enable
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changepermissioninheritance.md b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changepermissioninheritance.md
index 49f7125b62..8e3daa083a 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changepermissioninheritance.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changepermissioninheritance.md
@@ -11,4 +11,4 @@ permissions.
-Select the desired options for adding or removing inheritance.
+Select the options you want for adding or removing inheritance.
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changepermissionsauditing.md b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changepermissionsauditing.md
index 11f629366c..6b1f65d565 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changepermissionsauditing.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changepermissionsauditing.md
@@ -13,7 +13,7 @@ settings the action changes.
Use the following options to enter the Permissions:
-- Insert field – Use the drop-down list to select a field (column) from the source table, then click
+- Insert field – Use the dropdown list to select a field (column) from the source table, then click
the blue arrow
- Group or user names:
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changesharepermissions.md b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changesharepermissions.md
index 5df320491a..bad1482740 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changesharepermissions.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changesharepermissions.md
@@ -11,4 +11,4 @@ users are to be changed.
-Select the desired options for changing the permissions control of the selected group or users.
+Select the options you want for changing the permissions control of the selected group or users.
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/parameters.md b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/parameters.md
index 5ad81ec4bd..95c68d7d42 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/parameters.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/parameters.md
@@ -6,9 +6,9 @@ sidebar_position: 60
# File System Action: Parameters
-The Parameters page is available for some of the selections on the Operation page. The list of
-operations below provides access to the operation-specific versions of the Parameters page for this
-wizard. Click on an operation to view its associated Parameters page.
+The Parameters page is available for some of the selections on the Operation page. The following
+list of operations provides access to the operation-specific versions of the Parameters page for
+this wizard. Click an operation to view its associated Parameters page.
- [Change Attributes](/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changeattributes.md)
- [Change Permissions and Auditing](/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/changepermissionsauditing.md)
@@ -23,4 +23,4 @@ wizard. Click on an operation to view its associated Parameters page.
The Navigation pane will list this as the Parameters page, but the title for each version indicates
-the type of parameter to be configured.
+the type of parameter to configure.
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/removefilepermissions.md b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/removefilepermissions.md
index b99a37adf5..fbbd2156b1 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/removefilepermissions.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/removefilepermissions.md
@@ -13,7 +13,7 @@ removes.
Use the options to enter the Permissions:
-- Insert field – Use the drop-down list to select a field (column) from the source table, then click
+- Insert field – Use the dropdown list to select a field (column) from the source table, then click
the blue arrow
- Group or user names:
- Click **Add** to select a user or group object
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/removesharepermissions.md b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/removesharepermissions.md
index 5d95bcbb10..497fd51ee5 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/removesharepermissions.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/removesharepermissions.md
@@ -13,7 +13,7 @@ removes.
Use the options to enter the Permissions:
-- Insert field – Use the drop-down list to select a field (column) from the source table, then click
+- Insert field – Use the dropdown list to select a field (column) from the source table, then click
the blue arrow
- Group or user names:
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/removetags.md b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/removetags.md
index c3cab4de19..fee0761797 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/removetags.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/parameters/removetags.md
@@ -10,7 +10,7 @@ Use the Parameter page to specify the file tags the action removes.
-Use the fields provided to select tags from the drop-down lists and populate the Tag field, or edit
+Use the fields provided to select tags from the dropdown lists and populate the Tag field, or edit
the field manually. The Preview field updates based on the contents of the Tag field.
- Remove Mode:
@@ -19,32 +19,30 @@ the field manually. The Preview field updates based on the contents of the Tag f
- Remove all tags - Remove all existing tags
:::note
-If choosing the option to overwrite tags, the action module will clear out both normal
-tags and Boldon James tags and then proceed to apply the tags configured for overwrite. If choosing
-the option to remove all tags, the action module will clear out both normal tags and Boldon James
-tags.
+If you choose the option to overwrite tags, the action module clears out both normal tags and
+Boldon James tags, then applies the tags configured for overwrite. If you choose the option to
+remove all tags, the action module clears out both normal tags and Boldon James tags.
:::
-- Fields – Use the drop-down list to select a field (column) from the source table, then click the
+- Fields – Use the dropdown list to select a field (column) from the source table, then click the
blue arrow to insert the item into the **Tag** field
-- Environment Variables – Select an item from the drop-down list, then click the blue arrow to
+- Environment Variables – Select an item from the dropdown list, then click the blue arrow to
insert the item into the **Tag** field
-- Preview – Shows what the compound path specified will be resolved in to
+- Preview – Shows what the specified compound path resolves to
- Click **Add** to add the tag field to the list for removal
- Click **Remove** to remove the tag field from the list for removal
-- Type - Select which type of tag to remove. The two types of tags that can be removed are:
+- Type - Select which type of tag to remove. The two types of tags you can remove are:
- Regular - Specify a regular tag for removal
- Boldon James - Specify a Boldon James tag for removal
:::note
The Boldon James column indicates whether a file tag is a regular tag or a Boldon
- James tag. Regular tags will be identified with **0**. Boldon James tags will be identified
- with **1**.
+ James tag. The column marks regular tags with **0** and Boldon James tags with **1**.
:::
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/rollback.md b/docs/accessanalyzer/11.6/admin/action/filesystem/rollback.md
index bce3530933..dda58f37df 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/rollback.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/rollback.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# File System Action: Rollback
-Use the Rollback page to apply rollback support to the action. This option provides the ability to
+Use the Rollback page to apply rollback support to the action. This option lets you
undo failed actions and reapply the original action settings when the action continues from where it
left off.
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/summary.md b/docs/accessanalyzer/11.6/admin/action/filesystem/summary.md
index 090ff29663..045e3cc310 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/summary.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured action.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the File System Action Module Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the File System Action Module Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/action/filesystem/target.md b/docs/accessanalyzer/11.6/admin/action/filesystem/target.md
index e9e1b0ccee..c89890a574 100644
--- a/docs/accessanalyzer/11.6/admin/action/filesystem/target.md
+++ b/docs/accessanalyzer/11.6/admin/action/filesystem/target.md
@@ -13,13 +13,13 @@ field.
-Use the fields provided to select target items and hosts from the drop-down lists and populate the
+Use the fields provided to select target items and hosts from the dropdown lists and populate the
Target items field, or edit the field manually. The Preview field updates based on the contents of
the Target items field.
-- Fields – Use the drop-down list to select a field (column) from the source table, then click the
+- Fields – Use the dropdown list to select a field (column) from the source table, then click the
blue arrow to insert the item into the **Target items** field
-- Environment Variables – Select an item from the drop-down list, then click the blue arrow to
+- Environment Variables – Select an item from the dropdown list, then click the blue arrow to
insert the item into the Target items field
- Target items – Enter the path to the target file or folder
@@ -27,12 +27,12 @@ the Target items field.
- Click the **tick** icon to show a preview of the specified path
- Click the **Help** icon for additional information
-- Host – Select the field that identifies the systems or manually type the host to take action
+- Host – Select the field that identifies the systems or manually enter the host to take action
against
- Use path type – Choose from the following options:
- Local – Uses the local path
- UNC – Uses the UNC path
-- Preview – Shows what the compound path specified will be resolved in to. The text here is used to
- initialize the file specification selection dialog.
+- Preview – Shows what the specified compound path resolves to. The text here initializes the file
+ specification selection dialog.
diff --git a/docs/accessanalyzer/11.6/admin/action/libraries.md b/docs/accessanalyzer/11.6/admin/action/libraries.md
index a844c4ae40..2d729fdb96 100644
--- a/docs/accessanalyzer/11.6/admin/action/libraries.md
+++ b/docs/accessanalyzer/11.6/admin/action/libraries.md
@@ -6,10 +6,10 @@ sidebar_position: 10
# Action Libraries
-When creating a new action on a job, you have the ability to load action tasks that have been
-preconfigured with table input, script body, and parameters. This helps you:
+When creating a new action on a job, you can load action tasks preconfigured with table input,
+script body, and parameters. This helps you:
-- Perform operations that are not available in one of the out of the box action modules
+- Perform operations that aren't available in the built-in action modules
- Build custom action workflows to satisfy common use cases
- Build custom remediation workflows, such as:
@@ -22,15 +22,15 @@ window with the available Action Libraries and operations:
-When a specific operation within a library is chosen, the action is added in the disabled state to
-the job. The Action Properties page opens, which has a description, action module, and source table
-with relevant filters applied.
+When you choose a specific operation within a library, the wizard adds the action to the job in the
+disabled state. The Action Properties page opens, which has a description, action module, and
+source table with relevant filters applied.
When you click the **Configure Action** link, the action module's wizard opens.
-The following Action Libraries and Templates leverage the PowerShell Action module for running
+The following Action Libraries and Templates use the PowerShell Action module to run
actions within the specific environment:
- Active Directory
@@ -39,14 +39,13 @@ actions within the specific environment:
- SharePoint Online
- Windows
-Prerequisite information for each of the PowerShell scripts is included as part of the script
-comments. Typically, a script requires necessary cmdlets available and installed, as well as
-parameter inputs configured.
+The script comments include prerequisite information for each PowerShell script. Typically, a
+script requires necessary cmdlets available and installed, as well as parameter inputs configured.
## Create a Custom Action Library
You can also create and maintain custom libraries of action tasks for easy reference and use. Once
-you configure an action task as desired, follow the steps to add it to an Action Library.
+you configure an action task as desired, add it to an Action Library:
**Step 1 –** From within the Action Selections view where the custom action tasks exists,
right-click and copy the task.
diff --git a/docs/accessanalyzer/11.6/admin/action/mailbox/affectedmailboxes.md b/docs/accessanalyzer/11.6/admin/action/mailbox/affectedmailboxes.md
index 64ddd3d39d..ba4612bf91 100644
--- a/docs/accessanalyzer/11.6/admin/action/mailbox/affectedmailboxes.md
+++ b/docs/accessanalyzer/11.6/admin/action/mailbox/affectedmailboxes.md
@@ -20,7 +20,7 @@ Select mailboxes to process using the following options:
- Users found in the following column – Select this option to identify users via a data table column
- - Use the drop-down menu to select a data table column containing either the Mailbox display
+ - Use the dropdown menu to select a data table column containing either the Mailbox display
name or email address
- Select a data type for the selected field using the following options:
diff --git a/docs/accessanalyzer/11.6/admin/action/mailbox/delegaterights.md b/docs/accessanalyzer/11.6/admin/action/mailbox/delegaterights.md
index 978fba73ec..3bdeb0e957 100644
--- a/docs/accessanalyzer/11.6/admin/action/mailbox/delegaterights.md
+++ b/docs/accessanalyzer/11.6/admin/action/mailbox/delegaterights.md
@@ -14,7 +14,7 @@ operation.
Set delegate rights using the following options:
-- The following delegate rights can be chosen to access each mailbox folder:
+- Choose one of the following delegate rights to access each mailbox folder:
- None
- Reviewer
@@ -26,13 +26,13 @@ Set delegate rights using the following options:
- Publishing Editor
- Owner
-- Select a right from the drop-down menu of any desired mailbox folder, including:
+- Select a right from the dropdown menu of any desired mailbox folder, including:
- Calendar
:::note
- If Editor or a higher rights level is selected, the **Delegate receives copies of
- meeting-related messages sent to me** option is enabled for selection.
+ If you select Editor or a higher rights level, the wizard enables the **Delegate
+ receives copies of meeting-related messages sent to me** option.
:::
diff --git a/docs/accessanalyzer/11.6/admin/action/mailbox/folderconditions.md b/docs/accessanalyzer/11.6/admin/action/mailbox/folderconditions.md
index 7cb63cc1b7..81fb70b998 100644
--- a/docs/accessanalyzer/11.6/admin/action/mailbox/folderconditions.md
+++ b/docs/accessanalyzer/11.6/admin/action/mailbox/folderconditions.md
@@ -7,7 +7,7 @@ sidebar_position: 60
# Mailbox: Folder Conditions
Use the Folder Conditions page to customize folder search filter conditions. It is a wizard page for
-the **No, the query results do not contain a mailbox identification** column option on the Folder
+the **No, the query results don't contain a mailbox identification** column option on the Folder
Identification page.
@@ -19,7 +19,7 @@ Customize folder search conditions using the following options:
- With specific folder type
- With search terms in the folder name
- - With specific folder(s) to include/exclude
+ - With specific folders to include/exclude
- Edit conditions – Any selected conditions populate here. To modify filter conditions, click the
underlined portion of the condition, which opens a corresponding window.
@@ -27,8 +27,8 @@ Customize folder search conditions using the following options:
## Folder Type Window
Use the Folder Type window to select which folder types to run the action against. The Folder Type
-window opens if **specific** in **with specific folder type** is selected in the Edit Conditions
-box. .
+window opens if you select **specific** in **with specific folder type** in the Edit Conditions
+box.
@@ -46,13 +46,13 @@ Select the checkbox next to any desired folder type to include it in the search
## Search Terms Window
Use the Search Terms window to select terms contained in folder names to run the action against.The
-Search Terms window opens if **search terms** is selected in the Edit Conditions box.
+Search Terms window opens if you select **search terms** in the Edit Conditions box.
Edit the search terms using the following options:
-- To add a term to the search, enter the desired term into the upper text box and click **Add**
+- To add a term to the search, enter the term you want into the upper text box and click **Add**
- To remove a term from the search, select a term in the lower text box and click **Remove**
- Click **Clear** to clear all terms from the lower box
- Select a qualifier option:
@@ -67,8 +67,8 @@ Edit the search terms using the following options:
## Folder Inclusion/Exclusion Window
Use the Folder Inclusion/Exclusion window to select individual folders to add to or remove from the
-action. The Folder Inclusion/Exclusion window opens if **specific** in **with specific folder(s) to
-include/exclude** is selected in the Edit Conditions box.
+action. The Folder Inclusion/Exclusion window opens if you select **specific** in **with specific folders
+to include/exclude** in the Edit Conditions box.
@@ -78,13 +78,13 @@ Include/Exclude folders using the following options:
-- Click the ellipsis (**…**) or enter the path to the desired folder in the text box
-- Scope auto-populates with **This folder**. Click **This folder** to reveal a drop-down menu to
+- Click the ellipsis (**…**) or enter the path to the folder you want in the text box
+- Scope auto-populates with **This folder**. Click **This folder** to reveal a dropdown menu to
select from the following scope options:
- This folder
- This folder and subfolders
- Subfolders only
-- The Remove button becomes enabled once a folder is added to either section. To remove a folder
+- The Remove button becomes enabled after you add a folder to either section. To remove a folder
from the scope, select it and click **Remove**.
diff --git a/docs/accessanalyzer/11.6/admin/action/mailbox/folderidentification.md b/docs/accessanalyzer/11.6/admin/action/mailbox/folderidentification.md
index 00203aca87..864270c9d4 100644
--- a/docs/accessanalyzer/11.6/admin/action/mailbox/folderidentification.md
+++ b/docs/accessanalyzer/11.6/admin/action/mailbox/folderidentification.md
@@ -16,7 +16,7 @@ options:
- Yes, the query results contain a mailbox folder identification column
- - Select the mailbox identification column using the drop-down menu
+ - Select the mailbox identification column using the dropdown menu
- Folder Identifier Type – Choose which mailbox identifier the selected column uses:
- Folder Path and Name – Select this option if the specified field contains a fully
@@ -24,7 +24,7 @@ options:
- Entry ID – Select this option if the selected field is an EntryID that is a unique
identifier for a folder
-- No, the query results do not contain a mailbox folder identification column – Selecting this
+- No, the query results don't contain a mailbox folder identification column – Selecting this
enables the Folder Conditions page, used to identify specific folders to target. See the
[Mailbox: Folder Conditions](/docs/accessanalyzer/11.6/admin/action/mailbox/folderconditions.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/action/mailbox/identification.md b/docs/accessanalyzer/11.6/admin/action/mailbox/identification.md
index 5c1337d4fd..dbeaa14594 100644
--- a/docs/accessanalyzer/11.6/admin/action/mailbox/identification.md
+++ b/docs/accessanalyzer/11.6/admin/action/mailbox/identification.md
@@ -18,7 +18,7 @@ Select which mailboxes to target using the following options:
- Users found in the following column – Select this option to identify users via a data table column
- - Use the drop-down menu to select a data table column containing either the Mailbox display
+ - Use the dropdown menu to select a data table column containing either the Mailbox display
name or email address
- Select a data type for the selected field using the following options:
diff --git a/docs/accessanalyzer/11.6/admin/action/mailbox/messageactions.md b/docs/accessanalyzer/11.6/admin/action/mailbox/messageactions.md
index 2fade6f7b9..93a4e0102a 100644
--- a/docs/accessanalyzer/11.6/admin/action/mailbox/messageactions.md
+++ b/docs/accessanalyzer/11.6/admin/action/mailbox/messageactions.md
@@ -16,8 +16,8 @@ To select a message action, use the following options:
- Select an action – Select the checkbox next to a message action to apply it to the search. The
selected action displays in the Edit Actions box. Possible actions include:
- - Delete – Items can be recovered via the Deleted Contents table (folder dumpster)
- - Permanent Delete – Items are not recoverable
+ - Delete – You can recover items from the Deleted Contents table (folder dumpster)
+ - Permanent Delete – Items aren't recoverable
- Move to Deleted Items folder
- Delete Attachment (Append Text Options) – Deletes attachment and adds **Append Text Options**
to the Edit Conditions box
diff --git a/docs/accessanalyzer/11.6/admin/action/mailbox/messageconditions.md b/docs/accessanalyzer/11.6/admin/action/mailbox/messageconditions.md
index 47a33bcfe6..e5c36d91c7 100644
--- a/docs/accessanalyzer/11.6/admin/action/mailbox/messageconditions.md
+++ b/docs/accessanalyzer/11.6/admin/action/mailbox/messageconditions.md
@@ -13,7 +13,7 @@ for the Delete Mailbox Contents operation.
Customize the folder search conditions using the following options:
-- Message Category – Use the drop-down menu to select a message category
+- Message Category – Use the dropdown menu to select a message category
:::note
Each selection may populate various conditions in the Select Conditions section.
@@ -39,14 +39,14 @@ Customize the folder search conditions using the following options:
- Edit conditions – Any selected conditions populate here
- To edit filter conditions, click the underlined portion of the condition. This opens a
- corresponding window to configure the condition, with the exception of **has attachment(s)**.
+ corresponding window to configure the condition, with the exception of **has attachments**.
- - Clicking **has attachment(s)** changes it to **has no attachment(s** and vice versa
+ - Clicking **has attachments** changes it to **has no attachment(s** and vice versa
## MessageClasses Window
Use the MessageClasses window to select a message class to apply to the scope of the action. The
-MessageClasses window opens if **specific** in **with specific message classes** is selected in the
+MessageClasses window opens if you select **specific** in **with specific message classes** in the
Edit Conditions box.
@@ -57,8 +57,8 @@ Modify message classes using the following options:
-- Click the ellipsis (**…**) or enter the path to the desired folder in the text box
-- Matching Strategy auto-populates with **Exact Match**. Click **Exact Match** to reveal a drop-down
+- Click the ellipsis (**…**) or enter the path to the folder you want in the text box
+- Matching Strategy auto-populates with **Exact Match**. Click **Exact Match** to reveal a dropdown
menu to select from the following scope options:
- Exact Match
@@ -71,8 +71,8 @@ Modify message classes using the following options:
## Data Range Selection Window
Use the Date Range Selection window to determine a time period to scope. The Date Range Selection
-window opens if **in specific date** in either the **that is created in specific date** or **that is
-received in specific date** conditions is selected in the Edit condition box.
+window opens if you select **in specific date** in either the **that is created in specific date**
+or **that is received in specific date** conditions in the Edit condition box.
@@ -86,18 +86,18 @@ To specify a date range, use the following options:
- After
- Between
-- Configure the date range using the textbox or drop-down menus for the selected option
+- Configure the date range using the textbox or dropdown menus for the selected option
## Search Terms Window
Use the Search Terms window to select terms in messages to run the action against. The Search Terms
-window opens if **search terms** in any condition is selected in the Edit Conditions box.
+window opens if you select **search terms** in any condition in the Edit Conditions box.
Edit the search terms using the following options:
-- To add a term to the search, enter the desired term into the upper text box and click **Add**
+- To add a term to the search, enter the term you want into the upper text box and click **Add**
- To remove a term from the search, select a term in the lower text box and click **Remove**
- Click **Clear** to clear all terms from the lower box
- Specify a qualifier option:
@@ -110,11 +110,11 @@ Edit the search terms using the following options:
## Values Window
Use the Values window to add or remove values to or from the search. The Values window opens if
-**specific** in **with specific Message ID** is selected in the Edit Conditions box.
+you select **specific** in **with specific Message ID** in the Edit Conditions box.
-- To add a term to the search, enter the desired term into the upper text box and click **Add**
+- To add a term to the search, enter the term you want into the upper text box and click **Add**
- To remove a term from the search, select a term in the lower text box and click **Remove**
- Click **Clear** to clear all terms from the lower box
- Click **Import CSV** to open a file explorer and select a CSV file to import
diff --git a/docs/accessanalyzer/11.6/admin/action/mailbox/operations.md b/docs/accessanalyzer/11.6/admin/action/mailbox/operations.md
index ff34c3eedf..ff1a54ac36 100644
--- a/docs/accessanalyzer/11.6/admin/action/mailbox/operations.md
+++ b/docs/accessanalyzer/11.6/admin/action/mailbox/operations.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Mailbox: Operations
-Use the Operations page to specify the operation to be performed as part of the action.
+Use the Operations page to specify the operation to perform as part of the action.
diff --git a/docs/accessanalyzer/11.6/admin/action/mailbox/overview.md b/docs/accessanalyzer/11.6/admin/action/mailbox/overview.md
index a76ce5a86a..97cfa08b73 100644
--- a/docs/accessanalyzer/11.6/admin/action/mailbox/overview.md
+++ b/docs/accessanalyzer/11.6/admin/action/mailbox/overview.md
@@ -6,19 +6,18 @@ sidebar_position: 40
# Mailbox Action Module
-The Mailbox action module allows you to perform bulk operations on Microsoft Exchange mailboxes, for
+Use the Mailbox action module to perform bulk operations on Microsoft Exchange mailboxes, for
example deleting mailbox content and modifying permissions and delegates.
:::warning
This action module can add, change, or remove permissions and delegates from an
-environment. Always verify the data and target mailboxes prior to executing any action.
+environment. Always verify the data and target mailboxes before executing any action.
:::
## Mailbox Action Source Table Configuration
-All data tables used in Enterprise Auditor action modules require the presence of certain data
-columns. In addition, individual action modules including Mailbox may have their own column
+All data tables used in Enterprise Auditor action modules require certain data columns. In addition, individual action modules including Mailbox may have their own column
requirements. The Mailbox action module requires a column containing mailbox names.
## Configuration
diff --git a/docs/accessanalyzer/11.6/admin/action/mailbox/permissions.md b/docs/accessanalyzer/11.6/admin/action/mailbox/permissions.md
index 1bd5f22ed1..2188050e3c 100644
--- a/docs/accessanalyzer/11.6/admin/action/mailbox/permissions.md
+++ b/docs/accessanalyzer/11.6/admin/action/mailbox/permissions.md
@@ -11,7 +11,7 @@ Use the Permissions page to determine which permissions to remove. It is a wizar
-Use the following options to add, change or remove Permissions:
+Use the following options to add, change, or remove Permissions:
- User – Specifies user permissions to add or change. To select different users, click the
down-arrow to display the User window. See the [User Window](#user-window) topic for additional
@@ -22,8 +22,8 @@ Use the following options to add, change or remove Permissions:
window. See the [Permission Window](#permission-window) topic for additional information.
- Propagate permissions to child folders – Propagates permissions to the child folders of the
selected folders
-- Once User, Folder, and Permission are selected, click **Add** to add them to the summary of the
- action to be taken
+- After you select User, Folder, and Permission, click **Add** to add them to the summary of the
+ action
- To remove an added Permission, select it in the panel and click **Remove**
## User Window
@@ -37,7 +37,7 @@ Select a user using the following options:
- Users found in the following column – Select this option to identify users via a data table column
- - Use the drop-down menu to select a data table column containing either the Mailbox display
+ - Use the dropdown menu to select a data table column containing either the Mailbox display
name or email address
- Select a data type for the selected field using the following options:
@@ -81,7 +81,7 @@ Select a folder using the following options:
- The list of folders – Select one of the default folders
- - Select a folder from the drop-down menu and click **Add**
+ - Select a folder from the dropdown menu and click **Add**
- To remove a folder, select it and click **Remove**
## Permission Window
@@ -93,9 +93,9 @@ Use the Permission window to specify permissions. The Permission window opens wh
Specify permissions using the following options:
-- Permissions Level – Each permission level has a set of default selections. If a setting is
- changed, the Permissions Level field changes to **Custom**. Permission levels are associated with
- the different permissions available for assignment through Outlook. Options include:
+- Permissions Level – Each permission level has a set of default selections. If you change a
+ setting, the Permissions Level field changes to **Custom**. Permission levels correspond to the
+ different permissions available for assignment through Outlook. Options include:
- None
- Contributor
@@ -131,7 +131,7 @@ Specify permissions using the following options:
- Folder Contact – User receives automated messages about the folder such as replication
conflict messages, requests from users for additional permissions, and other changes to folder
status
- - Folder visible – User can see the folder but cannot read or edit the items within
+ - Folder visible – User can see the folder but can't read or edit the items within
- To add anonymous permissions, choose **None**
diff --git a/docs/accessanalyzer/11.6/admin/action/mailbox/samplinghost.md b/docs/accessanalyzer/11.6/admin/action/mailbox/samplinghost.md
index fa3bbbd762..9b19d95449 100644
--- a/docs/accessanalyzer/11.6/admin/action/mailbox/samplinghost.md
+++ b/docs/accessanalyzer/11.6/admin/action/mailbox/samplinghost.md
@@ -16,17 +16,17 @@ Select an Exchange server to target using the following options:
- Select the **Use Global Setting** checkbox to query the global Exchange setting
- Use the radio buttons to select a specific host
- System Attendant (2003 & 2007) – Audits Microsoft Exchange 2007 or older versions
-- Use the mailbox associated with the Windows account that Enterprise Auditor is run with – Uses
+- Use the mailbox associated with the Windows account under which Enterprise Auditor runs – Uses
either the account logged into the Enterprise Auditor Console server or the account set to run the
Enterprise Auditor application to access the Exchange mailbox
-- Exchange Mailbox (2010 and newer) – Allows Exhange Mailbox Alias to be specified for MAPI
+- Exchange Mailbox (2010 and newer) – Allows specifying an Exchange Mailbox Alias for MAPI
connections
- - When Exchange Mailbox (2010 and newer) is selected, the textbox is enabled. Enter the Alias
- name in the textbox. The Alias needs to be an Exchange 2010 or newer mailbox, not a
- mail-enabled service account. However, this mailbox does not need rights on the Exchange
+ - When you select Exchange Mailbox (2010 and newer), the textbox becomes enabled. Enter the
+ Alias name in the textbox. The Alias needs to be an Exchange 2010 or newer mailbox, not a
+ mail-enabled service account. However, this mailbox doesn't need rights on the Exchange
Organization; it only needs to reside within it.
- Client Access Server – Enter the name of the physical CAS in the textbox. This server can be
part of an array, but do enter the name of a CAS Array. This should also be the Exchange CAS
- where both Remote PowerShell and Windows Authentication on the PowerShell Virtual Directory
- have been enabled.
+ where you've enabled both Remote PowerShell and Windows Authentication on the PowerShell
+ Virtual Directory.
diff --git a/docs/accessanalyzer/11.6/admin/action/mailbox/trustedusers.md b/docs/accessanalyzer/11.6/admin/action/mailbox/trustedusers.md
index ceaeb397ef..6984333bb0 100644
--- a/docs/accessanalyzer/11.6/admin/action/mailbox/trustedusers.md
+++ b/docs/accessanalyzer/11.6/admin/action/mailbox/trustedusers.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# Mailbox: Trusted Users
-Use the Trusted Users page to select delegates to add. Users can be added individually or from a
+Use the Trusted Users page to select delegates to add. You can add users individually or from a
server with a mailbox environment. It is a wizard page for the following operations:
- Add Delegates
@@ -18,7 +18,7 @@ Select Trusted User delegates using the following options:
- Users found in the following column – Select this option to identify users via a data table column
- - Use the drop-down menu to select a data table column containing either the Mailbox display
+ - Use the dropdown menu to select a data table column containing either the Mailbox display
name or email address
- Select a data type for the selected field using the following options:
@@ -50,7 +50,6 @@ The following additional options are available for the Remove Delegates operatio
- Remove Permissions from Child Folders – Removes permissions from child folders
:::note
- This option is only enabled if the **Remove Permissions for Delegate** option is
- selected.
-
+ This option is only enabled if you select the **Remove Permissions for Delegate**
+ option.
:::
diff --git a/docs/accessanalyzer/11.6/admin/action/overview.md b/docs/accessanalyzer/11.6/admin/action/overview.md
index 262977833c..430f737a6f 100644
--- a/docs/accessanalyzer/11.6/admin/action/overview.md
+++ b/docs/accessanalyzer/11.6/admin/action/overview.md
@@ -11,8 +11,8 @@ Enterprise Auditor. This overview topic describes the basic procedure for creati
action module as well the initial steps to take when configuring an action. Each action module is
described in detail in the relevant topics.
-The Enterprise Auditor actions are capable of changing users, permissions, files, and objects from a
-variety of environments. Action modules are assigned to a job at the **Configure** > **Actions**
+Enterprise Auditor actions can change users, permissions, files, and objects from a variety of
+environments. Action modules are assigned to a job at the **Configure** > **Actions**
node. See the
[Actions Node](/docs/accessanalyzer/11.6/admin/jobs/job/configure/actions.md)
topic for additional information on the Action Selection view.
@@ -22,7 +22,7 @@ topic for additional information on the Action Selection view.
Configure the action through the Action Properties page. Navigate to the job’s **Configure** >
**Actions** node. Select **Create Action** to add a new action task to a job. Select an existing
action and click **Action Properties** to modify its configuration. The Action Properties page opens
-for either option. Pre-configured action tasks can be added from the Action Library. See the
+for either option. You can add pre-configured action tasks from the Action Library. See the
[Action Libraries](/docs/accessanalyzer/11.6/admin/action/libraries.md)
topic for additional information.
@@ -54,7 +54,7 @@ while the SendMail Action Module can send an email to a dynamic list of users.
The basic procedure consists of the following steps.
-**Step 1 –** Create a data table containing the target objects to be modified and exclude any
+**Step 1 –** Create a data table containing the target objects to modify and exclude any
extraneous columns.
**Step 2 –** Configure an action task using the configuration wizard for the selected action module.
@@ -64,9 +64,8 @@ Target the selected objects and apply selected operations to the data.
### Executing Actions
-Actions with the checkbox next to their name selected in the Action Selection view are executed
-automatically as part of the job’s execution. The actions are executed in the order in which they
-appear in the Selection table. You can also manually execute selected actions without running the
+The job automatically executes actions with the checkbox next to their name selected in the Action
+Selection view. It executes the actions in the order they appear in the Selection table. You can also manually execute selected actions without running the
job by clicking on the **Action Execute** link on the Action Selection view.
## Caution on Action Modules
@@ -74,15 +73,14 @@ job by clicking on the **Action Execute** link on the Action Selection view.
:::warning
Enterprise Auditor action modules apply bulk changes to targeted objects within the
target environment. Actions perform operations on selected objects listed in each row of the source
-table. Exercise caution to ensure the action applies only the desired changes and only to the
-desired target objects.
+table. Exercise caution to ensure the action applies only to the changes and target objects you want.
:::
:::info
-Prior to configuring the action module, scope the source data table to include
-only the desired data. It is also recommended to run the action in a test environment before making
-changes to a production environment.
+Before configuring the action module, scope the source data table to include
+only the data you want. Also run the action in a test environment before making changes to a
+production environment.
:::
@@ -101,7 +99,7 @@ created action tasks.
- Name – Action task name. For new actions, an editable default name displays.
- Description – Action task description. For new actions, this editable field is blank.
-- Action Module – Drop-down menu of available action modules
+- Action Module – dropdown menu of available action modules
- Configure Action – Opens the configuration wizard for the selected action module
@@ -113,7 +111,7 @@ created action tasks.
- ID – Unique identifier, or GUID, of the action task generated by the application. With this ID,
the database can distinguish actions, even those with identical configurations.
- Data Grid – Displays a sample of the selected Source table. This data grid functions the same as
- all data grids within Enterprise Auditor. Data can be filtered, and columns can be regrouped. See
+ all data grids within Enterprise Auditor. You can filter data and regroup columns. See
the
[Data Grid Functionality](/docs/accessanalyzer/11.6/admin/navigate/datagrid.md)
topic for additional information.
@@ -134,20 +132,20 @@ analysis and reports downstream.
| RowKey | Identifies each data row as unique. Sometimes the value is a GUID, but the datatype in the table is a varchar (text string). |
:::tip
-Remember, the individual action modules may have their own column requirements in addition to the
-above.
+Remember, the individual action modules may have their own column requirements in addition to
+these.
:::
#### Data Tables
-Enterprise Auditor native data tables generally contain all of the above columns. However, if all
-required columns are not present by default, add them manually.
+Enterprise Auditor native data tables generally contain all of these columns. However, if all
+required columns aren't present by default, add them manually.
:::warning
-Do not use native data tables in action modules. Source data tables in actions should
+Don't use native data tables in action modules. Source data tables in actions should
include only the data desired for the operation. Scope the data tables to include only the required
-columns prior to configuring the action.
+columns before configuring the action.
:::
diff --git a/docs/accessanalyzer/11.6/admin/action/powershell/executionoptions.md b/docs/accessanalyzer/11.6/admin/action/powershell/executionoptions.md
index c0a45771a3..d9c041965e 100644
--- a/docs/accessanalyzer/11.6/admin/action/powershell/executionoptions.md
+++ b/docs/accessanalyzer/11.6/admin/action/powershell/executionoptions.md
@@ -21,8 +21,8 @@ The options on the Execution Options page are:
- Execute script remotely on a target server – Enable this to execute the PowerShell script on a
remote target server
- - Use the **Remote host** dropdown to select the database column that will be used as the target
- server name or type in a network host name
+ - Use the **Remote host** dropdown to select the database column to use as the target server
+ name, or type in a network host name
- Select the **Fall back to the local Enterprise Auditor server if the remote execution fails**
option to use the Enterprise Auditor server if remote execution fails
diff --git a/docs/accessanalyzer/11.6/admin/action/powershell/overview.md b/docs/accessanalyzer/11.6/admin/action/powershell/overview.md
index 9d218aa1c7..fd880a22ec 100644
--- a/docs/accessanalyzer/11.6/admin/action/powershell/overview.md
+++ b/docs/accessanalyzer/11.6/admin/action/powershell/overview.md
@@ -10,8 +10,7 @@ The PowerShell action module provides methods of running PowerShell scripts on t
on remote hosts. Define PowerShell scripting actions using the PowerShell Action Module Wizard.
:::warning
-Ensure that only the changes required are applied and only to those target systems
-desired.
+Apply only the changes you need, and only to the target systems you intend.
:::
diff --git a/docs/accessanalyzer/11.6/admin/action/powershell/script.md b/docs/accessanalyzer/11.6/admin/action/powershell/script.md
index 05c2909a94..6a041b6f82 100644
--- a/docs/accessanalyzer/11.6/admin/action/powershell/script.md
+++ b/docs/accessanalyzer/11.6/admin/action/powershell/script.md
@@ -6,15 +6,15 @@ sidebar_position: 10
# PowerShell Action: Script
-The Script page enables you to input the PowerShell script that will be used to perform the
+Use the Script page to input the PowerShell script that performs the
requested action. Built-in variables are available for use in the script.
-The PowerShell script can be entered manually into the Script window at the top of the Script page.
+You can enter the PowerShell script manually into the Script window at the top of the Script page.
To open a pre-existing PowerShell script from a file, click **Open** to select the script file.
-At the bottom of the page are three tabs that can be used to configure the PowerShell action module
+Use the three tabs at the bottom of the page to configure the PowerShell action module
further. The tabs are:
- [Columns](#columns)
@@ -27,7 +27,7 @@ Use the Columns tab to select the available columns.
-The table in the Columns tab displays the Columns that can be used for the PowerShell script. To use
+The table in the Columns tab displays the columns you can use for the PowerShell script. To use
a Column, select the checkbox under the **Use** column.
@@ -53,7 +53,7 @@ The options are:
- Delete – Delete a selected parameter
:::note
-The built-in default parameters cannot be edited or deleted.
+You can't edit or delete the built-in default parameters.
:::
diff --git a/docs/accessanalyzer/11.6/admin/action/publicfolder/action.md b/docs/accessanalyzer/11.6/admin/action/publicfolder/action.md
index bb5dbd2887..a12f58d459 100644
--- a/docs/accessanalyzer/11.6/admin/action/publicfolder/action.md
+++ b/docs/accessanalyzer/11.6/admin/action/publicfolder/action.md
@@ -10,8 +10,8 @@ The Action page specifies the basic action to perform on public folders. The pag
selection in the Steps pane adjust based on this selection.
:::note
-Once an action is selected and saved, and the wizard is closed, this page is no longer
-available and the selection cannot be altered.
+After you select and save an action and close the wizard, this page is no longer available, and
+you can't alter the selection.
:::
@@ -19,9 +19,9 @@ available and the selection cannot be altered.
Choose from the following actions:
-- Define a new action – Enables the Operation page where the operation on which the action is based
- is selected
-- Rollback a previously executed action – Enables the Prior Actions page where a list of previously
- executed actions is displayed and a selected action may be rolled back. Not all operations support
- rollback, and the Support Rollback option must be enabled prior to execution for the action to be
- eligible for rollback.
+- Define a new action – Enables the Operation page, where you select the operation the action is
+ based on
+- Rollback a previously executed action – Enables the Prior Actions page, which displays a list of
+ previously executed actions and lets you roll back a selected action. Not all operations support
+ rollback. Enable the Support Rollback option before execution to make the action eligible for
+ rollback.
diff --git a/docs/accessanalyzer/11.6/admin/action/publicfolder/folders.md b/docs/accessanalyzer/11.6/admin/action/publicfolder/folders.md
index c0696f87cf..6f932804c2 100644
--- a/docs/accessanalyzer/11.6/admin/action/publicfolder/folders.md
+++ b/docs/accessanalyzer/11.6/admin/action/publicfolder/folders.md
@@ -17,8 +17,8 @@ The options on this page are:
- Field – Column names
:::note
- The displayed fields vary depending on the Source Table selected during the
- creation of the new action
+ The displayed fields vary depending on the Source Table selected when you create
+ the new action.
:::
diff --git a/docs/accessanalyzer/11.6/admin/action/publicfolder/mapisettings.md b/docs/accessanalyzer/11.6/admin/action/publicfolder/mapisettings.md
index a9772d6738..5320c8e34d 100644
--- a/docs/accessanalyzer/11.6/admin/action/publicfolder/mapisettings.md
+++ b/docs/accessanalyzer/11.6/admin/action/publicfolder/mapisettings.md
@@ -16,6 +16,6 @@ Use the following options to configure the action:
- System Attendant (2003 & 2007)
- Use the mailbox associated with the Windows account on which Enterprise Auditor is run
- Exchange Mailbox (2010 and newer) – If targeting a 2010 Exchange Server, specify the CAS server.
- This is also where the MAPI setting is selected.
+ This is also where you select the MAPI setting.
- Client Access Server – Enter the Domain Name in this field
diff --git a/docs/accessanalyzer/11.6/admin/action/publicfolder/operations.md b/docs/accessanalyzer/11.6/admin/action/publicfolder/operations.md
index 70aa217f55..8e9d816954 100644
--- a/docs/accessanalyzer/11.6/admin/action/publicfolder/operations.md
+++ b/docs/accessanalyzer/11.6/admin/action/publicfolder/operations.md
@@ -10,8 +10,8 @@ Use the Operations page to specify the operations to perform as part of the acti
-The **Add operation** drop-down menu lists the operations that can be performed. Each operation
-opens a corresponding window. Operations include:
+The **Add operation** dropdown menu lists the operations you can perform. Each operation opens a
+corresponding window. Operations include:
- Rename – See the [Rename Folder Window](#rename-folder-window) topic for additional information
- Change permissions – See the [Change Permissions Window](#change-permissions-window) topic for
@@ -22,9 +22,9 @@ opens a corresponding window. Operations include:
- Limits – See the [Limits Window](#limits-window) topic for additional information
- Delete – See the [Delete Folder Window](#delete-folder-window) topic for additional information
-The buttons to the right of the drop-down control the operations in the field:
+The buttons to the right of the dropdown control the operations in the field:
-- Edit – Allows you to alter operation settings
+- Edit – Alters operation settings
- Add – Places selected operation one step above its current position
- Down – Places selected operation one step below its current position
- Delete – Removes a selected operation
@@ -66,7 +66,7 @@ Change permissions using the following options:
- Mode – Select whether to change or remove permissions
- Permissions – Determine Permission level and assign permissions to the user
- - Permission level – Use the drop-down menu to select a permission level from the following:
+ - Permission level – Use the dropdown menu to select a permission level from the following:
- Reviewer
- Contributor
@@ -84,20 +84,20 @@ Change permissions using the following options:
- Read items – User can read items
- Create Subfolders – User can create subfolders
- Folder owner – User can view and move the public folder, create subfolders, and set
- permissions for the folder, but cannot read, edit, delete, or create items
+ permissions for the folder, but can't read, edit, delete, or create items
- Folder contact – Set user as the contact for the specified public folder
- - Folder visible – User can view the specified public folder but cannot read or edit the
+ - Folder visible – User can view the specified public folder but can't read or edit the
items within
:::note
- Different permissions become automatically selected based on which permission
- level is selected. To override this default, select the checkbox of the unwanted permission
- to deselect it. If a desired checkbox is blocked by a black square, click the square to
- unblock the checkbox. The checkbox can then be selected or unselected.
+ Selecting a permission level automatically selects different permissions. To
+ override this default, select the checkbox of the unwanted permission to deselect it. If a
+ black square blocks a desired checkbox, click the square to unblock the checkbox. You can
+ then select or unselect the checkbox.
:::
- - Edit items – Use the drop-down menu to determine user editing permissions from the following:
+ - Edit items – Use the dropdown menu to determine user editing permissions from the following:
- No change
- None
@@ -106,7 +106,7 @@ Change permissions using the following options:
- Own only
- All
- - Delete items – Use the drop-down menu to determine user deletion permissions from the
+ - Delete items – Use the dropdown menu to determine user deletion permissions from the
following:
- No change
@@ -145,11 +145,12 @@ Use the Replicas window to replicate servers. It is a wizard page for the Replic
Replicate servers using the following options:
-- Select a server from the dropdown menu and click **Add**. The servers listed will be replicated.
+- Select a server from the dropdown menu and click **Add**. The action replicates the servers
+ listed.
- Select a server from the list and click **Delete** to remove it from the list of replicated
servers
-- Select the **Remove last replica** option to delete the replica created when the action was last
- run
+- Select the **Remove last replica** option to delete the replica created the last time the action
+ ran
## Limits Window
@@ -182,5 +183,5 @@ Select deletion settings using the following options:
- Optionally, select a checkbox to apply any exception
- - Do not delete folders with subfolders
- - Do not delete folders with content
+ - Don't delete folders with subfolders
+ - Don't delete folders with content
diff --git a/docs/accessanalyzer/11.6/admin/action/publicfolder/overview.md b/docs/accessanalyzer/11.6/admin/action/publicfolder/overview.md
index 3e4d0f4c91..f50777173b 100644
--- a/docs/accessanalyzer/11.6/admin/action/publicfolder/overview.md
+++ b/docs/accessanalyzer/11.6/admin/action/publicfolder/overview.md
@@ -6,24 +6,22 @@ sidebar_position: 60
# PublicFolder Action Module
-The Public Folder action module allows users to make bulk changes to selected Microsoft Exchange
+Use the Public Folder action module to make bulk changes to selected Microsoft Exchange
public folders by adding, changing, or removing folders and permissions from the environment. Use
the Pubic Folder Action Module Wizard to choose the data table column that identifies the folders
and to configure the operations performed against the selected folders.
-Prior to configuring the Pubic Folder Action Module Wizard, scope the source data table to ensure
-the actions apply only to the desired folders.
+Before configuring the Public Folder Action Module Wizard, scope the source data table to ensure
+the actions apply only to the folders you want.
:::warning
-Be careful when using this action module. Make sure that only the changes required are
-applied and only to those target folders desired. Always verify the data prior to execution of any
-action.
+Be careful when using this action module. Apply only the changes you need, and only to the
+target folders you intend. Always verify the data before executing any action.
:::
:::info
-Although rollbacks for some actions are available, having to use one should be
-avoided
+Although rollbacks are available for some actions, avoid relying on them.
:::
diff --git a/docs/accessanalyzer/11.6/admin/action/publicfolder/prioractions.md b/docs/accessanalyzer/11.6/admin/action/publicfolder/prioractions.md
index a1a29f42e7..69b6009030 100644
--- a/docs/accessanalyzer/11.6/admin/action/publicfolder/prioractions.md
+++ b/docs/accessanalyzer/11.6/admin/action/publicfolder/prioractions.md
@@ -10,8 +10,8 @@ The Prior Actions page selects previously executed actions for rollback. It is a
**Rollback a previously executed action** is selected on the Action page.
:::note
-Once an action is selected and saved, and the wizard is closed, this page is no longer
-available and the selection cannot be altered.
+After you select and save an action and close the wizard, this page is no longer available, and
+you can't alter the selection.
:::
diff --git a/docs/accessanalyzer/11.6/admin/action/publicfolder/rollback.md b/docs/accessanalyzer/11.6/admin/action/publicfolder/rollback.md
index f4f6155ac4..81b1ebbb12 100644
--- a/docs/accessanalyzer/11.6/admin/action/publicfolder/rollback.md
+++ b/docs/accessanalyzer/11.6/admin/action/publicfolder/rollback.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# Public Folder: Rollback
-Use the Rollback page to enable rollback capabilities for the action. If rollback isn’t selected at
-this step, the applied operations cannot be rolled back after execution of the action module.
+Use the Rollback page to enable rollback capabilities for the action. If you don't select rollback
+at this step, you can't roll back the applied operations after execution of the action module.
diff --git a/docs/accessanalyzer/11.6/admin/action/publicfolder/summary.md b/docs/accessanalyzer/11.6/admin/action/publicfolder/summary.md
index e93c5f1c56..d9bfa54ad9 100644
--- a/docs/accessanalyzer/11.6/admin/action/publicfolder/summary.md
+++ b/docs/accessanalyzer/11.6/admin/action/publicfolder/summary.md
@@ -10,6 +10,5 @@ The Summary page summarizes the configuration of the action.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Public Folder Action Module Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the Public Folder Action Module Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/action/registry/operations.md b/docs/accessanalyzer/11.6/admin/action/registry/operations.md
index 2243484cb3..e6f6d6bc5e 100644
--- a/docs/accessanalyzer/11.6/admin/action/registry/operations.md
+++ b/docs/accessanalyzer/11.6/admin/action/registry/operations.md
@@ -14,11 +14,11 @@ for additional information.
Select and configure the operations using the following options:
-- Add operation – Use the drop-down menu to select an operation to perform on the target host. This
+- Add operation – Use the dropdown menu to select an operation to perform on the target host. This
opens a corresponding window for configuration. Operations include:
:::note
- Window options vary based on the operation selected from the drop-down menu.
+ Window options vary based on the operation selected from the dropdown menu.
:::
@@ -45,12 +45,12 @@ Select a key using the following options:
- Computer name – By default, the Registry browser connects to the local machine
- - If the desired registry item is on the local machine, browse the registry, and select the item
+ - If the registry item you want is on the local machine, browse the registry, and select the item
- To connect to the registry of another machine:
- Enter the hostname in the **Computer name** textbox
- Click **Connect**, then browse the registry of that machine
- - Select the desired registry item
+ - Select the registry item you want
- Connect – Attempts to connect to the registry of the machine specified in the **Computer name**
field
@@ -65,14 +65,14 @@ Use the Select Users or Groups window to select a user, group, or built-in secur
The options are:
-- Select this object type – Displays types that are queried against
+- Select this object type – Displays types to query against
- Click **Object Types** to open the Object Types window and select the types to query against.
See the [Object Types Window](#object-types-window) topic for additional information.
-- From this location – Displays the location the intended objects are found
+- From this location – Displays the location where the intended objects reside
- - Click **Locations** to open the Locations window and set the location to be queried. See the
+ - Click **Locations** to open the Locations window and set the location to query. See the
[Locations Window](#locations-window) topic for additional information.
- Enter the object names to select – Select names of objects to query
@@ -127,8 +127,8 @@ following additional options:
- Columns – Click **Columns** to open the Choose Columns window. See the
[Choose Columns Window](#choose-columns-window) topic for additional information.
- Find now – Click **Find Now** to search for objects matching the selected criteria
-- Stop – While a search is running , the **Stop** button is available. Click **Stop** to halt the
- search before it is completed.
+- Stop – While a search is running, the **Stop** button is available. Click **Stop** to halt the
+ search before it completes.
- Search Results – Displays results from a search
#### Choose Columns Window
diff --git a/docs/accessanalyzer/11.6/admin/action/registry/overview.md b/docs/accessanalyzer/11.6/admin/action/registry/overview.md
index b54d0144c6..6aa1b5399a 100644
--- a/docs/accessanalyzer/11.6/admin/action/registry/overview.md
+++ b/docs/accessanalyzer/11.6/admin/action/registry/overview.md
@@ -6,13 +6,13 @@ sidebar_position: 70
# Registry Action Module
-The Registry action module allows users to make bulk changes to the Microsoft Windows Registry. Use
+Use the Registry action module to make bulk changes to the Microsoft Windows Registry. Use
the Registry Action Module Wizard to choose the data table column that identifies the folders and to
configure the operations performed against the selected folders. The Registry action module requires
-a column containing the hosts to be targeted.
+a column containing the hosts to target.
-Prior to configuring the Registry Action Module Wizard, scope the source data table to ensure the
-actions apply only to the desired hosts.
+Before configuring the Registry Action Module Wizard, scope the source data table to ensure the
+actions apply only to the hosts you want.
:::warning
Unexpected values in the registry can cause major system failures when deleting or
@@ -28,10 +28,9 @@ module.
## Registry Action Source Table Configuration
-All data tables used in Enterprise Auditor action modules require the presence of certain data
-columns. In addition, individual action modules including Registry may have their own column
-requirements. The Registry action module requires a column containing the hosts that are going to be
-targeted.
+All data tables used in Enterprise Auditor action modules require certain data columns. In
+addition, individual action modules including Registry may have their own column requirements. The
+Registry action module requires a column containing the hosts to target.
## Configuration
diff --git a/docs/accessanalyzer/11.6/admin/action/registry/summary.md b/docs/accessanalyzer/11.6/admin/action/registry/summary.md
index 34296427d6..f85a233694 100644
--- a/docs/accessanalyzer/11.6/admin/action/registry/summary.md
+++ b/docs/accessanalyzer/11.6/admin/action/registry/summary.md
@@ -10,6 +10,5 @@ The Summary page summarizes the configuration of the action.
-When done configuring the action, click **Finish**. If no changes were made, it is a best practice
-to click **Cancel** to close the Registry Action Module Wizard to ensure that no accidental clicks
-are saved.
+When done configuring the action, click **Finish**. If you made no changes, click **Cancel** instead
+to close the Registry Action Module Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/action/registry/targethosts.md b/docs/accessanalyzer/11.6/admin/action/registry/targethosts.md
index 74b13179cf..651da3298b 100644
--- a/docs/accessanalyzer/11.6/admin/action/registry/targethosts.md
+++ b/docs/accessanalyzer/11.6/admin/action/registry/targethosts.md
@@ -11,6 +11,6 @@ alters.
-Use the drop-down menu to select the field that identifies the systems to be targeted. The list
-displays columns from the specified source table. The action applies the specified operations to all
+Use the dropdown menu to select the field that identifies the systems to target. The list displays
+columns from the specified source table. The action applies the specified operations to all
systems in the field.
diff --git a/docs/accessanalyzer/11.6/admin/action/sendmail/message.md b/docs/accessanalyzer/11.6/admin/action/sendmail/message.md
index 924a56476e..a5f564895e 100644
--- a/docs/accessanalyzer/11.6/admin/action/sendmail/message.md
+++ b/docs/accessanalyzer/11.6/admin/action/sendmail/message.md
@@ -15,8 +15,8 @@ Use the following fields to specify the text of the email:
- Subject – Specify a subject for the email. The contents of this field displays as the subject line
of the delivered email. Enter text directly and optionally use the Insert field to insert one or
more data fields. This is a required field.
-- Insert Field – Inserts a data field into the subject or body of the email. The drop-down menu
- displays a list of available fields. Once a selection displays in the field, click on the blue Up
+- Insert Field – Inserts a data field into the subject or body of the email. The dropdown menu
+ displays a list of available fields. Once a selection displays in the field, click the blue Up
and Down arrows to insert the field into the body or the subject, respectively. This field is
optional.
- Show sample input source data – To display a table of sample source data, click the icon next to
@@ -54,7 +54,7 @@ Use the following fields to specify the text of the email:
## Text Entry Box
-The Text Entry box allows you to compose a message. A Microsoft Word-style editor provides
+Use the Text Entry box to compose a message. A Microsoft Word-style editor provides
formatting options including the ability to insert dynamic text from the specified table (such as a
username) through the Insert field option. Use the editor to personalize the content and appearance
of each message.
@@ -62,13 +62,13 @@ of each message.
Example:
Assume the source table includes a column containing the names of intended recipients. Place the
-cursor in the greeting section of the email. Next, select that field from the Insert field drop-down
+cursor in the greeting section of the email. Next, select that field from the Insert field dropdown
list and click the down arrow to insert a dynamic field. The column name appears in the Text Entry
box, enclosed by brackets:
Dear [ProbableOwner];
-You are approaching your Mailbox storage quota. Please clean up any unneeded items.
+You are approaching your Mailbox storage quota. clean up any unneeded items.
**Thank you,**
diff --git a/docs/accessanalyzer/11.6/admin/action/sendmail/overview.md b/docs/accessanalyzer/11.6/admin/action/sendmail/overview.md
index 6373ff339b..5032254031 100644
--- a/docs/accessanalyzer/11.6/admin/action/sendmail/overview.md
+++ b/docs/accessanalyzer/11.6/admin/action/sendmail/overview.md
@@ -16,15 +16,15 @@ The SendMail Action Module has multiple uses, for example:
workflow to contact clients and solicit feedback for use in the decision-making process
:::warning
-This module sends one or more electronic messages to a selected audience. Prior to
-executing the action, ensure the audience consists of only the desired members.
+This module sends one or more electronic messages to a selected audience. Before
+executing the action, ensure the audience consists of only the members you want.
:::
## Source Table Configuration
-All data tables used in Enterprise Auditor action modules require the presence of certain data
-columns. In addition, individual action modules including SendMail may have their own column
+All data tables used in Enterprise Auditor action modules require certain data columns. In
+addition, individual action modules including SendMail may have their own column
requirements. The SendMail Action Module requires a column containing well-formatted email addresses
(for example, `hfinn@netwrix.com`) for your recipients.
diff --git a/docs/accessanalyzer/11.6/admin/action/sendmail/properties.md b/docs/accessanalyzer/11.6/admin/action/sendmail/properties.md
index 4fca40536f..8b0d1b3a89 100644
--- a/docs/accessanalyzer/11.6/admin/action/sendmail/properties.md
+++ b/docs/accessanalyzer/11.6/admin/action/sendmail/properties.md
@@ -12,16 +12,16 @@ Use the Properties page to specify the recipients of the email.
Use the following fields to specify the recipient information:
-- Recipient column – Use the drop-down menu to specify the column from the data table containing
+- Recipient column – Use the dropdown menu to specify the column from the data table containing
intended recipients, for example a column containing email addresses
-- Recipient type – Use the drop-down menu to specify the data type of the Recipient column, for
+- Recipient type – Use the dropdown menu to specify the data type of the Recipient column, for
example SMTP mail address
- Carbon copy (CC) – Optionally, specify one or more additional email addresses to receive a
carbon-copy of the SendMail message, for example an address not included in the source table.
- Use the following email address – Enter one or more additional email addresses. Separate
multiple addresses with a semi-colon and a space.
- - Use a column from the table – Use the drop-down menu to specify a column from the data table
+ - Use a column from the table – Use the dropdown menu to specify a column from the data table
- Combine multiple messages into a single message when all recipients are the same – Select this
checkbox to send only one message to each recipient as a result of this action (even recipients
diff --git a/docs/accessanalyzer/11.6/admin/action/sendmail/summary.md b/docs/accessanalyzer/11.6/admin/action/sendmail/summary.md
index 3ddd53330b..a9b39d99ac 100644
--- a/docs/accessanalyzer/11.6/admin/action/sendmail/summary.md
+++ b/docs/accessanalyzer/11.6/admin/action/sendmail/summary.md
@@ -10,9 +10,8 @@ The Summary page displays the SendMail configuration.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Send Mail Action Module Wizard to ensure that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the Send Mail Action Module Wizard without saving accidental clicks.
To view the status of executed SendMail actions, see the
[Viewing the Status of SendMail Actions](/docs/accessanalyzer/11.6/admin/action/sendmail/viewstatus.md)
diff --git a/docs/accessanalyzer/11.6/admin/action/sendmail/viewstatus.md b/docs/accessanalyzer/11.6/admin/action/sendmail/viewstatus.md
index 60f8b5ef94..c04c14e46c 100644
--- a/docs/accessanalyzer/11.6/admin/action/sendmail/viewstatus.md
+++ b/docs/accessanalyzer/11.6/admin/action/sendmail/viewstatus.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Viewing the Status of SendMail Actions
-Follow the steps to view the status of an executed SendMail action:
+To view the status of an executed SendMail action:
diff --git a/docs/accessanalyzer/11.6/admin/action/servicenow/authentication.md b/docs/accessanalyzer/11.6/admin/action/servicenow/authentication.md
index e57708b738..3a8157bf70 100644
--- a/docs/accessanalyzer/11.6/admin/action/servicenow/authentication.md
+++ b/docs/accessanalyzer/11.6/admin/action/servicenow/authentication.md
@@ -8,8 +8,8 @@ sidebar_position: 10
The Authentication page implements signing into a ServiceNow account.
-A ServiceNow account must be set up and configured to determine which incidents will be visible on
-the Incident Creation page.
+You must set up and configure a ServiceNow account to determine which incidents are visible on the
+Incident Creation page.
diff --git a/docs/accessanalyzer/11.6/admin/action/servicenow/description.md b/docs/accessanalyzer/11.6/admin/action/servicenow/description.md
index 9197650dee..451d398f80 100644
--- a/docs/accessanalyzer/11.6/admin/action/servicenow/description.md
+++ b/docs/accessanalyzer/11.6/admin/action/servicenow/description.md
@@ -7,15 +7,15 @@ sidebar_position: 30
# ServiceNow Action: Description
The Description page provides details on the incidents entered into a field on the Incident Creation
-page. A description of the incident and related comments are included with the incident’s report to
-provide additional feedback to the system administrator, and may be saved to a template.
+page. The incident's report includes a description of the incident and related comments, providing
+additional feedback to the system administrator. You can save this information to a template.
Create a report using the following options:
- Short Description – Displays entered words or phrases used to summarize the incident
-- Insert Field – Use the drop-down menu to select a field (column) from the source table
+- Insert Field – Use the dropdown menu to select a field (column) from the source table
- Click the **blue down arrow** to insert the item into the Short Description section
- Click the **blue up arrow** to insert the item in to the Comments section
diff --git a/docs/accessanalyzer/11.6/admin/action/servicenow/incidentcreation.md b/docs/accessanalyzer/11.6/admin/action/servicenow/incidentcreation.md
index 773c7e974f..d5bbdbcfd2 100644
--- a/docs/accessanalyzer/11.6/admin/action/servicenow/incidentcreation.md
+++ b/docs/accessanalyzer/11.6/admin/action/servicenow/incidentcreation.md
@@ -6,10 +6,10 @@ sidebar_position: 20
# ServiceNow Action: Incident Creation
-The Incident Creation page is available once the ServiceNow credentials are approved. Incidents on
-this page belong to two fields: Mandatory and Optional. The type of field and its incidents are
-chosen within ServiceNow’s configuration page. Selecting a field and entering a value will include
-the incident within ServiceNow’s incident report.
+The Incident Creation page is available after you get ServiceNow approval for your credentials.
+Incidents on this page belong to two fields: Mandatory and Optional. ServiceNow's configuration page
+determines the type of field and its incidents. Selecting a field and entering a value includes the
+incident in ServiceNow's incident report.
@@ -18,5 +18,5 @@ ServiceNow’s incident report. The ServiceNow account entered on the Authentica
which incidents are available within the fields on the Incidents Creation page and are adjusted in
ServiceNow.
-Fields with a drop-down menu have a set of preconfigured options to select. Fields with ellipsis
+Fields with a dropdown menu have a set of preconfigured options to select. Fields with ellipsis
choose members from a preconfigured list.
diff --git a/docs/accessanalyzer/11.6/admin/action/servicenow/overview.md b/docs/accessanalyzer/11.6/admin/action/servicenow/overview.md
index ead5014b23..311504d9ee 100644
--- a/docs/accessanalyzer/11.6/admin/action/servicenow/overview.md
+++ b/docs/accessanalyzer/11.6/admin/action/servicenow/overview.md
@@ -6,18 +6,18 @@ sidebar_position: 90
# ServiceNow Action Module
-The ServiceNow Action Module is primarily intended to allow for the automated creation of ServiceNow
-incidents from data collected by the Netwrix suite of data security tools. By facilitating
-communication between tools like Enterprise Auditor and ServiceNow’s incident management capability,
-security risks in an organization’s environment can not only be identified, but presented to admins,
+The ServiceNow Action Module automates the creation of ServiceNow incidents from data collected by
+the Netwrix suite of data security tools. By facilitating communication between tools like
+Enterprise Auditor and ServiceNow's incident management capability, this module doesn't just
+identify security risks in an organization's environment — it also presents them to admins,
managers, and other stakeholders in a familiar way, with respect to chains of command and approval
as dictated by employee relationships and business workflows implemented in ServiceNow.
When account lockouts occur, the Active Directory Inventory Data Collector makes that information
available. From the Enterprise Auditor console, the ServiceNow Action Module transmits customized
information regarding the locked out accounts directly to those responsible for account management,
-alerting them of the issue and requesting that appropriate action is taken to re-enable user
-accounts before effected users are aware of the problem.
+alerting them of the issue and requesting that they take appropriate action to re-enable user
+accounts before affected users become aware of the problem.
This section describes the following pages in the configuration wizard.
@@ -32,16 +32,16 @@ The ServiceNow Action Module requires an active ServiceNow account with:
## Permissions
-The following permissions are required to utilize Enterprise Auditor’s ServiceNow Action Module:
+The following permissions are required to use Enterprise Auditor’s ServiceNow Action Module:
- ServiceNow admin account – An Administrator Role by an organization’s ServiceNow administrator
-- The **Settings** > **ServiceNow** node at the global level can be configured with a credential
+- You can configure the **Settings** > **ServiceNow** node at the global level with a credential
provisioned to create incidents as Callers in the **Assigned to** field, and any other ServiceNow
incident field that references the sys_user table.
## Connecting ServiceNow with Enterprise Auditor
-The following instructions can only be performed with a ServiceNow admin account and access to the
+You can only perform the following instructions with a ServiceNow admin account and access to the
ServiceNow Action Module XML file.
@@ -50,23 +50,23 @@ ServiceNow Action Module XML file.
`STEALTHbits SN Action Module v1.0_merged_rev2.0` file to use on ServiceNow’s website.
**Step 2 –** Visit servicenow.com, sign into the administrator account, expand **System Update
-Sets**, and click on **Retrieved Update Sets**.
+Sets**, and click **Retrieved Update Sets**.
-**Step 3 –** Under **Related Links**, click on **Import Update Set from XML**.
+**Step 3 –** Under **Related Links**, click **Import Update Set from XML**.
**Step 4 –** Attach the `STEALTHbits SN Action Module v1.0_merged_rev2.0` file, and then click
**Upload**.
-**Step 5 –** After the file is uploaded, click on the **STEALTHbits SN Action Module** within the
+**Step 5 –** After you upload the file, click the **STEALTHbits SN Action Module** within the
list of updated sets.
-**Step 6 –** Click on the **Preview Update Set** button. Wait until the update set preview is
+**Step 6 –** Click the **Preview Update Set** button. Wait until the update set preview is
finished and then click **Commit Update Set**. Then, close the Update Set Commit window.
**Step 7 –** On the navigation page, expand **System Definitions** and click **Plugins**. Then click
on the **Insert Multiple Web Service plugin**
-**Step 8 –** Under **Related Links**, click on **Activate/Upgrade** and click **Activate** on the
+**Step 8 –** Under **Related Links**, click **Activate/Upgrade** and click **Activate** on the
Activate Plugin window. When the Activation is complete, click **Close** to close the window.
**Step 9 –** Click **Reload** on the System Plugin page and confirm the Status is Active.
diff --git a/docs/accessanalyzer/11.6/admin/action/servicenow/summary.md b/docs/accessanalyzer/11.6/admin/action/servicenow/summary.md
index 8ba192aa09..94dae04e3f 100644
--- a/docs/accessanalyzer/11.6/admin/action/servicenow/summary.md
+++ b/docs/accessanalyzer/11.6/admin/action/servicenow/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the ServiceNow Action Module Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the ServiceNow Action Module Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/action/survey/htmlstyle.md b/docs/accessanalyzer/11.6/admin/action/survey/htmlstyle.md
index 775af7c781..81e4649296 100644
--- a/docs/accessanalyzer/11.6/admin/action/survey/htmlstyle.md
+++ b/docs/accessanalyzer/11.6/admin/action/survey/htmlstyle.md
@@ -12,7 +12,7 @@ Choose an HTML style from the HTML Styles list. The Sample pane displays a previ
The configurable options are:
-- HTML Style List – Select which HTML Style is used for Surveys using the HTML Style list. An
- example of the style shows in the Sample box at the bottom of the wizard.
+- HTML Style List – Select which HTML Style the survey uses from the HTML Style list. An example of
+ the style shows in the Sample box at the bottom of the wizard.
- Hide and Lock Previous Responses – Select the checkbox to prevent users from changing their survey
responses once they exit the survey
diff --git a/docs/accessanalyzer/11.6/admin/action/survey/introduction.md b/docs/accessanalyzer/11.6/admin/action/survey/introduction.md
index fd076a30d8..3bc6a507c7 100644
--- a/docs/accessanalyzer/11.6/admin/action/survey/introduction.md
+++ b/docs/accessanalyzer/11.6/admin/action/survey/introduction.md
@@ -10,7 +10,7 @@ Use this page to specify web page introductory text (if any) for the web page sp
Server page. See the
[Survey: Web Server](/docs/accessanalyzer/11.6/admin/action/survey/webserver.md)
topic for additional information. The introductory text appears on the landing page when recipients
-click on the survey link in the email.
+click the survey link in the email.
@@ -21,7 +21,7 @@ The configurable options are:
are limited to data from the SQL table specified at the Source Table field on the Action
Properties page.
- Place the cursor in the text where a field should appear. Next, click on the drop-down and
+ Place the cursor in the text where a field should appear. Next, click the dropdown and
select a field from the list. When a selection appears in the field, click the blue down arrow.
The field appears in the text.
diff --git a/docs/accessanalyzer/11.6/admin/action/survey/mailmessage.md b/docs/accessanalyzer/11.6/admin/action/survey/mailmessage.md
index d6fe03f343..af8ec4a920 100644
--- a/docs/accessanalyzer/11.6/admin/action/survey/mailmessage.md
+++ b/docs/accessanalyzer/11.6/admin/action/survey/mailmessage.md
@@ -13,7 +13,7 @@ not using them.
Placeholder text displays in the Message box. This text includes a hyperlink to the web page hosting
-the survey. Placeholder text can be modified but the link cannot be removed. The link does not
+the survey. You can modify the placeholder text, but you can't remove the link. The link doesn't
activate until the message is sent.
Use the following fields to specify the text of the email:
@@ -21,8 +21,8 @@ Use the following fields to specify the text of the email:
- Subject – Specify subject text for the email. The contents of this field displays as the Subject
line of the delivered email. Enter text directly and use the **Insert field** to insert one or
more data fields. This is a required field.
-- Insert Field – Inserts a data field into the subject or body of the email. The drop-down menu
- displays a list of available fields. Once a selection displays in the field, click on the blue
+- Insert Field – Inserts a data field into the subject or body of the email. The dropdown menu
+ displays a list of available fields. Once a selection displays in the field, click the blue
Down and Up arrows to insert the field into the body or the subject, respectively. This field is
optional.
- The following are buttons appearing on a bar below the Subject field:
@@ -33,18 +33,18 @@ Use the following fields to specify the text of the email:
the blue arrows to display the SMTP Options dialog box
- Preview – Displays the Messages Preview window containing a preview of the current email
message. Click **Send** to send a single message to the addresses in the Recipient field in
- the Message Preview window. The Preview button is active only if the Recipients field is
- populated. See the [Messages Preview Window](#messages-preview-window) topic for additional
+ the Message Preview window. The Preview button is active only if you populate the Recipients
+ field. See the [Messages Preview Window](#messages-preview-window) topic for additional
information.
- Clear Template – Clears any content from the Subject and Text Entry box
-- Load from template – Survey templates are a legacy feature. It is strongly recommended not use
- templates when creating surveys.
+- Load from template – Survey templates are a legacy feature. Netwrix strongly recommends not
+ using templates when creating surveys.
- Save to template – Saves the current email subject and content to a template. If an existing
template name appears in the **Load from template** field, clicking this button updates that
template. If the **Load from template** field is empty or contains a name other than one of the
- existing templates, clicking this button accesses the Save SendMail Template window and changes
- can be saved to a new template. Templates reside locally on the host computer as XML files, in the
+ existing templates, clicking this button opens the Save SendMail Template window and saves the
+ changes to a new template. Templates reside locally on the host computer as XML files, in the
`Actions/SM_Templates` folder.
## Messages Preview Window
diff --git a/docs/accessanalyzer/11.6/admin/action/survey/mailproperties.md b/docs/accessanalyzer/11.6/admin/action/survey/mailproperties.md
index 97bb5860a7..8e90dd4a41 100644
--- a/docs/accessanalyzer/11.6/admin/action/survey/mailproperties.md
+++ b/docs/accessanalyzer/11.6/admin/action/survey/mailproperties.md
@@ -14,10 +14,10 @@ Use the following fields to specify the recipient information:
- Recipient column – Specify the data table columns containing intended recipient information
- - For example, a column containing email addresses. The drop-down menu displays a list of
+ - For example, a column containing email addresses. The dropdown menu displays a list of
possible column types.
-- Recipient type – Specify the data type of the Recipient column. The drop-down menu displays a list
+- Recipient type – Specify the data type of the Recipient column. The dropdown menu displays a list
of recipient types, for example **SMTP email address**.
- Carbon copy (CC) – (Optional) Specify one or more additional email addresses to receive a
carbon-copy of the SendMail message, for example an address not included in the source table.
diff --git a/docs/accessanalyzer/11.6/admin/action/survey/overview.md b/docs/accessanalyzer/11.6/admin/action/survey/overview.md
index b43afe14a6..ef88a4f2e2 100644
--- a/docs/accessanalyzer/11.6/admin/action/survey/overview.md
+++ b/docs/accessanalyzer/11.6/admin/action/survey/overview.md
@@ -10,21 +10,21 @@ Use this action module to create surveys and make them available to targeted rec
For example, a survey can solicit feedback from clients or poll employees on company issues.
The Survey Action Module Wizard builds customizable, web-based surveys containing questions created
-by the user. Once the survey is defined, a list of recipients can then be specified. When executing
+by the user. After you define the survey, you can specify a list of recipients. When executing
the action, the process simultaneously sends an email to the recipients containing a link to the
survey and creates a web page to host the survey.
:::warning
-This module sends one or more electronic messages to a selected audience. Prior to
-executing the action, ensure the audience consists of only the desired members. Netwrix recommends
+This module sends one or more electronic messages to a selected audience. Before
+executing the action, ensure the audience consists of only the members you want. Netwrix recommends
using this and all other Enterprise Auditor actions with caution.
:::
## Survey Action Source Table Configuration
-All data tables used in Enterprise Auditor action modules require the presence of certain data
-columns. In addition, individual action modules including Survey may have their own column
+All data tables used in Enterprise Auditor action modules require certain data columns. In
+addition, individual action modules including Survey may have their own column
requirements. The Survey action module requires a column containing well-formatted email addresses
(for example, `hfinn@netwrix.com`) for your recipients.
diff --git a/docs/accessanalyzer/11.6/admin/action/survey/questions.md b/docs/accessanalyzer/11.6/admin/action/survey/questions.md
index 6c0c74d4ff..48ccf382d3 100644
--- a/docs/accessanalyzer/11.6/admin/action/survey/questions.md
+++ b/docs/accessanalyzer/11.6/admin/action/survey/questions.md
@@ -39,7 +39,7 @@ The configurable options are:
available:
- Text – Specify the survey question
- - Subjects – Click on the ellipses (**…**) to open the Select subjects window. Specify the
+ - Subjects – Click the ellipses (**…**) to open the Select subjects window. Specify the
object to which a question is directed. The selected subjects show in the Subjects field. See
the [Select Subjects Window](#select-subjects-window) topic for additional information.
- Answer Column Name – The Survey action module inserts the results of the survey directly into
@@ -49,11 +49,11 @@ The configurable options are:
- Yes/No
- Text
- - Multiple Choice – If this option is selected, the **Answers** button activates. Click this
+ - Multiple Choice – If you select this option, the **Answers** button activates. Click this
button to open the Answers window and specify the response options to the multiple choice
question via the **Add** button.
- - Answers – This button activates if Multiple Choice in the Question Type field is selected.
+ - Answers – This button activates if you select Multiple Choice in the Question Type field.
Click to access the Answers window.
- Description – Specify any additional explanation of the survey question. The text appears on
the survey below the associated question.
diff --git a/docs/accessanalyzer/11.6/admin/action/survey/testsurvey.md b/docs/accessanalyzer/11.6/admin/action/survey/testsurvey.md
index 57d40c4694..8fe2056200 100644
--- a/docs/accessanalyzer/11.6/admin/action/survey/testsurvey.md
+++ b/docs/accessanalyzer/11.6/admin/action/survey/testsurvey.md
@@ -13,6 +13,6 @@ Use this page to test a survey and verify proper configuration.
The configurable options are:
- Start test – Click to test your survey configuration
-- Survey full test – Once the survey configuration test passes inspection, a full survey can be
- tested against a single user (for example, your own email account) to verify a survey matches
+- Survey full test – After the survey configuration test passes inspection, test a full survey
+ against a single user (for example, your own email account) to verify a survey matches
design criteria
diff --git a/docs/accessanalyzer/11.6/admin/action/webrequest/destination.md b/docs/accessanalyzer/11.6/admin/action/webrequest/destination.md
index e38789132c..a85a58af94 100644
--- a/docs/accessanalyzer/11.6/admin/action/webrequest/destination.md
+++ b/docs/accessanalyzer/11.6/admin/action/webrequest/destination.md
@@ -12,7 +12,7 @@ Use the Destination page to specify all settings for the destination of the web
Use the following categories to establish the location of the web request:
-- Insert field – Select a field using the drop-down menu
+- Insert field – Select a field using the dropdown menu
:::note
The fields available varies based on the source table columns.
@@ -41,12 +41,12 @@ Use the following categories to establish the location of the web request:
- Resource – URL destination to send the data via the web request
- - Select a field using the drop-down menu, place the cursor in the Resource textbox, and click
+ - Select a field using the dropdown menu, place the cursor in the Resource textbox, and click
the blue down-arrow to add it to the Resource box
- Manually enter a resource in the textbox
:::note
- A red circle with an x indicates that the Resource field cannot be empty.
+ A red circle with an x indicates that the Resource field can't be empty.
:::
@@ -56,17 +56,17 @@ Use the following categories to establish the location of the web request:
- Basic – Basic authentication
- JWT – JSON Web Token, a URL-safe authentication method
- Basic and JWT authentications are pulled from the credential profile set in the job. It inserts
- that data into the authentication header of the web request with the proper format expected (for
+ The action pulls Basic and JWT authentications from the credential profile set in the job. It
+ inserts that data into the authentication header of the web request with the proper format expected (for
example, Basic [Base64 encoded credentials] or Bearer [JWT token] for Basic and JWT
authentication respectively).
**Test Connection**
-- Drop-down menu – Select a method to test. Currently locked to GET.
+- dropdown menu – Select a method to test. locked to GET.
- URI textbox – Input the resource to receive the test message
- - Select a field using the drop-down menu, place the cursor in text area, and click the blue
+ - Select a field using the dropdown menu, place the cursor in text area, and click the blue
down-arrow to add it to the URI textbox
- Manually enter a resource in the field
diff --git a/docs/accessanalyzer/11.6/admin/action/webrequest/header.md b/docs/accessanalyzer/11.6/admin/action/webrequest/header.md
index b8d3ce0bab..b420fbc573 100644
--- a/docs/accessanalyzer/11.6/admin/action/webrequest/header.md
+++ b/docs/accessanalyzer/11.6/admin/action/webrequest/header.md
@@ -12,7 +12,7 @@ Use the Header page to enter the header values for the request.
Use the following options to enter header values:
-- Insert field – Select a field to include in the request using the drop-down menu
+- Insert field – Select a field to include in the request using the dropdown menu
:::note
The fields available varies based on the source table columns.
@@ -26,6 +26,6 @@ Use the following options to enter header values:
- Key / Value fields – The name or value of the attribute
- - Select a field using the drop-down menu, place the cursor in the cell of the desired Key or
- Value, and click the blue down-arrow to add it to the selected cell
+ - Select a field using the dropdown menu, place the cursor in the cell of the Key or
+ Value you want, and click the blue down-arrow to add it to the selected cell
- Manually enter a field in the cell
diff --git a/docs/accessanalyzer/11.6/admin/action/webrequest/overview.md b/docs/accessanalyzer/11.6/admin/action/webrequest/overview.md
index 54573a24d5..21d1ed2e61 100644
--- a/docs/accessanalyzer/11.6/admin/action/webrequest/overview.md
+++ b/docs/accessanalyzer/11.6/admin/action/webrequest/overview.md
@@ -7,12 +7,12 @@ sidebar_position: 110
# WebRequest Action Module
The Web Request action module provides methods of applying bulk changes to REST endpoints. At this
-stage, target endpoints should be identified to invoke web requests against. This wizard allows the
-definition of requests to perform.
+stage, identify target endpoints to invoke web requests against. This wizard lets you define the
+requests to perform.
:::warning
-Ensure that only the changes required are applied and only those target systems desired
-when using this action module.
+Apply only the changes you need, and only to the target systems you intend, when using this
+action module.
:::
diff --git a/docs/accessanalyzer/11.6/admin/action/webrequest/parameters.md b/docs/accessanalyzer/11.6/admin/action/webrequest/parameters.md
index bff375e905..3935b8c2e5 100644
--- a/docs/accessanalyzer/11.6/admin/action/webrequest/parameters.md
+++ b/docs/accessanalyzer/11.6/admin/action/webrequest/parameters.md
@@ -12,7 +12,7 @@ Use the Parameters page to enter the parameter values.
Enter parameter values using the following options:
-- Insert Field – Select a field to include in the request from the drop-down menu.
+- Insert Field – Select a field to include in the request from the dropdown menu.
:::note
The fields available varies based on the source table.
@@ -36,8 +36,8 @@ Enter parameter values using the following options:
- Key / Value Fields – The name or value of the attribute
- - Select a field using the drop-down menu, place the cursor in the cell of the desired Key or
- Value, and click the blue down-arrow to add it to the selected cell
+ - Select a field using the dropdown menu, place the cursor in the cell of the Key or
+ Value you want, and click the blue down-arrow to add it to the selected cell
- Select a cell and click the green circle with plus sign to open the Custom Attribute Editor
window and add the attribute to the cell
- Manually enter a field in the cell
@@ -51,16 +51,16 @@ and advanced functions.
Create custom attributes using the following options:
-- Insert field – Select a field to insert using the drop-down menu
-- Unique name – Name of the custom attribute that will be created
+- Insert field – Select a field to insert using the dropdown menu
+- Unique name – Name of the custom attribute to create
- - Select a field using the drop-down menu, place the cursor in the Unique name textbox, and
+ - Select a field using the dropdown menu, place the cursor in the Unique name textbox, and
click the blue down-arrow to add it to the Unique name textbox
- Manually enter the name
- Data – The actual value of the custom attribute (can be database value or manually specified)
- - Select a field using the drop-down menu, place the cursor in the Data textbox, and click the
+ - Select a field using the dropdown menu, place the cursor in the Data textbox, and click the
blue down-arrow to add it to the Data textbox
- Manually enter the data
diff --git a/docs/accessanalyzer/11.6/admin/action/webrequest/summary.md b/docs/accessanalyzer/11.6/admin/action/webrequest/summary.md
index aad9c73ae4..8246cbdf52 100644
--- a/docs/accessanalyzer/11.6/admin/action/webrequest/summary.md
+++ b/docs/accessanalyzer/11.6/admin/action/webrequest/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured action.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Web Request Action Module Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the Web Request Action Module Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/autoaction.md b/docs/accessanalyzer/11.6/admin/analysis/autoaction.md
index d15a206db6..df0b1f9f23 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/autoaction.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/autoaction.md
@@ -19,13 +19,12 @@ topic for additional information.
## Select Action Window
-The Select Action window lists the actions that currently exist within the Job that can be selected
+The Select Action window lists the actions that exist within the Job that you can select
to automatically run upon job execution.
Select an action from the list. Click **OK** to exit the window, and then click **Save** to preserve
-the changes made to the analysis module. The action now executes as part of the analysis task. If no
-actions were selected, it is best practice to click **Cancel** to close the Select Action window to
-ensure no accidental selections are saved. Actions only display if they exist within the Actions
-node of the current Job.
+the changes made to the analysis module. The action now executes as part of the analysis task. If you selected no actions, click **Cancel**
+instead to close the Select Action window without saving accidental selections. Actions only
+display if they exist within the Actions node of the current Job.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/businessrules/appliesto.md b/docs/accessanalyzer/11.6/admin/analysis/businessrules/appliesto.md
index 3ac22ba524..8fb875ef70 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/businessrules/appliesto.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/businessrules/appliesto.md
@@ -6,9 +6,9 @@ sidebar_position: 30
# Applies To Tab
-Use the Applies To tab to specify the scope for application of the analysis rules. Rules are applied
-to data collected from all hosts, from specific hosts, or from the specific host running the job
-(local data). Data is filtered based on a specified time window.
+Use the Applies To tab to specify the scope for application of the analysis rules. The analysis
+module applies rules to data collected from all hosts, from specific hosts, or from the specific
+host running the job (local data). It filters data based on a specified time window.
@@ -20,17 +20,17 @@ The Applies To tab provides the following options:
- All Source Data – Select this option to run the action using all data
- Source Data from this Console only – Select this option to run the action specifically using
data from only this Enterprise Auditor console
- - Time Window for source table – Use the drop-down menu to specify a time window from the
+ - Time Window for source table – Use the dropdown menu to specify a time window from the
following options:
- Most recent data – Use only the most recently collected data
- Cumulative data for offline hosts – Use data collected from offline hosts
- Most recent data filtering duplicate and offline hosts – Use most recent data excluding
duplicate and offline hosts
- - Do not filter data – Use unfiltered data
+ - Don't filter data – Use unfiltered data
- Hosts Filtering – Specify source hosts
- Apply to All Hosts – Select this checkbox to use all hosts to query
- - Host List – Select any desired hosts to query. If **Apply to All Hosts** is selected, the list
+ - Host List – Select any desired hosts to query. If you select **Apply to All Hosts**, the list
is unavailable.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/businessrules/logic.md b/docs/accessanalyzer/11.6/admin/analysis/businessrules/logic.md
index c044f64a45..eed0ad6e1d 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/businessrules/logic.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/businessrules/logic.md
@@ -16,7 +16,7 @@ The Logic tab contains the following sections and options:
- Rule Name – The field defaults with the name on the Analysis Properties page and is manually
editable
- - Table – Select a table from the drop-down menu containing the baseline values to evaluate
+ - Table – Select a table from the dropdown menu containing the baseline values to evaluate
- To view data from a selected table, click the ellipsis (**…**) to open the Sample Data
Viewer window, or select a table within the viewer. See the
@@ -48,20 +48,20 @@ Use the Sample Data Viewer window to examine data in a selected table.
The Sample Data Viewer window provides the following options:
-- Use the drop-down menu to select a table to view the table’s data. The field defaults with the
+- Use the dropdown menu to select a table to view the table’s data. The field defaults with the
table selected in the Logic tab if previously selected.
-- Show First [Number] rows – Adjusts the presentation of the number of rows of the selected table.
- The default value is 50. It can be manually adjusted with values between 0 and all.
+- Show First [Number] rows – Sets how many rows of the selected table to show. The default value is
+ 50. You can manually adjust it to any value between 0 and all.
## EditConditionsForm Window
-Use the EditConditionsForm to configure conditions to be applied to the table.
+Use the EditConditionsForm to configure conditions to apply to the table.
The EditConditionsForm contains the following options:
-- Column – Use the drop-down menu to select a column from the table selected in the Logic tab
+- Column – Use the dropdown menu to select a column from the table selected in the Logic tab
- Operator – Use the dropdown to select an operator:
- `<` – Search for items in the selected column with values less than a selected value
@@ -101,14 +101,14 @@ The Configure Scorecard Options window provides the following options:
- Action Name – Enter a name for the action
- Description – Enter a description for the action
-- Action Classification – This section allows you to group scorecard action results for reporting
+- Action Classification – Use this section to group scorecard action results for reporting
purposes
- Category – Enter a desired category name in the field or use the dropdown to select from
previously titled categories
- Index – Enter a desired index value for the scorecard action
-- Action Score – This section allows you to rank the action’s importance relative to other scorecard
+- Action Score – Use this section to rank the action’s importance relative to other scorecard
actions
- Score – Enter a desired score value for the scorecard action
@@ -119,9 +119,9 @@ The Configure Scorecard Options window provides the following options:
- Knowledge – Enter information to assist issue resolution, for example a website URL
-- Captured Values – This section allows you to select up to five optional properties whose values
- will be captured and stored with the scorecard entry. For each property selected, a name column
- and value column appear in the scorecard.
+- Captured Values – Use this section to select up to five optional properties. The scorecard entry
+ captures and stores the values of the properties you select. For each property selected, a name
+ column and value column appear in the scorecard.
- - Property [1-5] – Select a property from the selected table using the drop-down menu to capture
+ - Property [1-5] – Select a property from the selected table using the dropdown menu to capture
and store its values with the scorecard
diff --git a/docs/accessanalyzer/11.6/admin/analysis/businessrules/overview.md b/docs/accessanalyzer/11.6/admin/analysis/businessrules/overview.md
index b44ad6870c..27792be297 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/businessrules/overview.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/businessrules/overview.md
@@ -17,10 +17,10 @@ original baseline expectations.
## Scorecard
-Business Rules analysis module results are displayed in a table called a scorecard. The scorecard
-determines which of the rules are applied, and in what order. A scorecard table contains only
+A table called a scorecard displays Business Rules analysis module results. The scorecard
+determines which rules apply, and in what order. A scorecard table contains only
exceptions and deviations from the business rule criteria when compared to a baseline value. The
-table does not include matches to the criteria. All scorecard table names are suffixed with
+table doesn't include matches to the criteria. All scorecard table names are suffixed with
`_SCORECARD` for easy identification.
## Edit Rules Window
diff --git a/docs/accessanalyzer/11.6/admin/analysis/changedetection/additionalfields.md b/docs/accessanalyzer/11.6/admin/analysis/changedetection/additionalfields.md
index 9d8751be77..809f7df89e 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/changedetection/additionalfields.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/changedetection/additionalfields.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# Change Detection: Additional Fields
Use the Additional Fields page to choose any additional fields to include with the change analysis.
-These fields do not detect change, but may provide additional information to help diagnose and
+These fields don't detect change, but may provide additional information to help diagnose and
analyze the changes reported.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/changedetection/input.md b/docs/accessanalyzer/11.6/admin/analysis/changedetection/input.md
index 48061695ae..96091e8c06 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/changedetection/input.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/changedetection/input.md
@@ -12,10 +12,9 @@ Use the Input Data Source page to choose a data source to analyze for changes.
The configurable option is:
-- Please select a data source – Select a data source table from the list
+- select a data source – Select a data source table from the list
:::note
- The selectable data sources change based on which option is selected on the Input
+ The selectable data sources change based on which option you select on the Input
Scope page.
-
:::
diff --git a/docs/accessanalyzer/11.6/admin/analysis/changedetection/inputscope.md b/docs/accessanalyzer/11.6/admin/analysis/changedetection/inputscope.md
index 9bfe2ee296..81a1e996f0 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/changedetection/inputscope.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/changedetection/inputscope.md
@@ -12,12 +12,11 @@ Use the Input Scope page to specify the input scope of the data source.
Identify the scope of the data source from the following options:
-- Tables from Current Job – Select tables from only the currently selected job
+- Tables from Current Job – Select tables from only the selected job
- All Enterprise Auditor Tables – Select from all Enterprise Auditor tables within the SQL Server
database
- All tables in the database – Select all tables within the SQL Server database
:::note
-This selection affects the tables that are available for selection on the Input page.
-
+This selection affects which tables are available on the Input page.
:::
diff --git a/docs/accessanalyzer/11.6/admin/analysis/changedetection/options.md b/docs/accessanalyzer/11.6/admin/analysis/changedetection/options.md
index 325265b03c..039eed919c 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/changedetection/options.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/changedetection/options.md
@@ -13,7 +13,7 @@ made within a certain time period, or only changes between the last two runs of
Configure the additional options using the following:
-- Save change detection results for xx days – Modify the number of days that results for the Change
- Detection task are saved for
+- Save change detection results for xx days – Modify the number of days the action saves results
+ for the Change Detection task
- Only save most recent change (per unique key) – Select the checkbox to only save changes between
the last two runs of the source set
diff --git a/docs/accessanalyzer/11.6/admin/analysis/changedetection/overview.md b/docs/accessanalyzer/11.6/admin/analysis/changedetection/overview.md
index 418bd1bf02..24cdca0dc5 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/changedetection/overview.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/changedetection/overview.md
@@ -12,8 +12,8 @@ selected data items and compares result rows from previous collection activity w
most recent collection.
This module compares values collected for two different query instances. Therefore, as change
-detection depends on the existence of a **JobRunTimeKey**, history must be enabled and data
-collected at least twice to produce the desired results. Configure History settings under the job’s
+detection depends on the existence of a **JobRunTimeKey**, you must enable history and collect data
+at least twice to produce the results you want. Configure History settings under the job’s
**Settings** > **History** node. See the
[History](/docs/accessanalyzer/11.6/admin/settings/history.md) topic
for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/changedetection/summary.md b/docs/accessanalyzer/11.6/admin/analysis/changedetection/summary.md
index 346789e8d2..e2b5ef7480 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/changedetection/summary.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/changedetection/summary.md
@@ -10,5 +10,5 @@ The Summary page summarizes the configuration of the action.
-Click **Finish** to save configuration changes. If no changes were made, click **Cancel** to close
-the Change Detection Data Analysis Module wizard to ensure no accidental configurations are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the Change Detection Data Analysis Module wizard without saving accidental configurations.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/notification/changetype.md b/docs/accessanalyzer/11.6/admin/analysis/notification/changetype.md
index 35b8327d27..649e3b41c5 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/notification/changetype.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/notification/changetype.md
@@ -7,8 +7,8 @@ sidebar_position: 30
# Notification: Change Type
Use the Select Change Type page to choose the types of changes for which to trigger a notification.
-The selections on this page are optional. This page is only active if Change Detection Table is
-selected on the Table Type page.
+The selections on this page are optional. This page is only active if you select Change Detection
+Table on the Table Type page.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/notification/commandline.md b/docs/accessanalyzer/11.6/admin/analysis/notification/commandline.md
index 156c69eebd..568eb64599 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/notification/commandline.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/notification/commandline.md
@@ -6,8 +6,8 @@ sidebar_position: 80
# Notification: Command Line
-The Command Line properties page is available when the Command-line Executable notification type is
-selected on the Type page.
+The Command Line properties page is available when you select the Command-line Executable
+notification type on the Type page.
@@ -17,7 +17,7 @@ The following options are available:
view and select from a list of executable files.
- Arguments – If required, specify command line inputs for the application in the text box. If the
argument must come from a value in the database (for example, a timeout value), insert it here via
- the Fields drop-down menu above.
+ the Fields dropdown menu above.
- - Fields – To pass one or more fields into the command line arguments, click the drop-down menu,
+ - Fields – To pass one or more fields into the command line arguments, click the dropdown menu,
select a field from the lists, and click **Add**
diff --git a/docs/accessanalyzer/11.6/admin/analysis/notification/criteria.md b/docs/accessanalyzer/11.6/admin/analysis/notification/criteria.md
index 41576a795e..42d4c534a3 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/notification/criteria.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/notification/criteria.md
@@ -12,8 +12,8 @@ Use the Notification Criteria page to specify criteria to trigger a notification
The following options are available:
-- No Criteria – Set no criteria to trigger a notification if any property changes. If selected, any
- row will trigger the notification.
+- No Criteria – Set no criteria to trigger a notification if any property changes. If you select
+ this option, any row triggers the notification.
- Simple Criteria – Select criteria to send a notification based on the value of a specific property
or column in the database. The trigger can be if the property or column value is greater than,
equal to, or less than the value provided.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/notification/eventlog.md b/docs/accessanalyzer/11.6/admin/analysis/notification/eventlog.md
index 3ba486b98a..d387675c80 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/notification/eventlog.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/notification/eventlog.md
@@ -6,7 +6,7 @@ sidebar_position: 90
# Notification: Event Log
-The Event Log properties page is available when the Event log notification type is selected on the
+The Event Log properties page is available when you select the Event log notification type on the
Type page. Use this page to specify the type of event, the event ID, and the description for the
event.
@@ -15,7 +15,7 @@ event.
The following options are available:
- Log – The event log name is Enterprise Auditor
-- Type – Specify the log type. The drop-down menu displays the following options:
+- Type – Specify the log type. The dropdown menu displays the following options:
- Information
- Warning
@@ -26,5 +26,5 @@ The following options are available:
- Event ID – Specify the event ID
- Description – Enter a description of the event
- - Fields – To pass fields into the description, click on the drop-down list, select a field from
+ - Fields – To pass fields into the description, click the dropdown list, select a field from
the list, then click **Add**
diff --git a/docs/accessanalyzer/11.6/admin/analysis/notification/hosts.md b/docs/accessanalyzer/11.6/admin/analysis/notification/hosts.md
index ca41f15f33..4e1a3fa961 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/notification/hosts.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/notification/hosts.md
@@ -16,11 +16,11 @@ The following options are available:
- I want notifications sent only for the hosts listed below
- I want notifications sent for all hosts except the ones listed below
-If the first option is selected, the host list selection window is not enabled. If either the second
-or third option is selected, the following options are enabled:
+If you select the first option, the host list selection window isn't enabled. If you select either
+the second or third option, the wizard enables the following options:
-- Show me all host lists – Activates the host list selection window, from which individual host
- lists can be selected
-- Enter hosts manually – Manually enter specific host names. Once the name is entered, click the add
- (**+**) button to add it to the selection box. Ensure the checkbox next to the host name is
- selected to include it in the list of hosts.
+- Show me all host lists – Activates the host list selection window, from which you can select
+ individual host lists
+- Enter hosts manually – Manually enter specific host names. After you enter the name, click the add
+ (**+**) button to add it to the selection box. Select the checkbox next to the host name to
+ include it in the list of hosts.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/notification/overview.md b/docs/accessanalyzer/11.6/admin/analysis/notification/overview.md
index 039a4dad2e..518fccf625 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/notification/overview.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/notification/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Notification Analysis Module
-The Notification Data analysis module provides the ability to send an email or command-line
+The Notification Data analysis module lets you send an email or command-line
notification to selected targets based on the values contains in any table.
The Notification Data Analysis Module has the following prerequisites:
diff --git a/docs/accessanalyzer/11.6/admin/analysis/notification/smtp.md b/docs/accessanalyzer/11.6/admin/analysis/notification/smtp.md
index 10d4aaecb2..dcf64a399e 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/notification/smtp.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/notification/smtp.md
@@ -6,7 +6,7 @@ sidebar_position: 70
# Notification: SMTP
-The SMTP properties page is available when the Email notification type is selected on the Type page.
+The SMTP properties page is available when you select the Email notification type on the Type page.
Use this page to specify SMTP notification properties, including recipients, subject line, and email
body.
@@ -24,13 +24,13 @@ The following options are available:
- Subject – Specify a subject for the email. The subject can include field variables.
:::info
- If configuring a Notification analysis module for a pre-configured job, it is
- recommended not to change the existing field variables.
+ If you're configuring a Notification analysis module for a pre-configured job, avoid
+ changing the existing field variables.
:::
- Insert Field – Select a source data column to add to the message body or subject line. Click the
- drop-down to see a list of columns. Once the column displays in the field, click an arrow to
+ dropdown to see a list of columns. After the column displays in the field, click an arrow to
insert the field.
- Down arrow – Adds the selected source column to the message text
@@ -39,9 +39,9 @@ The following options are available:
- Embed HTML Report – Embed a HTML report in the notification email. Click the Embed HTML Report
button to navigate to the HTML file.
- Show sample input source data – Opens the Sample Source Data window, containing sample input
- source data as it currently exists in the database
-- Show dialog to set SMTP options – Opens the SMTP Options window, where SMTP global settings can be
- overwritten through manual configuration
+ source data as it exists in the database
+- Show dialog to set SMTP options – Opens the SMTP Options window, where you can manually overwrite
+ SMTP global settings
- Preview – Displays a preview of the email.
:::note
@@ -49,9 +49,9 @@ The following options are available:
:::
-- Clear Template – Clears all data from the subject and message boxes. Does not clear e-mail
+- Clear Template – Clears all data from the subject and message boxes. Doesn't clear e-mail
addresses.
- Text Box – Specify the text of the email message. The toolbar above the text box contains various
icons providing access to text editing and formatting tools. To insert fields from Enterprise
- Auditor, choose a field from the drop-down menu and click the Down arrow. Block tag formatting is
+ Auditor, choose a field from the dropdown menu and click the Down arrow. Block tag formatting is
supported.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/notification/summary.md b/docs/accessanalyzer/11.6/admin/analysis/notification/summary.md
index a9661f29ef..b35cef6dda 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/notification/summary.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/notification/summary.md
@@ -11,6 +11,5 @@ previous pages of the wizard.
-Click **Finish** to save configuration changes. If no changes were made, it is best practice to
-click **Cancel** to close the Notification Data Analysis Module wizard to ensure no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the Notification Data Analysis Module wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/notification/timewindow.md b/docs/accessanalyzer/11.6/admin/analysis/notification/timewindow.md
index e2cdd181bf..6dcb42d167 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/notification/timewindow.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/notification/timewindow.md
@@ -16,7 +16,7 @@ The following option is available:
task to the most recent data
:::note
- The checkbox is only enabled if the table selected on the Select Table page has a
- Enterprise Auditor **JobRunTimeKey** property. Otherwise, the checkbox is cleared by default.
+ Enterprise Auditor enables the checkbox only if the table selected on the Select Table page has
+ a **JobRunTimeKey** property. Otherwise, it clears the checkbox by default.
:::
diff --git a/docs/accessanalyzer/11.6/admin/analysis/overview.md b/docs/accessanalyzer/11.6/admin/analysis/overview.md
index 2c03bb784f..b3a4923538 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/overview.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/overview.md
@@ -6,17 +6,17 @@ sidebar_position: 90
# Analysis Modules
-The Enterprise Auditor analysis modules are capable of finding unique data and notifying users of
-its location from a variety of environments. Analysis modules are assigned to a job at the
-**Configure** > **Analysis** node. See the
+The Enterprise Auditor analysis modules find unique data and notify users of its location from a
+variety of environments. Assign analysis modules to a job at the **Configure** > **Analysis** node.
+See the
[Analysis Node](/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysis.md)
topic for information on the Analysis Selection view.
-Analysis tasks are configured through the Analysis Properties page. Navigate to the job’s
-**Configure** > Analysis node. The Analysis Properties page is opened from the Analysis Selection
-page by either of the following options:
+Configure analysis tasks through the Analysis Properties page. Navigate to the job’s
+**Configure** > Analysis node. Open the Analysis Properties page from the Analysis Selection
+page using either of the following options:
- Select **Create Analysis** to add a new analysis task to a job
- Select an existing analysis and click **Analysis Properties** to modify its configuration
@@ -30,7 +30,7 @@ Auditor.
| Analysis Module | Description |
| --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| [AutoAction Analysis Module](/docs/accessanalyzer/11.6/admin/analysis/autoaction.md) | Performs a specified action at the conclusion of an analysis task’s execution |
-| [Business Rules Analysis Module](/docs/accessanalyzer/11.6/admin/analysis/businessrules/overview.md) | Finds data that does not match user expectations for the target environment |
+| [Business Rules Analysis Module](/docs/accessanalyzer/11.6/admin/analysis/businessrules/overview.md) | Finds data that doesn't match user expectations for the target environment |
| [Change Detection Analysis Module](/docs/accessanalyzer/11.6/admin/analysis/changedetection/overview.md) | Notifies when a change occurs in the results of a job and identifies the location of the change |
| [Notification Analysis Module](/docs/accessanalyzer/11.6/admin/analysis/notification/overview.md) | Sends notifications to specified recipients when a specified event occurs |
| [SQLscripting Analysis Module](/docs/accessanalyzer/11.6/admin/analysis/sqlscripting.md) | Executes free-form SQL scripts |
@@ -41,16 +41,16 @@ Auditor.
## Executing Analyses
Analysis tasks execute automatically if enabled through the Analysis Selection page for jobs with
-analysis modules configured. Analysis tasks can be enabled or disabled by selecting the checkbox
-next to the analysis tasks. Analysis tasks execute in the order shown in the Analysis Selection
-window. Tasks can be manually executed without running the job by right-clicking on the task and
-selecting **Execute Analyses** from the dropdown menu.
+analysis modules configured. Select the checkbox next to an analysis task to enable or disable it.
+Analysis tasks execute in the order shown in the Analysis Selection window. To run a task manually
+without running the job, right-click the task and select **Execute Analyses** from the dropdown
+menu.
## Analysis Selection Page
-Analysis tasks can be created, deleted, and configured through the Analysis Selection page. For jobs
-with existing analysis tasks, the Analysis Selection page is used to change the order in which tasks
-are run, as well as enabling or disabling tasks.
+Use the Analysis Selection page to create, delete, and configure analysis tasks. For jobs
+with existing analysis tasks, use the Analysis Selection page to change the run order and to enable
+or disable tasks.
@@ -78,8 +78,8 @@ The Analysis Selection page has the following options:
## Analysis Properties Page
-Configure task properties through the Analysis Properties page. The Analysis Properties page is
-accessed through the Analysis Selection page.
+Configure task properties through the Analysis Properties page. Access the Analysis Properties page
+through the Analysis Selection page.
@@ -88,7 +88,7 @@ The Analysis Properties page has the following options:
- Name – Name of the analysis task. Default names can be changed.
- Description – Description of the analysis task. Analysis tasks for default solutions reference
associate data tables. Descriptions for new tasks are blank by default.
-- Analysis Module – Click the drop-down to select an analysis module for the task
+- Analysis Module – Click the dropdown to select an analysis module for the task
- Configure Analysis – Click to access the configuration wizard for the selected analysis module
- ID – Unique identifying number of the analysis task. The database uses distinct IDs to distinguish
between analysis tasks, even those with identical configurations.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/sqlscripting.md b/docs/accessanalyzer/11.6/admin/analysis/sqlscripting.md
index 92fb473daa..3bf32af20a 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/sqlscripting.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/sqlscripting.md
@@ -12,7 +12,7 @@ Use the SQLscripting analysis module to apply SQL scripting to the selected job.
The SQLscripting analysis module evaluates the Enterprise Auditor user’s permission level to
determine whether to allow the connected user to run the scripted command. Since this evaluation is
-based on specific SQL database permissions and is not always under Enterprise Auditor’s control,
+based on specific SQL database permissions and isn't always under Enterprise Auditor’s control,
some scripts with correct syntax may fail due to insufficient permissions.
The SQL Script Editor window has the following options:
@@ -25,13 +25,13 @@ The SQL Script Editor window has the following options:
- Syntax Check – Checks SQL script syntax
- - Syntax Check does not identify logic errors, only instances where syntax is incorrect. Click
+ - Syntax Check doesn't identify logic errors, only instances where syntax is incorrect. Click
**Syntax Check** to open the Script Errors window which identifies syntax errors.
- Syntax Check reports back syntax errors starting from the beginning of the script to the end.
- Syntax Check does not return a list of errors.
+ Syntax Check doesn't return a list of errors.
-- Load file – Opens a File Explorer which can be used to navigate to a SQL file
-- Save to File – Saves the currently configured script into a SQL file
+- Load file – Opens a File Explorer window you can use to navigate to a SQL file
+- Save to File – Saves the configured script into a SQL file
- Undo – Undo the previous changes made to script (Ctrl+Z)
- Redo – Redo the previous changes made to script (Ctrl+Y)
- Cut – Cuts the highlighted script from the SQL script editor (Ctrl+X)
@@ -41,14 +41,13 @@ The SQL Script Editor window has the following options:
[Transact-SQL Reference](https://learn.microsoft.com/en-us/previous-versions/sql/sql-server-2005/ms189826(v=sql.90))
article
-Click **Save and Close** to return to the Analysis Properties page. If no changes were made or
-intended, it is best practice to click **Cancel** to close the SQL Script Editor wizard to ensure no
-accidental changes are saved.
+Click **Save and Close** to return to the Analysis Properties page. If you made no changes, click
+**Cancel** to close the SQL Script Editor wizard and avoid saving accidental changes.
## Parameters
Use the Parameters window to add, edit, and delete temporary variables and tables defined by
-SQLscripting and users. The window only displays when **Parameters** is clicked.
+SQLscripting and users. The window displays only when you click **Parameters**.
@@ -75,8 +74,8 @@ The parameters have the following properties:
- Name – Name of the variable or table
- Type – Type of variable or table
- - String variables utilize a text string input
- - Integers and floats are able to handle invalid inputs
+ - String variables use a text string input
+ - Integers and floats can handle invalid inputs
- Boolean variables only take True/False input, in SQL they are 1/0
- Percentages only take whole numbers 0-100, converted to 0.0 to 1.0 in SQL
- Temporary and Variable Tables
@@ -110,8 +109,8 @@ The Edit table window has the following options:
- Delete – Deletes the selected value
- Up/Down – Changes the value position higher or lower
-A CSV file is created under the job’s directory when a parameter table is added to the analysis. A
-pre-existing CSV file can also be uploaded to populate the table.
+Enterprise Auditor creates a CSV file under the job’s directory when you add a parameter table to
+the analysis. You can also upload a pre-existing CSV file to populate the table.
-Click **OK** to confirm changes to the table. If no changes were made or intended, click **Cancel**
-to close the Edit Table window to ensure no accidental changes are saved.
+Click **OK** to confirm changes to the table. If you made no changes, click **Cancel** to close the
+Edit Table window and avoid saving accidental changes.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/columns.md b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/columns.md
index 75f2787874..c3ecf5f76b 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/columns.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/columns.md
@@ -11,7 +11,7 @@ The Result Columns page lists the tables selected on the Input Select page.
Expand the table to show its columns. Then, select the checkbox next to the column to include it in
-the resulting table or view. If two data tables are being joined, the resulting table displays at
+the resulting table or view. If you join two data tables, the resulting table displays at
the bottom of the grid. Use the scroll bar to view any hidden tables or data points.
The grid provides the following options for formatting the resulting table or view:
@@ -21,14 +21,14 @@ The grid provides the following options for formatting the resulting table or vi
- Add Column – Opens the New Trend Column window, where columns can be added to the table
- Delete – Deletes a selected column
- - Original columns cannot be deleted. Only columns that have been added by users can be deleted.
+ - Original columns can't be deleted. Only columns that have been added by users can be deleted.
-- Show All Columns/Hide Unchecked Columns – Hides rows that are not currently selected ,or if
- columns are currently hidden, displays all columns in the table
+- Show All Columns/Hide Unchecked Columns – Hides rows that aren't selected, or if
+ columns are hidden, displays all columns in the table
- Checked – Selects data columns for inclusion in the resulting table or view
- Column Name – Displays the data column name
- Group Operation – Accesses the available group operations that can be applied to individual data
- points. Click on a cell in this column to display the drop-down arrow. The following operations
+ points. Click a cell in this column to display the dropdown arrow. The following operations
are available:
- (none)
@@ -43,7 +43,7 @@ The grid provides the following options for formatting the resulting table or vi
column name on the materialized table or view. If applying a group operation, a default data label
shows. To apply a custom label, click in the cell and enter the label.
- Order By Operation – Accesses the available order-by operations that can be applied to individual
- data points. Click on a cell in this column to display the drop-down arrow. The following
+ data points. Click a cell in this column to display the dropdown arrow. The following
operations are available:
- None
diff --git a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/export.md b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/export.md
index 98377a96c7..76d46f5e30 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/export.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/export.md
@@ -13,9 +13,9 @@ Use the Export settings page to specify data export settings.
Select the **Export results data** checkbox to enable the settings. The following options control
the file type and destination of the exported data:
-- Format – Use the drop-down menu to select the file format of the exported data
+- Format – Use the dropdown menu to select the file format of the exported data
- - MS Excel file – Converts file to Microsoft Excel format. If Excel is not installed on the
+ - MS Excel file – Converts file to Microsoft Excel format. If Excel isn't installed on the
console, a warning message shows and another export file format needs to be selected.
- CSV file – Converts file to Comma-Separated Values format. Includes the option to compress the
file to a zip file.
@@ -29,4 +29,4 @@ the file type and destination of the exported data:
**Location** field. To specify a different location, clear the checkbox and edit the **Location**
field.
-Once the options are selected, click **Next**.
+After you select the options, click **Next**.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/filter.md b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/filter.md
index a83d9f9d14..5e36ffdb80 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/filter.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/filter.md
@@ -11,8 +11,8 @@ Use this page to add custom filters to the table using the Filter Builder.
Filters reduce the amount of data visible in a column imported to the resulting table or view. By
-default, when the filter page is blank, all the data within each column is included. Use the
-following options to add and remove filters:
+default, when the filter page is blank, Enterprise Auditor includes all the data within each column.
+Use the following options to add and remove filters:
- Edit – Opens the Filter window
diff --git a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/input.md b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/input.md
index 2c3988e9a3..a6b3118dc6 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/input.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/input.md
@@ -11,16 +11,16 @@ aggregate into a resulting table or view.
-At the first drop-down, select a table. The drop-down lists on this page are determined by the
-selection made on the Input Scope page. To join or aggregate data from two tables, select a second
-table at the second drop-down menu. To remove the second table from the field, click the **X**
+At the first dropdown, select a table. The selection you make on the Input Scope page determines
+the dropdown lists on this page. To join or aggregate data from two tables, select a second
+table at the second dropdown menu. To remove the second table from the field, click the **X**
button.
:::note
-It is important to choose tables that are compatible with one another or share similar
+Choose tables that are compatible with one another or share similar
columns.
:::
-When the two sources of data are selected, click **Next** to create a joint column within the
+After you select the two data sources, click **Next** to create a joint column within the
resulting table or view.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/inputscope.md b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/inputscope.md
index 2f8dd2f40c..ede863422d 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/inputscope.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/inputscope.md
@@ -11,7 +11,7 @@ available for selection on the subsequent pages.
-Select the source data to be used from the following options:
+Select the source data to use from the following options:
- Tables from Current Job – Targets all tables generated by the current job within the SQL Server
database
diff --git a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/joincolumns.md b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/joincolumns.md
index 6eac2de3b7..bdcebe3de7 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/joincolumns.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/joincolumns.md
@@ -7,8 +7,8 @@ sidebar_position: 30
# SQLViewCreations: Join Columns
Use the Join Columns page to select a column from each source table to join together on the
-resulting table or view. The options on this page are only enabled if two tables are selected on the
-Input Source page.
+resulting table or view. Enterprise Auditor enables the options on this page only if you select two
+tables on the Input Source page.
:::note
The SQLViewCreation analysis module can join two tables, using a simple equi-join
@@ -22,17 +22,17 @@ for additional information.
Use the **Table 1 join property** and **Table 2 join property** fields to select join predicates
-from both tables. Join predicates are columns containing analogous values that are used to match
-records in referenced tables.
+from both tables. Join predicates are columns containing analogous values that match records in
+referenced tables.
Next, specify how to join these tables. To automatically select the appropriate join type, select
one or more of the checkboxes. The selection in the **Join Type** field updates based on user
selections.
-To manually select, use the **Join Type** field. The selection here may update the above checkboxes.
-The following options are available:
+To manually select, use the **Join Type** field. The selection here may update the checkboxes you
+selected earlier. The following options are available:
-- Join Type – Select a join type from the drop-down:
+- Join Type – Select a join type from the dropdown:
:::note
Left is the first table referenced, right is the second table.
@@ -48,8 +48,8 @@ The following options are available:
:::note
The join property is the column found within both tables. The two columns can have
-different names. However, in the results set, everywhere a value in the first column matches the
-value in the second column, rows from the respective tables are joined together.
+different names. However, in the results set, wherever a value in the first column matches the
+value in the second column, Enterprise Auditor joins rows from the respective tables.
:::
diff --git a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/overview.md b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/overview.md
index d089d61de6..b0328feabb 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/overview.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# SQLViewCreation Analysis Module
-The SQLViewCreation analysis module provides the ability to create new views or tables that are used
-in Enterprise Auditor actions and reports. These views or tables are re-created during job
+The SQLViewCreation analysis module lets you create new views or tables for use in Enterprise
+Auditor actions and reports. Enterprise Auditor re-creates these views or tables during job
execution.
:::warning
@@ -19,7 +19,7 @@ tables. Tables require more storage space in the database.
## Configuration
This analysis module provides the View and Table Creation Analysis Module wizard to assist in
-configuring the module. Before the wizard, collect the desired data for manipulation.
+configuring the module. Before the wizard, collect the data you want to manipulate.
The wizard contains the following pages:
diff --git a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/result.md b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/result.md
index 8b869aa60e..4e520a295e 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/result.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/result.md
@@ -16,9 +16,10 @@ two sourced tables. Select from the following two options:
- Create Table – Creates a table output for the resulting dataset
- Create View – Creates a view output for the resulting dataset
-A default name of `SA_[job name]_Result` is provided in the name field. You can customize this name
+The name field defaults to `SA_[job name]_Result`. You can customize this name
for the resulting table or view.
-The name must start with `SA` to be recognized as a Enterprise Auditor table or view.
+The name must start with `SA` so Enterprise Auditor recognizes it as an Enterprise Auditor table or
+view.
After selecting the resulting table or view’s visual representation and name, click **Next**.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/resultconstraints.md b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/resultconstraints.md
index a6125a9b4d..39e73782b7 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/resultconstraints.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/resultconstraints.md
@@ -10,7 +10,7 @@ Use the Result Constraints page to impose restraints on the dataset.
-Select one of the following options to choose if and how much data should be returned:
+Select one of the following options to choose whether and how much data to return:
- Duplicate rows can appear in the result set
- Only unique rows can appear in the result set
@@ -18,7 +18,7 @@ Select one of the following options to choose if and how much data should be ret
of measurement to return for the rows that appear in the resulting table or view
- With ties – Include all instances of identical values in the sorted columns with the results.
- To include only one instance of identical values, do not select this option.. See the
+ To include only one instance of identical values, don't select this option.. See the
[With Ties Example](#with-ties-example) topic for additional information.
:::note
@@ -40,8 +40,8 @@ Consider a table that has ten rows with one repeating entry under the value colu
-If the table is sorted by the value column in ascending order and the **Return only** option is set
-to **40 percent**, then there should be four rows visible in the resulting table or view output.
+If you sort the table by the value column in ascending order and set the **Return only** option
+to **40 percent**, four rows should be visible in the resulting table or view output.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/resultsample.md b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/resultsample.md
index df0454396f..4ab6fb517e 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/resultsample.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/resultsample.md
@@ -11,10 +11,10 @@ Use this page to preview a sampling of the completed data manipulation.
Click **Show Preview** to populate the window with the selections from the previous pages. If the
-window does not populate, check the configurations for errors and try again.
+window doesn't populate, check the configurations for errors and try again.
:::note
-The **Show Preview** option does not always apply the filter conditions specified within
+The **Show Preview** option doesn't always apply the filter conditions specified within
the wizard, but the resulting table or view applies all filters.
:::
diff --git a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/summary.md b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/summary.md
index 8b6f99f889..226353fbbb 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/summary.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/summary.md
@@ -10,6 +10,5 @@ This page provides an overview of all the settings configured in the wizard.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the View and Table Creation Analysis Module wizard to ensure that no
-accidental clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the View and Table Creation Analysis Module wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/timewindow.md b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/timewindow.md
index 66a25fd662..f74ce9a335 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/timewindow.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/sqlviewcreation/timewindow.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# SQLViewCreation: Time Window
-Use the Source and Time Window page to specify which data to access if using multiple Enterprise
-Auditor Consoles or history is enabled.
+Use the Source and Time Window page to specify which data to access when using multiple Enterprise
+Auditor Consoles or with history enabled.
@@ -28,5 +28,5 @@ data was collected:
- Data from this Enterprise Auditor Console only – Uses only data from the Enterprise Auditor
Console generating the current analysis module
-- Time Window – Select a time window for each table in the analysis. The drop-down menu selections
+- Time Window – Select a time window for each table in the analysis. The dropdown menu selections
vary based on each table's history settings.
diff --git a/docs/accessanalyzer/11.6/admin/analysis/vbscripting.md b/docs/accessanalyzer/11.6/admin/analysis/vbscripting.md
index f1a02b4b27..c4869a2190 100644
--- a/docs/accessanalyzer/11.6/admin/analysis/vbscripting.md
+++ b/docs/accessanalyzer/11.6/admin/analysis/vbscripting.md
@@ -16,13 +16,13 @@ The VBScript Editor has the following options:
- Save and Close – Saves the script and closes the window
- Syntax Check – Checks VB script syntax
- - Syntax Check does not identify logic errors, only instances where syntax is incorrect. Click
+ - Syntax Check doesn't identify logic errors, only instances where syntax is incorrect. Click
**Syntax Check** to open the Script Errors window which identifies syntax errors.
- Syntax Check reports back syntax errors starting from the beginning of the script to the end.
- Syntax Check does not return a list of errors.
+ Syntax Check doesn't return a list of errors.
-- Load file – Opens a File Explorer which can be used to navigate to a VBS file
-- Save to File – Saves the currently configured script into a VBS file
+- Load file – Opens a File Explorer window you can use to navigate to a VBS file
+- Save to File – Saves the configured script into a VBS file
- Undo – Undo the previous changes made to script (Ctrl+Z)
- Redo – Redo the previous changes made to script (Ctrl+Y)
- Cut – Cuts the highlighted script from the VB script editor (Ctrl+X)
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/options.md b/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/options.md
index 8390ab1a7b..ef6343746b 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/options.md
@@ -15,11 +15,11 @@ The Options page provides format options for returned data. It is a wizard page
- Return data as collected
- Return data in a separate row for each property set in the following group
- - Select the group from the drop-down menu
+ - Select the group from the dropdown menu
- Return each value of the following property in a separate row
- - Select the property from the drop-down menu
+ - Select the property from the dropdown menu
- How to return multi-valued properties in one cell – Select from the following options:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/overview.md
index 856e530282..17ad37a48e 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# ActiveDirectory Data Collector
-The ActiveDirectory Data Collector audits objects published in Active Directory. It has been
-preconfigured within the Active Directory Solution. Both this data collector and the solution are
+The ActiveDirectory Data Collector audits objects published in Active Directory. Netwrix
+preconfigures it within the Active Directory Solution. Both this data collector and the solution are
available with a special Enterprise Auditor license. See the
[Active Directory Solution](/docs/accessanalyzer/11.6/solutions/activedirectory/overview.md)
topic for additional information.
@@ -30,7 +30,7 @@ topic for additional information.
## ActiveDirectory Query Configuration
-The ActiveDirectory Data Collector is configured through the Active Directory Data Collector Wizard,
+Configure the ActiveDirectory Data Collector through the Active Directory Data Collector Wizard,
which contains the following wizard pages:
- Welcome
@@ -42,5 +42,5 @@ which contains the following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open, and save the configuration settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/results.md b/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/results.md
index 9d284bc3c8..c14e5f3314 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/results.md
@@ -6,11 +6,11 @@ sidebar_position: 30
# ActiveDirectory: Results
-The Results page is where Active Directory object properties to be gathered are selected. It is a
+Use the Results page to select the Active Directory object properties to gather. It is a
wizard page for all categories.
-Properties can be selected individually or the **Check all**, **Uncheck all**, and **Reset to
-defaults** buttons can be used. All selected properties are gathered. Available properties vary
+You can select properties individually, or use the **Check all**, **Uncheck all**, and **Reset to
+defaults** buttons. Enterprise Auditor gathers all selected properties. Available properties vary
based on the category selected.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/summary.md
index 98e5d90d7c..058b0bb673 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/activedirectory/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query. It wizard page for
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Active Directory Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Active Directory Data Collector Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/category.md b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/category.md
index e455ea4cc4..fe43f07caa 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/category.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# ADActivity: Category
-Use the Category page to identify how activity data is retrieved or removed.
+Use the Category page to identify how the data collector retrieves or removes activity data.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/cleartables.md b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/cleartables.md
index 4ab7037eef..8b878ed0de 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/cleartables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/cleartables.md
@@ -19,13 +19,13 @@ Tables** category task.
**Step 3 –** Click **Next** to go to the Results page. Optionally, select the **Success** checkbox
-to display a confirmation of successful removal in the results after the job is run.
+to display a confirmation of successful removal in the results after you run the job.
**Step 4 –** Click **Next** and then Click **Finish** to close the Active Directory Activity DC
Wizard. Click **OK** to close the Query Properties window.
:::warning
-When the job is run, all of the ADActivity standard reference tables are removed from
-the database.
+When you run the job, Enterprise Auditor removes all of the ADActivity standard reference tables
+from the database.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/connection.md b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/connection.md
index c9a8ad53d1..da4dac7b07 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/connection.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/connection.md
@@ -6,14 +6,14 @@ sidebar_position: 30
# ADActivity: SAM Connection
-The SAM connection page is where the port number is configured to send Active Directory data from
+Use the SAM connection page to configure the port number for sending Active Directory data from
Netwrix Activity Monitor. It is a wizard page for the category of:
- Import from SAM
-The following connection setting can be configured to connect to the Netwrix Activity Monitor
+Configure the following connection setting to connect to the Netwrix Activity Monitor
archive via an API Server:
- Port – Enter the API server port. The default is 4494.
@@ -24,14 +24,14 @@ archive via an API Server:
scan to continue
- Test SAM host – Enter the Activity Monitor API server name in a qualified domain name format.
- Click Connect to test the connection. A successful result populates the section underneath with a
+ Click Connect to test the connection. A successful result populates the following section with a
Refresh token.
- Exclude – Select archives to be ignored by the Active Directory Activity DC scan
:::warning
Save the Refresh token to a Text Editor for later use. The Refresh token resets
- each time the Test SAM host option is connected to. It must be replaced in the Connection
- profile if it is regenerated.
+ each time you connect using the Test SAM host option. If it regenerates, replace it in the
+ Connection profile.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/overview.md
index 6db6f96a5c..0f500513f7 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# ADActivity Data Collector
The ADActivity Data Collector integrates with the Netwrix Activity Monitor by reading the Active
-Directory activity log files. It has been preconfigured within the Active Directory Solution. Both
+Directory activity log files. Netwrix preconfigures it within the Active Directory Solution. Both
this data collector and the solution are available with a special Enterprise Auditor license. See
the
[Active Directory Solution](/docs/accessanalyzer/11.6/solutions/activedirectory/overview.md)
@@ -30,8 +30,8 @@ topic for additional information.
## ADActivity Query Configuration
-The ADActivity Data Collector is configured through the Active Directory Activity DC wizard, which
-contains the following wizard pages, which change based up on the query category selected:
+Configure the ADActivity Data Collector through the Active Directory Activity DC wizard, which
+contains the following wizard pages that change based on the query category you select:
- [ADActivity: Category](/docs/accessanalyzer/11.6/admin/datacollector/adactivity/category.md)
- [ADActivity: SAM Connection](/docs/accessanalyzer/11.6/admin/datacollector/adactivity/connection.md)
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/results.md b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/results.md
index 12eeb60a14..b8b1b3495e 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/results.md
@@ -6,10 +6,11 @@ sidebar_position: 60
# ADActivity: Results
-The Results page is where the properties to be gathered are selected. It is a wizard page for all of
+Use the Results page to select the properties to gather. It is a wizard page for all of
the categories.
-Properties can be selected individually or the **Select All** and **Clear All** buttons can be used.
-All selected properties are gathered. Available properties vary based on the category selected.
+You can select properties individually, or use the **Select All** and **Clear All** buttons.
+Enterprise Auditor gathers all selected properties. Available properties vary based on the category
+selected.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/scope.md b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/scope.md
index ba4c1bb14c..46d7179cfd 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/scope.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/scope.md
@@ -14,18 +14,18 @@ the categories of:
-The Timespan is defined according to the following two elements:
+Define the Timespan according to the following two elements:
- Relative Timespan – Number of days AD Activity is collected when the scan is run
- Absolute Timespan – Set the date range for the scan to collect AD Activity
:::info
- The threshold should be set for after the Netwrix Activity Monitor collects
- and archives its data but before they are deleted after a set retention period.
+ Set the threshold to a time after the Netwrix Activity Monitor collects
+ and archives its data, but before it deletes the data at the end of the retention period.
:::
-The Retention section sets what event type is collected and how many days Enterprise Auditor keeps
+The Retention section sets which event type Enterprise Auditor collects and how many days it keeps
the collected data in its SQL database. The table has the following columns:
- Event Type – The event type that may be enabled for the scan. The event types are:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/share.md b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/share.md
index d2679dd4c4..adb06ff81f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/share.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/share.md
@@ -13,13 +13,13 @@ of:
-The following connection setting can be configured to connect to the AD activity archives that must
+Configure the following connection setting to connect to the AD activity archives that must
be located on a Domain Controller share:
-- UNC Path – Enter the path of the share that stores AD Activity from the AD Agent(s). The ellipsis
+- UNC Path – Enter the path of the share that stores AD Activity from the AD Agents. The ellipsis
(**…**) opens a file explorer where the path can be navigated to and selected.
- - _Remember,_ all AD Agent logs must be archived to this location or the AD Activity data is not
+ - _Remember,_ all AD Agent logs must be archived to this location or the AD Activity data isn't
queried by Enterprise Auditor
- Include Sub-Directories – Select to include sub-directories on the targeted share. Use this option
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/standardtables.md b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/standardtables.md
index f53868ae5a..0bc22ed3ce 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/standardtables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/standardtables.md
@@ -10,7 +10,7 @@ The ADActivity Data Collector gathers essential user and group activity informat
reference tables. Unlike other Enterprise Auditor data collectors, the ADActivity Data Collector
writes data to these tables regardless of the job executing the query.
-These tables and their associated views are outlined below:
+The following table outlines these tables and their associated views:
| Table | Details |
| -------------------------------- | --------------------------------------------------------------------- |
@@ -36,7 +36,7 @@ These tables and their associated views are outlined below:
| SA_ADActivity_SPNs | Contains a unique identifier for each logon account |
Views are the recommended way for Enterprise Auditor users to obtain the information gathered by the
-ADActivity Data Collector. They contain additional information for building queries easily. The
+ADActivity Data Collector. They contain additional information for building queries. The
following is an explanation of the corresponding views created for some of the tables generated by
the ADActivity Data Collector:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/summary.md
index e4f4365772..22f8f053d5 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adactivity/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adactivity/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 70
# ADActivity: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for all of the
+The Summary page summarizes the configuration settings. It is a wizard page for all of the
categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Active Directory Activity DC wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Active Directory Activity DC wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/category.md b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/category.md
index 5038a8bec6..2012bcabbb 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/category.md
@@ -26,6 +26,6 @@ The categories include the following tasks:
:::note
The Scan Active Directory category is the pre-configured setting for the .Active Directory
Inventory Job Group. Therefore, accessing the Active Directory Inventory DC Wizard from the query
-within that job group does not display the Category wizard page.
+within that job group doesn't display the Category wizard page.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/cleartables.md b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/cleartables.md
index 68fb9be767..b80ced2bd6 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/cleartables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/cleartables.md
@@ -10,8 +10,7 @@ Sometimes when troubleshooting an ADInventory issue, it becomes necessary to cle
reference tables. Follow the steps.
:::warning
-Be careful when using this query task. It will result in the deletion of collected
-data.
+Be careful when using this query task. It deletes collected data.
:::
@@ -25,7 +24,8 @@ Tables** category task.
**Step 3 –** Click **Next** and then **Finish** to close the Active Directory Inventory DC Wizard.
Click **OK** to close the Query Properties window.
-When the job is run, all of the ADInventory standard reference tables are removed from the database.
+When you run the job, Enterprise Auditor removes all of the ADInventory standard reference tables
+from the database.
:::warning
Never leave the query task selected after job execution. Accidental data loss can
@@ -34,6 +34,6 @@ occur.
:::tip
-Remember, this job deletes data from the Enterprise Auditor database. Check the job has been
-configured correctly prior to job execution.
+Remember, this job deletes data from the Enterprise Auditor database. Verify that you configured
+the job correctly before running it.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/customattributes.md b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/customattributes.md
index 024fdeb001..00a0971269 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/customattributes.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/customattributes.md
@@ -6,25 +6,25 @@ sidebar_position: 70
# ADInventory: Custom Attributes
-The Custom Attributes page provides ability to add Active Directory attributes that are unique to
-the environment or not collected by default to be gathered. It is a wizard page for the category of
-Scan Active Directory.
+The Custom Attributes page lets you add Active Directory attributes that are unique to
+the environment or that Enterprise Auditor doesn't collect by default. It is a wizard page for the
+category of Scan Active Directory.
The
[Standard Reference Tables & Views for the ADInventory Data Collector](/docs/accessanalyzer/11.6/admin/datacollector/adinventory/standardtables.md)
-topic provides information on what is collected by default. Custom attributes added on this page are
-stored in the **SA_ADInventory_ExtendedAttributes** table.
+topic provides information on what Enterprise Auditor collects by default. Enterprise Auditor stores
+custom attributes added on this page in the **SA_ADInventory_ExtendedAttributes** table.
-The Custom Attribute is defined according to the following three elements:
+Define the Custom Attribute according to the following three elements:
- Domain Filter – Short or fully qualified name
- Object Class – User, Group, or Computer
- Attribute Name – As listed within Active Directory
Use the **Add**, **Edit**, and **Remove** buttons at the bottom of the window to configure the
-custom attributes to be gathered by the scan. See the
+custom attributes the scan gathers. See the
[Manually Add Custom Attributes](#manually-add-custom-attributes) topic for additional information.
The **Import** button opens the Custom Attributes Import Wizard. See the
@@ -38,30 +38,29 @@ article.
#### Manually Add Custom Attributes
The **Add** and **Edit** buttons on the Custom Attributes page open the Custom Attribute window.
-Follow the steps to manually add custom attributes.
+To manually add custom attributes:
**Step 1 –** On the Custom Attributes page of the Active Directory Inventory DC Wizard, click
**Add**. The Custom Attribute window opens.
-**Step 2 –** Enter the **Domain Filter**. This can be entered either as the short domain name or the
+**Step 2 –** Enter the **Domain Filter**. Enter this as either the short domain name or the
fully qualified domain name.
-**Step 3 –** Select the checkbox for the desired **Object Class**.
+**Step 3 –** Select the checkbox for the **Object Class** you want.
**Step 4 –** Enter the **Attribute Name** as it appears in Active Directory.
-**Step 5 –** Click **OK**. The Custom Attribute window closes and the specified attribute is added
-in the Custom Attributes page.
+**Step 5 –** Click **OK**. The Custom Attribute window closes, and Enterprise Auditor adds the
+specified attribute to the Custom Attributes page.
-Repeat this process until all desired Custom Attributes have been included.
+Repeat this process until you've included all desired Custom Attributes.
#### Custom Attributes Import Wizard
-The Custom Attributes Import Wizard is used to import a list of custom attributes into the
-ADInventory Data Collector configurations. Follow the steps to use the Custom Attributes Import
-Wizard.
+Use the Custom Attributes Import Wizard to import a list of custom attributes into the
+ADInventory Data Collector configurations:
**Step 1 –** On the Custom Attributes page of the Active Directory Inventory DC Wizard, click
**Import**. The Custom Attribute Import Wizard opens.
@@ -69,7 +68,7 @@ Wizard.
**Step 2 –** On the Credentials page, identify a domain either by entering one manually or selecting
-one from the **Domain Name** drop-down menu which displays a list of domains trusted by the one in
+one from the **Domain Name** dropdown menu which displays a list of domains trusted by the one in
which the Enterprise Auditor Console server resides. Then set the credentials for reading the
attributes list from the domain:
@@ -82,12 +81,12 @@ Click **Next** to continue.
**Step 3 –** The wizard populates available attributes from the domain specified on the Attributes
-page. Expand the desired object class and select the checkboxes for the custom attributes to be
-imported. Then click **Next**.
+page. Expand the object class you want and select the checkboxes for the custom attributes you want
+to import. Then click **Next**.
**Step 4 –** On the Summary page, click **Finish**.
-The selected attributes are added on the Custom Attributes page of the Active Directory Inventory DC
-Wizard.
+Enterprise Auditor adds the selected attributes to the Custom Attributes page of the Active
+Directory Inventory DC Wizard.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/indexupdateoptions.md b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/indexupdateoptions.md
index 25ad1450fd..1213b20dd9 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/indexupdateoptions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/indexupdateoptions.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# ADInventory: Index Update Options
-Configure options for maintaining SQL Server indexes while running queries using the Index Update
-Options page.
+Use the Index Update Options page to configure options for maintaining SQL Server indexes while
+running queries.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/options.md b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/options.md
index 72e8327edd..b48b4262a3 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/options.md
@@ -19,10 +19,10 @@ The Options page has the following configuration options:
- Ignore certificate errors? (For testing only) – Ignores untrusted certificate authority errors
and allows the scan to continue. This option is for testing purposes only.
-- Collect SID History from domain migrations – During a domain migration, the new infrastructure is
- created alongside the old infrastructure. The old account SID is typically added to the SID
- history attribute for the new account. The option to collect SID history is made available within
- the ADInventory Data Collector to assist resolving SIDs for domain migrations.
+- Collect SID History from domain migrations – A domain migration creates the new infrastructure
+ alongside the old infrastructure. The migration typically adds the old account SID to the SID
+ history attribute for the new account. The ADInventory Data Collector provides the option to
+ collect SID history to help resolve SIDs for domain migrations.
- Collect only updates since the last scan (recommended) – Default setting for differential
scanning. The updates collected are any changes to: group membership, attributes on user objects,
attributes on group objects, and so on.
@@ -30,7 +30,7 @@ The Options page has the following configuration options:
- Track changes into Change tracking tables – Records all changes since the last scan in
separate tables
- Limit Last Logon TimeStamp Changes – When selected, changes to the Last Logon TimeStamp
- Attribute are not recorded
+ Attribute aren't recorded
:::info
If tracking changes, use the Limit Last Logon TimeStamp Changes option.
@@ -40,16 +40,16 @@ The Options page has the following configuration options:
- Number of days you want to keep changes in the database – Use the arrow buttons or manually
enter a number to set the number of days to keep changes
- Target previously scanned domain controller – Collects updated information from the last
- domain controller targeted to reduce the scan time. Below are some considerations:
+ domain controller targeted to reduce the scan time. Consider the following:
- If the last domain controller is unavailable, the targeted domain controller is the
specified domain controller from the host list. If using the domain name, it attempts to
find the last scanned domain controller.
- - If that domain controller is determined to be unavailable, then it runs a full scan on the
+ - If that domain controller turns out to be unavailable, it runs a full scan on the
next domain controller that responds. Then, it will scan the new domain controller for
changes going forward.
Selecting the **Track changes into Change tracking tables** option enables the **Number of days
- you want to keep changes in the database** box. This allows for changes in Active Directory to
- be tracked. When change tracking is enabled, notification analysis tasks can be used to send
+ you want to keep changes in the database** box. This allows Enterprise Auditor to track changes
+ in Active Directory. With change tracking enabled, use notification analysis tasks to send
alerts.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/overview.md
index b62afd5a40..c835906efc 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/overview.md
@@ -9,11 +9,11 @@ sidebar_position: 40
The extraction and correlation of user, group, and computer attributes drastically transforms the
meaning of data collected across the many systems and applications that are linked to Active
Directory. The ADInventory Data Collector is designed as a highly scalable and useful data
-collection mechanism to catalogue user, group, and computer object information that can be used by
-other solutions within Enterprise Auditor.
+collection mechanism to catalogue user, group, and computer object information that other solutions
+within Enterprise Auditor can use.
-The ADInventory Data Collector is a core component of Enterprise Auditor and has been preconfigured
-to be used within the .Active Directory Inventory Solution. Both this data collector and the
+The ADInventory Data Collector is a core component of Enterprise Auditor. Netwrix preconfigures it
+for use within the .Active Directory Inventory Solution. Both this data collector and the
solution are available with all Enterprise Auditor license options. See the
[.Active Directory Inventory Solution](/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/overview.md)
topic for additional information.
@@ -44,14 +44,14 @@ topic for additional information.
## Functional Design of the ADInventory Data Collector
-The ADInventory Data Collector has been designed to update incrementally. Once it has run against a
+The ADInventory Data Collector updates incrementally. After it runs against a
domain controller, additional collections gather changes made since the last scan. This enables the
-ADInventory Data Collector to function efficiently within large environments. Each time it is run
+ADInventory Data Collector to function efficiently within large environments. Each time you run it
against different domain controllers, it restarts the cycle.
## ADInventory Query Configuration
-The ADInventory Data Collector is configured through the Active Directory Inventory DC Wizard, which
+Configure the ADInventory Data Collector through the Active Directory Inventory DC Wizard, which
contains the following wizard pages:
- Welcome
@@ -64,5 +64,5 @@ contains the following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open, and save the configuration settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/results.md b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/results.md
index e6bc6261d4..3326e6c1cd 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/results.md
@@ -6,14 +6,14 @@ sidebar_position: 30
# ADInventory: Results
-The Results page is where properties from Active Directory to be gathered are selected. It is a
+Use the Results page to select the properties from Active Directory to gather. It is a
wizard page for the category of Scan Active Directory.
-Properties can be selected individually or the **Select All** or **Clear All** buttons can be used.
-All selected properties are gathered.
+You can select properties individually, or use the **Select All** or **Clear All** buttons.
+Enterprise Auditor gathers all selected properties.
-This information is not available within the standard reference tables and views. Instead, this
-information can be viewed in the SA_ADInventory_DEFAULT table, which is created when any of these
-properties are selected.
+This information isn't available within the standard reference tables and views. Instead, you can
+view it in the SA_ADInventory_DEFAULT table, which Enterprise Auditor creates when you select any of
+these properties.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/standardtables.md b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/standardtables.md
index 1a4a8f00d3..315be0fd7b 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/standardtables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/standardtables.md
@@ -10,7 +10,7 @@ The ADInventory Data Collector gathers essential user and group inventory inform
reference tables. Unlike other Enterprise Auditor data collectors, the ADInventory Data Collector
writes data to these tables regardless of the job executing the query.
-These tables and their associated views are outlined below:
+The following table outlines these tables and their associated views:
| Table | Details | AD Object Reference Article |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -33,7 +33,7 @@ These tables and their associated views are outlined below:
Views are the recommended way for you to obtain the information gathered by the ADInventory Data
-Collector. They contain additional information for building queries easily.
+Collector. They contain additional information for building queries.
The following is an explanation of the corresponding views created for some of the tables generated
by the ADInventory Data Collector:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/summary.md
index ebcc0ead07..44316d83f7 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adinventory/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adinventory/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 80
# ADInventory: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for all of the
+The Summary page summarizes the configuration settings. It is a wizard page for all of the
categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Active Directory Inventory DC Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Active Directory Inventory DC Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/category.md b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/category.md
index 60ea8d5c14..166934a165 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/category.md
@@ -6,8 +6,7 @@ sidebar_position: 20
# ADPermissions: Category
-The ADPermissions Data Collector Category page identifies what kind of information to retrieve using
-the Category wizard page.
+The ADPermissions Data Collector Category page identifies what kind of information to retrieve.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/customfilter.md b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/customfilter.md
index a1cf116329..35c106ffab 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/customfilter.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/customfilter.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# ADPermissions: Custom Filter
The Custom Filter page provides options to configure settings for object permission collection. It
-is only available if the Custom Filter option is checked on the Scope page. It is a wizard page for
+is only available if you check the Custom Filter option on the Scope page. It is a wizard page for
the categories of:
- Scan Active Directory Permissions
@@ -19,11 +19,11 @@ The configurable options are:
- Root Path – Enter the AD root path
- - Select the distinguished name from the drop-down menu to the right of the Root Path
+ - Select the distinguished name from the dropdown menu to the right of the Root Path
- Click **Preview** to show an example of the complete path
- LDAP Filter – Enter a custom filter string
-- Scope – Select an option from the drop-down menu:
+- Scope – Select an option from the dropdown menu:
- Base – Limits the scope to the base object. The maximum number of objects returned is always
one.
@@ -31,4 +31,4 @@ The configurable options are:
object itself
- Sub tree – (or a deep scope) includes all child objects as well as the base object
-- Click **Add** to add the filter criteria to the list. Multiple filters can be used.
+- Click **Add** to add the filter criteria to the list. You can use multiple filters.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/overview.md
index dc95436186..14b0801253 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# ADPermissions Data Collector
-The ADPermissions Data Collector collects the advanced security permissions of objects in AD. It is
-preconfigured within the Active Directory Permissions Analyzer Solution. Both this data collector
+The ADPermissions Data Collector collects the advanced security permissions of objects in AD.
+Netwrix preconfigures it within the Active Directory Permissions Analyzer Solution. Both this data collector
and the solution are available with a special Enterprise Auditor license. See the
[Active Directory Permissions Analyzer Solution](/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/overview.md)
topic for additional information.
@@ -32,9 +32,9 @@ topic for additional information.
## ADPermissions Query Configuration
-The ADPermissions Data Collector is configured through the Active Directory Permissions Data
-Collector Wizard. The wizard contains the following pages, which change based upon the query
-category selected:
+Configure the ADPermissions Data Collector through the Active Directory Permissions Data
+Collector Wizard. The wizard contains the following pages, which change based on the query
+category you select:
- [ADPermissions: Category](/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/category.md)
- [ADPermissions: Scope](/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/scope.md)
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/removetables.md b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/removetables.md
index 06eaf2440e..e2c0300dbf 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/removetables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/removetables.md
@@ -12,7 +12,7 @@ Connection Profile applied should be the same as the one used for the associated
Permissions Analyzer** > **0.Collection** Job. Follow the steps.
:::warning
-Using this query task results in the deletion of collected data.
+Using this query task deletes collected data.
:::
@@ -21,23 +21,23 @@ Using this query task results in the deletion of collected data.
**Step 2 –** In the Active Directory Permissions Data Collector Wizard, on the Category page select
the **Remove Tables** category and click **Next**.
-**Step 3 –** On the Results page, make sure all the Available Properties are selected and click
+**Step 3 –** On the Results page, ensure all the Available Properties are selected and click
**Next**.
**Step 4 –** Click **Finish** to close the Active Directory Permissions Data Collector Wizard. Click
**OK** to close the Query Properties window.
-When the job is run, all of the ADPermissions standard reference tables are removed from the
-database.
+When you run the job, Enterprise Auditor removes all of the ADPermissions standard reference tables
+from the database.
:::tip
-Remember, this job deletes data from the Enterprise Auditor database. Ensure the job has been
-configured correctly prior to executing the job.
+Remember, this job deletes data from the Enterprise Auditor database. Ensure you configure the job
+correctly before running it.
:::
:::warning
-Never leave the query task selected after the job has been executed. Accidental data
+Never leave the query task selected after you execute the job. Accidental data
loss can occur.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/results.md b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/results.md
index a6d16adbf8..e6ebc7d718 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/results.md
@@ -6,10 +6,11 @@ sidebar_position: 60
# ADPermissions: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for all
+Use the Results page to select the properties to gather. It is a wizard page for all
of the categories.
-Available properties vary based on the category selected. Properties can be selected individually or
-the **Select All** and **Clear All** buttons can be used. All selected properties are gathered.
+Available properties vary based on the category selected. You can select properties individually,
+or use the **Select All** and **Clear All** buttons. Enterprise Auditor gathers all selected
+properties.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/scope.md b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/scope.md
index e396153073..704da21387 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/scope.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/scope.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# ADPermissions: Scope
-The Scope page is where the scope for the Active Directory permissions scan is configured. It is a
+Use the Scope page to configure the scope for the Active Directory permissions scan. It is a
wizard page for the categories of:
- Scan Active Directory Permissions
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/standardtables.md b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/standardtables.md
index aadb080a7d..c03c2f7cfc 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/standardtables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/standardtables.md
@@ -10,7 +10,7 @@ The ADPermissions Data Collector gathers essential user and group inventory info
standard reference tables. Unlike other Enterprise Auditor data collectors, the ADPermissions Data
Collector writes data to these tables regardless of the job executing the query.
-These tables and their associated views are outlined below:
+The following table outlines these tables and their associated views:
| Table | Details |
| -------------------------------------- | ------------------------------------------------- |
@@ -27,7 +27,7 @@ These tables and their associated views are outlined below:
| SA_ADPerms_Sets | Junction table to associate permissions with ACLs |
Views are the recommended way for Enterprise Auditor users to obtain the information gathered by the
-ADPermissions Data Collector. They contain additional information for building queries easily. The
+ADPermissions Data Collector. They contain additional information for building queries. The
following is an explanation of the corresponding views created for some of the tables generated by
the ADPermissions Data Collector:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/summary.md
index 986edb0600..1e8f18a578 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/adpermissions/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 70
# ADPermissions: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for all of the
+The Summary page summarizes the configuration settings. It is a wizard page for all of the
categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Active Directory Permissions Data Collector Wizard ensuring that no
-accidental clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Active Directory Permissions Data Collector Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/aws/criteria.md b/docs/accessanalyzer/11.6/admin/datacollector/aws/criteria.md
index f74bfdd72f..baa19c1492 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/aws/criteria.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/aws/criteria.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# AWS: Criteria
-The Criteria (Select DLP criteria for this scan) page is where criteria to be used for discovering
-sensitive data during a scan is configured. It is a wizard page for the category of Collect SDD
+Use the Criteria (Select DLP criteria for this scan) page to configure the criteria for discovering
+sensitive data during a scan. It is a wizard page for the category of Collect SDD
Data.
This page requires the Sensitive Data Discovery Add-On to be been installed on the Enterprise
@@ -17,11 +17,11 @@ topic for additional information.
-Default criteria is set at the **Global Settings** > **Sensitive Data** node. Choose between the
+Set default criteria at the **Global Settings** > **Sensitive Data** node. Choose between the
**Use Global Criteria** Selection and the **Use the Following Selected Criteria** radio buttons.
-For custom criteria, select the checkbox for the criteria to be used to search for sensitive data.
-There are **Select All** and **Clear All** buttons that can be used.
+For custom criteria, select the checkbox for the criteria to use to search for sensitive data.
+You can use the **Select All** and **Clear All** buttons.
The table contains the following types of criteria:
@@ -34,7 +34,7 @@ Criteria and User Criteria nodes are visible in the table.
:::
-User-defined criteria is created in the Criteria Editor, accessed through the **Global Settings** >
+Create user-defined criteria in the Criteria Editor, accessed through the **Global Settings** >
**Sensitive Data** node. See the
[Sensitive Data Discovery Add-On](/docs/accessanalyzer/11.6/sensitivedatadiscovery/overview.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/aws/droptables.md b/docs/accessanalyzer/11.6/admin/datacollector/aws/droptables.md
index 5d56597c3e..999e27cec5 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/aws/droptables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/aws/droptables.md
@@ -7,7 +7,7 @@ sidebar_position: 80
# Drop AWS Tables
Sometimes when troubleshooting an AWS issue, it becomes necessary to clear the AWS DC data and
-tables from the Enterprise Auditor database. Follow the steps to configure a job to remove tables.
+tables from the Enterprise Auditor database. To configure a job to remove tables:
**Step 1 –** Create a new job.
@@ -24,13 +24,14 @@ tables from the Enterprise Auditor database. Follow the steps to configure a job
Collector Wizard. Click **OK** to close the Query Properties window.
:::warning
-When the job is run, all of the AWS DC data and tables are removed from the database.
+When you run the job, Enterprise Auditor removes all of the AWS DC data and tables
+from the database.
:::
The job is now configured and ready to run.
:::note
-An AWS connection profile is not required for the Drop AWS DC Tables task.
+An AWS connection profile isn't required for the Drop AWS DC Tables task.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/aws/filters3objects.md b/docs/accessanalyzer/11.6/admin/datacollector/aws/filters3objects.md
index d8af8074f0..f301f4493b 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/aws/filters3objects.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/aws/filters3objects.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# AWS: Filter S3 Objects
-The Filter S3 Objects page provides the options to filter which objects stored in S3 should be
-queried for permissions and sensitive data. It is a wizard page for the categories of:
+The Filter S3 Objects page provides options to filter which objects stored in S3 to query for
+permissions and sensitive data. It is a wizard page for the categories of:
- Collect S3
- Collect SDD Data
@@ -32,7 +32,7 @@ Select from the available buckets and click **OK** to add them to the Filter S3
## Add Custom Filter
-The Add Custom Filter window allows a custom filter to be configured.
+The Add Custom Filter window lets you configure a custom filter.
@@ -41,6 +41,6 @@ Configure a custom filter using the following format:
- The characters `*` and `?` are wildcards
- `*` – matches any number of characters
- `?` – matches a single character
-- ARN should follow the format: `arn:aws:s3:::/`
+- The Amazon Resource Name (ARN) should follow the format: `arn:aws:s3:::/`
Click **Save** to add the custom filter to the Filter S3 Objects page.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/aws/loginroles.md b/docs/accessanalyzer/11.6/admin/datacollector/aws/loginroles.md
index 4d4a926275..392983642f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/aws/loginroles.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/aws/loginroles.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# AWS: Login Roles
-The Login Roles page is where the previously created AWS Roles are added. It is a wizard page for
+Use the Login Roles page to add the previously created AWS Roles. It is a wizard page for
the categories of:
- Collect Org data
@@ -25,5 +25,5 @@ topic for additional information. The page has the following options:
- Remove – Remove the selected role from the list
- Clear – Remove all roles from the list
- Max Session Duration (hours) – Specify the maximum time the account can be logged in for. This
- value should not exceed the SessionDuration configured for the role in AWS. The default value is 1
+ value shouldn't exceed the SessionDuration configured for the role in AWS. The default value is 1
and the maximum value is 12.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/aws/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/aws/overview.md
index 34b28d7390..7c591d1b4a 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/aws/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/aws/overview.md
@@ -7,8 +7,9 @@ sidebar_position: 60
# AWS Data Collector
The AWS Data Collector collects IAM users, groups, roles, and policies, as well as S3 permissions,
-content, and sensitive data from the target Amazon Web Services (AWS) accounts. The AWS Data
-Collector has been preconfigured for the AWS Solution. Both this data collector and the solution are
+content, and sensitive data from the target Amazon Web Services (AWS) accounts. Netwrix
+preconfigures the AWS Data Collector for the AWS Solution. Both this data collector and the solution
+are
available with a special Enterprise Auditor license. See the
[AWS Solution](/docs/accessanalyzer/11.6/solutions/aws/overview.md)
topic for additional information.
@@ -46,15 +47,15 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
+which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans,
+increase the minimum amount of RAM. Each thread requires a minimum of 2
additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
then an extra 16 GB of RAM are required (8x2=16).
## AWS Query Configuration
-The AWS Data Collector is configured through the Amazon Web Services Data Collector Wizard. The
-wizard contains the following pages, which change based up on the query category selected:
+Configure the AWS Data Collector through the Amazon Web Services Data Collector Wizard. The
+wizard contains the following pages, which change based on the query category you select:
- [AWS: Category](/docs/accessanalyzer/11.6/admin/datacollector/aws/category.md)
- [AWS: Login Roles](/docs/accessanalyzer/11.6/admin/datacollector/aws/loginroles.md)
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/aws/results.md b/docs/accessanalyzer/11.6/admin/datacollector/aws/results.md
index 178c7939bc..723f80c7fb 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/aws/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/aws/results.md
@@ -6,10 +6,11 @@ sidebar_position: 60
# AWS: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for all
+Use the Results page to select the properties to gather. It is a wizard page for all
of the categories.
-Properties can be checked individually or the **Select All** or **Clear All** buttons can be used.
-All checked properties are gathered. Available properties vary based on the category selected.
+You can check properties individually, or use the **Select All** or **Clear All** buttons.
+Enterprise Auditor gathers all checked properties. Available properties vary based on the category
+selected.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/aws/sensitivedata.md b/docs/accessanalyzer/11.6/admin/datacollector/aws/sensitivedata.md
index 8d939f7ce8..ffde7f3b03 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/aws/sensitivedata.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/aws/sensitivedata.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# AWS: Sensitive Data Settings
-The Sensitive Data Settings page is where sensitive data discovery settings are configured. It is a
+Use the Sensitive Data Settings page to configure sensitive data discovery settings. It is a
wizard page for the category of Collect SDD Data.
@@ -46,7 +46,7 @@ Configure the following options:
- Spreadsheets
- Text/Markup files
-- Perform differential scan of – Enables you to choose whether to employ incremental scanning:
+- Perform differential scan of – Choose whether to employ incremental scanning:
- Files modified since last scan – Scans only files modified since the last scan
- Files modified since [date] – Only scans files modified after the specified date
@@ -54,7 +54,7 @@ Configure the following options:
of days
- Number of SDD scan processes [number] – Increases the number of SDD scanner processes that spawn
- as part of a scan, increasing parallel scanning. The value should not exceed 2x the number of CPU
+ as part of a scan, increasing parallel scanning. The value shouldn't exceed 2x the number of CPU
threads available.
:::tip
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/aws/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/aws/summary.md
index 10e5b4883b..c58b7a8458 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/aws/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/aws/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query. It is a wizard page
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Amazon Web Services Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Amazon Web Services Data Collector Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/category.md b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/category.md
index 020b9f42d7..8cec1e8662 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/category.md
@@ -21,5 +21,5 @@ The two categories are:
topic for more information.
The Scan Entra ID category is the pre-configured setting for the .Entra ID Inventory Job Group.
-Therefore, accessing the Entra ID Inventory DC Wizard from the query within that job group does not
+Therefore, accessing the Entra ID Inventory DC Wizard from the query within that job group doesn't
display the Category wizard page.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/configurejob.md b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/configurejob.md
index 6f12c1484b..67963e0688 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/configurejob.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/configurejob.md
@@ -6,14 +6,14 @@ sidebar_position: 20
# Microsoft Entra ID Connection Profile & Host List
-The AzureADInventory Data Collector requires a custom Connection Profile and host list to be created
-and assigned to the job or job group conducting the data collection. The host inventory option
-during host list creation makes it necessary to configure the Connection Profile first.
+The AzureADInventory Data Collector requires you to create a custom Connection Profile and host
+list, and assign them to the job or job group conducting the data collection. The host inventory
+option during host list creation requires you to configure the Connection Profile first.
## Connection Profile
-Creating the Connection Profile requires having the Client ID and Key that was generated when
-Enterprise Auditor was registered as a web application with Microsoft Entra ID. See the
+Creating the Connection Profile requires the Client ID and Key generated when you registered
+Enterprise Auditor as a web application with Microsoft Entra ID. See the
[Microsoft Entra ID Auditing Configuration](/docs/accessanalyzer/11.6/requirements/entraid/entraid/access.md)
for additional information.
@@ -33,7 +33,7 @@ Create a Connection Profile and set the following information on the User Creden
[Generate the Client Secret Key](/docs/accessanalyzer/11.6/requirements/entraid/entraid/access.md#generate-the-client-secret-key)
topic for additional information.
-Once the Connection Profile is created, it is time to create the custom host list. See the
+After you create the Connection Profile, create the custom host list. See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/customattributes.md b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/customattributes.md
index 96b5ddf68c..204675d91f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/customattributes.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/customattributes.md
@@ -6,8 +6,7 @@ sidebar_position: 50
# AzureADInventory: Custom Attributes
-Use the Custom Attributes wizard page to define custom attributes that will be used in the Microsoft
-Entra ID scan.
+Use the Custom Attributes wizard page to define custom attributes for the Microsoft Entra ID scan.
@@ -21,7 +20,7 @@ Configuration options for Custom Attributes include:
will only scan changes since the last scan was performed.
:::warning
- A full scan is required when new attributes are added or removed.
+ You must run a full scan when you add or remove attributes.
:::
@@ -35,7 +34,7 @@ Configuration options for Custom Attributes include:
Attributes Import Wizard.
Use the **Add**, **Edit**, and **Remove** buttons at the bottom of the window to configure the
-custom attributes to be gathered by the scan. Use the **Add** button to open the
+custom attributes the scan gathers. Use the **Add** button to open the
[Custom Attribute Window](#custom-attribute-window). The **Import** button opens the
[Custom Attributes Import Wizard](#custom-attributes-import-wizard).
@@ -48,7 +47,7 @@ window.
The options on the Custom Attributes window are:
-- Tenant Filter – Use a Tenant Name or wildcard to target the desired environment. Wildcards (\*)
+- Tenant Filter – Use a Tenant Name or wildcard to target the environment you want. Wildcards (\*)
can be used.
- Object Class – One or more object class for the attribute can be selected:
- User
@@ -58,7 +57,7 @@ The options on the Custom Attributes window are:
- Collect all sub-attributes – Allows the collection of sub-attributes
- Sub-Attribute Name – Define the sub-attribute name. Wildcards (\*) can be used.
-Repeat this process until all desired Custom Attributes have been included. Click **OK** to save the
+Repeat this process until you include all desired Custom Attributes. Click **OK** to save the
attribute.
#### Custom Attributes Import Wizard
@@ -72,8 +71,9 @@ Custom Attributes Import Wizard opens.
-**Step 2 –** On the Connection page, enter the Tenant Name of the instance of Microsoft Entra ID to
-be targeted, and then select the method of supplying credentials for the specified tenant instance:
+**Step 2 –** On the Connection page, enter the Tenant Name of the Microsoft Entra ID instance you
+want to target, and then select the method of supplying credentials for the specified tenant
+instance:
- Use the following connection profile entry – Select an Azure Connection Profile from the dropdown
list
@@ -94,7 +94,7 @@ or the
[Microsoft Entra ID Connection Profile & Host List](/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/configurejob.md)
topics for additional information.
-**Step 3 –** Click **Test Connection** in order to connect to the tenant with the supplied
+**Step 3 –** Click **Test Connection** to connect to the tenant with the supplied
credentials. If they are correct, the Schema Attributes and Application Attributes pages become
available. Click **Next** to navigate to them.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/overview.md
index 9fa942223c..8dea1ff3af 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/overview.md
@@ -8,7 +8,7 @@ sidebar_position: 70
The AzureADInventory Data Collector catalogs user and group object information from Microsoft Entra
ID, formerly Azure Active Directory. This data collector is a core component of Enterprise Auditor
-and is preconfigured in the .Entra ID Inventory Solution.
+and Netwrix preconfigures it in the .Entra ID Inventory Solution.
Both this data collector and the solution are available with all Enterprise Auditor license options.
See the
@@ -50,7 +50,7 @@ topic for additional information.
## AzureADInventory Query Configuration
-The AzureADInventory Data Collector is configured through the Entra ID Inventory DC Wizard, which
+Configure the AzureADInventory Data Collector through the Entra ID Inventory DC Wizard, which
contains the following wizard pages:
- Welcome
@@ -62,5 +62,5 @@ contains the following wizard pages:
-Hide the Welcome page the next time this data collected is accessed by selecting the **Do not
+To hide the Welcome page the next time you access this data collector, select the **Don't
display this page the next time** checkbox.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/results.md b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/results.md
index 3b2653b831..5281eabeaf 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/results.md
@@ -6,12 +6,13 @@ sidebar_position: 60
# AzureADInventory: Results
-The Results page is where the properties from Microsoft Entra ID to be gathered are selected. It is
+Use the Results page to select the properties from Microsoft Entra ID to gather. It is
a wizard page for the category of Scan Entra ID.
-Properties can be checked individually or the **Select All** and **Clear All** buttons can be used.
-All checked properties are collected. This information is not available within the standard
-reference tables and views. Instead, this information can be viewed in the
-**SA_AzureADInventory_DEFAULT** table, which is created when any of these properties are selected.
+You can check properties individually, or use the **Select All** and **Clear All** buttons.
+Enterprise Auditor collects all checked properties. This information isn't available within the
+standard reference tables and views. Instead, you can view this information in the
+**SA_AzureADInventory_DEFAULT** table, which Enterprise Auditor creates when you select any of
+these properties.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/standardtables.md b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/standardtables.md
index 3427100659..3ba859981a 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/standardtables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/standardtables.md
@@ -10,7 +10,7 @@ The AzureADInventory Data Collector collects essential user and group inventory
standard reference tables. Unlike other Enterprise Auditor data collectors, the AzureADInventory
Data Collector writes data to these tables regardless of the job executing the query.
-These tables and their associated views are outlined below:
+The following table outlines these tables and their associated views:
| Table | Details |
| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -27,7 +27,7 @@ These tables and their associated views are outlined below:
| SA_AzureADInventory_Users | Contains extended information about users, department, title, and so on |
Views are the recommended way for you to obtain the information gathered by the AzureADInventory
-Data Collector. They contain additional information for building queries easily. The following is an
+Data Collector. They contain additional information for building queries. The following is an
explanation of the corresponding views created for some of the tables generated by the
AzureADInventory Data Collector:
@@ -43,7 +43,7 @@ AzureADInventory Data Collector:
### AzureADInventory Exception Types Translated
-The following table translates the Type of Exceptions that can found.
+The following table translates the types of exceptions you might encounter.
| Type | Exception | Description |
| ---- | -------------------- | ------------------------------------------------------------------------- |
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/summary.md
index b55ed855b9..c0b3b96258 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 70
# AzureADInventory: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for both of the
+The Summary page summarizes the configuration settings. It is a wizard page for both of the
categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Entra ID Inventory DC Wizard to ensure that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Entra ID Inventory DC Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/troubleshooting.md b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/troubleshooting.md
index d69b108d63..94cbe50746 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/troubleshooting.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/troubleshooting.md
@@ -19,8 +19,8 @@ category task.
**Step 3 –** Click **Next** and then **Finish** to close the Entra ID Inventory DC Wizard. Click
**OK** to close the Query Properties window.
-When the job is run, all of the AzureADInventory standard reference tables are removed from the
-database.
+When you run the job, Enterprise Auditor removes all of the AzureADInventory standard reference
+tables from the database.
## Troubleshooting Error Messages
@@ -28,12 +28,12 @@ Change the XML parameters to address the following errors:
Error: Microsoft.Graph.ServiceException: Code: timeout Message: The request timed out
-Update the `` parameter to update the number of retries to run the query.
+Update the `` parameter to set the number of query retries.
The default is 3.
Error: An existing connection was forcible closed by the remote host
-Update the `` parameter to update the max delta token age. The default is 6.
+Update the `` parameter to set the maximum delta token age. The default is 6.
See the
[View Job XML File](/docs/accessanalyzer/11.6/admin/jobs/job/properties/viewxml.md)
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/box/activityoperationscope.md b/docs/accessanalyzer/11.6/admin/datacollector/box/activityoperationscope.md
index b1c066f5b8..cb8ac9770f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/box/activityoperationscope.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/box/activityoperationscope.md
@@ -6,13 +6,13 @@ sidebar_position: 70
# Box: Activity Operation Scope
-The Activity Operation Scope page (ActivityOperationScope) is where Box Enterprise events can be
-selected or unselected for scans. It is a wizard page for the Scan Box Activity category.
+Use the Activity Operation Scope page (ActivityOperationScope) to select or unselect Box Enterprise
+events for scans. It is a wizard page for the Scan Box Activity category.
-Event filters can be selected by group or the group may be expanded and the filters selected
-individually. All selected filters are gathered from the Box environment.
+You can select event filters by group, or expand the group and select filters individually.
+Enterprise Auditor gathers all selected filters from the Box environment.
Event filters include:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/box/activitytimeframescope.md b/docs/accessanalyzer/11.6/admin/datacollector/box/activitytimeframescope.md
index fa09bd3e8b..a83f83b341 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/box/activitytimeframescope.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/box/activitytimeframescope.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# Box: Activity Timeframe Scope
-The Activity Timespan Scope page (ActivityTimeframeScope) is where Box activity data collection is
-configured. It is a wizard page for the Scan Box Activity category.
+Use the Activity Timespan Scope page (ActivityTimeframeScope) to configure Box activity data
+collection. It is a wizard page for the Scan Box Activity category.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/box/additionalscoping.md b/docs/accessanalyzer/11.6/admin/datacollector/box/additionalscoping.md
index 9063678bdc..33a1bf6543 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/box/additionalscoping.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/box/additionalscoping.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Box: Additional Scoping
-The Additional Scoping page is where the scan can be limited by depth of the scan. It is a wizard
+Use the Additional Scoping page to limit the scan by depth. It is a wizard
page for the Scan Box Permissions category.
@@ -14,7 +14,7 @@ page for the Scan Box Permissions category.
Configure the scan depth level:
- Limit scanned depth to: [number] level – Select the checkbox and set the scan depth level to the
- desired depth. If this checkbox is not selected, then the entire Box environment will be scanned,
+ desired depth. If this checkbox isn't selected, then the entire Box environment will be scanned,
according to the
[Box: Exclusions Page](/docs/accessanalyzer/11.6/admin/datacollector/box/exclusions.md)
settings. If the scoping depth is set to **0** then only root will be scanned. Each increment will
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/box/authenticate.md b/docs/accessanalyzer/11.6/admin/datacollector/box/authenticate.md
index d504fce9b4..46b70744b0 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/box/authenticate.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/box/authenticate.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# Box: Authenticate
-The Authenticate page is where connection to the Box environment is configured. It is a wizard page
+Use the Authenticate page to configure the connection to the Box environment. It is a wizard page
for all categories.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/box/exclusions.md b/docs/accessanalyzer/11.6/admin/datacollector/box/exclusions.md
index d2ea84b4dc..b14c744d96 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/box/exclusions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/box/exclusions.md
@@ -6,21 +6,21 @@ sidebar_position: 30
# Box: Exclusions Page
-The Exclude or Include folders page (ExclusionsPage) is where the scan can be limited to include or
-to exclude folders within the Box Enterprise. It is a wizard page for of Scan Box Permissions
+Use the Exclude or Include folders page (ExclusionsPage) to limit the scan to include or
+exclude folders within the Box Enterprise. It is a wizard page for of Scan Box Permissions
category.
The options on the Exclusions Page are:
-- Add as inclusion – Type the path of a folder in the text box to include in the scan. The folder
+- Add as inclusion – Enter the path of a folder in the text box to include in the scan. The folder
path must not include a slash at the end.
- Example format: `/All Files/Folder/SubFolder`
- Incorrect format: `/All Files/Folder/SubFolder/`
-- Add as exclusion – Type the path of a folder in the text box to exclude from the scan
+- Add as exclusion – Enter the path of a folder in the text box to exclude from the scan
The **Remove** option will delete a selected folder from the list. The **Clear List** option will
remove all folders from the list.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/box/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/box/overview.md
index 85ee6431d3..4b81a5f14d 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/box/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/box/overview.md
@@ -9,13 +9,12 @@ sidebar_position: 80
The Box Data Collector audits access, group membership, and content within a Box enterprise.
:::note
-If the Box Data Collector is used in a new job, outside of the Box Solution, it is
-necessary to deselect the **Skip Hosts that do not respond to PING** option on the job’s
-**Properties** > **Performance** tab.
+If you use the Box Data Collector in a new job, outside of the Box Solution, deselect the
+**Skip Hosts that don't respond to PING** option on the job’s **Properties** > **Performance** tab.
:::
-The Box Data Collector has been preconfigured within the Box Solution. Both this data collector and
+Netwrix preconfigures the Box Data Collector within the Box Solution. Both this data collector and
the solution are available with a special Enterprise Auditor license. See the
[Box Solution](/docs/accessanalyzer/11.6/solutions/box/overview.md)
topic for additional information.
@@ -36,8 +35,8 @@ topic for additional information.
## Box Query Configuration
-The Box Data Collector is configured through the Box Data Collector Wizard. The wizard contains the
-following pages, which change based up on the query category selected:
+Configure the Box Data Collector through the Box Data Collector Wizard. The wizard contains the
+following pages, which change based on the query category you select:
- Welcome
- [Box: Category](/docs/accessanalyzer/11.6/admin/datacollector/box/category.md)
@@ -56,5 +55,5 @@ introductory and caution information about the Box Data Collector before proceed
-The Welcome page can be hidden by checking the **Do not display this page the next time** box when
-the wizard is open and configuration settings are saved.
+To hide the Welcome page, check the **Don't display this page the next time** box while the wizard
+is open, and save the configuration settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/box/results.md b/docs/accessanalyzer/11.6/admin/datacollector/box/results.md
index 4d9bd5cb9b..5319c58864 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/box/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/box/results.md
@@ -6,10 +6,11 @@ sidebar_position: 90
# Box: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for all
+Use the Results page to select the properties to gather. It is a wizard page for all
categories.
-Properties can be selected individually or the **Select All** or **Clear All** buttons can be used.
-All selected properties will be gathered. Available properties vary based on the category selected.
+You can select properties individually, or use the **Select All** or **Clear All** buttons.
+Enterprise Auditor gathers all selected properties. Available properties vary based on the category
+selected.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/box/scopebyuser.md b/docs/accessanalyzer/11.6/admin/datacollector/box/scopebyuser.md
index d4b64f3e83..4bc79bdfb6 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/box/scopebyuser.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/box/scopebyuser.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# Box: Scope by User Page
-The User Scope Settings page (ScopeByUserPage) is where the scope of the scan can be limited to
-specified users and the resulting scan will only scan for the specified users. It is a wizard page
+Use the User Scope Settings page (ScopeByUserPage) to limit the scope of the scan to
+specified users; the resulting scan only scans for the specified users. It is a wizard page
for the Scan Box Permissions category.
@@ -18,8 +18,8 @@ included in the scan. The CSV file should have one email address per row.
:::note
The query will collect information related to User names and Group membership for all
-users in a target environment. However, if the query is scoped to specific users, no additional
-information is collected for users outside out of the scope. User names and group membership for the
-target environment is necessary to generate the Box Solution reports.
+users in a target environment. However, if you scope the query to specific users, Enterprise
+Auditor doesn't collect additional information for users outside the scope. User names and group
+membership for the target environment is necessary to generate the Box Solution reports.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/box/standardtables.md b/docs/accessanalyzer/11.6/admin/datacollector/box/standardtables.md
index a9dc756331..b113634a14 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/box/standardtables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/box/standardtables.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Standard Reference Tables & Views For the Box Data Collector
The Box Data Collector gathers essential user and group inventory information into standard
-reference tables. These tables and their associated views are outlined below:
+reference tables. The following table outlines these tables and their associated views:
| Table | Details |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
@@ -28,7 +28,7 @@ reference tables. These tables and their associated views are outlined below:
| SA_Box_Users | Contains one row per user and displays information on users of any teams present |
Views are the recommended way for Enterprise Auditor users to obtain the information gathered by the
-Box Data Collector. They contain additional information for building queries easily. The following
+Box Data Collector. They contain additional information for building queries. The following
is an explanation of the corresponding views created for some of the tables generated by the Box
Data Collector:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/box/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/box/summary.md
index feb45fbee9..cc64d0ff9b 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/box/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/box/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 100
# Box: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for all of the
+The Summary page summarizes the configuration settings. It is a wizard page for all of the
categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Box Data Collector Wizard ensuring that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Box Data Collector Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/definefields.md b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/definefields.md
index 2062a34163..f591152bcd 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/definefields.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/definefields.md
@@ -12,7 +12,7 @@ output. It is a wizard page for the **Edit Profile** and **Create a New Profile*
:::warning
-Do not modify this page without guidance from Netwrix or the data may not be processed
-by Enterprise Auditor.
+Don't modify this page without guidance from Netwrix, or Enterprise Auditor may not process the
+data.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/overview.md
index ed4a8f2a03..2dbb2611b1 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 90
# CommandLineUtility Data Collector
-The CommandLineUtility Data Collector provides the ability to remotely spawn, execute, and extract
-data provided by a Microsoft native or third-party command line utility. It allows users to easily
+The CommandLineUtility Data Collector lets you remotely spawn, execute, and extract
+data provided by a Microsoft native or third-party command line utility. It lets you
execute a command line utility and capture its output as Enterprise Auditor data. This data
collector is a core component of Enterprise Auditor and is available with all Enterprise Auditor
licenses.
@@ -28,8 +28,8 @@ licenses.
## CommandLineUtility Query Configuration
-The CommandLineUtility Data Collector executes a command line utility and captures the output. It is
-configured through the Command Line Utility Data Collector Wizard, which contains the following
+The CommandLineUtility Data Collector executes a command line utility and captures the output.
+Configure it through the Command Line Utility Data Collector Wizard, which contains the following
pages:
- Welcome
@@ -43,5 +43,5 @@ pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open, and save the configuration settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/profileparameters.md b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/profileparameters.md
index 67f8f965bb..e2eef672f1 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/profileparameters.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/profileparameters.md
@@ -24,7 +24,7 @@ Profile parameters include:
- Start in path for task (Optional) – Working directory for the command line that executes the
program or script. This should be either the path to the program or script file, or the path to
the files that are used by the executable file.
-- Command Line – Command that the utility executes. If the utility is self-executable and does not
+- Command Line – Command that the utility executes. If the utility is self-executable and doesn't
need a command, leave this field blank.
-- Output File Name – Enter the desired name for the output file. By default, the output file name
+- Output File Name – Enter the name you want for the output file. By default, the output file name
matches the profile name.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/profiletype.md b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/profiletype.md
index 832918416f..5cf09b5e99 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/profiletype.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/profiletype.md
@@ -12,10 +12,10 @@ The Profile Type page contains options to select a new or existing profile.
The options on the Profile Type page are:
-- Select Profile – Allows you to change the properties of a profile from the results page
-- Edit Profile – Allows you to edit a profile's execution options and properties. Enables the Define
+- Select Profile – Changes the properties of a profile from the results page
+- Edit Profile – Edits a profile's execution options and properties. Enables the Define
Fields and Script Editor pages.
-- Create a New Profile – Allows you to create a new profile. Enables the Define Fields and Script
+- Create a New Profile – Creates a new profile. Enables the Define Fields and Script
Editor pages.
The profile type selected may alter the availability of the subsequent wizard steps.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/results.md b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/results.md
index 5f8726f46f..ea0bbefbee 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/results.md
@@ -6,11 +6,11 @@ sidebar_position: 60
# CLU: Results
-The Results page is where the properties to be returned as columns in the results table are
-selected. It is a wizard page for all profile types.
+Use the Results page to select the properties to return as columns in the results table. It is a
+wizard page for all profile types.
-Select one or more properties to be returned as columns in the results table. Click **Select All**
-to select all of the properties, or click **Clear All** to clear all the currently selected
+Select one or more properties to return as columns in the results table. Click **Select All**
+to select all of the properties, or click **Clear All** to clear all the selected
properties. The available properties vary based on the selections on previous wizard pages.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/scripteditor.md b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/scripteditor.md
index 3d0812db1d..376081dd97 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/scripteditor.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/scripteditor.md
@@ -6,15 +6,15 @@ sidebar_position: 50
# CLU: Script Editor
-The Script Editor page provides options to create or edit a Visual Basic script that is used to
-parse the output file created by the data collector after execution. The Script Editor page is
-enabled when **Edit Profile** or **Create a New Profile** is selected on the Profile Type page. The
-page is disabled when the **Select Profile** option is selected on the Profile Type page.
+The Script Editor page provides options to create or edit a Visual Basic script that parses the
+output file the data collector creates after execution. Enterprise Auditor enables the Script Editor
+page when you select **Edit Profile** or **Create a New Profile** on the Profile Type page, and
+disables it when you select the **Select Profile** option on the Profile Type page.
:::warning
-Do not modify this page without guidance from Netwrix or the data may not be processed
-by Enterprise Auditor.
+Don't modify this page without guidance from Netwrix, or Enterprise Auditor may not process the
+data.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/summary.md
index 5d5c10b8a4..12ba9ef200 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/commandlineutility/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 70
# CLU: Summary
-The Summary page provides a summary of the query that has been created or edited. It is a wizard
+The Summary page provides a summary of the query you created or edited. It is a wizard
page for all profile types.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Command Line Utility Data Collector Wizard to ensure that no
-accidental clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Command Line Utility Data Collector Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/overview.md
index 8578260f6e..4b9dfc6b0f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 100
# DiskInfo Data Collector
-The DiskInfo Data Collector provides enumeration of disks and their associated properties. When
-targeting the local host for a DiskInfo query, it is necessary to select the **Systems Default**
+The DiskInfo Data Collector enumerates disks and their associated properties. When
+targeting the local host for a DiskInfo query, select the **Systems Default**
option as the connection profile. This data collector is a core component of Enterprise Auditor and
is available with all Enterprise Auditor licenses.
@@ -27,7 +27,7 @@ is available with all Enterprise Auditor licenses.
## DiskInfo Query Configuration
-The DiskInfo Data Collector is configured through the Disk Info wizard, which contains the following
+Configure the DiskInfo Data Collector through the Disk Info wizard, which contains the following
wizard pages:
- Welcome
@@ -37,5 +37,5 @@ wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open, and save the configuration settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/results.md b/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/results.md
index 86982c80d7..57a6adaaa7 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/results.md
@@ -6,14 +6,14 @@ sidebar_position: 20
# DiskInfo: Results
-The Results page provides a checklist of the data that is available for return by the query. Any
-number of options can be selected at once, but at least one must be selected in order to complete
+The Results page provides a checklist of the data that is available for return by the query. You
+can select any number of options at once, but you must select at least one to complete
the wizard.
-Properties can be selected individually, or you can use the **Select all** and **Clear all**
-buttons. The table below describes the available options.
+You can select properties individually, or use the **Select all** and **Clear all**
+buttons. The following table describes the available options.
| Checklist Result | Description |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------- |
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/summary.md
index b5444f941e..702a53499e 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Disk Info Data Collector Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Disk Info Data Collector Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/targetdisks.md b/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/targetdisks.md
index ddead664e6..4a46474225 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/targetdisks.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/diskinfo/targetdisks.md
@@ -11,9 +11,9 @@ target host after a query.
-Use the options to select the desired target disk.
+Use the options to select the target disk you want.
-- The Enumerate all storage devices – Allows all internal drives to be scanned. In order to expand
+- The Enumerate all storage devices – Allows all internal drives to be scanned. to expand
the scan, two sub-options can be included together, separately, or not at all.
- Include removable storage devices – Scans removable devices that are plugged into the target
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/dns/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/dns/overview.md
index 145d8669dc..cb96ec2cb0 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/dns/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/dns/overview.md
@@ -25,7 +25,7 @@ special Enterprise Auditor license.
## DNS Query Configuration
-The DNS Data Collector is configured through the Domain Name System Data Collector Wizard, which
+Configure the DNS Data Collector through the Domain Name System Data Collector Wizard, which
contains the following wizard pages:
- Welcome
@@ -35,5 +35,5 @@ contains the following wizard pages:
-The Welcome page can be hidden by selecting the Do not display this page the next time checkbox when
-the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the Don't display this page the next time checkbox while the
+wizard is open, and save the configuration settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/dns/results.md b/docs/accessanalyzer/11.6/admin/datacollector/dns/results.md
index 2479df0bf1..5297e9d71a 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/dns/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/dns/results.md
@@ -6,11 +6,11 @@ sidebar_position: 20
# DNS: Results
-The Results page is where DNS properties to be gathered are selected. It is a wizard page for all
+Use the Results page to select the DNS properties to gather. It is a wizard page for all
categories.
-Available properties can be selected individually, or the **Select All**, **Clear All**, and **Reset
-to defaults** buttons can be used. All selected properties are gathered. Available properties vary
-based on the category selected.
+You can select available properties individually, or use the **Select All**, **Clear All**, and
+**Reset to defaults** buttons. Enterprise Auditor gathers all selected properties. Available
+properties vary based on the category selected.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/dns/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/dns/summary.md
index a894836ea5..07d14e8d0a 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/dns/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/dns/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query. It is a wizard page
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Domain Name System Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Domain Name System Data Collector Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/completion.md b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/completion.md
index bc4c8be2ca..46304dd2db 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/completion.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/completion.md
@@ -6,17 +6,16 @@ sidebar_position: 80
# DropboxAccess: Summary (Completion)
-The Completion page, is where configuration settings are summarized. This page is a wizard page for
-all categories.
+Use the Completion page to review a summary of configuration settings. This page is a wizard page
+for all categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Dropbox Access Auditor Data Collector Wizard ensuring that no
-accidental clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Dropbox Access Auditor Data Collector Wizard to avoid saving accidental clicks.
:::tip
-Remember, if an Access Token was generated, use it as the credential within the Connection
+Remember, if you generated an Access Token, use it as the credential within the Connection
Profile. Then assign it to the job group or job which will be scanning the targeted Dropbox
environment. See the
[Custom Dropbox Connection Profile & Host List](/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/configurejob.md) topic
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/configurejob.md b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/configurejob.md
index fc0c85fadd..63fb0a1cd1 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/configurejob.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/configurejob.md
@@ -6,12 +6,12 @@ sidebar_position: 20
# Custom Dropbox Connection Profile & Host List
-The DropboxAccess Data Collector requires a custom Connection Profile to be created and assigned to
-the job or job group conducting the data collection.
+The DropboxAccess Data Collector requires you to create a custom Connection Profile and assign it
+to the job or job group conducting the data collection.
## Connection Profile
-Creating the Connection Profile requires an access token. The access token is generated on the Scan
+Creating the Connection Profile requires an access token. You generate the access token on the Scan
Options page of the Dropbox Access Auditor Data Collector Wizard.
Create a Connection Profile and set the following information on the User Credentials window:
@@ -32,6 +32,6 @@ topic for additional information.
## Host List
-The host list should be set to:
+Set the host list to:
- Local host
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/dlpauditsettings.md b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/dlpauditsettings.md
index 167aaf4cb4..5723b15fc6 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/dlpauditsettings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/dlpauditsettings.md
@@ -27,13 +27,13 @@ Configure the DLP audit settings:
the scan:
- Store discovered sensitive data – Stores a copy of any potentially sensitive data that matches
- the selected criteria in the Enterprise Auditor database. This copy can be used to check for
- false positives, data that matches the selected criteria but is not actually sensitive.
+ the selected criteria in the Enterprise Auditor database. Use this copy to check for
+ false positives, data that matches the selected criteria but isn't actually sensitive.
- Limit stored matches per criteria to [number] – Identifies the number of potentially sensitive
data matches that are copied to the database. The default is 5 matches. This option is
available only if the **Store discovered sensitive data** option is selected.
-- Perform differential scan of – Enables users to choose whether to employ incremental scanning:
+- Perform differential scan of – Choose whether to employ incremental scanning:
- Files modified since last scan – Scans only files modified since the last scan
- Files modified since [date] – Only scans files modified after the specified date
@@ -41,8 +41,8 @@ Configure the DLP audit settings:
of days
:::tip
-Remember, the sensitive data discovery options require the Sensitive Data Discovery Add-On to have
-been installed on the Enterprise Auditor Console. See the
+Remember, the sensitive data discovery options require you to install the Sensitive Data Discovery
+Add-On on the Enterprise Auditor Console. See the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
topic for additional information.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/overview.md
index 669e23d7af..5dc546964c 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/overview.md
@@ -8,8 +8,8 @@ sidebar_position: 120
The DropboxAccess Data Collector audits access, group membership, and content within a Dropbox
environment. Dropbox can scan the contents of over 400 file types to discover which files contain
-sensitive data using the Sensitive Data Discovery Add-on. The DropboxAccess Data Collector has been
-preconfigured within the Dropbox Solution. Both this data collector and the solution are available
+sensitive data using the Sensitive Data Discovery Add-on. Netwrix preconfigures the DropboxAccess
+Data Collector within the Dropbox Solution. Both this data collector and the solution are available
with a special Enterprise Auditor license. See the
[Dropbox Solution](/docs/accessanalyzer/11.6/solutions/dropbox/overview.md)
topic for additional information.
@@ -31,16 +31,15 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
-then an extra 16 GB of RAM are required (8x2=16).
+which enables Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if you configure the job to
+scan 8 hosts at a time, it requires an extra 16 GB of RAM (8x2=16).
## Query Configuration
-The DropboxAccess Data Collector is configured through the Dropbox Access Auditor Data Collector
-Wizard. The wizard contains the following pages, which change based upon the query category
-selected:
+Configure the DropboxAccess Data Collector through the Dropbox Access Auditor Data Collector
+Wizard. The wizard contains the following pages, which change based on the query category you
+select:
- Welcome
- [DropboxAccess: Category](/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/category.md)
@@ -52,5 +51,5 @@ selected:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open, and save the configuration settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/scanoptions.md b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/scanoptions.md
index cb8d995385..06daec978a 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/scanoptions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/scanoptions.md
@@ -11,8 +11,8 @@ DropboxAccess Data Collector to access and scan an organization’s Dropbox envi
Token is used as the credential in the Connection Profile.
:::note
-The Access Token needs to be generated only once, prior to the first execution of any job
-in which the DropboxAccess Data Collector is used in a query.
+You need to generate the Access Token only once, before the first execution of any job
+that uses the DropboxAccess Data Collector in a query.
:::
@@ -21,7 +21,7 @@ The Scan Options page is a wizard page for the following categories:
- Scan Dropbox Access
- Scan for Sensitive Content
-Follow the steps to create the Access Token:
+To create the Access Token:
@@ -33,7 +33,7 @@ Follow the steps to create the Access Token:
-**Step 3 –** Once the Access Token has been generated, click **Copy to Clipboard**. Click **Next**
+**Step 3 –** After Enterprise Auditor generates the Access Token, click **Copy to Clipboard**. Click **Next**
to finish choosing the configuration options or click **Cancel** to close the Dropbox Access Auditor
Data Collector Wizard.
@@ -42,6 +42,6 @@ Create a Connection Profile using this access token as the credential. See the
topic for additional information on configuring the Dropbox credential.
:::tip
-Remember, assign this Connection Profile to the job group or job where the host assignment for the
-Dropbox environment to be targeted has been assigned.
+Remember, assign this Connection Profile to the job group or job that has the host assignment for
+the targeted Dropbox environment.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/selectdlpcriteria.md b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/selectdlpcriteria.md
index f1a5b5154e..31abf4607a 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/selectdlpcriteria.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/selectdlpcriteria.md
@@ -7,7 +7,7 @@ sidebar_position: 70
# DropboxAccess: Select DLP Criteria
Use the Select DLP criteria for this scan page to configure criteria to use for discovering
-sensitive data. This page requires the Sensitive Data Discovery Add-On to be been installed on the
+sensitive data. This page requires you to install the Sensitive Data Discovery Add-On on the
Enterprise Auditor Console to define the criteria and enable the Criteria Editor. See the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
topic for additional information.
@@ -17,7 +17,7 @@ category.
-Select the checkbox next to each criteria to be included in the search for sensitive data. You can
+Select the checkbox next to each criteria to include it in the search for sensitive data. You can
also use the **Select All** and **Clear All** buttons.
The table contains the following types of criteria:
@@ -26,12 +26,12 @@ The table contains the following types of criteria:
- User Criteria – Lists user-defined criteria
:::note
-Until the Sensitive Data Discovery Add-On is installed, only the headers for the System
+Until you install the Sensitive Data Discovery Add-On, only the headers for the System
Criteria and User Criteria nodes are visible in the table.
:::
-Use the **Edit** button to access the Criteria Editor where user-defined criteria can be created or
-customized. See the
+Use the **Edit** button to access the Criteria Editor, where you can create or customize
+user-defined criteria. See the
[Sensitive Data Criteria Editor](/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/overview.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/standardtables.md b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/standardtables.md
index 4eeaba2c74..735fe80e46 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/standardtables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/standardtables.md
@@ -12,7 +12,7 @@ DropboxAccess Data Collector writes data to these tables regardless of the job e
## Dropbox Access Auditing Tables & Views
-These tables and their associated views are outlined below:
+The following table outlines these tables and their associated views:
| Table | Details |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
@@ -27,7 +27,7 @@ These tables and their associated views are outlined below:
| SA_Dropbox_Trustees | Contains information about any trustee, group, or team that has been assigned permissions |
Views are the recommended way for you to obtain the information gathered by the DropboxAccess Data
-Collector. They contain additional information for building queries easily. The following is an
+Collector. They contain additional information for building queries. The following is an
explanation of the corresponding views created for some of the tables generated by the DropboxAccess
Data Collector:
@@ -40,7 +40,7 @@ Data Collector:
## Dropbox Sensitive Data Discovery Auditing (SEEK) Tables & Views
-These tables and their associated views are outlined below:
+The following table outlines these tables and their associated views:
| Table | Details |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------ |
@@ -49,7 +49,7 @@ These tables and their associated views are outlined below:
| SA_Dropbox_MatchHits | Contains the actual sensitive data discovered within files which matched selected criteria |
Views are the recommended way for you to obtain the information gathered by the DropboxAccess Data
-Collector. They contain additional information for building queries easily. The following is an
+Collector. They contain additional information for building queries. The following is an
explanation of the corresponding views created for some of the tables generated by the DropboxAccess
Data Collector:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/eventlog.md b/docs/accessanalyzer/11.6/admin/datacollector/eventlog.md
index ee5cc9ba7a..9ea96ca46c 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/eventlog.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/eventlog.md
@@ -27,7 +27,7 @@ Enterprise Auditor licenses.
## EventLog Query Configuration
-The EventLog Data Collector is configured through the Event Log Browser window.
+Configure the EventLog Data Collector through the Event Log Browser window.
@@ -39,7 +39,7 @@ In the Sample section, select from the following options:
- Host – Enter a sample host that contains a log with the type of events desired for the query.
Click **Connect** to generate a list of logs available for extraction.
- - Log name – Select a log from the drop-down list. Events from the selected log are populated in
+ - Log name – Select a log from the dropdown list. Events from the selected log are populated in
the table.
- From file
@@ -51,7 +51,7 @@ In the Sample section, select from the following options:
File path box
:::note
- A preview displays automatically if the folder icons is used to navigate to the log.
+ A preview displays automatically if you use the folder icon to navigate to the log.
:::
@@ -62,11 +62,11 @@ In the Sample section, select from the following options:
In the Search Criteria section, add a search filter to the table by configuring the following
criteria:
-- Event Source – Select the event source from the drop-down list. Typically, select **Any Source**.
-- Even Type – Select the event type from the drop-down list. Typically, select **Any Type**.
+- Event Source – Select the event source from the dropdown list. Typically, select **Any Source**.
+- Even Type – Select the event type from the dropdown list. Typically, select **Any Type**.
- Event ID – Enter the event ID for the type of event to search
-Once the information above has been entered, click **Add** to add the configured event to the query.
+After you enter this information, click **Add** to add the configured event to the query.
Add as many events as desired.
- Latest event only – Select this checkbox to only search the latest event
@@ -83,7 +83,7 @@ Click **Apply Filter** to filter the list of sample events to the search criteri
**Options**
-In the Options section, select the desired processing options:
+In the Options section, select the processing options you want:
- Process offline logs only – Select this checkbox to process only offline logs
- Process offline logs if required – Select this checkbox to process offline logs if needed
@@ -93,14 +93,14 @@ In the Options section, select the desired processing options:
**Available Properties**
-In the Available Properties section, select which properties will be collected by the browser.
+In the Available Properties section, select which properties the browser collects.
- Add Icon – Add properties from those available in the list to add the properties to the search
- - The Description properties provide the ability to extract the bracketed pieces of information
+ - The Description properties let you extract the bracketed pieces of information
found within the description and display each bracketed piece of information in its own column
- Remove Icon – Use to remove properties from the search
-Once all options have been configured, click **OK** to save changes and exit the browser. Click
+After you configure all options, click **OK** to save changes and exit the browser. Click
**Cancel** to exit without saving.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/category.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/category.md
index c23088fa71..7fa3a4745a 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/category.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# EWSMailbox: Category
-The Category page identifies which type of EWSMailbox information is retrieved during the scan.
+The Category page identifies which type of EWSMailbox information the scan retrieves.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/criteria.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/criteria.md
index f587e4d35c..b5c81ee60e 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/criteria.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/criteria.md
@@ -6,10 +6,10 @@ sidebar_position: 60
# EWSMailbox: Criteria
-The Select DLP criteria for this scan page is where to select the criteria to use for the sensitive
-data scan are selected. It is a wizard page for the Sensitive Data category.
+Use the Select DLP criteria for this scan page to select the criteria to use for the sensitive
+data scan. It is a wizard page for the Sensitive Data category.
-This page requires the Sensitive Data Discovery Add-On to be been installed on the Enterprise
+This page requires you to install the Sensitive Data Discovery Add-On on the Enterprise
Auditor Console to define the criteria and enable the Criteria Editor. See the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
topic for additional information.
@@ -32,7 +32,7 @@ The options on the Criteria page are:
The table contains the following types of criteria:
:::note
-Until the Sensitive Data Discovery Add-On is installed, only the headers for the System
+Until you install the Sensitive Data Discovery Add-On, only the headers for the System
Criteria and User Criteria nodes are visible in the table.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/filter.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/filter.md
index 34c718604d..e57eada4d2 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/filter.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/filter.md
@@ -15,13 +15,13 @@ the categories of:
-All folders and attachments are scanned by default. Scope the scan for specific folders and
-attachments:
+Enterprise Auditor scans all folders and attachments by default. Scope the scan for specific
+folders and attachments:
-- Include Folders – Type the folder paths to filter the scan to specific mailbox folders
-- Include Attachments – Type the attachment file names to filter to specific attachments
-- Exclude Folders – Type the folder paths to exclude mailbox folders from the scan
-- Exclude Attachments – Type the file names for the attachments to exclude attachments from the scan
+- Include Folders – Enter the folder paths to filter the scan to specific mailbox folders
+- Include Attachments – Enter the attachment file names to filter to specific attachments
+- Exclude Folders – Enter the folder paths to exclude mailbox folders from the scan
+- Exclude Attachments – Enter the file names for the attachments to exclude attachments from the scan
Use `*` and `?` for matching wildcard and single characters.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/options.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/options.md
index 82d32664b6..6ef9a11e3b 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/options.md
@@ -27,7 +27,7 @@ Select the checkboxes to apply any desired scan options:
- Scan archives – Scans for archived mailbox data
- Scan recoverable items – Scans for recoverable items
-- Authentication – Select an Authentication type from the drop down:
+- Authentication – Select an Authentication type from the dropdown:
- Negotiate
- Basic
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/overview.md
index d56d758b86..7f650ae421 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 140
# EWSMailbox Data Collector
The EWSMailbox Data Collector provides configuration options to scan mailbox contents, permissions,
-and sensitive data, and is preconfigured within the Exchange Solution. Both this data collector and
-the solution are available with a special Enterprise Auditor license. See the
+and sensitive data. Netwrix preconfigures it within the Exchange Solution. Both this data collector
+and the solution are available with a special Enterprise Auditor license. See the
[Exchange Solution](/docs/accessanalyzer/11.6/solutions/exchange/overview.md)
topic for additional information.
@@ -33,14 +33,13 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
-then an extra 16 GB of RAM are required (8x2=16).
+which enables Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if you configure the job to
+scan 8 hosts at a time, it requires an extra 16 GB of RAM (8x2=16).
## EWSMailbox Query Configuration
-The EWSMailbox Data Collector is configured through the Exchange Mailbox Data Collector Wizard,
+Configure the EWSMailbox Data Collector through the Exchange Mailbox Data Collector Wizard,
which contains the following wizard pages:
:::note
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/results.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/results.md
index 8c1be99693..5ae020732b 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/results.md
@@ -6,7 +6,7 @@ sidebar_position: 90
# EWSMailbox: Results
-Use the Results page to select which properties are gathered out of those available for the
+Use the Results page to select which properties to gather out of those available for the
category. It is a wizard page for all of the categories.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/scope.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/scope.md
index 778a3d32f1..5828dccda0 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/scope.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/scope.md
@@ -6,12 +6,12 @@ sidebar_position: 30
# EWSMailbox: Scope
-The Mailbox scope settings page is used to select which mailboxes are searched by the scan. It is a
+Use the Mailbox scope settings page to select which mailboxes the scan searches. It is a
wizard page for all categories.
-Select an option to specify which mailboxes are searched:
+Select an option to specify which mailboxes to search:
- All mailboxes – Search all mailboxes
- Select mailboxes from list – Search only specific selected mailboxes. This option enables the
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/scopeselect.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/scopeselect.md
index 42962d38fc..d3bee34061 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/scopeselect.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/scopeselect.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# EWSMailbox: Scope Select
-The Scope select page is used to select specific mailboxes to scan. It is a wizard page for all
-categories when the **Select mailboxes from list** option is selected on the
+Use the Scope select page to select specific mailboxes to scan. It is a wizard page for all
+categories when you select the **Select mailboxes from list** option on the
[EWSMailbox: Scope](/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/scope.md)
page.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/sddoptions.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/sddoptions.md
index dbb5879759..e035f3ca9e 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/sddoptions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/sddoptions.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# EWSMailbox: SDD Options
-The Sensitive data scan options page is where options to be used for discovering sensitive data are
-configured. It is a wizard page for the Sensitive Data category.
+Use the Sensitive data scan options page to configure options for discovering sensitive data. It is
+a wizard page for the Sensitive Data category.
The Sensitive Data Discovery Add-on is required to use the sensitive data collection option. See the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/bodyoptions.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/bodyoptions.md
index 466de0ccdc..dff23d1c5c 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/bodyoptions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/bodyoptions.md
@@ -10,7 +10,7 @@ Use the BodyOptions page to select the size unit of messages.
-Select the desired message size unit:
+Select the message size unit you want:
- KB
- MB
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/folderconditions.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/folderconditions.md
index 9f833582bd..548f4752e9 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/folderconditions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/folderconditions.md
@@ -33,7 +33,7 @@ Customize folder search conditions using the following options:
## Folder Type Window
Use the Folder Type window to determine folder types to search for. The Folder Type window opens if
-**specific** is selected in the Edit Conditions box on the Folder Conditions page.
+you select **specific** in the Edit Conditions box on the Folder Conditions page.
@@ -42,17 +42,17 @@ Select the checkbox next to any folder type to include it in the search filter.
## Search Terms Window
Use the Search Terms window to determine terms for the search. The Search Terms window opens if
-**search terms** is selected in the Edit Conditions box.
+you select **search terms** in the Edit Conditions box.
Determine terms for the search using the following options:
-- Type the desired term into the upper text box and click **Add** to add the term to the lower text
+- Enter the term you want into the upper text box and click **Add** to add the term to the lower text
box, which adds the term to the search
- Select a term in the lower text box, and click **Remove** to remove the term from the search
- Click **Clear** to clear all terms from the lower box
-- Select the desired qualifier option:
+- Select the qualifier option you want:
- Contains ALL of the following search terms (And) – Search only returns results containing all
of the search terms
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/messageconditions.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/messageconditions.md
index 6e3eb9a498..711923302f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/messageconditions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/messageconditions.md
@@ -63,20 +63,20 @@ Customize message search filter conditions using the following options:
- Click **search terms** to open the Search Terms Window. See the
[Search Terms Window (Message Conditions)](#search-terms-window-message-conditions) topic for
additional information.
- - Click **has attachment(s)** to convert the condition to **has no attachment(s)** and vice
+ - Click **has attachments** to convert the condition to **has no attachments** and vice
versa
## MessageClasses Window (Message Conditions)
Use the MessageClasses window to alter criteria related to message class. The Message Classes window
-opens if **specific** is clicked in the Edit Conditions box on the Message Conditions page.
+opens if you click **specific** in the Edit Conditions box on the Message Conditions page.
Determine MessageClass-related criteria using the following options:
- To add a class, click **Add**
-- Enter the desired Message Class in the corresponding textbox
+- Enter the Message Class you want in the corresponding textbox
- Click **Exact Match** to reveal a dropdown menu of other search criteria under Matching Strategy
and select the preferred option:
@@ -91,7 +91,7 @@ Determine MessageClass-related criteria using the following options:
## Date Range Selection Window
Use the Date Range Selection window to select a time period or range for the search. The Date Range
-Selection window opens if **in specific date** is clicked in the Edit Conditions box on the Message
+Selection window opens if you click **in specific date** in the Edit Conditions box on the Message
Conditions page.
@@ -107,17 +107,17 @@ Determine the time period or range of the search using the following options:
## Search Terms Window (Message Conditions)
Use the Search Terms window to determine terms for the search. The Search Terms window opens if
-**search terms** is selected in the Edit Conditions box.
+you select **search terms** in the Edit Conditions box.
Determine terms for the search using the following options:
-- Type the desired term into the upper text box and click **Add** to add the term to the lower text
+- Enter the term you want into the upper text box and click **Add** to add the term to the lower text
box, which adds the term to the search
- Select a term in the lower text box, and click **Remove** to remove the term from the search
- Click **Clear** to clear all terms from the lower box
-- Select the desired qualifier option:
+- Select the qualifier option you want:
- Contains ALL of the following search terms (And) – Search only returns results containing all
of the search terms
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/searchfilter_1.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/searchfilter_1.md
index 3dd187682c..5a862aeb64 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/searchfilter_1.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/searchfilter/searchfilter_1.md
@@ -26,18 +26,18 @@ Customize folder search conditions using the following options:
:::
- - Click either **IPM.Note** or **IPM.Appointment**, to open the MessageClasses Window with
+ - Click either **IPM.Note** or **IPM.Appointment** to open the MessageClasses Window with
IPM.Note or IPM.Appointment class populated, respectively. See the
[MessageClasses Window ](#messageclasses-window) topic for additional information.
- Click **over 90 Day ago** to open the Date Range Selection Window. See the
[Date Range Selection Window](#date-range-selection-window) topic for additional information.
- - Click **has attachment(s)** to convert the condition to **has no attachment(s)** and vice
+ - Click **has attachments** to convert the condition to **has no attachments** and vice
versa
## MessageClasses Window
Use the MessageClasses window to alter criteria related to message class. The Message Classes window
-opens if **Ipm.Note** or **Ipm.Appointment** is clicked in the Edit Conditions box on the Search
+opens if you click **Ipm.Note** or **Ipm.Appointment** in the Edit Conditions box on the Search
Filter page.
@@ -45,7 +45,7 @@ Filter page.
Determine MessageClass-related criteria using the following options:
- To add a class, click **Add**
-- Enter the desired Message Class in the corresponding textbox
+- Enter the Message Class you want in the corresponding textbox
- Click **Exact Match** to reveal a dropdown menu of other search criteria under Matching Strategy
and select the preferred option:
@@ -60,7 +60,7 @@ Determine MessageClass-related criteria using the following options:
## Date Range Selection Window
Use the Date Range Selection window to select a time period or range for the search. The Date Range
-Selection window opens if **over 90 Day ago** is clicked in the Edit Conditions box on the Search
+Selection window opens if you click **over 90 Day ago** in the Edit Conditions box on the Search
Filter page.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/summary.md
index fd4446325d..3130f67319 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query. It wizard page for
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the EWS Mailbox Data Collector Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel**
+instead to close the EWS Mailbox Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/critieria.md b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/critieria.md
index 6fbf4bff90..d6b9fee304 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/critieria.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/critieria.md
@@ -26,13 +26,13 @@ The options on the Criteria page are:
sensitive data criteria to scan for
- Select All - Click **Select All** to enable all sensitive data criteria for scanning
- Clear All - Click **Clear All** to remove all selections from the table
-- Select the checkboxes next to the sensitive data criteria options to enable it to be scanned for
+- Select the checkboxes next to the sensitive data criteria options to include them in the scan
during job execution
The table contains the following types of criteria:
:::note
-Until the Sensitive Data Discovery Add-On is installed, only the headers for the System
+Until you install the Sensitive Data Discovery Add-On, only the headers for the System
Criteria and User Criteria nodes are visible in the table.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/filter.md b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/filter.md
index e4b58bd93f..7866458feb 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/filter.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/filter.md
@@ -15,13 +15,13 @@ the categories of:
-All folders and attachments are scanned by default. Scope the scan for specific folders and
+The scan includes all folders and attachments by default. Scope the scan for specific folders and
attachments:
-- Include Folders – Type the folder paths to filter the scan to specific mailbox folders
-- Include Attachments – Type the attachment file names to filter to specific attachments
-- Exclude Folders – Type the folder paths to exclude mailbox folders from the scan
-- Exclude Attachments – Type the file names for the attachments to exclude attachments from the scan
+- Include Folders – Enter the folder paths to filter the scan to specific mailbox folders
+- Include Attachments – Enter the attachment file names to filter to specific attachments
+- Exclude Folders – Enter the folder paths to exclude mailbox folders from the scan
+- Exclude Attachments – Enter the file names for the attachments to exclude attachments from the scan
Use `*` and `?` for matching wildcard and single characters.
@@ -30,10 +30,10 @@ Use `*` and `?` for matching wildcard and single characters.
- Limit attachments size to [numerical value] – Select to limit attachment size and define a
threshold for maximum size of an attachment returned in the scan. The default value is 20000 KB.
-Public folders can also be included or excluded from the scan by retrieving a list of public folders
-and selecting the desired folders.
+You can also include or exclude public folders from the scan by retrieving a list of public folders
+and selecting the folders you want.
-Follow the steps to filter the scan by selecting public folders from a list.
+To filter the scan by selecting public folders from a list:
@@ -42,7 +42,8 @@ open the Choose folders to include or Choose folders to exclude window.
**Step 2 –** Click **Retrieve** to load the list of public folders that can be selected.
-**Step 3 –** Select the desired public folders and click **Add** to add the folders to the Include
+**Step 3 –** Select the public folders you want and click **Add** to add the folders to the Include
Folders or Exclude Folders list.
-After the configuration changes are saved, scans are filtered by the selected public folders.
+After you save the configuration changes, the data collector filters scans by the selected public
+folders.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/options.md b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/options.md
index f71aa21c9c..c2f8145b5d 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/options.md
@@ -22,7 +22,7 @@ Select any desired scan options:
:::
-- Authentication – Select an Authentication type from the drop down:
+- Authentication – Select an Authentication type from the dropdown:
- Negotiate
- Basic
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/overview.md
index dcd7f55988..a22593a6d5 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/overview.md
@@ -32,11 +32,11 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
-then an extra 16 GB of RAM are required (8x2=16).
+You must install the Sensitive Data Discovery Add-On on the Enterprise Auditor Console server to
+enable Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans, increase
+the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For
+example, if you configure the job to scan 8 hosts at a time, you need an extra 16 GB of RAM
+(8 x 2 = 16).
## EWSPublicFolder Query Configuration
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/results.md b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/results.md
index 7b7b8dbf25..3a8f627709 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/results.md
@@ -6,15 +6,15 @@ sidebar_position: 70
# EWSPublicFolder: Results
-The Results page is used to select which properties will be gathered out of those available for the
-category. It is a wizard page for all of the categories.
+Use the Results page to select which properties to gather out of those available for the category.
+It is a wizard page for all of the categories.
Select criteria using the following options:
-- Select the checkbox of any property to include it in the summary. All selected properties will be
- gathered.
+- Select the checkbox of any property to include it in the summary. The data collector gathers all
+ selected properties.
:::note
Available properties vary based on the category selected.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/bodyoptions.md b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/bodyoptions.md
index 9e8dac56fd..e47f5e75a1 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/bodyoptions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/bodyoptions.md
@@ -6,11 +6,11 @@ sidebar_position: 40
# EWSPublicFolder FW: BodyOptions
-The BodyOptions page is where the size of messages is selected.
+Use the BodyOptions page to select the size of messages.
-Select the desired message size unit:
+Select the message size unit you want:
- KB
- MB
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/folderconditions.md b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/folderconditions.md
index 3092c48c3e..aa207105de 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/folderconditions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/folderconditions.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# EWSPublicFolder FW: Folder Conditions
-The Folder Conditions page is where folder-related filter criteria can be applied to the search.
+Use the Folder Conditions page to apply folder-related filter criteria to the search.
@@ -33,7 +33,7 @@ Customize folder search conditions using the following options:
## Folder Type Window
Use the Folder Type window to determine folder types to search for. The Folder Type window opens if
-**specific** is selected in the Edit Conditions box on the Folder Conditions page.
+you select **specific** in the Edit Conditions box on the Folder Conditions page.
@@ -41,18 +41,17 @@ Select the checkbox next to any folder type to include it in the search filter.
## Search Terms Window
-Use the Search Terms window to determine terms for the search. The Search Terms window opens if
-**search terms** is selected in the Edit Conditions box.
+Use the Search Terms window to determine terms for the search. The Search Terms window opens if you
+select **search terms** in the Edit Conditions box.
Determine terms for the search using the following options:
-- Type the desired term into the upper text box and click **Add** to add the term to the lower text
- box, which adds the term to the search
+- Enter the term you want in the upper text box, then click **Add** to add it to the search
- Select a term in the lower text box, and click **Remove** to remove the term from the search
- Click **Clear** to clear all terms from the lower box
-- Select the desired qualifier option:
+- Select the qualifier option you want:
- Contains ALL of the following search terms (And) – Search only returns results containing all
of the search terms
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/messageconditions.md b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/messageconditions.md
index d0a4a4f8b0..6971694146 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/messageconditions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/messageconditions.md
@@ -61,20 +61,20 @@ Customize message search filter conditions using the following options:
[Date Range Selection Window](#date-range-selection-window) topic for additional information.
- Click **search terms** to open the Search Terms Window. See the
[Search Terms Window](#search-terms-window) topic for additional information.
- - Click **has attachment(s)** to convert the condition to **has no attachment(s)** and vice
+ - Click **has attachments** to convert the condition to **has no attachments** and vice
versa
## MessageClasses Window
Use the MessageClasses window to alter criteria related to message class. The Message Classes window
-opens if **specific** is clicked in the Edit Conditions box on the Message Conditions page.
+opens if you click **specific** in the Edit Conditions box on the Message Conditions page.
Determine MessageClass-related criteria using the following options:
- To add a class, click **Add**
-- Enter the desired Message Class in the corresponding textbox
+- Enter the Message Class you want in the corresponding textbox
- Click **Exact Match** to reveal a dropdown menu of other search criteria under Matching Strategy
and select the preferred option:
@@ -89,7 +89,7 @@ Determine MessageClass-related criteria using the following options:
## Date Range Selection Window
Use the Date Range Selection window to select a time period or range for the search. The Date Range
-Selection window opens if **in specific date** is clicked in the Edit Conditions box on the Message
+Selection window opens if you click **in specific date** in the Edit Conditions box on the Message
Conditions page.
@@ -104,18 +104,17 @@ Determine the time period or range of the search using the following options:
## Search Terms Window
-Use the Search Terms window to determine terms for the search. The Search Terms window opens if
-**search terms** is selected in the Edit Conditions box.
+Use the Search Terms window to determine terms for the search. The Search Terms window opens if you
+select **search terms** in the Edit Conditions box.
Determine terms for the search using the following options:
-- Type the desired term into the upper text box and click **Add** to add the term to the lower text
- box, which adds the term to the search
+- Enter the term you want in the upper text box, then click **Add** to add it to the search
- Select a term in the lower text box, and click **Remove** to remove the term from the search
- Click **Clear** to clear all terms from the lower box
-- Select the desired qualifier option:
+- Select the qualifier option you want:
- Contains ALL of the following search terms (And) – Search only returns results containing all
of the search terms
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/searchfilter_1.md b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/searchfilter_1.md
index 43116f49bd..6983c8e272 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/searchfilter_1.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/searchfilter/searchfilter_1.md
@@ -31,13 +31,13 @@ Customize folder search conditions using the following options:
[MessageClasses Window](#messageclasses-window) topic for additional information.
- Click **over 90 Day ago** to open the Date Range Selection Window. See the
[Date Range Selection Window](#date-range-selection-window)
- - Click **has attachment(s)** to convert the condition to **has no attachment(s)** and vice
+ - Click **has attachments** to convert the condition to **has no attachments** and vice
versa
## MessageClasses Window
Use the MessageClasses window to alter criteria related to message class. The Message Classes window
-opens if **Ipm.Note** or **Ipm.Appointment** is clicked in the Edit Conditions box on the Search
+opens if you click **Ipm.Note** or **Ipm.Appointment** in the Edit Conditions box on the Search
Filter page.
@@ -45,7 +45,7 @@ Filter page.
Determine MessageClass-related criteria using the following options:
- To add a class, click **Add**
-- Enter the desired Message Class in the corresponding textbox
+- Enter the Message Class you want in the corresponding textbox
- Click **Exact Match** to reveal a dropdown menu of other search criteria under Matching Strategy
and select the preferred option:
@@ -60,7 +60,7 @@ Determine MessageClass-related criteria using the following options:
## Date Range Selection Window
Use the Date Range Selection window to select a time period or range for the search. The Date Range
-Selection window opens if **over 90 Day ago** is clicked in the Edit Conditions box on the Search
+Selection window opens if you click **over 90 Day ago** in the Edit Conditions box on the Search
Filter page.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/summary.md
index 0c4f732e18..f01a4880cf 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query. It wizard page for
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the EWS Public Folder Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel**
+instead to close the EWS Public Folder Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/category.md b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/category.md
index efc4ad087e..5f48decdb1 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/category.md
@@ -28,7 +28,7 @@ focus:
- Recipient Update Services
- Message Delivery – System-wide message settings
- Instant Messaging – Instant messaging settings
- - Exchange Mailbox Store Logons – The users currently logged on to Microsoft Exchange 2007 and
+ - Exchange Mailbox Store Logons – The users logged on to Microsoft Exchange 2007 and
2010
- Exchange 2007/2010 Hub Transport Configuration
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/mapisettings.md b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/mapisettings.md
index 98c00ef374..cc47b8357e 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/mapisettings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/mapisettings.md
@@ -6,10 +6,10 @@ sidebar_position: 40
# Exchange2K: MAPI Settings
-The MAPI Settings page is used to enter configurations to connect to target Exchange servers. By
+Use the MAPI Settings page to enter configurations to connect to target Exchange servers. By
default, Enterprise Auditor connects to Exchange using System Attendant. For Exchange 2010 and 2013,
-a mailbox and a client access server need to be entered in order to make a MAPI connection. These
-settings only need to be configured if not configured at the Global Settings level. It is a wizard
+enter a mailbox and a client access server to make a MAPI connection. You only need to configure
+these settings if you haven't already configured them at the Global Settings level. It is a wizard
page for the categories of:
- Exchange Organization > Users
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/options.md b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/options.md
index 411b60821d..7592544755 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/options.md
@@ -13,7 +13,7 @@ depending on the category selected. It is a wizard page for all of the categorie
Configure the Options step using the following options:
-- How to format collected – Select how the table will be formatted according to the return data
+- How to format collected – Select how to format the table based on the return data
- Return data as collected
- Return each value of the following property in a separate row – Enabled for specific
@@ -21,12 +21,12 @@ Configure the Options step using the following options:
- Return data in a separate row for each property set in the following group – Enabled for
specific properties selected on the Results page
-- How to return multi-valued properties – Select how the table will be formatted when the return
- data contains multi-valued properties
+- How to return multi-valued properties – Select how to format the table when the return data
+ contains multi-valued properties
- Concatenated – Return the data in a continuous string without gaps
- - Delimiter – Enter the desired delimiter to be used between values
+ - Delimiter – Enter the delimiter to use between values
- First-value only – Only display the first value
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/overview.md
index 7eb1b3771b..9324a75618 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/overview.md
@@ -7,12 +7,12 @@ sidebar_position: 160
# Exchange2K Data Collector
The Exchange2K Data Collector extracts configuration details from Exchange organizations for
-versions 2003 and later. This is a MAPI-based data collector which requires the **Settings** >
-**Exchange** node to be enabled and configured. See the
+versions 2003 and later. This is a MAPI-based data collector, which requires you to enable and
+configure the **Settings** > **Exchange** node. See the
[Exchange](/docs/accessanalyzer/11.6/admin/settings/exchange.md)
topic for additional information.
-The Exchange2K Data Collector has been preconfigured within the Exchange Solution. Both this data
+The Exchange2K Data Collector comes preconfigured within the Exchange Solution. Both this data
collector and the solution are available with a special Enterprise Auditor license. See the
[Exchange Solution](/docs/accessanalyzer/11.6/solutions/exchange/overview.md)
topic for additional information.
@@ -53,5 +53,5 @@ contains the following wizard pages:
-The Welcome page can be hidden by selecting the **Do not show this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't show this page the next time** checkbox while the
+wizard is open, then save the configuration settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/results.md b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/results.md
index 73b8d96286..7d96ec4d90 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/results.md
@@ -6,12 +6,12 @@ sidebar_position: 30
# Exchange2K: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for
+Use the Results page to select properties to gather. It is a wizard page for
all.
-Properties can be selected individually or the **Check All**, **Uncheck All**, or **Reset Defaults**
-buttons can be used. All Selected properties will be gathered. Click **Expand All** to expand all
+Select properties individually, or use the **Check All**, **Uncheck All**, or **Reset Defaults**
+buttons. The data collector gathers all selected properties. Click **Expand All** to expand all
properties, or **Collapse All** to collapse all properties. Available properties vary based on the
category selected.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/scope.md b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/scope.md
index 675d0b615b..0d43a7574f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/scope.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/scope.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Exchange2K: Scope
-The Scope page is used to define where to search. It is a wizard page for the categories of:
+Use the Scope page to define where to search. It is a wizard page for the categories of:
- Exchange Organization > Users
- Exchange Organization > Groups
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/summary.md
index e368a2a233..8a870a7011 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchange2k/summary.md
@@ -11,6 +11,5 @@ categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Exchange 2K+ Data Collector Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel**
+instead to close the Exchange 2K+ Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/options.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/options.md
index 410d705363..c910bebc39 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/options.md
@@ -16,7 +16,7 @@ the following categories:
-The following options can be configured:
+Configure the following options:
:::note
Options available vary based upon the category selected.
@@ -30,8 +30,8 @@ Options available vary based upon the category selected.
- Folders
- - All Folders – Select to include all folders in the query. When deselected, the other options
- of the category become available.
+ - All Folders – Select to include all folders in the query. When you deselect this option, the
+ other options of the category become available.
- Include root folder – Include root folders of the selected folders in the query
- - – Enter the name of a folder to include and click **+** to add it to the list of
@@ -46,7 +46,7 @@ Options available vary based upon the category selected.
- Count attachment types – Counts attachment types as part of the query. When selected, this
enables the following options:
- - Add New – Adds another line to the list of attachment types which is manually edited
+ - Add New – Adds another line to the list of attachment types that you can edit manually
- Load Defaults – Reverts the list to default attachment types
- Remove – Remove selected attachment type from the list
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/overview.md
index a343ec9db1..81d42d4f0f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/overview.md
@@ -34,11 +34,11 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
-then an extra 16 GB of RAM are required (8x2=16).
+You must install the Sensitive Data Discovery Add-On on the Enterprise Auditor Console server to
+enable Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans, increase
+the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For
+example, if you configure the job to scan 8 hosts at a time, you need an extra 16 GB of RAM
+(8 x 2 = 16).
## ExchangeMailbox Query Configuration
@@ -62,18 +62,18 @@ permissions on the Welcome page.
Select one of the following options for the connection setting:
-- Use Global setting – The configured Global Setting is displayed next to this checkbox. Select the
- checkbox to use the global setting.
-- System Attendant (2003 & 2007) – Enabled when the **Use Global Setting** checkbox is not selected.
+- Use Global setting – This checkbox shows the configured Global Setting. Select the checkbox to use
+ the global setting.
+- System Attendant (2003 & 2007) – Enabled when the **Use Global Setting** checkbox isn't selected.
Select this option to use System Attendant (2003 & 2007) for the connection.
- Use the mailbox associated with the Windows account that Enterprise Auditor is run with – Enabled
- when the **Use Global Setting** checkbox is not selected. Select this option to use the mailbox
+ when the **Use Global Setting** checkbox isn't selected. Select this option to use the mailbox
associated with the Windows account that Enterprise Auditor is run with for the connection.
-- Exchange Mailbox (2010 and newer) – Enabled when the **Use Global Setting** checkbox is not
- selected. Select this option to use an Exchange Mailbox (2010 and newer) for the connection. The
- Client Access Server must be entered unless specified in the Global Settings.
+- Exchange Mailbox (2010 and newer) – Enabled when the **Use Global Setting** checkbox isn't
+ selected. Select this option to use an Exchange Mailbox (2010 and newer) for the connection. Enter
+ the Client Access Server unless you specified it in the Global Settings.
- - Client Access Server – A private store server is needed if the Exchange server only has public
+ - Client Access Server – Use a private store server if the Exchange server only has public
stores
**Test Connection Setting**
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/properties.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/properties.md
index db4e183657..61ee703e68 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/properties.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/properties.md
@@ -6,13 +6,13 @@ sidebar_position: 30
# ExchangeMailbox: Properties
-The Properties page is where properties that will be gathered are selected. The available properties
+Use the Properties page to select the properties to gather. The available properties
depend on the category selected. It is a wizard page for all of the categories.
-Properties can be selected individually or you can use the Select All, Clear All, and Reset All
-buttons. All selected properties will be gathered. Click **Message Classes** to open the Message
+Select properties individually, or use the **Select All**, **Clear All**, and **Reset All**
+buttons. The data collector gathers all selected properties. Click **Message Classes** to open the Message
classes filters window.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/scope.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/scope.md
index 20200fb2cb..60486d6063 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/scope.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/scope.md
@@ -6,13 +6,13 @@ sidebar_position: 20
# ExchangeMailbox: Scope
-The Scope page is used to define which mailboxes are to be queried. It is a wizard page for all of
+Use the Scope page to define which mailboxes to query. It is a wizard page for all of
the categories.
-At the top, configure the mailboxes to be queried. The selected option changes how the mailboxes are
-identified for scoping.
+At the top, configure the mailboxes to query. The selected option changes how the data collector
+identifies mailboxes for scoping.
- All mailboxes – Searches all mailboxes
- Selected mailboxes from server – Retrieves all mailboxes in the Exchange organization, making them
@@ -23,7 +23,7 @@ identified for scoping.
- Retrieve – Enter the server and select Retrieve to display the list of mailboxes on that
server
- - Add – Select the desired mailboxes to add to the query. The added mailboxes display in the
+ - Add – Select the mailboxes you want to add to the query. The added mailboxes display in the
**Selected mailboxes** list.
- Remove – Deletes selected mailboxes from the list
- Select All – Click the Select All icon to select all mailboxes in the list
@@ -34,7 +34,7 @@ identified for scoping.
- - Table – Filters this list by tables. Select the table which hosts the list of mailboxes for
- which this query will be scoped.
- - Field containing EmailAddressDNs – This list will be populated with columns from the selected
+ - Table – Filters this list by tables. Select the table that hosts the list of mailboxes to scope
+ this query to.
+ - Field containing EmailAddressDNs – This list populates with columns from the selected
table. Select the appropriate column from the list.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/sddcriteria.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/sddcriteria.md
index 7e2f125f45..ae6e671bb5 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/sddcriteria.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/sddcriteria.md
@@ -6,17 +6,17 @@ sidebar_position: 40
# ExchangeMailbox: SDD Criteria
-The SDD Criteria page is where criteria to be used for discovering sensitive data are configured. It
-is a wizard page for the Mailbox sensitive data discovery category. This page requires the Sensitive
-Data Discovery Add-On to be been installed on the Enterprise Auditor Console to define the criteria
+Use the SDD Criteria page to configure criteria for discovering sensitive data. It
+is a wizard page for the Mailbox sensitive data discovery category. This page requires you to
+install the Sensitive Data Discovery Add-On on the Enterprise Auditor Console to define the criteria
and enable the Criteria Editor. See the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
topic for additional information.
-Select the checkbox for the criteria to be used to search for sensitive data. Criteria can also be
-selected using the **Select All** and **Select None** buttons.
+Select the checkbox for each criterion you want to use to search for sensitive data. You can also
+select criteria using the **Select All** and **Select None** buttons.
The table contains the following types of criteria:
@@ -24,19 +24,19 @@ The table contains the following types of criteria:
- User Criteria – Lists user-defined criteria
:::note
- Until the Sensitive Data Discovery Add-On is installed, only the headers for the
+ Until you install the Sensitive Data Discovery Add-On, only the headers for the
System Criteria and User Criteria nodes will be visible in the table.
:::
-- Edit – Click this button to access the Criteria Editor where user-defined criteria can be created
- or customized. See the
+- Edit – Click this button to access the Criteria Editor, where you can create or customize
+ user-defined criteria. See the
[Sensitive Data Criteria Editor](/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/overview.md)
topic for additional information.
- Store discovered sensitive data – Stores the potentially sensitive data that matches the selected
criteria in the Enterprise Auditor database. Select this checkbox to store a copy of the criteria
- match data. This copy can be used to check for false positives, data that matches the selected
- criteria but is not actually sensitive.
+ match data. Use this copy to check for false positives, data that matches the selected
+ criteria but isn't actually sensitive.
- Limit stored matches per criteria to [number] – Identifies the number of potentially sensitive
- data matches that are copied to the database. The default is 5 matches. This option is only
+ data matches copied to the database. The default is 5 matches. This option is only
available if the **Store discovered sensitive data** option is selected.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/summary.md
index 9a2b55361d..e08dc2ffdf 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemailbox/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query. It wizard page for
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Exchange Mailbox Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel**
+instead to close the Exchange Mailbox Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/category.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/category.md
index 530a41959d..49d7ceb9bd 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/category.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# ExchangeMetrics: Category
-The Category page is used to identify the type of Exchange Metrics information to retrieve.
+Use the Category page to identify the type of Exchange Metrics information to retrieve.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/collectmode.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/collectmode.md
index ea34d6aff4..6cbcb70fa8 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/collectmode.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/collectmode.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# ExchangeMetrics: Collect Mode
-The Collect Mode page is where to set the collection mode. It is a wizard page for the categories
+Use the Collect Mode page to set the collection mode. It is a wizard page for the categories
of:
- Server Volume
@@ -27,8 +27,8 @@ of:
There are two types of collection modes:
- Query Summary Data Only – In this mode, the applet gathers only existing summary data and returns
- it to the Enterprise Auditor Console. In order to process Exchange tracking log files, another
- instance of the applet must be configured.
+ it to the Enterprise Auditor Console. To process Exchange tracking log files, configure another
+ instance of the applet.
- Process Exchange Tracking Logs and Query Summary Data – In this mode, the applet processes missing
summary data and returns it to the Enterprise Auditor Console. This mode includes an additional
setting for **Summary data path**. Choose between:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/messageactivityfilter.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/messageactivityfilter.md
index c080266193..5bb1ca6db2 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/messageactivityfilter.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/messageactivityfilter.md
@@ -7,9 +7,10 @@ sidebar_position: 80
# ExchangeMetrics: Message Activity Filter
The Message Activity Filter page configures which domains the data collector should return mail flow
-from specific senders and to specific recipients. For example, if `@netwrix.com` is entered in the
-Senders list and `@netwrix.com` in the Recipients list, message activity will be returned only for
-mail sent to and received from an `@netwrix.com` address. It is a wizard page for the categories of:
+from specific senders and to specific recipients. For example, if you enter `@netwrix.com` in the
+Senders list and `@netwrix.com` in the Recipients list, the data collector returns message activity
+only for mail sent to and received from an `@netwrix.com` address. It is a wizard page for the
+categories of:
- User’s Message Activity
- User’s Message Activity Per Hour
@@ -18,9 +19,8 @@ mail sent to and received from an `@netwrix.com` address. It is a wizard page fo
Configure the Message Activity Filter using the following options:
-- Add – To add a filter to the desired category, click **Add** in the desired category to add an
- entry to that category
-- Select **Exact Match** in the added filter to reveal a drop-down list with the following condition
+- Add – To add an entry to a category, click **Add** in that category
+- Select **Exact Match** in the added filter to reveal a dropdown list with the following condition
options:
- Exact matches
@@ -30,7 +30,7 @@ Configure the Message Activity Filter using the following options:
- Kind – Select **(Custom…)** to open the Custom Filter menu. The Custom Filter menu provides
options to create and configure other filters.
-- Value – Type the filter to be applied
+- Value – Enter the filter to apply
-The columns in the entry tables can be sorted and or filtered, using the same sorting and filtering
-methods of Enterprise Auditor data grids. The **Remove** option will delete a selected filter.
+You can sort and filter the columns in the entry tables using the same sorting and filtering
+methods as Enterprise Auditor data grids. The **Remove** option will delete a selected filter.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/messagesizes.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/messagesizes.md
index 98f6a3f8b7..dc710cfc4a 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/messagesizes.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/messagesizes.md
@@ -6,17 +6,17 @@ sidebar_position: 60
# ExchangeMetrics: Message Sizes
-The Message Sizes page is used to configure message size frames for which to return summary metrics
+Use the Message Sizes page to configure message size frames for which to return summary metrics
by server. It is a wizard page for the category of:
- Message Size Statistics Custom.
-Configure the desired message size frames using the following options:
+Configure the message size frames you want using the following options:
-- Frame name – Name the configured message size parameters. Can either be entered manually or a
- default will populate when query limits are set.
+- Frame name – Name the configured message size parameters. Enter a name manually, or let a default
+ populate when you set query limits.
- Start – Specify the lower limit of the message sizes (in MB)
- End – Specify the upper limit of the message sizes (in MB)
@@ -27,6 +27,6 @@ For example, a **Start** value of **1** and an **End** value of **2** returns me
value of **5** with the **Infinite** checkbox selected retrieves all messages which are 5
megabytes or larger.
-Once the frame is configured, click **Add**. The configured message size frame will appear in the
-list. Multiple frames can be configured. Select a frame and click **Replace** to modify an existing
+After you configure the frame, click **Add**. The configured message size frame will appear in the
+list. You can configure multiple frames. Select a frame and click **Replace** to modify an existing
frame. Use **Remove** to delete an existing frame.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/options.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/options.md
index b93def53fb..3e499d7b2c 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/options.md
@@ -43,7 +43,7 @@ Available options vary depending on Category selected.
- Applet Logging
- Enable Logging – Enables the applet to log
- - Applet log level – Select the desired log level using the dropdown list:
+ - Applet log level – Select the log level you want using the dropdown list:
- None
- Debug
@@ -55,9 +55,9 @@ Available options vary depending on Category selected.
- Applet History
- - Enable Persistent Log State – Search the log from where the previous search left off. A state
- file is created for each host configured in the query. State files can be viewed within
- Enterprise Auditor and are named by the query GUID. State files display the record the
+ - Enable Persistent Log State – Search the log from where the previous search left off. The job
+ creates a state file for each host configured in the query. You can view state files within
+ Enterprise Auditor, where they're named by the query GUID. State files display the record the
previous search left off on, the event log, and the date of the last entry.
- AD Database Creation
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/overview.md
index 95bcfb5c9b..a42857e88e 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/overview.md
@@ -13,7 +13,7 @@ summarized metrics from the Message Tracking Log. See the
[Exchange Support and Permissions Explained](/docs/accessanalyzer/11.6/requirements/exchange/support/support.md)
topic for a complete list of supported platforms.
-The ExchangeMetrics Data Collector has been preconfigured within the Exchange Solution. Both this
+The ExchangeMetrics Data Collector comes preconfigured within the Exchange Solution. Both this
data collector and the solution are available with a special Enterprise Auditor license. See the
[Exchange Solution](/docs/accessanalyzer/11.6/solutions/exchange/overview.md)
topic for additional information.
@@ -30,7 +30,7 @@ topic for additional information.
**Permissions**
-- Member of the local Administrator group on the targeted Exchange server(s)
+- Member of the local Administrator group on the targeted Exchange servers
See the
[Exchange Mail-Flow Permissions](/docs/accessanalyzer/11.6/requirements/exchange/support/mailflow.md)
@@ -59,5 +59,5 @@ which contains the following wizard pages:
-The Welcome page can be hidden by checking the **Do not display this page the next time** box when
-the wizard is open and configuration settings are saved.
+To hide the Welcome page, check the **Don't display this page the next time** box while the wizard
+is open, then save the configuration settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/results.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/results.md
index 1e480d6904..cd076754ad 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/results.md
@@ -6,11 +6,11 @@ sidebar_position: 30
# ExchangeMetrics: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for all
+Use the Results page to select properties to gather. It is a wizard page for all
of the categories.
-Properties can be selected individually or the **Check All**, **Uncheck All**, or **Reset Defaults**
-buttons can be used. Click **Expand All** to expand all property categories. All selected properties
-will be gathered. Available properties vary based on the category selected.
+Select properties individually, or use the **Check All**, **Uncheck All**, or **Reset Defaults**
+buttons. Click **Expand All** to expand all property categories. The data collector gathers all
+selected properties. Available properties vary based on the category selected.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/scope.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/scope.md
index 52aa2ceaeb..5b7fe7f4d3 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/scope.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/scope.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# ExchangeMetrics: Scope
-The Scope page is used to define where to search. It is a wizard page for the categories of:
+Use the Scope page to define where to search. It is a wizard page for the categories of:
- Server Volume
- Internal Traffic Summary
@@ -26,8 +26,8 @@ The Scope page is used to define where to search. It is a wizard page for the ca
Define the scope of the query using the following options:
-- Return data for section – Select the time period for which data will be collected. GMT time is
- used by Exchange Metrics to calculate the result.
+- Return data for section – Select the time period to collect data for. Exchange Metrics uses GMT
+ time to calculate the result.
- Today
- Yesterday
@@ -37,11 +37,11 @@ Define the scope of the query using the following options:
- Last Month
- Last [number] days
- Within time frame:
- - From [calendar date] to [calendar date] – Use the drop-down arrows to select calendar dates.
+ - From [calendar date] to [calendar date] – Use the dropdown arrows to select calendar dates.
- Return results section – Select the table design for the collected data
- - One row for – Use the drop-down list to select one of the following options:
+ - One row for – Use the dropdown list to select one of the following options:
- All period
- Day
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/summary.md
index 3c23a0267e..b3a20425d5 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/summary.md
@@ -11,6 +11,5 @@ categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Exchange Metrics Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel**
+instead to close the Exchange Metrics Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/timeframes.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/timeframes.md
index 134fc2565f..7cb4041929 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/timeframes.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/timeframes.md
@@ -6,17 +6,17 @@ sidebar_position: 50
# ExchangeMetrics: Time Frames
-The Time Frames page is used to configure message delivery time frames for which to return summary
+Use the Time Frames page to configure message delivery time frames for which to return summary
metrics by server. It is a wizard page for the category of:
- Delivery Time Custom.
-Configure the desired time frames using the following options:
+Configure the time frames you want using the following options:
-- Frame name – Name the configured time frame. Can either be entered manually or a default will
- populate when frame limits are set.
+- Frame name – Name the configured time frame. Enter a name manually, or let a default populate when
+ you set frame limits.
- Start – Specify the lower limit of the delivery time frame
- End – Specify the upper limit of the delivery time frame
- Select the time unit of the time frame:
@@ -32,6 +32,6 @@ selected returns messages delivered in 1 to 2 minutes.
**Start** value of **2** with the **Infinite** checkbox selected retrieves all messages that took
2 seconds/minutes/hours or longer to deliver.
-Once the frame is configured, click **Add**. The configured message time frame will appear in the
-list. Multiple time frames can be configured. Select a frame and click **Replace** to modify an
+After you configure the frame, click **Add**. The configured message time frame will appear in the
+list. You can configure multiple time frames. Select a frame and click **Replace** to modify an
existing frame. Use **Remove** to delete an existing frame.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/category.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/category.md
index 345a69e179..5b93633747 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/category.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# ExchangePS: Category
-The Category page contains a connection section where connection options are defined. It is also
-where the query category is selected. The available query categories are sub-divided by auditing
+The Category page contains a connection section where you define connection options. It's also
+where you select the query category. The available query categories are sub-divided by auditing
focus.
@@ -29,15 +29,15 @@ In the Connection section, select the method for connecting to the target Exchan
**Exchange** node)
- Exchange 2013 & 2016 – Require an actual CAS server name:
- - If the **Settings** > **Exchange** node was configured for MAPI over HTTP, then an actual
- CAS server name was supplied and will be used by the ExchangePS Data Collector
- - If the **Settings** > **Exchange** node was configured for MAPI over HTTPS, then the
- global configuration will have a web address instead of an actual server. Therefore, each
- query requires the CAS server to be set as the specific server on the Category page.
+ - If you configured the **Settings** > **Exchange** node for MAPI over HTTP, the ExchangePS
+ Data Collector uses the actual CAS server name you supplied
+ - If you configured the **Settings** > **Exchange** node for MAPI over HTTPS, the global
+ configuration has a web address instead of an actual server. Therefore, each query
+ requires you to set the CAS server as the specific server on the Category page.
- Use Office 365 – Connect to Office 365
-- Use pipelined PowerShell – Processes each mailbox object in turn. When selected, the data
- collector streams data to the database instead of transferring batches of data.
+- Use pipelined PowerShell – Processes each mailbox object in turn. When you select this option, the
+ data collector streams data to the database instead of transferring batches of data.
- This option uses less memory but is more sensitive to network conditions
- Only available for Exchange 2013+ target environments
@@ -54,7 +54,7 @@ focus:
- Mailbox Databases – Collects information on mailbox databases
:::note
- This option is not available for Office 365 target environments
+ This option isn't available for Office 365 target environments
:::
@@ -111,7 +111,7 @@ Get-MailboxStatistics
Get-MailboxDatabase
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md)
@@ -132,7 +132,7 @@ Get-MailboxStatistics
Get-MailboxDatabase
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md)
@@ -150,7 +150,7 @@ PowerShell query this category runs is as follows:
Get-MailboxDatabase
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md)
@@ -168,7 +168,7 @@ PowerShell query this category runs is as follows:
Get-MailboxDatabase
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md)
@@ -186,7 +186,7 @@ PowerShell query this category runs is as follows:
Get-MailboxDatabase
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md)
@@ -206,7 +206,7 @@ Get-Mailbox
Get-MailboxDatabase
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md)
@@ -218,8 +218,8 @@ for configuration:
**Mailbox Access Logons**
-This category returns the Mailbox Access Auditing log details. Mailbox Access Auditing does need to
-be enabled on the Mailboxes in order for this job to return any information. The PowerShell queries
+This category returns the Mailbox Access Auditing log details. You must enable Mailbox Access
+Auditing on the mailboxes for this job to return any information. The PowerShell queries
this category runs are as follows:
```
@@ -227,7 +227,7 @@ Search-MailboxAuditLog
Get-Mailbox
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md)
@@ -253,7 +253,7 @@ Get-Mailbox
Get-ThrottlingPolicyAssociation
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md)
@@ -276,7 +276,7 @@ Get-ActiveSyncDeviceStatistics
Get-Mailbox
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md)
@@ -291,8 +291,8 @@ Public Folder Information audit focus contains the following categories:
**Public Folder Content**
-This category returns general statistics and sizing for the public folder environment. When it is
-selected, the following ExchangePS Data Collector Wizard pages are available for configuration:
+This category returns general statistics and sizing for the public folder environment. When you
+select it, the following ExchangePS Data Collector Wizard pages are available for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md)
- [ExchangePS: Results](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/results.md)
@@ -302,8 +302,8 @@ selected, the following ExchangePS Data Collector Wizard pages are available for
**Public Folder Permissions**
-This category returns permissions information for the public folder environment. When it is
-selected, the following ExchangePS Data Collector Wizard pages are available for configuration:
+This category returns permissions information for the public folder environment. When you
+select it, the following ExchangePS Data Collector Wizard pages are available for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md)
- [ExchangePS: Results](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/results.md)
@@ -317,8 +317,8 @@ Office 365 audit focus contains the following category:
**Mail Flow Metrics**
-This category returns information about mail flow in the target Exchange Online environment. When it
-is selected, the following ExchangePS Data Collector Wizard pages are available for configuration:
+This category returns information about mail flow in the target Exchange Online environment. When
+you select it, the following ExchangePS Data Collector Wizard pages are available for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md)
- [ExchangePS: Mail Flow](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/mailflow.md)
@@ -333,7 +333,7 @@ Domain Information audit focus contains the following category:
**Domains**
-This category returns information about domains in the Exchange environment. When it is selected,
+This category returns information about domains in the Exchange environment. When you select it,
the following ExchangePS Data Collector Wizard pages are available for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md)
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/configurejob.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/configurejob.md
index a6b2d0983d..f268e41920 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/configurejob.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/configurejob.md
@@ -6,12 +6,12 @@ sidebar_position: 10
# Exchange Custom Connection Profile & Host List
-The ExchangePS Data Collector requires a custom Connection Profile and host list to be created and
-assigned to the job conducting the data collection. The host inventory option during host list
-creation makes it necessary to configure the Connection Profile first.
+The ExchangePS Data Collector requires you to create a custom Connection Profile and host list and
+assign them to the job that collects the data. The host inventory option during host list
+creation requires you to configure the Connection Profile first.
:::note
-It is not possible to target both Exchange Online and on-premises Exchange environments
+You can't target both Exchange Online and on-premises Exchange environments
from the same job. Therefore, the Connection Profile should only contain the credentials for one
type of environment.
:::
@@ -28,21 +28,21 @@ The provisioned credential used should be an Active Directory account. Create a
and set the following information on the User Credentials window:
- Select Account Type – Active Directory Account
-- Domain – Drop-down menu with available trusted domains will appear. Either type the short domain
+- Domain – dropdown menu with available trusted domains will appear. Either enter the short domain
name in the textbox or select a domain from the menu.
-- User name – Type the user name
+- User name – Enter the user name
- Password Storage – Choose the for credential password storage:
- Application – Uses the configured Profile Security setting as selected at the **Settings** >
**Application** node
- CyberArk – Uses the CyberArk Enterprise Password Vault
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
### Exchange On-Premise Host List
-The ExchangePS Data Collector should be set to run against:
+Set the ExchangePS Data Collector to run against:
- Local host
@@ -53,7 +53,7 @@ Exchange Online.
### Exchange Online Credential for a Connection Profile
-The provisioned credential must be created with the Exchange Modern Authentication account type.
+Create the provisioned credential with the Exchange Modern Authentication account type.
Create a Connection Profile and set the following information on the User Credentials window:
- Select Account Type – Exchange Modern Authentication
@@ -61,11 +61,11 @@ Create a Connection Profile and set the following information on the User Creden
**Settings** > **Application** node. See the
[Application](/docs/accessanalyzer/11.6/admin/settings/application/overview.md)
topic for additional information.)
-- Organization – The primary domain name of the Microsoft Entra tenant being leveraged to make the
+- Organization – The primary domain name of the Microsoft Entra tenant used to make the
connection. See the
[Identify the Tenant's Name](/docs/accessanalyzer/11.6/requirements/exchange/exchangeonline/access.md#identify-the-tenants-name)
topic for additional information.
-- Email Address – The email address for the mailbox to be leveraged in Exchange Online environment
+- Email Address – The email address for the mailbox used in Exchange Online environment
scans. The mailbox must belong to the primary domain used in the Organization field.
- AppID – Application (client) ID of the Enterprise Auditor application registered with Microsoft
Entra ID. See the
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/filtermessage.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/filtermessage.md
index 717b8df657..42d7205c08 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/filtermessage.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/filtermessage.md
@@ -6,7 +6,7 @@ sidebar_position: 70
# ExchangePS: Filter by Message
-The Filter by Message page is used to define the filter conditions of the search. It is a wizard
+Use the Filter by Message page to define the filter conditions of the search. It is a wizard
page for the category of:
- Mailbox Search
@@ -36,16 +36,16 @@ Available conditions to select from include:
See the [Date Range Selection Window](#date-range-selection-window) and
[Words Window](#words-window) topics for additional information.
-In the Select Search Mailbox Parameters section, select the desired filter parameters:
+In the Select Search Mailbox Parameters section, select the filter parameters you want:
-- Do not Include Archive
+- Don't Include Archive
- Include Unsearchable Items
- Search Dumpster
- Search Dumpster Only
#### Date Range Selection Window
-The Date Range Selection window is opened by the **Specify Date Range...** option for a date related
+The **Specify Date Range...** option opens the Date Range Selection window for a date-related
filter on the Filter by Message page.
@@ -56,19 +56,19 @@ Select the range category on the left and configure the range setting in the ena
**Years**.
- Last – Select the number and time units. The available time units are: **Days**, **Months**, or
**Years**.
-- Before – Drop-down menu opens a calendar selection view, choose the end date
-- After – Drop-down menu opens a calendar selection view, choose the start date
-- Between (Date) – Drop-down menus open calendar selection view, choose the start and end dates
-- Between – Select the numbers for the lower and upper range boundary, and the desired time units.
+- Before – dropdown menu opens a calendar selection view, choose the end date
+- After – dropdown menu opens a calendar selection view, choose the start date
+- Between (Date) – dropdown menus open calendar selection view, choose the start and end dates
+- Between – Select the numbers for the lower and upper range boundary, and the time units you want.
The available time units are: **Days**, **Months**, or **Years**.
-When the date range is specified, click **OK**. The selected date range shows as a filter on the
+After you specify the date range, click **OK**. The selected date range shows as a filter on the
Filter by Message page. Click the filter to open the Date Range Selection window to modify the date
range.
#### Words Window
-The Words window is opened by the **Specify words...** option for a word related filter on the
+The **Specify words...** option opens the Words window for a word-related filter on the
Filter by Message page.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/mailboxlogons.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/mailboxlogons.md
index 55d8c2d3ad..d2283361d1 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/mailboxlogons.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/mailboxlogons.md
@@ -6,13 +6,13 @@ sidebar_position: 80
# ExchangePS: Mailbox Logons
-The Mailbox Logons page is used to define the type of mailbox logon events to return, as well as the
-date range to be returned. It is a wizard page for the category of Mailbox Information > Mailbox
+Use the Mailbox Logons page to define the type of mailbox logon events to return, as well as the
+date range to return. It is a wizard page for the category of Mailbox Information > Mailbox
Access Logons.
-Select the desired checkboxes to indicate which logons to audit:
+Select the checkboxes you want to indicate which logons to audit:
- Delegate
- Admin
@@ -27,4 +27,4 @@ Specify the date range for the logons:
:::
-- Between (Date) – Use the drop-down menus to open calendars to select the start and end dates
+- Between (Date) – Use the dropdown menus to open calendars to select the start and end dates
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/mailflow.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/mailflow.md
index 661a143ad6..e461c9ca20 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/mailflow.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/mailflow.md
@@ -21,5 +21,5 @@ Date range must be 7 days or less.
- Last – Select the number of days
-- Between (Date) – Use the drop-down menus to open the calendar selection view to choose the start
+- Between (Date) – Use the dropdown menus to open the calendar selection view to choose the start
and end dates
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/options.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/options.md
index 04bbf6a131..304814bf23 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/options.md
@@ -6,12 +6,12 @@ sidebar_position: 110
# ExchangePS: Options
-The Options page is used to configure additional options. It is a wizard page for all of the
+Use the Options page to configure additional options. It is a wizard page for all of the
categories.
-The following options can be configured:
+Configure the following options:
- Message size units - Select the message size for the query:
@@ -19,7 +19,7 @@ The following options can be configured:
- MB
- GB
-- How to format collected results – Select how table will be formatted according to the return data:
+- How to format collected results – Select how to format the table based on the return data:
- Return data as collected
- Return each value of the following property in a separate row – Enabled for specific
@@ -27,11 +27,11 @@ The following options can be configured:
- Return data in a separate row for each property set in the following group – Enabled for
specific properties selected on the Results page
-- How to return multi-valued properties – Select how the table will be formatted when the return
+- How to return multi-valued properties – Select how to format the table when the return
data contains multi-valued properties:
- Concatenated
- - Delimiter – Enter the desired delimiter to be used between values
+ - Delimiter – Enter the delimiter to use between values
- First-value only
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/overview.md
index dbce74ca75..8ca553ea89 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/overview.md
@@ -6,9 +6,9 @@ sidebar_position: 190
# ExchangePS Data Collector
-The ExchangePS Data Collector utilizes the Exchange CMDlets to return information about the Exchange
-environment utilizing PowerShell. This data collector has been designed to work with Exchange 2010
-and newer. The ExchangePS Data Collector has been preconfigured within the Exchange Solution. Both
+The ExchangePS Data Collector uses the Exchange CMDlets to return information about the Exchange
+environment using PowerShell. This data collector works with Exchange 2010
+and newer. The ExchangePS Data Collector comes preconfigured within the Exchange Solution. Both
this data collector and the solution are available with a special Enterprise Auditor license. See
the
[Exchange Solution](/docs/accessanalyzer/11.6/solutions/exchange/overview.md)
@@ -42,9 +42,9 @@ topic for additional information.
## Remote PowerShell
-The ExchangePS Data Collector will utilize Remote PowerShell when connecting to Exchange 2010 or
-newer. This behavior simulates what the Exchange Management Shell does when loading. The below
-PowerShell syntax is an example of how the connection is loaded through PowerShell.
+The ExchangePS Data Collector will use Remote PowerShell when connecting to Exchange 2010 or
+newer. This behavior simulates what the Exchange Management Shell does when loading. The following
+PowerShell syntax is an example of how PowerShell loads the connection.
```
$JobUserName = '{insert domain\username}'
@@ -62,14 +62,14 @@ topic for instructions on enabling Remote PowerShell.
## The Exchange Applet
-The Exchange Applet will run on the Exchange server by the ExchangePS Data Collector in the
+The ExchangePS Data Collector runs the Exchange Applet on the Exchange server in the
following circumstances:
-- An actual Client Access Server (CAS) server is not specified either in the global configuration
+- An actual Client Access Server (CAS) server isn't specified either in the global configuration
(**Settings** > **Exchange** node) or on the Category page of the ExchangePS Data Collector Wizard
-- Remote PowerShell has not been enabled for targeting Exchange 2010
+- You haven't enabled Remote PowerShell for targeting Exchange 2010
-The following Exchange Snap-in is used when the applet is utilized:
+The applet uses the following Exchange Snap-in:
- Add-pssnapin Microsoft.Exchange.Management.Powershell.E2010
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/results.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/results.md
index e6523713e3..3a57499d8b 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/results.md
@@ -6,10 +6,10 @@ sidebar_position: 100
# ExchangePS: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for all
+Use the Results page to select properties to gather. It is a wizard page for all
of the categories.
-Properties can be selected individually or the **Select All** and **Clear All** buttons can be used.
-All selected properties will be gathered. Available properties vary based on the category selected.
+Select properties individually, or use the **Select All** and **Clear All** buttons.
+The data collector gathers all selected properties. Available properties vary based on the category selected.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md
index d9465574ac..c7ea3c43bb 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md
@@ -6,7 +6,8 @@ sidebar_position: 30
# ExchangePS: Scope
-The Scope page establishes how mailboxes are scoped. It is a wizard page for all of the categories.
+The Scope page establishes how the data collector scopes mailboxes. It is a wizard page for all of
+the categories.
@@ -15,14 +16,14 @@ Available scoping options vary based on the category selected. Scoping options i
- No Scoping Target Host: Local Host – Returns all results for the entire targeted Exchange
Organization
- - If this option is selected, then the data collector should be run against the host specified
+ - If you select this option, run the data collector against the host specified
on the Summary page. See the
[ExchangePS: Summary](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/summary.md) topic
for additional information.
- When using the applet, the data collector gathers information about the Exchange Forest in
- which the Enterprise Auditor Console currently resides
+ which the Enterprise Auditor Console resides
- For Remote PowerShell, the data collector gathers information about the Exchange Organization
- to which the Remote PowerShell connection was made. This refers to the server entered in the
+ to which you made the Remote PowerShell connection. This refers to the server entered in the
Client Access Server (CAS) field of the global configuration from the **Settings** >
**Exchange** node or on the this page.
@@ -39,7 +40,7 @@ Available scoping options vary based on the category selected. Scoping options i
- When using the applet, the data collector deploys a process to the targeted host to run the
PowerShell on that server
- - For Remote PowerShell, the data collector does not deploy anapplet and utilizes the WinRM
+ - For Remote PowerShell, the data collector doesn't deploy anapplet and uses the WinRM
protocol to gather information about the objects on that server. See the
[Remote PowerShell](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/overview.md#remote-powershell)
and
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopedatabases.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopedatabases.md
index 2319d5bbdd..5093c72b4d 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopedatabases.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopedatabases.md
@@ -6,20 +6,20 @@ sidebar_position: 40
# ExchangePS: Scope by DB
-The Scope by Databases page is used to define specific databases to search. This page is enabled
-when **Scope by Database Target Host: Local Host** option is selected on the Scope page. See the
+Use the Scope by Databases page to define specific databases to search. You enable this page by
+selecting the **Scope by Database Target Host: Local Host** option on the Scope page. See the
[ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md) topic
for additional information.
When using the applet, the data collector returns databases for the Exchange Organization in which
-the Enterprise Auditor Console currently resides, and only returns information about those
+the Enterprise Auditor Console resides, and only returns information about those
databases. For Remote PowerShell, the data collector returns databases for the Exchange Forest and
only returns information about those databases.
Click **Retrieve** to return all databases in the Exchange Organization and populate them in the
-Available Databases list. Select the desired databases from Available Databases and click **Add**.
-The selected databases are added in the Selected Databases list. To remove undesired databases from
-Selected Databases, select them and click **Remove**. The Select All and Clear All buttons can be
-used for quick selection.
+Available Databases list. Select the databases you want from Available Databases and click **Add**.
+The wizard adds the selected databases to the Selected Databases list. To remove undesired databases
+from Selected Databases, select them and click **Remove**. Use the Select All and Clear All buttons
+for quick selection.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopemailboxes.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopemailboxes.md
index 6c48cd69ca..603fca79aa 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopemailboxes.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopemailboxes.md
@@ -6,13 +6,13 @@ sidebar_position: 50
# ExchangePS: Scope by Mailboxes
-The Scope by Mailboxes page is used to define specific mailboxes to search. This page is enabled
-when the **Scope by Mailbox Target Host: Local Host** option is selected on the Scope page. See the
+Use the Scope by Mailboxes page to define specific mailboxes to search. You enable this page by
+selecting the **Scope by Mailbox Target Host: Local Host** option on the Scope page. See the
[ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md) topic
for additional information.
When using the applet, the data collector will return mailboxes for the Exchange Forest in which the
-Enterprise Auditor Console currently resides, and only return information about those mailboxes. For
+Enterprise Auditor Console resides, and only return information about those mailboxes. For
Remote PowerShell, the data collector will return mailboxes for the Exchange Forest as well as
return information about those mailboxes.
@@ -20,6 +20,6 @@ return information about those mailboxes.
Click **Retrieve** to return all mailboxes in the Exchange Organization and populate them in the
Available Mailboxes list. Select desired mailboxes from the Available Mailboxes list and click
-**Add**. The selected mailboxes are added in the Selected Mailboxes list. To remove undesired
+**Add**. The wizard adds the selected mailboxes to the Selected Mailboxes list. To remove undesired
mailboxes from Selected Mailboxes, select them and click **Remove**. The Select All and Clear All
-buttons can be used for quick selection.
+buttons let you select quickly.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopepublicfolders.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopepublicfolders.md
index 53de73fca0..9c4b1c2b9f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopepublicfolders.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopepublicfolders.md
@@ -6,17 +6,17 @@ sidebar_position: 60
# ExchangePS: Scope by Public Folders
-The Scope by Public Folders page is used to define specific public folders to search. This page is
-enabled when the **Scope by Public Folder** option is selected on the Scope page. See the
+Use the Scope by Public Folders page to define specific public folders to search. You enable this
+page by selecting the **Scope by Public Folder** option on the Scope page. See the
[ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md) topic
for additional information.
-Configure the **Scope** option using the drop-down. The available options are:
+Configure the **Scope** option using the dropdown. The available options are:
- Selected Public Folder
- Selected Table
-The option selected changes how the public folders are identified for scoping.
+The selected option changes how the data collector identifies public folders for scoping.
## Selected Public Folder
@@ -25,9 +25,9 @@ organization, populating them in the Available list.
-The **Search** feature filters this list. Select the desired public folders and click **Add**. The
-selected public folders are added to the Selected list. Use the **Remove** option to delete selected
-public folders from the list. The Select All or Deselect All buttons can be used for quick
+The **Search** feature filters this list. Select the public folders you want and click **Add**. The
+wizard adds the selected public folders to the Selected list. Use the **Remove** option to delete selected
+public folders from the list. Use the Select All or Deselect All buttons for quick
selection. Additional scoping options include:
- Return only these folders – Audits only the selected public folders
@@ -42,5 +42,5 @@ Enterprise Auditor database.
The **Search** feature filters this list. Select the table that houses the list of public folders
-for which this query will be scoped. The Field containing EntryIDs list is populated with columns
+to scope this query to. The Field containing EntryIDs list populates with columns
from the selected table. Select the appropriate column from the list.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/summary.md
index b559203a10..9baa3a555c 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 130
# ExchangePS: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for all of the
-categories.
+Use the Summary page to review a summary of the configuration settings. It is a wizard page for all
+of the categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the ExchangePS Data Collector Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel**
+instead to close the ExchangePS Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/category.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/category.md
index f0ea77570f..57b2fc723c 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/category.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# ExchangePublicFolder: Category
-The Category page is used to select the objects to search.
+Use the Category page to select the objects to search.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/options.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/options.md
index 7c8848080d..eedf4dcfda 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/options.md
@@ -16,7 +16,7 @@ The Options page contains the following options:
- Process folders that physically reside on the target server only – This option will limit
extraction to only the subset of public folders which reside on this server when selected. Clear
this option if targeting the Exchange 2010 Public Folder Server. The ability to scope to the
- targeted server is not available for Exchange 2010. The entire public folder hierarchy is
+ targeted server isn't available for Exchange 2010. The entire public folder hierarchy is
returned.
- Message size units:
@@ -28,7 +28,7 @@ The Options page contains the following options:
Scope page settings. See the
[ExchangeMetrics: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangemetrics/scope.md) topic
for additional information.
-- Large attachment threshold (Kb) – Configure the desired size limit for attachments. The default
+- Large attachment threshold (Kb) – Configure the size limit you want for attachments. The default
value is 500.
In the Attachment types section, configure attachment count types.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/overview.md
index 6ad208c975..6c49e0c8e2 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/overview.md
@@ -7,12 +7,12 @@ sidebar_position: 200
# ExchangePublicFolder Data Collector
The ExchangePublicFolder Data Collector audits an Exchange Public Folder, including contents,
-permissions, ownership, and replicas. This is a MAPI-based data collector which requires the
-**Settings > Exchange** node to be enabled and configured. See the
+permissions, ownership, and replicas. This is a MAPI-based data collector, which requires you to
+enable and configure the **Settings > Exchange** node. See the
[Exchange](/docs/accessanalyzer/11.6/admin/settings/exchange.md)
topic for additional information.
-The ExchangePublicFolder Data Collector has been preconfigured within the Exchange Solution. Both
+The ExchangePublicFolder Data Collector comes preconfigured within the Exchange Solution. Both
this data collector and the solution are available with a special Enterprise Auditor license. See
the
[Exchange Solution](/docs/accessanalyzer/11.6/solutions/exchange/overview.md)
@@ -35,11 +35,11 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
-then an extra 16 GB of RAM are required (8x2=16).
+You must install the Sensitive Data Discovery Add-On on the Enterprise Auditor Console server to
+enable Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans, increase
+the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For
+example, if you configure the job to scan 8 hosts at a time, you need an extra 16 GB of RAM
+(8 x 2 = 16).
## ExchangePublicFolder Query Configuration
@@ -62,7 +62,7 @@ permissions on the Welcome page.
In the Connection Setting section, choose to either maintain the global inheritance, or configure
query specific settings.
-The **Use Global setting** option specifies what setting is being inherited. Clear this option to
+The **Use Global setting** option specifies which setting the query inherits. Clear this option to
break inheritance, and then select one of the following options:
- System Attendant (2003 & 2007)
@@ -74,6 +74,6 @@ See the
[Exchange](/docs/accessanalyzer/11.6/admin/settings/exchange.md)
topic for additional information.
-In the Sampling server section, enter the Exchange server in the textbox to be used to test the
+In the Sampling server section, enter the Exchange server in the textbox to test the
connection settings. Click **Test sampling server** to ensure there is access to the server. The box
at the bottom of the page displays information regarding the test connection in progress.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/probableowner.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/probableowner.md
index a8ede5385c..565c56064b 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/probableowner.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/probableowner.md
@@ -6,14 +6,14 @@ sidebar_position: 50
# ExchangePublicFolder: Probable Owner
-The Probable Owner Settings page provides configuration options to determine an owner. It is enabled
-when the Probable Owner property is selected on the Properties page. See the
+The Probable Owner Settings page provides configuration options to determine an owner. You enable it
+by selecting the Probable Owner property on the Properties page. See the
[ExchangePublicFolder: Properties](/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/properties.md) topic
for additional information.
-In the Determine owner section, select the desired option to specify what setting to use to
+In the Determine owner section, select the option you want to specify what setting to use to
determine an owner:
- Determine owner from folder hierarchy – Select to determine the probable owner with a weight of
@@ -48,15 +48,15 @@ In the Exclusions section, select one or more of the following checkboxes to spe
- Remove selected – Select a user or users to remove from the Exclude users list and click
**Remove selected** to remove the users
-In the Output Options section, select the desired output option:
+In the Output Options section, select the output option you want:
- Get one most probable owner – Return one probable owner
- Get probable owners with relative deviation to the most probable owner – Return probable owners
based on the deviation from percentage from the most probable owner
- - Maximum deviation [number] percents – Use the arrow buttonss to enter the desired percent of
- deviation from the most probable owner from which to return probable owners
+ - Maximum deviation [number] percents – Use the arrow buttons to enter the percent of
+ deviation you want from the most probable owner from which to return probable owners
- Get multiple probable owners – Return multiple probable owners
- - Count – Use the arrow buttons to enter the desired number of probable owners to return
+ - Count – Use the arrow buttons to enter the number of probable owners you want to return
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/properties.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/properties.md
index d38082209f..ad0c258e33 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/properties.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/properties.md
@@ -6,13 +6,13 @@ sidebar_position: 30
# ExchangePublicFolder: Properties
-The Properties page is where properties that will be gathered are selected. It is a wizard page for
+Use the Properties page to select the properties to gather. It is a wizard page for
all of the categories.
-Properties can be selected individually or you can use the **Select All**, **Clear All**, or **Reset
-All** buttons. All selected properties will be gathered. The **Message Classes** button opens the
+Select properties individually, or use the **Select All**, **Clear All**, or **Reset
+All** buttons. The data collector gathers all selected properties. The **Message Classes** button opens the
Message classes filters window.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/scope.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/scope.md
index cfc7227708..bfee7640d6 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/scope.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/scope.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# ExchangePublicFolder: Scope
-The Scope page is used to define which folders will be included will be searched by this query. It
+Use the Scope page to define which folders this query searches. It
is a wizard page for all of the categories.
@@ -15,12 +15,12 @@ In the Choose Type of Public Folders to be queried section, select either:
- Default Public Folders – User can access these folders directly with client applications such as
Microsoft Outlook. In its default configuration, Exchange System Manager displays these folders
- when a public folder tree is expanded.
-- System Public Folders – Users cannot access these folders directly. Client applications, such as
+ when you expand a public folder tree.
+- System Public Folders – Users can't access these folders directly. Client applications, such as
Microsoft Outlook, use these folders to store information such as free and busy data, offline
address lists, and organizational forms. Other folders hold configuration information that is used
by custom applications or by Exchange itself. The Public Folders tree contains extra system
- folders, such as the EFORMS REGISTRY folder, that do not exist in general-purpose public folder
+ folders, such as the EFORMS REGISTRY folder, that don't exist in general-purpose public folder
trees.
In the Choose Scope of Public Folders to be queried section, select one of the following options:
@@ -39,14 +39,14 @@ In the Choose Scope of Public Folders to be queried section, select one of the f
## Scope to the Selected Public Folders
-When Scope to **Selected Public Folders** is selected on the Scope page, the options to specify the
-desired folders are enabled.
+When you select Scope to **Selected Public Folders** on the Scope page, the options to specify the
+desired folders become available.
Configure the scope of the selected public folders to be queried:
-- Select public folders from – Enter the name of the server hosting the desired public folders and
+- Select public folders from – Enter the name of the server hosting the public folders you want and
click **Retrieve**. The box will populate with available public folders.
- Add – Adds the selected folders
- Add Recursive – Adds the selected folders and all child folders. Not adding recursive folders will
@@ -55,13 +55,13 @@ Configure the scope of the selected public folders to be queried:
selected host. If enabled, physically housed folders show in bold text in the list that is
returned after clicking **Retrieve**.
-The selected public folders are added in the table at the bottom. Click **Remove** to delete a
+The wizard adds the selected public folders to the table at the bottom. Click **Remove** to delete a
selected word from the filter list.
## Scope to Selected Table
-When Scope to **Selected Table** is selected on the Scope page, the options to specify the desired
-tables are enabled.
+When you select Scope to **Selected Table** on the Scope page, the options to specify the desired
+tables become available.
@@ -71,7 +71,7 @@ Configure the selected tables to be queried:
table. Click **Retrieve** to populate the Table name box with all available tables within the
database.
- - The Table name box can be filtered by entering a name in the textbox and clicking **Retrieve**
+ - Filter the Table name box by entering a name in the textbox and clicking **Retrieve**
-- Field name – Select the desired table and the available fields will populate the Field names box.
+- Field name – Select the table you want, and the available fields populate the Field names box.
Select the field containing the public folder names.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/summary.md
index d8babeaac7..60adc7e846 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/exchangepublicfolder/summary.md
@@ -11,6 +11,5 @@ categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Exchange Public Folder Data Collector Wizard to ensure that no
-accidental clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel**
+instead to close the Exchange Public Folder Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/file/category.md b/docs/accessanalyzer/11.6/admin/datacollector/file/category.md
index 8d202a2b40..e9fce7d9b6 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/file/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/file/category.md
@@ -13,8 +13,8 @@ Use the Category page to identify the type of information to retrieve in this qu
The categories are:
- Calculate Group Size (Files Only) – Scans of disk space for the amount used by files in each
- folder location. This option scopes the query to files so that any information involving the
- folders that hold the files is not retrieved.
+ folder location. This option scopes the query to files so that the query doesn't retrieve any
+ information involving the folders that hold the files.
- File or Folder Properties – Scans the target host for specific attributes and properties
associated with certain files and folders in the environment. This option is selected by default.
- File or Folder Permissions – Scans files or folders for permission settings and effective
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/file/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/file/overview.md
index 0f054f8b4f..ef2e849576 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/file/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/file/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 210
# File Data Collector
-The File Data Collector provides file and folder enumeration, properties, and permissions. It is
-used to find files and folders on a target host. The File Data Collector finds one or more files on
+The File Data Collector provides file and folder enumeration, properties, and permissions. It finds
+files and folders on a target host. The File Data Collector finds one or more files on
the target hosts. It can target any file extension. This data collector is a core component of
Enterprise Auditor and is available with all Enterprise Auditor licenses.
@@ -52,5 +52,5 @@ following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open, then save the configuration settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/file/results.md b/docs/accessanalyzer/11.6/admin/datacollector/file/results.md
index 2eb57750ad..ff6318f956 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/file/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/file/results.md
@@ -6,13 +6,13 @@ sidebar_position: 30
# File: Results
-The Results page provides a list of available properties to be searched for and returned by the job
-execution. The properties selected display as table columns in the results of the query. It is a
-wizard page for all of the categories.
+The Results page provides a list of available properties for the job to search for and return. The
+properties selected display as table columns in the results of the query. It is a wizard page for
+all of the categories.
-Properties can be selected individually or in groups with the **Select All** or **Clear All**
+Select properties individually or in groups with the **Select All** or **Clear All**
buttons. The properties available vary based on the category selected.
:::note
@@ -26,15 +26,15 @@ options on the Results page are grayed out.
- This option is available for the **File or Folder Properties** category
-- Only return permissions for the following user(s) – Defines users for the query. Enter the desired
+- Only return permissions for the following users – Defines users for the query. Enter the desired
users in the textbox.
- This option is available for the **File or Folder Permissions** category
-- Only return permissions for the following group(s) – Defines groups for the query. Enter the
+- Only return permissions for the following groups – Defines groups for the query. Enter the
desired users in the textbox.
- This option is available for the **File or Folder Permissions** category
-- Size Units – Identifies the unit in which the values will be displayed. The options are:
+- Size Units – Identifies the unit for displaying values. The options are:
**Bytes**, **Kb**, **Mb**, or **Gb**.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/file/targetfiles.md b/docs/accessanalyzer/11.6/admin/datacollector/file/targetfiles.md
index 7384d4c38a..93735f1f9e 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/file/targetfiles.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/file/targetfiles.md
@@ -11,7 +11,7 @@ results for the specific folder or file. It is a wizard page for all of the cate
-Within the Target files configuration page, select the desired method to refine the query.
+Within the Target files configuration page, select the method you want to refine the query.
:::note
Some options are grayed out depending on the option selected.
@@ -59,7 +59,7 @@ network neighborhoods which begin with `\\`.
used for the lookup by the query
- Registry Value – This value is automatically populated from the registry key
- - Levels – After a registry path has been selected, the Levels slider can be used to
+ - Levels – After you select a registry path, use the Levels slider to
truncate the path for the key value in the Adjust Path dialog box
- Current Value – Displays the type of data each registry value contains
- Query 32-bit View – Select this checkbox to query a 32-bit view
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/activitysettings.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/activitysettings.md
index e25295ec93..5493e0713e 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/activitysettings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/activitysettings.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# FSAA: Activity Settings
-The File System Activity Auditor Scan Filter Settings page is where activity scan filter settings
-are configured. It is a wizard page for the category of File System Activity Scan.
+Use the File System Activity Auditor Scan Filter Settings page to configure activity scan filter
+settings. It is a wizard page for the category of File System Activity Scan.
@@ -28,16 +28,16 @@ In the Scan Limit section, configure the following:
- Set Log Processing Limit – Stops the scan after the set number of MB or GB of log files are
processed and the threshold number is reached
-These filters affect what data is collected from the activity logs. However, enabling these filters
-also causes the corresponding bulk import query to purge the database of selected activity
+These filters affect what data the scan collects from the activity logs. However, enabling these
+filters also causes the corresponding bulk import query to purge the database of selected activity
information older than the time filter specified here.
-If either is left deselected, all available log files are collected and stored. This has a direct
-impact on both scan time and database size.
+If you leave either deselected, the scan collects and stores all available log files. This has a
+direct impact on both scan time and database size.
:::tip
-Remember, the file activity options require the Activity Monitor to be deployed, configured, and
-services running.
+Remember, the file activity options require you to deploy and configure the Activity Monitor and run
+its services.
:::
@@ -55,7 +55,7 @@ Query window.
-When the Enable host mapping checkbox is selected, the query textbox is enabled. The SQL query
+When you select the Enable host mapping checkbox, the query textbox becomes available. The SQL query
provided by a user should return a set of log locations, target hosts, and host names of the
Monitored Hosts in the Activity Monitor. The target tables must reside within the Enterprise Auditor
database and contain at least the following columns:
@@ -71,21 +71,21 @@ database and contain at least the following columns:
- Host – Name of the host being targeted in the FSAC scan and Bulk Import which the activity events
will be mapped to
-Enter the SQL query by clicking Sample Query then replacing the sample text in the textbox, as shown
-above. The SQL query must target tables that have the required columns populated with the host
+Enter the SQL query by clicking **Sample Query**, then replace the sample text in the textbox as
+needed. The SQL query must target tables that have the required columns populated with the host
mapping.
(Optional) Enter a host in the **Host parameter value (@host)** textbox to test the query to
retrieve the data for that host.
Select **Test Query** to open a preview of the results in the Query Results window. Ensure that the
-data being retrieved by the query is expected. When this option is selected, the data collector runs
+query retrieves the expected data. When you select this option, the data collector runs
against the target table.
### Host-Agent Mapping
-Enterprise Auditor can be configured via the Host Mapping feature to support the use of Multiple
-Activity Monitor Agents for a single targeted Host. See the examples below:
+You can configure Enterprise Auditor via the Host Mapping feature to support the use of Multiple
+Activity Monitor Agents for a single targeted Host. See the following examples:
Single-Host Single-Agent Example:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/appletsettings/appletsettings.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/appletsettings/appletsettings.md
index 985de0e99c..cad2cbf0fd 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/appletsettings/appletsettings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/appletsettings/appletsettings.md
@@ -87,8 +87,8 @@ In the Applet Settings section, configure the following options:
while the proxy server is busy, before it enters the job engine queue
- Applet communication timeout: [number] minutes – This option determines the length of time (in
minutes) the Enterprise Auditor Console attempts to reach the proxy before giving up. Depending on
- the job configuration, the data collector behaves in one of three ways after the timeout value has
- been exceeded:
+ the job configuration, the data collector behaves in one of three ways after the timeout value
+ expires:
- If a communication timeout is reached and the **Stop scan on applet communication timeout**
option is unchecked, the scan continues running. When the proxy is available again, the data
collector gets the database files on the next scan of that host. It will either bring the
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/azuretenantmapping.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/azuretenantmapping.md
index 45160fb776..b15c993303 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/azuretenantmapping.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/azuretenantmapping.md
@@ -6,7 +6,7 @@ sidebar_position: 70
# FSAA: Azure Tenant Mapping
-The Azure Tenant Mapping page is where the target domain or Tenant ID are configured for Azure
+Use the Azure Tenant Mapping page to configure the target domain or Tenant ID for Azure
Information Protection (AIP) scanning. It is a wizard page for the categories of:
- File System Access/Permission Auditing Scan
@@ -15,8 +15,8 @@ Information Protection (AIP) scanning. It is a wizard page for the categories of
Remember, select the **Enable scanning of files protected by Azure Information Protection** checkbox
on the
[FSAA: Scan Settings](/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scansettings.md)
-page to enable this page in the data collector wizard. In order for FSAA to scan files protected by
-AIP, ensure that the prerequisites are met and an Azure Connection Profile is successfully created.
+page to enable this page in the data collector wizard. For FSAA to scan files protected by
+AIP, ensure that you meet the prerequisites and successfully create an Azure Connection Profile.
See the
[Azure Information Protection Target Requirements](/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md)
topic for additional information on configuring the File System solution to scan for AIP labels.
@@ -24,7 +24,7 @@ topic for additional information on configuring the File System solution to sca
Populate this page with the App ID (created during prerequisites) and a domain name or Tenant ID for
-an Azure environment. These values must be associated with each application ID in the Azure
+an Azure environment. Associate these values with each application ID in the Azure
Connection Profile.
Use the **Add** and **Remove** buttons and manually enter or **Paste** into the textbox the required
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/bulkimport.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/bulkimport.md
index 71da515a0f..f11f300589 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/bulkimport.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/bulkimport.md
@@ -6,7 +6,7 @@ sidebar_position: 130
# FSAA: Bulk Import Settings
-The Bulk Import Settings page is where the bulk import process settings are configured. It is a
+Use the Bulk Import Settings page to configure the bulk import process settings. It is a
wizard page for the categories of:
- Bulk Import File System Access/Permission Auditing
@@ -16,5 +16,5 @@ wizard page for the categories of:
Select the **Import incomplete scan data** checkbox to enable imports of partial scan data. If the
-scan is stopped before successful completion, this option must be checked in order to bulk import
+scan stops before successful completion, check this option to bulk import
the data from a partially scanned host.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/certificatemanagement/certificatemanagement.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/certificatemanagement/certificatemanagement.md
index 8b12508a04..819c0cb9a0 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/certificatemanagement/certificatemanagement.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/certificatemanagement/certificatemanagement.md
@@ -7,7 +7,7 @@ sidebar_position: 160
# FSAA Applet Certificate Management Overview
Communication between the FSAA Data Collector and the FSAA Applet is secure by default using HTTPS.
-For authentication, at least three certificates are required and need to be stored in the correct
+Authentication requires at least three certificates, which you must store in the correct
certificate store managed by the FSAA Data Collector. These three certificates are:
- The certificate authority (stored in the FSAA Certificate Authority Store)
@@ -16,10 +16,10 @@ certificate store managed by the FSAA Data Collector. These three certificates a
:::note
The FSAA Data Collector and Applet server support certificates in both the user’s
-certificate store and the computer’s certificate store. It is recommended to store certificates in
-the user's certificate store that is running the FSAA Data Collector or Applet server because
-administrative access is required for the computer's certificate store. When certificates are
-generated using the Automatic option below, they are stored in the user’s certificate store.
+certificate store and the computer’s certificate store. Store certificates in
+the user's certificate store that is running the FSAA Data Collector or Applet server, because
+the computer's certificate store requires administrative access. When you generate certificates
+using the Automatic option, Enterprise Auditor stores them in the user’s certificate store.
:::
@@ -27,21 +27,19 @@ generated using the Automatic option below, they are stored in the user’s cert
There are three Certificate Exchange Options provided by the FSAA Data collector:
-- Automatic (Default Option) – The creation of a self-signed certificate and certificate exchange
- between the FSAA Data Collector and Applet are handled entirely by the FSAA Data Collector and
- Applet server
+- Automatic (Default Option) – The FSAA Data Collector and Applet server handle the creation of a
+ self-signed certificate and certificate exchange entirely
- The self-signed CA generated will be valid for two years and the FSAA Data Collector and
Applet server will also manage expired certificates and remove certificates that are no longer
valid from the FSAA stores
- Manual – The FSAA Data Collector will expect all certificates to be valid and in their respective
- certificate stores prior to running a scan
+ certificate stores before running a scan
- - To create and store certificates, the `FSAACertificateManager.exe` tool can be used. This
- application was created to simplify the process of creating certificates and will store the
- certificates in the location that the FSAA Data Collector and Applet server expect them to be
- stored. See the
+ - To create and store certificates, use the `FSAACertificateManager.exe` tool. This tool
+ simplifies the process of creating certificates and stores them in the location that the FSAA
+ Data Collector and Applet server expect. See the
[FSAA Manual Certificate Configuration](/docs/accessanalyzer/11.6/admin/datacollector/fsaa/certificatemanagement/manualcertificate.md)
topic for additional information.
@@ -51,30 +49,30 @@ There are three Certificate Exchange Options provided by the FSAA Data collector
with the `-help` command.
:::note
- If the FSAA Data Collector and Applet are on separate domains without a trust, this
- option must be used.
+ If the FSAA Data Collector and Applet are on separate domains without a trust, use this
+ option.
:::
- Provide Certificate Authority – The certificate exchange process is the same as with the Automatic
option. However, instead of creating a self-signed certificate, the FSAA Data Collector uses a
- certificate you provide through the FSAA Data Collector Wizard. The provided certificate is stored
- in the FSAA Certificate Authority Store.
+ certificate you provide through the FSAA Data Collector Wizard. The FSAA Data Collector stores the
+ provided certificate in the FSAA Certificate Authority Store.
:::note
- If the provided certificate is not self-signed as the Certificate Authority, the root
- certificate and the Certificate Authority’s certificate chain must also be stored in the FSAA
+ If the provided certificate isn't self-signed as the Certificate Authority, you must also store
+ the root certificate and the Certificate Authority’s certificate chain in the FSAA
Certificate Authority Store on both the client and server hosts.
:::
:::warning
- The FSAA Applet does not support password-protected certificates. Certificates
+ The FSAA Applet doesn't support password-protected certificates. Certificates
generated when the Automatic option is selected have no password. When manually creating a
- certificate for use with the FSAA Applet the password parameter should be omitted.
+ certificate for use with the FSAA Applet, omit the password parameter.
:::
-Additionally, the port used for secure certificate exchange can be configured by selecting the
+Additionally, you can configure the port used for secure certificate exchange by selecting the
Specify certificate exchange port checkbox on the Applet Settings page of the FSAA Data Collector
Wizard. The default port is 8767.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/certificatemanagement/manualcertificate.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/certificatemanagement/manualcertificate.md
index 53d8371a77..f915047be0 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/certificatemanagement/manualcertificate.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/certificatemanagement/manualcertificate.md
@@ -14,16 +14,16 @@ case-sensitive.
## Create and store the required certificates
:::note
-In these steps, some commands need to be run on the Enterprise Auditor console and some on
+In these steps, you run some commands on the Enterprise Auditor console and others on
the Proxy host. In the provided example commands:
:::
-- All files that are generated by the Certificate Manager or copied to the Enterprise Auditor
- console are placed in the
+- The Certificate Manager places any files it generates, or that you copy to the Enterprise Auditor
+ console, in the
`%SAInstallDir%\PrivateAssemblies\FILESYSTEMACCESS\Applet\My Certificates` directory. The tool creates this folder
if it doesn't already exist.
-- When operating on the proxy host, files are placed into the root of the **FSAA** folder
+- When you run the tool on the proxy host, it places files into the root of the **FSAA** folder
:::tip
Remember, all commands in the `FSAACertificateManager.exe` tool are case-sensitive.
@@ -131,7 +131,7 @@ copied to:
- Replace the CN (`proxy01.my.domain.com`) with the FQDN of the proxy host
- Replace the alternate subject name (`proxy01`) with the short name for the proxy host
-- The generated certificate signing request and key are stored in the same directory as
+- The tool stores the generated certificate signing request and key in the same directory as
`FSAACertificateManager.exe` on the proxy host
The following message appears when the command completes successfully:
@@ -186,12 +186,12 @@ Successfully added FSAA_Server_Auth to Server
**Step 11 –** Repeat Steps 6-10 for each proxy host.
-**Step 12 –** Delete all the PFX, CER, and Key files that were generated or copied in the earlier
+**Step 12 –** Delete all the PFX, CER, and Key files generated or copied in the earlier
steps from the output locations.
-You have now stored all the required FSAA certificates in the FSAA managed certificate stores. The
-FSAA queries need to be configured to use the **Manual** certificate exchange option. This option
-can be found under Applet Settings in the FSAA Data Collector Wizard. See the
+You have now stored all the required FSAA certificates in the FSAA managed certificate stores.
+Configure the FSAA queries to use the **Manual** certificate exchange option. You can find this
+option under Applet Settings in the FSAA Data Collector Wizard. See the
[FSAA: Applet Settings](/docs/accessanalyzer/11.6/admin/datacollector/fsaa/appletsettings/appletsettings.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/defaultscopingoptions.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/defaultscopingoptions.md
index 0e010abf76..748eaa6d38 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/defaultscopingoptions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/defaultscopingoptions.md
@@ -6,10 +6,9 @@ sidebar_position: 80
# FSAA: Default Scoping Options
-The Default Scoping Options page is where scan settings, file details, and file properties settings
-can be configured for every resource in the targeted environment by the data collector. The settings
-assigned on this page are used by all resources involved in the scan. It is a wizard page for the
-categories of:
+Use the Default Scoping Options page to configure scan settings, file details, and file properties
+settings for every resource the data collector targets in the environment. All resources involved in
+the scan use the settings you assign on this page. It is a wizard page for the categories of:
- File System Access/Permission Auditing Scan
- Sensitive Data Scan
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/filedetails.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/filedetails.md
index a97d5056fd..dac91f59c6 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/filedetails.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/filedetails.md
@@ -6,11 +6,11 @@ sidebar_position: 20
# File Details Tab
-The File Details tab allows configuration of settings for file detail collection.
+Use the File Details tab to configure settings for file detail collection.
-Select the desired settings for additional scoping:
+Select the settings you want for additional scoping:
- Scan file-level details – Turns on file-level scanning and collects a full list of files, file
size, last modified, and last accessed
@@ -35,11 +35,10 @@ provides a count for the number of occurrences of each tag.
**Scan filter settings**
-The Scan filter settings options are enabled if the **Scan file-level details** checkbox is
-selected.
+You enable the Scan filter settings options by selecting the **Scan file-level details** checkbox.
- Only files larger than [number] [size unit] – Filters the results to only collect file data on
- files larger than the set value. If this option is not set, all file sizes are collected.
+ files larger than the set value. If this option isn't set, all file sizes are collected.
- Only files last modified more than [number] [time period] ago – Filters results to only collect
file data on files modified older than the set value
- Only files last modified less than [number] [time period] ago – Filters results to only collect
@@ -49,7 +48,7 @@ selected.
not set, all file types are collected.
:::warning
-Be careful when configuring these settings. If no filters are applied when file detail
-scanning has been enabled, it can result in returning large amounts of data to the database.
+Be careful when configuring these settings. If you don't apply filters after enabling file
+detail scanning, the scan can return large amounts of data to the database.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/fileproperties.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/fileproperties.md
index c8d65e5e3a..577e8cb293 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/fileproperties.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/fileproperties.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# File Properties (Folder Summary) Tab
-The File Properties (Folder Summary) tab is where file property collection settings for the scan is
-configured.
+Use the File Properties (Folder Summary) tab to configure file property collection settings for the
+scan.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/scansettings.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/scansettings.md
index 361cfe4a9d..e6f97f664f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/scansettings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/scansettings.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Scan Settings Tab
-The Scan Settings tab allows configuration of data collection settings.
+Use the Scan Settings tab to configure data collection settings.
@@ -18,16 +18,16 @@ The Scan Settings tab has the following configurable options:
- Exclude snapshot directories on NetApp server – Excludes folders on NetApp Filers that begin with
~snapshot
-- Exclude system shares – Part of the OS that most users don’t have access to so its hidden by
- Microsoft
+- Exclude system shares – Excludes parts of the OS that most users can't access; Microsoft hides
+ these by default
- Exclude hidden shares – Excludes shares with names ending with $
- Last Access Time (LAT) preservation – Preserves Data Access timestamp attribute on files that are
scanned for Metadata tags and sensitive data
- - Warn if unable to preserve Last Access Time – Scan throws a warning if the LAT cannot be
- preserved. The file is still scanned unless the Skip file if unable to preserve Last Access
- Time checkbox is also selected.
- - Skip file if unable to preserve Last Access Time – Scan skips the file if the LAT cannot be
+ - Warn if unable to preserve Last Access Time – Scan throws a warning if the LAT can't be
+ preserved. The scan still processes the file unless you also select the Skip file if unable to
+ preserve Last Access Time checkbox.
+ - Skip file if unable to preserve Last Access Time – Scan skips the file if the LAT can't be
preserved
Selecting the **Last Access Time (LAT) preservation** checkbox enables the **Action on failure to
@@ -37,13 +37,13 @@ enable LAT preservation** and **Action on changed LAT after scan** dropdown me
- Action on failure to enable LAT Preservation – Before scanning each file, FSAA attempts to enable
an operating system feature to preserve the LAT when accessing the file. This operation may fail
- for a variety of reasons, which include but are not limited to: the operating system or file
- system where the file is located does not support LAT preservation, or insufficient permissions
+ for a variety of reasons, which include but aren't limited to: the operating system or file
+ system where the file is located doesn't support LAT preservation, or insufficient permissions
from the service account trying to access the file. The following configuration addresses a
failure to enable the LAT preservation mode:
- Continue to scan file silently – FSAA scans the file with the possibility that LAT
- preservation is not possible. No warning will be shown.
+ preservation isn't possible. No warning will be shown.
- Continue to scan file with warning – FSAA scans the file with the possibility that LAT will
not be preserved. A warning will be shown for this file.
- Skip file silently – FSAA will not scan the file. No warning will be shown.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/queryselection.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/queryselection.md
index 673710961e..9edd796708 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/queryselection.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/queryselection.md
@@ -28,7 +28,7 @@ auditing focus:
- Scan and import – Collects Distributed File System information
:::note
- Starting with v8.1, DFS Audits are completed with a streaming method and do not
+ Starting with v8.1, DFS Audits are completed with a streaming method and don't
require a bulk import query following the scan query.
:::
@@ -61,9 +61,9 @@ Once a query scan using the FSAA DC has been executed, the **Maintenance** butto
allow troubleshooting of scan errors that may have occurred.
:::warning
-Do not use the Maintenance button unless instructed by
-[Netwrix Support](https://www.netwrix.com/support.html). It is possible to cause corruption of the
-database and loss of data to occur.
+Don't use the Maintenance button unless instructed by
+[Netwrix Support](https://www.netwrix.com/support.html). Using it incorrectly can corrupt the
+database and cause data loss.
:::
@@ -75,7 +75,7 @@ errors.
-The Maintenance Selection page allows you to select the type of maintenance to be performed:
+Use the Maintenance Selection page to select the type of maintenance to perform:
- Reset Hosts – Resets the Access GUID column value in the SA_FSAA_Hosts table for the Hosts
selected. Allows data to be bulk imported when there is a GUID mismatch.
@@ -89,14 +89,14 @@ selection made.
- Select the desired hosts to reset the SQL data for, and click **Reset Hosts** to perform the
+ Select the hosts you want to reset the SQL data for, and click **Reset Hosts** to perform the
maintenance.
- If Repair was selected, the Repair Tool page displays:
- Select the desired hosts to repair the SQL data for, and click **Run** to perform the
+ Select the hosts you want to repair the SQL data for, and click **Run** to perform the
maintenance.
Click **Finish** to close the wizard when you have completed the required maintenance.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scanserverselection.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scanserverselection.md
index 07eec1a634..3a2f14bdfc 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scanserverselection.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scanserverselection.md
@@ -46,7 +46,7 @@ Using the radio buttons, select where the execution of the applet will take plac
choose from. If more than one list is selected, scanning is distributed across each host.
:::info
-It is best practice in global implementations to utilize a specific remote server or proxy scanner
+It is best practice in global implementations to use a specific remote server or proxy scanner
that is located in the same data center as the target hosts. This is particularly beneficial if the
Enterprise Auditor Console server is in a different data center. See the
[Proxy Scanning Architecture](/docs/accessanalyzer/11.6/install/filesystemproxy/overview.md#proxy-scanning-architecture)
@@ -55,7 +55,7 @@ topic for additional information.
In the bottom section, the checkbox options affect the execution of the applet:
-- Fallback to local mode if applet can't start – If the applet cannot be deployed on the target
+- Fallback to local mode if applet can't start – If the applet can't be deployed on the target
host, it is deployed locally on the same server as the Enterprise Auditor Console and the scan
collects data across the network
- Run remote applet with normal priority (non-proxy applet server uses background priority by
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scansettings.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scansettings.md
index 9bef9e0467..6e9b531d84 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scansettings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scansettings.md
@@ -14,16 +14,16 @@ wizard page for the categories of:
-In the Scan Protocols section, select the desired checkboxes for including certain types of shared
+In the Scan Protocols section, select the checkboxes you want for including certain types of shared
folders:
- Scan Windows (SMB/CIFS) shares – Includes types of Windows and NAS shares
- Scan NFS exports (shares) – Includes this type of UNIX and NAS shares
-In the middle section, select the desired checkboxes for additional settings:
+In the middle section, select the checkboxes you want for additional settings:
- Enable file system scan streaming – Sends the streamed data directly to the Enterprise Auditor
- database. A bulk import query is not required when this option is selected
+ database. A bulk import query isn't required when this option is selected
- Enable scanning of files protected by Azure Information Protection – Adds additional options to
this wizard to scan for protection labels and encrypted files for sensitive data
@@ -37,7 +37,7 @@ In the middle section, select the desired checkboxes for additional settings:
permissions. Click **Configure Query** to open the Manual Shares Query window. See the
[Enable the Use SQL Query to Manually Specify Shares](#enable-the-use-sql-query-to-manually-specify-shares)
topic for additional information.
-- NetApp communication security – This option provides the ability to choose levels of encryption
+- NetApp communication security – This option lets you choose levels of encryption
and authentication applied during Access Auditing scans of NetApp devices
@@ -83,7 +83,7 @@ columns for all shares in the target environment:
- Host – Name of host where the share resides matching the Host Master table Name field value
:::info
- Use this column but it is not required.
+ Use this column but it isn't required.
:::
@@ -121,7 +121,7 @@ When this option is selected, the data collector runs against the target table t
in the environment.
:::tip
-Remember, if a share is not in the target table, the data collector assumes that the share does
+Remember, if a share isn't in the target table, the data collector assumes that the share does
not exist and marks it as deleted.
:::
@@ -130,7 +130,7 @@ not exist and marks it as deleted.
The HTTPS encryption options for the NetApp communication security setting of the global Remote Data
Collection Configuration page in the File System Access Auditor Data Collector Wizard requires a
-certificate. If the organization uses a self-signed certificate, it is necessary to add this
+certificate. If the organization uses a self-signed certificate, add this
certificate to enable HTTPS encryption of Enterprise Auditor communications.
The certificate (`cacert.pem`) which is shipped with Enterprise Auditor is in the DC folder of the
@@ -140,14 +140,14 @@ installation directory. The default location is:
If employing remote applet mode or proxy servers, then the certificate (`cacert.pem`) must exist in
the FSAA folder where the `FSAAAppletServer.exe` process is running (applet/proxy host). Therefore,
-it is necessary to also copy it to the FSAA folder on the target hosts andr proxy servers. This is
+also copy it to the FSAA folder on the target hosts andr proxy servers. This is
done at runtime when using remote applet mode, but any updates or custom certificates must be copied
manually. The default location is:
**…\STEALTHbits\StealthAUDIT\FSAA**
:::info
-Do not overwrite this certificate. It is fully trusted by Netwrix. Instead, add
+Don't overwrite this certificate. It is fully trusted by Netwrix. Instead, add
an underscore (_) character to the start of the file name. Then copy the organization's self-signed
certificate to this location with the name `cacert.pem`.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scopingoptions.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scopingoptions.md
index 519ceed7e2..8dcfe1cc25 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scopingoptions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scopingoptions.md
@@ -31,7 +31,7 @@ The Scoping Options buttons have the following:
imported, the user will be prompted to resolve the conflict by either keeping the existing
configuration or importing the new one, which will overwrite the scoping option.
-- Export – Take the currently configured scoping options in the job and export it to a `.fsaascope`
+- Export – Take the configured scoping options in the job and export it to a `.fsaascope`
file
By default, priority is assigned in the order it is added to the table. Priority can also be
@@ -54,7 +54,7 @@ default scoping settings for the selected resource.
Set the Resource Name and Host Name:
- Resource Name – Specify a local path or individual share to the target folder or the share name
-- Host Name – Apply scoping options to a specific target host. If a host name is not supplied, all
+- Host Name – Apply scoping options to a specific target host. If a host name isn't supplied, all
hosts targeted by the job have the scoping options applied.
Both the Resource Name and Host Name textboxes support regular expressions and pattern matching.
@@ -94,15 +94,15 @@ Then set Scoping Type and Priority:
:::note
Any included files or folders inherit all options previously checked in the
[FSAA: Default Scoping Options](/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/defaultscopingoptions.md)
- page. Manually apply new options if the default ones are not desired in this scan.
+ page. Manually apply new options if the default ones aren't desired in this scan.
:::
- Priority – Numerical value that determines which options are used in the case of more than one
scoping option overlaps for a particular resource. Lower numerical values have a higher priority
for this scan. When multiple scoping options are added to a single resource, and there is no
- conflict, the scoping options are merged. However, in some instances, the settings conflict. Below
- are some known conflicts and their results:
+ conflict, the scoping options are merged. However, in some instances, the settings conflict. The
+ following list describes some known conflicts and their results:
- Conflict between two options for a single resource – Higher priority takes precedence
- Folder scoping option conflicts with a share scoping option – Folder takes precedence
- Conflict between two scoping options with the same priority – Path determines which option is
@@ -178,11 +178,11 @@ All other folder paths are excluded.
**Additional Considerations**
-The scoping options listed above can be used to scope for SMB shares and NFS exports but NFS exports
-are enumerated differently. The include/exclude logic outlined above should be the same for both,
+Use the preceding scoping options to scope for SMB shares and NFS exports, but NFS exports
+are enumerated differently. The same include/exclude logic applies to both,
but when scoping for NFS exports the Resource Name should be the full path to the export.
-For example, in the scenario below, the NFS export named NFS_Export is included. All other exports
+For example, in the following scenario, the NFS export named NFS_Export is included. All other exports
are excluded. Within the NFS_Export export, folder path \ifs\NFS_Export\Test_Folder is included. All
other folder paths are excluded.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scopingqueries.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scopingqueries.md
index 0ea1057685..3d0b23540c 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scopingqueries.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/scopingqueries.md
@@ -48,7 +48,7 @@ The Scoping Queries buttons have the following functionality:
:::note
These two Scan Resource Filters are both Share Include queries by default. To restrict the
-scan to only Open Shares or only DFS Shares it is necessary to also configure the Scoping Options on
+scan to only Open Shares or only DFS Shares, also configure the Scoping Options on
the previous page of the wizard to exclude all other shares.
:::
@@ -68,8 +68,8 @@ topic for additional information and common scoping scenarios.
## Scoping Query Configuration Window
-The Scoping Query Configuration window allows you to create a custom Scoping Query to specify shares
-and folders to be included in or excluded from the scan.
+Use the Scoping Query Configuration window to create a custom Scoping Query that specifies shares
+and folders to include in or exclude from the scan.
@@ -94,7 +94,7 @@ Scoping Options Query Configuration window.
-Follow the steps to configure a query.
+To configure a query:
**Step 1 –** Enter a SQL Query that will return a list of resources to be included in or excluded
from the scan.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/sensitivedatasettings.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/sensitivedatasettings.md
index 55b1884eb6..caa24f90a6 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/sensitivedatasettings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/sensitivedatasettings.md
@@ -45,7 +45,7 @@ Use the radio buttons to select the File types to scan:
- Spreadsheets
- Text/Markup files
-- Perform differential scan of – Enables users to choose whether to employ incremental scanning:
+- Perform differential scan of – Lets you choose whether to use incremental scanning:
- Files modified or newly discovered since last scan – Scans newly discovered files and files
with a modified date after the previous scan date
@@ -62,7 +62,7 @@ been installed on the Enterprise Auditor Console.
The Performance Options section allows the user to modulate the efficiency of SDD scans.
- Number of SDD scan processes [number] – Increases the number of SDD scanner processes that spawn
- as part of a scan, increasing parallel scanning. The value should not exceed 2x the number of CPU
+ as part of a scan, increasing parallel scanning. The value shouldn't exceed 2x the number of CPU
threads available.
:::info
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/standardtables.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/standardtables.md
index 94045aa074..c5293da35d 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/standardtables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/standardtables.md
@@ -26,9 +26,9 @@ The tables and their associated views are grouped by types.
| Tables | Details |
| -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SA_FSAA_Trustees | Contains information about any domain user, group, or security principal that has been assigned permissions. This table does not contain local users and groups since none of the trustees in this table are specific to any one host. |
-| SA_FSAA_LocalTrustees | Contains information about any trustees that do not belong to a domain, primarily local users and local groups |
-| SA_FSAA_TrusteeEquivalence | Contains information about Local Group membership. The trustees described can be found in the SA_FSAA_LocalTrustees table. |
+| SA_FSAA_Trustees | Contains information about any domain user, group, or security principal that has been assigned permissions. This table doesn't contain local users and groups since none of the trustees in this table are specific to any one host. |
+| SA_FSAA_LocalTrustees | Contains information about any trustees that don't belong to a domain, primarily local users and local groups |
+| SA_FSAA_TrusteeEquivalence | Contains information about Local Group membership. The SA_FSAA_LocalTrustees table contains the trustees described. |
**Access Calculation Tables**
@@ -68,7 +68,7 @@ The tables and their associated views are grouped by types.
| SA_FSAA_SchemaVer | Tracks the schema version of the tables for upgrading purposes |
Views are the recommended way for Enterprise Auditor users to obtain the information gathered by the
-FSAA Data Collector. They contain additional information for building queries easily. The following
+FSAA Data Collector. They contain additional information for building queries. The following
is an explanation of the corresponding views created for some of the tables generated by the FSAA
Data Collector:
@@ -117,7 +117,7 @@ The tables and their associated views are grouped by types.
| SA_FSAC_UserExceptionTypes | Identifies how many instances of user exceptions exist on the audited hosts |
Views are the recommended way for Enterprise Auditor users to obtain the information gathered by the
-FSAA Data Collector. They contain additional information for building queries easily. The following
+FSAA Data Collector. They contain additional information for building queries. The following
is an explanation of the corresponding views created for some of the tables generated by the FSAA
Data Collector:
@@ -145,7 +145,7 @@ The tables and their associated views are grouped by types.
| SA_FSDFS_Namespaces | Contains a list of all of the domain and server namespaces with corresponding links to the SA_FSAA_Hosts table |
Views are the recommended way for Enterprise Auditor users to obtain the information gathered by the
-FSAA Data Collector. They contain additional information for building queries easily. The following
+FSAA Data Collector. They contain additional information for building queries. The following
is an explanation of the corresponding views created for some of the tables generated by the FSAA
Data Collector:
@@ -170,7 +170,7 @@ The tables and their associated views are grouped by types.
| SA_FSDLP_MatchHits_SubjectProfile | Contains the actual sensitive data within files that matched selected criteria for subject profiles |
Views are the recommended way for Enterprise Auditor users to obtain the information gathered by the
-FSAA Data Collector. They contain additional information for building queries easily. The following
+FSAA Data Collector. They contain additional information for building queries. The following
is an explanation of the corresponding views created for some of the tables generated by the FSAA
Data Collector:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/workflows.md b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/workflows.md
index 7088b7f5df..3b263c2b21 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/fsaa/workflows.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/fsaa/workflows.md
@@ -33,12 +33,12 @@ job it is applied to.
## Remove File System Access Scan Category
-The FSAA Data Collector can be used to clean-up or troubleshoot the applet and proxy scanning
+Use the FSAA Data Collector to clean up or troubleshoot the applet and proxy scanning
servers. This would need to be done through a new job’s query. Set the host list and Connection
-Profile to target the desired applet and proxy servers.
+Profile to target the applet and proxy servers you want.
-Follow these steps to build a new query using the FSAA Data Collector with the Remove scan
-executables and data category.
+To build a new query using the FSAA Data Collector with the Remove scan
+executables and data category:
**Step 1 –** Navigate to the **Configure** node of a new or chosen job and select the **Queries**
node.
@@ -46,7 +46,7 @@ node.
**Step 2 –** In the Query Selection view, click the **Create Query** link. The Query Properties
window displays.
-**Step 3 –** Select the **Data Source** tab. From the **Data Collector** drop-down menu, select
+**Step 3 –** Select the **Data Source** tab. From the **Data Collector** dropdown menu, select
**FILESYSTEMACCESS** and then click the **Configure** button. The File System Access Auditor Data
Collector Wizard opens.
@@ -62,20 +62,20 @@ audit scan applet and data from the target server. Run the job to clean-up the t
## Update Proxy Service Category
-The FSAA Data Collector can be used to upgrade the File System Proxy Service already installed on
+Use the FSAA Data Collector to upgrade the File System Proxy Service already installed on
proxy servers. The FS_UpdateProxy Job is preconfigured to run with the default settings with the
category of Update proxy service. It is available through the Instant Job Library under the File
System library.
The Update Proxy Service category option enables users with the ability to update v8.0+ File System
Proxy Service installations to newer versions. When this query is employed, the job compresses the
-updated binaries and deploy them to the proxy server. Once the proxy server has no active sessions,
+updated binaries and deploy them to the proxy server. When the proxy server has no active sessions,
the Netwrix Enterprise Auditor FSAA Proxy Scanner service shuts down and the components are updated.
Finally, the service restarts itself.
:::note
-This option is not for updating v7.x File System Proxy installations. Those must be
-manually updated to at least v8.0 on the proxy server before this query can be used to automate the
+This option isn't for updating v7.x File System Proxy installations. Those must be
+manually updated to at least v8.0 on the proxy server before you can use this query to automate the
process.
:::
@@ -86,14 +86,14 @@ and use the FS_UpdateProxy Job.
## Remove Host Category
-The FSAA Data Collector can be used to clean-up the Standard Reference Tables by removing data for
+Use the FSAA Data Collector to clean up the Standard Reference Tables by removing data for
particular hosts. This would need to be done through a new job’s query. The host to be removed is
set as the host list for the new job. The Connection Profile applied should be the same as the one
used for the associated **FileSystem** > **0.Collection** > … **Bulk Import** Job.
:::warning
Be careful when applying this query task, as it results in the deletion of collected
-data. Ensure proper configuration prior to job execution.
+data. Ensure proper configuration before job execution.
:::
@@ -102,8 +102,8 @@ Manually enter individual hosts into the host list executing this query.
:::
-Follow the steps to build a new query using the FSAA Data Collector with the Remove host data
-category.
+To build a new query using the FSAA Data Collector with the Remove host data
+category:
**Step 1 –** Navigate to the **Configure** node of a new or chosen job and select the **Queries**
node.
@@ -111,7 +111,7 @@ node.
**Step 2 –** In the Query Selection view, click the **Create Query** link. The Query Properties
window displays.
-**Step 3 –** Select the **Data Source** tab. From the **Data Collector** drop-down menu, select
+**Step 3 –** Select the **Data Source** tab. From the **Data Collector** dropdown menu, select
**FILESYSTEMACCESS** and then click **Configure**. The File System Access Auditor Data Collector
Wizard opens.
@@ -127,14 +127,14 @@ job’s **Configure** > **Hosts** node. Run the job to clean-up the targeted hos
:::tip
Remember, this job deletes data from the Enterprise Auditor database. Use caution and ensure
-proper configuration prior to job execution.
+proper configuration before job execution.
:::
## Remove Host and Criteria SDD Data
The FS_SDD_DELETE job removes host and criteria sensitive data matches from the Tier 1 database. It
-is preconfigured to run analysis tasks with temporary tables that requires modification prior to job
+is preconfigured to run analysis tasks with temporary tables that requires modification before job
execution. It is available through the Instant Job Library under the File System library. See the
[Instant Job Wizard](/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md)
topic for additional information.
@@ -161,9 +161,9 @@ Applying these analysis tasks result in the deletion of collected data.
### Configure the FS_SDD_DELETE Analysis Tasks
-Follow the steps to configure and run the analysis tasks.
+To configure and run the analysis tasks:
-**Step 1 –** Prior to job execution, modify the desired analysis tasks using the
+**Step 1 –** Before job execution, modify the analysis tasks you want using the
[Customizable Analysis Parameters for FS_SDD_DELETE Job](#customizable-analysis-parameters-for-fs_sdd_delete-job)
instructions.
@@ -176,7 +176,7 @@ status is visible from the **Running Instances** node.
analysis tasks.
:::warning
-Do not leave these analysis tasks checked in order to avoid accidental data loss.
+Don't leave these analysis tasks checked to avoid accidental data loss.
:::
@@ -195,11 +195,11 @@ be deleted during this job’s analysis.
| Remove Host & Criteria | #Criteria #hosts | List of Criteria and Host Names to be removed |
The parameters that can be customized are listed in a section at the bottom of the SQL Script
-Editor. Follow the steps to customize analysis task parameters.
+Editor. To customize analysis task parameters:
**Step 1 –** Navigate to the **FS_SDD_DELETE** > **Configure** node and select **Analysis**.
-**Step 2 –** In the Analysis Selection view, select the desired analysis task and click on
+**Step 2 –** In the Analysis Selection view, select the analysis task you want and click
**Analysis Configuration**. The SQL Script Editor opens.
@@ -209,7 +209,7 @@ or **#hosts** row, depending on the analysis task chosen, and then **Edit Table*
window opens.
:::warning
-Do not change any parameters where the Value states `Created during execution`.
+Don't change any parameters where the Value states `Created during execution`.
:::
@@ -264,7 +264,7 @@ Applying these analysis tasks result in the deletion of collected data.
- **4. Drop FSDFS Tables** – Drops the File System DFS Auditing tables imported from the previous runs
- **5. Drop FSAA Tables** – Drops File System Access Auditing tables imported from the previous runs
-Do not try to run these tasks separately, as they are designed to work together. Follow these steps
+Don't try to run these tasks separately, as they are designed to work together. Follow these steps
to run the analysis tasks:
**Step 1 –** In the Analysis Selection Pane, click **Select All**. All tasks will be checked.
@@ -276,7 +276,7 @@ status is visible from the **Running Job** node.
All** to deselect these analysis tasks.
:::warning
-Do not leave these analysis tasks checked in order to avoid accidental data loss.
+Don't leave these analysis tasks checked to avoid accidental data loss.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/category.md b/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/category.md
index 023fdd9ac9..a54f972b0d 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/category.md
@@ -6,23 +6,23 @@ sidebar_position: 10
# GroupPolicy: Category
-On the GroupPolicy Data Collector Category page, select the required query category to be executed.
+On the GroupPolicy Data Collector Category page, select the query category to run.
The available categories are:
- Group Policy Objects – Retrieves the GPO’s list in the domain and where each is linked
-- Policies State – Provides the ability to return information on configured policies and policy
- parts from the individual policies which have been selected
+- Policies State – lets you return information on configured policies and policy
+ parts from the individual policies you select
- - For example, selecting **Account Policies** > **Policy Password** will result in **Account
- Policies** > **Policy Password** being returned for the targeted domains
+ - For example, if you select **Account Policies** > **Policy Password**, the query returns
+ **Account Policies** > **Policy Password** for the targeted domains
-- Policies State for all GPOs – Provides the ability to return information on selected policy parts
+- Policies State for all GPOs – lets you return information on selected policy parts
from all policies within the domain
- - For example, selecting **Account Policies** > **Password Policy** will result in **Password
- Policy** being returned for all policies in the targeted domains
+ - For example, if you select **Account Policies** > **Password Policy**, the query returns
+ **Password Policy** for all policies in the targeted domains
- Local policies – Returns effective security policies in effect at the individual workstation
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/options.md b/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/options.md
index b169c86ec8..a1d2ab1bdd 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/options.md
@@ -6,14 +6,14 @@ sidebar_position: 40
# GroupPolicy: Options
-The Options page is used to configure how to return multi-valued properties and how policy results
-are presented. It is a wizard page for all categories.
+Use the Options page to configure how to return multi-valued properties and how to present policy
+results. It is a wizard page for all categories.
The configurable options are:
-- Result Presentation – Select one of the following options. This section is not available for the
+- Result Presentation – Select one of the following options. This section isn't available for the
Group Policy Objects category.
- Each part of each policy on a new row
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/overview.md
index 87c82a94a4..261d7b1905 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/overview.md
@@ -6,13 +6,13 @@ sidebar_position: 230
# GroupPolicy Data Collector
-The GroupPolicy Data Collector provides the ability to retrieve the GPO’s list in the domain and
+The GroupPolicy Data Collector lets you retrieve the GPO’s list in the domain and
where they are linked, return information on configured policies and policy parts from the
-individual policies that have been selected, return information on selected policy parts from all
+individual policies you select, return information on selected policy parts from all
policies within the domain, and return effective security policies in effect at the individual
workstation.
-The GroupPolicy Data Collector is a core component of Enterprise Auditor, but it has been
+The GroupPolicy Data Collector is a core component of Enterprise Auditor, but it comes
preconfigured within the Active Directory Solution and the Windows Solution. While the data
collector is available with all Enterprise Auditor license options, the Windows Solution is only
available with a special Enterprise Auditor licenses. See the following topics for additional
@@ -52,5 +52,5 @@ pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open, then save the configuration settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/policieslist.md b/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/policieslist.md
index 623a093613..46a74efc15 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/policieslist.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/policieslist.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# GroupPolicy: Policies List
-The Policies List page is where the policies from the desired GPOs to be queried are selected. It is
+The Policies List page is where you select the policies from the GPOs you want to query. It is
a wizard page for the categories of:
- Policies State
@@ -15,10 +15,10 @@ a wizard page for the categories of:
-Select the policies or policy parts to be audited. The category dictates how this selection is
-applied across the domain or local host.
+Select the policies or policy parts to audit. The category dictates how the query applies this
+selection across the domain or local host.
-To search parts of a policy, drill into the policy and select the desired policy parts. Click
+To search parts of a policy, drill into the policy and select the policy parts you want. Click
**Check all** to select all properties, and click **Uncheck all** to deselect all properties. Search
for a policy by entering a policy name in the Search box and clicking **Search**.
@@ -27,4 +27,4 @@ The policy parts returned may have multiple values.
:::
-At least one policy or policy part must be selected in order to proceed to the next wizard page.
+Select at least one policy or policy part to proceed to the next wizard page.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/summary.md
index c2096cf70e..2985e40d1f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query. It is a wizard page
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Group Policy Data Collector Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel**
+instead to close the Group Policy Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/target.md b/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/target.md
index 4e5dad5f6a..5e3a0d7d17 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/target.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/grouppolicy/target.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# GroupPolicy: Target
-The Target page is where a host from which to get data (in wizard only) and .admx source are
-identified. It is a wizard page for the categories of:
+Use the Target page to identify a host to get data from (in wizard only) and the .admx source. It is
+a wizard page for the categories of:
- Policies State
- Policies State for all GPOs
@@ -19,9 +19,9 @@ In the Connect to section of the page, select from the following options:
- Default domain – Select this option to connect to the default domain
- This domain – Select this option and click the ellipsis to open the Browse for Domain window. Then
- select the desired domain. Click **OK**.
+ select the domain you want. Click **OK**.
-In the Use these job credentials to browse section of the page, if multiple credentials are set up,
+In the Use these job credentials to browse section of the page, if you set up multiple credentials,
select the credentials to use for the query from the dropdown menu.
:::note
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/inifile/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/inifile/overview.md
index fd6c07dc23..8764c21a56 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/inifile/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/inifile/overview.md
@@ -36,5 +36,5 @@ following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** box when
-the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** box while the wizard
+is open, then save the configuration settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/inifile/properties.md b/docs/accessanalyzer/11.6/admin/datacollector/inifile/properties.md
index 503cb4b141..15ae1c6c3c 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/inifile/properties.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/inifile/properties.md
@@ -15,7 +15,7 @@ Use the following options to determine which data to adult:
- All contents – Collect all contents from the INI file
:::note
- `*` can be used for matching wildcard or single characters.
+ Use `*` to match wildcard or single characters.
:::
@@ -27,7 +27,8 @@ Use the following options to determine which data to adult:
- Click the ellipses (**…**) to open a file explorer window
- Select an appropriate .INI file
-- Properties – Select a checkbox next to any desired properties. **Select All** or **Clear All** can
- also be used.
+- Properties – Select a checkbox next to any desired properties. You can also use **Select All** or
+ **Clear All**.
- If **Differences from standard** is selected, all properties are selected and cannot be altered.
+ If you select **Differences from standard**, the wizard selects all properties, and you can't
+ change them.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/inifile/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/inifile/summary.md
index f4dc38e6cb..68494c8be4 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/inifile/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/inifile/summary.md
@@ -6,10 +6,9 @@ sidebar_position: 30
# INIFile: Summary
-The Summary page is where the selected configuration settings are listed.
+Use the Summary page to review the selected configuration settings.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the INIFile Data Collector Wizard ensuring that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel**
+instead to close the INIFile Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/inifile/targetfiles.md b/docs/accessanalyzer/11.6/admin/datacollector/inifile/targetfiles.md
index 4ce177dd9c..9cab813399 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/inifile/targetfiles.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/inifile/targetfiles.md
@@ -17,10 +17,10 @@ Configure the Target Files options:
`drive:\filepath`
- Registry Lookup – Select this option to obtain a path from a registry key that exists on the
target host in the environment. Click the ellipsis (**…**) to open the Enterprise Auditor Registry
- Browser and connect to a host to select a registry key and path to be used for the lookup.
+ Browser and connect to a host to select a registry key and path to use for the lookup.
- - Registry Value – This value is automatically populated from the registry key
- - Levels – The Levels slider can be used to truncate the path for the key value in the Adjust
+ - Registry Value – The wizard automatically populates this value from the registry key
+ - Levels – Use the Levels slider to truncate the path for the key value in the Adjust
Path dialog box
- Current value – Displays the current value for the registry key
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/ldap.md b/docs/accessanalyzer/11.6/admin/datacollector/ldap.md
index 2e8c3c049c..6cef45eced 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/ldap.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/ldap.md
@@ -7,11 +7,11 @@ sidebar_position: 250
# LDAP Data Collector
The LDAP Data Collector uses LDAP to query Active Directory returning the specified objects and
-attributes. For example, a query can be configured to return all user objects at the selected level.
-Another query can be configured to return a master list of all user objects found within the target
-domain. Wildcards and LDAP filters can be applied to the query configurations.
+attributes. For example, you can configure a query to return all user objects at the selected level.
+You can configure another query to return a master list of all user objects found within the target
+domain. You can apply wildcards and LDAP filters to the query configurations.
-The LDAP Data Collector is a core component of Enterprise Auditor, but it has been preconfigured
+The LDAP Data Collector is a core component of Enterprise Auditor, but it comes preconfigured
within the Active Directory Solution. While the data collector is available with all Enterprise
Auditor license options, the Active Directory Solution is only available with a special Enterprise
Auditor license. See the
@@ -39,13 +39,13 @@ following configuration options:
- Connect to the server – Use the default domain controller entered in the box, or enter an
alternate server
-- Naming context – Select a directory partition from the drop-down list: **Default Context**,
+- Naming context – Select a directory partition from the dropdown list: **Default Context**,
**Configuration Context**, or **Schema Context**
-- Connect – Connects to the domain specified. The root folder of the domain is displayed in the left
- pane of the window.
+- Connect – Connects to the domain specified. The left pane of the window displays the root folder of
+ the domain.
:::note
- Before clicking **Connect**, the server port must be configured. To configure the
+ Before clicking **Connect**, configure the server port. To configure the
server port, click **Options** to open the Options window and configure the server port as
described in the Options Window section.
:::
@@ -55,8 +55,7 @@ following configuration options:
options. See the [Options Window](#options-window) topic for additional information.
- List of attributes – Table in the upper right corner lists attributes for the object selected in
the left pane
-- Root path – The Root path textbox is populated with the path to the highlighted attributes to be
- collected
+- Root path – The Root path textbox shows the path to the highlighted attributes to collect
- LDAP filter – The LDAP filter textbox shows the filters applied to the objects. Click the ellipses
(**…**) to open the Filter Options window. See the [Filter Options Window](#filter-options-window)
topic for additional information.
@@ -78,7 +77,7 @@ The Options window contains configure connection options and multi-value results
- Server Port
- If the Connect Securely with TLS/SSL option is selected, use Server Port `686`
- - If the Connect Securely with TLS/SSL option is not selected, use Server Port `389`
+ - If the Connect Securely with TLS/SSL option isn't selected, use Server Port `389`
- Authentication Type
@@ -86,17 +85,17 @@ The Options window contains configure connection options and multi-value results
- Simple
- TreeView Node Limit – Typically set to 500
-- Multi-valued attributes – Indicates how multi-valued properties are returned
+- Multi-valued attributes – Indicates how the query returns multi-valued properties
- - Concatenated – All values are listed in one cell using the delimiter specified
+ - Concatenated – Lists all values in one cell using the delimiter specified
- Delimiter – Symbol used to separate values in the cell
- - First Value Only – Only the first value is listed in the cell
+ - First Value Only – Lists only the first value in the cell
### Filter Options Window
-The Filter Options window is where to add filters to the query. Click the ellipses (**…**) button
+Use the Filter Options window to add filters to the query. Click the ellipses (**…**) button
located to the right of the **LDAP filter** box in the LDAP template form to open this window.
@@ -120,7 +119,7 @@ The Custom Filter window provides options for creating a complex filter.
-Select a **Field** and **Condition** from the drop-down lists. Enter a **Value** for the condition.
+Select a **Field** and **Condition** from the dropdown lists. Enter a **Value** for the condition.
Click **Add** to add the filter to the Filter Lines table.
- Filter Lines will be combined with a logical – Select the **AND** or **OR** option. **AND** is
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nis/category.md b/docs/accessanalyzer/11.6/admin/datacollector/nis/category.md
index 284e141783..70a0e9b257 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nis/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nis/category.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# NIS: Category
-The Category page is used to identify which type of NIS information to retrieve.
+Use the Category page to identify which type of NIS information to retrieve.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nis/configurejob.md b/docs/accessanalyzer/11.6/admin/datacollector/nis/configurejob.md
index 2a71af83f3..82c7b3fafc 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nis/configurejob.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nis/configurejob.md
@@ -6,13 +6,13 @@ sidebar_position: 20
# Unix Connection Profile & Host List
-The NIS Data Collector requires a custom Connection Profile and host list be created and assigned to
-the job or job group conducting the data collection. The host inventory option during host list
-creation makes it necessary to configure the Connection Profile first.
+The NIS Data Collector requires you to create a custom Connection Profile and host list and assign
+them to the job or job group that collects the data. The host inventory option during host list
+creation requires you to configure the Connection Profile first.
## Connection Profile
-Creating the Connection Profile requires having an account with access to the targeted NIS server.
+To create the Connection Profile, you need an account with access to the targeted NIS server.
Create a Connection Profile and set the following information on the User Credentials window:
@@ -25,12 +25,12 @@ Create a Connection Profile and set the following information on the User Creden
- Password/Confirm
- If not using a private key, enter the **Password** and re-type in the **Confirm** field
- - If using a private key, then the password is not needed. Provide the private key information
+ - If you use a private key, you don't need the password. Provide the private key information
in the **Use the following private key when connecting** field.
- Use the following port/ports(CSV) for SSH
- - The SSH port needs to be opened in software and hardware firewalls
+ - You must open the SSH port in software and hardware firewalls
- If desired, select this option and provide the port value
- Use the following private key when connecting
@@ -43,7 +43,7 @@ Create a Connection Profile and set the following information on the User Creden
- If desired, select this option and provide the key value
-Once the Connection Profile is created, it is time to create the custom host list. See the
+After you create the Connection Profile, create the custom host list. See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nis/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/nis/overview.md
index 27844ef590..4b5857a318 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nis/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nis/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 260
# NIS Data Collector
The NIS Data Collector inventories a NIS domain for user and group information, mapping to
-Windows-style SIDs. This data collector is a core component of Enterprise Auditor and has been
+Windows-style SIDs. This data collector is a core component of Enterprise Auditor and comes
preconfigured within the .NIS Inventory Solution. Both this data collector and the solution are
available with all Enterprise Auditor license options. See the
[.NIS Inventory Solution](/docs/accessanalyzer/11.6/solutions/nisinventory/overview.md)
@@ -41,5 +41,5 @@ following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open, then save the configuration settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nis/query.md b/docs/accessanalyzer/11.6/admin/datacollector/nis/query.md
index 87928a3937..22a23f2e1e 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nis/query.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nis/query.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# NIS: NIS Query
-The NIS Query page is where the NIS query regular expressions are configured and tested. It is a
+Use the NIS Query page to configure and test NIS query regular expressions. It is a
wizard page for the category of:
- Custom NIS Scan
@@ -18,7 +18,7 @@ The Data Source configuration options are:
- NIS Map – Specify the name of the NIS map to query
- Load Data – Fetches the first 50 rows of data of the specified NIS map from the test host
- Paste Data – Uses text from the clipboard as the test data source
-- Open File – Allows using a text file as test data. The test data is shown in the preview box.
+- Open File – Allows using a text file as test data. The preview box shows the test data.
The Query Expressions configuration options are:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nis/results.md b/docs/accessanalyzer/11.6/admin/datacollector/nis/results.md
index f25b5cd003..05440d0913 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nis/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nis/results.md
@@ -6,15 +6,15 @@ sidebar_position: 70
# NIS: Results
-The Results page is where properties from Unix to be gathered are selected. It is a wizard page for
+Use the Results page to select properties from Unix to gather. It is a wizard page for
both categories.
-Available properties have checkboxes that can be selected individually, or you can use the **Select
-All**, **Clear All**, and **Reset to defaults** buttons. All selected properties are gathered.
-Available properties vary based on the category selected.
+Select available properties individually using their checkboxes, or use the **Select
+All**, **Clear All**, and **Reset to defaults** buttons. The data collector gathers all selected
+properties. Available properties vary based on the category selected.
-This information is not available within the standard reference tables and views. Instead, this
-information can be viewed in the `SA_[Job Name]_DEFAULT` table, which is created when any of these
-properties are selected.
+This information isn't available within the standard reference tables and views. Instead, you can
+view this information in the `SA_[Job Name]_DEFAULT` table, which the data collector creates when
+you select any of these properties.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nis/settings.md b/docs/accessanalyzer/11.6/admin/datacollector/nis/settings.md
index 9700073687..e47b43cc8a 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nis/settings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nis/settings.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# NIS: NIS Settings
-The NIS Settings page is where the NIS domain and a NIS server are configured for testing. It is a
+Use the NIS Settings page to configure the NIS domain and a NIS server for testing. It is a
wizard page for both categories.
@@ -15,7 +15,7 @@ Configure the NIS domain and sample NIS server:
- NIS Domain Name – Enter the case-sensitive name of the NIS domain to scan. This is the value
returned by `/bin/domainname` on UNIX systems.
-- (Optional) Sample NIS Server – Enter the host name or IP address of a NIS server for the above
+- (Optional) Sample NIS Server – Enter the host name or IP address of a NIS server for this
domain to use for testing. This system should be running the `ypserv` process and be accessible
from the Enterprise Auditor Console. Then, click **Test**.
- Test – The data collector attempts to connect to the specified server and access information from
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nis/sidmappings.md b/docs/accessanalyzer/11.6/admin/datacollector/nis/sidmappings.md
index 544dfe423f..6b3fc95d38 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nis/sidmappings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nis/sidmappings.md
@@ -6,13 +6,14 @@ sidebar_position: 50
# NIS: SID Mappings
-The SID Mappings page is where the Windows-style SID mappings for the Unix User ID and Group ID are
-specified. It is a wizard page for the category of:
+Use the SID Mappings page to specify the Windows-style SID mappings for the Unix User ID and Group
+ID. It is a wizard page for the category of:
- Scan NIS User and Groups
The default settings work for most environments. Use this page to **Add**, **Edit**, or **Remove**
-ID Mappings. Multiple entries are allowed. For each range of User ID or Group ID entered, the offset
-is added to the ID and the resulting SID is the format with `%d` replaced by the ID.
+ID Mappings. You can add multiple entries. For each range of User ID or Group ID you enter, the
+wizard adds the offset to the ID, and the resulting SID uses the format with `%d` replaced by the
+ID.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nis/standardtables.md b/docs/accessanalyzer/11.6/admin/datacollector/nis/standardtables.md
index 33032c1e2b..b24eeea0df 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nis/standardtables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nis/standardtables.md
@@ -10,7 +10,7 @@ The NIS Data Collector gathers essential user and group inventory information in
reference tables. Unlike other Enterprise Auditor data collectors, the NIS Data Collector writes
data to these tables regardless of the job executing the query.
-These tables and their associated views are outlined below:
+The following table outlines these tables and their associated views:
| Table | Details |
| ------------------- | -------------------------------------------------------------------------------------- |
@@ -18,10 +18,9 @@ These tables and their associated views are outlined below:
| SA_NIS_Groups | Contains extended information about groups, mail enabled, security enabled, and so on. |
| SA_NIS_Users | Contains extended information about users, department, title, and so on |
-Views are the recommended way for Enterprise Auditor users to obtain the information gathered by the
-NIS Data Collector. They contain additional information for building queries easily. The following
-is an explanation of the corresponding view created for some of the tables generated by the NIS Data
-Collector:
+Views are the recommended way for Enterprise Auditor users to obtain the information the NIS Data
+Collector gathers. They contain additional information useful for building queries. The following
+explains the corresponding view for some of the tables the NIS Data Collector generates:
| Views | Details |
| ----------------------- | ------------------------------------- |
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nis/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/nis/summary.md
index f68bcaf7a9..89ef6cef84 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nis/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nis/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 80
# NIS: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for both
+Use the Summary page to review a summary of the configuration settings. It is a wizard page for both
categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the NIS Data Collector Wizard to ensure that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel**
+instead to close the NIS Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nosql/category.md b/docs/accessanalyzer/11.6/admin/datacollector/nosql/category.md
index 73640bd34c..2e1f650903 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nosql/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nosql/category.md
@@ -17,8 +17,8 @@ The query categories are:
- Sensitive Data Collection – Scan databases for sensitive data
- - The Sensitive Data category options require the Sensitive Data Discovery Add-on to be
- installed on the Enterprise Auditor Console before the NoSQL Data Collector can collect
+ - The Sensitive Data category options require you to install the Sensitive Data Discovery
+ Add-on on the Enterprise Auditor Console before the NoSQL Data Collector can collect
sensitive data. See the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
topic for additional information.
@@ -37,5 +37,5 @@ The query categories are:
- NoSQL Utilities
- - Remove NoSQL Storage Tables — All connection related and filter data will be removed for
+ - Remove NoSQL Storage Tables — Removes all connection-related and filter data for
NoSQL databases
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nosql/configurejob.md b/docs/accessanalyzer/11.6/admin/datacollector/nosql/configurejob.md
index 4ac697d676..20d21900ea 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nosql/configurejob.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nosql/configurejob.md
@@ -19,9 +19,9 @@ window.
For an Active Directory account, set the following on the User Credentials window:
- Select Account Type – Active Directory Account
-- Domain – Drop-down menu with available trusted domains will appear. Either type the short domain
+- Domain – dropdown menu with available trusted domains will appear. Either enter the short domain
name in the textbox or select a domain from the menu.
-- User name – Type the user name
+- User name – Enter the user name
- Password Storage – Choose the option for credential password storage:
- Application – Uses the configured Profile Security setting as selected at the **Settings** >
@@ -30,11 +30,11 @@ For an Active Directory account, set the following on the User Credentials windo
topic for additional information.
- CyberArk – Uses the CyberArk Enterprise Password Vault. See the
[CyberArk Integration](/docs/accessanalyzer/11.6/admin/settings/connection/cyberarkintegration.md)
- topic for additional information. The password fields do not apply for CyberArk password
+ topic for additional information. The password fields don't apply for CyberArk password
storage.
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
**SQL**
@@ -46,8 +46,8 @@ For a SQL account, set the following on the User Credentials window:
**Settings** > **Application** node. See the
[Application](/docs/accessanalyzer/11.6/admin/settings/application/overview.md)
topic for additional information.)
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
@@ -58,13 +58,13 @@ topics for additional information.
## Host List
Jobs using the NoSQL Data Collector must create a host list with the servers containing the target
-databases. Setup the list of MongoDB hosts that needs to be monitored. Be sure to use a specific
+databases. Set up the list of MongoDB hosts to monitor. Be sure to use a specific
host name (if forcing the connection to a secondary host) or just the cluster name if connecting to
the cluster. See the
[Host Management](/docs/accessanalyzer/11.6/admin/hostmanagement/overview.md)
topic for additional information.
-Additionally, the database clusters / instances must be added to the Filter page in the query
+Additionally, add the database clusters/instances to the Filter page in the query
configuration. See the
[NoSQL: Filter](/docs/accessanalyzer/11.6/admin/datacollector/nosql/filter.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nosql/criteria.md b/docs/accessanalyzer/11.6/admin/datacollector/nosql/criteria.md
index 86d3ef3ecc..c2f09d2210 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nosql/criteria.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nosql/criteria.md
@@ -6,10 +6,10 @@ sidebar_position: 40
# NoSQL: Criteria
-The Criteria page is where the criteria to be used for discovering sensitive data is configured. It
+Use the Criteria page to configure the criteria for discovering sensitive data. It
is a wizard page for the category of Sensitive Data Collection.
-This page requires the Sensitive Data Discovery Add-On to be installed on the Enterprise Auditor
+This page requires you to install the Sensitive Data Discovery Add-On on the Enterprise Auditor
Console to define the criteria and enable the Criteria Editor. See the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
topic for additional information.
@@ -27,13 +27,13 @@ The options on the Criteria page are:
- Select All – Click **Select All** to enable all sensitive data criteria for scanning
- Clear All – Click **Clear All** to remove all selections from the table
- - Select the checkboxes next to the sensitive data criteria options to enable it to be scanned
- for during job execution
+ - Select the checkboxes next to the sensitive data criteria options to include them in the scan
+ during job execution
The table contains the following types of criteria:
:::note
-Until the Sensitive Data Discovery Add-On is installed, only the headers for the System
+Until you install the Sensitive Data Discovery Add-On, only the headers for the System
Criteria and User Criteria nodes are visible in the table.
:::
@@ -48,7 +48,7 @@ Criteria and User Criteria nodes are visible in the table.
:::note
Adding unnecessary criteria can adversely impact the scanner performance and can cause the
-scanning job to take a long time. If performance is adversely affected, revisit the sensitive data
-scanning criteria and remove criteria that is not required.
+scanning job to take a long time. If performance suffers, revisit the sensitive data
+scanning criteria and remove criteria that isn't required.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nosql/filter.md b/docs/accessanalyzer/11.6/admin/datacollector/nosql/filter.md
index 2daebc20ee..68cdc0626f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nosql/filter.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nosql/filter.md
@@ -6,10 +6,10 @@ sidebar_position: 50
# NoSQL: Filter
-The Filter page is where the query can be scoped to target specific databases or instances. It is a
+Use the Filter page to scope the query to target specific databases or instances. It is a
wizard page for the Sensitive Data Collection category.
-It is necessary to populate the available Mongo databases/instances before the query can be scoped.
+Populate the available Mongo databases/instances before scoping the query.
See the [Manage Connections Window](#manage-connections-window) topic for additional information.
@@ -33,24 +33,24 @@ The configurable filter options are:
- Exclude — Excludes selected databases/instances and displays them in red
- Include — Reverts an exclusion. By default, all sub tables are included.
- - Build Pattern — Opens the Build Pattern dialogue to build a custom filter to be applied to the
+ - Build Pattern — Opens the Build Pattern dialogue to build a custom filter to apply to the
selected database objects. See the [Build or Edit Pattern](#build-or-edit-pattern) topic for
additional information.
-- Selections — Displays selected database objects for which the query has been scoped. Right click
+- Selections — Displays selected database objects the query is scoped to. Right click
to open context menu:
- - Remove Pattern — Selected database/instance will be removed from the query
+ - Remove Pattern — Removes the selected database/instance from the query
- Edit Pattern — Opens the Edit Pattern dialogue with the following options (See the
[Build or Edit Pattern](#build-or-edit-pattern) topic for additional information):
- Exclude — Excludes selected databases/instances and displays them in red
- Include — Reverts an exclusion. By default, all sub tables are included.
- - Pattern — Build a custom filter to be applied to the selected database objects
+ - Pattern — Build a custom filter to apply to the selected database objects
## Manage Connections Window
-The Manage Connections window enables users to add MongoDB database instances to search for
+Use the Manage Connections window to add MongoDB database instances to search for
sensitive data. Click **Connections** to open the window.
@@ -64,8 +64,8 @@ additional information on how to connect to a MongoDB database, see the MongoDB
- Is Active — Select the checkbox to include the database on the Servers Pane on the Filter page
- Server Label — The name of the server
- Host — Name or IP address of the host where the database is located
-- Port Number — Port number for the database. The default port is 27017. If a non-default port is
- being used, it should be specified in the Port Number section.
+- Port Number — Port number for the database. The default port is 27017. If you use a non-default
+ port, specify it in the Port Number section.
- Auth Database — The database used for authorization. Typically it is the **admin** database.
- Read Preference — Read preference describes how MongoDB clients route read operations to the
members of a replica set by default, an application directs its read operations to the primary
@@ -80,7 +80,7 @@ In the Manage Connections table, the following information is also listed:
information has been validated. **N** indicates the information has not been validated.
- Last Inspected — Indicates the date and time of when the connection information was last
inspected. If blank, the connection information has not yet been validated.
-- Enable Impersonation – Impersonation does not apply to MongoDB and this column will be blank.
+- Enable Impersonation – Impersonation doesn't apply to MongoDB and this column will be blank.
The Manage Connections window has the following buttons:
@@ -92,7 +92,7 @@ The Manage Connections window has the following buttons:
#### Build or Edit Pattern
-The Build / Edit Pattern window enables users to apply a custom scoping filter to the query.
+Use the Build / Edit Pattern window to apply a custom scoping filter to the query.
@@ -104,7 +104,7 @@ The Build / Edit Pattern window has the following features:
- Pattern — Build a custom filter to be applied to the selected database objects
:::note
- Color-coding indicating Excluded and Included objects does not display until after a
- selection is validated using the **Validate Selections** button on the Filter page.
+ Color-coding indicating Excluded and Included objects doesn't display until after you validate
+ a selection using the **Validate Selections** button on the Filter page.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nosql/options.md b/docs/accessanalyzer/11.6/admin/datacollector/nosql/options.md
index 9d959bfb70..e0c0f0671f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nosql/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nosql/options.md
@@ -21,13 +21,13 @@ The sensitive data scan settings are:
database or cluster
- Limit of documents to scan — Scan limited number of documents in each database or cluster.
This option is ideal when discovering sensitive data and has minimal impact on the MongoDB
- cluster performance. However, if the Subject Profile Request feature is being leveraged, then
- all the documents in all the database or cluster need to be scanned.
+ cluster performance. However, if you use the Subject Profile Request feature, you need to
+ scan all the documents in all the databases or clusters.
- Scan documents randomly — Enterprise Auditor requests a set of documents from each database
- when scanning for sensitive data. The database engine does not return random data from a
- collection. Instead, Enterprise Auditor returns sequential documents in a collection. In order
- to ensure a statistical discrete uniform distribution of data being scanned, this option can
- be selected. When selected, the Enterprise Auditor sensitive data scanner requests randomized
+ when scanning for sensitive data. The database engine doesn't return random data from a
+ collection. Instead, Enterprise Auditor returns sequential documents in a collection. To
+ ensure a statistical discrete uniform distribution of scanned data, select this option.
+ When you select this option, the Enterprise Auditor sensitive data scanner requests randomized
documents from each collection in all the targeted databases.
- Scan database names for sensitive data – Scans database names for sensitive data if the database
@@ -39,11 +39,11 @@ The sensitive data scan settings are:
**DLP Options**
- Store discovered sensitive data – Stores potentially sensitive data in the Enterprise Auditor
- database. Any sampled sensitive data discovered based on the matched criteria is stored in the
- Enterprise Auditor database. This functionality can be disabled by clearing this checkbox.
+ database. The scan stores any sampled sensitive data discovered based on the matched criteria in
+ the Enterprise Auditor database. Clear this checkbox to disable this functionality.
:::note
- The **Store discovered sensitive data** option is required to view Content Audit
+ You must select the **Store discovered sensitive data** option to view Content Audit
reports in the Access Information Center for MongoDB data.
:::
@@ -58,6 +58,6 @@ The sensitive data scan settings are:
scan was stopped as a result of an error
:::tip
-Remember, the Sensitive Data Discovery Add-on is required to use the sensitive data collection
+Remember, you need the Sensitive Data Discovery Add-on to use the sensitive data collection
option.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nosql/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/nosql/overview.md
index 39c9098e38..cc06496747 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nosql/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nosql/overview.md
@@ -10,7 +10,7 @@ The NoSQL Data Collector for MongoDB provides information on MongoDB Cluster con
user permissions, scans collections for sensitive data, and identifies who has access to sensitive
data. It also supports the execution of custom queries against all targeted MongoDB cluster nodes.
-The NoSQL Data Collector has been preconfigured within the MongoDB Solution. Both this data
+The NoSQL Data Collector comes preconfigured within the MongoDB Solution. Both this data
collector and the solution are available with a special Enterprise Auditor license. See the
[MongoDB Solution](/docs/accessanalyzer/11.6/solutions/databases/mongodb/overview.md)
topic for additional information.
@@ -41,11 +41,11 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
-then an extra 16 GB of RAM are required (8x2=16).
+You must install the Sensitive Data Discovery Add-On on the Enterprise Auditor Console server to
+enable Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans, increase
+the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For
+example, if you configure the job to scan 8 hosts at a time, you need an extra 16 GB of RAM
+(8 x 2 = 16).
## NoSQL Query Configuration
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nosql/results.md b/docs/accessanalyzer/11.6/admin/datacollector/nosql/results.md
index 459d023f2a..b606ce4c52 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nosql/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nosql/results.md
@@ -6,11 +6,11 @@ sidebar_position: 60
# NoSQL: Results
-The Results page is where the properties that will be gathered are selected. It is a wizard page for
+Use the Results page to select the properties to gather. It is a wizard page for
all of the categories.
-Properties can be selected individually, or the **Select All**, **Clear All**, and **Reset to
-Defaults** buttons can be used. All selected properties are gathered. Available properties vary
+Select properties individually, or use the **Select All**, **Clear All**, and **Reset to
+Defaults** buttons. The data collector gathers all selected properties. Available properties vary
based on the category selected.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/nosql/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/nosql/summary.md
index a3f9259991..9be82750a2 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/nosql/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/nosql/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 70
# NoSQL: Summary
-The Summary page is where the configuration settings are summarized. It is a wizard page for all of
-the categories.
+Use the Summary page to review a summary of the configuration settings. It is a wizard page for all
+of the categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the NoSQL Data Collector Wizard ensuring that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel**
+instead to close the NoSQL Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/overview.md
index 250e27f19c..d0986e7eaa 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/overview.md
@@ -13,7 +13,7 @@ for additional information on job configuration.
## Query Selection
The Enterprise Auditor data collectors can collect information from a wide range of environments.
-Data collection tasks are assigned to jobs at the **Configure** > **Queries** node level. See the
+You assign data collection tasks to jobs at the **Configure** > **Queries** node level. See the
[Queries Node](/docs/accessanalyzer/11.6/admin/jobs/job/configure/queries.md)
topic for additional information.
@@ -27,7 +27,7 @@ following options:
- Rename Table – Rename the current table selected
- Delete Table – Delete the current table selected
-The Queries section is where the Data Collectors are configured. The Queries section has the
+Use the Queries section to configure the Data Collectors. The Queries section has the
following options:
- Add from Library – Opens the Libraries window. Add a pre-built query from the Enterprise Auditor
@@ -35,25 +35,25 @@ following options:
information.
- Create Query – Click **Create Query** to add a new query task to a job. See the
[Create or Modify a Query](#create-or-modify-a-query) topic for additional information.
-- Delete Query – Delete the currently selected query
+- Delete Query – Delete the selected query
- Query Properties – Select an existing query and click **Query Properties** to modify its
configuration
### Add Query from Library
-Pre-built queries can be added to the Data Collector job through the Libraries window.
+You can add pre-built queries to the Data Collector job through the Libraries window.
The Libraries window toolbar has the following options:
-- Create New Library – Create a new library entry. The new Library will be added to the Library
+- Create New Library – Create a new library entry. The new Library appears in the Library
dropdown menu.
-- Delete Library – Deletes the currently selected library
+- Delete Library – Deletes the selected library
- Cut – Cut the selected task in the library to the clipboard
- Copy – Copy the selected task in the library to the clipboard
-- Paste – Paste cut or copied item from the clipboard into the currently selected library
-- Delete Selected Task – Deletes the currently selected task
+- Paste – Paste cut or copied item from the clipboard into the selected library
+- Delete Selected Task – Deletes the selected task
Click **Add** to confirm the query selection and add it to the Queries list on the Query Selection
page. If no selection is needed or intended, click **Cancel** to close the Libraries window without
@@ -62,8 +62,8 @@ adding a pre-built query into the Queries list.
### Create or Modify a Query
To open the Query Properties window, click **Create Query** for a new query or **Query Properties**
-for an existing query. There are three tabs in the Query Properties window where queries can be
-configured. These tabs are:.
+for an existing query. The Query Properties window has three tabs where you can configure queries.
+These tabs are:
- [General Tab](#general-tab)
- [Data Source Tab](#data-source-tab)
@@ -88,10 +88,10 @@ The General tab displays:
- Within the SQL database, the table name will be prefaced with `SA_[Job Name]_`
- ID – Query GUID generated by Enterprise Auditor for this query task.
- - The query GUID is referenced by the **SMARTLog** Data Collector, **ExchangeMetrics** Data
- Collector, and the **PowerShell** Data Collector.
- - When using the **SMARTLog** Data Collector or the **ExchangeMetrics** Data Collector, the
- `state` file for the query’s Persist log state feature can be found in the SA_CommonData
+ - The **SMARTLog** Data Collector, **ExchangeMetrics** Data Collector, and **PowerShell** Data
+ Collector all reference the query GUID.
+ - When using the **SMARTLog** Data Collector or the **ExchangeMetrics** Data Collector, you can
+ find the `state` file for the query’s Persist log state feature in the SA_CommonData
folder in the Enterprise Auditor installation directory:
…/STEALTHbits/StealthAUDIT/Jobs/SA_CommonData/[Data Collector]/[Query GUID]/[Target
@@ -112,15 +112,15 @@ Use the Data Source tab to configure the data collector and query.
The Data Source tab displays:
-- Data Collector – Data collector selected from the drop-down menu.
+- Data Collector – Data collector selected from the dropdown menu.
- Query – Query configuration string.
- Configure – Opens the wizard for the selected data collector. Each Data Collector task has its own
Configuration Wizard.
- Properties – Configured query properties.
-When creating a new query, expand the **Data Collector** drop-down menu, which provides a list of
-all licensed data collectors in alphabetical order. The **Query** and **Property** sections are
-auto-filled according to the configuration. The buttons at the bottom of the Property section are
+When creating a new query, expand the **Data Collector** dropdown menu, which provides a list of
+all licensed data collectors in alphabetical order. The wizard auto-fills the **Query** and
+**Property** sections according to the configuration. The buttons at the bottom of the Property section are
for advanced features to manipulate the query. The **+** and **–** buttons manually add or remove
individual properties from the query. The script button opens the VBScript Editor window for query
manipulation scripts.
@@ -147,15 +147,15 @@ The Filter tab has the following items:
- Use the **+** and **–** buttons to add and remove filters from the query
- Key – Labels identifying the configurable value in the filter
- Value – When applicable, add a new value to the filter using the dropdown menu. Otherwise, create
- a new one by typing in the desired value.
+ a new one by typing in the value you want.
:::info
-Use the default settings for filters. Filters can be used to substitute or delete
+Use the default settings for filters. Use filters to substitute or delete
data values during data collection. For more information on the impacts of adding filters to
queries, contact [Netwrix Support](https://www.netwrix.com/support.html).
:::
-Click **OK** to save changes and exist the Query Properties window. If no changes were made or
-intended, it is best practice to click **Cancel** to exit the Query Properties window to ensure
-unintended changes are not saved.
+Click **OK** to save changes and exist the Query Properties window. If you didn't make or intend any
+changes, click **Cancel** instead to exit the Query Properties window without saving unintended
+changes.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/dictionaries.md b/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/dictionaries.md
index da136413ab..e1f4551dc1 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/dictionaries.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/dictionaries.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# PasswordSecurity: Dictionaries
-The Dictionaries page provides configuration settings for storing passwords to be used as a
+The Dictionaries page provides configuration settings for storing passwords to use as a
reference for the scan.
@@ -14,20 +14,20 @@ reference for the scan.
The configurable dictionary options are:
- Use Stealthbits dictionary (> 100,000 passwords) – If enabled, compares passwords against
- out-of-the-box dictionary comprised of commonly used password hashes
+ built-in dictionary comprised of commonly used password hashes
- Automatically update the Stealthbits dictionary – Checks for the latest version of the Stealthbits
dictionary file when the job is executed, and downloads the latest version from the
[Netwrix website](https://www.netwrix.com/)
- - If the Enterprise Auditor server does not have an internet connection, the Stealthbits
- dictionary can be downloaded directly from the
+ - If the Enterprise Auditor server doesn't have an internet connection, you can download the
+ Stealthbits dictionary directly from the
[My Products](https://www.netwrix.com/my_products.html) page of the Netwrix website.
- Update Dictionary – Checks for the latest version of the dictionary file, and updates if necessary
- Add – Add a custom dictionary file in one of the following formats:
- Plaintext – Line separated in a text file
- - NLTM Hashes – Can be added with hashes or sorted hashes. The haveibeenpwned dictionary can be
+ - NLTM Hashes – You can add these as hashes or sorted hashes. The haveibeenpwned dictionary can be
used. See the
[Download and Configure the Have I Been Pwnd (HIBP) Hash List](#download-and-configure-the-have-i-been-pwnd-hibp-hash-list)
topic for additional information.
@@ -41,8 +41,8 @@ The configurable dictionary options are:
## Download the Stealthbits dictionary
-**Step 1 –** If the Enterprise Auditor server does not have an internet connection, the Stealthbits
-dictionary can be downloaded directly from the
+**Step 1 –** If the Enterprise Auditor server doesn't have an internet connection, you can download
+the Stealthbits dictionary directly from the
[My Products](https://www.netwrix.com/my_products.html) page of the Netwrix website.
**Step 2 –** After downloading the dictionary file manually do one the following:
@@ -74,8 +74,8 @@ get the latest breached hashes from the Have I Been Pwnd (HIBP) database.
:::note
The
-[](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader)[Pwnd Passwords Downloader](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader)
-is a third party, open source tool, created by the HaveIBeenPwned team and distributed under a BSD
+[Pwnd Passwords Downloader](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader)
+is a third-party, open source tool that the HaveIBeenPwned team created and distributes under a BSD
3-Clause License. You might experience issues during the hash download process, depending on your
threading settings or the load on the CloudFlare backend. The Pwnd Passwords Downloader tool will
automatically retry to continue downloading the hashes until it fully completes the download
@@ -92,14 +92,14 @@ The Pwnd Passwords Downloader has the following prerequisite:
can download .NET 6 from Microsoft:
[https://dotnet.microsoft.com/en-us/download/dotnet/6.0](https://dotnet.microsoft.com/en-us/download/dotnet/6.0)
-The HIBP database takes up additional space on the machine where it is copied (approximately 13 GB,
-but subject to change). The Have I Been Pwnd database (HIBP) hashes can take up to 30 GB. Make sure
+The HIBP database takes up additional space on the machine where you copy it (approximately 13 GB,
+but subject to change). The Have I Been Pwnd database (HIBP) hashes can take up to 30 GB. ensure
that you have enough free space on your disk in your Netwrix Enterprise Auditor install directory
(`%sainstalldir%`).
### Install the Pwnd Passwords Downloader
-Follow the steps to install the Pwnd Passwords Downloader.
+To install the Pwnd Passwords Downloader:
**Step 3 –** Open command prompt, and navigate to your .NET install folder (for example,
`C:\Program Files (x86)\dotnet`).
@@ -116,7 +116,7 @@ dotnet tool install --global haveibeenpwned-downloader
### Update an Installed Pwnd Passwords Downloader
-Follow the steps to update an installed Pwnd Passwords Downloader.
+To update an installed Pwnd Passwords Downloader:
**Step 1 –** Open the command prompt.
@@ -130,7 +130,7 @@ dotnet tool update --global haveibeenpwned-downloader
### Download NTML Hashes with the Pwnd Passwords Downloader
-Follow the steps to download NTLM hashes.
+To download NTLM hashes:
**Step 1 –** Navigate to the folder where you want to download the hashes.
@@ -153,5 +153,5 @@ This screenshot shows the completed download.
haveibeenpwned-downloader.exe -n pwnedpasswords_ntlm -o
```
-For a complete list of available parameters, please check the
+For a complete list of available parameters, check the
[Pwnd Passwords Downloader GitHub page](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader).
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/overview.md
index 8d7df8fef7..06bfa6cbe2 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/overview.md
@@ -10,8 +10,8 @@ The PasswordSecurity Data Collector compares passwords stored in Active Director
passwords in the Netwrix dictionary or custom dictionaries. The PasswordSecurity Data Collector also
checks for common misconfigurations with passwords in Active Directory.
-The PasswordSecurity Data Collector is a core component of Enterprise Auditor, but it has been
-preconfigured within the Active Directory Solution. While the data collector is available with all
+The PasswordSecurity Data Collector is a core component of Enterprise Auditor, and the Active
+Directory Solution includes it as a preconfigured component. While the data collector is available with all
Enterprise Auditor license options, the Active Directory Solution is only available with a special
Enterprise Auditor license. See the
[Active Directory Solution](/docs/accessanalyzer/11.6/solutions/activedirectory/overview.md)
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/results.md b/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/results.md
index 4de0c8602b..7daf1f4c9c 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/results.md
@@ -6,9 +6,9 @@ sidebar_position: 40
# PasswordSecurity: Results
-The Results page is where Active Directory properties to be gathered are selected.
+Use the Results page to select the Active Directory properties to gather.
-Properties can be selected individually or by using the **Select All** or **Clear All** buttons. All
-selected properties are gathered.
+Select properties individually, or use the **Select All** or **Clear All** buttons. Enterprise
+Auditor gathers all selected properties.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/summary.md
index 6543cc95ba..1347c374aa 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/passwordsecurity/summary.md
@@ -10,6 +10,6 @@ The Summary page displays a summary of the configured query.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Active Directory Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Active Directory Data Collector Wizard instead. This prevents the wizard from saving accidental
+clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/permissionmatrix.md b/docs/accessanalyzer/11.6/admin/datacollector/permissionmatrix.md
index a0d710127e..8c3cff0469 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/permissionmatrix.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/permissionmatrix.md
@@ -6,12 +6,11 @@ sidebar_position: 10
# Permissions by Data Collector (Matrix)
-The Enterprise Auditor data collectors are capable of collecting information from a variety of
-sources. Each data collector requires specific protocols, ports, and permissions for the collection
-of data to occur.
+The Enterprise Auditor data collectors collect information from a variety of sources. Each data
+collector requires specific protocols, ports, and permissions to collect data.
-Many data collectors are included as core components. However, some data collectors require specific
-license features. The following table provides a quick reference for each data collector.
+Netwrix includes many data collectors as core components. However, some data collectors require
+specific license features. The following table provides a quick reference for each data collector.
| Data Collector | Description | Protocols | Ports Used | Recommended Permissions |
| -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -22,7 +21,7 @@ license features. The following table provides a quick reference for each data c
| AWS | The AWS Data Collector collects IAM users, groups, roles, and policies, as well as S3 permissions, content, and sensitive data from the target Amazon Web Services (AWS) accounts. | | | To collect details about the AWS Organization, the following permission is required:- organizations:DescribeOrganization
To collect details regarding IAM, the following permissions are required:- iam:GenerateCredentialReport
- iam:GenerateServiceLastAccessedDetails
- iam:Get\*
- iam:List\*
- iam:Simulate\*
- sts:GetAccessKeyInfo
To collect details related to S3 buckets and objects, the following permissions are required:- s3:Describe\*
- s3:Get\*
- s3:HeadBucket
- s3:List\*
|
| AzureADInventory | The AzureADInventory Data Collector catalogs user and group object information from Microsoft Entra ID, formerly Azure Active Directory. This data collector is a core component of Enterprise Auditor and is preconfigured in the .Entra ID Inventory Solution. | | |**Microsoft Graph API**
Application Permissions:- AuditLog.Read.All – Read all audit log data
- Directory.Read.All – Read directory data
Delegated Permissions:- Group.Read.All – Read all groups
- User.Read.All – Read all users' full profiles
**Access URLs**- https://login.windows.net
- https://graph.windows.net
- https://login.microsoftonline.com
- https://graph.microsoft.com
- All sub-directories of the access URLs listed
|
| Box _\*requires license_ | The Box Data Collector audits access, group membership, and content within a Box enterprise. | | | - Box Enterprise Administrator
|
-| CommandLineUtility | The CommandLineUtility Data Collector provides the ability to remotely spawn, execute, and extract data provided by a Microsoft native or third-party command line utility. | | - TCP 135-139
- Randomly allocated high TCP ports
| - Member of the local Administrators group
|
+| CommandLineUtility | The CommandLineUtility Data Collector lets you remotely spawn, execute, and extract data provided by a Microsoft native or third-party command line utility. | | - TCP 135-139
- Randomly allocated high TCP ports
| - Member of the local Administrators group
|
| DiskInfo | The DiskInfo Data Collector provides enumeration of disks and their associated properties. | | - TCP 135
- Randomly allocated high TCP ports
| - Member of the local Administrators group
|
| DNS _\*requires license_ | The DNS Data Collector provides information regarding DNS configuration and records. | | - TCP 135
- Randomly allocated high TCP ports
| - Member of the Domain Administrators group
|
| DropboxAccess _\*requires license_ | The DropboxAccess Data Collector audits access, group membership, and content within a Dropbox environment. | | | - Dropbox Team Administrator
|
@@ -31,12 +30,12 @@ license features. The following table provides a quick reference for each data c
| EWSPublicFolder _\*requires license_ | The EWSPublicFolder Data Collector provides configuration options to extract public folder contents, permissions, and sensitive data, and is preconfigured within the Exchange Solution. | | | For Exchange servers: - Exchange Admin Role
- Discovery Management Role
- Application Impersonation Role
- Exchange Online License with a mailbox
For Exchange Online:- Exchange Admin Role
- Discovery Management Role
- Exchange Online License with a mailbox
|
| Exchange2K _\*requires license_ | The Exchange2K Data Collector extracts configuration details from Exchange organizations for versions 2003 and later. | | - TCP 135-139
- Randomly allocated high TCP ports
- TCP 389
- Optional TCP 445
| - Member of the Exchange Administrator group
- Domain Admin for AD property collection
- Public Folder Management
|
| ExchangeMailbox _\*requires license_ | The ExchangeMailbox Data Collector extracts configuration details from the Exchange Store to provide statistical, content, permission, and sensitive data reporting on mailboxes. | | - TCP 135
- Randomly allocated high TCP ports
| - Member of the Exchange Administrator group
- Organization Management
- Discovery Management
|
-| ExchangeMetrics _\*requires license_ | The ExchangeMetrics Data Collector collects Mail-Flow metrics from the Exchange Message Tracking Logs on the Exchange servers. Some examples of this include server volume and message size statistics. | | - TCP 135
- Randomly allocated high TCP ports
| - Member of the local Administrator group on the targeted Exchange server(s)
|
-| ExchangePS _\*requires license_ | The ExchangePS Data Collector utilizes the Exchange CMDlets to return information about the Exchange environment utilizing PowerShell. This data collector has been designed to work with Exchange 2010 and newer. | | - TCP 135
- Randomly allocated high TCP ports
| For Exchange servers: - Remote PowerShell enabled on a single Exchange server
- Windows Authentication enabled for the PowerShell Virtual Directory on the same Exchange server where Remote PowerShell has been enabled
- View-Only Organization Management Role Group
- Discovery Search Management Role Group
- Public Folder Management Role Group
- Mailbox Search Role
For Exchange Online:- Discovery Management Role
- Organization Management Role
|
+| ExchangeMetrics _\*requires license_ | The ExchangeMetrics Data Collector collects Mail-Flow metrics from the Exchange Message Tracking Logs on the Exchange servers. Some examples of this include server volume and message size statistics. | | - TCP 135
- Randomly allocated high TCP ports
| - Member of the local Administrator group on the targeted Exchange servers
|
+| ExchangePS _\*requires license_ | The ExchangePS Data Collector uses the Exchange CMDlets to return information about the Exchange environment using PowerShell. This data collector has been designed to work with Exchange 2010 and newer. | | - TCP 135
- Randomly allocated high TCP ports
| For Exchange servers: - Remote PowerShell enabled on a single Exchange server
- Windows Authentication enabled for the PowerShell Virtual Directory on the same Exchange server where Remote PowerShell has been enabled
- View-Only Organization Management Role Group
- Discovery Search Management Role Group
- Public Folder Management Role Group
- Mailbox Search Role
For Exchange Online:- Discovery Management Role
- Organization Management Role
|
| ExchangePublicFolder _\*requires license_ | The ExchangePublicFolder Data Collector audits an Exchange Public Folder, including contents, permissions, ownership, and replicas. | | - TCP 135
- Randomly allocated high TCP ports
| - Member of the Exchange Administrator group
- Organization Management
|
| File | The File Data Collector provides file and folder enumeration, properties, and permissions. | | - TCP 135-139
- Randomly allocated high TCP ports
- Optional TCP 445
| - Member of the Local Administrators group
|
| FileSystemAccess (FSAA) _\*requires license_ | The FileSystemAccess (FSAA) Data Collector collects permissions, content, and activity, and sensitive data information for Windows and NAS file systems. | | - Ports vary based on the Scan Mode Option selected. See the [File System Scan Options](/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/scanoptions.md) topic for additional information.
| - Permissions vary based on the Scan Mode Option selected. See the [File System Supported Platforms](/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/filesystems.md) topic for additional information.
|
-| GroupPolicy | The GroupPolicy Data Collector provides the ability to retrieve the GPO’s list in the domain and where they are linked, return information on configured policies and policy parts from the individual policies that have been selected, return information on selected policy parts from all policies within the domain, and return effective security policies in effect at the individual workstation. | | - TCP 389
- TCP 135-139
- Randomly allocated high TCP ports
| - Member of the Domain Administrators group (if targeting domain controllers)
- Member of the Local Administrators group
|
+| GroupPolicy | The GroupPolicy Data Collector lets you retrieve the GPO’s list in the domain and where they are linked, return information on configured policies and policy parts from the individual policies that have been selected, return information on selected policy parts from all policies within the domain, and return effective security policies in effect at the individual workstation. | | - TCP 389
- TCP 135-139
- Randomly allocated high TCP ports
| - Member of the Domain Administrators group (if targeting domain controllers)
- Member of the Local Administrators group
|
| INIFile | The INIFile Data Collector provides options to configure a task to collect information about log entries on target hosts. | | - TCP 135-139
- Randomly allocated high TCP ports
- Optional TCP 445
| - Member of the Local Administrators group
|
| LDAP | The LDAP Data Collector uses LDAP to query Active Directory returning the specified objects and attributes. | | | - Member of the Domain Administrators group
|
| NIS | The NIS Data Collector inventories a NIS domain for user and group information, mapping to Windows-style SIDs. | | - TCP 111 or UDP 111
- Randomly allocated high TCP ports
| - No special permissions are needed aside from access to a NIS server
|
@@ -51,7 +50,7 @@ license features. The following table provides a quick reference for each data c
| Services | The Services Data Collector enumerates status and settings from remote services. | | - TCP 135-139
- Randomly allocated high TCP ports
| - Member of the Local Administrators group
|
| SharePointAccess (SPAA) _\*requires license_ | The SharePointAccess (SPAA) Data Collector audits access, group membership, and content within a SharePoint on-premises and SharePoint Online environment. The SPAA Data Collector has been preconfigured within the SharePoint Solution. | - MS SQL
- Remote Registry
- SP CSOM (Web Services via HTTP & HTTPS)
- SP Server API
- WCF AUTH via TCP (configurable)
| - Ports vary based on the Scan Mode selected and target environment. See the [SharePoint Scan Options](/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/scanoptions.md) topic for additional information.
| - Permissions vary based on the Scan Mode selected and target environment. See the [SharePoint Support](/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint.md) topic for additional information.
|
| SMARTLog | The SMARTLog Data Collector provides search and extraction of details from Windows Event Logs (online or offline) and Microsoft Exchange Internet Information Server (IIS) logs. | | - TCP 135
- TCP 445
- Randomly allocated high TCP ports
| - Member of the Domain Administrators group (if targeting domain controllers)
- Member of the local Administrators group
|
-| SQL _\*requires license_ | The SQL Data Collector provides information on database configuration, permissions, data extraction, application name of the application responsible for activity events, an IP Address or Host name of the client server, and sensitive data reports. This data collector also provides information on Oracle databases including infrastructure and operations. | TCP | For Db2 Target: - Specified by Instances table (default is 5000)
For MySQL Target:- Specified by Instances table (default is 3306)
For Oracle Target:- Specified by Instances table (default is 1521)
For PostgreSQL Target:- Specified by Instances table (default is 5432)
For SQL Target:- Specified by Instances table (default is 1433)
| **For MySQL Target:** - Read access to MySQL instance to include all databases contained within each instance
- Windows Only — Domain Admin or Local Admin privilege
**For Oracle Target:**- User with SYSDBA role
- Local Administrator on the target servers – Only applies to Windows Servers and not on Linux or Unix operating systems
**For PostgreSQL Target:**- Read access to all the databases in PostgreSQL cluster or instance
- Windows Only — Domain Admin or Local Admin privilege
**For Redshift Target:**- Read-access to the following tables:
- pg_tables
- pg_user
**For SQL Target:**
For Instance Discovery, local rights on the target SQL Servers:- Local group membership to Remote Management Users
- Permissions on the following WMI NameSpaces: `root\Microsoft\SQLServer, root\interop`
For permissions for data collection:- Read access to SQL instance
- Requires SQL Full-Text and Semantic Extractions for Search feature to be installed on the target SQL instance(s) when using the **Scan full rows for sensitive data** option on the Options wizard page
- Grant Authenticate Server to [DOMAIN\USER]
- Grant Connect SQL to [DOMAIN\USER]
- Grant View any database to [DOMAIN\USER]
- Grant View any definition to [DOMAIN\USER]
- Grant View server state to [DOMAIN\USER]
- Grant Control Server to [DOMAIN\USER] (specifically required for the Weak Passwords Job)
|
+| SQL _\*requires license_ | The SQL Data Collector provides information on database configuration, permissions, data extraction, application name of the application responsible for activity events, an IP Address or Host name of the client server, and sensitive data reports. This data collector also provides information on Oracle databases including infrastructure and operations. | TCP | For Db2 Target: - Specified by Instances table (default is 5000)
For MySQL Target:- Specified by Instances table (default is 3306)
For Oracle Target:- Specified by Instances table (default is 1521)
For PostgreSQL Target:- Specified by Instances table (default is 5432)
For SQL Target:- Specified by Instances table (default is 1433)
| **For MySQL Target:** - Read access to MySQL instance to include all databases contained within each instance
- Windows Only — Domain Admin or Local Admin privilege
**For Oracle Target:**- User with SYSDBA role
- Local Administrator on the target servers – Only applies to Windows Servers and not on Linux or Unix operating systems
**For PostgreSQL Target:**- Read access to all the databases in PostgreSQL cluster or instance
- Windows Only — Domain Admin or Local Admin privilege
**For Redshift Target:**- Read-access to the following tables:
- pg_tables
- pg_user
**For SQL Target:**
For Instance Discovery, local rights on the target SQL Servers:- Local group membership to Remote Management Users
- Permissions on the following WMI NameSpaces: `root\Microsoft\SQLServer, root\interop`
For permissions for data collection:- Read access to SQL instance
- Requires SQL Full-Text and Semantic Extractions for Search feature to be installed on the target SQL instances when using the **Scan full rows for sensitive data** option on the Options wizard page
- Grant Authenticate Server to [DOMAIN\USER]
- Grant Connect SQL to [DOMAIN\USER]
- Grant View any database to [DOMAIN\USER]
- Grant View any definition to [DOMAIN\USER]
- Grant View server state to [DOMAIN\USER]
- Grant Control Server to [DOMAIN\USER] (specifically required for the Weak Passwords Job)
|
| SystemInfo | The SystemInfo Data Collector extracts information from the target system based on the selected category. | | - TCP 135-139
- Randomly allocated high TCP ports
| - Member of the Local Administrators group
|
| TextSearch | The TextSearch Data Collector enables searches through text based log files. | | - TCP 135-139
- Randomly allocated high TCP ports
| - Member of the Local Administrators group
|
| Unix _\*requires license_ | The Unix Data collector provides host inventory, software inventory, and logical volume inventory on UNIX & Linux platforms. | | | - Root permissions in Unix/Linux
|
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/powershell/editquery.md b/docs/accessanalyzer/11.6/admin/datacollector/powershell/editquery.md
index f35c18a8a1..89df5cd647 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/powershell/editquery.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/powershell/editquery.md
@@ -15,9 +15,8 @@ The options on the Edit Query page are:
- Open – Click to import and open a PowerShell script
- Script Editor – Input PowerShell script to use for the configured job
-- Parameters – The Parameters tab located on the right-hand side of the Edit Query page is used to
- bring up the Parameters window. See the [Parameters](#parameters) topic for additional
- information.
+- Parameters – Use the Parameters tab on the right-hand side of the Edit Query page to open the
+ Parameters window. See the [Parameters](#parameters) topic for additional information.
- Use table input for PowerShell script – select the checkbox to bring up the Input options for the
PowerShell script. See the [Input Options](#input-options) topic for additional information.
@@ -36,8 +35,8 @@ The options in the Parameters Window are:
- Delete – Delete a parameter
:::note
-Only user created parameters can be edited or deleted. Pre-configured parameters cannot be
-edited or deleted.
+You can edit or delete only user-created parameters. You can't edit or delete preconfigured
+parameters.
:::
@@ -64,14 +63,14 @@ The options in the Add/Edit Variable window are:
## Input Options
-When the Use table input for PowerShell script option is selected on the Edit Query page, additional
+When you select the Use table input for PowerShell script option on the Edit Query page, additional
options display to define the source for input data.
The input options are:
-- Please select name – Select the input table to be used from the drop-down menu
+- select name – Select the input table to use from the dropdown menu
- Filter nulls – Excludes values that are null from input
- Filter duplicates – Excludes any values that are duplicate from input
- Text Box – Displays an example of how the input can be used in a PowerShell script
@@ -81,5 +80,5 @@ The input options are:
-Selecting an input table in the **Please select name** dropdown populates the Text Box and the
+Selecting an input table in the **select name** dropdown populates the Text Box and the
Columns tab with information.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/powershell/options.md b/docs/accessanalyzer/11.6/admin/datacollector/powershell/options.md
index ec45b7f865..9b564d847f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/powershell/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/powershell/options.md
@@ -12,11 +12,11 @@ The Options page provides the option to execute the script remotely on the targe
The configurable options are:
-- Execute remotely – Remotely executes the script on the target host. If this checkbox is not
- selected, the script will be executed from the Enterprise Auditor Console server.
+- Execute remotely – Remotely executes the script on the target host. If you don't select this
+ checkbox, the script runs from the Enterprise Auditor Console server.
- Use impersonation within server executable – Executes the script with the job credentials
For cmdlets requiring explicit credentials, a single credential set from the job's Connection
Profile can be referenced using `Get-Credential` or the `$JobCredential` variable, a `PSCredential`
-type object. All credentials from the job’s Connection Profile may be accessed via the
+type object. You can access all credentials from the job's Connection Profile via the
`$JobCredentials` array.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/powershell/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/powershell/overview.md
index 25bd9200cf..5b54ff7b19 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/powershell/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/powershell/overview.md
@@ -37,5 +37,5 @@ contains the following pages:
-The Welcome page can be hidden by checking the **Do not display this page the next time** box when
-the wizard is open and configuration settings are saved.
+Check the **Don't display this page the next time** box to hide the Welcome page. The wizard saves
+this setting with your configuration changes.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/powershell/results.md b/docs/accessanalyzer/11.6/admin/datacollector/powershell/results.md
index 90d7231608..3d5474bf4b 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/powershell/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/powershell/results.md
@@ -14,4 +14,4 @@ components.
The Results page options are:
- Properties to return – List of available properties which can be gathered for the PowerShell query
-- ROWKEY's components – List of available properties based on which ROWKEY will be built
+- ROWKEY's components – List of available properties for building ROWKEY
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/powershell/sampleserver.md b/docs/accessanalyzer/11.6/admin/datacollector/powershell/sampleserver.md
index 628eb570d4..078e307f31 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/powershell/sampleserver.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/powershell/sampleserver.md
@@ -13,10 +13,10 @@ The Sample Server page provides a box to select a server to generate the result
The Select Server page options are:
- Server name – Server to be used during configuration
-- Validate – Validates the script results and retrieves result columns. Validation must be run in
- order to populate and enable the Results page.
+- Validate – Validates the script results and retrieves result columns. Run validation to populate
+ and enable the Results page.
The server selected here replaces any `[SAHOSTNAME]` tokens in the PowerShell script. During
-execution, the `[SAHOSTNAME]` tokens are replaced in turn by each host in the host list. If no
+execution, each host in the host list replaces the `[SAHOSTNAME]` tokens in turn. If no
`[SAHOSTHAME]` tokens exist in the PowerShell script, then the server name and the hosts in the host
list have no effect.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/powershell/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/powershell/summary.md
index 29b4869d11..797704ca3d 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/powershell/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/powershell/summary.md
@@ -11,6 +11,6 @@ Data Collector Wizard.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the PowerShell Data Collector Wizard ensuring that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the PowerShell Data Collector Wizard instead. This prevents the wizard from saving accidental
+clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/registry.md b/docs/accessanalyzer/11.6/admin/datacollector/registry.md
index 881da9ff90..399ef48ffa 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/registry.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/registry.md
@@ -7,13 +7,14 @@ sidebar_position: 300
# Registry Data Collector
The Registry Data Collector queries the registry and returns keys, key values, and permissions on
-the keys. The data in the native tables returned by the Registry Data Collector is dependent upon
-the query configuration. For example, a query could be configured to only show permissions on
-registry keys in a 32-bit view. Another query could be configured to show a listing of all keys and
-key values in a 64-bit view. Wildcards can also be used in query configurations.
-
-The Registry Data Collector is a core component of Enterprise Auditor, but it has been preconfigured
-within both the Active Directory Solution and the Windows Solution. While the data collector is
+the keys. The data in the native tables returned by the Registry Data Collector depends on the query
+configuration. For example, you can configure a query to show only permissions on registry keys in
+a 32-bit view. You can configure another query to show a listing of all keys and key values in a
+64-bit view. You can also use wildcards in query configurations.
+
+The Registry Data Collector is a core component of Enterprise Auditor, and the Active Directory
+Solution and the Windows Solution both include it as a preconfigured component. While the data
+collector is
available with all Enterprise Auditor license options, these solutions are only available with a
special Enterprise Auditor licenses. See the following topics for additional information:
@@ -42,16 +43,16 @@ The Registry Data Collector is configured through the Registry Browser window.
The configurable options are:
-- Sample Host – The host to connect to. If this box is left blank, the connection is to the local
- host.
+- Sample Host – The host to connect to. If you leave this box blank, the connection defaults to the
+ local host.
- 64-bit view – The default view is 32-bit. Select the **64-bit view** checkbox to switch to a
64-bit view.
-- Connect – Connect to host’s registry. If no host is specified in the Sample Host box, the
- connection is to the local host’s registry.
+- Connect – Connect to host's registry. If you don't specify a host in the Sample Host box, the
+ connection defaults to the local host's registry.
- Query 32-bit view – Select this checkbox to query the 32-bit view of the registry
- Query 64-bit view – Select this checkbox to query the 64-bit view of the registry
-- Name – The key value. Key values can be added to the Selected Properties list by pressing the
- **ctrl** key, selecting the keys to add, and then clicking the **Add currently selected value**
+- Name – The key value. Add key values to the Selected Properties list by pressing the
+ **ctrl** key, selecting the keys to add, and clicking the **Add selected value**
button.
- Type – The key value type
- Data – The key value path
@@ -71,11 +72,11 @@ to do the following:
| Icon | Name |
| ------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
|  | Select all peer keys for this node |
-|  | Add name of currently selected key |
-|  | Add full path of the currently selected key |
-|  | Add last write date/time of currently selected key |
+|  | Add name of selected key |
+|  | Add full path of the selected key |
+|  | Add last write date/time of selected key |
|  | Add security properties for selected key |
|  | Enumerate all values for this key |
-|  | Add currently selected value |
+|  | Add selected value |
|  | Delete properties from selection |
|  | Go to selected key |
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/script/add.md b/docs/accessanalyzer/11.6/admin/datacollector/script/add.md
index 56bd8dc118..79b0bfee78 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/script/add.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/script/add.md
@@ -6,17 +6,17 @@ sidebar_position: 20
# Add a Script to an Existing Query
-The Query Properties window provides the ability to add a script to an existing query. Typically, a
-script is used to augment a query providing services such as conversion of returned data.
+The Query Properties window lets you add a script to an existing query. Typically, you use a script
+to augment a query, providing services such as conversion of returned data.
-Follow the steps to add a script.
+To add a script:
**Step 1 –** Navigate to the job's **Configure** node and select **Queries**.
**Step 2 –** Click **Create Query** to open the Query Properties window.
-**Step 3 –** Select the **Data Source** tab and select the desired data collector in the Data
-Collector drop-down menu.
+**Step 3 –** Select the **Data Source** tab and select the data collector you want in the Data
+Collector dropdown menu.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/script/editor.md b/docs/accessanalyzer/11.6/admin/datacollector/script/editor.md
index 60d19cf53c..f069884d81 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/script/editor.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/script/editor.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# VBScript Editor
-The VBScript Editor window provides the means to add a script. The window is ideal for editing small
+The VBScript Editor window lets you add a script. The window is ideal for editing small
scripts and for pasting larger scripts from external scripting tools.
@@ -14,10 +14,10 @@ scripts and for pasting larger scripts from external scripting tools.
The options in the VBScript Editor are:
- Save and Close – Use this option to save the script and close the window
-- Syntax Check – Use this option to check the syntax of your script. This does not identify logic
+- Syntax Check – Use this option to check the syntax of your script. This doesn't identify logic
errors, only cases where the script syntax is incorrect. It helps reduce the overhead of debugging
- a script. When selected, a Script Errors window opens and a syntax check is performed. Any
- syntactical errors are displayed within the window.
+ a script. When you select this option, a Script Errors window opens and runs a syntax check. The
+ window displays any syntax errors.
- Load from file – Use this option to load a VB script from a .vbs file
- Save to file – Use this option to save the current script in the Editor
- Undo – Undo previous changes made to the script (Shortcut is Ctrl+Z)
@@ -25,8 +25,8 @@ The options in the VBScript Editor are:
- Cut – Cut the highlighted text
- Copy – Copy the highlighted text
- Paste – Paste cut or copied text into the VB Script Editor
-- Online VBScript Language Reference – Opens internet browser to the Microsoft Technical
- Documentation website from where documentation for Visual Basic Script can be navigated to
+- Online VBScript Language Reference – Opens a browser to the Microsoft Technical
+ Documentation website, where you can find documentation for Visual Basic Script
After adding or modifying a script, click **Save and close**.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/script/example1.md b/docs/accessanalyzer/11.6/admin/datacollector/script/example1.md
index d9be2daa43..19a31a55d9 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/script/example1.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/script/example1.md
@@ -7,26 +7,25 @@ sidebar_position: 70
# Script Example 1: Conversion of Data
This script example demonstrates how to perform a query and modify returned data. The script
-provides the data collector with the information that would have been provided if the user interface
-had been used to design the query. However, in this case it is all done through script. The data
-collector returns a value that is then converted and stored by Enterprise Auditor.
+provides the data collector with the information you would provide if you used the user interface to
+design the query. However, in this case, the script does it all. The data collector returns a value,
+and Enterprise Auditor converts and stores it.
-This script starts by defining a query using the Perfmon Data Collector. Notice that the
-**WorkingQuery** object is used, not the Query object. This is done to preserve the Query object,
-since the Query object will be used to store the results that are different from what the data
-collector is providing.
+This script starts by defining a query using the Perfmon Data Collector. Notice that the script uses
+the **WorkingQuery** object, not the Query object. This preserves the Query object, since the script
+uses it to store results that differ from what the data collector provides.
-The script then issues the query by calling `WorkingQuery.Execute`. When the query completes,
-**WorkingQuery** is set to view the first row of results by setting the **ResultRow** property. The
-value within the **System Up Time** property is then transferred into the `REMAINDER` variable so
-that it can be more easily manipulated.
+The script then issues the query by calling `WorkingQuery.Execute`. When the query completes, the
+script sets **WorkingQuery** to view the first row of results by setting the **ResultRow** property.
+The script then transfers the value of the **System Up Time** property into the `REMAINDER` variable
+for easier manipulation.
The script then takes the value of `REMAINDER`, which is in seconds, and converts it to days, hours,
-minutes, and seconds. These values are then recorded in the Query object so that Enterprise Auditor
-can store this data.
+minutes, and seconds. The script then records these values in the Query object so that Enterprise
+Auditor can store the data.
:::note
-In this task, the hours, minutes, and seconds properties were specified manually using the
+This example specifies the hours, minutes, and seconds properties manually using the
task dialog. See the
[Script Properties](/docs/accessanalyzer/11.6/admin/datacollector/script/properties.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/script/example2.md b/docs/accessanalyzer/11.6/admin/datacollector/script/example2.md
index 2c2d88d90a..20dccf5b19 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/script/example2.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/script/example2.md
@@ -11,25 +11,25 @@ database list from SQL Server and then proceeds to the File System Data Collecto
the database file, essentially inventorying the installed databases, their paths, and sizes.
:::note
-Because the object instances are not thread-safe, scripts like these that use objects
-external to Enterprise Auditor should be run with only one thread.
+Because the object instances aren't thread-safe, run scripts like these that use objects
+external to Enterprise Auditor with only one thread.
:::
-In this example, a connection is opened with a SQL server. The SQL server name is provided by
-Enterprise Auditor during the query. Enterprise Auditor provides the active host to the script using
+In this example, the script opens a connection with a SQL server. Enterprise Auditor provides the
+SQL server name during the query and provides the active host to the script using
the **Query.Host** property.
The script then queries the Master database, requesting a **recordset** containing all databases and
proceeds to get the row count. Setting the **Query.ResultRows** property creates a row of storage
for each record in the recordset. It then proceeds to read data from each row by looping row by row.
-For each row, the database name, filename, and ID are captured. The script then calls a function to
-get the size of the file. The **FileSize** function uses the database filename to construct a query
-to the File System Data Collector, which ultimately returns the size of the file.
+For each row, the script captures the database name, filename, and ID. The script then calls a
+function to get the size of the file. The **FileSize** function uses the database filename to
+construct a query to the File System Data Collector, which ultimately returns the size of the file.
-The data for each database is stored in the Query object.
+The script stores the data for each database in the Query object.
-Finally, the SQL objects are freed.
+Finally, the script frees the SQL objects.
## Example of Compound Query Script
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/script/methodsproperties.md b/docs/accessanalyzer/11.6/admin/datacollector/script/methodsproperties.md
index c42438b310..d8741d0ccf 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/script/methodsproperties.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/script/methodsproperties.md
@@ -26,7 +26,7 @@ The Query and Working Query objects support the following methods and properties
| Path : sting | Sets or retrieves the path |
| Paths : integer | Sets or retrieves the current path for multi-path tasks |
| ResultData (Property : string) : Variant | Sets or retrieves the value for the property specified |
-| ResultData (PropertyIndex : integer) : Variant | Sets ResultRow to the desired row before accessing this property |
+| ResultData (PropertyIndex : integer) : Variant | Sets ResultRow to the row you want before accessing this property |
| ResultRow : integer | Sets or retrieves the current row. For non-enumerated tasks, ResultRow will always be 0. |
| ResultRows : integer | Sets or returns the count of rows. Use this to determine the number of rows returned after an enumerated task is executed. Set this property to create a multi-row return value. |
| Message (index : integer, type : string) | Sets or returns a message in the indicated position. Use MessageCount to determine the number of messages. These messages appear in the job MessageLog. |
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/script/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/script/overview.md
index 5a7ee04537..b1bb108ae7 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/script/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/script/overview.md
@@ -18,15 +18,16 @@ The following examples describe situations where using a script may be useful:
another, for example `build1230` to `at risk`. See the
[Script Example 1: Conversion of Data](/docs/accessanalyzer/11.6/admin/datacollector/script/example1.md)
topic for additional information.
-- Compound Queries – This is a query that cannot be performed using a single query. See the
+- Compound Queries – This is a query that you can't perform using a single query. See the
[Script Example 2: Command Query](/docs/accessanalyzer/11.6/admin/datacollector/script/example2.md)
topic for additional information.
- Interfacing with External Systems – This is a query that requires access to external data. For
example, the query needs to access a corporate database to obtain a location code.
-The Script Data Collector is a core component of Enterprise Auditor, but it has been preconfigured
-within the Windows Solution. While the data collector is available with all Enterprise Auditor
-license options, the Windows Solution is only available with a special Enterprise Auditor license.
+The Script Data Collector is a core component of Enterprise Auditor, and the Windows Solution
+includes it as a preconfigured component. While the data collector is available with all Enterprise
+Auditor license options, the Windows Solution is only available with a special Enterprise Auditor
+license.
See the
[Windows Solution](/docs/accessanalyzer/11.6/solutions/windows/overview.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/script/properties.md b/docs/accessanalyzer/11.6/admin/datacollector/script/properties.md
index 0a7e34e619..05e3cd9026 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/script/properties.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/script/properties.md
@@ -6,9 +6,9 @@ sidebar_position: 60
# Script Properties
-The Data Source tab is used to select the data collector to be used. The configurable options are:
+Use the Data Source tab to select the data collector. The configurable options are:
-- Source – Used to select data collector
+- Source – Select the data collector
- Path – Displays the returned path from the data collector
:::warning
@@ -17,24 +17,23 @@ The Data Source tab is used to select the data collector to be used. The configu
:::
- - The path is used to identify the selection from within the data collector. The path
- essentially tells the data collector where the data is and depending on the data collector,
- may define selected options. It is sometimes convenient to edit the path manually.
- - For example: If defining a file system query using the File System Data Collector, the path
- would automatically be filled in with the selected details. A minor change like changing the
- file location can be done manually by editing the path.
+ - The path identifies the selection within the data collector. The path essentially tells the
+ data collector where the data is and, depending on the data collector, may define selected
+ options. It's sometimes convenient to edit the path manually.
+ - For example, if you define a file system query using the File System Data Collector,
+ Enterprise Auditor automatically fills in the path with the selected details. You can manually
+ edit the path to make a minor change, like changing the file location.
-- Properties – As the Path is used to define where the target data is, the properties are used to
- define what data is desired. Each property has a series of attributes including:
+- Properties – While the path defines where the target data is, the properties define what data you
+ want. Each property has a series of attributes including:
- Name – Identifies the target data. Modifying this affects what data the data collector
returns.
- Column – Specifies the column name within the result data. Use this to specify the column name
- that will be used within the report output. This is set by default to match the **Name**
- attribute.
- - DataType – Used to determine the format of the data for reporting purposes. It affects sorting
- order and the ability to graph content. In some cases, the data collector is unable to
- determine the correct data type for the returned data.
+ for the report output. By default, this matches the **Name** attribute.
+ - DataType – Determines the format of the data for reporting purposes. It affects sorting
+ order and the ability to graph content. In some cases, the data collector can't determine the
+ correct data type for the returned data.
:::warning
Setting this value manually to an incorrect data type may render your results
@@ -42,25 +41,25 @@ The Data Source tab is used to select the data collector to be used. The configu
:::
- - For example: Querying the registry for a value stored as **REG_SZ** returns a string, as
- **REG_SZ** is a string type in the registry. However, sometimes numbers are recorded in
- **REG_SZ** entries. If you determine that the content returned could always be interpreted as
- numeric, you could override the default `STRING` value and set it to `NUMERIC`. This provides
- proper sorting and charting ability.
+ - For example, querying the registry for a value stored as **REG_SZ** returns a string, as
+ **REG_SZ** is a string type in the registry. However, REG_SZ entries sometimes contain
+ numbers. If you determine that the returned content is always numeric, you can override the
+ default `STRING` value and set it to `NUMERIC`. This provides proper sorting and charting
+ ability.
-- Size – Used to determine the width of the field used to hold String data. Setting the size smaller
+- Size – Determines the width of the field used to hold String data. Setting the size smaller
than the actual returned data will cause Enterprise Auditor to truncate the data in the view.
However, the actual stored data in the result table will contain the full result.
- Value – Reserved for internal use
-- Key – Used to identify a key property. A key property is used to identify the property that
- contains a unique value for enumerated tasks. A Key value is required for Change Detection and
- Conformance Management on enumerated tasks. To identify a property that uniquely identifies each
- row, set the Key attribute to `YES`.
+- Key – Identifies a key property. A key property identifies the property that contains a unique
+ value for enumerated tasks. Enumerated tasks require a Key value for Change Detection and
+ Conformance Management. To identify a property that uniquely identifies each row, set the Key
+ attribute to `YES`.
## Adding and Removing Properties Manually
-Although the property list is automatically populated by the data collectors, additional properties
-may be added manually. Doing so allocates storage within Enterprise Auditor during data collection
+Although the data collectors automatically populate the property list, you can add additional
+properties manually. Doing so allocates storage within Enterprise Auditor during data collection
and creates corresponding columns in the output table. Use a script to reference and populate these
properties.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/script/reference.md b/docs/accessanalyzer/11.6/admin/datacollector/script/reference.md
index 1af55b8fb7..47a07e6205 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/script/reference.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/script/reference.md
@@ -7,20 +7,20 @@ sidebar_position: 50
# Script Reference
Enterprise Auditor provides extensions to standard Visual Basic Script. These extensions allow
-access to and manipulation of task data, in addition to invoking queries. They are implemented
-through two objects.
+access to and manipulation of task data, in addition to invoking queries. Enterprise Auditor
+implements them through two objects.
**Query Object**
The Query object provides access to the current query configuration and data. Use this to examine
-the results of a query or to manipulate the query before it is executed. Changing properties of this
-object will change the way the task is executed by Enterprise Auditor.
+the results of a query or to manipulate the query before Enterprise Auditor executes it. Changing
+properties of this object changes how Enterprise Auditor executes the task.
**Working Query Object**
The Working Query object is identical to the Query object. This object supports the same methods and
-properties as the Query object but its properties and methods do not access the current query. Think
-of this object as allowing the ability to create a task on the fly. Use this object to perform
+properties as the Query object but its properties and methods don't access the current query. Think
+of this object as allowing the ability to create a task dynamically. Use this object to perform
queries, while leaving the original task undisturbed. This is valuable when performing compound
queries isneeded. See the
[Script Example 2: Command Query](/docs/accessanalyzer/11.6/admin/datacollector/script/example2.md)
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/script/run.md b/docs/accessanalyzer/11.6/admin/datacollector/script/run.md
index a2b837a967..9e35418288 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/script/run.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/script/run.md
@@ -6,16 +6,16 @@ sidebar_position: 10
# Run a Stand-Alone Script
-Some situations require a script to be used exclusively without defining a data source. The Query
-Properties window provides the ability to add and run a script.
+Some situations require you to use a script exclusively, without defining a data source. The Query
+Properties window lets you add and run a script.
-Follow the steps to add a script.
+To add a script:
**Step 1 –** Go to the job's **Configure** node and select **Queries**.
**Step 2 –** Click **Create Query** to open the Query Properties window.
-**Step 3 –** Select the **Data Source** tab, and select **SCRIPT** in the Data Collector drop-down
+**Step 3 –** Select the **Data Source** tab, and select **SCRIPT** in the Data Collector dropdown
menu.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/services.md b/docs/accessanalyzer/11.6/admin/datacollector/services.md
index d93d05d765..e3a3ddf300 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/services.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/services.md
@@ -7,8 +7,9 @@ sidebar_position: 320
# Services Data Collector
The Services Data Collector enumerates status and settings from remote services. The Services Data
-Collector is a core component of Enterprise Auditor, but it has been preconfigured within the
-Windows Solution. While the data collector is available with all Enterprise Auditor license options,
+Collector is a core component of Enterprise Auditor, and the Windows Solution includes it as a
+preconfigured component. While the data collector is available with all Enterprise Auditor license
+options,
the Windows Solution is only available with a special Enterprise Auditor license. See the
[Windows Solution](/docs/accessanalyzer/11.6/solutions/windows/overview.md)
topic for additional information.
@@ -37,14 +38,15 @@ The Services Data Collector is configured through the Service Browser window.
- All Services – Select this option to build the query to extract information from all services on
the target host
- Specific Services – Select this option to build the query to extract information from specific
- services on the target host. Select the checkboxes next to the desired services for the query
+ services on the target host. Select the checkboxes next to the services you want for the query
after clicking **Connect**.
- Connect – Click **Connect** to connect to the host and display a list of all services found
-- Available Properties – Select the properties to be returned
+- Available Properties – Select the properties to return
:::note
-In cases where the query does not find the selected services on the target host, the
-`InternalName` column that is returned reflects the `DisplayName` column and no other values are
-retrieved. If the services are found on the host, the `DisplayName` value in the table is resolved.
+In cases where the query doesn't find the selected services on the target host, the
+returned `InternalName` column reflects the `DisplayName` column, and the query doesn't retrieve
+any other values. If the query finds the services on the host, it resolves the `DisplayName` value
+in the table.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/collectionmethod.md b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/collectionmethod.md
index 45d1c67c9f..09cc807732 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/collectionmethod.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/collectionmethod.md
@@ -6,13 +6,13 @@ sidebar_position: 60
# SMARTLog: Collection Method
-The Collection Method page is used to select the collection method employed by the data collector.
-It is a wizard page for all log types.
+Use the Collection Method page to select the collection method the data collector uses. It's a
+wizard page for all log types.
-Select the collection method from the following options to set how the collection routine is
-executed to collect the data from the target.
+Select the collection method from the following options to set how the collection routine collects
+the data from the target.
- Using network query – Connects to the target log over the network via RPC and reads events
- Using server side applet – Deploys a remote executable to the target host and then runs as a
@@ -20,17 +20,17 @@ executed to collect the data from the target.
Enterprise Auditor Console.
:::note
- The applet cannot be used to target the local host.
+ You can't use the applet to target the local host.
:::
- Copy the log locally and process (Not available for all query scenarios) – Extract events from an
- offline log by moving the log to the Enterprise Auditor Console and having it processed on the
- local host instead of the target host. In order to use this option, the log type selected for the
+ offline log by moving the log to the Enterprise Auditor Console and processing it on the local
+ host instead of the target host. To use this option, the log type selected for the
query must be **Windows Event Log (Archived)**.
-The Applet Options section is only visible when the **Using server side applet** collection method
-is selected.
+The Applet Options section is visible only when you select the **Using server side applet**
+collection method.
- Connection retries count – The number of times to retry a failed connection. The default is 15.
- Retry delay (ms) – The time between retries of a failed connection. The default is 5000
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/criteria.md b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/criteria.md
index 1720440c87..d2295a3ea6 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/criteria.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/criteria.md
@@ -6,15 +6,15 @@ sidebar_position: 50
# SMARTLog: Criteria
-The Criteria page is used to specify the search criteria. A test query can be run with the sample
-host entered on the Sample Host page to confirm the results that will be returned by the query. It
-is a wizard page for all log types.
+Use the Criteria page to specify the search criteria. You can run a test query with the sample
+host entered on the Sample Host page to confirm the results the query returns. It's a wizard page
+for all log types.
The **Limit number of records to** setting has a default of `1000`.
-Follow the steps to configure the search criteria.
+To configure the search criteria:
@@ -36,12 +36,11 @@ that level. The available options are **AND**, **OR**, **NOT AND**, and **NOT O
- To remove a row (condition or group), click the ellipsis (**…**) on the row and select **Remove
Row**
-- To remove all currently configured criteria, click **Filter** and select **Clear All**
+- To remove all configured criteria, click **Filter** and select **Clear All**
-**Step 6 –** Click **Show data** to run a test query and sample the data that will be returned that
-is connected to a target log based upon the configured criteria. The data is displayed in the
-Records found table.
+**Step 6 –** Click **Show data** to run a test query and sample the data connected to a target log
+based on the configured criteria. The Records found table displays the data.
-The search criteria has now been configured and the results it returns tested. Configure the
-criteria further if the returned results are not as expected, or click **Next** to continue to the
+You've now configured the search criteria and tested the results it returns. Configure the
+criteria further if the returned results aren't as expected, or click **Next** to continue to the
next wizard page.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/eventlogoptions.md b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/eventlogoptions.md
index 7479b4d0e3..25ca82e608 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/eventlogoptions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/eventlogoptions.md
@@ -6,12 +6,12 @@ sidebar_position: 80
# SMARTLog: Event Log Options
-The Event Log Options page is used to configure additional options. It is a wizard page for all log
+Use the Event Log Options page to configure additional options. It's a wizard page for all log
types.
-The following additional options can be selected:
+You can select the following additional options:
- Lookup user name – Resolves SIDs found in the event descriptions to friendly display name values
- Resolve GUIDs – Resolves GUIDs found in the event descriptions to friendly display name values
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/logstate.md b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/logstate.md
index ec75b027a9..03926809bc 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/logstate.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/logstate.md
@@ -6,12 +6,12 @@ sidebar_position: 70
# SMARTLog: Log State
-The Log State page is used to configure how to search the log. It is a wizard page for all log
+Use the Log State page to configure how to search the log. It's a wizard page for all log
types.
-Select the **Persist log state** checkbox to search the log from where the search last left off. A
-state file is created for each host configured in the query. State files can be viewed within
-Enterprise Auditor and are named by the query GUID. State files display the record the search last
-left off on, the event log, and the date of the last entry.
+Select the **Persist log state** checkbox to search the log from where the search last left off.
+Enterprise Auditor creates a state file for each host configured in the query. You can view state
+files within Enterprise Auditor, and Enterprise Auditor names them by the query GUID. State files
+display the record the search last left off on, the event log, and the date of the last entry.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/logtype.md b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/logtype.md
index 1a49a2b279..5d9a62b0d6 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/logtype.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/logtype.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# SMARTLog: Log Type
-The Log Type page is used to select the log type to be processed.
+Use the Log Type page to select the log type to process.
@@ -15,16 +15,16 @@ The log types are:
- Windows Event Log – Connects to and extract information from any Windows event log made available
on the target host
- Windows Event Log (Archived) – Extract events from an offline log by moving the log to the
- Enterprise Auditor Console and having it processed on the local host instead of the target host
+ Enterprise Auditor Console and processing it on the local host instead of the target host
- Internet Information Server Log – An Exchange query that returns information from Outlook Web
Access IIS logs found on CAS servers
- - The IIS log must be configured to generate specific columns in order for the SMARTLog Data
- Collector to audit them. See the
+ - Configure the IIS log to generate specific columns so the SMARTLog Data
+ Collector can audit them. See the
[IIS Log Auditing Requirements](#iis-log-auditing-requirements) topic for additional
information.
-- File Change Detection Log – This is a legacy option. It should not be selected.
+- File Change Detection Log – This is a legacy option. Don't select it.
## IIS Log Auditing Requirements
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/overview.md
index e0dd4cca04..f5e4b2da72 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/overview.md
@@ -9,11 +9,11 @@ sidebar_position: 340
The SMARTLog Data Collector provides search and extraction of details from Windows Event Logs
(online or offline) and Microsoft Exchange Internet Information Server (IIS) logs.
-The SMARTLog Data Collector is a core component of Enterprise Auditor, but it has been preconfigured
-within the Active Directory Solution, Exchange Solution, SQL Solution, and the Windows Solution.
-While the data collector is available with all Enterprise Auditor license options, these solutions
-are only available with a special Enterprise Auditor licenses. See following sections for additional
-information:
+The SMARTLog Data Collector is a core component of Enterprise Auditor, and the Active Directory
+Solution, Exchange Solution, SQL Solution, and Windows Solution all include it as a preconfigured
+component. While the data collector is available with all Enterprise Auditor license options, these
+solutions are only available with a special Enterprise Auditor license. See following sections for
+additional information:
- [Active Directory Solution](/docs/accessanalyzer/11.6/solutions/activedirectory/overview.md)
- [Exchange Solution](/docs/accessanalyzer/11.6/solutions/exchange/overview.md)
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/results.md b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/results.md
index 961bb3baf8..7d3d202e77 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/results.md
@@ -6,9 +6,8 @@ sidebar_position: 40
# SMARTLog: Results
-The Results page is where the events to be returned by the query are selected. It is a wizard page
-for all log types. The description strings within the log records can also be selected for the
-query.
+Use the Results page to select the events the query returns. It's a wizard page for all log types.
+You can also select the description strings within the log records for the query.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/samplehost.md b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/samplehost.md
index 6269dad4a5..c33d324f16 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/samplehost.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/samplehost.md
@@ -6,14 +6,14 @@ sidebar_position: 20
# SMARTLog: Sample Host
-The Sample Host page is used to configure the host. It is a wizard page for all log types.
+Use the Sample Host page to configure the host. It's a wizard page for all log types.
Select a host for running a test query on the Criteria page from the following radio buttons:
- Local Computer – localhost
-- Another computer – If selecting another computer for the host, click the ellipsis to open the
+- Another computer – If you select another computer for the host, click the ellipsis to open the
Select Computer window. See the [Select Computer Window](#select-computer-window) topic for
additional information.
@@ -21,7 +21,7 @@ Select a host for running a test query on the Criteria page from the following r
-If selecting another computer for the host, click the ellipsis to open the Select Computer window
+If you select another computer for the host, click the ellipsis to open the Select Computer window
and select a computer. The options in the Select Computer window are:
- Object Types – Either enter the object type name in the textbox or click **Object Types** to
@@ -41,13 +41,13 @@ and select a computer. The options in the Select Computer window are:
The Common Queries section is included on the advanced Select Computer window in addition to object
type and location in the original Select Computer window.
-- Name – Select a qualifier from the drop-down menu and enter a name of an object in the associated
+- Name – Select a qualifier from the dropdown menu and enter a name of an object in the associated
text box
-- Description – Select a qualifier from the drop-down menu and enter a description in the associated
+- Description – Select a qualifier from the dropdown menu and enter a description in the associated
text box
- Select the **Disabled accounts** checkbox to include disabled accounts in the search
- Select the **Non-expiring password** checkbox to include non-expiring passwords in the search
-- Select the number of **Days since last logon** from the drop-down menu
+- Select the number of **Days since last logon** from the dropdown menu
- Click the **Columns** button to open the Choose Columns window
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/summary.md
index 527a451840..c518779a07 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/summary.md
@@ -10,5 +10,5 @@ The Summary page displays a summary of the configured query. It is a wizard page
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the SMART Log DC Wizard to ensure that no accidental clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the SMART Log DC Wizard instead. This prevents the wizard from saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/targetlog/filedetectionlog.md b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/targetlog/filedetectionlog.md
index 953f22dfb9..2f30e5f9e3 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/targetlog/filedetectionlog.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/targetlog/filedetectionlog.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# SMARTLog: Target Log for File Detection Log Type
-The Target Log page is where logs are selected to be collected. This version is a wizard page for
+Use the Target Log page to select the logs to collect. This version is a wizard page for
the File Change Detection log type.
@@ -16,6 +16,6 @@ of the following options:
- Automatic (Local for NAS device hosts, Remote for Windows hosts)
- Local Enterprise Auditor Server
-- Specific Remote Server – If selected, enter the server name in the Server textbox
+- Specific Remote Server – If you select this option, enter the server name in the Server textbox
In the Log files to be processed section, set the filter criteria.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/targetlog/targetlog.md b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/targetlog/targetlog.md
index c2906387d3..49ea0b400b 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/targetlog/targetlog.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/targetlog/targetlog.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# SMARTLog: Target Log
-The Target Log page is where logs are selected to be collected. There are three versions of this
+Use the Target Log page to select the logs to collect. There are three versions of this
wizard page that change based on log type. This version is a wizard page for the log types of:
- Windows Event Log (Archived)
@@ -23,9 +23,9 @@ topics for information on the other versions of this wizard page.
The configurable options are:
- Path – Enter or browse to the path to the log
-- File mask – Enter file names to limit the file names to return from the path entered. Asterisks
- can be used for wildcards. For example, `u_ex*.log` would match **u_ex170530.log**. When no mask
- is set, all files from the listed path are returned.
+- File mask – Enter file names to limit the file names to return from the path entered. Use asterisks
+ for wildcards. For example, `u_ex*.log` would match **u_ex170530.log**. When you don't set a mask,
+ Enterprise Auditor returns all files from the listed path.
- Log files to be processed – Select from the following options:
- All
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/targetlog/windowseventlog.md b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/targetlog/windowseventlog.md
index 73e70357ba..951c5e8f7b 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/smartlog/targetlog/windowseventlog.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/smartlog/targetlog/windowseventlog.md
@@ -6,10 +6,10 @@ sidebar_position: 10
# SMARTLog: Target Log for Windows Event Log Type
-The Target Log page is where logs are selected to be collected. This version is a wizard page for
+Use the Target Log page to select the logs to collect. This version is a wizard page for
the log type of Windows Event Log.
-Only one log can be targeted per query task. The selected log is displayed at the bottom of the
+You can target only one log per query task. The selected log displays at the bottom of the
wizard page.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/activitydatescope.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/activitydatescope.md
index dc6170a79f..d4322f428b 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/activitydatescope.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/activitydatescope.md
@@ -6,17 +6,17 @@ sidebar_position: 110
# SPAA: Activity Date Scope
-The Activity Date Scope page is where the range of dates for which the SharePoint activity scan will
-collect data is configured. It is a wizard page for the category of Scan SharePoint Activity.
+Use the Activity Date Scope page to configure the range of dates for which the SharePoint activity
+scan collects data. It's a wizard page for the category of Scan SharePoint Activity.
Use the radio buttons to select the **Scan Filters**.
- Relative Timespan
- - Collect Activity from the last 180 days – The number of days to collect activity can be
- configured with the up and down arrows
- - Retain data – The timespan for data retention. Select from the drop-down list:
+ - Collect Activity from the last 180 days – Configure the number of days to collect activity
+ with the up and down arrows
+ - Retain data – The timespan for data retention. Select from the dropdown list:
- within timespan
- forever
- Absolute Timespan
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/activityloglocations.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/activityloglocations.md
index 0470e3f5b8..b9e6d94dfc 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/activityloglocations.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/activityloglocations.md
@@ -6,8 +6,8 @@ sidebar_position: 120
# SPAA: Activity Log Locations
-The Activity Log Locations page is where to manually configure log locations to avoid requiring
-remote registry access to locate the activity event log files. It is a wizard page for the category
+Use the Activity Log Locations page to manually configure log locations, avoiding the need for
+remote registry access to locate the activity event log files. It's a wizard page for the category
of Scan SharePoint Activity.
@@ -16,7 +16,7 @@ The options in the Activity Log Locations page are:
- Add – Opens the Customize Activity Log UNC Paths location window to add a new host
- Add Default – Opens the Customize Activity Log UNC Paths location window for the default host
-- Edit – Opens the Customize Activity Log UNC Paths window for the selected host. If edits are made,
+- Edit – Opens the Customize Activity Log UNC Paths window for the selected host. If you make edits,
click **OK** to save the changes.
- Remove – Removes the selected host
@@ -31,17 +31,17 @@ The options in the Customize Activity Log UNC Paths Window are:
Activity Logs (as configured in **Activity Monitor** > **Monitored Hosts**)
:::note
- For On-Premises environments you do not need to specify an Activity Log UNC path as
+ For On-Premises environments you don't need to specify an Activity Log UNC path as
the Data Collector will default to finding the log locations via the registry.
:::
- Activity archive UNC path – UNC path to the archive location of Activity Logs (as configured in
- **Activity Monitor** > **Agents**). If archiving is not enabled in Activity Monitor this can be
+ **Activity Monitor** > **Agents**). If archiving isn't enabled in Activity Monitor this can be
left blank.
:::note
-In any UNC paths, `%HOST%` will be replaced with the host name.
+In any UNC paths, Enterprise Auditor replaces `%HOST%` with the host name.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/additionalscoping.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/additionalscoping.md
index a3ae335519..45a96fd2cd 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/additionalscoping.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/additionalscoping.md
@@ -6,33 +6,33 @@ sidebar_position: 60
# SPAA: Additional Scoping
-The Additional Scoping page is where the scan can be limited by depth of the scan. It is a wizard
+Use the Additional Scoping page to limit the scan by depth. It's a wizard
page for the categories of:
- Scan SharePoint Access
- Scan For Sensitive Content
:::warning
-Users should not change scans in a way that would result in less data being returned on
-a subsequent scan (i.e. scanning fewer web applications, scanning fewer site collections, or a
-shallower depth scan). Those resources not included in a subsequent scan are marked as deleted in
-the Tier 2 database and subsequently removed from the Tier 1 database.
+Don't change scans in a way that results in a subsequent scan returning less data (for example,
+scanning fewer web applications, scanning fewer site collections, or using a shallower depth scan).
+Enterprise Auditor marks resources not included in a subsequent scan as deleted in the Tier 2
+database and subsequently removes them from the Tier 1 database.
:::
-If checked, set the **Limit scanned depth to: [number] level(s)** option to the desired depth. If
-this option is not checked then the entire farm is scanned. If the scoping depth is set to **0**
-then only root site collections are scanned. Each increment to the depth adds an additional level of
-depth from that point.
+If you check this option, set the **Limit scanned depth to: [number] levels** option to the depth
+you want. If you don't check this option, the scan covers the entire farm. If you set the scoping
+depth to **0**, the scan covers only root site collections. Each increment to the depth adds an
+additional level of depth from that point.
Check the **Perform differential scan** box to enable the job to run a differential scan.
-Differential scanning is enabled by default. When this option is enabled, SPAA scan will only parse
-files for content/SDD if it has been modified since the last scan.
+Differential scanning is on by default. When you enable this option, the SPAA scan only parses
+files for content/SDD that have changed since the last scan.
:::note
-This option only applies to Tag collection and Sensitive data collection. Files will be
-still be scanned for permissions regardless of whether this option is checked or not.
+This option only applies to Tag collection and Sensitive data collection. Enterprise Auditor
+still scans files for permissions regardless of whether you check this option.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/agentsettings.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/agentsettings.md
index 5ee2ba010d..1c3ac9a7a2 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/agentsettings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/agentsettings.md
@@ -6,20 +6,20 @@ sidebar_position: 70
# SPAA: Agent Settings
-The Agent Settings page is where the SharePoint Agent Service is configured. It is a wizard page for
+Use the Agent Settings page to configure the SharePoint Agent Service. It's a wizard page for
the category of Scan SharePoint Access.
The **Enable Agent Service Scans** checkbox enables collecting SharePoint data through the agent
-services instead of directly from SharePoint. This option requires a **Network Port** to be entered.
+services instead of directly from SharePoint. This option requires you to enter a **Network Port**.
Agent Service Identity radio buttons are:
- Use Job Credentials when job has same credentials as agent services
- Use Custom Identity for other agent service credential scenarios
- Specify identity in the format `spn:name` or `upn:name`
- - The token `%HOST%` may be substituted for the host name
+ - You may substitute the token `%HOST%` for the host name
-This option requires the SharePoint Agent to be installed on the application server. See the
+This option requires you to install the SharePoint Agent on the application server. See the
[SharePoint Agent Installation](/docs/accessanalyzer/11.6/install/sharepointagent/overview.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/bulkimportsettings.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/bulkimportsettings.md
index a2f25fcd5f..c82dc8f231 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/bulkimportsettings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/bulkimportsettings.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# SPAA: Bulk Import Settings
-The Bulk Import Settings page is where the bulk import process settings are configured. It is a
+Use the Bulk Import Settings page to configure the bulk import process settings. It's a
wizard page for the categories of:
- Bulk Import Access Scan Results
@@ -15,6 +15,6 @@ wizard page for the categories of:
Subsequent hosts in job lists will get host IDs incremented by 1. The Host Identifier may require an
-offset to avoid overlapping IDs in collected data. If the **Set Host ID** checkbox is left
-unchecked, then Enterprise Auditor assigns values starting from 1 to every host. This feature is
+offset to avoid overlapping IDs in collected data. If you leave the **Set Host ID** checkbox
+unchecked, Enterprise Auditor assigns values starting from 1 to every host. This feature is
intended only for SQL Server Replication.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/category.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/category.md
index cc9944b76a..7a9bafb111 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/category.md
@@ -30,7 +30,7 @@ The options on the Category page are:
Auditor database
:::tip
-Remember, the sensitive data discovery options require the Sensitive Data Discovery Add-On to be
-installed on the Enterprise Auditor Console. If the SharePoint Agent is used, then it must also be
-installed on the application server that hosts the Central Administration component.
+Remember, the sensitive data discovery options require you to install the Sensitive Data Discovery
+Add-On on the Enterprise Auditor Console. If you use the SharePoint Agent, you must also install it
+on the application server that hosts the Central Administration component.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/configurejob.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/configurejob.md
index 4aca22f190..df6f630e70 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/configurejob.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/configurejob.md
@@ -6,12 +6,12 @@ sidebar_position: 20
# SharePoint Custom Connection Profile & Host List
-The SPAA Data Collector requires a custom Connection Profile and a custom host list to be created
-and assigned to the job conducting the data collection. The host inventory option during host list
-creation makes it necessary to configure the Connection Profile first. While SharePoint on-premises
-uses the Active Directory account type for the credential within a Connection Profile, it is
-necessary for online credentials to be listed first in the credentials list within a Connection
-Profile housing credentials to both environments.
+The SPAA Data Collector requires you to create a custom Connection Profile and a custom host list
+and assign them to the job conducting the data collection. The host inventory option during host
+list creation makes it necessary to configure the Connection Profile first. While SharePoint
+on-premises uses the Active Directory account type for the credential within a Connection Profile,
+you must list online credentials first in the credentials list within a Connection Profile housing
+credentials to both environments.
## SharePoint Farm
@@ -25,17 +25,17 @@ The provisioned credential used should be an Active Directory account.
Create a Connection Profile and set the following information on the User Credentials window:
- Select Account Type – Active Directory Account
-- Domain – Drop-down menu with available trusted domains displays. Either type the short domain name
+- Domain – dropdown menu with available trusted domains displays. Either enter the short domain name
in the textbox or select a domain from the menu.
-- User name – Type the user name
+- User name – Enter the user name
- Password Storage – Choose the for credential password storage:
- Application – Uses Enterprise Auditor’s configured Profile Security setting as selected at the
**Settings** > **Application** node
- CyberArk – Uses the CyberArk Enterprise Password Vault
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
-Once the Connection Profile is created, it is time to create the custom host list. See the
+After you create the Connection Profile, create the custom host list. See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
topic for additional information.
@@ -44,7 +44,7 @@ topic for additional information.
The custom host list should include:
- One application server per farm
-- Host name without a domain suffix, this means the host name should not contain a period character
+- Host name without a domain suffix, this means the host name shouldn't contain a period character
See the
[Add Hosts](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/add.md)
@@ -85,20 +85,20 @@ Create a Connection Profile and set the following information on the User Creden
- 5 – US Government-High
- 6 – US Government-DoD
- An example string matching the configuration from above is:
+ An example string matching the preceding configuration is:
C:\Program Files
(x86)\STEALTHbits\StealthAUDIT\PrivateAssemblies\spaa_cert_myorg.pfx,PasswordGoesHere,0
:::note
- `PasswordGoesHere` should be replaced with the password used when generating the
+ Replace `PasswordGoesHere` with the password used when generating the
self-signed X.509 certificate if the Microsoft Entra ID Application was Registered and
- Provisioned manually or the $appPassword parameter used in the SP_RegisterAzureAppAuth Instant
- Job if that method was used.
+ Provisioned manually, or with the $appPassword parameter used in the SP_RegisterAzureAppAuth
+ Instant Job if that method was used.
:::
-Once the Connection Profile is created, it is time to create the custom host list. See the
+After you create the Connection Profile, create the custom host list. See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
topic for additional information.
@@ -106,11 +106,11 @@ topic for additional information.
The custom host list should include:
-- Web or cloud hosts should be specified using the full web DNS part of the site URL, for example an
- Office 365 site with the URL http://TestSite.sharepoint.com should be added as a host with name
+- Specify web or cloud hosts using the full web DNS part of the site URL. For example, add an
+ Office 365 site with the URL http://TestSite.sharepoint.com as a host named
TestSite.sharepoint.com
-- Do not use the admin site, for example TestSite-admin.sharepoint.com
-- Do not use IP Addresses
+- Don't use the admin site, for example TestSite-admin.sharepoint.com
+- Don't use IP Addresses
- Host name must be in DNS format
See the
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/dlpauditsettings.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/dlpauditsettings.md
index 371f8995f1..89ddb04e10 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/dlpauditsettings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/dlpauditsettings.md
@@ -6,14 +6,14 @@ sidebar_position: 90
# SPAA: DLP Audit Settings
-The DLP Audit Settings page is where sensitive data discovery settings are configured. It is a
-wizard page for the category of Scan For Sensitive Content.
+Use the DLP Audit Settings page to configure sensitive data discovery settings. It's a wizard page
+for the category of Scan For Sensitive Content.
:::warning
-Users should not change scans in a way that would result in less data being returned on
-a subsequent scan (i.e. scanning fewer web applications, scanning fewer site collections, or a
-shallower depth scan). Those resources not included in a subsequent scan are marked as deleted in
-the Tier 2 database and subsequently removed from the Tier 1 database.
+Don't change scans in a way that results in a subsequent scan returning less data (for example,
+scanning fewer web applications, scanning fewer site collections, or using a shallower depth scan).
+Enterprise Auditor marks resources not included in a subsequent scan as deleted in the Tier 2
+database and subsequently removes them from the Tier 1 database.
:::
@@ -21,11 +21,11 @@ the Tier 2 database and subsequently removed from the Tier 1 database.
Configure the **Scan Performance** options:
-- Don’t process files larger than: Size Limit [number] MB – Limits the files to be scanned for
+- Don’t process files larger than: Size Limit [number] MB – Limits the files scanned for
sensitive content to only files smaller than the specified size. The checkbox is selected by
default. The default size is 2 MB.
- Number of SDD scan processes [number] – Increases the number of SDD scanner processes that spawn
- as part of a scan, increasing parallel scanning. The value should not exceed 2x the number of CPU
+ as part of a scan, increasing parallel scanning. The value shouldn't exceed 2x the number of CPU
threads available.
Use the radio buttons to select the **File types to scan**:
@@ -46,13 +46,13 @@ Use the radio buttons to select the **File types to scan**:
Use the checkboxes to select to **Store Match Hits**:
- Store discovered sensitive data – Stores match hits for sensitive data in the SPAA Tier 2
- database. If this option is not selected, then the match hits for sensitive data are still
- reported but the data columns are masked in the database.
-- Limit stored matches per criteria to [number] – Enabled when the Store discovered sensitive data
- checkbox is selected. Limits the number of stored matches per criteria to the specified number.
+ database. If you don't select this option, Enterprise Auditor still reports the match hits for
+ sensitive data but masks the data columns in the database.
+- Limit stored matches per criteria to [number] – Available when you select the Store discovered
+ sensitive data checkbox. Limits the number of stored matches per criteria to the specified number.
:::tip
-Remember, the sensitive data discovery options require the Sensitive Data Discovery Add-On to be
-installed on the Enterprise Auditor Console. If the SharePoint Agent is used, then it must also be
-installed on the application server that hosts the Central Administration component.
+Remember, the sensitive data discovery options require you to install the Sensitive Data Discovery
+Add-On on the Enterprise Auditor Console. If you use the SharePoint Agent, you must also install it
+on the application server that hosts the Central Administration component.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/droptables.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/droptables.md
index 3ad886496a..aec4a70137 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/droptables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/droptables.md
@@ -10,7 +10,7 @@ If it becomes necessary to clear the SPAA Data Collector tables and views to res
SP_DropTables Job is preconfigured to run analysis tasks that drop functions and views for the
SharePoint Solution as well as the standard tables and views generated by the **SPAA** Data
Collector. It is available through the Instant Job Library under the SharePoint library. Since this
-job does not require a host to target, select **Local host** on the Hosts page of the Enterprise
+job doesn't require a host to target, select **Local host** on the Hosts page of the Enterprise
Auditor Instant Job Wizard. See the
[Instant Job Wizard](/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md)
topic for additional information.
@@ -38,10 +38,10 @@ The default analysis tasks are:
- **4. Drop SPAA Tables** – Drops the SharePoint Access Auditing tables imported from the previous
runs
-Do not try to run these tasks separately, as they are designed to work together. Follow these steps
+Don't try to run these tasks separately, as they are designed to work together. Follow these steps
to run the analysis tasks:
-**Step 1 –** In the Analysis Selection Pane, click **Select All**. All tasks will be checked.
+**Step 1 –** In the Analysis Selection Pane, click **Select All** to check all tasks.
**Step 2 –** Right-click the **SP_DropTables** Job and select **Run Job**. The analysis execution
status will be visible from the **Running Jobs** node.
@@ -50,9 +50,9 @@ status will be visible from the **Running Jobs** node.
All** to deselect these analysis tasks.
:::info
-Do not leave these analysis tasks checked in order to avoid accidental data loss.
+Don't leave these analysis tasks checked to avoid accidental data loss.
:::
-All of these tables have been dropped from the SQL Server database and the data is no longer
-available.
+The tasks have now dropped all of these tables from the SQL Server database, and the data is no
+longer available.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/overview.md
index 59cf7b9152..2174838b2a 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 330
# SharePointAccess Data Collector
The SharePointAccess (SPAA) Data Collector audits access, group membership, and content within a
-SharePoint on-premises and SharePoint Online environment. The SPAA Data Collector has been
-preconfigured within the SharePoint Solution. Both this data collector and the solution are
+SharePoint on-premises and SharePoint Online environment. The SharePoint Solution includes the SPAA
+Data Collector as a preconfigured component. Both this data collector and the solution are
available with a special Enterprise Auditor license. See the
[SharePoint Solution](/docs/accessanalyzer/11.6/solutions/sharepoint/overview.md)
topic for additional information. The SPAA Data Collector has the following requirements:
@@ -35,15 +35,15 @@ topic for additional information. The SPAA Data Collector has the following requ
**Sensitive Data Discovery Considerations**
-The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
-then an extra 16 GB of RAM are required (8x2=16).
+You must install the Sensitive Data Discovery Add-On on the Enterprise Auditor Console server,
+which enables Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans,
+you must increase the minimum amount of RAM. Each thread requires a minimum of 2
+additional GB of RAM per host. For example, if you configure the job to scan 8 hosts at a time,
+you need an extra 16 GB of RAM (8x2=16).
:::tip
-Remember, if employing the Enterprise Auditor SharePoint Agent, it is also necessary for the
-Sensitive Data Discovery Add-on to be installed on the server where the agent is installed.
+Remember, if you use the Enterprise Auditor SharePoint Agent, you must also install the
+Sensitive Data Discovery Add-on on the server where the agent is installed.
:::
@@ -70,5 +70,5 @@ Category selected:
-The Welcome page can be hidden by checking the **Do not display this page the next time** box when
-the wizard is open and configuration settings are saved.
+Check the **Don't display this page the next time** box to hide the Welcome page. The wizard saves
+this setting with your configuration changes.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/results.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/results.md
index d8db50e71d..b65fcb9104 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/results.md
@@ -6,12 +6,13 @@ sidebar_position: 140
# SPAA: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for all
+Use the Results page to select the properties to gather. It's a wizard page for all
of the categories.
-Properties can be checked individually, or the **Select All**and **Clear All** buttons can be used.
-All checked properties are gathered. Available properties vary based on the category selected. This
-information is not available within the standard reference tables. Instead, this information can be
-viewed in the table created by the query task, for example SA_1-SPAA_SystemScans_Access table.
+Check properties individually, or use the **Select All** and **Clear All** buttons.
+Enterprise Auditor gathers all checked properties. Available properties vary based on the category
+selected. This information isn't available within the standard reference tables. Instead, you can
+view this information in the table created by the query task, for example the
+SA_1-SPAA_SystemScans_Access table.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/scanscopingoptions.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/scanscopingoptions.md
index 68d1862708..2e72ee88ec 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/scanscopingoptions.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/scanscopingoptions.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# SPAA: Scan Scoping Options
-The Scan Scoping Options page provides scoping options to specify the list of URLs to be scanned. It
+The Scan Scoping Options page provides scoping options to specify the list of URLs to scan. It
is a wizard page for the categories of:
- Scan SharePoint Access
@@ -24,19 +24,19 @@ The options on the Scan Scoping Options page are:
topic for additional information.
:::note
- If sites are included in the Scope box, all other sites are excluded from the scan.
+ If you include sites in the Scope box, the scan excludes all other sites.
:::
- Import CSV – Opens a file explorer to browse for a CSV file
- Scope box – Lists all added URLs
-- Scope drop-down list – Select include to include a URL in the scan. Select exclude to exclude a
+- Scope dropdown list – Select include to include a URL in the scan. Select exclude to exclude a
URL from the scan.
- Remove – Removes the selected URL from the Scope box
## Scoping to SharePoint Host Named Site Collections
-In order to scope to objects within host named site collections, add a scope line which includes the
+to scope to objects within host named site collections, add a scope line which includes the
URL of the web application containing the host named site collection. To scope the host named site
collection URL `http://sample.com/documents/` for a host named site collection that exists under the
web application URL `http://example.com`, follow the steps:
@@ -56,17 +56,17 @@ the HNSCs. Click **Add**.
-**Step 4 –** The Web App URL must appear above the HNSC URL, as depicted in the example above.
+**Step 4 –** The Web App URL must appear above the HNSC URL, as depicted in the preceding example.
**Step 5 –** The SharePoint Access Auditor Data Collector Wizard is now configured to filter for the
URL inside the SharePoint Host Named Site Collections.
## Virtual Hosts
-In order to decrease the scan time in large SharePoint Online environments, it is possible to break
+To decrease the scan time in large SharePoint Online environments, you can break
Site Collections for a single host down into subsets, or **Virtual Hosts**, that are treated as
-separate hosts by Enterprise Auditor. This allows multiple scans of a single host to be run
-concurrently. Follow the steps to configure this.
+separate hosts by Enterprise Auditor. This allows multiple scans of a single host to run
+concurrently. To configure this:
@@ -96,8 +96,8 @@ will also see a separate line on the Running Instances tab for each Virtual Host
scan.
:::note
-The Host List for Bulk Import should be configured to contain each Virtual Host included
-in the above scan using the `HOSTNAME#DESIGNATOR` format. After Bulk Import, the data contained in
-Tier 1 Database tables and views will resemble a scan run against multiple hosts.
+Configure the Host List for Bulk Import to contain each Virtual Host included
+in the preceding scan, using the `HOSTNAME#DESIGNATOR` format. After Bulk Import, the data contained
+in Tier 1 Database tables and views resembles a scan run against multiple hosts.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/selectdlpcriteria.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/selectdlpcriteria.md
index b2ee467545..7c798c8c34 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/selectdlpcriteria.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/selectdlpcriteria.md
@@ -6,19 +6,19 @@ sidebar_position: 100
# SPAA: Select DLP Criteria
-The Select Criteria page is where criteria to be used for discovering sensitive data are configured.
-It is a wizard page for the category of Scan For Sensitive Content. This page requires the Sensitive
-Data Discovery Add-On to be been installed on the Enterprise Auditor Console to define the criteria
-and enable the Criteria Editor. If the SharePoint Agent is used, then it must also be installed on
+Use the Select Criteria page to configure the criteria for discovering sensitive data.
+It's a wizard page for the category of Scan For Sensitive Content. This page requires you to
+install the Sensitive Data Discovery Add-On on the Enterprise Auditor Console to define the criteria
+and enable the Criteria Editor. If you use the SharePoint Agent, you must also install it on
the application server that hosts the Central Administration component. See the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
topic for additional information.
:::warning
-Users should not change scans in a way that would result in less data being returned on
-a subsequent scan (i.e. scanning fewer web applications, scanning fewer site collections, or a
-shallower depth scan). Those resources not included in a subsequent scan are marked as deleted in
-the Tier 2 database and subsequently removed from the Tier 1 database.
+Don't change scans in a way that results in a subsequent scan returning less data (for example,
+scanning fewer web applications, scanning fewer site collections, or using a shallower depth scan).
+Enterprise Auditor marks resources not included in a subsequent scan as deleted in the Tier 2
+database and subsequently removes them from the Tier 1 database.
:::
@@ -34,8 +34,8 @@ The options on the Select DLP Criteria page are:
data criteria to scan for
- Select All - Click **Select All** to enable all sensitive data criteria for scanning
- Clear All - Click **Clear All** to remove all selections from the table
-- Check the boxes next to the sensitive data criteria options to enable it to be scanned for during
- job execution
+- Check the boxes next to the sensitive data criteria options to enable the query to scan for them
+ during job execution
The table contains the following types of criteria:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/settings.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/settings.md
index af9a25ea5e..52a3654bf3 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/settings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/settings.md
@@ -6,51 +6,52 @@ sidebar_position: 40
# SPAA: SharePoint Data Collection Settings
-The SharePoint data collection settings page is where additional scan settings are configured. It is
+Use the SharePoint data collection settings page to configure additional scan settings. It's
a wizard page for the categories of:
- Scan SharePoint Access
- Scan For Sensitive Content
:::warning
-Users should not change scans in a way that would result in less data being returned on
-a subsequent scan (i.e. scanning fewer web applications, scanning fewer site collections, or a
-shallower depth scan). Those resources not included in a subsequent scan are marked as deleted in
-the Tier 2 database and subsequently removed from the Tier 1 database.
+Don't change scans in a way that results in a subsequent scan returning less data (for example,
+scanning fewer web applications, scanning fewer site collections, or using a shallower depth scan).
+Enterprise Auditor marks resources not included in a subsequent scan as deleted in the Tier 2
+database and subsequently removes them from the Tier 1 database.
:::
-The Probable Owners section provides options for how probable ownership will be calculated:
+The Probable Owners section provides options for how Enterprise Auditor calculates probable
+ownership:
- Limit maximum number of Probable Owners per resource: [number] – Return the maximum user supplied
number of probable owners per resource
The Collect Personal Sites checkbox enables or disables collection during the scan of personal site
-collections of individual users. Personal site collections are a SharePoint feature which gives
-every user their own site collection, and which are used by Office 365 to store a user’s OneDrive
-files. Personal sites are configured by default to only be accessible by the user to whom they
-belong, and so it is likely that the Connection Profile that the data collector is assigned may not
-have access to some users’ personal sites. There are three radio buttons for identifying how the
-query treats personal sites to which it does not have access:
-
-- Skip inaccessible personal sites – Inaccessible personal sites are not scanned
+collections of individual users. Personal site collections are a SharePoint feature that gives
+every user their own site collection, and Office 365 uses them to store a user's OneDrive
+files. By default, only the user to whom a personal site belongs can access it, so the Connection
+Profile that the data collector is assigned may not have access to some users' personal sites. There
+are three radio buttons for identifying how the
+query treats personal sites to which it doesn't have access:
+
+- Skip inaccessible personal sites – The query doesn't scan inaccessible personal sites
- Force scan account as admin of inaccessible personal sites – Make the Connection Profile
- credentials a Site Collection Administrator of any personal sites to which it does not have
+ credentials a Site Collection Administrator of any personal sites to which it doesn't have
access:
- - The personal sites will be scanned
- - When the scan is complete, the permissions are restored to what they were prior to the scan,
- referring to those credentials made a Site Collection Administrator of personal sites in order
- to conduct the scan.
+ - The query scans the personal sites
+ - When the scan is complete, Enterprise Auditor restores the permissions to what they were
+ before the scan, referring to those credentials made a Site Collection Administrator of
+ personal sites to conduct the scan.
- Requires the account used in the Connection Profile credentials to have the Global
Administrator role for SharePoint Online or be a Farm Administrator for SharePoint on premise.
This permission is required to facilitate altering the administrators of site collections.
:::note
- The Microsoft SharePoint API employed to remove personal Site Collection
- Administrator is unreliable, and occasionally the scanning account is left as a Site
+ The Microsoft SharePoint API used to remove personal Site Collection
+ Administrator access is unreliable and occasionally leaves the scanning account as a Site
Collection Administrator of personal sites. This may leave the scanning account visible to
SharePoint users on the permissions of the files in their personal sites.
:::
@@ -58,17 +59,17 @@ query treats personal sites to which it does not have access:
:::info
Only use this option if that account is clearly identifiable as an
- administrative account, and users are advised of the possibility that the account could
- appear on the permissions of their personal site collection documents.
+ administrative account, and advise users that the account could appear on the permissions
+ of their personal site collection documents.
:::
- Force Company Administrator as admin of inaccessible personal sites – Make the special Company
- Administrator account an administrator of any personal sites to which it does not have access
+ Administrator account an administrator of any personal sites to which it doesn't have access
- - The personal sites will be scanned
- - When the scan is complete, the Company Administrator account is left as an administrator of
- the users’ personal site collections
+ - The query scans the personal sites
+ - When the scan is complete, the Company Administrator account remains an administrator of
+ the users' personal site collections
- Requires the account used in the Connection Profile credentials to have the Global
Administrator role for SharePoint Online or be a Farm Administrator for SharePoint on premise.
This permission is required to facilitate altering the administrators of site collections.
@@ -80,11 +81,11 @@ query treats personal sites to which it does not have access:
The **Extract Document Tags** option enables the collection of metadata tags from Microsoft Office
-files in SharePoint. Since this option requires the retrieval and scanning of each document, it
+files in SharePoint. Since this option requires retrieving and scanning each document, it
results in a noticeable increase in scan time.
-- Select a preferred zone – Use the drop-down list to select a preferred zone within the web
- application to target the scan. If a targeted web application does not have the selected preferred
+- Select a preferred zone – Use the dropdown list to select a preferred zone within the web
+ application to target the scan. If a targeted web application doesn't have the selected preferred
zone, the scan targets the default zone for that web application. Options include:
- Default
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/standardtables.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/standardtables.md
index 603a9528c6..9a49fe2dd2 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/standardtables.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/standardtables.md
@@ -30,7 +30,7 @@ The tables and their associated views are grouped by types.
| Tables | Details |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SA_SPAA_Trustees | Contains information about any domain user, group, or security principal that has been assigned permissions. This table does not contain local user and groups, as none of the trustees in this table are specific to any one host. |
+| SA_SPAA_Trustees | Contains information about any domain user, group, or security principal that has been assigned permissions. This table doesn't contain local user and groups, as none of the trustees in this table are specific to any one host. |
| SA_SPAA_TrusteeGroupMembers | Table contains information on SharePoint group membership. |
**Access Calculation Tables**
@@ -46,7 +46,7 @@ The tables and their associated views are grouped by types.
| Tables | Details |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SA_SPAA_Exceptions | Contains information about security issues and concerns. One out-of-the-box exception stored inside this table is the Open Resource exception, which identifies where resources are open to Everyone, Authenticated Users, or Domain Users. |
+| SA_SPAA_Exceptions | Contains information about security issues and concerns. One built-in exception stored inside this table is the Open Resource exception, which identifies where resources are open to Everyone, Authenticated Users, or Domain Users. |
| SA_SPAA_ExceptionTypes | Contains summary information about exceptions. It details how many exceptions are found on each host scanned and breaks them down by exception type. |
**Content Tables**
@@ -59,7 +59,7 @@ The tables and their associated views are grouped by types.
| SA_SPAA_Tags | Contains the individual tags which were found in documents. |
Views are the recommended way for Enterprise Auditor users to obtain the information gathered by
-the SPAA Data Collector. They contain additional information for building queries easily. The
+the SPAA Data Collector. They contain additional information for building queries. The
following is an explanation of the corresponding views created for some of the tables generated by
the SPAA Data Collector:
@@ -111,7 +111,7 @@ The tables and their associated views are:
| SA_SPAC_EventNames | Contains a list of SharePoint event names, their IDs, and a description of each event. |
Views are the recommended way for Enterprise Auditor users to obtain the information gathered by the
-SPAA Data Collector. They contain additional information for building queries easily. The following
+SPAA Data Collector. They contain additional information for building queries. The following
is an explanation of the corresponding views created for some of the tables generated by the SPAA
Data Collector:
@@ -139,7 +139,7 @@ Lists and libraries are excluded from Sensitive Data Discovery Auditing.
| SA_SPDLP_MatchHits | Contains the actual sensitive data within files that matched selected criteria. For example, if the credit card criteria is used, this table will contain the potential credit card numbers identified within each files with hits. |
Views are the recommended way for Enterprise Auditor users to obtain the information gathered by the
-SPAA Data Collector. They contain additional information for building queries easily. The following
+SPAA Data Collector. They contain additional information for building queries. The following
is an explanation of the corresponding views created for some of the tables generated by the SPAA
Data Collector:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/summary.md
index bcf573f3be..3ff75a4218 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/summary.md
@@ -11,6 +11,6 @@ categories.
**-**
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the SharePoint Access Auditor Data Collector Wizard ensuring that no
-accidental clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the SharePoint Access Auditor Data Collector Wizard instead. This prevents the wizard from saving
+accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/spaa/testaccess.md b/docs/accessanalyzer/11.6/admin/datacollector/spaa/testaccess.md
index ec8d45dc04..0ec0da31dc 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/spaa/testaccess.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/spaa/testaccess.md
@@ -22,12 +22,12 @@ The options and sections on the Test Access page are:
Server text box. Click **Check Access** to test access to the SharePoint environment.
- For example – `sbnjqasp30` or `sbnjqasp3.qa.com`
- - Do not include `http[s]://` or use a URL for the server name. The Test Access function cannot
- be scoped to individual Web applications.
+ - Don't include `http[s]://` or use a URL for the server name. You can't scope the Test
+ Access function to individual Web applications.
- Access Test Results – Displays information on test results. Test criteria are listed in the
- **Description** column. Test results will be returned as either **Pass** or **Fail** in the
- Results column.
+ **Description** column. The Test Access page returns test results as either **Pass** or **Fail**
+ in the Results column.
- Save Report – Click **Save Report** to export and save a text version of the test results
| | |
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/sql/category.md b/docs/accessanalyzer/11.6/admin/datacollector/sql/category.md
index 61c462800e..909873c070 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/sql/category.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/sql/category.md
@@ -26,8 +26,8 @@ The query categories are:
- Sensitive Data Collection – Scan databases for sensitive data
:::note
- The Sensitive Data category options require the Sensitive Data Discovery Add-on to
- have been installed on the Enterprise Auditor Console before the SQL Data Collector can collect
+ The Sensitive Data category options require you to install the Sensitive Data Discovery Add-on
+ on the Enterprise Auditor Console before the SQL Data Collector can collect
sensitive data. See the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
topic for additional information.
@@ -100,7 +100,7 @@ The query categories are:
- Latest Week Backup – Information about the latest week backup
- Oldest and Newest Backup – Information about the oldest and the most recent backups
- - Database File Without Backup – Indicates file names of the files that are not present in
+ - Database File Without Backup – Indicates file names of the files that aren't present in
the RMAN backup
- Utilities
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/sql/configurejob.md b/docs/accessanalyzer/11.6/admin/datacollector/sql/configurejob.md
index 113c0393a2..855b3f62b2 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/sql/configurejob.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/sql/configurejob.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# SQL Custom Connection Profile & Default Dynamic Host List
-The SQL Data Collector requires a custom Connection Profile and Host List. The **SQL SERVERS**
-default host list can be used with this data collector for the SQL Solution. The host inventory
+The SQL Data Collector requires a custom Connection Profile and Host List. You can use the
+**SQL SERVERS** default host list with this data collector for the SQL Solution. The host inventory
option during host list creation makes it necessary to configure the Connection Profile first.
## Connection Profile
@@ -17,10 +17,10 @@ Create a Connection Profile and set the following information on the User Creden
- For an Active Directory account:
- Select Account Type – Active Directory Account
- - Domain – Drop-down menu with available trusted domains will appear. Either type the short
+ - Domain – dropdown menu with available trusted domains will appear. Either enter the short
domain name in the textbox or select a domain from the menu.
- - User name – Type the user name
- - Password Storage – Choose the desired option for credential password storage:
+ - User name – Enter the user name
+ - Password Storage – Choose the option you want for credential password storage:
- Application – Uses the configured Profile Security setting as selected at the
**Settings** > **Application** node. See the
@@ -28,11 +28,11 @@ Create a Connection Profile and set the following information on the User Creden
topic for additional information.
- CyberArk – Uses the CyberArk Enterprise Password Vault. See the
[CyberArk Integration](/docs/accessanalyzer/11.6/admin/settings/connection/cyberarkintegration.md)
- topic for additional information. The password fields do not apply for CyberArk password
+ topic for additional information. The password fields don't apply for CyberArk password
storage.
- - Password – Type the password
- - Confirm – Re-type the password
+ - Password – Enter the password
+ - Confirm – Re-enter the password
- For a SQL account:
@@ -42,8 +42,8 @@ Create a Connection Profile and set the following information on the User Creden
the **Settings** > **Application** node. See the
[Application](/docs/accessanalyzer/11.6/admin/settings/application/overview.md)
topic for additional information.)
- - Password – Type the password
- - Confirm – Re-type the password
+ - Password – Enter the password
+ - Confirm – Re-enter the password
See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
@@ -51,27 +51,28 @@ topic for additional information.
## Host List
-The required host list depends on the database that the SQL data collector is being used for.
+The required host list depends on the database for which you're using the SQL data collector.
### Default Dynamic Host List (SQL)
Jobs using the SQL Data Collector can use the SQL Servers default host list. This is a dynamic host
-list that is populated from hosts in the Host Master Table which meet the host inventory criteria
-for the list, `IsSQLServer = True`. Since the SQL Servers host list is default, it is available to
+list that Enterprise Auditor populates from hosts in the Host Master Table that meet the host
+inventory criteria for the list, `IsSQLServer = True`. Since the SQL Servers host list is default,
+it is available to
jobs and job groups for host assignment. See the
[Host Management](/docs/accessanalyzer/11.6/admin/hostmanagement/overview.md)
topic for additional information.
### Oracle / MySQL / PostgreSQL / Db2
-Jobs in the Oracle, MySQL, Postgre SQL, or Db2 solution using the SQL Data Collector must be
-configured to query a host list with the servers containing the target databases. Setup the list of
-hosts that needs to be monitored. Be sure to use a specific host name (if forcing the connection to
+You must configure jobs in the Oracle, MySQL, Postgre SQL, or Db2 solution that use the SQL Data
+Collector to query a host list with the servers containing the target databases. Set up the list of
+hosts you need to monitor. Be sure to use a specific host name (if forcing the connection to
a secondary host) or just the server name if connecting to the server. See the
[Host Management](/docs/accessanalyzer/11.6/admin/hostmanagement/overview.md)
topic for additional information.
-Additionally, the database instances must be added to the Filter page in the query configuration.
+Additionally, you must add the database instances to the Filter page in the query configuration.
See the
[SQL: Filter](/docs/accessanalyzer/11.6/admin/datacollector/sql/filter.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/sql/criteria.md b/docs/accessanalyzer/11.6/admin/datacollector/sql/criteria.md
index 9afa0ffc98..f7e87e8589 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/sql/criteria.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/sql/criteria.md
@@ -6,10 +6,10 @@ sidebar_position: 40
# SQL: Criteria
-The Criteria page is where criteria to be used for discovering sensitive data are configured. It is
+Use the Criteria page to configure the criteria for discovering sensitive data. It's
a wizard page for the Sensitive Data Collection category.
-This page requires the Sensitive Data Discovery Add-On to be installed on the Enterprise Auditor
+This page requires you to install the Sensitive Data Discovery Add-On on the Enterprise Auditor
Console to define the criteria and enable the Criteria Editor. See the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
topic for additional information.
@@ -27,8 +27,8 @@ The options on the Criteria page are:
- Select All– Click **Select All** to enable all sensitive data criteria for scanning
- Clear All – Click **Clear All** to remove all selections from the table
- - Select the checkboxes next to the sensitive data criteria options to enable it to be scanned
- for during job execution
+ - Select the checkboxes next to the sensitive data criteria options to enable the query to scan
+ for them during job execution
The table contains the following types of criteria:
@@ -48,7 +48,7 @@ Criteria and User Criteria nodes are visible in the table.
:::note
Adding unnecessary criteria can adversely impact the scanner performance and can cause the
-scanning job to take a long time. If performance is adversely affected, revisit the sensitive data
-scanning criteria and remove criteria that is not required.
+scanning job to take a long time. If unnecessary criteria adversely affect performance, revisit the
+sensitive data scanning criteria and remove criteria that isn't required.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/sql/customqueryoracle.md b/docs/accessanalyzer/11.6/admin/datacollector/sql/customqueryoracle.md
index 5a8cfa00b3..61fb085415 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/sql/customqueryoracle.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/sql/customqueryoracle.md
@@ -16,8 +16,8 @@ The configurable options are:
- Test Database:
- - Data Source – Select the host\instance from the drop-down menu
- - Database – Select the database from the drop-down menu
+ - Data Source – Select the host\instance from the dropdown menu
+ - Database – Select the database from the dropdown menu
- Convert CDB to DBA on non-container databases
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/sql/customquerysql.md b/docs/accessanalyzer/11.6/admin/datacollector/sql/customquerysql.md
index 13d2a62dbc..d151d50a34 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/sql/customquerysql.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/sql/customquerysql.md
@@ -20,8 +20,8 @@ The configurable options are:
- Test Database:
- - Data Source – Select the host\instance from the drop-down menu
- - Database – Select the database from the drop-down menu
+ - Data Source – Select the host\instance from the dropdown menu
+ - Database – Select the database from the dropdown menu
- SQL Query textbox – Enter the custom SQL script
- Validate Query – Click to test the query, results display in the box
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/sql/filter.md b/docs/accessanalyzer/11.6/admin/datacollector/sql/filter.md
index 74144f6a52..9615661ea4 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/sql/filter.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/sql/filter.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# SQL: Filter
-The Filter page is where the query can be scoped to target specific databases or instances. It is a
+Use the Filter page to scope the query to target specific databases or instances. It's a
wizard page for the categories of:
- Permissions > Permissions Collection
@@ -46,14 +46,14 @@ wizard page for the categories of:
- Utilities – Remove Storage Data
-It is necessary for the SA_SQL_Instances table to be populated before available databases/instances
-can populate the Available Server audits list. For Oracle and SQL, the SA_SQL_Instances table is
-populated through an instance discovery query. See the
+You must populate the SA_SQL_Instances table before available databases/instances can populate the
+Available Server audits list. For Oracle and SQL, an instance discovery query populates the
+SA_SQL_Instances table. See the
[0-SQL_InstanceDiscovery Job](/docs/accessanalyzer/11.6/solutions/databases/sql/collection/0-sql_instancediscovery.md)
-topic for additional information. For PostgreSQL and MySQL Scans, the SA_SQL_Instances table is
-populated manually in the Manage Connections window. See the
-[Manage Connections Window](#manage-connections-window) topic for additional information. Once the
-table has been populated, a query can be scoped.
+topic for additional information. For PostgreSQL and MySQL scans, you populate the
+SA_SQL_Instances table manually in the Manage Connections window. See the
+[Manage Connections Window](#manage-connections-window) topic for additional information. After you
+populate the table, you can scope a query.
@@ -72,13 +72,13 @@ The configurable filter options are:
- Select from the available list and click **Add**
-- Selected databases or instances — Displays selected database objects for which the query has been
- scoped. Additional options include:
+- Selected databases or instances — Displays selected database objects the query is scoped to.
+ Additional options include:
- Remove — Removes the selected database/instance from the query
- Include — Reverts an exclusion. By default, all sub tables are included.
- Exclude — Excludes selected databases/instances and displays them in red
- - Add Custom Filter — Opens the Add custom filter window to build a custom filter to be applied
+ - Add Custom Filter — Opens the Add custom filter window to build a custom filter to apply
to the selected databases/instances. See the
[Add Custom Filter Window](#add-custom-filter-window) topic for additional information.
- Import CSV — Import a list of databases/instances from a CSV file
@@ -86,7 +86,7 @@ The configurable filter options are:
## Manage Connections Window
-The Manage Connections window enables you to add database instances to search. Click the
+Use the Manage Connections window to add database instances to search. Click the
**Connections** button to open it.
@@ -99,8 +99,8 @@ Select a row in the table to edit that instance, or create a new instance to add
- Database System — Select from a list of available databases
- Service Name — Name of the service
- Host — Name or IP address of the host where the database is located
-- Port Number — Port number for the database. If a non-default port is being used, it should be
- specified in the Port Number section.
+- Port Number — Port number for the database. If you use a non-default port, specify it in the
+ Port Number section.
- Default Database — Account used to access the database. Admin is recommended.
- Enable impersonation — Select to enable impersonation
- Service Type— If applicable, select whether the service type is **Service** or **SID**
@@ -127,7 +127,7 @@ you to apply a custom scoping filter to the query.
-Type the filter in the window and click Save. The following characters can be used in the filter:
+Enter the filter in the window and click Save. You can use the following characters in the filter:
- Forward slash (/) – Path separator
- Asterisk (\*) – Wild card for any combination of characters
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/sql/options.md b/docs/accessanalyzer/11.6/admin/datacollector/sql/options.md
index 340fc17edf..1eb7d78ebc 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/sql/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/sql/options.md
@@ -76,11 +76,12 @@ The sensitive data scan settings are:
**SDD Options**
- Store discovered sensitive data – Stores potentially sensitive data in the Enterprise Auditor
- database. Any sampled sensitive data discovered based on the matched criteria is stored in the
- Enterprise Auditor database. This functionality can be disabled by clearing this option.
+ database. Enterprise Auditor stores any sampled sensitive data discovered based on the matched
+ criteria in the Enterprise Auditor database. You can disable this functionality by clearing this
+ option.
:::note
- The **Store discovered sensitive data** option is required to view Content Audit
+ You must enable the **Store discovered sensitive data** option to view Content Audit
reports in the Access Information Center for SQL data.
:::
@@ -91,10 +92,9 @@ The sensitive data scan settings are:
:::
-- Resume scan from last point on error – Resumes scan from where the previous scan left off when the
- previous scan was stopped as a result of an error
+- Resume scan from last point on error – Resumes scan from where the previous scan left off if an
+ error stopped the previous scan
:::tip
-Remember, the Sensitive Data Discovery Add-on is required to use the sensitive data collection
-option.
+Remember, using the sensitive data collection option requires the Sensitive Data Discovery Add-on.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/sql/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/sql/overview.md
index 69cbc51c77..122a1ef6ad 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/sql/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/sql/overview.md
@@ -11,9 +11,9 @@ application name of the application responsible for activity events, an IP Addre
the client server, and sensitive data reports. This data collector also provides information on
Oracle databases including infrastructure and operations.
-The SQL Data Collector has been preconfigured within the Database data collection jobs for Db2,
-MySQL, Oracle, PostgreSQL, Redshift, and SQL Server databases. Both this data collector and the
-Database Solution are available with a special Enterprise Auditor license. See the following topics
+The Database data collection jobs for Db2, MySQL, Oracle, PostgreSQL, Redshift, and SQL Server
+databases include the SQL Data Collector as a preconfigured component. Both this data collector
+and the Database Solution are available with a special Enterprise Auditor license. See the following topics
for additional information:
- [Db2 Solution](/docs/accessanalyzer/11.6/solutions/databases/db2/overview.md)
@@ -84,8 +84,8 @@ For SQL:
- For permissions for data collection:
- Read access to SQL instance
- - Requires SQL Full-Text and Semantic Extractions for Search feature to be installed on the
- target SQL instance(s) when using the **Scan full rows for sensitive data** option on the
+ - Requires you to install the SQL Full-Text and Semantic Extractions for Search feature on the
+ target SQL instances when using the **Scan full rows for sensitive data** option on the
Options wizard page
- Grant Authenticate Server to [DOMAIN\USER]
- Grant Connect SQL to [DOMAIN\USER]
@@ -102,11 +102,11 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
-then an extra 16 GB of RAM are required (8x2=16).
+You must install the Sensitive Data Discovery Add-On on the Enterprise Auditor Console server,
+which enables Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans,
+you must increase the minimum amount of RAM. Each thread requires a minimum of 2
+additional GB of RAM per host. For example, if you configure the job to scan 8 hosts at a time,
+you need an extra 16 GB of RAM (8x2=16).
## SQL Query Configuration
@@ -114,8 +114,8 @@ The SQL Data Collector is configured through the SQL Data Collector Wizard. The
following pages, which change based upon the query category selected:
:::note
-The SQL Data Collector is used in multiple Enterprise Auditor Solutions, and the query
-categories used are dependent on the solution.
+Enterprise Auditor uses the SQL Data Collector in multiple Solutions, and the query
+categories used depend on the solution.
:::
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/sql/results.md b/docs/accessanalyzer/11.6/admin/datacollector/sql/results.md
index 5340fcf494..a5053b6e51 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/sql/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/sql/results.md
@@ -6,11 +6,11 @@ sidebar_position: 90
# SQL: Results
-The Results page is where the properties that will be gathered are selected. It is a wizard page for
+Use the Results page to select the properties to gather. It's a wizard page for
all of the categories.
-Properties can be selected individually, or the **Select All** and **Clear All** buttons can be
-used. All selected properties are gathered. Available properties vary based on the category
+Select properties individually, or use the **Select All** and **Clear All** buttons.
+Enterprise Auditor gathers all selected properties. Available properties vary based on the category
selected.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/sql/rowkey.md b/docs/accessanalyzer/11.6/admin/datacollector/sql/rowkey.md
index 6d2b828a31..eb1b09b65e 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/sql/rowkey.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/sql/rowkey.md
@@ -11,6 +11,6 @@ categories.
-Properties selected on the Results page are listed. Select the property or properties to act as the
-Rowkey. Properties can be selected individually, or the **Select All** and **Clear All** buttons can
-be used.
+The Rowkey page lists the properties selected on the Results page. Select the property or
+properties to act as the Rowkey. Select properties individually, or use the **Select All** and
+**Clear All** buttons.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/sql/settings.md b/docs/accessanalyzer/11.6/admin/datacollector/sql/settings.md
index 88fa35bb0e..6dda0c7131 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/sql/settings.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/sql/settings.md
@@ -11,7 +11,7 @@ instances. It is a wizard page for the category of Utilities.
-Data from the selected categories will be removed from the Enterprise Auditor database:
+Enterprise Auditor removes data from the selected categories:
- Permissions
- Audits
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/sql/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/sql/summary.md
index f64e2de89e..17de9a7ccf 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/sql/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/sql/summary.md
@@ -11,6 +11,5 @@ the categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the SQL Data Collector Wizard ensuring that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the SQL Data Collector Wizard instead. This prevents the wizard from saving accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/filetypes.md b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/filetypes.md
index 7cc778c6d7..d6fe2c100f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/filetypes.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/filetypes.md
@@ -6,9 +6,9 @@ sidebar_position: 70
# SystemInfo: File Types
-The File Types page is where to enable count file types and specify filename masks if it is desired
-to count files of given types. Two properties are generated for every mask provided, one for size
-and one for count. It is a wizard page for the category of File Shares.
+The File Types page is where you enable counting file types and specify filename masks if you want
+to count files of given types. Enterprise Auditor generates two properties for every mask provided,
+one for size and one for count. It's a wizard page for the category of File Shares.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/jobscope.md b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/jobscope.md
index 3f9ecb0414..a4b4ce07c9 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/jobscope.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/jobscope.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# SystemInfo: Job Scope
-The Job Scope page is where to select whether or not scoping should be used during execution. It is
+The Job Scope page is where you select whether to use scoping during execution. It's
a wizard page for the category of File Shares.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/options.md b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/options.md
index 43caa5f70f..b0f83752ae 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/options.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/options.md
@@ -26,11 +26,11 @@ For the File Shares and Open File Shares categories:
Select from the following options to control the depth of processing and the amount of information
-to be returned by the query:
+the query returns:
- Include file level permissions
- - Do not collect inherited file permissions
+ - Don't collect inherited file permissions
- Return All Folders
@@ -38,7 +38,7 @@ to be returned by the query:
- Limit returned subfolders depth to – Specify the number of levels
-- Size units for corresponding properties – Select the desired size unit:
+- Size units for corresponding properties – Select the size unit you want:
- Bytes
- KBytes
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/overview.md
index a65e6d7d40..9ba25f0ca0 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/overview.md
@@ -7,8 +7,9 @@ sidebar_position: 360
# SystemInfo Data Collector
The SystemInfo Data Collector extracts information from the target system based on the selected
-category. The SystemInfo Data Collector is a core component of Enterprise Auditor, but it has been
-preconfigured within the Windows Solution. While the data collector is available with all Enterprise
+category. The SystemInfo Data Collector is a core component of Enterprise Auditor, and the Windows
+Solution includes it as a preconfigured component. While the data collector is available with all
+Enterprise
Auditor license options, the Windows Solution is only available with a special Enterprise Auditor
license. See the
[Windows Solution](/docs/accessanalyzer/11.6/solutions/windows/overview.md)
@@ -46,5 +47,5 @@ contains the following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+Select the **Don't display this page the next time** checkbox to hide the Welcome page. The wizard
+saves this setting with your configuration changes.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/probableowner.md b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/probableowner.md
index 842a0717df..2830bc7a92 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/probableowner.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/probableowner.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# SystemInfo: Probable Owner
On the Probable Owner page, select options for determining the owner using weighted calculations.
-This page is enabled when the **Probable Owner** property is selected on the Results page.
+This page becomes available when you select the **Probable Owner** property on the Results page.
@@ -20,7 +20,7 @@ In the Determine owner section, select from the following options:
- Determine owner from Current User
- Determine owner from Last User
- Custom weights – Select this radio button to use custom weights to determine the probable owner.
- These weights can be set by clicking the ellipsis next to the Result weights box to open the
+ You can set these weights by clicking the ellipsis next to the Result weights box to open the
Probable Owner Settings window.
@@ -52,7 +52,7 @@ Click **Set Users to Exclude** to open the Probable Owner Settings window:
In the Output options section, select from the following options:
-- Get the most probable owner(s)
+- Get the most probable owners
- Get probable owners with relative deviation to the most probable owner – Enables the following
option:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/results.md b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/results.md
index 52822df5ac..f544e9c63a 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/results.md
@@ -6,11 +6,11 @@ sidebar_position: 20
# SystemInfo: Results
-The Results page is used to select which properties are gathered out of those available for the
-category. It is a wizard page for all categories.
+Use the Results page to select which properties to gather from those available for the category.
+It's a wizard page for all categories.
-Properties can be selected individually or the **Check all**, **Uncheck all**, and **Reset to
-defaults** buttons can be used. All selected properties are gathered. Available properties vary
-based on the category selected.
+Select properties individually, or use the **Check all**, **Uncheck all**, and **Reset to
+defaults** buttons. Enterprise Auditor gathers all selected properties. Available properties vary
+based on the selected category.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/summary.md
index 10bb545f7b..b0f8f779e2 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/summary.md
@@ -10,6 +10,6 @@ The Summary page displays a summary of the configured query. It is a wizard page
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the System Info Data Collector Wizard ensuring that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the System Info Data Collector Wizard instead. This prevents the wizard from saving accidental
+clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/vipmembership.md b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/vipmembership.md
index 8bedcd8af3..5eec9acea9 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/vipmembership.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/vipmembership.md
@@ -7,8 +7,8 @@ sidebar_position: 50
# SystemInfo: VIP Membership
The VIP Membership provides the option to add members to a VIP List and exclude them from contact
-about probable ownership. Any users can be added to VIP membership. This page is enabled when the
-VIPList property is selected on the Results page.
+about probable ownership. You can add any users to VIP membership. This page becomes available when
+you select the VIPList property on the Results page.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/textsearch/advancedcriteria.md b/docs/accessanalyzer/11.6/admin/datacollector/textsearch/advancedcriteria.md
index 8b925f069e..d7f18993e8 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/textsearch/advancedcriteria.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/textsearch/advancedcriteria.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# TextSearch: Advanced Criteria
-The Advanced Criteria page is displayed if the **Use advanced criteria (instead of simple
-criteria)** checkbox is selected on the Search Criteria page. This page provides configuration
+The Advanced Criteria page displays if you select the **Use advanced criteria (instead of simple
+criteria)** checkbox on the Search Criteria page. This page provides configuration
options to specify the text to search for across the entire row of each file or within the specified
column in each row.
@@ -17,8 +17,8 @@ The configurable options are:
- Return Multiple Columns – Return data values in multiple columns
- Load Sample Data – Click this button to browse for sample data to test the filters entered. If the
- sample data file is large, it is recommended to sample an excerpt of the file to reduce the amount
- of time it takes to load the data.
+ sample data file is large, sample an excerpt of the file to reduce the time it takes to load the
+ data.
- Customize – Click this button to open the Filter builder
@@ -27,4 +27,4 @@ The configurable options are:
[Filtration Dialog](/docs/accessanalyzer/11.6/admin/navigate/datagrid.md#filtration-dialog)
topic for information on using the Filter builder.
-The filter section cannot be blank.
+The filter section can't be blank.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/textsearch/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/textsearch/overview.md
index e88a8d5970..d0078f321f 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/textsearch/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/textsearch/overview.md
@@ -7,8 +7,9 @@ sidebar_position: 370
# TextSearch Data Collector
The TextSearch Data Collector enables searches through text based log files. The TextSearch Data
-Collector is a core component of Enterprise Auditor, but it has been preconfigured within the
-Windows Solution. While the data collector is available with all Enterprise Auditor license options,
+Collector is a core component of Enterprise Auditor, and the Windows Solution includes it as a
+preconfigured component. While the data collector is available with all Enterprise Auditor license
+options,
the Windows Solution is only available with a special Enterprise Auditor license. See the
[Windows Solution](/docs/accessanalyzer/11.6/solutions/windows/overview.md)
topic for additional information.
@@ -40,5 +41,5 @@ contains the following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+Select the **Don't display this page the next time** checkbox to hide the Welcome page. The wizard
+saves this setting with your configuration changes.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/textsearch/results.md b/docs/accessanalyzer/11.6/admin/datacollector/textsearch/results.md
index 2771955a07..d6c4c431fb 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/textsearch/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/textsearch/results.md
@@ -6,13 +6,13 @@ sidebar_position: 40
# TextSearch: Results
-The Results page is where properties that will be gathered are selected.
+Use the Results page to select the properties to gather.
-Properties can be selected individually or the **Check all**, **Uncheck All**, and **Reset to
-Defaults** buttons can be used. All selected properties are gathered. Available properties vary
-based on the category selected.
+Select properties individually, or use the **Check all**, **Uncheck All**, and **Reset to
+Defaults** buttons. Enterprise Auditor gathers all selected properties. Available properties vary
+based on the selected category.
- Size units – Select from the following:
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/textsearch/searchcriteria.md b/docs/accessanalyzer/11.6/admin/datacollector/textsearch/searchcriteria.md
index b0e2162a88..e696535442 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/textsearch/searchcriteria.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/textsearch/searchcriteria.md
@@ -14,8 +14,8 @@ entire row of each file.
The configurable functions are:
- Use advanced criteria (instead of simple criteria) – Select this checkbox to display the Advanced
- Criteria page and configure the search with additional filtering options. Advanced search criteria
- is configured on the Advanced Criteria page. See the
+ Criteria page and configure the search with additional filtering options. Configure advanced
+ search criteria on the Advanced Criteria page. See the
[TextSearch: Advanced Criteria](/docs/accessanalyzer/11.6/admin/datacollector/textsearch/advancedcriteria.md) topic
for additional information.
- Simple Criteria
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/textsearch/sourcefiles.md b/docs/accessanalyzer/11.6/admin/datacollector/textsearch/sourcefiles.md
index 32e311b337..0980b88d27 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/textsearch/sourcefiles.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/textsearch/sourcefiles.md
@@ -21,11 +21,11 @@ The Location section provides options to scope the search.
- Current Job Directory – Search the job’s root folder for the specified file
- Registry Lookup – Select this option to programmatically obtain a file path from a registry key
that exists on the target host in the environment. Click the ellipsis to open the Enterprise
- Auditor Registry Browser and connect to a host to select a registry key and path to be used for
+ Auditor Registry Browser and connect to a host to select a registry key and path to use for
the lookup.
- - Value Name – This value is automatically populated from the registry key
- - Levels – The Levels slider can be used to truncate the path for the key value in the Adjust
+ - Value Name – Enterprise Auditor automatically populates this value from the registry key
+ - Levels – Use the Levels slider to truncate the path for the key value in the Adjust
Path dialog box
- Current value data – Displays the current value for the registry key
- Query 32-bit – Select this checkbox to query a 32-bit view
@@ -37,8 +37,8 @@ The Files section provides options to define the object or set of objects to fin
- File name – Enter file names to search in the following format: `filename.extension`. Separate
multiple file names with a semicolon and no spaces between the names. Wild cards can be used.
-- File type – Select the extension type of the file name entered above to tell the collection
- routine how the data within the underlying file is structured and should be handled:
+- File type – Select the extension type of the file name you entered to tell the collection
+ routine how the data within the underlying file is structured and how to handle it:
- Autodetect – Select this when the data type is unknown. The data collection routine will
attempt to figure out what type of data it is and handle it appropriately.
@@ -48,7 +48,7 @@ The Files section provides options to define the object or set of objects to fin
- Binary
- Space Separated Text
-- First line is header captions line – Enabled when CSV, TSV, or Space Separated Text is selected
+- First line is header captions line – Enabled when you select CSV, TSV, or Space Separated Text
**Options**
@@ -71,13 +71,13 @@ The Last Modification Time Filter section provides options to apply time filters
Clicking the ellipsis in the Location section of the Source Files page opens the Remote Folder
Explorer search window. In the Remote Folder Explorer window, navigate to the file folder location
-and add the path to the scope. Multiple paths can be added to the scope.
+and add the path to the scope. You can add multiple paths to the scope.
The Remote Folder Explorer functions are:
-- Sample from host (path) – If the desired file does not exist on the local Enterprise Auditor
+- Sample from host (path) – If the file you want doesn't exist on the local Enterprise Auditor
Console, enter the name of the host that contains the file and click **Connect** to browse that
host
- Selected Path – Displays the path selected in the box above
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/textsearch/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/textsearch/summary.md
index f00f3d2f7e..9508450a82 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/textsearch/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/textsearch/summary.md
@@ -10,6 +10,6 @@ The Summary page displays a summary of the configured query.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Text Search Data Collector Wizard ensuring that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Text Search Data Collector Wizard instead. This prevents the wizard from saving accidental
+clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/unix/editscript.md b/docs/accessanalyzer/11.6/admin/datacollector/unix/editscript.md
index e42ba648a1..546651a8f9 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/unix/editscript.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/unix/editscript.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Unix: Edit Script
-The Edit Script page allows the script to be customized.
+The Edit Script page lets you customize the script.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/unix/input.md b/docs/accessanalyzer/11.6/admin/datacollector/unix/input.md
index b06b28b3d5..711d167483 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/unix/input.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/unix/input.md
@@ -15,12 +15,12 @@ The configurable options are:
- Use SQL table for scoping input – Select the checkbox to enable scoping options
- Input Table
- - Name – Select the SQL table from the drop-down menu
+ - Name – Select the SQL table from the dropdown menu
- Filter Nulls – Select the checkbox to ignore blank rows in the table
- Filter Duplicates – Select the checkbox to ignore duplicate rows in the table
- Filter by host column – Select the checkbox to sort rows by host
-- Columns – Select the desired rows from the SQL table
+- Columns – Select the rows you want from the SQL table
- Data Input Method
- Run command once per table row
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/unix/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/unix/overview.md
index 8b4323b74c..a198609ca8 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/unix/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/unix/overview.md
@@ -7,7 +7,8 @@ sidebar_position: 380
# Unix Data Collector
The Unix Data collector provides host inventory, software inventory, and logical volume inventory on
-UNIX & Linux platforms. The Unix Data Collector has been preconfigured within the Unix Solution.
+UNIX & Linux platforms. The Unix Solution includes the Unix Data Collector as a preconfigured
+component.
Both this data collector and the solution are available with a special Enterprise Auditor license.
See the
[Unix Solution](/docs/accessanalyzer/11.6/solutions/unix/overview.md)
@@ -26,7 +27,7 @@ topic for additional information.
- Root permissions in Unix/Linux
-If the Root permission is unavailable, a least privileged model can be used. See the
+If the Root permission is unavailable, you can use a least privileged model. See the
[Least Privilege Model](/docs/accessanalyzer/11.6/requirements/unix/target.md#least-privilege-model)
topic additional information.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/unix/results.md b/docs/accessanalyzer/11.6/admin/datacollector/unix/results.md
index cdd0674370..b5b35ab6b5 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/unix/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/unix/results.md
@@ -6,16 +6,16 @@ sidebar_position: 50
# Unix: Results
-On the Results page, select which properties will be gathered out of those available for the query.
-Additionally select properties based on which ROWKEY will be built.
+On the Results page, select which properties to gather from those available for the query.
+Additionally, select properties for building ROWKEY.
The configurable options are:
-- Properties to return – Select the desired columns
-- ROWKEY's components – Select the desired columns
+- Properties to return – Select the columns you want
+- ROWKEY's components – Select the columns you want
Click **Finish** to save the configuration changes, or **Back** to return to the previous page. If
-no changes were made, it is a best practice to click **Cancel** to close the Unix Data Collector
-Wizard to make sure that no accidental settings are saved.
+you made no changes, click **Cancel** to close the Unix Data Collector Wizard instead. This
+prevents the wizard from saving accidental settings.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/overview.md
index a3688a533d..76ca2d1904 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/overview.md
@@ -9,7 +9,8 @@ sidebar_position: 390
The UsersGroups Data Collector audits user and group accounts for both local and domain, extracting
system policies.
-The UsersGroups Data Collector has been preconfigured within the Windows Solution. Both this data
+The Windows Solution includes the UsersGroups Data Collector as a preconfigured component. Both
+this data
collector and the solution are available with a special Enterprise Auditor license. See the
[Windows Solution](/docs/accessanalyzer/11.6/solutions/windows/overview.md)
topic for additional information.
@@ -47,5 +48,5 @@ contains the following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** box when
-the wizard is open and configuration settings are saved.
+Select the **Don't display this page the next time** box to hide the Welcome page. The wizard
+saves this setting with your configuration changes.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/groups.md b/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/groups.md
index 3e73d1ea75..32cbc2231e 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/groups.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/groups.md
@@ -47,7 +47,7 @@ options opens the Find a Group or Find a User browser.
The Find a Group and Find a User browsers display a list of groups or users, depending on which one
-is being used, that can be selected for the option. Select from a specific host using the Sample
+you use, that you can select for the option. Select from a specific host using the Sample
from host option, or leave the text field blank and click **Connect** to retrieve all user groups or
users that are selectable.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/results.md b/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/results.md
index 828b6f3cb9..d870e26f12 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/results.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/results.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# UsersGroups: Results
-The Results page is where the type of data to be returned is configured. Each type has a different
-set of options.
+Use the Results page to configure the type of data to return. Each type has a different set of
+options.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/security.md b/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/security.md
index fc62bc2d8f..94636be680 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/security.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/security.md
@@ -6,11 +6,11 @@ sidebar_position: 30
# UsersGroups: Security Category
-This Security policy is used to audit security policies.
+This Security policy audits security policies.
-Select from the following options for what data will be returned:
+Select from the following options for what data to return:
- Security Policy (User Rights Assignment) – Identifies user rights assignment for each individual
policy part that grants or removes rights
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/users.md b/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/users.md
index 7447032700..46f53a6580 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/users.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/results/users.md
@@ -15,11 +15,11 @@ In the Users section, select from the following options:
- All users – All users found on the target host
- All users in the following groups – Click the ellipsis (**…**) to open the Find a Group browser
window and specify a group. See the [Find a Group/User Browser](#find-a-groupuser-browser) topic
- for additional information. A specific group can also be entered manually into the text field.
+ for additional information. You can also enter a specific group manually into the text field.
- These users – Click the ellipsis (**…**) to open the Find a User browser window and specify one or
more users. See the [Find a Group/User Browser](#find-a-groupuser-browser) topic for additional
- information. A specific user can also be entered manually into the text field.
-- Special users – The users found can be flagged as special users in the following categories:
+ information. You can also enter a specific user manually into the text field.
+- Special users – You can flag users found as special users in the following categories:
- Administrator
- Guest
@@ -65,7 +65,7 @@ opens the Find a Group or Find a User browser.
The Find a Group and Find a User browsers display a list of groups or users, depending on which one
-is being used, that can be selected for the option. Select from a specific host using the Sample
+you use, that you can select for the option. Select from a specific host using the Sample
from host option, or leave the text field blank and click **Connect** to retrieve all user groups or
users that are selectable.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/summary.md
index d7037777b8..0415fa0a41 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/usersgroups/summary.md
@@ -10,6 +10,6 @@ The Summary page displays a summary of the configured query.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Users and Groups Browser wizard ensuring that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you didn't make changes, it is a best practice to
+click **Cancel** to close the Users and Groups Browser wizard, which prevents the wizard from saving
+accidental clicks.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/classes.md b/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/classes.md
index 19daea50d4..9c57242898 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/classes.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/classes.md
@@ -10,6 +10,6 @@ On the Classes page, configure the WMICollector namespaces and classes to use as
-Select the **Namespace** and **Class** from the drop-down lists to use as a data source. The default
-namespace, **root\CIMV2**, is typically what should be used. Select the **Win32 classes only**
-checkbox to use only Win32 classes.
+Select the **Namespace** and **Class** from the dropdown lists to use as a data source. Typically, use
+the default namespace, **root\CIMV2**. Select the **Win32 classes only** checkbox to use only Win32
+classes.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/overview.md b/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/overview.md
index 2cd2779126..81e534d0bc 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/overview.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/overview.md
@@ -7,9 +7,9 @@ sidebar_position: 400
# WMICollector Data Collector
The WMICollector Data Collector identifies data for certain types of WMI classes and namespaces. The
-WMICollector Data Collector is a core component of Enterprise Auditor, but it has been preconfigured
-within the Windows Solution. While the data collector is available with all Enterprise Auditor
-license options, the Windows Solution is only available with a special Enterprise Auditor license.
+WMICollector Data Collector is a core component of Enterprise Auditor, but the Windows Solution has
+preconfigured it. While the data collector is available with all Enterprise Auditor license options,
+the Windows Solution is only available with a special Enterprise Auditor license.
See the
[Windows Solution](/docs/accessanalyzer/11.6/solutions/windows/overview.md)
topic for additional information.
@@ -30,7 +30,7 @@ topic for additional information.
## WMICollector Query Configuration
-The WMICollector Data Collector is configured through the WMI Browser wizard, which contains the
+You configure the WMICollector Data Collector through the WMI Browser wizard, which contains the
following wizard pages:
- Welcome
@@ -41,5 +41,5 @@ following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
+The Welcome page can be hidden by selecting the **Don't display this page the next time** checkbox
when the wizard is open and configuration settings are saved.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/properties.md b/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/properties.md
index 573a2f6fff..2e219c8bab 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/properties.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/properties.md
@@ -10,10 +10,10 @@ On the Properties page, select the properties to extract.
-If the **Extract only selected instances** checkbox is not selected, data is returned from all
+If you don't select the **Extract only selected instances** checkbox, the query returns data from all
process instances displayed in the **Instances of `\`** box. To return data from a
single process instance, select an instance and select the **Extract only selected instances**
-checkbox. Only one instance can be selected at a time.
+checkbox. You can select only one instance at a time.
-In the **Instance data** box, select the checkboxes next to the desired properties to return during
+In the **Instance data** box, select the checkboxes next to the properties you want to return during
query execution.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/samplehost.md b/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/samplehost.md
index 1a31c8b981..3eec84cfeb 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/samplehost.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/samplehost.md
@@ -10,7 +10,7 @@ On the Sample Host page, enter a sample host to populate options for the query.
-On the Sample Host page, if the desired classes and namespaces to audit reside on the local host,
-click **Next**. (The local host is represented by `.` in the **Sample host name** box). If a
-different sample host is needed to populate the namespace and class options, enter the name for the
-remote host and click **Next**.
+On the Sample Host page, if the classes and namespaces you want to audit reside on the local host,
+click **Next**. (In the **Sample host name** box, `.` represents the local host). If you need a
+different sample host to populate the namespace and class options, enter the name for the remote
+host and click **Next**.
diff --git a/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/summary.md b/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/summary.md
index cebcdd093f..0820553fa6 100644
--- a/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/summary.md
+++ b/docs/accessanalyzer/11.6/admin/datacollector/wmicollector/summary.md
@@ -10,5 +10,6 @@ The Summary page, or Results page, displays a summary of the configured query.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the WMI Browser wizard ensuring that no accidental clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make changes, it is a best practice to
+click **Cancel** to close the WMI Browser wizard, which prevents the wizard from saving accidental
+clicks.
diff --git a/docs/accessanalyzer/11.6/admin/hostdiscovery/activities.md b/docs/accessanalyzer/11.6/admin/hostdiscovery/activities.md
index 6c532985aa..8d8a76a44b 100644
--- a/docs/accessanalyzer/11.6/admin/hostdiscovery/activities.md
+++ b/docs/accessanalyzer/11.6/admin/hostdiscovery/activities.md
@@ -19,7 +19,7 @@ The options are:
- A confirmation window displays. Click **Yes** to complete the deletion
- Run Query – Begins an immediate execution of the selected query
-- Stop Query – Stops the selected query which is currently running
+- Stop Query – Stops the selected query which is running
- No action occurs if the query is **Idle**
@@ -38,6 +38,6 @@ The options are:
[Host Management](/docs/accessanalyzer/11.6/admin/hostmanagement/overview.md)
node directly to the selected query’s generated host list
-These options are also available through a pop-up menu accessed by right-clicking on a query.
-**Create Query** and **Suspend Query Queue** are additionally available through a pop-up menu
-accessed by right-clicking on the **Host Discovery** node.
+You can also access these options through a pop-up menu by right-clicking a query. You can also
+access **Create Query** and **Suspend Query Queue** through a pop-up menu by right-clicking the
+**Host Discovery** node.
diff --git a/docs/accessanalyzer/11.6/admin/hostdiscovery/log.md b/docs/accessanalyzer/11.6/admin/hostdiscovery/log.md
index ce38115c35..4be07d5e28 100644
--- a/docs/accessanalyzer/11.6/admin/hostdiscovery/log.md
+++ b/docs/accessanalyzer/11.6/admin/hostdiscovery/log.md
@@ -6,12 +6,12 @@ sidebar_position: 40
# Discovery Log
-The **Host Discovery** > **Discovery Log** node lists host discovery logs. These logs house
-transactions that transpire during the running of host discovery and host inventory tasks.
+The **Host Discovery** > **Discovery Log** node lists host discovery logs. These logs record
+transactions that occur while host discovery and host inventory tasks run.
-The Discovery Log logging level is configured within the **Settings** > **Host Discovery** node. See
+Configure the Discovery Log logging level within the **Settings** > **Host Discovery** node. See
the
[Host Discovery](/docs/accessanalyzer/11.6/admin/settings/hostdiscovery.md)
topic for additional information.
@@ -19,9 +19,9 @@ topic for additional information.
The following options are above the data grid:
- Reload Log – Refresh the log data for the selected Log date and Query Name
-- Log date – Select the desired **Log date** from the drop-down menu to view transactions
+- Log date – Select the **Log date** you want from the dropdown menu to view transactions
- Query Name – The default selection is **All Queries**. To narrow the data to a desired query,
- select a query name from the drop-down menu.
+ select a query name from the dropdown menu.
The data grid contains the following columns:
diff --git a/docs/accessanalyzer/11.6/admin/hostdiscovery/overview.md b/docs/accessanalyzer/11.6/admin/hostdiscovery/overview.md
index 45dde6857c..d164f800ba 100644
--- a/docs/accessanalyzer/11.6/admin/hostdiscovery/overview.md
+++ b/docs/accessanalyzer/11.6/admin/hostdiscovery/overview.md
@@ -6,12 +6,12 @@ sidebar_position: 40
# Host Discovery Node
-Use the **Host Discovery** node to discover hosts to audit. Host Discovery queries are created in
+Use the **Host Discovery** node to discover hosts to audit. Create Host Discovery queries in
the Host Discovery node to discover hosts within the targeted environment that match the desired
criteria (for example, all domain controllers for Active Directory auditing).
The Host Discovery queries view displays a list of previously configured queries, opens the Host
-Discovery Wizard to create new queries, and is where host inventory process can be automated. The
+Discovery Wizard to create new queries, and lets you automate host inventory. The
**Host Discovery** node houses the Discovery Log. The **Settings** > **Host Discovery** node
contains the global settings that affect discovery queries. See the
[Host Discovery](/docs/accessanalyzer/11.6/admin/settings/hostdiscovery.md)
diff --git a/docs/accessanalyzer/11.6/admin/hostdiscovery/queries.md b/docs/accessanalyzer/11.6/admin/hostdiscovery/queries.md
index 98a52aff75..51063fdb75 100644
--- a/docs/accessanalyzer/11.6/admin/hostdiscovery/queries.md
+++ b/docs/accessanalyzer/11.6/admin/hostdiscovery/queries.md
@@ -10,7 +10,7 @@ The Host Discovery Queries Pane contains a list of previously-configured queries
-The list of previously configured queries is provided in a table format with the following columns:
+The list of previously configured queries appears in a table format with the following columns:
- Name – Displays the name assigned to the query during creation
- Query Source – Identifies where the query searches for hosts
@@ -27,13 +27,13 @@ The list of previously configured queries is provided in a table format with the
- Snapshot – Only shows host found during the most recent query execution
:::note
- The Snapshot mode is configured on the Options page of the Host Discovery Wizard.
+ Configure Snapshot mode on the Options page of the Host Discovery Wizard.
:::
## View Hidden Columns
-Follow the steps to view the hidden columns in the table:
+To view the hidden columns in the table:
**Step 1 –** Right-click a header in the table, which opens a context menu.
@@ -47,7 +47,7 @@ Follow the steps to view the hidden columns in the table:
-**Step 4 –** Drag and drop the desired column between any header of the table.
+**Step 4 –** Drag and drop the column you want between any header of the table.
diff --git a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/addomaincontrollers.md b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/addomaincontrollers.md
index 8fa8740ed2..9c572e703d 100644
--- a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/addomaincontrollers.md
+++ b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/addomaincontrollers.md
@@ -20,8 +20,8 @@ Directory server (Discover Domain Controllers)** option. Click **Next**.
**Step 2 –** On the Query page, name the query and select the credentials used to access the source.
- Query Name – Provide a unique descriptive name for this query by typing over the `NEWQUERY`
- default name. Two queries can't have the same name. If you use an existing name, a number is
- automatically appended to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
+ default name. Two queries can't have the same name. If you use an existing name, Enterprise Auditor
+ automatically appends a number to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
for querying the source:
@@ -74,7 +74,7 @@ Click **Next** to continue.
- Run the query when jobs that reference it are run – Select this option to automatically execute
the Host Discovery query before executing a job that has the host list generated by this query
- assigned. This ensures any new hosts have been discovered and are available for auditing.
+ assigned. This ensures the query discovers any new hosts and makes them available for auditing.
:::info
Use this setting only for host lists tied to specific jobs that require
@@ -94,11 +94,11 @@ Click **Next** to continue.
-**Step 5 –** On the Inventory page, the host inventory process can be automatically included with
+**Step 5 –** On the Inventory page, you can automatically include the host inventory process with
the discovery query.
- Refresh inventory every time when the host discovery query completes – Automates the host
- inventory process and is dependent on the **Settings** > **Host Inventory** node configuration for
+ inventory process and depends on the **Settings** > **Host Inventory** node configuration for
the age of previously inventoried records. Leaving this option deselected applies the global
settings for host inventory.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
@@ -129,12 +129,12 @@ configuration process.
query at another time.
Both options close the Host Discovery Wizard and return to the Host Discovery Queries view on the
-Host Discovery node. If **Yes** is selected, the **Query State** indicates the running query.
+Host Discovery node. If you select **Yes**, the **Query State** indicates the running query.
## Required Permissions
-This query only requires an authenticated domain user account — no elevated Active Directory
-administrative role (such as Domain Admin or Enterprise Admin) is needed to enumerate domain
+This query only requires an authenticated domain user account — you don't need an elevated Active
+Directory administrative role (such as Domain Admin or Enterprise Admin) to enumerate domain
controllers, domains, or sites.
Because the query reads domain and site information from the forest-wide Configuration partition (the
@@ -142,8 +142,8 @@ Because the query reads domain and site information from the forest-wide Configu
capable of servicing a query against the Configuration naming context.
:::info
-Domain Controllers are a high-value target class. If **Refresh inventory every time the host
-discovery query completes** is enabled on the Inventory page, the account used for inventory needs
+Domain Controllers are a high-value target class. If you enable **Refresh inventory every time the
+host discovery query completes** on the Inventory page, the account used for inventory needs
local administrator rights on every discovered domain controller — effectively equivalent to
Domain Admin. Use a dedicated, tightly scoped service account for this purpose rather than an
existing Domain Admin credential. See the
diff --git a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/adexchange.md b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/adexchange.md
index 5cb389dbd3..60c5c56d15 100644
--- a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/adexchange.md
+++ b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/adexchange.md
@@ -21,8 +21,8 @@ Directory server (Discover Exchange servers)** option. Click **Next**.
**Step 2 –** On the Query page, name the query and select the credentials used to access the source.
- Query Name – Provide a unique descriptive name for this query by typing over the `NEWQUERY`
- default name. Two queries can't have the same name. If you use an existing name, a number is
- automatically appended to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
+ default name. Two queries can't have the same name. If you use an existing name, Enterprise Auditor
+ automatically appends a number to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
for querying the source:
@@ -54,7 +54,7 @@ topic for instructions. Click **Next**.
- Run the query when jobs that reference it are run – Select this option to automatically execute
the Host Discovery query before executing a job that has the host list generated by this query
- assigned. This ensures any new hosts have been discovered and are available for auditing.
+ assigned. This ensures the query discovers any new hosts and makes them available for auditing.
:::info
Use this setting only for host lists tied to specific jobs that require
@@ -74,11 +74,11 @@ Click **Next** to continue.
-**Step 5 –** On the Inventory page, the host inventory process can be automatically included with
+**Step 5 –** On the Inventory page, you can automatically include the host inventory process with
the discovery query.
- Refresh inventory every time when the host discovery query completes – Automates the host
- inventory process and is dependent on the **Settings** > **Host Inventory** node configuration for
+ inventory process and depends on the **Settings** > **Host Inventory** node configuration for
the age of previously inventoried records. Leaving this option deselected applies the global
settings for host inventory.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
@@ -109,13 +109,13 @@ configuration process.
query at another time.
Both options close the Host Discovery Wizard and return to the Host Discovery Queries view on the
-Host Discovery node. If **Yes** is selected, the **Query State** indicates the running query.
+Host Discovery node. If you select **Yes**, the **Query State** indicates the running query.
## Required Permissions
-This query only requires an authenticated domain user account — no Exchange administrative role
-(such as Organization Management or View-Only Organization Management) is needed to read Exchange
-server objects from Active Directory.
+This query only requires an authenticated domain user account — you don't need an Exchange
+administrative role (such as Organization Management or View-Only Organization Management) to read
+Exchange server objects from Active Directory.
Because the search targets the Exchange Configuration container
(`CN=Microsoft Exchange,CN=Services,CN=Configuration`), which is part of the forest-wide
@@ -124,7 +124,7 @@ servicing a query against the Configuration naming context. Any domain controlle
holds a copy of this partition, so this isn't limited to domain controllers local to the
Enterprise Auditor Console.
-If **Refresh inventory every time the host discovery query completes** is enabled on the Inventory
+If you enable **Refresh inventory every time the host discovery query completes** on the Inventory
page, Enterprise Auditor also queries each discovered Exchange server for inventory data (including Exchange role
and version), which requires local administrator rights (or explicitly delegated Remote Registry
and WMI access, including the Exchange WMI provider) on that host. See the
diff --git a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/adgeneral.md b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/adgeneral.md
index 933984a47e..01d40810b1 100644
--- a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/adgeneral.md
+++ b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/adgeneral.md
@@ -21,8 +21,8 @@ Directory server (General)** option. Click **Next**.
**Step 2 –** On the Query page, name the query and select the credentials used to access the source.
- Query Name – Provide a unique descriptive name for this query by typing over the `NEWQUERY`
- default name. Two queries can't have the same name. If you use an existing name, a number is
- automatically appended to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
+ default name. Two queries can't have the same name. If you use an existing name, Enterprise Auditor
+ automatically appends a number to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
for querying the source:
@@ -78,7 +78,7 @@ Click **Next** to continue.
- Run the query when jobs that reference it are run – Select this option to automatically execute
the Host Discovery query before executing a job that has the host list generated by this query
- assigned. This ensures any new hosts have been discovered and are available for auditing.
+ assigned. This ensures the query discovers any new hosts and makes them available for auditing.
:::info
Use this setting only for host lists tied to specific jobs that require
@@ -98,11 +98,11 @@ Click **Next** to continue.
-**Step 5 –** On the Inventory page, the host inventory process can be automatically included with
+**Step 5 –** On the Inventory page, you can automatically include the host inventory process with
the discovery query.
- Refresh inventory every time when the host discovery query completes – Automates the host
- inventory process and is dependent on the **Settings** > **Host Inventory** node configuration for
+ inventory process and depends on the **Settings** > **Host Inventory** node configuration for
the age of previously inventoried records. Leaving this option deselected applies the global
settings for host inventory.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
@@ -133,21 +133,21 @@ configuration process.
query at another time.
Both options close the Host Discovery Wizard and return to the Host Discovery Queries view on the
-Host Discovery node. If **Yes** is selected, the **Query State** indicates the running query.
+Host Discovery node. If you select **Yes**, the **Query State** indicates the running query.
## Required Permissions
Querying Active Directory for computer objects only requires an authenticated domain user
-account — no elevated Active Directory rights (such as Domain Admin or specific delegated
-permissions) are needed to read computer objects in a standard Active Directory environment. This
-applies regardless of which Connection Profile option is selected.
+account — you don't need elevated Active Directory rights (such as Domain Admin or specific
+delegated permissions) to read computer objects in a standard Active Directory environment. This
+applies regardless of which Connection Profile option you select.
:::info
If the targeted OUs have restricted read access (for example, hardened Tier 0 OUs in a tiered
-administration model), the account used must be explicitly granted read access to those OUs.
+administration model), you must explicitly grant the account used read access to those OUs.
:::
-If **Refresh inventory every time the host discovery query completes** is enabled on the Inventory
+If you enable **Refresh inventory every time the host discovery query completes** on the Inventory
page, Enterprise Auditor also queries each discovered computer for inventory data, which requires local
administrator rights (or explicitly delegated Remote Registry and WMI access) on that host in
addition to the Active Directory read access described earlier. See the
diff --git a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/csv.md b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/csv.md
index c303efe3b6..efadbf94fc 100644
--- a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/csv.md
+++ b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/csv.md
@@ -31,8 +31,8 @@ The source in this case is the Enterprise Auditor Console server.
- Query Name – Provide a unique descriptive name for this query by typing over the `NEWQUERY`
- default name. Two queries can't have the same name. If you use an existing name, a number is
- automatically appended to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
+ default name. Two queries can't have the same name. If you use an existing name, Enterprise Auditor
+ automatically appends a number to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
for querying the source:
@@ -70,7 +70,7 @@ Click **Next** to continue.
- Run the query when jobs that reference it are run – Select this option to automatically execute
the Host Discovery query before executing a job that has the host list generated by this query
- assigned. This ensures any new hosts have been discovered and are available for auditing.
+ assigned. This ensures the query discovers any new hosts and makes them available for auditing.
:::info
Use this setting only for host lists tied to specific jobs that require
@@ -90,11 +90,11 @@ Click **Next** to continue.
-**Step 5 –** On the Inventory page, the host inventory process can be automatically included with
+**Step 5 –** On the Inventory page, you can automatically include the host inventory process with
the discovery query.
- Refresh inventory every time when the host discovery query completes – Automates the host
- inventory process and is dependent on the **Settings** > **Host Inventory** node configuration for
+ inventory process and depends on the **Settings** > **Host Inventory** node configuration for
the age of previously inventoried records. Leaving this option deselected applies the global
settings for host inventory.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
@@ -125,12 +125,12 @@ configuration process.
query at another time.
Both options close the Host Discovery Wizard and return to the Host Discovery Queries view on the
-Host Discovery node. If **Yes** is selected, the **Query State** indicates the running query.
+Host Discovery node. If you select **Yes**, the **Query State** indicates the running query.
## Required Permissions
-No domain credentials are required to import a host list from a CSV file. The account used only
-needs read access to the folder containing the CSV file. If the file is stored on a local drive of
+You don't need domain credentials to import a host list from a CSV file. The account used only
+needs read access to the folder containing the CSV file. If you store the file on a local drive of
the Enterprise Auditor Console server, the Console service account's own permissions are
sufficient. If the file is on a network share (a UNC path), the credential selected must have read
access to that share instead.
@@ -140,7 +140,7 @@ This query doesn't contact any of the hosts listed in the CSV during the import
only reads the file and populates the host list.
:::
-If **Refresh inventory every time the host discovery query completes** is enabled on the Inventory
+If you enable **Refresh inventory every time the host discovery query completes** on the Inventory
page, Enterprise Auditor also queries each imported host for inventory data, which requires local administrator
rights (or explicitly delegated Remote Registry and WMI access) on that host. See the
[Host Inventory](/docs/accessanalyzer/11.6/admin/settings/hostinventory.md) topic for details.
diff --git a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/database.md b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/database.md
index 9d9cb7dbae..a7e08efc0d 100644
--- a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/database.md
+++ b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/database.md
@@ -26,8 +26,8 @@ database** option. Click **Next**.
**Step 2 –** On the Query page, name the query and select the credentials used to access the source.
- Query Name – Provide a unique descriptive name for this query by typing over the `NEWQUERY`
- default name. Two queries can't have the same name. If you use an existing name, a number is
- automatically appended to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
+ default name. Two queries can't have the same name. If you use an existing name, Enterprise Auditor
+ automatically appends a number to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
for querying the source:
@@ -66,16 +66,16 @@ names are located:
- - Click **Test Connection** to confirm a connection has been established. Click **OK** on the
+ - Click **Test Connection** to confirm the connection succeeded. Click **OK** on the
confirmation window.
- Database – Select the **Select the database on the server** option and use the dropdown menu
to select the database
- - The other tabs in the Data Link Properties window shouldn't be modified
+ - Don't modify the other tabs in the Data Link Properties window
- Provider tab – The database connector, dictated by the source of the data and the data
- sources that are available on the Enterprise Auditor Console server. This is set by
- default to the **Microsoft OLE DB Provider for SQL Server**.
- - Advanced tab – Allows modifications of the connection timeout to the database server in
+ sources that are available on the Enterprise Auditor Console server. By default,
+ Enterprise Auditor sets this to the **Microsoft OLE DB Provider for SQL Server**.
+ - Advanced tab – Lets you modify the connection timeout to the database server in
case the server is slow or far away
- All tab – Don't modify this tab
@@ -94,7 +94,7 @@ Click **Next** to continue.
- Run the query when jobs that reference it are run – Select this option to automatically execute
the Host Discovery query before executing a job that has the host list generated by this query
- assigned. This ensures any new hosts have been discovered and are available for auditing.
+ assigned. This ensures the query discovers any new hosts and makes them available for auditing.
:::info
Use this setting only for host lists tied to specific jobs that require
@@ -114,11 +114,11 @@ Click **Next** to continue.
-**Step 5 –** On the Inventory page, the host inventory process can be automatically included with
+**Step 5 –** On the Inventory page, you can automatically include the host inventory process with
the discovery query.
- Refresh inventory every time when the host discovery query completes – Automates the host
- inventory process and is dependent on the **Settings** > **Host Inventory** node configuration for
+ inventory process and depends on the **Settings** > **Host Inventory** node configuration for
the age of previously inventoried records. Leaving this option deselected applies the global
settings for host inventory.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
@@ -149,13 +149,13 @@ configuration process.
query at another time.
Both options close the Host Discovery Wizard and return to the Host Discovery Queries view on the
-Host Discovery node. If **Yes** is selected, the **Query State** indicates the running query.
+Host Discovery node. If you select **Yes**, the **Query State** indicates the running query.
## Required Permissions
The account configured in the Data Link Properties window only needs permission to connect to the
-database and read (`SELECT`) from the single table used by the query. No write access, additional
-tables, or server-level roles are required.
+database and read (`SELECT`) from the single table used by the query. The query doesn't require
+write access, additional tables, or server-level roles.
:::info
Enterprise Auditor doesn't restrict the query to the selected table/column at the database
@@ -164,12 +164,12 @@ grant the account `SELECT` only on the specific table (or a view exposing just t
rather than reusing a broader-access account.
:::
-If **Use Windows NT Integrated security** is selected, the query reuses whatever database access
+If you select **Use Windows NT Integrated security**, the query reuses whatever database access
the Enterprise Auditor Console's service account already has, which may be broader than this
query needs. A dedicated SQL authentication account scoped to this one table is generally the
safer choice.
-If **Refresh inventory every time the host discovery query completes** is enabled on the Inventory
+If you enable **Refresh inventory every time the host discovery query completes** on the Inventory
page, Enterprise Auditor also queries each imported host for inventory data, which requires local administrator
rights (or explicitly delegated Remote Registry and WMI access) on that host. See the
[Host Inventory](/docs/accessanalyzer/11.6/admin/settings/hostinventory.md) topic for details.
diff --git a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/ipnetwork.md b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/ipnetwork.md
index a315ce48c0..00d75d32a9 100644
--- a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/ipnetwork.md
+++ b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/ipnetwork.md
@@ -20,8 +20,8 @@ option. Click **Next**.
**Step 2 –** On the Query page, name the query and select the credentials used to access the source.
- Query Name – Provide a unique descriptive name for this query by typing over the `NEWQUERY`
- default name. Two queries can't have the same name. If you use an existing name, a number is
- automatically appended to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
+ default name. Two queries can't have the same name. If you use an existing name, Enterprise Auditor
+ automatically appends a number to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
for querying the source:
@@ -63,10 +63,10 @@ Click **Next** to continue.
- IP Ranges box – Displays the selected range of IP Addresses. Use the links at the top of the box
to edit the list:
- - Add as inclusion – Adds information provided in the IP Address Textboxes into the to be
- collected list
- - Add as exclusion – Adds information provided in the IP Address Textboxes into the to be
- ignored list
+ - Add as inclusion – Adds information provided in the IP Address Textboxes to the inclusion
+ list
+ - Add as exclusion – Adds information provided in the IP Address Textboxes to the exclusion
+ list
- Remove – Removes the selection from the IP Ranges box
- (Optional) Only include host with the following ports open – If selected, this option limits the
@@ -85,7 +85,7 @@ Click **Next** to continue.
- Run the query when jobs that reference it are run – Select this option to automatically execute
the Host Discovery query before executing a job that has the host list generated by this query
- assigned. This ensures any new hosts have been discovered and are available for auditing.
+ assigned. This ensures the query discovers any new hosts and makes them available for auditing.
:::info
Use this setting only for host lists tied to specific jobs that require
@@ -105,11 +105,11 @@ Click **Next** to continue.
-**Step 5 –** On the Inventory page, the host inventory process can be automatically included with
+**Step 5 –** On the Inventory page, you can automatically include the host inventory process with
the discovery query.
- Refresh inventory every time when the host discovery query completes – Automates the host
- inventory process and is dependent on the **Settings** > **Host Inventory** node configuration for
+ inventory process and depends on the **Settings** > **Host Inventory** node configuration for
the age of previously inventoried records. Leaving this option deselected applies the global
settings for host inventory.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
@@ -140,7 +140,7 @@ configuration process.
query at another time.
Both options close the Host Discovery Wizard and return to the Host Discovery Queries view on the
-Host Discovery node. If **Yes** is selected, the **Query State** indicates the running query.
+Host Discovery node. If you select **Yes**, the **Query State** indicates the running query.
## Required Permissions
@@ -150,14 +150,14 @@ standard DNS to resolve their names — none of these steps authenticate to the
:::info
The Connection Profile selected on the Query page isn't required for the IP sweep step itself. It
-only becomes relevant if Host Inventory Refresh is also enabled.
+only becomes relevant if you also enable Host Inventory Refresh.
:::
-If **Only include host with the following ports open** is selected, Enterprise Auditor only
+If you select **Only include host with the following ports open**, Enterprise Auditor only
verifies that the specified TCP ports accept a connection. This confirms network reachability, not
that any particular service is running or that any credential would succeed against it.
-If **Refresh inventory every time the host discovery query completes** is enabled on the Inventory
+If you enable **Refresh inventory every time the host discovery query completes** on the Inventory
page, Enterprise Auditor also queries each discovered host for inventory data. This requires the Remote Registry
service to be running on the target and the account used to have local administrator rights (or an
account explicitly delegated Remote Registry and WMI namespace permissions) on that host. See the
diff --git a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/overview.md b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/overview.md
index d8e42381dd..9e5cd98bfc 100644
--- a/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/overview.md
+++ b/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/overview.md
@@ -6,13 +6,13 @@ sidebar_position: 30
# Host Discovery Wizard
-The Host Discovery Wizard gives complete control over how hosts are discovered on the targeted
-network and which hosts are discovered.
+The Host Discovery Wizard gives you complete control over how the query discovers hosts on the
+targeted network and which hosts it discovers.
Use the Host Discovery Wizard to create new queries. The wizard opens in the Results pane. Use any
-of the following methods in order to access the Host Discovery Wizard from the Host Discovery node:
+of the following methods to access the Host Discovery Wizard from the Host Discovery node:
- Select **Create Query** in the Activities pane
- Right-click the **Host Discovery** node and select **Create Query** from the pop-up menu
@@ -28,8 +28,8 @@ for hosts. Hosts are discoverable using one of the following options:
– Scans a specified range of IP Addresses for active hosts and resolves the names of machines
using DNS
- [Query an Active Directory Server (General)](/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/adgeneral.md)
- – Scans the default domain controller or a specified server for all computer objects, can be
- scoped
+ – Scans the default domain controller or a specified server for all computer objects; you can
+ scope it
- [Query an Active Directory Server (Discover Exchange servers)](/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/adexchange.md)
– Scans the default domain controller or a specified server but is scoped to return only computer
objects sitting in the configuration container for Exchange servers
@@ -42,7 +42,7 @@ for hosts. Hosts are discoverable using one of the following options:
– Imports a host list from a specified SQL Server database
:::note
-The Advanced Options checkbox in the lower-left corner is a legacy item and should not be
+The Advanced Options checkbox in the lower-left corner is a legacy item and shouldn't be
selected.
:::
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/add.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/add.md
index 9176772e84..2e88ba2c54 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/add.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/add.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# Add Hosts
-The **Add Hosts** option creates a new host list. It can be accessed through the **Host Management**
-node. Follow the steps to add a new host list.
+The **Add Hosts** option creates a new host list. You can access it through the **Host Management**
+node. To add a new host list:
@@ -18,9 +18,9 @@ node. Follow the steps to add a new host list.
**Step 2 –** On the Manual Host Entry page, choose to either enter the hosts manually one at a time,
or use the **Import** option. When the list is completed, click **Next**.
-- To enter hosts manually, type the host name in the **Host name** textbox. Then click **Add**. The
- entry will appear in the **Host list** box. Repeat the process until all hosts for this list have
- been entered.
+- To enter hosts manually, enter the host name in the **Host name** textbox. Then click **Add**. The
+ entry will appear in the **Host list** box. Repeat the process until you've entered all hosts for
+ this list.
- The **Import** option opens the Import Hosts window. See the
[Import Hosts Option](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/importhost.md)
topic for additional information.
@@ -31,11 +31,11 @@ or use the **Import** option. When the list is completed, click **Next**.
**Step 3 –** On the Specify Host List Properties page, provide a unique descriptive **Host List
Name**.
-- There cannot be two host lists with the same name. Enterprise Auditor automatically appends a
+- There can't be two host lists with the same name. Enterprise Auditor automatically appends a
numeral to the end of a host list name to avoid duplicates.
-**Step 4 –** On the Specify Host List Properties page, configure when inventory fields should be
-refreshed for hosts in the list and set the credentials to use to conduct the host inventory.
+**Step 4 –** On the Specify Host List Properties page, configure when to refresh inventory fields
+for hosts in the list and set the credentials to use to conduct the host inventory.
- Refresh inventory every time when the host discovery query completes – Automates the host
inventory process and is dependent on the **Settings** > **Host Inventory** node configuration for
@@ -57,5 +57,5 @@ refreshed for hosts in the list and set the credentials to use to conduct the ho
**Step 5 –** Click **Finish** to save the host list and close the Host Lost Wizard.
The new list displays at the bottom of the host lists under the **Host Management** node in the
-Navigation pane. Every host added is included in the host master table at the Host Management node
-as well as in the newly created host list.
+Navigation pane. Enterprise Auditor includes every added host in the host master table at the Host
+Management node as well as in the newly created host list.
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/deletehost.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/deletehost.md
index c077bbfc3f..e3f235175f 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/deletehost.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/deletehost.md
@@ -4,24 +4,24 @@ description: "Delete Host(s)"
sidebar_position: 30
---
-# Delete Host(s)
+# Delete Hosts
-Use the **Delete Host(s)** option at the **Host Management** node to permanently delete a host from
+Use the **Delete Hosts** option at the **Host Management** node to permanently delete a host from
the master host table, or at an individual host list node to remove the host from the selected list.
## Delete From Host Management Node
-Follow the steps to delete a host from the Host Management node.
+To delete a host from the Host Management node:
**Step 1 –** In the Host Management node, select the host in the data grid and click **Delete
-Host(s)** on the Activities pane.
+Hosts** on the Activities pane.
:::warning
-A deletion from the host master table at the Host Management node cannot be undone, as
+A deletion from the host master table at the Host Management node can't be undone, as
it deletes it from the host management database tables. It also removes the host from any host list
-to which it has been assigned. Click **Cancel** to stop the deletion.
+it's assigned to. Click **Cancel** to stop the deletion.
:::
@@ -32,9 +32,9 @@ The host is no longer in the master host table.
## Delete From Individual Host List
-Follow the steps to delete a host from an individual host list.
+To delete a host from an individual host list:
-**Step 1 –** In the host list, select the host in the data grid and click **Delete Host(s)** on the
+**Step 1 –** In the host list, select the host in the data grid and click **Delete Hosts** on the
Activities pane.
@@ -42,18 +42,18 @@ Activities pane.
**Step 2 –** A dialog box asks for confirmation of the action. Click **OK** to proceed with the
deletion.
-Enterprise Auditor checks to see if the host exists in any other static host lists. If so, the
-deletion is limited to removing the selected host from the current host list.
+Enterprise Auditor checks to see if the host exists in any other static host lists. If so,
+Enterprise Auditor limits the deletion to removing the selected host from the current host list.
:::warning
-A deletion from the host master table cannot be undone, as it deletes it from the host
+A deletion from the host master table can't be undone, as it deletes it from the host
management database tables.
:::
-**Step 3 –** If the host is not found in another static host list, Enterprise Auditor asks if you
+**Step 3 –** If Enterprise Auditor doesn't find the host in another static host list, it asks if you
also want to remove the host from the Host Master Table. On the Confirm dialog, select the desired
action.
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/deletelist.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/deletelist.md
index 641ddd860d..c5cf628389 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/deletelist.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/deletelist.md
@@ -10,7 +10,7 @@ Use the **Delete List** option to remove the selected list. This option is avail
individual host list node.
:::info
-Before deleting a host list, first ensure it is not assigned to a job.
+Before deleting a host list, first ensure no job uses it.
:::
@@ -19,26 +19,26 @@ Before deleting a host list, first ensure it is not assigned to a job.
:::warning
-This action cannot be undone. Click **Cancel** to stop the deletion.
+This action can't be undone. Click **Cancel** to stop the deletion.
:::
**Step 2 –** On the Confirm dialog box, click **OK** to continue with the deletion.
-Enterprise Auditor checks to see if any hosts within the host list are found in any other static
+Enterprise Auditor checks to see if any hosts within the host list exist in any other static
host lists.
-**Step 3 –** If no hosts are found in any other host list, then Enterprise Auditor asks if you want
-to remove the host from the master host table. On the Confirm dialog box, select the desired option.
+**Step 3 –** If Enterprise Auditor doesn't find any hosts in another host list, it asks if you want
+to remove the host from the master host table. On the Confirm dialog box, select the option you want.
- Yes – Deletes the specified host from the master host table
-- No – Does not delete the specified host from the master host table
-- No to All – Does not delete other hosts that are not found in another static host list from the
+- No – Doesn't delete the specified host from the master host table
+- No to All – Doesn't delete other hosts that aren't found in another static host list from the
master host table
- Yes to All – Deletes other hosts not found in any other static host list from the master host
table
When the operation is complete, the list is no longer visible under the Host Management node in the
-Navigation pane and it cannot be used to execute jobs against.
+Navigation pane and you can't use it to execute jobs against.
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/editlist.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/editlist.md
index eae811a35a..4a71ff6895 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/editlist.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/editlist.md
@@ -19,7 +19,7 @@ the Specify Host List Properties page where you can modify the following:
- Host List Name
:::warning
- Changing the name of a host list that has been assigned to a job can cause the job
+ Changing the name of a host list assigned to a job can cause the job
to fail.
:::
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/editquery.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/editquery.md
index 74d076325b..42058596f6 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/editquery.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/editquery.md
@@ -11,7 +11,7 @@ Use the **Edit Query** option to modify host lists created by a Host Discovery q
In the Navigation pane, select the query-created host list to edit and click **Edit Query**. The
-Host Discovery Wizard opens to the Query page where the query settings for the selected
-query-created host list are modified. See the
+Host Discovery Wizard opens to the Query page, where you can modify the query settings for the
+selected query-created host list. See the
[Host Discovery Wizard](/docs/accessanalyzer/11.6/admin/hostdiscovery/wizard/overview.md)
topic for information on modifying these settings.
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/export.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/export.md
index 091d0a0703..88d627a375 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/export.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/export.md
@@ -7,7 +7,7 @@ sidebar_position: 70
# Export Data
Use the **Export Data** option to export all information available in the current grid view for the
-selected host list to a HTML, XML , or CSV file. Follow the steps to export data.
+selected host list to a HTML, XML , or CSV file. To export data:
**Step 1 –** Select the Host Management or individual host list node to export data from, and
configure the data grid to contain all the columns you want to export. See the
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/importhost.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/importhost.md
index 695b062a59..f4e890c4b6 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/importhost.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/importhost.md
@@ -6,10 +6,10 @@ sidebar_position: 20
# Import Hosts Option
-On the Manual Host Entry page of the Host List Wizard, the **Import** option allows hosts to be
-imported from either a CSV file or a database into the host list being created.
+On the Manual Host Entry page of the Host List Wizard, the **Import** option lets you import hosts
+from either a CSV file or a database into the host list you're creating.
-Follow the steps to import hosts.
+To import hosts:
@@ -28,11 +28,11 @@ step.
- CSV File
- - File Name – Click the ellipsis (**…**) to open a browser window and select the CSV file. This
- file needs to be stored on the Enterprise Auditor Console server. Once selected, a preview of
- the file is shown in the preview box.
+ - File Name – Click the ellipsis (**…**) to open a browser window and select the CSV file. You
+ must store this file on the Enterprise Auditor Console server. Once selected, the preview box
+ shows a preview of the file.
- Includes header row – Select this checkbox if the file contains a header row. Otherwise, the
- header row will be included in the import (visible within the preview box).
+ import includes the header row (visible within the preview box).
@@ -45,23 +45,23 @@ step.
topic for additional information.
:::note
- The Provider, Advanced, and All tabs of the Data Link Properties window should not
- be modified.
+ Don't modify the Provider, Advanced, and All tabs of the Data Link Properties window.
:::
- - Table – Use the dropdown to select the table that contains the hosts to be imported. A preview
- of the selected table is displayed in the preview box.
+ - Table – Use the dropdown to select the table that contains the hosts to be imported. The
+ preview box displays a preview of the selected table.
-**Step 4 –** Use either the drop-down menu or click on the column in the preview box to select the
-column containing the host names. The selected column is highlighted in the preview box.
+**Step 4 –** Use either the dropdown menu or click the column in the preview box to select the
+column containing the host names. The preview box highlights the selected column.
**Step 5 –** Click **OK** to complete the import.
-The Import Hosts window closes, and the imported list of host names is added in the Host list box on
-the Manual Host Entry page of the Host List Wizard. Click **Next** to proceed with configuring the
+The Import Hosts window closes, and Enterprise Auditor adds the imported list of host names to the
+Host list box on the Manual Host Entry page of the Host List Wizard. Click **Next** to proceed with
+configuring the
host list. See the
[Add Hosts](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/add.md)
topic for additional information on the Host List Wizard.
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/importlocation.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/importlocation.md
index 00e1311559..2a98ff2f18 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/importlocation.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/importlocation.md
@@ -12,14 +12,14 @@ database without creating a new host list. See the
[Host Inventory Data Grid](/docs/accessanalyzer/11.6/admin/hostmanagement/datagrid.md)
topic for information on the Location column of host inventory.
-Follow the steps to import physical location data for hosts.
+To import physical location data for hosts:
**Step 1 –** Ensure the import source file has columns for both the host name as it is identified
within Enterprise Auditor and the location.
:::note
-When a host name does not match any existing hosts within the Host Master Table, it can be
-added as a new host.
+When a host name doesn't match any existing hosts within the Host Master Table, Enterprise Auditor
+can add it as a new host.
:::
@@ -37,11 +37,11 @@ step.
- CSV File
- - File Name – Click the ellipsis (**…**) to open a browser window and select the CSV file. This
- file needs to be stored on the Enterprise Auditor Console server. Once selected, a preview of
- the file is shown in the preview box.
+ - File Name – Click the ellipsis (**…**) to open a browser window and select the CSV file. You
+ must store this file on the Enterprise Auditor Console server. Once selected, the preview box
+ shows a preview of the file.
- Includes header row – Select this checkbox if the file contains a header row. Otherwise, the
- header row will be included in the import (visible within the preview box).
+ import includes the header row (visible within the preview box).
- Database
@@ -52,33 +52,32 @@ step.
topic for additional information.
:::note
- The Provider, Advanced, and All tabs of the Data Link Properties window should not
- be modified.
+ Don't modify the Provider, Advanced, and All tabs of the Data Link Properties window.
:::
- - Table – Use the dropdown to select the table that contains the hosts to be imported. A preview
- of the selected table is displayed in the preview box.
+ - Table – Use the dropdown to select the table that contains the hosts to be imported. The
+ preview box displays a preview of the selected table.
-**Step 5 –** Use either the drop-down menu or click on the column in the preview box to select the
-column containing the host names. The selected column is highlighted in the preview box.
+**Step 5 –** Use either the dropdown menu or click the column in the preview box to select the
+column containing the host names. The preview box highlights the selected column.
-**Step 6 –** Use the **Import column** drop-down menu to select the column containing the location
-information. The selected column is highlighted a lighter color in the preview box.
+**Step 6 –** Use the **Import column** dropdown menu to select the column containing the location
+information. The preview box highlights the selected column in a lighter color.
**Step 7 –** Click **OK** to complete the import.
The Location column now contains the imported information. If any of the hosts included in the
-import file are not already in the Host Master Table, Enterprise Auditor prompts for confirmation on
-whether or not to import the host. Selecting **Yes** or **Yes to All** adds the new hosts to the
+import file aren't already in the Host Master Table, Enterprise Auditor prompts for confirmation on
+whether to import the host. Selecting **Yes** or **Yes to All** adds the new hosts to the
Host Master Table but not to any individual host lists.
:::note
-Any new hosts that match dynamic host list criteria will be added to the appropriate
+Enterprise Auditor adds any new hosts that match dynamic host list criteria to the appropriate
dynamic host lists.
:::
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/overview.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/overview.md
index 4d37a94089..6a65b37794 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/overview.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/overview.md
@@ -20,9 +20,9 @@ The available actions are:
the Host Management node)
- [View/Edit Host](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/viewhost.md)
– Open the Host Details View, which displays the collected host inventory information for the
- selected host in an easier-to-read format and allows you to manually edit the host inventory
+ selected host in an easier-to-read format and lets you manually edit the host inventory
information
-- [Delete Host(s)](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/deletehost.md)
+- [Delete Hosts](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/deletehost.md)
– Delete host from the selected list (permanently deletes host from the host master table if used
in the Host Management node)
- [Import Location](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/importlocation.md)
@@ -41,8 +41,9 @@ The available actions are:
– Export the current data grid to a HTML, XML, or CSV file
- [Suspend/Resume Host Inventory](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/suspend.md)
– Pause an **In progress** host inventory or resume a paused **In queue** host inventory
-- External commands – Sub-header (not activity) that separates the Activities above which occur
- within the Enterprise Auditor Console from the Activities below which open external processes:
+- External commands – Sub-header (not activity) that separates the preceding Activities, which occur
+ within the Enterprise Auditor Console, from the following Activities, which open external
+ processes:
- Manage Host – Opens the Microsoft Management Console interface for the selected host if it has
that feature enabled
@@ -58,7 +59,7 @@ Activities available only at the individual host list nodes are:
- [Edit Query](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/editquery.md)
– Edit the Host Discovery query settings for the selected query-created host list
- [Rename List](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/rename.md)
- – Rename the selected host list (should not be used if the host list has already been assigned to
+ – Rename the selected host list (shouldn't be used if the host list has already been assigned to
a job for execution)
- [Delete List](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/deletelist.md)
– Delete the selected host list
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/refresh.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/refresh.md
index 17f14e4b59..2fed8dcc2e 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/refresh.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/refresh.md
@@ -6,7 +6,7 @@ sidebar_position: 90
# Refresh Hosts
-Use the **Refresh Hosts** option to manually execute the Host Inventory query. It can be selected
+Use the **Refresh Hosts** option to manually execute the Host Inventory query. You can select it
for the following:
- All hosts – Use from the Host Management node
@@ -21,4 +21,4 @@ Select the hosts or host list to inventory and then click **Refresh Hosts** in t
-When only particular hosts are selected in a list, a dialog box asks for confirmation of the action.
+When you select only particular hosts in a list, a dialog box asks for confirmation of the action.
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/rename.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/rename.md
index 976f3a0ae4..5af8fa52b9 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/rename.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/rename.md
@@ -10,7 +10,7 @@ Use the Rename List option to change the name of a selected host list. This opti
from an individual host list node.
:::warning
-Changing the name on a host list that has been assigned to a job can cause the job to
+Changing the name on a host list assigned to a job can cause the job to
fail.
:::
@@ -21,7 +21,7 @@ Select the host list to rename and click **Rename List** to open the Host list n
the new name for the host list and click **OK**.
:::note
-Host list names can also be changed using the **Edit List** option, see the
+You can also change host list names using the **Edit List** option. See the
[Edit List](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/editlist.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/savetolist.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/savetolist.md
index 13fe5591a1..c813ee25f2 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/savetolist.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/savetolist.md
@@ -9,8 +9,8 @@ sidebar_position: 120
Use the **Save Selected To List** option to create a static host list. This option is available from
either the Host Management node or an individual host list node. See the
[Static Host Lists](/docs/accessanalyzer/11.6/admin/hostmanagement/lists.md#static-host-lists)
-topic for additional information on static host lists. This option is inactive until at least one
-host within the data grid is selected.
+topic for additional information on static host lists. This option is inactive until you select at
+least one host within the data grid.
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/saveview.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/saveview.md
index dd0a4525be..b0f277a750 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/saveview.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/saveview.md
@@ -8,11 +8,11 @@ sidebar_position: 110
Use the **Save Current View** option to create a dynamic host list. This option is available from
either the Host Management node or an individual host list node. The option is inactive until you
-apply a filter to the data grid. Follow the steps to create a dynamic host list.
+apply a filter to the data grid. To create a dynamic host list:
**Step 1 –** Select the Host Management or individual host list node to create the host list from.
-**Step 2 –** Filter the data grid for the desired criteria. See the
+**Step 2 –** Filter the data grid for the criteria you want. See the
[Host Inventory Data Grid](/docs/accessanalyzer/11.6/admin/hostmanagement/datagrid.md)
topic for additional information.
@@ -27,12 +27,12 @@ and click **OK**.
The new host list displays under the Host Management node. When the Enterprise Auditor Console
closes the host lists under the Host Management node, the hosts reorganize in alphanumeric order.
-Like the default host lists, custom dynamic host lists are auto-populated and updated according to
-host inventory.
+Like the default host lists, Enterprise Auditor auto-populates and updates custom dynamic host lists
+according to host inventory.
:::info
-Do not modify the criteria once a dynamic based list has been created. It is
-better to delete and recreate the list in order to modify a dynamic-based list.
+Don't modify the criteria after you've created a dynamic-based list. To modify a dynamic-based list,
+delete and recreate it instead.
:::
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/suspend.md b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/suspend.md
index 699200272d..860a726d77 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/actions/suspend.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/actions/suspend.md
@@ -14,7 +14,7 @@ Once clicked, the option changes to **Resume Host Inventory** and the **In progr
inventories change to an **In queue** state.
:::note
-Clicking **Refresh Hosts** while inventory is suspended adds to the queue but does not
+Clicking **Refresh Hosts** while inventory is suspended adds to the queue but doesn't
resume the inventory.
:::
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/datagrid.md b/docs/accessanalyzer/11.6/admin/hostmanagement/datagrid.md
index b45c972394..edd9d9a96a 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/datagrid.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/datagrid.md
@@ -13,7 +13,7 @@ topic for information on host lists.
-The icon for each host entry is an indicator of its inventory state:
+The icon for each host entry indicates its inventory state:
| Icon | Inventory State |
| ---------------------------------------------------------------------------------------------------------------------------------------------- | --------------- |
@@ -32,10 +32,10 @@ Use the horizontal scrollbar at the bottom to view the host inventory data, whic
queue**)
:::note
- If the Enterprise Auditor application is stopped during host inventory collection,
+ If the Enterprise Auditor application stops during host inventory collection,
hosts queued for inventory retain the **InventoryState** of **In queue** within the Host
Management node data grid, as this is the last known state of inventory. It retains that state
- until the next host inventory collection is executed against the host.
+ until the next host inventory collection runs against the host.
:::
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/lists.md b/docs/accessanalyzer/11.6/admin/hostmanagement/lists.md
index 36a75bb4ba..cd2d63bfcd 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/lists.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/lists.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Hosts Lists
-A host list is a grouping of hosts for the purpose of executing jobs against. Every host list
+A host list is a grouping of hosts to execute jobs against. Every host list
created can be accessed by expanding the **Host Management** node in the Navigation pane.
@@ -44,26 +44,26 @@ both the default host lists and custom created dynamic host lists. See the
topic for a list of the default host lists and instructions on controlling which of these lists are
visible under the Host Management node.
-Custom dynamic host lists are created by filtering the data grid and using the
+Create custom dynamic host lists by filtering the data grid and using the
[Save Current View](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/saveview.md)
-option in the Activities pane or right-click menu. This can be done at the Host Management node with
+option in the Activities pane or right-click menu, either at the Host Management node with
the Host Master Table or at any host list node. See the
[Filter](/docs/accessanalyzer/11.6/admin/navigate/datagrid.md#filter)
topic for additional information on filtering data grids.
:::info
-Do not modify the criteria once a dynamic based list has been created. It is
-better to delete and recreate the list in order to modify a dynamic-based list.
+Don't modify the criteria after you create a dynamic-based list. To modify a
+dynamic-based list, delete and recreate it instead.
:::
## Static Host Lists
-Static host lists are created either through host discovery queries or manually entered within the
+You create static host lists either through host discovery queries or by manually entering them within the
**Host Management** node. Lists created by
[Host Discovery Node](/docs/accessanalyzer/11.6/admin/hostdiscovery/overview.md)
queries are updated each time the query is run, manually or scheduled. Other static host lists can
-only be changed manually. Custom host lists are frequently created in order to scope a job to
+only be changed manually. You frequently create custom host lists to scope a job to
execute against a select set of hosts.
For example, a user running the Exchange Solution might create a list to just run Mailbox queries
@@ -75,8 +75,8 @@ There are two common ways to create static host lists:
- Use the
[Add Hosts](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/add.md)
option in the Activities pane or right-click menu to access the Host List Wizard
-- Select multiple hosts from the data grid using the Windows Ctrl and left-click function. This can
- be done from the Host Mast Table or any host list under the Host Management node. Then use the
+- Select multiple hosts from the data grid using the Windows Ctrl and left-click function, from the
+ Host Mast Table or any host list under the Host Management node. Then use the
[Save Selected To List](/docs/accessanalyzer/11.6/admin/hostmanagement/actions/savetolist.md)
option in the Activities pane or right-click menu to open the Host List Wizard with a pre-filled
in Manual Host Entry page.
diff --git a/docs/accessanalyzer/11.6/admin/hostmanagement/overview.md b/docs/accessanalyzer/11.6/admin/hostmanagement/overview.md
index 908049bc2d..ea4ca468e7 100644
--- a/docs/accessanalyzer/11.6/admin/hostmanagement/overview.md
+++ b/docs/accessanalyzer/11.6/admin/hostmanagement/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Host Management
-The **Host Management** node is used to manage hosts in a targeted environment. Hosts configured
-under the **Host Management** node can be audited using other features in Enterprise Auditor. This
+Use the **Host Management** node to manage hosts in a targeted environment. You can audit hosts
+configured under the **Host Management** node using other features in Enterprise Auditor. This
node maintains information for audited computers. To view information on all computers in the
environment, use the
[.Active Directory Inventory Solution](/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/overview.md),
@@ -16,7 +16,7 @@ specifically the Active Directory Summary report.
The Host Management node provides a master list of every host ever introduced to Enterprise Auditor.
Introduce hosts through
[Host Discovery Node](/docs/accessanalyzer/11.6/admin/hostdiscovery/overview.md)
-queries or by entering them manually. Hosts are removed from this list only by manually deleting
+queries or by entering them manually. You can only remove hosts from this list by manually deleting
them. This master listing of hosts, or the Host Master Table, is designed around unique host names,
not necessarily unique hosts themselves. The data grid provides all host inventory information
collected on the hosts. See the
diff --git a/docs/accessanalyzer/11.6/admin/jobs/features.md b/docs/accessanalyzer/11.6/admin/jobs/features.md
index a50c9acbec..69fb080e18 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/features.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/features.md
@@ -11,8 +11,8 @@ Enterprise Auditor users should be familiar.
**View XML Files**
-Job, query, analysis, and action property windows all have the **View XML** option. These provide
-the ability to edit through an XML text window.
+Job, query, analysis, and action property windows all have the **View XML** option. These let you
+edit through an XML text window.
**Open Explore Folder**
@@ -21,20 +21,20 @@ using the **Explore Folder** option in the right-click menu.
**Publish Reports after Report Generation**
-Reports that have been generated but not published can be sent to the Web Console using the
+Send reports that have been generated but not published to the Web Console using the
**Publish** option in the right-click menu from the selected Jobs tree, job group, or job node. See
the [Publish Reports Window](#publish-reports-window) topic for additional information.
**Job Configuration Change Tracking**
-Jobs configuration changes can be tracked using the **Changes** option in the right-click menu from
+Track job configuration changes using the **Changes** option in the right-click menu from
the selected Jobs tree, job group, or job node. See the
[Changes Window](/docs/accessanalyzer/11.6/admin/jobs/overview.md#changes-window)
topic for additional information.
**Job Export**
-Jobs can be exported to a ZIP file using the **Export** option in the right-click menu from the
+Export jobs to a ZIP file using the **Export** option in the right-click menu from the
selected job group or job node. See the
[Export Job to Zip Archive Window](#export-job-to-zip-archive-window) topic for additional
information.
@@ -62,33 +62,33 @@ There are two options for where to save the ZIP file:
- Save in the exported folder – Saves the file in the job’s directory, for example
`%sainstalldir%Jobs\GROUP_.Active Directory Inventory\.Active Directory Inventory.zip`
-- Save in the following location – Allows you to either type or browse to the desired save location
+- Save in the following location – Enter or browse to the save location you want
-The **Email this archive**checkbox provides the opportunity to send an email notification with the
+The **Email this archive**checkbox lets you send an email notification with the
attached ZIP file.
When the archive has been created, the Enterprise Auditor Support Email window opens. By default,
-the recipient is set to [Netwrix Support](https://www.netwrix.com/support.html) but it can be
-modified prior to sending. Additional recipients can be added, and the Subject and email body can be
-modified.
+the recipient is set to [Netwrix Support](https://www.netwrix.com/support.html) but you can
+modify it before sending. You can also add additional recipients and modify the Subject and email
+body.
## Publish Reports Window
-The **Publish Reports** wizard allows you to better manage the list of reports published to the Web
+Use the **Publish Reports** wizard to better manage the list of reports published to the Web
Console.
-When you right-click on a job group or job and select **Publish**, the Publish Reports wizard opens.
+When you right-click a job group or job and select **Publish**, the Publish Reports wizard opens.
You can choose the list of reports to be published or removed from the Web Console.
-Follow the steps to publish the reports.
+To publish the reports:
-**Step 1 –** Right-click on a job group or job and select **Publish** from the drop-down list.
+**Step 1 –** Right-click a job group or job and select **Publish** from the dropdown list.
-**Step 2 –** On the Action Type page, select the type of action to be performed on the reports and
+**Step 2 –** On the Action Type page, select the type of action to perform on the reports and
click **Next**:
- Publish Reports
@@ -96,13 +96,13 @@ click **Next**:
-**Step 3 –** On the Report Tree page, select the reports to be published or removed (depending on
-the Action Type selected in the previous step). Click **Next** to proceed with the action.
+**Step 3 –** On the Report Tree page, select the reports to publish or remove (depending on
+the Action Type you selected in the previous step). Click **Next** to proceed with the action.
**Step 4 –** The Progress page shows you the status of the action. When it has completed, click
**Finish** to exit the wizard.
-Published reports can be viewed under the **[Job]** > **Results** node or through the Web Console.
+You can view published reports under the **[Job]** > **Results** node or through the Web Console.
See the
[Reporting](/docs/accessanalyzer/11.6/admin/report/overview.md) topic
for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/group/overview.md b/docs/accessanalyzer/11.6/admin/jobs/group/overview.md
index 538bb39452..8a68211767 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/group/overview.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/group/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# Job Groups
-Job groups are designed to manage related jobs and can contain sub-job groups to ensure that related
-jobs are executed in the correct order. To create a new job group, right-click on the desired
+Job groups manage related jobs and can contain sub-job groups to ensure that related
+jobs execute in the correct order. To create a new job group, right-click the desired
location (Jobs tree or another job group) and select **Create Group**. Then provide a unique,
descriptive name taking into consideration the alphanumeric ordering of the Jobs tree.
@@ -16,7 +16,7 @@ descriptive name taking into consideration the alphanumeric ordering of the Jobs
Job groups are organized similar to the Jobs tree, with the Settings node at the top, followed by
sub-job groups (job group for collection first, if applicable), then followed by analysis and
reporting jobs. Both are sorted in alphanumeric order. This is necessary because data collection
-jobs must run prior to the analysis and reporting jobs that rely on the collected data without
+jobs must run before the analysis and reporting jobs that rely on the collected data without
consideration to the job’s name (alphanumeric order).
## Job Group Description Page
@@ -43,13 +43,13 @@ Job Library, and creating a job.
Pre-configured job group description pages provide users with shortcuts and links to many of the
-functions that can be accessed in the Jobs Tree in the Navigation Pane.
+functions you can access in the Jobs Tree in the Navigation Pane.
The sections of the job group description page are:
-- Job Group Settings Shortcuts – These pages can also be accessed through the job group Settings
+- Job Group Settings Shortcuts – You can also access these pages through the job group Settings
Nodes in the Navigation Pane. See the
[Job Groups Settings Node](/docs/accessanalyzer/11.6/admin/jobs/group/settings/settings.md)
topic for additional information.
@@ -62,11 +62,11 @@ The sections of the job group description page are:
- Help – Opens the [Netwrix Technical Knowledge Center](https://helpcenter.netwrix.com/) in a
browser to a relevant landing page for the job group
-- Run Now – Runs the currently selected job group
+- Run Now – Runs the selected job group
- Schedule – Opens the Schedule page to schedule the job group
- Open Folder – Opens the job group’s folder location with supporting files in the Windows Explorer
-- Create Group – Creates a job group within the currently selected job group
-- Create Job – Creates a job within the currently selected Job
+- Create Group – Creates a job group within the selected job group
+- Create Job – Creates a job within the selected Job
- Add Instant Job – Add an Instant Job using the Instant Job Wizard. See the
[Instant Job Wizard](/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md)
topic for additional information.
@@ -79,12 +79,12 @@ following information:
- Assigned Host List – Hovering over the **Assigned Host List** button shows a tool-tip with
information on the hosts lists are assigned to the job group
- - Click on the **Assigned Host List** button to go to the Job Group's Host List Assignment node.
+ - Click the **Assigned Host List** button to go to the Job Group's Host List Assignment node.
See the
[Host Lists Assignment](/docs/accessanalyzer/11.6/admin/jobs/group/settings/hostlistsassignment.md)
topic for additional information.
-- Show Inherited Settings – Click on the **Show Inherited Settings** button to view information on
+- Show Inherited Settings – Click the **Show Inherited Settings** button to view information on
the following:
- Connection Profile
@@ -93,18 +93,18 @@ following information:
- Reporting Settings
- Storage Account
-- Contents – Shows the job groups and jobs contained within the currently selected job group
+- Contents – Shows the job groups and jobs contained within the selected job group
:::note
-If applicable, the page shows special instructions for which hosts need to be targeted for
+If applicable, the page shows special instructions for which hosts to target for
proper job group execution.
:::
### Job Settings: Inherited and Directly Applied
-Job group settings can be applied directly or inherited. On the job group level, it is considered
-that all settings are applied directly.
+Job group settings can be applied directly or inherited. At the job group level, all settings
+apply directly.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/group/settings/connection.md b/docs/accessanalyzer/11.6/admin/jobs/group/settings/connection.md
index 1a6535d771..a1192237e5 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/group/settings/connection.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/group/settings/connection.md
@@ -16,8 +16,8 @@ level or a parent job group. See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
topic for additional information.
-If the Default Setting is not preferred, select the custom type of connection settings desired
-below:
+If you don't want the default setting, select one of the following custom connection settings
+types:
- System default
@@ -28,7 +28,7 @@ below:
- Select one of the following user defined profiles
- - Select a pre-configured Connection Profile from the drop-down menu
+ - Select a pre-configured Connection Profile from the dropdown menu
Selecting the **Set all the child objects to inherit these settings** option forces inheritance of
this setting to all sub-groups and jobs within the job group. When enabled, this option overrides
diff --git a/docs/accessanalyzer/11.6/admin/jobs/group/settings/history.md b/docs/accessanalyzer/11.6/admin/jobs/group/settings/history.md
index 48f5973d5e..a7e6a5445f 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/group/settings/history.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/group/settings/history.md
@@ -17,12 +17,12 @@ By default, all job groups are set to inherit **Use Default Setting** option fro
for additional information.
:::warning
-It is important to understand that some pre-configured jobs require history retention
-while others do not support it. See job group and job descriptions for additional information.
+Some pre-configured jobs require history retention
+while others don't support it. See job group and job descriptions for additional information.
:::
-If the Default Setting is not preferred, select the custom type of retention settings desired below:
+If you don't want the default setting, select one of the following custom retention settings types:
- Data Retention Period
diff --git a/docs/accessanalyzer/11.6/admin/jobs/group/settings/hostlistsassignment.md b/docs/accessanalyzer/11.6/admin/jobs/group/settings/hostlistsassignment.md
index ba757122e8..8ae6152036 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/group/settings/hostlistsassignment.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/group/settings/hostlistsassignment.md
@@ -11,9 +11,9 @@ job group.
-At a top-level job group, there is no host list to be inherited. The **Use Default Settings** option
-is grayed-out. However, a sub-job group can inherit host lists from a parent job group. Host lists
-are configured through the **Host Management** node. See the
+At a top-level job group, there is no host list to inherit. The **Use Default Settings** option
+is grayed-out. However, a sub-job group can inherit host lists from a parent job group. You configure
+host lists through the **Host Management** node. See the
[Host Management](/docs/accessanalyzer/11.6/admin/hostmanagement/overview.md)
topic for additional information.
@@ -21,10 +21,10 @@ Several pre-defined solutions have default host lists already assigned to the so
the .Active Directory Inventory Job Group has the Default domain controller assigned at the job
group and inherited to the jobs.
-Select the host lists to be targeted by the job group. The **Filter host lists by** feature scopes
-the list to match the search string provided. At the bottom of the list is an indicator of how many
-hosts lists have been selected out of the total number of hosts lists known to the Enterprise
-Auditor Console. If a filter has been applied, there is also an indicator of how many host lists
+Select the host lists to target for the job group. The **Filter host lists by** feature scopes
+the list to match the search string provided. At the bottom of the list, an indicator shows how many
+host lists you've selected out of the total number of host lists known to the Enterprise
+Auditor Console. If you apply a filter, an indicator also shows how many host lists
matched the search string.
Selecting the **Set all the child objects to inherit these settings** option forces inheritance of
diff --git a/docs/accessanalyzer/11.6/admin/jobs/group/settings/reporting.md b/docs/accessanalyzer/11.6/admin/jobs/group/settings/reporting.md
index 13440faeb2..ff5590220a 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/group/settings/reporting.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/group/settings/reporting.md
@@ -15,8 +15,8 @@ topic for additional information.
:::note
If the Role Based Access feature is enabled, it also displays a list of all accounts
-granted access to the published reports via the Web Console that are generated by any jobs within
-the job group.
+granted access to the published reports via the Web Console that any jobs within
+the job group generate.
:::
diff --git a/docs/accessanalyzer/11.6/admin/jobs/group/settings/settings.md b/docs/accessanalyzer/11.6/admin/jobs/group/settings/settings.md
index 43430b5e88..8524bdf3ab 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/group/settings/settings.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/group/settings/settings.md
@@ -6,12 +6,12 @@ sidebar_position: 10
# Job Groups Settings Node
-A job group’s Settings node is where custom configurations can be set and where the host lists are
-assigned to a job group.
+A job group’s Settings node is where you can set custom configurations and assign host lists to
+a job group.
-These settings inherit the global settings down by default unless inheritance is broken at a job
+These settings inherit the global settings down by default unless you break inheritance at a job
group or a job level.
- [Connection Node](/docs/accessanalyzer/11.6/admin/jobs/group/settings/connection.md)
@@ -25,7 +25,7 @@ group or a job level.
lists for this job group
:::note
- Host List Assignments is not a global setting. The pre-configured solutions may
+ Host List Assignments isn't a global setting. The pre-configured solutions may
contain Host List Assignments configured to use Global Default Host Lists, for example All
Domain Controllers. See the
[Default Host Lists](/docs/accessanalyzer/11.6/admin/settings/hostinventory.md#default-host-lists)
@@ -39,14 +39,14 @@ group or a job level.
- [Storage Node](/docs/accessanalyzer/11.6/admin/jobs/group/settings/storage.md)
– Use the default storage profile or break inheritance on where this job group's data is stored
-If changes are made, click **Save** to implement the changes. Changes are not implemented unless
-they are saved.
+If you make changes, click **Save** to implement them. Changes aren't implemented unless
+you save them.
-**Host List Assignment** and **Connection** are the two settings that should always be confirmed
+You should always confirm **Host List Assignment** and **Connection**
before executing a job group or job when data collection is included. The assigned host lists
-contains the hosts that are targeted by the job’s data collection queries. The assigned Connection
-Profile must have the appropriate level of permissions in order for the data collection to be
-successful. See the
+contains the hosts that the job’s data collection queries target. The assigned Connection
+Profile must have the appropriate level of permissions for the data collection to
+succeed. See the
[Permissions by Data Collector (Matrix)](/docs/accessanalyzer/11.6/admin/datacollector/permissionmatrix.md)
-topic for information on the recommended permissions needed on the targeted hosts in order to
+topic for information on the recommended permissions needed on the targeted hosts to
collect data.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/group/settings/storage.md b/docs/accessanalyzer/11.6/admin/jobs/group/settings/storage.md
index d00106cb2e..58ba3843e2 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/group/settings/storage.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/group/settings/storage.md
@@ -14,9 +14,9 @@ topic for additional information.
By default, all job groups are set to inherit the **Use Default Profile** option from the global
-level or a parent job group. If it is necessary for a job group to send data to a different
+level or a parent job group. If a job group needs to send data to a different
database, the Storage Profile must already exist at the global level. Select the **Use This
-Profile** radio button and choose the non-default Storage Profile from the drop-down menu.
+Profile** radio button and choose the non-default Storage Profile from the dropdown menu.
Selecting the **Set all the child objects to inherit these settings** option forces inheritance of
this setting to all sub-groups and jobs within the job group. When enabled, this option overrides
diff --git a/docs/accessanalyzer/11.6/admin/jobs/instantiate.md b/docs/accessanalyzer/11.6/admin/jobs/instantiate.md
index f78e06fc17..523019a785 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/instantiate.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/instantiate.md
@@ -14,7 +14,7 @@ Jobs directory. The default location is:
-The folder is opened from within the Enterprise Auditor Console by right-clicking on the desired
+Open the folder from within the Enterprise Auditor Console by right-clicking the desired
**Jobs** node and selecting **Explore Folder**.
@@ -23,21 +23,21 @@ The naming convention of the folders controls what is visible in the Jobs tree.
prefix for all job groups. `JOB_` is the prefix for all jobs. Changing the prefix removes the object
from the Jobs tree without deleting it.
-Instantiating new, external jobs is as easy as copying and pasting the job or job group into this
-location. However, copying an existing job within the Jobs directory is not supported. If the job
+To instantiate new, external jobs, copy and paste the job or job group into this
+location. However, copying an existing job within the Jobs directory isn't supported. If the job
already exists within the Enterprise Auditor Console server, copying outside of the console may
result in reporting issues.
:::warning
-Do not use these steps to copy an existing job.
+Don't use these steps to copy an existing job.
:::
There is no need to close the Enterprise Auditor application to instantiate a new job. Follow the
steps to instantiate a new job into the Enterprise Auditor Jobs tree:
-**Step 1 –** Obtain the job or job group to be instantiated. If it has been sent by Netwrix, a
-colleague, or other entity, it is most likely in one of two formats:
+**Step 1 –** Obtain the job or job group to instantiate. If Netwrix, a
+colleague, or another entity sent it, it's most likely in one of two formats:
- Archive (.zip, .rar, and so on)
- Folder containing the job content (JOB*[name of job] or GROUP*[name of job group])
@@ -50,7 +50,7 @@ colleague, or other entity, it is most likely in one of two formats:
-- If in archive format, extract the desired content to the Jobs directory
+- If in archive format, extract the content you want to the Jobs directory
- Use the default path or specify a specific path using the browse button (…)
- Select whether to **Show extracted files when complete**. This option is selected by default.
@@ -64,7 +64,7 @@ match that of the jobs or job groups that are already there.
-**Step 4 –** In the Enterprise Auditor Console, right-click on the **Jobs** node and select
+**Step 4 –** In the Enterprise Auditor Console, right-click the **Jobs** node and select
**Refresh Tree**.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/ad_passwordexpirationnotification.md b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/ad_passwordexpirationnotification.md
index ea767b3f60..f1317e3133 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/ad_passwordexpirationnotification.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/ad_passwordexpirationnotification.md
@@ -7,10 +7,10 @@ sidebar_position: 10
# AD_PasswordExpirationNotification Job
The AD_PasswordExpirationNotification Job determines when Active Directory user passwords are about
-to expire and can be configured to send notifications to users prior to password expiration. It is
+to expire, and you can configure it to send notifications to users before password expiration. It is
available through the Instant Job Library under the Active Directory library. See the
[Instant Job Wizard](/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md)
-section for instructions to add this instant job into the Jobs tree. Since this job does not require
+section for instructions to add this instant job into the Jobs tree. Since this job doesn't require
a host to target, select Local host on the Hosts page of the Instant Job Wizard.
@@ -26,8 +26,8 @@ Runtime Details:
The AD_PasswordExpirationNotification Job runs analysis tasks that generate tables and configure
password expiration notifications. It also generates a report on passwords expiring within a
-specified parameter, by default within 15 days. If desired, notifications of password expiration can
-be configured to send to a help desk email (through an analysis task) and to the user (through an
+specified parameter, by default within 15 days. If desired, you can configure notifications of password expiration
+to send to a help desk email (through an analysis task) and to the user (through an
action task).
## Analysis Tasks for the AD_PasswordExpirationNotification Job
@@ -91,12 +91,12 @@ AD_PasswordExpirationNotification Job produces the following pre-configured repo
## Customizable Analysis Tasks for the AD_PasswordExpirationNotification Job
Customizable parameters enable Enterprise Auditor users to set the values used to classify user and
-group objects during this job’s analysis. The parameters can be customized and are listed in a
-section at the bottom of the SQL Script Editor. Follow the steps to customize an analysis task’s
-parameters.
+group objects during this job’s analysis. You can customize the parameters, which appear in a
+section at the bottom of the SQL Script Editor. To customize an analysis task’s
+parameters:
:::warning
-Do not change the table names or report name to align with a different value supplied
+Don't change the table names or report name to align with a different value supplied
for this parameter. Modifying the table names will result in analysis and report errors downstream.
Only the report title and descriptions can be modified within the report configuration.
:::
@@ -106,22 +106,22 @@ Only the report title and descriptions can be modified within the report configu
| ---------------------------- | --------------------------- | ------------- | ------------------------------------------------------------------------------------------------- |
| 1. User Password Information | @pswLen | 15 | Number of days left until a password expires, should be set according to an organizations policy. |
-The parameters that can be customized are listed in a section at the bottom of the SQL Script
-Editor. Follow the steps to customize an analysis task’s parameters.
+The parameters you can customize appear in a section at the bottom of the SQL Script
+Editor. To customize an analysis task’s parameters:
**Step 1 –** Navigate to the **AD_PasswordExpirationNotification** > **Configure** node and select
**Analysis** to view the analysis tasks.
**Step 2 –** In the Analysis Selection view, select the **1. User Password Information** Analysis
-Task and click on **Analysis Configuration**. The SQL Script Editor opens.
+Task and click **Analysis Configuration**. The SQL Script Editor opens.
**Step 3 –** In the parameters section at the bottom of the editor, find the Value column.
-Double-click on the current value and change as desired.
+Double-click the current value and change as desired.
:::warning
-Do not change any parameters where the Value states **Created during execution**.
+Don't change any parameters where the Value states **Created during execution**.
:::
@@ -131,7 +131,7 @@ The new value will be applied to the next job execution.
## Notification Analysis Task in the AD_PasswordExpirationNotification Job
-The Notification Analysis Task can be used to send a single email to specified recipients containing
+Use the Notification Analysis Task to send a single email to specified recipients containing
a list of all users whose passwords will expire in the specified number of days, that is the users
listed in the PasswordExpirationNotification_ExpiresWithin15Days table. The analysis is enabled by
default. Therefore, when the job is executed the following message is sent to the specified
@@ -141,7 +141,7 @@ recipient, such as the organization’s help desk, with information from the ass
>
> Support Team,
>
-> Heads-up. The following users are facing password expiration in seven days or less:
+> Heads-up. The following users are facing password expiration in seven days or less:
>
> [ -- Password for [User] ([NTAccount]) expires in [DaysUntilExpiration] days]
>
@@ -150,22 +150,22 @@ recipient, such as the organization’s help desk, with information from the ass
> Netwrix
:::warning
-Do not modify the tags, highlighted in bold text above.
+Don't modify the tags, highlighted in bold text in the preceding message.
:::
-The Subject or message body can be modified, for example to replace `Netwrix` with the
-organization’s name. Follow the steps to configure the 5. Help Desk Notification Analysis Task.
+You can modify the Subject or message body, for example to replace `Netwrix` with the
+organization’s name. To configure the 5. Help Desk Notification Analysis Task:
**Step 1 –** Navigate to the **AD_PasswordExpirationNotification** > **Configure** node and select
**Analysis** to view the Analysis tasks.
**Step 2 –** In the Analysis Selection view, select the **5. Help Desk Notification Analysis Task**
-and click on **Analysis Configuration**. The Notification Data Analysis Module opens.
+and click **Analysis Configuration**. The Notification Data Analysis Module opens.
-**Step 3 –** Use the **Next** button to navigate to the SMTP properties page. Do not make changes to
+**Step 3 –** Use the **Next** button to navigate to the SMTP properties page. Don't make changes to
the preceding pages. The email configuration takes place on the SMTP page. Provide the recipients’
email addresses, Message Subject, and add the notification email content.
@@ -173,7 +173,7 @@ email addresses, Message Subject, and add the notification email content.
In the Recipients section, provide the email addresses in the text box or distribution lists in the
E-mail field (fully qualified address) for those who are to receive this notification, for example
-the organization’s Help Desk. Multiple addresses can be input by adding a semicolon (;) and space
+the organization’s Help Desk. You can input multiple addresses by adding a semicolon (;) and space
between entries.
Use the **Add** and **Remove** buttons to add or remove the address in the E-mail field from the
@@ -183,16 +183,16 @@ per user.
-In the Message section, the **Subject** should be configured. Then set the email content in the text
+In the Message section, configure the **Subject**. Then set the email content in the text
box as desired.
**Step 4 –** To save these configuration changes, use the **Next** button to navigate to the Summary
-page. Do not make changes to any other pages. Click **Finish**. The Notification Data Analysis
+page. Don't make changes to any other pages. Click **Finish**. The Notification Data Analysis
Module window closes.
-**Step 5 –** This notification analysis task is now configured to send emails. In the Analysis
+**Step 5 –** You have now configured this notification analysis task to send emails. In the Analysis
Selection view, ensure the 5. Help Desk Notification Analysis Task is checked so that notifications
can be sent automatically during the execution of the AD_PasswordExpirationNotification Job.
@@ -203,7 +203,7 @@ is executed.
The 1. User Notification Action Task uses the SendMail Action Module to send users notification of
password expiration. It targets the SMTP Address Column of the users whose passwords are going to
-expire within the desired number of days, that is the users listed in the
+expire within the number of days you want, that is the users listed in the
PasswordExpirationNotification_ExpiresWithin15Days_UserNotifications table. The action is enabled by
default. Therefore, when the job is executed the following message is sent to all users in the
associated table:
@@ -212,8 +212,8 @@ associated table:
>
> Hello **[User]**,
>
-> The password for the account **[NTAccount]** expires on **[ExpirationDate]**. Please change the
->password prior to the expiration date. If account profiles are used on mobile devices, please
+> The password for the account **[NTAccount]** expires on **[ExpirationDate]**. change the
+>password before the expiration date. If account profiles are used on mobile devices,
>remember to update the password on each device used.
>
> Thank you,
@@ -221,19 +221,19 @@ associated table:
> Netwrix
:::warning
-Do not change the recipient for the action task. While the tags can be moved, do not
-remove or modify the tags, which are highlighted in bold text above.
+Don't change the recipient for the action task. While you can move the tags, don't
+remove or modify them, which are highlighted in bold text in the preceding message.
:::
-The subject or message body can be modified, for example to replace `Netwrix` with the
-organization’s name. Follow the steps to modify the Subject or message body within the 1. User
-Notification Action Task.
+You can modify the subject or message body, for example to replace `Netwrix` with the
+organization’s name. To modify the Subject or message body within the 1. User
+Notification Action Task:
:::note
-It is necessary for the
-PasswordExpirationNotification_ExpiresWithin15Days_UserNotifications table to exist in the database
-before this action task can be modified.
+The
+PasswordExpirationNotification_ExpiresWithin15Days_UserNotifications table must exist in the database
+before you can modify this action task.
:::
@@ -244,12 +244,12 @@ before this action task can be modified.
on **Action Properties** to view the actions.
:::warning
-Do not modify the action task properties.
+Don't modify the action task properties.
:::
**Step 3 –** In the Action Properties view, the action properties and a preview of the users from
-the associated table are displayed. Click **Configure Action**. The Send Mail Action Module Wizard
+the associated table appear. Click **Configure Action**. The Send Mail Action Module Wizard
opens.
@@ -262,5 +262,5 @@ Wizard closes.
**Step 6 –** Click **Save** on the Action Properties view.
-When the action task is enabled, it executes as part of the job. Optionally, the action task can be
-manually executed.
+When the action task is enabled, it executes as part of the job. Optionally, you can
+manually execute the action task.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/ex_registerazureappauth.md b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/ex_registerazureappauth.md
index adc87d905e..dd774918aa 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/ex_registerazureappauth.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/ex_registerazureappauth.md
@@ -22,7 +22,7 @@ authentication and provision appropriate permissions for Exchange Online scans.
- Azure AD PowerShell module installed on targeted hosts
:::note
- If the module is not already installed, the job will attempt to install it.
+ If the module isn't already installed, the job will attempt to install it.
:::
@@ -49,10 +49,10 @@ authentication and provision appropriate permissions for Exchange Online scans.
## Using the EX_RegisterAzureAppAuth Job
-Follow the steps to configure and run the EX_RegisterAzureAppAuth Job.
+To configure and run the EX_RegisterAzureAppAuth Job:
**Step 1 –** In Enterprise Auditor navigate to the Exchange Job Group (or any other Job Group you
-wish to place the EX_RegistureAzureApp job into).
+want to place the EX_RegistureAzureApp job into).
**Step 2 –** Click **Add Instant Job** to open the Instant Job Wizard.
@@ -79,7 +79,7 @@ to provide the full environment name. For a standard tenant, leave this option b
**Step 7 –** On the **Configure** > **Hosts** node, select the target hosts. The targeted hosts
should be the Microsoft Entra tenant name (for example, `myorg.onmicrosoft.com`). Click **Save**.
-The job is now ready to be run.
+The job is now ready to run.
**Step 8 –** Run the EX_RegisterAzureAppAuth Job.
@@ -87,16 +87,16 @@ The job is now ready to be run.
Log-in as a Global Administrator, and grant administrator consent to the Application's configured
API Permissions.
-- If this login attempt fails or you close the browser, you will need to login to Microsoft Entra ID
+- If this login attempt fails or you close the browser, you will need to log in to Microsoft Entra ID
as a Global Administrator and navigate to the Application's API Permissions to grant Admin Consent
- before the Application can be used for Exchange scans in Enterprise Auditor.
+ before you can use the Application for Exchange scans in Enterprise Auditor.
-The Microsoft Entra ID application is now provisioned with the necessary permissions for Exchange
-Online scans. There will be a new Connection Profile for this Application. Restart the Enterprise
+The job has now provisioned the Microsoft Entra ID application with the necessary permissions for
+Exchange Online scans. There will be a new Connection Profile for this Application. Restart the Enterprise
Auditor Console and enter a password to use this Connection Profile.
:::tip
-Remember, the required rights and roles for Exchange Online still need to be configured. See the
+Remember, you still need to configure the required rights and roles for Exchange Online. See the
[Target Exchange Online Requirements, Permissions, and Ports](/docs/accessanalyzer/11.6/requirements/exchange/exchangeonline/exchangeonline.md)
topic for additional information.
:::
diff --git a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/fs_defend_sdd.md b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/fs_defend_sdd.md
index 68c700c5b4..6eb93c9d43 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/fs_defend_sdd.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/fs_defend_sdd.md
@@ -81,9 +81,9 @@ The default action is:
## Custom Connection Profile for FS_DEFEND_SDD Job
-The FS_DEFEND_SDD Job requires a custom Connection Profile to authenticate to Threat Manager. The
-credential for the Connection Profile must be created with the Web Services (JWT) account type.
-Remember, the Threat Manager App Token is generated within Threat Manager.
+The FS_DEFEND_SDD Job requires a custom Connection Profile to authenticate to Threat Manager. You
+must create the credential for the Connection Profile with the Web Services (JWT) account type.
+Remember, Threat Manager generates the App Token.
Create a Connection Profile and set the following information on the User Credentials window:
diff --git a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/fs_migrateschema.md b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/fs_migrateschema.md
index 38cd823e48..642cd93993 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/fs_migrateschema.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/fs_migrateschema.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# FS_MigrateSchema Job
-The FS_Migrate_Schema Job migrates the schema in order to support the use of 64-bit ResourceID's
+The FS_Migrate_Schema Job migrates the schema to support the use of 64-bit ResourceID's
without affecting data. It is available through the Instant Job Library under the File System
library. See the
[Instant Job Wizard](/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md)
@@ -25,7 +25,7 @@ Runtime Details:
- Multi-console Support – Not supported
- Additional Notes – None
-The FS_Migrate Schema Job migrates the schema in order to support the use of 64-bit ResourceID's
+The FS_Migrate Schema Job migrates the schema to support the use of 64-bit ResourceID's
without affecting data.
## Analysis Tasks for the FS_MigrateSchema Job
@@ -34,7 +34,7 @@ Navigate to the **Jobs** > **FS_MigrateSchema** > **Configure** node and select
the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -43,23 +43,23 @@ preconfigured for this job.
The default analysis tasks are:
-- 1.Migrate Resources – Migrates the SA_FSAA_Resources table to leverage 64-bit IDs
-- 2.Migrate UnixRights – Migrates the SA_FSAA_UnixRights table to leverage 64-bit IDs
-- 3.Migrate Gates – Migrates the SA_Gates table to leverage 64-bit IDs
-- 4.Migrate GatesProxy – Migrates the SA_FSAA_GatesProxy table to leverage 64-bit IDs
-- 5.Migrate Exceptions – Migrates the SA_FSAA_Exceptions table to leverage 64-bit IDs
-- 6.Migrate ProbableOwners – Migrates the SA_FSAA_ProbableOwners table to leverage 64-bit IDs
-- 7.Migrate FileSizes – Migrates the SA_FSAA_FileSizes table to leverage 64-bit IDs
-- 8.Migrate FileTypes – Migrates the SA_FSAA_FileTypes table to leverage 64-bit IDs
-- 9.Migrate FileAges – Migrates the SA_FSAA_FileAges table to leverage 64-bit IDs
-- 10.Migrate FileTags – Migrates the SA_FSAA_FileTags table to leverage 64-bit IDs
-- 11.Migrate DFS Links – Migrates the SA_FSDFS_Links table to leverage 64-bit IDs
-- 12.Migrate DLP Matches – Migrates the SA_FSDLP_Matches table to leverage 64-bit IDs
-- 13.Migrate DLP MatchHits – Migrates the SA_FSDLP_MatchHits table to leverage 64-bit IDs
+- 1.Migrate Resources – Migrates the SA_FSAA_Resources table to use 64-bit IDs
+- 2.Migrate UnixRights – Migrates the SA_FSAA_UnixRights table to use 64-bit IDs
+- 3.Migrate Gates – Migrates the SA_Gates table to use 64-bit IDs
+- 4.Migrate GatesProxy – Migrates the SA_FSAA_GatesProxy table to use 64-bit IDs
+- 5.Migrate Exceptions – Migrates the SA_FSAA_Exceptions table to use 64-bit IDs
+- 6.Migrate ProbableOwners – Migrates the SA_FSAA_ProbableOwners table to use 64-bit IDs
+- 7.Migrate FileSizes – Migrates the SA_FSAA_FileSizes table to use 64-bit IDs
+- 8.Migrate FileTypes – Migrates the SA_FSAA_FileTypes table to use 64-bit IDs
+- 9.Migrate FileAges – Migrates the SA_FSAA_FileAges table to use 64-bit IDs
+- 10.Migrate FileTags – Migrates the SA_FSAA_FileTags table to use 64-bit IDs
+- 11.Migrate DFS Links – Migrates the SA_FSDFS_Links table to use 64-bit IDs
+- 12.Migrate DLP Matches – Migrates the SA_FSDLP_Matches table to use 64-bit IDs
+- 13.Migrate DLP MatchHits – Migrates the SA_FSDLP_MatchHits table to use 64-bit IDs
- 14.Migrate DLP MatchHits Subject Profile – Migrates the SA_FSDLP_MatchHits_SubjectProfile table to
- leverage 64-bit IDs
-- 15.Migrate FSAC ActivityEvents – Migrates the SA_FSAC_ActivityEvents table to leverage 64-bit IDs
-- 16.Migrate DailyActivity – Migrates the SA_FSAC_DailyActivity table to leverage 64-bit IDs
-- 17.Migrate FSAC RenameTargets – Migrates the SA_FSAC_RenameTargets table to leverage 64-bit IDs
-- 18.Migrate FSAC Exceptions – Migrates the SA_FSAC_Exceptions table to leverage 64-bit IDs
+ use 64-bit IDs
+- 15.Migrate FSAC ActivityEvents – Migrates the SA_FSAC_ActivityEvents table to use 64-bit IDs
+- 16.Migrate DailyActivity – Migrates the SA_FSAC_DailyActivity table to use 64-bit IDs
+- 17.Migrate FSAC RenameTargets – Migrates the SA_FSAC_RenameTargets table to use 64-bit IDs
+- 18.Migrate FSAC Exceptions – Migrates the SA_FSAC_Exceptions table to use 64-bit IDs
- 19.Refresh Views – Updates viewable metadata
diff --git a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md
index d27180b6ab..1c337e15f4 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md
@@ -13,12 +13,12 @@ problems. The instant solutions available align to an organization’s license k
the[Solutions](/docs/accessanalyzer/11.6/solutions/overview.md) topic
for additional information.
-Follow the steps to install an instant solution or an instant job with the Instant Job Wizard.
+To install an instant solution or an instant job with the Instant Job Wizard:
-**Step 1 –** Select the Jobs tree (for an instant solution) or the desired job group (for an instant
-job), right-click on the node, and select **Add Instant Job**.
+**Step 1 –** Select the Jobs tree (for an instant solution) or the job group you want (for an instant
+job), right-click the node, and select **Add Instant Job**.
@@ -31,15 +31,15 @@ category, or click the plus icon (+) to expand a category group.
-**Step 4 –** Select the desired instant solution or job. To select multiple instant solutions or
+**Step 4 –** Select the instant solution or job you want. To select multiple instant solutions or
jobs, press the Windows **Ctrl** key and select the items to install. Click **Next**.
-**Step 5 –** Some of the Library selections add a Host Assignment page. If this page does not
+**Step 5 –** Some of the Library selections add a Host Assignment page. If this page doesn't
appear, skip to Step 7. If the page does appear, select either the **Use default settings (Inherit
-from the parent group, if any)** or **Specify individual hosts or hosts lists** option. If the first
-option is selected, skip to Step 7. If the second option is selected, click **Next** to go to the
+from the parent group, if any)** or **Specify individual hosts or hosts lists** option. If you selected the first
+option, skip to Step 7. If you selected the second option, click **Next** to go to the
Host Lists and Individual Hosts wizard pages.
|  | |  |
@@ -47,8 +47,8 @@ Host Lists and Individual Hosts wizard pages.
| Host Lists page | | Individual Hosts page |
**Step 6 –** Some of the Library selections add a Host Lists, and Individual Hosts page. If these
-pages do not appear with the selection, skip to Step 7. If the pages do appear, check the host list
-to be assigned to the job group or job. Alternatively enter hosts manually. Then click **Next**.
+pages don't appear with the selection, skip to Step 7. If the pages do appear, check the host list
+to assign to the job group or job. Alternatively enter hosts manually. Then click **Next**.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/sas_executionstatistics.md b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/sas_executionstatistics.md
index 89d6d66871..850f4aa832 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/sas_executionstatistics.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/sas_executionstatistics.md
@@ -10,7 +10,7 @@ The SAS_ExecutionStatistics Job tracks historical performance of Enterprise Audi
functions and highlights when a particular task takes an abnormal length of time to execute. It is
available through the Instant Job Library under the Enterprise Auditor Utilities library. See the
[Instant Job Wizard](/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md)
-section for instructions to add this instant job into the Jobs tree. Since this job does not require
+section for instructions to add this instant job into the Jobs tree. Since this job doesn't require
a host to target, select Local host on the Hosts page of the Instant Job Wizard.
The job is dependent upon the Job Statistics Retention configuration in the **Settings** >
@@ -40,7 +40,7 @@ Navigate to the **Jobs** > **SAS_ExecutionStatistics** > **Configure** node and
to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/sp_registerazureappauth.md b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/sp_registerazureappauth.md
index cab680351c..5ced6b9651 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/sp_registerazureappauth.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/sp_registerazureappauth.md
@@ -15,14 +15,14 @@ authentication and provision appropriate permissions for SharePoint Online scans
- Microsoft Entra ID Global Admin credential
- A credential with the username `newapp` that contains the password for the new application
-- Microsoft Graph API PowerShell module to be installed on targeted hosts
+- Microsoft Graph API PowerShell module installed on targeted hosts
## Instantiate the SP_RegisterAzureAppAuth Job.
-Follow the steps to instantiate the SP_RegisterAzureAppAuth Job.
+To instantiate the SP_RegisterAzureAppAuth Job:
**Step 1 –** In Enterprise Auditor navigate to the SharePoint Job Group (or any other Job Group you
-wish to place the SP_RegistureAzureApp job into).
+want to place the SP_RegistureAzureApp job into).
**Step 2 –** Click **Add Instant Job** to open the Instant Job Wizard.
@@ -36,13 +36,13 @@ Microsoft Entra ID application. Click **Save**.
**Step 5 –** On the **Configure** > **Hosts** node, select the targeted host. The targeted host
should be the Microsoft Entra ID tenant on which you want to install the Microsoft Entra ID
-application (for example, `myorg.onmicrosoft.com`). Click **Save**. The job is now ready to be run.
+application (for example, `myorg.onmicrosoft.com`). Click **Save**. The job is now ready to run.
-After the job successfully runs it will open a browser window to Microsoft Entra ID that, when
-logged-in as a Global Administrator, allows the user to grant administrator consent to the
+After the job successfully runs, it opens a browser window to Microsoft Entra ID. Log in as a
+Global Administrator to grant administrator consent to the
Application's configured API Permissions. If the login attempt fails, or the user closes the
-browser, they will need to login to Microsoft Entra ID as a Global Administrator and navigate to the
-Application's API Permissions to grant Admin Consent before the Application can be used for
+browser, they will need to log in to Microsoft Entra ID as a Global Administrator and navigate to the
+Application's API Permissions to grant Admin Consent before you can use the Application for
SharePoint scans in Enterprise Auditor.
**Additional Considerations**
@@ -53,8 +53,8 @@ SharePoint scans in Enterprise Auditor.
directory), the Microsoft Entra ID application's password, and a numeric designator for the
Microsoft 365 environment (0 is the default for production environments; the other supported
options are 1 for pre-production environments, 2 for China, 3 for Germany, 4 for US Government, 5
- for US Government-High, and 6 for US Government-DoD). To allow for multiple unique certificates
- for different Microsoft Entra ID tenants to be stored on the same Enterprise Auditor server, the
+ for US Government-High, and 6 for US Government-DoD). To allow multiple unique certificates
+ for different Microsoft Entra ID tenants to reside on the same Enterprise Auditor server, the
script appends the targeted host name (without the domain) to the filename of the PFX file
generated by the script. For example, if the targeted host is `myorg.onmicrosoft.com`, then the
password for the connection profile would be:
diff --git a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/sp_removehost.md b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/sp_removehost.md
index cdd86c59ca..90e483a0bf 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/instantjobs/sp_removehost.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/instantjobs/sp_removehost.md
@@ -31,7 +31,7 @@ Navigate to the **Jobs** > **SP_RemoveHost** > **Configure** node and select **A
the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -40,4 +40,4 @@ preconfigured for this job.
The default analysis tasks are:
-- Remove Host(s) — Remove Scanned Hosts from Tier 1
+- Remove Hosts — Remove Scanned Hosts from Tier 1
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/configure/actions.md b/docs/accessanalyzer/11.6/admin/jobs/job/configure/actions.md
index ff20b9a08c..7e38ec915a 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/configure/actions.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/configure/actions.md
@@ -7,8 +7,8 @@ sidebar_position: 40
# Actions Node
The Actions node uses Enterprise Auditor action modules to take action on collected and analyzed
-data. Action can be taken on objects leveraging collected data or analyzed data, for example from a
-listing of locked-out accounts, an action can be executed to unlock those accounts.
+data. You can take action on objects leveraging collected data or analyzed data. For example, from a
+listing of locked-out accounts, you can execute an action to unlock those accounts.
:::note
Action modules are available with a special Enterprise Auditor license.
@@ -52,7 +52,7 @@ The Actions section at the top has five options:
- Execute Action – Opens the Action Execution window and starts executing the selected action
- - Does not require an action task to be checked, only selected
+ - Doesn't require checking an action task, only selecting it
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysis.md b/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysis.md
index 94cf694ddb..003b9096aa 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysis.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysis.md
@@ -10,9 +10,9 @@ The Analysis node uses Enterprise Auditor analysis modules to run analysis tasks
There are two basic types of analysis modules. Most analysis modules correlate, format, and
transform collected data into powerful data views for end-stage reports and graphs.
-The Notification analysis module allows for the ability to send an email notice when a trigger is
-met, for example an email can be sent to an administrator to notify that disk space has reached a
-particular point (the trigger) and needs to be addressed before space runs out.
+The Notification analysis module lets you send an email notice when a trigger is
+met. For example, it can send an email to an administrator to notify that disk space has reached a
+particular point (the trigger) and needs attention before space runs out.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md b/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md
index ba702b437e..cdf7d88483 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md
@@ -6,12 +6,12 @@ sidebar_position: 10
# Configure the Customizable Parameters in an Analysis Task
-The parameters that can be customized and are listed in a section at the bottom of the SQL Script
-Editor. Follow the steps to customize an analysis task’s parameters.
+You can customize the parameters, which appear in a section at the bottom of the SQL Script
+Editor. To customize an analysis task’s parameters:
**Step 1 –** Navigate to the Job’s **Configure** node and select **Analysis**.
-**Step 2 –** In the Analysis Selection view, select the desired analysis task and click **Analysis
+**Step 2 –** In the Analysis Selection view, select the analysis task you want and click **Analysis
Configuration**. The SQL Script Editor opens.
**Step 3 –** At the top of the SQL Script Editor, select **Parameters**.
@@ -27,11 +27,11 @@ based on the Job.
**Step 4 –** In the parameters section at the bottom of the editor, find the Value column.
:::warning
-Do not change any parameters where the Value states **Created during execution**.
+Don't change any parameters where the Value states **Created during execution**.
:::
-- Double-click on the customizable value and change as desired
+- Double-click the customizable value and change as desired
**Step 5 –** Click **Save and Close** to finalize the customization and close the SQL Script Editor.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/configure/hosts.md b/docs/accessanalyzer/11.6/admin/jobs/job/configure/hosts.md
index e7036abdef..8f0df880ac 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/configure/hosts.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/configure/hosts.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Hosts Node
The Hosts node provides the option to assign a preconfigured host list at the job level. It also
-provides a way to manually assign hosts to be targeted by the job using Host Selection pane.
+provides a way to manually assign hosts for the job to target using Host Selection pane.
@@ -20,12 +20,12 @@ it triggers a host inventory query according to the global settings. The host wi
any individual host lists. See the [Manually Add Hosts to a Job](#manually-add-hosts-to-a-job) topic
for additional information.
-Click **Save** to apply any changes to the host selection. Changes are not implemented unless they
-are saved.
+Click **Save** to apply any changes to the host selection. Changes aren't implemented unless you
+save them.
## Manually Add Hosts to a Job
-Hosts can be added manually at the job level even when inheritance (Use Default Setting) is used for
+You can manually add hosts at the job level even when inheritance (Use Default Setting) is used for
host list assignment. The job targets the hosts in any assigned host lists as well as any manually
added at the job level. Follow these directions to manually add a host to a job.
@@ -38,8 +38,8 @@ added at the job level. Follow these directions to manually add a host to a job.
**Step 2 –** In the Individual hosts section of the Host Selection view, enter the Host name in the
textbox and click **Add**.
-**Step 3 –** Repeat the previous step for each host to be added.
+**Step 3 –** Repeat the previous step for each host to add.
**Step 4 –** Click **Save** and then **OK** to confirm the changes.
-The manually added host is now targeted by the job.
+The job now targets the manually added host.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/configure/overview.md b/docs/accessanalyzer/11.6/admin/jobs/job/configure/overview.md
index af3887843d..658cb56575 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/configure/overview.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/configure/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Configure Node
-Changes to configurations for the job’s assigned Host Lists, Queries, Analyses, Actions, and Reports
-are created through the **[Job]** > **Configure** node or through the Configure shortcut on the
+You create changes to configurations for the job’s assigned Host Lists, Queries, Analyses, Actions,
+and Reports through the **[Job]** > **Configure** node or through the Configure shortcut on the
job’s Description page.
| | |
@@ -18,7 +18,7 @@ job’s Description page.
The sub-nodes under the **[Job]** > **Configure** node are:
- [Hosts Node](/docs/accessanalyzer/11.6/admin/jobs/job/configure/hosts.md)
- – Assign a host list at the job level or manually add hosts to be targeted by the job
+ – Assign a host list at the job level or manually add hosts for the job to target
- [Queries Node](/docs/accessanalyzer/11.6/admin/jobs/job/configure/queries.md)
– Select and configure a Enterprise Auditor data collector to scan targeted hosts
- [Analysis Node](/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysis.md)
@@ -26,11 +26,11 @@ The sub-nodes under the **[Job]** > **Configure** node are:
- [Actions Node](/docs/accessanalyzer/11.6/admin/jobs/job/configure/actions.md)
– Create and configure Action tasks for taking action on collected and analyzed data
- [Reports Node](/docs/accessanalyzer/11.6/admin/jobs/job/configure/reports.md)
- – Create and configure Reports to be generated during job execution
+ – Create and configure Reports to generate during job execution
## Configure Page
-The job's Configure Page provides an overview with shortcuts for options that are configured in the
+The job's Configure Page provides an overview with shortcuts for options you configure in the
job's Configure Node.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/configure/queries.md b/docs/accessanalyzer/11.6/admin/jobs/job/configure/queries.md
index 47b7259675..44cbd213ae 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/configure/queries.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/configure/queries.md
@@ -7,29 +7,29 @@ sidebar_position: 20
# Queries Node
The Queries node uses a Enterprise Auditor data collector to run scans against the targeted hosts.
-Different data collectors are designed for different types of collection. It is necessary for the
-Connection Profile associated with the target hosts to have a sufficient level of rights for the
-selected data collector. See the
+Different data collectors are designed for different types of collection. The Connection Profile
+associated with the target hosts must have a sufficient level of rights for the selected data
+collector. See the
[Permissions by Data Collector (Matrix)](/docs/accessanalyzer/11.6/admin/datacollector/permissionmatrix.md)
topic for a chart with recommended permissions per data collector.
-The Query Selection view lists all queries for the selected job. Though it is possible to have
-multiple queries in a single job, it is not usually recommended. The listed information includes:
+The Query Selection view lists all queries for the selected job. Though a job can have
+multiple queries, avoid using more than one when possible. The listed information includes:
- Name – Name of the query (as provided by the creator of the query)
- Source – Name of the Enterprise Auditor data collector
- Table – Name of the Native Data table
-- Enumerates – Whether or not the data collector will return enumerated data, or multiple lines of
+- Enumerates – Whether the data collector will return enumerated data, or multiple lines of
data per target host
- If **Yes**, only one query can write to a single table
- If **No**, then multiple related queries can write to a single table
- Properties – Number of the properties to be returned
- Filters – Number of in-line filters applied to the data being returned by the query
-- Script – Whether or not a VB Script was added to the query
+- Script – Whether a VB Script was added to the query
- If **Yes**, a VB Script was added to query execution
- - If **No**, a VB Script was not added to query execution
+ - If **No**, a VB Script wasn't added to query execution
- Description – Description of the query (as provided by the creator of the query)
## Tables
@@ -43,18 +43,17 @@ The Tables section at the top has three options:
- Add Table – Adds an additional native data table and associated query to the selected job
- Rename Table – Opens the Rename Table window for changing the native data table name
- Delete Table – Deletes the selected table from the list, all associated query tasks, and the
- database table if it has already been created. This action does require confirmation.
+ database table if it has already been created. This action requires confirmation.
:::warning
- Do not delete the last table in a job’s Query Selection view. Doing so will also
- delete the Messages table. In order to delete the last table, it is necessary to delete the job.
+ Don't delete the last table in a job’s Query Selection view. Doing so will also
+ delete the Messages table. To delete the last table, delete the job.
:::
## Queries
-The Queries section is where the job’s preconfigured queries can be edited and where new queries can
-be added.
+The Queries section is where you can edit the job’s preconfigured queries and add new queries.
@@ -65,7 +64,7 @@ The Queries section has four options and includes the list of queries for the se
[Add Query from Library](/docs/accessanalyzer/11.6/admin/datacollector/overview.md#add-query-from-library)
topic for additional information.
- Create Query – Opens the Query Properties window for creating and configuring queries
-- Delete Query – Deletes the selected query from the list. This action does require confirmation.
+- Delete Query – Deletes the selected query from the list. This action requires confirmation.
- Query Properties – Opens the Query Properties window for the selected query
- This option is used for query modifications
- See the
@@ -102,9 +101,9 @@ The options in the Queries node right-click menu are:
## Host List
-Jobs with configured queries require a host list to be assigned. This can be done at either the Job
-Group or Job level. Whichever location is used to set the host list for query execution should also
-be the location where the Connection Profile is assigned. See the
+Jobs with configured queries require you to assign a host list. You can do this at either the Job
+Group or Job level. Whichever location you use to set the host list for query execution should also
+be the location where you assign the Connection Profile. See the
[Job Properties](/docs/accessanalyzer/11.6/admin/jobs/job/properties/overview.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/configure/reports.md b/docs/accessanalyzer/11.6/admin/jobs/job/configure/reports.md
index 3dbdc05381..fd95df388a 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/configure/reports.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/configure/reports.md
@@ -6,17 +6,17 @@ sidebar_position: 50
# Reports Node
-The Reports node is for configuring reports to be generated during job execution.
+The Reports node is for configuring reports to generate during job execution.
-The Reports view lists any reports that have been configured for the selected job and options
+The Reports view lists any reports you've configured for the selected job and options
related to configuring reports. The options at the top of the Reports view are:
- Properties – Opens the
[Job Properties](/docs/accessanalyzer/11.6/admin/jobs/job/properties/overview.md)
page for the job that the report is for
-- Run Now – Runs the currently selected job that the report is for
+- Run Now – Runs the selected job that the report is for
- Open Folder – Opens the Report’s folder location with supporting files in the Windows Explorer
- View Log – Opens the log for the job that the report is for
@@ -33,8 +33,8 @@ contains the following options for adding reports to the table:
- Paste – Paste a cut or copied report into the selected job
- - The paste option is accessed from the vertical ellipsis menu of the header row of the Reports
- table
+ - You can access the paste option from the vertical ellipsis menu of the header row of the
+ Reports table
@@ -48,9 +48,9 @@ on a reports row:
- Copy – Copies the report to the clipboard
- Delete – Deletes the report
-Once a report is generated, it can be viewed in several locations depending on the configuration.
-Report configurations may also be copied to other reports to generate preferred outputs for
-alternate jobs. However, all generated reports can be viewed in the job’s **Results** node.
+After you generate a report, you can view it in several locations depending on the configuration.
+You can also copy report configurations to other reports to generate preferred outputs for
+alternate jobs. However, you can view all generated reports in the job’s **Results** node.
See the
[Reporting](/docs/accessanalyzer/11.6/admin/report/overview.md) topic
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/create.md b/docs/accessanalyzer/11.6/admin/jobs/job/create.md
index c5e3cdabbd..cccaab75e0 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/create.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/create.md
@@ -6,11 +6,11 @@ sidebar_position: 50
# Create a New Job
-Follow the steps to create a new job.
+To create a new job:
-**Step 1 –** Select the Jobs tree or the desired job group to add the new job to. Right-click and
+**Step 1 –** Select the Jobs tree or the job group you want to add the new job to. Right-click and
select **Create Job**.
@@ -19,20 +19,20 @@ select **Create Job**.
considerations for naming conventions:
:::warning
-Do not end a job name with a space.
+Don't end a job name with a space.
:::
- There can never be two jobs with the same name. Enterprise Auditor automatically appends a numeral
to the end of a job name to avoid duplicates, for example `NewJob1`.
-- No special characters can be used. See the Microsoft
+- Don't use special characters. See the Microsoft
[Naming Conventions](https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file#naming-conventions)
article for limitations.
-- Jobs in a group are run alphanumerically
+- Enterprise Auditor runs jobs in a group alphanumerically
- When possible, keep names short to avoid report path errors caused by Microsoft’s maximum path
- length. See the Microsoft article referenced above.
+ length. See the Microsoft article referenced earlier in this topic.
-The new job is now ready to be configured. See the
+You can now configure the new job. See the
[Data Collectors](/docs/accessanalyzer/11.6/admin/datacollector/overview.md),
[Analysis Modules](/docs/accessanalyzer/11.6/admin/analysis/overview.md),
[Action Modules](/docs/accessanalyzer/11.6/admin/action/overview.md),
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/disableenable.md b/docs/accessanalyzer/11.6/admin/jobs/job/disableenable.md
index b331f29003..c48bf12aaf 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/disableenable.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/disableenable.md
@@ -6,57 +6,56 @@ sidebar_position: 60
# Disable or Enable a Job
-Job groups may contain individual jobs that should not be run when the entire job group is run. Some
-job groups also contain jobs that can optionally be run separately from the rest of the job group.
-Individual jobs can be disabled or enabled at the job group or job level. Disabled jobs do not
-execute when the parent job group is run.
+Job groups may contain individual jobs that shouldn't run when you run the entire job group. Some
+job groups also contain jobs that you can optionally run separately from the rest of the job group.
+You can disable or enable individual jobs at the job group or job level. Disabled jobs don't
+execute when you run the parent job group.
-If the role based access feature is enabled, the ability to enable and disable jobs is limited by
-the assigned role. See the
+If you enable the role based access feature, the assigned role limits the ability to enable and
+disable jobs. See the
[Role Based Access](/docs/accessanalyzer/11.6/admin/settings/access/rolebased/overview.md)
topic for additional information.
## Disable a Job
-Jobs can be disabled from the Jobs tree. Disabled jobs cannot be run manually, through a scheduled
-task, or executed as part of the job group. Follow the steps to disable a job.
+You can disable jobs from the Jobs tree. You can't run a disabled job manually, through a scheduled
+task, or as part of job group execution. To disable a job:
**Step 1 –** Select a job group or job.
:::note
-When disabling jobs at the job group level, all jobs contained in the job group are
-disabled, but the job group is not disabled. Any additional jobs added to that job group at a later
-time will be enabled by default.
+When you disable jobs at the job group level, all jobs in the job group become disabled, but the
+job group itself remains enabled. Any additional jobs added to that job group later are enabled by
+default.
:::
-**Step 2 –** Right-click on the job group or job and select **Disable Job(s)** from the menu.
+**Step 2 –** Right-click the job group or job and select **Disable Jobs** from the menu.
-The job is now disabled. If a job group was selected, all the jobs in the group are now disabled.
+The job is now disabled. If you selected a job group, all the jobs in the group are now disabled.
Disabled jobs are grayed out, and a red cross is displayed in front of the job.
A yellow banner also notifies users that a job is disabled in the Job’s Description page.
-Additionally, if a disabled job is run, a warning message appears in the Messages table stating:
-`[UserName] requested [JobName] to run but it is in a disabled state`. Job statistics also do not
+Additionally, if you run a disabled job, a warning message appears in the Messages table stating:
+`[UserName] requested [JobName] to run but it is in a disabled state`. Job statistics also don't
display on the job’s description page.
## Enable a Job
-Jobs that have been disabled can be enabled from the Jobs tree. Following the steps to enable a
-disabled job.
+You can enable disabled jobs from the Jobs tree.
**Step 1 –** Select the disabled job. If multiple jobs in a job group are disabled, select the job
group to enable all of the disabled jobs.
-**Step 2 –** Right-click on the job group or job and select **Enable Job(s)** from the menu.
+**Step 2 –** Right-click the job group or job and select **Enable Jobs** from the menu.
-The job is now enabled. If a job group was selected, all the jobs in the group are now enabled.
+The job is now enabled. If you selected a job group, all the jobs in the group are now enabled.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/overview.md b/docs/accessanalyzer/11.6/admin/jobs/job/overview.md
index 4ec41b025c..57983013cd 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/overview.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 20
# Jobs
An Enterprise Auditor job is responsible for running data collection, conducting data analysis,
-executing actions on collected or analyzed data, or generating reports. Each of these are configured
-in the corresponding section under the job’s Configure node. A single job can be configured to
+executing actions on collected or analyzed data, or generating reports. You configure each of these
+in the corresponding section under the job’s Configure node. You can configure a single job to
execute one or multiple tasks. See the
[Configure Node](/docs/accessanalyzer/11.6/admin/jobs/job/configure/overview.md)
topic for additional information.
@@ -22,20 +22,20 @@ structure to run those jobs together in the proper order.
:::
-Jobs do not have a Settings node like a job group. Job Properties provide the option to break
+Jobs don't have a Settings node like a job group. Job Properties provide the option to break
inheritance on global or job group settings. See the
[Job Properties](/docs/accessanalyzer/11.6/admin/jobs/job/properties/overview.md)
topic for additional information.
-Once a job has been configured and is being executed, job progress can be viewed at the **Running
+After you configure and execute a job, you can view job progress at the **Running
Instances** node on the Navigation pane. See the
[Running Instances Node](/docs/accessanalyzer/11.6/admin/runninginstances/overview.md)
topic for additional information.
-At the bottom of the Enterprise Auditor Console, there is an indication of how many jobs are in
-queue and the **View Job Progress** link, which opens the Running Instances node.
+At the bottom of the Enterprise Auditor Console, an indicator shows how many jobs are in
+queue, along with the **View Job Progress** link, which opens the Running Instances node.
When a job execution has completed, the tables, views, and reports generated by the job are
accessible under the job’s Status and Results nodes. See the
@@ -46,7 +46,7 @@ topics for additional information. Reports are also accessible through the Web C
## Job Description Page
The Job Description page displays shortcuts, links, and important information on the job. The Job
-Page allows users to view and modify common job configurations, such as Connection and Storage
+Page lets users view and modify common job configurations, such as Connection and Storage
profiles, job properties, SQL analysis parameters, and PowerShell parameters. Depending on the type
of job, the description page will appear different and display information specific to the job
selected.
@@ -58,13 +58,12 @@ selected.
The two types of Job Groups in Enterprise Auditor are:
- Pre-configured – The job description page provides a brief summary of the purpose of the job, the
- reports and data contained within it, and summary information of the last five times the job was
- executed
-- User Created – The job description page of User Created jobs will be blank until the job is
- configured
+ reports and data contained within it, and summary information of the last five times the job ran
+- User Created – The job description page of User Created jobs will be blank until you configure
+ the job
Pre-configured job description pages provide users with shortcuts and links to many of the functions
-that can be accessed under the **[Job Group]** > **[Job]** node in the Jobs Tree in the Navigation
+that you can access under the **[Job Group]** > **[Job]** node in the Jobs Tree in the Navigation
Pane.
@@ -93,10 +92,10 @@ The sections and options of the job description page are:
The Overview section provides summary information about the job, and includes the following
information:
-- Inherited settings – Job settings can be applied directly or inherited from a parent job group or
- even the General Settings level. See the
+- Inherited settings – You can apply job settings directly or inherit them from a parent job group
+ or even the General Settings level. See the
[Jobs with Inherited Settings](#jobs-with-inherited-settings) topic for additional information.
-- Reports – Displays a list of reports that are generated by this job
+- Reports – Displays a list of reports this job generates
- Results – Displays a list of data tables and views created and populated by the job
- Configuration - If applicable, configure parameters for the job's analysis tasks
@@ -109,9 +108,9 @@ information:
- Status – Displays information on job status (Running, Success, Error)
- Duration – Displays length of time each job took
-- Graph – Displays a line graph that has information for the last five times the job was executed
+- Graph – Displays a line graph that has information for the last five times the job ran
-Prior to running any job or job group, ensure the following have been properly configured:
+Before running any job or job group, ensure the following have been properly configured:
- Queries, Analysis, Actions, and Reports are configured as desired
- If collecting data, at least one host list has been assigned
@@ -123,13 +122,13 @@ and that the inheritance of settings is adjusted accordingly.
### Jobs with Inherited Settings
-Job settings can be applied directly or inherited from a parent job group or even the General
-Settings level. If settings are applied directly to a job, these are shown in the Overview section
-under the job description:
+You can apply job settings directly or inherit them from a parent job group or even the General
+Settings level. If you apply settings directly to a job, the Overview section shows them under the
+job description:
-In the example above, the **Assigned 1 Host List** setting is applied directly to the job. Other
+In the preceding example, the **Assigned 1 Host List** setting is applied directly to the job. Other
settings are inherited from the parent job group. Clicking the **Show inherited settings** button
opens this list of the inherited settings.
@@ -147,22 +146,22 @@ The following settings can be inherited from a parent:
### Parameter Configuration
-If a job has analysis parameters that can be customized, those parameters can be configured in the
+If a job has analysis parameters you can customize, you can configure those parameters in the
Configuration section of the Job Description Page.
-Follow the steps to configure customizable parameters using the Configuration option on the Job
+To configure customizable parameters using the Configuration option on the Job
Description Page:
**Step 1 –** Navigate to the **Jobs > [Job Group] > [Job]** node. If the job has customizable
-parameters, they will be located under Configuration in the job's Overview section.
+parameters, they appear under Configuration in the job's Overview section.
-**Step 2 –** Click on a parameter to open the Parameter Configuration window.
+**Step 2 –** Click a parameter to open the Parameter Configuration window.
:::note
To view a tool-tip that contains information about the Variable Name and the Task Name
-that the parameter is associated with, hover the mouse over the parameter.
+associated with the parameter, hover the mouse over the parameter.
:::
@@ -171,7 +170,7 @@ that the parameter is associated with, hover the mouse over the parameter.
**Step 3 –** Configure the parameter in the Parameter Configuration window. Click **Save** to save
changes and exit the window. Click **Cancel** to exit without saving.
-The parameter has now been configured. The parameters can also be configured in the Analysis Node
+You have now configured the parameter. You can also configure parameters in the Analysis Node
under the job's Configure Node. See the
[Analysis Node](/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysis.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/properties/autoretry.md b/docs/accessanalyzer/11.6/admin/jobs/job/properties/autoretry.md
index 0cd9afcc45..4d2b6d02da 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/properties/autoretry.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/properties/autoretry.md
@@ -11,7 +11,7 @@ the selected host status values: Offline, Failed, Errors, and Warnings.
-Check the desired Host Status values to generate a retry, and then configure the Refresh Data and
+Check the Host Status values you want to generate a retry, and then configure the Refresh Data and
Retry Options settings. Finally, enter a User name (domain\user) and Password in the Scheduler
Authentication section.
@@ -22,4 +22,4 @@ field.
Click **OK** to save configuration changes and close the Job Properties window. Click **Cancel** if
-no changes were made.
+you didn't make changes.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/properties/connection.md b/docs/accessanalyzer/11.6/admin/jobs/job/properties/connection.md
index aeee232a16..713137fb78 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/properties/connection.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/properties/connection.md
@@ -12,18 +12,18 @@ the system default (the account being used to run Enterprise Auditor), or to sel
Connection Profile.
:::note
-It is a best practice to set the Connection Profile at the same level where the job’s host
-list is set. For example, if the host list is set under the job group’s **Settings** node, then that
-is where the Connection Profile should be configured. If the host list is set under the **[Job]** >
-**Configure** node, then this is where the Connection Profile should be configured.
+As a best practice, set the Connection Profile at the same level where you set the job’s
+host list. For example, if you set the host list under the job group’s **Settings** node, configure
+the Connection Profile there. If you set the host list under the **[Job]** >
+**Configure** node, configure the Connection Profile there.
:::
-Select the desired option to identify the required Connection Profile for the job. See the
+Select the option you want to identify the required Connection Profile for the job. See the
[Connection Node](/docs/accessanalyzer/11.6/admin/jobs/group/settings/connection.md)
topic for additional information for the three connection options.
Click **OK** to save configuration changes and close the Job Properties window. Click **Cancel** if
-no changes were made.
+you didn't make changes.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/properties/general.md b/docs/accessanalyzer/11.6/admin/jobs/job/properties/general.md
index 9f1e54c2f7..b527eb4e06 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/properties/general.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/properties/general.md
@@ -14,13 +14,14 @@ The following options are available:
- Job Name
- Description
-- Log Level – Indicates the job log level, which can be inherited from the global **Settings** >
- **Application** log level or customized here. See below for additional information.
+- Log Level – Indicates the job log level, which you can inherit from the global **Settings** >
+ **Application** log level or customize here. See the following Log Level section for additional
+ information.
- Write CSV Files To Job Output Directory – Exports the native data table created by a query to a
CSV file in the job’s output directory. If there are multiple tables in the job, this option
creates one file per table.
- Timeout [value] minutes – Job’s thread timeout value
-- Command – Provides the ability to enter a command that will be executed from the command line upon
+- Command – lets you enter a command that runs from the command line upon
job completion
## Log Level
@@ -30,7 +31,7 @@ The log level feature includes the following options:
- Use global setting – use the Application log level feature, configured at the global level.
:::note
- By selecting the another option from the drop-down list, you break inheritance for
+ By selecting the another option from the dropdown list, you break inheritance for
this job.
:::
@@ -39,8 +40,8 @@ The log level feature includes the following options:
- Records all Info level information
- Records everything else that happens
- Creates the largest file
-- Info – Records information about what stage of the job is being performed when errors or warnings
- occurred
+- Info – Records information about what stage the job is in when errors or warnings
+ occur
- Records all Warning level information
- Records job progress information
- Warning – Records all warnings which occur during job execution
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/properties/history.md b/docs/accessanalyzer/11.6/admin/jobs/job/properties/history.md
index 4875602277..b98adebbb2 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/properties/history.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/properties/history.md
@@ -14,10 +14,10 @@ broken inheritance at a job group level, or to configure settings just for this
By default, all jobs are set to inherit the Data Retention Period and Log Retention Period settings,
the **Use Default Setting** option. Deselect the **Use Default Settings** option to configure custom
-settings for the job. Then provide the desired Data Retention Period and Log Retention Period
-settings. See the
+settings for the job. Then provide the Data Retention Period and Log Retention Period settings you
+want. See the
[History](/docs/accessanalyzer/11.6/admin/settings/history.md) topic
for additional information.
Click **OK** to save configuration changes and close the Job Properties window. Click **Cancel** if
-no changes were made.
+you didn't make changes.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/properties/notification.md b/docs/accessanalyzer/11.6/admin/jobs/job/properties/notification.md
index 7673df14e4..2dc5f2f033 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/properties/notification.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/properties/notification.md
@@ -12,9 +12,9 @@ inherit the global configuration or to configure settings just for this job.
Deselect the **Use Global Settings** option to configure custom settings for the job. Then provide a
-specific list of recipients for email notifications generated by this job. Multiple email addresses
-can be input by adding a semicolon (;) and space between entries. This is specific to Notification
-analysis module tasks.
+specific list of recipients for email notifications generated by this job. You can input multiple
+email addresses by adding a semicolon (;) and space between entries. This is specific to
+Notification analysis module tasks.
Click **OK** to save configuration changes and close the Job Properties window. Click **Cancel** if
-no changes were made.
+you didn't make changes.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/properties/overview.md b/docs/accessanalyzer/11.6/admin/jobs/job/properties/overview.md
index 157fbfbf2e..e78454e3d6 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/properties/overview.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/properties/overview.md
@@ -6,15 +6,15 @@ sidebar_position: 40
# Job Properties
-Jobs can be configured to inherit global settings down through parent job groups or to be
-individually configured at the job level through the Job Properties window.
+You can configure jobs to inherit global settings down through parent job groups or configure them
+individually at the job level through the Job Properties window.
To configure a job’s properties, open the Job Properties window by right-clicking on the job's node
in the Navigation pane and selecting **Properties**.
-The properties can be configured at the job level within the Job Properties window using the
+You can configure the properties at the job level within the Job Properties window using the
following tabs:
- [General Tab](/docs/accessanalyzer/11.6/admin/jobs/job/properties/general.md)
@@ -33,4 +33,4 @@ the
for additional information.
Click **OK** to save configuration changes and close the Job Properties window. Click **Cancel** if
-no changes were made.
+you didn't make changes.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/properties/performance.md b/docs/accessanalyzer/11.6/admin/jobs/job/properties/performance.md
index 6bb3a1af2b..0938178a5f 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/properties/performance.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/properties/performance.md
@@ -6,22 +6,21 @@ sidebar_position: 20
# Performance Tab
-The Performance tab provides options that can be used to improve job performance and runtime.
+Use the Performance tab options to improve job performance and runtime.
Adjust the following settings by sliding the needle up and down the line:
- Concurrent Worker Threads – The number of worker threads selected equals the number of hosts being
- queried concurrently. If needed, this value can be increased.
-- Skip Hosts that do not respond to PING – Selected by default. Deselect if a target host has been
- configured to not respond to PING requests, allowing Enterprise Auditor to scan the target host
- without a PING response.
+ queried concurrently. If needed, you can increase this value.
+- Skip Hosts that don't respond to PING – Selected by default. Deselect if you configured a target
+ host to not respond to PING requests, allowing Enterprise Auditor to scan the target host without
+ a PING response.
:::note
- In most cases, it is not recommend to deselect this option, as it causes the job to
- continue querying offline hosts until the job timeout value is reached, set by default to 20
- minutes.
+ In most cases, avoid deselecting this option. Doing so causes the job to continue
+ querying offline hosts until the job timeout value is reached, set by default to 20 minutes.
:::
@@ -29,4 +28,4 @@ Adjust the following settings by sliding the needle up and down the line:
offline for not responding to PING
Click **OK** to save configuration changes and close the Job Properties window. Click **Cancel** if
-no changes were made.
+you didn't make changes.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/properties/reportroles.md b/docs/accessanalyzer/11.6/admin/jobs/job/properties/reportroles.md
index 883f1c837c..4d50bec43c 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/properties/reportroles.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/properties/reportroles.md
@@ -6,30 +6,29 @@ sidebar_position: 50
# Report Roles Tab
-The Report Roles tab is part of the Role Bases Access feature of Enterprise Auditor. If Role Based
-Access has been enabled, the table displays all accounts that can view reports within the Web
-Console. If Role Based Access has not been enabled, all accounts have access to all reports, and the
+The Report Roles tab is part of the Role Bases Access feature of Enterprise Auditor. If you enable
+Role Based Access, the table displays all accounts that can view reports within the Web
+Console. If you haven't enabled Role Based Access, all accounts have access to all reports, and the
table is blank. See the
[Role Based Access](/docs/accessanalyzer/11.6/admin/settings/access/rolebased/overview.md)
topic for additional information.
-On the Report Roles tab, report role inheritance cannot be broken. Access to reports is inherited
-from the global level to job groups to jobs to report configuration. All user roles configured at
-the global level (**Settings** > **Roles**) are inherited down to all reports. Only the Global
-Options Administrator, the Access Administrator, and the Host Management Administrator do not have
-access to reports.
+On the Report Roles tab, you can't break report role inheritance. Reports inherit access from the
+global level to job groups to jobs to report configuration. All reports inherit the user roles
+configured at the global level (**Settings** > **Roles**). Only the Global Options Administrator,
+the Access Administrator, and the Host Management Administrator don't have access to reports.
-The **Include Report Viewers from this object's parent** option can be unchecked to automatically
+You can uncheck the **Include Report Viewers from this object's parent** option to automatically
remove any user with the Report Viewer role inherited from a parent object to the job. Remember,
-this does not apply to global inheritance.
+this doesn't apply to global inheritance.
-Additional accounts can be added with the Report Viewer role at the job level and inherited down to
-all reports generated by the job. Click **Add Report Viewer** to open the Select User or Group
-window and grant a new account access to these reports. Inheritance can be broken for accounts that
-have not inherited the report role from the global level. Select an account and click **Delete
-Report Viewer** to deny access to the reports.
+You can add additional accounts with the Report Viewer role at the job level. Enterprise Auditor
+inherits their access down to all reports generated by the job. Click **Add Report Viewer** to open
+the Select User or Group window and grant a new account access to these reports. You can break
+inheritance for accounts that haven't inherited the report role from the global level. Select an
+account and click **Delete Report Viewer** to deny access to the reports.
The table displays the following information:
@@ -37,7 +36,7 @@ The table displays the following information:
- Type – Account type (user or group)
- Role – Role assigned to account which grants access to reports
- Inherited From – Indicates the level at which the account was granted access to reports. Remember,
- global inheritance cannot be broken.
+ you can't break global inheritance.
Click **OK** to save configuration changes and close the Job Properties window. Click **Cancel** if
-no changes were made.
+you didn't make changes.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/properties/reportsettings.md b/docs/accessanalyzer/11.6/admin/jobs/job/properties/reportsettings.md
index 6ee838770a..3808ed50f6 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/properties/reportsettings.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/properties/reportsettings.md
@@ -13,12 +13,12 @@ this job.
-Use the Publish Options drop-down menu to customize the publish setting for the job. To configure
+Use the Publish Options dropdown menu to customize the publish setting for the job. To configure
custom Email settings for the job, select the **Use These Email Settings** option and then provide
-the desired Email information. Multiple email addresses can be input by adding a semicolon (;) and
-space between entries. See the
+the Email information you want. You can input multiple email addresses by adding a semicolon (;)
+and space between entries. See the
[Reporting Node](/docs/accessanalyzer/11.6/admin/jobs/group/settings/reporting.md)
topic for additional information on the Publish and Email options.
Click **OK** to save configuration changes and close the Job Properties window. Click **Cancel** if
-no changes were made.
+you didn't make changes.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/properties/storage.md b/docs/accessanalyzer/11.6/admin/jobs/job/properties/storage.md
index 21f28834eb..38c271d000 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/properties/storage.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/properties/storage.md
@@ -12,12 +12,12 @@ group level, or to configure settings just for this job.
-By default, all jobs are set to inherit the storage setting, the **Use Default** option. To
+By default, all jobs inherit the storage setting through the **Use Default** option. To
configure a different profile for the job, select the **Use This Profile** option and select the
-desired Storage Profile from the drop-down menu. Storage Profiles can only be configured at the
+desired Storage Profile from the dropdown menu. You can only configure Storage Profiles at the
**Settings** > **Storage** node. See the
[Storage](/docs/accessanalyzer/11.6/admin/settings/storage/overview.md)
topic for additional information.
Click **OK** to save configuration changes and close the Job Properties window. Click **Cancel** if
-no changes were made.
+you didn't make changes.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/properties/viewxml.md b/docs/accessanalyzer/11.6/admin/jobs/job/properties/viewxml.md
index a5e6c1d781..216422b239 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/properties/viewxml.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/properties/viewxml.md
@@ -14,7 +14,7 @@ At the bottom of the Job Properties window is the **View XML** button. To view t
| Job Properties Window | Job XML File |
This opens the job’s XML file, which contains all of the job, query, and reporting configurations.
-When the log level is directly set at job level, the job XML `` parameter will show a
+When you directly set the log level at job level, the job XML `` parameter shows a
value of:
- 0 for Debug
@@ -23,6 +23,6 @@ value of:
- 3 for Error
:::note
-Job analysis configurations are kept in a separate XML file.
+Enterprise Auditor keeps job analysis configurations in a separate XML file.
:::
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/results.md b/docs/accessanalyzer/11.6/admin/jobs/job/results.md
index f86ffc9258..c2eeea9275 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/results.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/results.md
@@ -6,31 +6,31 @@ sidebar_position: 20
# Results Node
-Once a job has been executed, the query populated native data tables, the analysis and action
-populated materialized tables and views, and the generated reports can be viewed under the job’s
+After you execute a job, you can view the query-populated native data tables, the analysis- and
+action-populated materialized tables and views, and the generated reports under the job’s
Results node.
:::note
-Native data tables are only populated by jobs with configured queries. Materialized tables
-and views are only generated by jobs with configured analysis or action tasks. Reports are only
-generated by jobs with configured reports.
+Jobs with configured queries only populate native data tables. Jobs with configured analysis
+or action tasks only generate materialized tables and views. Jobs with configured reports only
+generate reports.
:::
Every job generates a native data table when executed, which appears at the top of the Results node.
-The native data table, or raw data table, is produced by query execution. It contains all raw data
-collected by the scan. It is often named DEFAULT, but may have another name that is set during query
-configuration. If no query is executed by the job, the DEFAULT table is listed as a placeholder only
-and will be empty (0 rows). It is possible to have multiple queries in the same job, though not
-recommended. These queries could write to the same native data table, or each query could write to
-its own native data table. If multiple native data tables are being generated by one job, they are
-listed in alphanumeric order at the top of the Results node list.
-
-Analysis tasks can be configured to generate materialized tables and views. Action tasks create
+Query execution produces the native data table, or raw data table. It contains all raw data
+collected by the scan. It is often named DEFAULT, but may have another name that you set during
+query configuration. If the job executes no query, the DEFAULT table appears as a placeholder only
+and remains empty (0 rows). A job can have multiple queries, though avoid using more than one when
+possible. These queries could write to the same native data table, or each query could write to
+its own native data table. If one job generates multiple native data tables, they appear in
+alphanumeric order at the top of the Results node list.
+
+You can configure analysis tasks to generate materialized tables and views. Action tasks create
action status tables. These appear beneath the native data tables under the Results node in
alphanumeric order.
-Finally, any reports generated by the job, both published and unpublished, will be listed beneath
+Finally, any reports generated by the job, both published and unpublished, appear beneath
the materialized tables and views in alphanumeric order.
diff --git a/docs/accessanalyzer/11.6/admin/jobs/job/status.md b/docs/accessanalyzer/11.6/admin/jobs/job/status.md
index 8fcd3d06d0..cfa7e97ea5 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/job/status.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/job/status.md
@@ -6,16 +6,15 @@ sidebar_position: 10
# Status Node
-Once a job has been executed, it always generates the tables providing information on host
-connection status, job statistics, job task statistics, and error and warning messages can be viewed
-under the job’s Status node:
+After a job runs, tables containing information on host connection status, job statistics, job task
+statistics, and error and warning messages appear under the job’s Status node:
The Status node tables are:
- ConnectStatus table – Lists all hosts queried during job execution and the access status of the
- scan, unless the System Default is being used
+ scan, unless you're using the System Default
- Job Stats table – Provides information on the selected job’s runtime details, according to the
global configuration set in the **Settings** > **Application** node. By default, this is set to
not filter the data.
@@ -25,8 +24,8 @@ The Status node tables are:
:::note
The Job Statistics Retention settings in the **Settings** > **Application** node
- control how long the job statistics history is kept in the database and displayed Job Stats and
- Task Stats tables. See the
+ control how long the database keeps the job statistics history and displays it in the Job Stats
+ and Task Stats tables. See the
[Application](/docs/accessanalyzer/11.6/admin/settings/application/overview.md)
topic for additional information.
:::
@@ -36,7 +35,7 @@ The Status node tables are:
execution of the job. For example, a frequently generated message is
`WARNING: No Host found for processing`.
- - If this message is generated by an analysis or reporting job, then there is no problem as that
- type of job does not need a host list assigned
- - However, if this message is generated by a job running a data collection query, this warning
- would explain why the native data table is empty
+ - If an analysis or reporting job generates this message, there is no problem as that
+ type of job doesn't need a host list assigned
+ - However, if a job running a data collection query generates this message, this warning
+ explains why the native data table is empty
diff --git a/docs/accessanalyzer/11.6/admin/jobs/overview.md b/docs/accessanalyzer/11.6/admin/jobs/overview.md
index 722b87d4b4..34e27e362f 100644
--- a/docs/accessanalyzer/11.6/admin/jobs/overview.md
+++ b/docs/accessanalyzer/11.6/admin/jobs/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 70
# Jobs Tree
-Jobs are the fundamental unit of Enterprise Auditor. It is through jobs that all data collection
-queries, analysis tasks, notification tasks, action tasks, and report generation occur. Jobs are
+Jobs are the fundamental unit of Enterprise Auditor. All data collection queries, analysis tasks,
+notification tasks, action tasks, and report generation occur through jobs. Jobs are
housed within the Jobs tree of the Navigation pane.
The Jobs Tree is located in the Navigation Pane on the Enterprise Auditor Console.
@@ -36,27 +36,27 @@ Each component within the Jobs tree has an icon for quick reference. The icons a
|  | Job’s Data Table or View |
|  | Job’s Report |
-A green checkmark over a Job or Job Group icon indicates a configuration change has been made to the
-job or job group. The global settings configured under the Settings node are inherited down through
-the Jobs tree to the job unless inheritance is broken in a job group’s Settings node, a job’s
+A green checkmark over a Job or Job Group icon indicates you made a configuration change to the
+job or job group. The Jobs tree inherits the global settings configured under the Settings node down
+to the job unless you break inheritance in a job group’s Settings node, a job’s
Configure node, or a job’s Properties window. See the
[Navigating the Console](/docs/accessanalyzer/11.6/admin/navigate/overview.md)
for additional information.
## Job Execution Options
-Enterprise Auditor is designed to execute jobs one at a time in the order assigned. If a job group
-is run, the jobs execute in the order listed within the job group. Job groups are designed to run
-data collection jobs before running analysis and reporting jobs. If multiple jobs are independently
-triggered to run, the jobs execute in the order triggered.
+Enterprise Auditor is designed to execute jobs one at a time in the order assigned. If you run a job
+group, the jobs execute in the order listed within the job group. Job groups are designed to run
+data collection jobs before running analysis and reporting jobs. If you independently trigger
+multiple jobs to run, the jobs execute in the order triggered.
Jobs execution options include:
- Manual or Ad Hoc
- Applies logged in user’s credentials to execute the job on the Enterprise Auditor Console
server
- - Job progress can be monitored through the **Running Instances** node
- - Order of job execution can be manipulated on the **Running Instances** node
+ - You can monitor job progress through the **Running Instances** node
+ - You can manipulate the order of job execution on the **Running Instances** node
- Closing the Enterprise Auditor Console terminates the running job and clear the jobs queue
- Schedule
- Applies Schedule Service Account credentials to execute the job through Windows Task Scheduler
@@ -66,19 +66,19 @@ Jobs execution options include:
## Changes Window
-The Changes window is where jobs are created by customers or professional services engineers. Custom
-jobs can be enabled to track changes to configuration settings. When enabled, configuration changes
-are tracked in change logs stored within the job folder. Changes can also be viewed within this
-window.
+The Changes window is where customers or professional services engineers create jobs. You can
+enable custom jobs to track changes to configuration settings. When enabled, Enterprise Auditor
+tracks configuration changes in change logs stored within the job folder. You can also view
+changes within this window.
-Remember, custom jobs are not shipped with Enterprise Auditor but instead user created.
+Remember, Enterprise Auditor doesn't ship custom jobs; users create them instead.
The Changes window opens from the **Changes** option in the right-click menu from the selected Jobs
tree, job group, or job node.
-Select **Enabled** from the drop-down menu in the upper-left corner to turn on change tracking of
+Select **Enabled** from the dropdown menu in the upper-left corner to turn on change tracking of
configuration settings. Select a modification from the table and click **Undo** to revert the
change.
@@ -97,9 +97,10 @@ The window columns display the following information:
Select a modification from the table and click **Undo** to revert the change.
-If configuration change tracking is **Disabled**, configuration changes are only written directly to
-the job’s XML file. If the configuration change tracking feature was previously enabled and then
-disabled at a later time, an option is provided to merge changes back into the job’s XML file.
+If configuration change tracking is **Disabled**, Enterprise Auditor only writes configuration
+changes directly to the job’s XML file. If you previously enabled the configuration change tracking
+feature and then disabled it at a later time, Enterprise Auditor provides an option to merge changes
+back into the job’s XML file.
@@ -109,10 +110,10 @@ the Enterprise Auditor pop-up window to confirm the merge.
-Changes between releases are tracked. Only jobs that are locked can be upgraded.
+Enterprise Auditor tracks changes between releases. You can only upgrade jobs that are locked.
:::note
-Jobs that are included in Enterprise Auditor are locked and changes cannot be made to
+Jobs that are included in Enterprise Auditor are locked, and you can't make changes to
those jobs.
:::
diff --git a/docs/accessanalyzer/11.6/admin/maintenance/backuprecovery.md b/docs/accessanalyzer/11.6/admin/maintenance/backuprecovery.md
index 5770907d5b..bb798e48fa 100644
--- a/docs/accessanalyzer/11.6/admin/maintenance/backuprecovery.md
+++ b/docs/accessanalyzer/11.6/admin/maintenance/backuprecovery.md
@@ -6,20 +6,20 @@ sidebar_position: 30
# Backup and Recovery
-For data recovery purposes, the Enterprise Auditor does not need a complete image back up of the
-Enterprise Auditor Console server. Rather a standard file level back up of a few key components is
-all that is necessary. This document contains a step-by-step guide for back up and recovery. The
-choice of back up utility is left to the Enterprise Auditor user.
+For data recovery purposes, the Enterprise Auditor doesn't need a complete image back up of the
+Enterprise Auditor Console server. Rather, a standard file level back up of a few key components is
+sufficient. This document contains a step-by-step guide for back up and recovery. The
+Enterprise Auditor user chooses the back up utility.
:::note
-This does not cover back up of the Enterprise Auditor database.
+This doesn't cover back up of the Enterprise Auditor database.
:::
## Steps to Back Up the Console Server
-Follow these steps to back up the key components necessary for data recovery of the Enterprise
-Auditor Console server.
+To back up the key components necessary for data recovery of the Enterprise
+Auditor Console server:
**Step 1 –** Obtain or save the installation media for Enterprise Auditor.
@@ -37,8 +37,8 @@ built-in environment variable `%SAINSTALLDIR%`):
- ...\ STEALTHbits\StealthAUDIT\rba.conf: Contains the Role Based Access Configuration
- ...\ STEALTHbits\StealthAUDIT\StealthAUDIT.LIC: The license key
-**Step 3 –** Back up all Scheduled Tasks. The method of back up is determined by the Enterprise
-Auditor user. This can be as simple as copying the contents of the tasks folder from the following
+**Step 3 –** Back up all Scheduled Tasks. The Enterprise Auditor user determines the method of back
+up. For example, you can copy the contents of the tasks folder from the following
two locations:
@@ -49,18 +49,18 @@ two locations:
- C:\Windows\System32\Tasks
-All key components necessary for data recovery have now been backed up.
+You have now backed up all key components necessary for data recovery.
## Steps to Restore the Console Server
Follow these steps for data recovery of the Enterprise Auditor Console server.
-**Step 1 –** Confirm the prerequisites have been met on the Enterprise Auditor Console Server. See
+**Step 1 –** Confirm that you've met the prerequisites on the Enterprise Auditor Console Server. See
the
[Requirements](/docs/accessanalyzer/11.6/requirements/overview.md)
topic for specific prerequisites.
-**Step 2 –** Install the Enterprise Auditor application. Do not start the Enterprise Auditor
+**Step 2 –** Install the Enterprise Auditor application. Don't start the Enterprise Auditor
application at this time.
**Step 3 –** Restore all of the backed up files and folders from Step 2 of Steps to Back up the
@@ -72,7 +72,7 @@ Enterprise Auditor Console Server to the corresponding tasks folder of the opera
**Step 5 –** For Host Management and Host List Replication in a new host scenario, run the following
code within the SQL Studio on the Enterprise Auditor database.
-- Replace `OldServer` and `NewServer` in the script below with the names of the old and new
+- Replace `OldServer` and `NewServer` in the following script with the names of the old and new
Enterprise Auditor servers
```
@@ -92,7 +92,7 @@ SET SA_Node = @NHost
Where SA_Node = @OHost;
```
-**Step 6 –** Start Enterprise Auditor and confirm all settings and jobs have been restored.
+**Step 6 –** Start Enterprise Auditor and confirm that you've restored all settings and jobs.
**Step 7 –** Enable Role Based Access to write the necessary registry keys:
@@ -106,4 +106,4 @@ Where SA_Node = @OHost;
[Role Based Access](/docs/accessanalyzer/11.6/admin/settings/access/rolebased/overview.md)
topic for more information
-The Enterprise Auditor Console Server is now restored.
+You have now restored the Enterprise Auditor Console Server.
diff --git a/docs/accessanalyzer/11.6/admin/maintenance/bestpractices.md b/docs/accessanalyzer/11.6/admin/maintenance/bestpractices.md
index 7736a2680d..d06c47d12d 100644
--- a/docs/accessanalyzer/11.6/admin/maintenance/bestpractices.md
+++ b/docs/accessanalyzer/11.6/admin/maintenance/bestpractices.md
@@ -6,20 +6,19 @@ sidebar_position: 50
# Best Practices
-With any new product, a few pointers can really get us started on the right foot. In the spirit of
-making you successful, here are some tips that will help you become an effective user of the
-Enterprise Auditor in no time. Enjoy!
+With any new product, a few pointers can help you get started effectively. Here are some tips to
+help you become an effective user of Enterprise Auditor quickly.
## Do
The following is a list of best practices to use for Enterprise Auditor:
-- Read all Job and Job Group descriptions and instructions prior to running any solution
-- Scope all collection queries to target just the desired objects, locations, or hosts you want to
+- Read all Job and Job Group descriptions and instructions before running any solution
+- Scope all collection queries to target just the objects, locations, or hosts you want to
collect information from
-- Run new solutions against a single host or subset of data prior to running against all to ensure
+- Run new solutions against a single host or subset of data before running against all to ensure
proper operation, configuration, and output of each job
-- Leverage service accounts (if possible) containing the proper permissions to access the
+- Use service accounts (if possible) containing the proper permissions to access the
information you want to audit rather than personal user accounts (this will reduce “access denied”
warnings due to insufficient privileges)
- Set a username and password for any scheduled task
@@ -27,31 +26,31 @@ The following is a list of best practices to use for Enterprise Auditor:
Enterprise Auditor System Requirements & Installation Notes document for details)
- Set a connection profile inside the Job “properties” menu for any job that runs using the Exchange
Metrics data collector
-- Check the “Messages” table within any Job’s “Results” node if reports do not generate or
+- Check the “Messages” table within any Job’s “Results” node if reports don't generate or
collection doesn’t appear to be working properly
- Configure history settings at the Job level (as opposed to at the Global or Job Group level) to
avoid unnecessary storage consumption within SQL
- Contact Netwrix Support with ANY questions you have
-## Do Not
+## Don't
The following is a list of practices to avoid for Enterprise Auditor.
-- Do not change Job or Job Group names within the Job Tree
-- Do not attempt to run an entire Solution Set without configuring your scoping options first
-- Do not confuse WARNINGS for errors in data collection. Warnings are purely informational
-- Do not change the name of your Enterprise Auditor database
-- Do not edit a job’s configuration or open any query or analysis rule while that job is running
-- Do not use the Fully Qualified Domain Name of a host when manually entering hosts to run queries
+- Don't change Job or Job Group names within the Job Tree
+- Don't attempt to run an entire Solution Set without configuring your scoping options first
+- Don't confuse WARNINGS for errors in data collection. Warnings are purely informational
+- Don't change the name of your Enterprise Auditor database
+- Don't edit a job’s configuration or open any query or analysis rule while that job is running
+- Don't use the Fully Qualified Domain Name of a host when manually entering hosts to run queries
against; instead, use the Common Name
-- Do not enable “Debug” logging unless needed for additional troubleshooting
-- Do not change the database Enterprise Auditor writes to at the global level; instead, change the
+- Don't enable “Debug” logging unless needed for additional troubleshooting
+- Don't change the database Enterprise Auditor writes to at the global level; instead, change the
database at the job level if desired
### Contact Support
-When the checklist items do not resolve the issue, contact support with as much applicable
-information as possible from the table below. It is possible that a hot fix may already exist for
+When the checklist items don't resolve the issue, contact support with as much applicable
+information as possible from the following information. A hot fix may already exist for
the product.
**What is the version of the Access Analyzer application?**
@@ -87,4 +86,4 @@ See the Export Job to Zip Archive Window section for additional instruction.
Jobs > [Solution] > [Job Group and/or Job] > Status > Messages table
**Are there any messages in the ConnectStatus Table?**
-Jobs > [Solution] > [Job Group and/or Job] > Status > ConnectStatus table
\ No newline at end of file
+Jobs > [Solution] > [Job Group and/or Job] > Status > ConnectStatus table
diff --git a/docs/accessanalyzer/11.6/admin/maintenance/troubleshooting.md b/docs/accessanalyzer/11.6/admin/maintenance/troubleshooting.md
index 3a006c46b0..34e3335af5 100644
--- a/docs/accessanalyzer/11.6/admin/maintenance/troubleshooting.md
+++ b/docs/accessanalyzer/11.6/admin/maintenance/troubleshooting.md
@@ -15,16 +15,16 @@ installed. The default installation directory is:
`C:\Program Files (x86)\STEALTHbits\StealthAUDIT\`
-If the installation directory was customized during installation, it will be:
+If you customized the installation directory during installation, it will be:
`…\STEALTHbits\StealthAUDIT\`
-The Enterprise Auditor install directory has several logs that can be accessed for troubleshooting
+The Enterprise Auditor install directory has several logs that you can access for troubleshooting
purposes. This includes:
- The Application log which contains logging of all activities within Enterprise Auditor
- The Upgrade log which logs activities related to the upgrade process
-- The upgrade archive which is a zip file containing all of your Enterprise Auditor jobs prior to
+- The upgrade archive which is a zip file containing all of your Enterprise Auditor jobs before
the upgrade process
- Sensitive Data logs that contain details from sensitive data scans performed against various
repositories
@@ -35,14 +35,14 @@ See the [Logs](#logs) topic for additional information.
## Logs
-Enterprise Auditor has a few areas where it stores logs. Make sure the log level is set to DEBUG in
-Enterprise Auditor to gather all necessary information. Once the logs have been created and sent to
-Netwrix Support, then reset the logging level to save disc space.
+Enterprise Auditor has a few areas where it stores logs. Ensure you set the log level to DEBUG in
+Enterprise Auditor to gather all necessary information. After you create and send the logs to
+Netwrix Support, reset the logging level to save disc space.
To set your logging level to debug go to **Settings** > **Application** – **Set the Application log
level to Debug** and restart the application.
-#### Where Are the Logs Located?
+#### Log File Locations
| Log Name | Log Location |
| ------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -70,13 +70,13 @@ and DFS scan types:
FSAA Trace Logs:
-Below are two types of FSAA trace logs created while in local, applet, or proxy modes:
+The following are two types of FSAA trace logs created while in local, applet, or proxy modes:
- Parent Trace Log – StealthAUDITRPC*[YYYYMMDD_hhmmss]*[Execution_Host].log
- - ProccessID is logged in the job log
+ - ProccessID appears in the job log
- Child Trace Log –
StealthAUDITRPC*[session_id]*[ScanType]_[Execution_host]_[Target_host]_[YYMMDD_hhmmss].log
- - ProcessID is logged in the Parent trace log
+ - ProcessID appears in the Parent trace log
When running StealthAUDITRPC as a service, the parent trace log reads as:
diff --git a/docs/accessanalyzer/11.6/admin/maintenance/updatepasswords.md b/docs/accessanalyzer/11.6/admin/maintenance/updatepasswords.md
index 467d1b885d..b33f9471a1 100644
--- a/docs/accessanalyzer/11.6/admin/maintenance/updatepasswords.md
+++ b/docs/accessanalyzer/11.6/admin/maintenance/updatepasswords.md
@@ -6,10 +6,9 @@ sidebar_position: 20
# Updating Passwords
-Credential passwords in Enterprise Auditor occasionally need to be updated due to reasons such as
-the password expiring due to existing password expiration polices or for security purposes. If a
-password change is required, there are multiple types of accounts where credential passwords must be
-updated:
+You occasionally need to update credential passwords in Enterprise Auditor due to reasons such as
+existing password expiration policies or security purposes. If you need to change a password, there
+are multiple types of accounts where you must update credential passwords:
- [Storage Profiles](#storage-profiles)
- [Connection Profiles ](#connection-profiles)
@@ -51,8 +50,8 @@ topic for additional information.
## Schedule Service Accounts
Enterprise Auditor uses the Schedule Service Account to run scheduled tasks on the Enterprise
-Auditor Console server. The global account is configured at the Settings > Schedule node. However, a
-custom account can be assigned to either a Job or a Scheduled Task.
+Auditor Console server. You configure the global account at the Settings > Schedule node. However,
+you can assign a custom account to either a Job or a Scheduled Task.
### Settings > Schedule Node
@@ -63,22 +62,22 @@ topic for additional information on editing the user credentials for the account
### Schedules Node
-The Schedules Node opens the Scheduled Actions pages where scheduled tasks are listed. From this
-page, actions can be scheduled using the Schedule wizard. See the
+The Schedules Node opens the Scheduled Actions pages, which list scheduled tasks. From this
+page, you can schedule actions using the Schedule wizard. See the
[Schedule Wizard](/docs/accessanalyzer/11.6/admin/schedule/wizard.md)
topic for additional information on updating the credentials password in the Schedule wizard.
### Jobs
-Jobs are typically scheduled with the global scheduled account. However, Jobs can also be scheduled
-with a custom account. See the
+Enterprise Auditor typically schedules Jobs with the global scheduled account. However, you can
+also schedule Jobs with a custom account. See the
[Auto Retry Tab](/docs/accessanalyzer/11.6/admin/jobs/job/properties/autoretry.md)
topic for information on updating the Schedule Authentication credentials.
## Notifications (if enabled)
-Email notifications are configured in the Notifications node. The following steps only apply if
-Notification authentication has been enabled for the Enterprise Auditor Console. See the
+You configure email notifications in the Notifications node. The following steps only apply if
+you've enabled Notification authentication for the Enterprise Auditor Console. See the
[Update Notification Authentication Credentials](/docs/accessanalyzer/11.6/admin/settings/notification.md#update-notification-authentication-credentials)
topic for information on updating Notification authentication credentials.
diff --git a/docs/accessanalyzer/11.6/admin/navigate/activitiespane.md b/docs/accessanalyzer/11.6/admin/navigate/activitiespane.md
index 84f4c0c255..bb2a08208c 100644
--- a/docs/accessanalyzer/11.6/admin/navigate/activitiespane.md
+++ b/docs/accessanalyzer/11.6/admin/navigate/activitiespane.md
@@ -6,11 +6,11 @@ sidebar_position: 40
# Activities Pane
-The Activities pane displays a list of activities which can be conducted within the currently
+The Activities pane displays a list of activities that you can perform within the
selected console section. It is only visible if there are activities available for the selected
section. In the few cases where the Results pane is a wizard, this pane becomes the navigation pane
-for the wizard, e.g. the Enterprise Auditor Host Discovery Wizard. If the currently selected console
-section has an associated Activities Pane, it can be found on the right-hand side of the Enterprise
+for the wizard, e.g. the Enterprise Auditor Host Discovery Wizard. If the selected console
+section has an associated Activities Pane, it appears on the right-hand side of the Enterprise
Auditor Console.
@@ -23,4 +23,4 @@ The following console sections have associated Activities Panes:
- Jobs > [Job Group/Job] > Settings node
The Guidance section of the Activities Pane will display context sensitive information depending on
-what the currently selected console section is.
+what the selected console section is.
diff --git a/docs/accessanalyzer/11.6/admin/navigate/datagrid.md b/docs/accessanalyzer/11.6/admin/navigate/datagrid.md
index c9d3db0a4e..4c32645cf4 100644
--- a/docs/accessanalyzer/11.6/admin/navigate/datagrid.md
+++ b/docs/accessanalyzer/11.6/admin/navigate/datagrid.md
@@ -21,15 +21,15 @@ The different grouping, filtering, and search methods in the Data Grid are:
The Show maximum [value] of total [value] rows, located in the upper-right hand corner of the Data
Grid view in the Results Pane, indicates how many rows of data are available within this data grid
(the first value) and how many rows of data are available in the Enterprise Auditor database for
-this data grid (the second value). The maximum value can be changed by the user and only affects the
-maximum number of rows available for this data grid within the Enterprise Auditor Console. The total
-value is automatically supplied from the Enterprise Auditor database and cannot be changed by the
-user. If the total value is less than the maximum value, then all available data for this grid is
+this data grid (the second value). The user can change the maximum value, and it only affects the
+maximum number of rows available for this data grid within the Enterprise Auditor Console. The
+Enterprise Auditor database automatically supplies the total value, and the user can't change it.
+If the total value is less than the maximum value, then all available data for this grid is
present for sorting, filtering, and searching.
## Data Grid Right-Click Menu
-The right-click menu that affects data grid functionality is accessible by right-clicking on the
+Access the right-click menu that affects data grid functionality by right-clicking on the
data grid header row.
@@ -57,7 +57,7 @@ for information on right-click menus within a data grid.
### Customization Window
-The Customization window can be used to customize the data grid to only display specific columns.
+Use the Customization window to customize the data grid to only display specific columns.
@@ -65,8 +65,8 @@ To open the Customization window, select Field Chooser from the column header ri
-Any column that has been removed from the data grid, either by dragging it off the screen or by
-dropping it into this window, will be listed here. A column not currently displayed can be returned
+Any column that you remove from the data grid, either by dragging it off the screen or by
+dropping it into this window, appears here. You can return a column that isn't displayed
to the data grid by dragging-and-dropping it from this window onto the header row.
### Footer
@@ -80,8 +80,8 @@ To enable the footer, right-click in a column header and select Footer from the
-The footer appears as a gray bar at the bottom of the grid (or grid group). Right-click on the
-footer under the desired column. Only the options applicable to the desired column will be valid for
+The footer appears as a gray bar at the bottom of the grid (or grid group). Right-click the
+footer under the column you want. Only the options applicable to that column will be valid for
selection.
@@ -97,7 +97,7 @@ The different footer options are:
## Sort
-The data grid can be sorted in alphanumeric order by clicking on a column header.
+You can sort the data grid in alphanumeric order by clicking on a column header.
@@ -118,22 +118,22 @@ a ‘count’ of records within each group. Expand the group to view the data.
-Multiple columns can be dragged into the Group By area to form tiered groupings.
+You can drag multiple columns into the Group By area to form tiered groupings.
:::note
-Sorting by the FQDN column is an easy way to see if there are two entries for the same
+Sort by the FQDN column to see if there are two entries for the same
host.
:::
-The data grid can also be grouped by dragging a column header beneath the other column headers
+You can also group the data grid by dragging a column header beneath the other column headers
either to the stationary section on the left or to the mobile section on the right. Each record
counts as a single row for the total rows value, but displays in two rows with the second row
dedicated for the moved column.
-Drag the column header(s) back to the table to remove the grouping or use the Clear Sort option in
+Drag the column headers back to the table to remove the grouping or use the Clear Sort option in
the [Data Grid Right-Click Menu](#data-grid-right-click-menu). Additionally, the sort will clear
when the user navigates to another place in the console.
@@ -145,9 +145,9 @@ dialog located above the Activities Pane.
-In the header of every column is a drop-down arrow. This provides users with the ability to filter
-the data grid for a particular item or items within a column. The drop-down menu has the options of
-(All), (Custom…), and an alphabetical listing of all items currently within that column for the data
+In the header of every column is a dropdown arrow. This provides users with the ability to filter
+the data grid for a particular item or items within a column. The dropdown menu has the options of
+(All), (Custom…), and an alphabetical listing of all items within that column for the data
grid.
- [Custom Filter](#custom-filter) – Click Custom Filter in the header dropdown to open the Custom
@@ -171,44 +171,44 @@ The Custom Filter window options are:
- Second Comparison Operator – Select from a list of different logical operators that will apply
to the second custom filter criteria.
- Two wildcard options:
- - The underscore (_) can be used to represent any single character
- - The asterisk (\*) can be used to represent any series of characters
+ - Use the underscore (_) to represent any single character
+ - Use the asterisk (\*) to represent any series of characters
#### Creating a Custom Filter
-Follow the steps to create a Custom Filter:
+To create a Custom Filter:
-**Step 1 –** Click the dropdown arrow in the column header for the column where the Custom Filter is
-going to be applied and select (Custom…) from the list. The Custom Filter window opens.
+**Step 1 –** Click the dropdown arrow in the column header for the column where you want to apply
+the Custom Filter and select (Custom…) from the list. The Custom Filter window opens.
-**Step 2 –** Set the desired criteria for the custom filter. Select the logical operator from the
-drop-down menu on the left and set the criteria in the textbox on the right.
+**Step 2 –** Set the criteria you want for the custom filter. Select the logical operator from the
+dropdown menu on the left and set the criteria in the textbox on the right.
**Step 3 –** Select either AND/OR and set the second criteria field, following the same method as
Step 2.
-**Step 4 –** Click OK to confirm changes. The custom filter criteria is now applied to the Data
-Grid.
+**Step 4 –** Click OK to confirm changes. Enterprise Auditor now applies the custom filter criteria
+to the Data Grid.
-In the example above, OSName is like \*2008\* AND not like \*Standard\*, the filter returns all data
+In this example, OSName is like \*2008\* AND not like \*Standard\*, the filter returns all data
records with an operating system name that contains “2008” but not “Standard,” e.g. Windows Server
-2008 Enterprise Edition, 64 bit and Windows Server 2008 R2 Datacenter Edition, 64-bit, etc. Complex
-filters can be created using the Advanced Search option in the Filtration Dialog.
+2008 Enterprise Edition, 64 bit and Windows Server 2008 R2 Datacenter Edition, 64-bit, etc. You can
+create complex filters using the Advanced Search option in the Filtration Dialog.
The selected filter criteria will appear at the top of the data grid. A red X appears in the
filtration dialog, and the total rows value drops to the number of records that match the filter
-criteria. Additional filter statements can be added for other columns by repeating the process to
+criteria. You can add additional filter statements for other columns by repeating the process to
build complex filters. The filtration dialog also provides other ways to filter and search the data
set. See the [Filtration Dialog](#filtration-dialog) topic for additional information on this
feature.
-Filters can be cleared by clicking the red X in the filtration dialog (to clear all filter
-statements), selecting All from the column’s drop-down menu (to clear filters one column at a time),
-or by navigating to another place in the console (to clear all filter statements). However, the
+You can clear filters by clicking the red X in the filtration dialog (to clear all filter
+statements), selecting All from the column’s dropdown menu (to clear filters one column at a time),
+or navigating to another place in the console (to clear all filter statements). However, the
Recent Filters option in the filtration dialog provides a list of the most recent filters applied to
the data set for users to quickly return to a filtered view.
@@ -237,8 +237,8 @@ The filter options and logical operators are:
- Add Condition
- Add Group
- Clear All
-- Logical Operator – The logical operator (red text) beside the Filter button can be changed by
- clicking on it to open a menu with:
+- Logical Operator – Click the logical operator (red text) beside the Filter button to open a menu
+ with:
- AND
- OR
- NOT AND
@@ -248,12 +248,12 @@ The filter options and logical operators are:
- Add Condition
- Add Group
- Remove Row
-- Column Selection – The selected column (green text) can be changed by clicking on it to open a
+- Column Selection – Click the selected column (green text) to open a
menu with all available columns for the data grid.
-- Comparison Operator – The comparison operator (dark red text) can be changed by clicking on it to
+- Comparison Operator – Click the comparison operator (dark red text) to
open a menu with:
- equals
- - does not equal
+ - doesn't equal
- is less than
- is less than or equal to
- is greater than
@@ -261,11 +261,11 @@ The filter options and logical operators are:
- like
- not like
- is blank
- - is not blank
+ - isn't blank
- between
- not between
- in
- not in
-- Filter Criteria – The filter criteria (blue text) can be changed by clicking on it and typing in
- the textbox that appears. The Custom Filter builder wildcards can also be used in the Set Filter
+- Filter Criteria – Click the filter criteria (blue text) and type in
+ the textbox that appears. You can also use the Custom Filter builder wildcards in the Set Filter
builder.
diff --git a/docs/accessanalyzer/11.6/admin/navigate/overview.md b/docs/accessanalyzer/11.6/admin/navigate/overview.md
index 56597d06f1..782f573774 100644
--- a/docs/accessanalyzer/11.6/admin/navigate/overview.md
+++ b/docs/accessanalyzer/11.6/admin/navigate/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Navigating the Console
-There are several options that can be used to navigate the Enterprise Auditor Console. This section
+Use several options to navigate the Enterprise Auditor Console. This section
covers basic Enterprise Auditor Console navigation, including menu options, buttons, and the
different panes through which users can access Enterprise Auditor’s various functions and options.
@@ -18,15 +18,15 @@ The primary sections of the Enterprise Auditor Console are:
Comprised of the Menu Bar and the Actions Bar
- [Navigation Pane](/docs/accessanalyzer/11.6/admin/navigate/pane.md)
– Navigate through all of Enterprise Auditor’s major functions using the Navigation Pane.
- Selecting a node or sub-folder in the Navigation Pane will change what can be done in the Results
+ Selecting a node or sub-folder in the Navigation Pane will change what you can do in the Results
Pane.
- [Results Pane](/docs/accessanalyzer/11.6/admin/navigate/resultspane.md)
- – Displays various interfaces based on what is selected in the Navigation Pane or Activities Pane
+ – Displays various interfaces based on what you select in the Navigation Pane or Activities Pane
- [Activities Pane](/docs/accessanalyzer/11.6/admin/navigate/activitiespane.md)
- – Displays a list of activities which can be conducted within the currently selected console
+ – Displays a list of activities that you can perform within the selected console
section
-Enterprise Auditor Data Grids also have specific navigation options that enable users to filter,
+Enterprise Auditor Data Grids also have specific navigation options that let users filter,
group, and search through data. See the
[Data Grid Functionality](/docs/accessanalyzer/11.6/admin/navigate/datagrid.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/navigate/pane.md b/docs/accessanalyzer/11.6/admin/navigate/pane.md
index 397e36100d..168f91dbf8 100644
--- a/docs/accessanalyzer/11.6/admin/navigate/pane.md
+++ b/docs/accessanalyzer/11.6/admin/navigate/pane.md
@@ -37,14 +37,14 @@ The items in the Navigation Pane are:
[Jobs Tree](/docs/accessanalyzer/11.6/admin/jobs/overview.md) topic
for additional information.
-The title above the Navigation Pane will change depending on what is selected. There are also
+The title above the Navigation Pane will change depending on what you select. There are also
several right-click or context menus available throughout the console. See the
[Navigation Pane Right-click Menus](#navigation-pane-right-click-menus) topic for additional
information.
## Navigation Pane Right-click Menus
-There are several contextual right-click menus that are accessed by right-clicking on individual
+You can access several contextual right-click menus by right-clicking on individual
nodes or sub-nodes in the Navigation Pane. The different right-click menus are:
- Host Management Right-click Menus
@@ -60,7 +60,7 @@ topic for additional information on these actions.
#### Discovery Node
-The Discovery node right click-menu can be accessed in the Host Management node in the Navigation
+You can access the Discovery node right-click menu in the Host Management node in the Navigation
Pane.
@@ -73,7 +73,7 @@ The Discovery node right-click menu options are:
#### All Hosts Node
-The All Hosts node right-click menu can be accessed in the Host Management node in the Navigation
+You can access the All Hosts node right-click menu in the Host Management node in the Navigation
Pane.
@@ -96,7 +96,7 @@ The All Hosts right-click menu options are:
#### All Hosts > [Host List] Node
-The All Hosts > [Host List] right-click menu can be accessed in the Host Management node in the
+You can access the All Hosts > [Host List] right-click menu in the Host Management node in the
Navigation Pane.
@@ -156,7 +156,7 @@ Menu items include:
job. This option only applies to Role Based Access. See the
[Role Based Access](/docs/accessanalyzer/11.6/admin/settings/access/rolebased/overview.md)
for additional information.
-- Enable/Disable Job(s) – Disables the selected job or job group and skips them during scan
+- Enable/Disable Jobs – Disables the selected job or job group and skips them during scan
execution. When a job group is disabled, all existing jobs within the job group are disabled. See
the
[Disable or Enable a Job](/docs/accessanalyzer/11.6/admin/jobs/job/disableenable.md) topic
@@ -193,9 +193,9 @@ Menu items include:
and/or the job log and SA_Debug log.
- Save the ZIP file to a desired location, and optionally attach it to an email to
[Netwrix Support](https://www.netwrix.com/support.html).
- - Email option requires
+ - Email option requires you to configure
[Notification](/docs/accessanalyzer/11.6/admin/settings/notification.md)
- settings to be configured.
+ settings.
- Create Job (Ctrl+Alt+A) – Creates a new job at the same location as the selected job group or job.
See the
[Create a New Job](/docs/accessanalyzer/11.6/admin/jobs/job/create.md)
diff --git a/docs/accessanalyzer/11.6/admin/navigate/top.md b/docs/accessanalyzer/11.6/admin/navigate/top.md
index 383fa595a6..9fe5381c36 100644
--- a/docs/accessanalyzer/11.6/admin/navigate/top.md
+++ b/docs/accessanalyzer/11.6/admin/navigate/top.md
@@ -168,4 +168,4 @@ The options in the Button Bar are:
|  | Clipboard with paper | Paste the query from the clipboard (Ctrl + V) |
|  | Red X | Delete the selected query |
-Select a button for the desired action.
+Select a button for the action you want.
diff --git a/docs/accessanalyzer/11.6/admin/overview.md b/docs/accessanalyzer/11.6/admin/overview.md
index a8e7d3de16..1ada19bbbc 100644
--- a/docs/accessanalyzer/11.6/admin/overview.md
+++ b/docs/accessanalyzer/11.6/admin/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Administration
-The Enterprise Auditor application is the power behind the solutions. It has the automation,
+The Enterprise Auditor application powers the solutions. It has the automation,
management, and integration building blocks that ensure the solutions’ advanced data collection and
analysis deliver meaningful results to an organization’s infrastructure and other technologies.
Users manage and control access to unstructured and structured data, systems, and critical
@@ -14,7 +14,7 @@ applications with the application.
## Data Collectors Overview
-Enterprise Auditor leverages a wide variety of APIs and protocols to connect to and communicate with
+Enterprise Auditor uses a wide variety of APIs and protocols to connect to and communicate with
the systems and applications in an organization’s environment. From MAPI to PowerShell, WMI, LDAP,
CIFS, and more. It uses the best, most appropriate data collection methodology for every data
collection task. The majority of Enterprise Auditor data comes from agentless scans and log
@@ -23,8 +23,8 @@ application types.
Though Enterprise Auditor does use applets and kernel-level drivers for certain data collection
requirements, e.g. real-time file level activity monitoring, these agent-based advanced data
-collection methods allow the kind of deep rich information, which can usually be obtained only by
-substantial manual effort.
+collection methods provide the kind of deep, rich information that otherwise requires substantial
+manual effort to obtain.
See the
[Data Collectors](/docs/accessanalyzer/11.6/admin/datacollector/overview.md)
@@ -32,11 +32,10 @@ topic for additional information.
## Analysis Modules Overview
-Enterprise Auditor employs a series of powerful, yet easy-to-use Analysis Modules which provide
-end-users with the ability to perform very simple and sophisticated data analysis routines with
-ease:
+Enterprise Auditor employs a series of powerful Analysis Modules which provide
+end-users with the ability to perform both simple and sophisticated data analysis routines:
-- Correlation – Easily correlate data from multiple datasets to create meaningful views
+- Correlation – Correlate data from multiple datasets to create meaningful views
- Policy – Create rules and policies which automatically categorize your data output, i.e. Severity,
Classifications, etc.
- Change – Turn on change detection to see exactly what has changed between time periods
@@ -66,12 +65,12 @@ topic for additional information.
The Enterprise Auditor custom report authoring engine, dashboards, and open data views provide
information to multiple audiences within an organization, both technical and non-technical. Its
-reporting capabilities include a distribution and viewing mechanism allowing reports to be
-automatically distributed via email or posted to one or more network locations and/or websites for
+reporting capabilities include a distribution and viewing mechanism that automatically distributes
+reports via email or posts them to one or more network locations and/or websites for
simple, secure, and on-demand access to information. The Enterprise Auditor Report Index provides
access to published Enterprise Auditor reports through a web-based console, granting access to
-reports without requiring access to the Enterprise Auditor Console. It is accessed through the
-Stealthbits Web Console, which is created during the installation of Enterprise Auditor. The Web
+reports without requiring access to the Enterprise Auditor Console. Users access it through the
+Stealthbits Web Console, created when they install Enterprise Auditor. The Web
Console can also provide access to the Access Information Center, and other Stealthbits products.
See the
diff --git a/docs/accessanalyzer/11.6/admin/report/cleanup.md b/docs/accessanalyzer/11.6/admin/report/cleanup.md
index cd249dbef1..d6a55dd9ba 100644
--- a/docs/accessanalyzer/11.6/admin/report/cleanup.md
+++ b/docs/accessanalyzer/11.6/admin/report/cleanup.md
@@ -6,18 +6,18 @@ sidebar_position: 70
# Report Cleanup when Deleting a Job or Job Group
-When deleting a job or job group, the Delete Job and Delete Group wizards allow you to delete any
-published reports contained in the jobs that are being deleted. Follow the steps to delete a job or
-job group that contains published reports.
+When deleting a job or job group, the Delete Job and Delete Group wizards let you delete any
+published reports contained in the jobs you're deleting. To delete a job or
+job group that contains published reports:
:::warning
-Deleted objects cannot be restored.
+Deleted objects can't be restored.
:::
-**Step 1 –** In the Jobs tree, right-click on the job or group that you want to delete and select
+**Step 1 –** In the Jobs tree, right-click the job or group that you want to delete and select
**Delete Job/Group**.
@@ -41,12 +41,12 @@ group or job. Click **Next** to proceed with the deletion.
**Step 4 –** The Progress page shows you the status of the deletion process. When it has completed,
click **Finish** to exit the wizard.
-The job or job group and all of the selected published reports have been deleted. If you chose not
-to delete any of the published reports contained in any of the deleted jobs, then those remaining
-reports can still be viewed in the Web Console, even though the parent has been removed from the
-Enterprise Auditor Console.
+Enterprise Auditor deletes the job or job group and all of the selected published reports. If you
+chose not to delete any of the published reports contained in any of the deleted jobs, then you can
+still view those remaining reports in the Web Console, even though the parent no longer appears in
+the Enterprise Auditor Console.
-The remaining published reports that weren't deleted are shown in the wizard if you are deleting the
+The wizard shows the remaining published reports that weren't deleted if you delete the
parent group of the previously deleted job or group.
diff --git a/docs/accessanalyzer/11.6/admin/report/create.md b/docs/accessanalyzer/11.6/admin/report/create.md
index 7c1dea1e3e..42c590c861 100644
--- a/docs/accessanalyzer/11.6/admin/report/create.md
+++ b/docs/accessanalyzer/11.6/admin/report/create.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Creating a Report
-Creating and customizing reports allows you to design outputs uniquely crafted to your requirements.
+Creating and customizing reports lets you design outputs uniquely crafted to your requirements.
Reports can vary by section order, sourced data, file format, and other elements within the reports
configuration.
@@ -16,8 +16,8 @@ You can add additional reports by the following methods:
- [Copy an Existing Report](#copy-an-existing-report)
:::note
-It is important to consider whether a report should be added to an existing job, or a new
-job created to generate the report. Contact [Netwrix Support](https://www.netwrix.com/support.html)
+Consider whether to add a report to an existing job or create a new
+job to generate the report. Contact [Netwrix Support](https://www.netwrix.com/support.html)
for additional information on report outputs.
:::
@@ -33,39 +33,39 @@ to create a new report.
**Step 2 –** On the Reports page, click Create.
-**Step 3 –** The Report Configuration wizard is automatically launched. Use the wizard to configure
+**Step 3 –** The Report Configuration wizard launches automatically. Use the wizard to configure
the new report as required, see the
[Report Configuration Wizard](/docs/accessanalyzer/11.6/admin/report/wizard/overview.md)
topic for instructions. Click **Finish** on the final page of the wizard to create the report.
-The new report is added to the Reports table.
+Enterprise Auditor adds the new report to the Reports table.
**Step 4 –** Click the vertical ellipsis menu next to the report and select Generate.
-The report is now created. To access the new report, see the
+Enterprise Auditor generates the report. To access the new report, see the
[Viewing Generated Reports](/docs/accessanalyzer/11.6/admin/report/view.md)
topic.
## Copy an Existing Report
You can create a new report by copying an existing report and pasting it in a job’s Reports node.
-You can then optionally customize the report as required. Follow the steps to create a copy of an
-existing report.
+You can then optionally customize the report as required. To create a copy of an
+existing report:
-**Step 1 –** Navigate to the Reports node where the desired report to copy is located. Click the
+**Step 1 –** Navigate to the Reports node where the report you want to copy is located. Click the
vertical ellipsis menu next to the report and select Copy.
-**Step 2 –** Navigate to the Reports node in the desired destination for the new report. Click the
+**Step 2 –** Navigate to the Reports node in the destination you want for the new report. Click the
vertical ellipsis menu in the header row of the Reports table and select Paste.
-The copy of the report is added to the Reports table. Reports that are copied maintain the same
-configuration settings as the original report.
+Enterprise Auditor adds the copy of the report to the Reports table. Copied reports maintain the
+same configuration settings as the original report.
:::note
If the report copied to the job’s Reports node has the same name as an existing report,
@@ -81,6 +81,6 @@ topic for instructions.
**Step 4 –** Click the vertical ellipsis menu next to the report and select Generate.
-The report is now created. To access the new report, see the
+Enterprise Auditor generates the report. To access the new report, see the
[Viewing Generated Reports](/docs/accessanalyzer/11.6/admin/report/view.md)
topic.
diff --git a/docs/accessanalyzer/11.6/admin/report/edit.md b/docs/accessanalyzer/11.6/admin/report/edit.md
index 181c89cff2..3d8ceeec9f 100644
--- a/docs/accessanalyzer/11.6/admin/report/edit.md
+++ b/docs/accessanalyzer/11.6/admin/report/edit.md
@@ -6,14 +6,15 @@ sidebar_position: 20
# Editing Existing Reports
-It is not recommended to edit existing reports unless there are changes to a job’s settings at the
-global level, job group level, or job level. Changes to when data is collected, the types of data
-collected, and the properties of collected data are not reflected in a report’s configuration. As a
-result, generated reports could appear with blank fields or misleading information about the purpose
-of the collected data, unless the report is modified to reflect the changes to the job's settings.
+Avoid editing existing reports unless there are changes to a job’s settings at the
+global level, job group level, or job level. Changes to when Enterprise Auditor collects data, the
+types of data it collects, and the properties of that data don't appear in a report’s configuration.
+As a result, generated reports could appear with blank fields or misleading information about the
+purpose of the collected data, unless you modify the report to reflect the changes to the job's
+settings.
To modify a report, use the Report Configuration Wizard.
-Follow the steps to modify an existing report.
+To modify an existing report:
**Step 1 –** Navigate to the Reports node that contains the report.
@@ -26,10 +27,10 @@ Follow the steps to modify an existing report.
topic for instructions.
- You must go through all pages of the wizard, and click **Finish** on the final page to save your
- changes. Skip any sections or pages that do not require changes to the existing configuration. You
+ changes. Skip any sections or pages that don't require changes to the existing configuration. You
can click **Cancel** on any page to exit the wizard without saving your changes.
-Your configuration updates have been saved. To view the updated report you need to first generate
-the report or run it's associated job. See the
+Enterprise Auditor saves your configuration updates. To view the updated report you need to first
+generate the report or run it's associated job. See the
[Viewing Generated Reports](/docs/accessanalyzer/11.6/admin/report/view.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/report/interactivegrids/copyingcells.md b/docs/accessanalyzer/11.6/admin/report/interactivegrids/copyingcells.md
index d07019b724..e08c042851 100644
--- a/docs/accessanalyzer/11.6/admin/report/interactivegrids/copyingcells.md
+++ b/docs/accessanalyzer/11.6/admin/report/interactivegrids/copyingcells.md
@@ -7,12 +7,12 @@ sidebar_position: 40
# Copying Cells
Copying an individual cell within a generated report enables easier searching for information using
-the AIC or other tools. The copy feature can only be used on interactive grids. Each cell listed
-under a column can be selected and copied to the clipboard.
+the Access Information Center (AIC) or other tools. You can only use the copy feature on interactive
+grids. You can select and copy each cell listed under a column to the clipboard.
-To copy a cell, select the cell, then right-click on it and select **Copy Cell Data**.
+To copy a cell, select the cell, then right-click it and select **Copy Cell Data**.
:::note
You may need to allow programmatic clipboard access for your browser the first time you
diff --git a/docs/accessanalyzer/11.6/admin/report/interactivegrids/grouping.md b/docs/accessanalyzer/11.6/admin/report/interactivegrids/grouping.md
index 0e407b6227..f3ded4769b 100644
--- a/docs/accessanalyzer/11.6/admin/report/interactivegrids/grouping.md
+++ b/docs/accessanalyzer/11.6/admin/report/interactivegrids/grouping.md
@@ -6,11 +6,11 @@ sidebar_position: 10
# Grouping Data
-If grouping is enabled, the **Group by** field provides a drop-down list of categories by which the
+If grouping is enabled, the **Group by** field provides a dropdown list of categories by which the
data can be grouped.
:::note
-Grouping and filtering cannot be enabled at the same time. If grouping is enabled, the
+Grouping and filtering can't be enabled at the same time. If grouping is enabled, the
Filter icon is disabled in the report.
:::
@@ -21,5 +21,5 @@ topic for additional information.
-The drop-down list to the right of the Group by field can be accessed by clicking the down arrow.
-Click an item from the drop-down list to group the report by that category.
+The dropdown list to the right of the Group by field can be accessed by clicking the down arrow.
+Click an item from the dropdown list to group the report by that category.
diff --git a/docs/accessanalyzer/11.6/admin/report/interactivegrids/overview.md b/docs/accessanalyzer/11.6/admin/report/interactivegrids/overview.md
index de74522ea3..78fc8ecb37 100644
--- a/docs/accessanalyzer/11.6/admin/report/interactivegrids/overview.md
+++ b/docs/accessanalyzer/11.6/admin/report/interactivegrids/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# Interactive Grids
-Interactive grids in the table section of a report provide the ability to interact with the data and
-filter it as required. Interactive grids allow you to perform the following actions:
+Interactive grids in the table section of a report let you interact with the data and
+filter it as required. Use interactive grids to perform the following actions:
- Group data
- Search and filter data
@@ -19,7 +19,7 @@ filter it as required. Interactive grids allow you to perform the following acti
The toolbar in an interactive grid can display the following options:
- Filter icon – Click this icon to activate searching and filter the data
-- Group by – Provides a drop-down list of available categories to select for grouping. When grouping
+- Group by – Provides a dropdown list of available categories to select for grouping. When grouping
is enabled, searching is disabled.
- Up arrow and down arrow – Click to expand or collapse the groups
- Download Data – Click to download all data to a CSV file. This option is displayed when the
@@ -27,8 +27,8 @@ The toolbar in an interactive grid can display the following options:
[Grid](/docs/accessanalyzer/11.6/admin/report/wizard/widgets.md#grid)
topic for additional information.
-When enumeration is set on an interactive grid, a second download button is displayed. A CSV file
-can be downloaded that contains only data for the selected enumeration.
+When enumeration is set on an interactive grid, a second download button is displayed. You can
+download a CSV file that contains only data for the selected enumeration.
diff --git a/docs/accessanalyzer/11.6/admin/report/interactivegrids/paging.md b/docs/accessanalyzer/11.6/admin/report/interactivegrids/paging.md
index d1c4626b3f..4ae3b467fe 100644
--- a/docs/accessanalyzer/11.6/admin/report/interactivegrids/paging.md
+++ b/docs/accessanalyzer/11.6/admin/report/interactivegrids/paging.md
@@ -6,21 +6,21 @@ sidebar_position: 30
# Paging
-Paging allows users to interact with large sets of data more efficiently when viewing, filtering,
+Paging lets users interact with large sets of data more efficiently when viewing, filtering,
and sorting generated report tables by limiting the amount of data being displayed at a given time.
-Reports provide the ability to navigate to specific pages using arrows at the bottom of the report.
+Reports let you navigate to specific pages using arrows at the bottom of the report.
Paging is enabled by default. See the
[Grid](/docs/accessanalyzer/11.6/admin/report/wizard/widgets.md#grid)
topic for additional information.
:::note
-Paging and grouping cannot be enabled at the same time. When Paging is enabled, the
+Paging and grouping can't be enabled at the same time. When Paging is enabled, the
Grouping options are disabled for the report.
:::
-When paging is enabled, arrows are displayed that allow you to navigate to the next page, last page,
+When paging is enabled, arrows are displayed that let you navigate to the next page, last page,
previous page, or first page. If the data is filtered, it is indicated at the end of the line. Each
page contains 10 records.
diff --git a/docs/accessanalyzer/11.6/admin/report/interactivegrids/searchfilter.md b/docs/accessanalyzer/11.6/admin/report/interactivegrids/searchfilter.md
index 6ff5da7c06..48c60bd5c4 100644
--- a/docs/accessanalyzer/11.6/admin/report/interactivegrids/searchfilter.md
+++ b/docs/accessanalyzer/11.6/admin/report/interactivegrids/searchfilter.md
@@ -6,11 +6,10 @@ sidebar_position: 20
# Searching and Filtering Data
-When dealing with large sets of data, it may be useful to search for a desired attribute. This can
-be done using the Filter icon.
+When dealing with large sets of data, use the Filter icon to search for a desired attribute.
:::note
-Searching and grouping cannot be enabled at the same time. If grouping is enabled, the
+Searching and grouping can't be enabled at the same time. If grouping is enabled, the
Search icon is disabled in the report.
:::
@@ -24,7 +23,7 @@ topic for additional information.
Enter search criteria in the boxes under the columns to filter the data. Click the search icon again
to clear the filters.
-Click on a column to sort by that column. Clicking on a cell in a column automatically expands the
+Click a column to sort by that column. Clicking on a cell in a column automatically expands the
column size to fit the largest length of text contained in the column.
## Searching Enumerated Tables
@@ -36,22 +35,21 @@ types to display as enumerated tables.
To change the enumeration in the report, select an option from the enumerated column list. When
enumeration is set on an interactive grid, a second download button is displayed with the name of
-the currently selected enumerated column. You can use this to download a CSV file that only contains
+the selected enumerated column. You can use this to download a CSV file that only contains
the data for the selected enumeration.
## Filtering on Dates & Times
-Data can also be filtered on dates and times. Expanding the column’s width activates hyperlinks to
+You can also filter data on dates and times. Expanding the column’s width activates hyperlinks to
filter on specific time periods.
-Enter a Start and End date and select the desired time period.
+Enter a Start and End date and select the time period you want.
## Filtering on Numeric Columns
-Comparison operators can also be used for filtering. Comparison operators which can be used for
-filtering include the following:
+Use comparison operators to filter numeric columns. Available comparison operators include the following:
| Description | Operator |
| ------------------------ | -------- |
@@ -64,9 +62,9 @@ filtering include the following:
## Adding & Removing Columns
-Columns can be added or removed from the table.
+You can add or remove columns from the table.
-Right-click on a column to display a list of the available columns. Select the checkboxes of the
-columns you want to be displayed. Click the up or down arrows to scroll through the list of columns.
+Right-click a column to display a list of the available columns. Select the checkboxes of the
+columns you want to display. Click the up or down arrows to scroll through the list of columns.
diff --git a/docs/accessanalyzer/11.6/admin/report/overview.md b/docs/accessanalyzer/11.6/admin/report/overview.md
index 96f1bd91bc..7b69145246 100644
--- a/docs/accessanalyzer/11.6/admin/report/overview.md
+++ b/docs/accessanalyzer/11.6/admin/report/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# Reporting
-Enterprise Auditor provides the ability to report on collected data in multiple ways such as tables,
+Enterprise Auditor lets you report on collected data in multiple ways such as tables,
views, graphs, and emails. Depending on the type of data collected, different reporting methods can
simplify how to present and understand the information.
@@ -15,17 +15,17 @@ simplify how to present and understand the information.
The Reports node, contained within a job’s Configure node, lists any reports that are configured for
the job. The page contains options to create a report, configure existing reports, and a link to
view generated reports. The configuration of reports vary by use case, but they contain the same
-elements. The layout and elements of a report are configured using the
+elements. You configure the layout and elements of a report using the
[Report Configuration Wizard](/docs/accessanalyzer/11.6/admin/report/wizard/overview.md).
-In addition, there are various ways to view and interact with generated reports. Generated reports
-can be viewed in the Enterprise Auditor Console or in the Web Console. Reports can also be
+In addition, there are various ways to view and interact with generated reports. You can view
+generated reports in the Enterprise Auditor Console or in the Web Console. Reports can also be
configured to be downloaded as a CSV file, or sent as an email in various forms. See the
[Viewing Generated Reports](/docs/accessanalyzer/11.6/admin/report/view.md)
topic for additional information.
-The global settings configured under the Settings node are inherited down through the Jobs tree to
-the job unless inheritance is broken in a job group’s Settings node, a job’s Properties window, or
+The global settings configured under the Settings node inherit down through the Jobs tree to
+the job unless you break inheritance in a job group’s Settings node, a job’s Properties window, or
in the Report Configuration Wizard. See the
[Reporting](/docs/accessanalyzer/11.6/admin/settings/reporting.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/report/tags.md b/docs/accessanalyzer/11.6/admin/report/tags.md
index 6f61efafe5..857d4aa0b6 100644
--- a/docs/accessanalyzer/11.6/admin/report/tags.md
+++ b/docs/accessanalyzer/11.6/admin/report/tags.md
@@ -6,38 +6,38 @@ sidebar_position: 50
# Tags
-Tags can be added to reports to describe the content of the report and use cases for the report. For
-example, tags can be included in a report to show the compliance frameworks to which the report
-maps. To view tags or click on tag links, reports must be viewed in the Web Console. Tags are not
+You can add tags to reports to describe the content of the report and use cases for the report. For
+example, you can include tags in a report to show the compliance frameworks to which the report
+maps. To view tags or click tag links, you must view reports in the Web Console. Tags aren't
supported in reports in the Jobs tree.
-If Reports from solutions that have been run have tags added to them, those tags can be found under
+If reports from solutions you've run have tags, you can find those tags under
the Tags tab in the Navigation section on the right-hand side of the Published Reports homepage.
|  |  |
| -------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| Privileged Accounts Tag on Published Reports homepage | Privileged Accounts Tag page |
-Click on a tag to view all reports that contain the selected tag.
+Click a tag to view all reports that contain the selected tag.
Clicking on a job group in the Published Reports menu displays the reports contained in that job
-group. Jobs within that job group that have tags are identified with a tag icon along with the tag
+group. Jobs within that job group that have tags show a tag icon along with the tag
name.
When viewing a report in either the Web Console or the Enterprise Auditor console, tags are
-displayed below the report title. Click on a tag to view all reports that contain that tag. If the
-tag is selected from the Reports view in the Enterprise Auditor Console, the Published Reports Web
+displayed below the report title. Click a tag to view all reports that contain that tag. If you select the
+tag from the Reports view in the Enterprise Auditor Console, the Published Reports Web
Console opens and direct users to the tag page.
## Default Tags in Reports
-The following sections list out of the box reports that contain each tag. The tags are:
+The following sections list the default reports that contain each tag. The tags are:
### Open Access
diff --git a/docs/accessanalyzer/11.6/admin/report/view.md b/docs/accessanalyzer/11.6/admin/report/view.md
index a7302c8ddb..9c6d303194 100644
--- a/docs/accessanalyzer/11.6/admin/report/view.md
+++ b/docs/accessanalyzer/11.6/admin/report/view.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# Viewing Generated Reports
-Reports can be viewed either in the Enterprise Auditor Console in the Results Node of the related
-job, or published reports can be viewed in the Web Console.
+You can view reports either in the Enterprise Auditor Console in the Results Node of the related
+job, or view published reports in the Web Console.
- [Results Node](#results-node) – All reports generated by a job are always accessible under the
job’s Results node
@@ -16,12 +16,12 @@ job, or published reports can be viewed in the Web Console.
## Results Node
-Each job contains a results node where reports generated by that job can be viewed. Even if the
+Each job contains a results node where you can view reports generated by that job. Even if the
report is unpublished, the report is still displayed here.
-Select the desired report to be viewed. The report displays in the Results pane of the console.
+Select the report you want to view. The report displays in the Results pane of the console.
@@ -45,7 +45,7 @@ that solution’s job group. This list includes reports with changed Publish Pat
Clicking a report name link opens the selected report, or navigate through the folders to select a
report.
-From within the Web Console, reports cannot be edited or deleted. However, the interactive grid
+From within the Web Console, you can't edit or delete reports. However, the interactive grid
functions are enabled. See the
[Interactive Grids](/docs/accessanalyzer/11.6/admin/report/interactivegrids/overview.md)
topic for additional information. An additional feature available within the Web Console is the
diff --git a/docs/accessanalyzer/11.6/admin/report/wizard/authoring.md b/docs/accessanalyzer/11.6/admin/report/wizard/authoring.md
index a1e5b2393e..180fba4d0e 100644
--- a/docs/accessanalyzer/11.6/admin/report/wizard/authoring.md
+++ b/docs/accessanalyzer/11.6/admin/report/wizard/authoring.md
@@ -25,7 +25,7 @@ Configure the following settings as required:
- Author – Name of the person or group who created the report. This is displayed at the top of the
generated report.
- Tags – Use the tag editor to add and remove tags, see the
- [Add Tags to a Report](#add-tags-to-a-report) topic below for more information. Tags are displayed
+ [Add Tags to a Report](#add-tags-to-a-report) topic for more information. Tags are displayed
in the header of the generated reported.
- Description – A description of the report content. It is displayed beneath the report Title in the
generated report.
@@ -42,7 +42,7 @@ Configure the following settings as required:
[Report Settings Tab](/docs/accessanalyzer/11.6/admin/jobs/job/properties/reportsettings.md)
topics for additional information.)
- Publish report – Select this option to publish the report
- - Do not publish report – Select this option to not publish the report
+ - Don't publish report – Select this option to not publish the report
- Publish State – Shows the current publish state of the report. If the report is already published,
you can click the link to open the report in the Web Console.
@@ -50,22 +50,22 @@ Configure the following settings as required:
You can add tags to reports to describe the content and use cases of the report (see the
[Tags](/docs/accessanalyzer/11.6/admin/report/tags.md) topic for
-additional information). The Tag Editor allows you to select the tags for a report, including
+additional information). Use the Tag Editor to select the tags for a report, including
creating new ones to select.
-Follow the steps to select tags using the Tag Editor.
+To select tags using the Tag Editor:
**Step 1 –** On the Authoring page of the Report Configuration wizard, click the **Edit** button
located next to the Tags text box.
-**Step 2 –** In the Tag editor, select the checkbox next to the tags that should be applied to the
+**Step 2 –** In the Tag editor, select the checkbox next to the tags you want to apply to the
report.
-- In addition to selecting existing tags, you can also add new tags to be selected. To create a tag,
- enter the desired tag name in the text box and click **Add**.
+- In addition to selecting existing tags, you can also add new tags to select. To create a tag,
+ enter the tag name you want in the text box and click **Add**.
**Step 3 –** Click **OK**.
-The selected tags are now shown in the Tags field as a comma separated list.
+The Tags field now shows the selected tags as a comma separated list.
diff --git a/docs/accessanalyzer/11.6/admin/report/wizard/email.md b/docs/accessanalyzer/11.6/admin/report/wizard/email.md
index 76b9b10f20..9a42f91c29 100644
--- a/docs/accessanalyzer/11.6/admin/report/wizard/email.md
+++ b/docs/accessanalyzer/11.6/admin/report/wizard/email.md
@@ -21,14 +21,14 @@ topics for additional information). If you want to keep the default, then you ca
the wizard by clicking **Next**.
:::note
-In order for reports to be emailed, the SMTP server information must be configured in the
+To email reports, configure the SMTP server information in the
**Settings** > **Notification** node. See the
[Notification](/docs/accessanalyzer/11.6/admin/settings/notification.md)
topic for additional information.
:::
-To configure the setting for the report, use the Settings drop-down menu to select one of the
+To configure the setting for the report, use the Settings dropdown menu to select one of the
following options:
- Use default setting – The default option. Applies the Global notification settings, or whatever
@@ -36,9 +36,9 @@ following options:
**Email this report** is enabled by default, then using this option sends the report to the
recipients configured at the parent level where the inheritance begins.
- Email this report – Select this option if you want to email the report and the inherited setting
- is **Do not email this report**, or if you want to configure specific email settings for the
+ is **Don't email this report**, or if you want to configure specific email settings for the
report. If it is selected, you must then configure the additional fields below.
-- Do not email this report – Select this option to not email the report
+- Don't email this report – Select this option to not email the report
@@ -57,7 +57,7 @@ configure:
automatically populated.
- Send-To / Send-Cc / Send-Bcc – Enter the email addresses of the required recipients for the email
notification. Use a semicolon (;) to separate multiple recipients.
-- Do not e-mail this report if blank – Select this checkbox to not email the report if all elements
+- Don't e-mail this report if blank – Select this checkbox to not email the report if all elements
of it are blank when it is generated
- A blank report can occur if there is an error in data collection or if the report is
configured for data which might not always be present (for example, new computer objects
diff --git a/docs/accessanalyzer/11.6/admin/report/wizard/layout.md b/docs/accessanalyzer/11.6/admin/report/wizard/layout.md
index 0de8ee2e94..a85dd4d4cc 100644
--- a/docs/accessanalyzer/11.6/admin/report/wizard/layout.md
+++ b/docs/accessanalyzer/11.6/admin/report/wizard/layout.md
@@ -6,18 +6,18 @@ sidebar_position: 40
# Layout Page
-The Layout page allows you to configure the layout of the report's content.
+Use the Layout page to configure the layout of the report's content.
-Follow the steps to select the layout:
+To select the layout:
-**Step 1 –** Click the **Select the number of rows** drop-down menu and select an option from: 1
+**Step 1 –** Click the **Select the number of rows** dropdown menu and select an option from: 1
row, 2 rows, or 3 rows.
-**Step 2 –** Click on the layout tile you want for the report.
+**Step 2 –** Click the layout tile you want for the report.
-The layout for the report has been selected. Each box on the selected tile corresponds to a separate
+You've selected the layout for the report. Each box on the selected tile corresponds to a separate
widget that you next need to configure on the
[Widgets Page](/docs/accessanalyzer/11.6/admin/report/wizard/widgets.md)
page of the Report Configuration wizard.
@@ -29,9 +29,10 @@ number of already configured widgets, then the Element Downgrade Editor automati
-The maximum number of elements allowed by the correctly selected layout is specified at the top of
-the editor. Select the checkboxes next to the title of all the configured widgets you want to keep
-up to this limit, then click **OK**. Any widgets not selected will be removed from the report.
+The top of the editor specifies the maximum number of elements allowed by the correctly selected
+layout. Select the checkboxes next to the title of all the configured widgets you want to keep
+up to this limit, then click **OK**. Enterprise Auditor removes any widgets you don't select from
+the report.
:::note
You can click **Cancel** to return to the layout page to select a different layout with
diff --git a/docs/accessanalyzer/11.6/admin/report/wizard/overview.md b/docs/accessanalyzer/11.6/admin/report/wizard/overview.md
index 58f219e24f..5f4d7de91f 100644
--- a/docs/accessanalyzer/11.6/admin/report/wizard/overview.md
+++ b/docs/accessanalyzer/11.6/admin/report/wizard/overview.md
@@ -6,17 +6,17 @@ sidebar_position: 30
# Report Configuration Wizard
-You can use the Report Configuration Wizard to configure reports. The wizard can be launched for an
+You can use the Report Configuration Wizard to configure reports. You can launch the wizard for an
existing report or when creating a new report. See the
[Creating a Report](/docs/accessanalyzer/11.6/admin/report/create.md)
and
[Editing Existing Reports](/docs/accessanalyzer/11.6/admin/report/edit.md)
topics for additional information.
-Follow the steps to configure a report using the wizard.
+To configure a report using the wizard:
:::note
-Skip any sections or pages that do not require changes to the existing configuration.
+Skip any sections or pages that don't require changes to the existing configuration.
:::
@@ -33,12 +33,12 @@ page, use the inherited settings or configure report specific settings. Click **
**Step 4 –** The
[Publish Security Page](/docs/accessanalyzer/11.6/admin/report/wizard/publishsecurity.md)
page is only enabled if role-based access is configured for the Enterprise Auditor console. On this
-page you can view and configure accounts with permissions to view the report. If you are not using
+page you can view and configure accounts with permissions to view the report. If you aren't using
role-based access, you can skip this page. Click **Next**.
**Step 5 –** On the
[Layout Page](/docs/accessanalyzer/11.6/admin/report/wizard/layout.md)
-page, select the number of rows using the dropdown menu. Then select the desired pre-defined layout
+page, select the number of rows using the dropdown menu. Then select the pre-defined layout you want
from the options displayed. Click **Next**.
**Step 6 –** On the
@@ -47,9 +47,9 @@ page, configure widgets for each element of the layout.
**Step 7 –** Click **Finish** to save your changes.
-- If you do not want to save your changes or have not made any changes, click **Cancel** on any page
+- If you don't want to save your changes or have not made any changes, click **Cancel** on any page
to exit the wizard without saving your changes.
-Your configuration has been saved. For information on how to view your report, see the
+Enterprise Auditor has saved your configuration. For information on how to view your report, see the
[Viewing Generated Reports](/docs/accessanalyzer/11.6/admin/report/view.md)
topic.
diff --git a/docs/accessanalyzer/11.6/admin/report/wizard/publishsecurity.md b/docs/accessanalyzer/11.6/admin/report/wizard/publishsecurity.md
index 188b43be04..dd7522f901 100644
--- a/docs/accessanalyzer/11.6/admin/report/wizard/publishsecurity.md
+++ b/docs/accessanalyzer/11.6/admin/report/wizard/publishsecurity.md
@@ -19,8 +19,8 @@ topic for additional information.
-Roles assigned at the global level are inherited down to the report configuration. Additional report
-viewer privileges can also be added at the job group or job levels.
+Roles assigned at the global level inherit down to the report configuration. You can also add
+additional report viewer privileges at the job group or job levels.
De-select the Include Report Reviewers from this object's parent checkbox to remove all inherited
accounts with the Report Viewer role.
@@ -33,15 +33,15 @@ steps to add an account.
-**Step 2 –** On the Select User, Service Account or Group window, select the desired account and
+**Step 2 –** On the Select User, Service Account or Group window, select the account you want and
then click **OK**.
-The selected account is added to the list with a Role of Report Viewer.
+Enterprise Auditor adds the selected account to the list with a Role of Report Viewer.
:::note
-The permission for accounts that are not Inherited can also be removed using the wizard.
+You can also remove the permission for accounts that aren't Inherited using the wizard.
To remove an account, select it and then click **Remove**.
:::
diff --git a/docs/accessanalyzer/11.6/admin/report/wizard/widgets.md b/docs/accessanalyzer/11.6/admin/report/wizard/widgets.md
index 2f76aebf33..a31a8f6d39 100644
--- a/docs/accessanalyzer/11.6/admin/report/wizard/widgets.md
+++ b/docs/accessanalyzer/11.6/admin/report/wizard/widgets.md
@@ -11,12 +11,12 @@ text that form the report.
-At the top of the page the selected layout is described. The table contains the available element
-locations where widgets need to be configured.
+The top of the page describes the selected layout. The table contains the available element
+locations where you need to configure widgets.
-To add a new widget to an empty element, click **Configure** and select the desired widget type from
+To add a new widget to an empty element, click **Configure** and select the widget type you want from
the dropdown menu. The following widgets are available:
- [Grid](#grid)
@@ -38,7 +38,7 @@ following actions by selecting a row and clicking the relevant button:
## Grid
-Use the Grid widget type to configure a table to be displayed on generated reports.
+Use the Grid widget type to configure a table for generated reports.
@@ -74,7 +74,7 @@ To generate results, select a location as the data source.
**Export CSV Options**
-You can configure the table to allow the data to be exported as a CSV file.
+You can configure the table to allow exporting the data as a CSV file.
- Export table data as CSV – Select this option to enable a report’s table section to be exportable
as a CSV file from the generated report
@@ -83,7 +83,7 @@ You can configure the table to allow the data to be exported as a CSV file.
[Interactive Grids](/docs/accessanalyzer/11.6/admin/report/interactivegrids/overview.md)
topic for details about interactive grids.
:::warning
- Only interactive grids can be exported. Non-interactive grids display an "EOIeError" pop-up when you attempt to export a non-interactive grid as CSV.
+ You can only export interactive grids. Non-interactive grids display an "EOIeError" pop-up when you attempt to export a non-interactive grid as CSV.
:::
- Rows – Limits the amount of rows exported to the CSV file. The default is **Visible**.
- Visible – Only includes the amount of rows set by the **Limit Maximum number of displayed rows
@@ -142,8 +142,8 @@ The following settings are available when Interactive grid is selected:
### Data
-The selected data for the table is shown in the section at the bottom of the window. Use this section
-to configure the data to be displayed in the table.
+The section at the bottom of the window shows the selected data for the table. Use this section
+to configure the data to display in the table.
@@ -212,7 +212,7 @@ The following options are the available in the Chart Properties:
- Stacked – Consolidated bar chart for comparing values
:::note
- Negative numbers can't be plotted.
+ You can't plot negative numbers.
:::
@@ -220,7 +220,7 @@ The following options are the available in the Chart Properties:
- Enum Column – Groups the data in chart by the selected column name
- Assign color for pie slice – Available only for pie charts. Use this option to customize the color
for each slice. Select the column header name from the dropdown menu, then use the color selector
- window to choose the desired color.
+ window to choose the color you want.
### Link
@@ -233,8 +233,8 @@ report to link to and click **Ok**.
### Data
-The table of data for the chart is displayed in the middle of the window. Use this table to
-customize the data to be shown in the chart.
+The middle of the window displays the table of data for the chart. Use this table to
+customize the data to show in the chart.
@@ -274,7 +274,7 @@ Text Editor. On this dialog, select either the Basic or Advanced Text Editor and
Editor**. The selected editor then opens.
:::note
-Once a Text Editor is selected for a Text element, it can't be changed.
+After you select a Text Editor for a Text element, you can't change it.
:::
diff --git a/docs/accessanalyzer/11.6/admin/runninginstances/jobdetails.md b/docs/accessanalyzer/11.6/admin/runninginstances/jobdetails.md
index baa41cb257..9de54db7ff 100644
--- a/docs/accessanalyzer/11.6/admin/runninginstances/jobdetails.md
+++ b/docs/accessanalyzer/11.6/admin/runninginstances/jobdetails.md
@@ -38,7 +38,7 @@ The tab includes:
- Status – Execution status, for example **Queued**, **Running**, **Success**, or **Warning**.
- Message – Enterprise Auditor message regarding runtime activity
- Runtime – Duration of task execution
-- Stop – Aborts all currently running instances
+- Stop – Aborts all running instances
## History Tab
@@ -74,13 +74,14 @@ topic for additional information.
## Queued Jobs Tab
-The Queued Jobs tab displays a list of jobs in queue and the order in which they are executed.
+The Queued Jobs tab displays a list of jobs in queue and the order in which Enterprise Auditor
+executes them.
The tab includes:
-- Order – Order in which the queued jobs are executed. This order can be changed on the Queued Jobs
+- Order – Order in which the queued jobs are executed. You can change this order on the Queued Jobs
tab by using the buttons at the bottom.
- Job Path – Folder path in Jobs directory
- State – Queue status, for example **Running** or **Waiting**
diff --git a/docs/accessanalyzer/11.6/admin/runninginstances/overview.md b/docs/accessanalyzer/11.6/admin/runninginstances/overview.md
index c7c9524e0d..4922526cbe 100644
--- a/docs/accessanalyzer/11.6/admin/runninginstances/overview.md
+++ b/docs/accessanalyzer/11.6/admin/runninginstances/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# Running Instances Node
-The Running Instances node displays progress for all running jobs. This includes jobs that are run
-by a scheduled task, interactively within the open Enterprise Auditor instance, or interactively in
+The Running Instances node displays progress for all running jobs. This includes jobs that run
+via a scheduled task, interactively within the open Enterprise Auditor instance, or interactively in
any other running instance of Enterprise Auditor. The Running Instances node displays the instance
name, its status and position in the queue, run times for all instances, and detailed views of each
instance.
@@ -43,13 +43,13 @@ It also has hyperlinks for:
Clicking on any of the hyperlinks displays more information about the running job. The
**ProcessID**, **View Details, View Log**, and **Stop** links only work while the job is running.
-Once the job is complete, these links are disabled. The host and Connection Profile links continue
+After the job is complete, these links are disabled. The host and Connection Profile links continue
to work. The **View Schedule** link only displays and is valid for jobs that are running via a
-scheduled task and is not enabled for interactive job executions.
+scheduled task and isn't enabled for interactive job executions.
-The number of jobs currently being run can be found in the lower-left-hand corner of the Enterprise
+You can find the number of jobs being run in the lower-left-hand corner of the Enterprise
Auditor Console.
## View Host
@@ -98,7 +98,7 @@ topic for additional information.
## View Log
-The log for this running job can be opened in a text editor, such as Notepad.
+You can open the log for this running job in a text editor, such as Notepad.
@@ -118,8 +118,8 @@ Scheduler.
Click the **View Schedule** link to display the corresponding Scheduled Task for the running job or
-job group. This link is only enabled for jobs that are running via scheduled task and will not be
-enabled for interactive job executions.
+job group. The **View Schedule** link is only enabled for jobs that are running via scheduled task
+and will not be enabled for interactive job executions.
@@ -129,9 +129,9 @@ for additional information.
## Stop
-The job execution can be stopped if needed.
+You can stop the job execution if needed.
-Click **Stop** to abort all instances in the job queue. This link is only enabled while a job is
-running.
+Click **Stop** to abort all instances in the job queue. The **Stop** link is only enabled while a
+job is running.
diff --git a/docs/accessanalyzer/11.6/admin/schedule/overview.md b/docs/accessanalyzer/11.6/admin/schedule/overview.md
index bf4bad66f7..92e3e384df 100644
--- a/docs/accessanalyzer/11.6/admin/schedule/overview.md
+++ b/docs/accessanalyzer/11.6/admin/schedule/overview.md
@@ -11,7 +11,7 @@ Account, the Enterprise Auditor application can run multiple tasks simultaneousl
[Schedule](/docs/accessanalyzer/11.6/admin/settings/schedule.md)
topic for information on configuring the Schedule Service Account.
-The following tasks can be scheduled:
+You can schedule the following tasks:
- Job or Job Group – Schedule jobs to run at the job or job group level. See the
[Schedule Jobs](#schedule-jobs) topic for additional information.
@@ -25,11 +25,11 @@ The following tasks can be scheduled:
## Schedule Jobs
-Jobs can be scheduled at the job group or job level.
+You can schedule jobs at the job group or job level.
-Select the desired job group or job. Right-click on the node and select **Schedule** to open the
+Select the job group or job you want. Right-click the node and select **Schedule** to open the
Schedule wizard.
diff --git a/docs/accessanalyzer/11.6/admin/schedule/wizard.md b/docs/accessanalyzer/11.6/admin/schedule/wizard.md
index 87cc0e0e88..b28735f84e 100644
--- a/docs/accessanalyzer/11.6/admin/schedule/wizard.md
+++ b/docs/accessanalyzer/11.6/admin/schedule/wizard.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Schedule Wizard
-The schedule wizard allows you to configure scheduled tasks for jobs, job groups, Host Discovery
+Use the schedule wizard to configure scheduled tasks for jobs, job groups, Host Discovery
queries, and Host Inventory queries. The wizard has five wizard pages with options for setting up
the schedule task:
@@ -17,16 +17,16 @@ the schedule task:
- [Options](#options)
On the Schedule page, click **New** to schedule when the task will run. The Host List and Connection
-pages are optional customizations. See the relevant section below for more information on the
+pages are optional customizations. See the relevant section for more information on the
settings on each wizard page.
-When the settings on the wizard pages are configured as desired, click **OK** to save the changes
+When you've configured the settings on the wizard pages as desired, click **OK** to save the changes
and close the window. The task is visible in the Schedule Actions view, at the Schedules node.
## Schedule
-The Schedule page is for setting the schedule of when and how often the task will run. This tab
-needs to be properly configured for every scheduled task.
+The Schedule page is for setting the schedule of when and how often the task will run. You need to
+properly configure this tab for every scheduled task.
@@ -54,11 +54,11 @@ The options in the Trigger window are:
Days [value] of the month or the [value] [Day of the Week] of the month. By default, this is
set to recur every month. To select only specific months, use Months dropdown menu and
deselect the undesired months.
- - The drop-down menu next to **Start** opens a calendar view for selecting the date
+ - The dropdown menu next to **Start** opens a calendar view for selecting the date
- Selecting the **Synchronize across time zones** checkbox will synchronize the scheduled task
to run without respect to the time zone
-The remaining schedule frequencies are supplied by Windows Task Scheduler and not applicable to
+Windows Task Scheduler supplies the remaining schedule frequencies, which aren't applicable to
Enterprise Auditor task scheduling. See the Microsoft
[Task Scheduler Overview](https://technet.microsoft.com/en-us/library/cc721871.aspx) article for
additional information.
@@ -78,24 +78,24 @@ configuration of this tab is optional.
-Choose the desired setting from the following options:
+Choose the setting you want from the following options:
- Use Host list from Job – A default setting and applies the host list designated at the job or job
group level. This is also the recommended setting.
- Use Alternate Host List – Allows a host list to be selected from the list of Hosts Lists provided.
The list is from the Host Management host lists.
-Under the selection window, the number of selected hosts are identified. In addition, the **Select
+Under the selection window, the number of selected hosts appears. In addition, the **Select
All** and **Clear All** links provide for quick selection and deselection.
## Connection
-The Connection page identifies the Connection Profile that is applied to the targeted hosts being
+The Connection page identifies the Connection Profile applied to the targeted hosts being
queried by the task being scheduled. Customizations to the configuration of this tab is optional.
-Choose the desired setting from the following options:
+Choose the setting you want from the following options:
- Use Profile from Job – A default setting and applies the Connection Profile designated at the job
or job group level
@@ -124,7 +124,7 @@ The options on the Run as wizard page are:
- Use default Schedule Service Account – Uses the default Schedule Service Account that is set at
the **Settings** > **Schedule** node
- Use selected Schedule Service Account – Select the Schedule Service Account to use for the task
- from a list of available accounts in the drop-down menu
+ from a list of available accounts in the dropdown menu
- Use Custom Credentials – Use custom credentials not stored in the Enterprise Auditor Console.
Enter the User Name for the custom credentials.
diff --git a/docs/accessanalyzer/11.6/admin/schema/fsaadc/views/overview.md b/docs/accessanalyzer/11.6/admin/schema/fsaadc/views/overview.md
index 63efdbc8f3..c2c749a154 100644
--- a/docs/accessanalyzer/11.6/admin/schema/fsaadc/views/overview.md
+++ b/docs/accessanalyzer/11.6/admin/schema/fsaadc/views/overview.md
@@ -3,7 +3,7 @@
FSAA, FSAC, and FSDLP views provide pre-joined, human-readable projections of the underlying tables. Reports and the FSAA web UI consume these views rather than the raw tables.
:::note
-For views, column sizes are derived from the underlying source columns and the SQL `CASE` expressions in the view definitions; on a populated database the actual `sys.columns.max_length` may differ slightly. Use `EXEC sp_help ''` to inspect a view's exact runtime shape.
+The underlying source columns and the SQL `CASE` expressions in the view definitions determine column sizes for views; on a populated database the actual `sys.columns.max_length` may differ slightly. Use `EXEC sp_help ''` to inspect a view's exact runtime shape.
:::
---
@@ -549,7 +549,7 @@ For views, column sizes are derived from the underlying source columns and the S
**Description:** Surface view over `SA_FSAC_PermissionChanges` that resolves the affected trustee and decodes the ACL / ACE / inheritance / access-rights bitmasks into descriptive strings.
:::note
-This view doesn't join `SA_FSAC_ActivityEvents` or `SA_FSAA_Resources` — the access time and resource path aren't exposed; reports needing them must join `SA_FSAC_ActivityEvents` themselves.
+This view doesn't join `SA_FSAC_ActivityEvents` or `SA_FSAA_Resources`, so it doesn't expose the access time or resource path; reports needing them must join `SA_FSAC_ActivityEvents` themselves.
:::
**Source tables:** `SA_FSAC_PermissionChanges`, `SA_FSAA_Hosts`, UDF `SA_FSAA_GetTrusteeInformation`.
diff --git a/docs/accessanalyzer/11.6/admin/schema/sqldc/coretables/overview.md b/docs/accessanalyzer/11.6/admin/schema/sqldc/coretables/overview.md
index f0ffba48f0..02edc15bb3 100644
--- a/docs/accessanalyzer/11.6/admin/schema/sqldc/coretables/overview.md
+++ b/docs/accessanalyzer/11.6/admin/schema/sqldc/coretables/overview.md
@@ -49,7 +49,7 @@
|---|---|---|---|---|---|---|---|
| id | int | | No | PK | | IDENTITY | Surrogate primary key |
| instance_id | int | | No | | | | Reference to the hosting SQL Server instance |
-| active_database_id | int | | Yes | | FK | | FK to `SA_SQLServer_Databases.id`; links to the currently active database record |
+| active_database_id | int | | Yes | | FK | | FK to `SA_SQLServer_Databases.id`; links to the active database record |
| name | nvarchar | 128 | No | | | | Database name as recorded in audit events |
| minimum_event_datetime | datetime2 | | Yes | | | | Earliest event timestamp recorded for this database |
@@ -715,7 +715,7 @@
**Indexes:** `UQ_SA_SQLServer_Events_StaleDataLookup` on `(file_id, event_time)` (nonclustered, non-unique despite UQ_ prefix)
-> **Note:** Despite the `UQ_` prefix used in some environments, this index is **not unique** per the live schema (`is_unique = 0`).
+> **Note:** Despite the `UQ_` prefix used in some environments, this index **isn't unique** per the live schema (`is_unique = 0`).
---
@@ -950,7 +950,7 @@
| instance_id | int | | No | PK | | IDENTITY | Auto-incrementing surrogate primary key |
| instance_label | nvarchar | 256 | No | | | | Unique display label for the instance |
| service_name | nvarchar | 128 | Yes | | | | Named instance or service/database name |
-| is_active | bit | | No | | | `1` | Whether the instance is currently active for data collection |
+| is_active | bit | | No | | | `1` | Whether the instance is active for data collection |
| enable_impersonation | bit | | No | | | `0` | Whether Windows impersonation is enabled for connecting to this instance |
| database_type | int | | No | | | | Database platform type (see Section 6.11) |
| host_name | nvarchar | 150 | No | | | | Server hostname or IP address |
diff --git a/docs/accessanalyzer/11.6/admin/schema/sqldc/enumeration/overview.md b/docs/accessanalyzer/11.6/admin/schema/sqldc/enumeration/overview.md
index 8ff9afaedf..207c7a009f 100644
--- a/docs/accessanalyzer/11.6/admin/schema/sqldc/enumeration/overview.md
+++ b/docs/accessanalyzer/11.6/admin/schema/sqldc/enumeration/overview.md
@@ -91,7 +91,7 @@ Referenced by `SA_SQLServer_ServerPermissions.class` and `SA_SQLServer_DatabaseP
## Permission Names (`SA_SQLServer_PermissionNames`)
-Referenced by `SA_SQLServer_ServerPermissions.type` and `SA_SQLServer_DatabasePermissions.type`. Values are populated at runtime from `sys.server_permissions` and `sys.database_permissions`. The table below lists commonly encountered permission names; additional permissions may be present depending on SQL Server version and features in use.
+Referenced by `SA_SQLServer_ServerPermissions.type` and `SA_SQLServer_DatabasePermissions.type`. Values are populated at runtime from `sys.server_permissions` and `sys.database_permissions`. The following table lists commonly encountered permission names; additional permissions may be present depending on SQL Server version and features in use.
| Code | Permission Name |
|---|---|
@@ -121,7 +121,7 @@ Referenced by `SA_SQLServer_ServerPermissions.type` and `SA_SQLServer_DatabasePe
## Audit Class Types (`SA_SQLServer_AuditClassType`)
-Referenced by `SA_SQLServer_AuditActions.class_type` and `SA_SQLServer_Events.class_type`. The full list contains 107 entries; the most commonly encountered types are shown below.
+Referenced by `SA_SQLServer_AuditActions.class_type` and `SA_SQLServer_Events.class_type`. The full list contains 107 entries; the following table shows the most commonly encountered types.
| Code | Description | Code | Description |
|---|---|---|---|
@@ -148,7 +148,7 @@ Referenced by `SA_SQLServer_AuditActions.class_type` and `SA_SQLServer_Events.cl
## Audit Actions (Common) (`SA_SQLServer_AuditActions`)
-Referenced by `SA_SQLServer_Events.action_id`. The full list contains 173 action definitions; frequently referenced actions are shown below.
+Referenced by `SA_SQLServer_Events.action_id`. The full list contains 173 action definitions; the following sections show frequently referenced actions.
**Login / Logout Actions:**
@@ -265,13 +265,13 @@ Used to compute the `Database Type` column in `SA_SQLServer_EffectiveRoleMembers
| `5` | MySql | MySQL |
| `6` | AzureSqlServerManagedInstance | Azure SQL Managed Instance |
| `7` | SaDataSource | StealthAUDIT Data Source |
-| `8` | AWSPostgres | AWS PostgreSQL (not currently supported) |
-| `9` | AWSMySql | AWS MySQL (not currently supported) |
-| `10` | EDBPostgreSql | EDB PostgreSQL (not currently supported) |
-| `11` | SqlServerCluster | SQL Server Cluster (not currently supported) |
+| `8` | AWSPostgres | AWS PostgreSQL (not supported) |
+| `9` | AWSMySql | AWS MySQL (not supported) |
+| `10` | EDBPostgreSql | EDB PostgreSQL (not supported) |
+| `11` | SqlServerCluster | SQL Server Cluster (not supported) |
| `12` | Db2LUW | IBM Db2 LUW |
| `20` | MongoDb | MongoDB |
:::note
Within the SQL Server Data Collector context, only values `0` (Unset), `1` (SqlServer), `2` (AzureSqlServer), and `6` (AzureSqlServerManagedInstance) are applicable. The remaining values are used by other database collector modules that share the `SA_SQL_Instances` table.
-:::
\ No newline at end of file
+:::
diff --git a/docs/accessanalyzer/11.6/admin/schema/sqldc/overview.md b/docs/accessanalyzer/11.6/admin/schema/sqldc/overview.md
index d1a7779780..bc68d32cfb 100644
--- a/docs/accessanalyzer/11.6/admin/schema/sqldc/overview.md
+++ b/docs/accessanalyzer/11.6/admin/schema/sqldc/overview.md
@@ -8,9 +8,9 @@ This is a comprehensive schema documentation for the **NAA 11.6 SQL Server Data
The tables fall into two categories:
-1. **Core Data Collection Tables** (44 tables) — Normalized tables populated directly by data collectors. These contain raw audit data with full foreign key relationships. Includes shared infrastructure tables (`SA_SQL_Instances`, `SA_SQL_Patches`) used across all database collector modules.
+1. **Core Data Collection Tables** (44 tables) — Normalized tables that data collectors populate directly. These contain raw audit data with full foreign key relationships. Includes shared infrastructure tables (`SA_SQL_Instances`, `SA_SQL_Patches`) used across all database collector modules.
-2. **Reporting / Summary Tables** (59 tables) — Denormalized, report-ready tables populated by analysis jobs. These use human-readable column names (e.g., `"Instance"`, `"Database"`, `"Permission"`).
+2. **Reporting / Summary Tables** (59 tables) — Denormalized, report-ready tables that analysis jobs populate. These use human-readable column names (e.g., `"Instance"`, `"Database"`, `"Permission"`).
---
diff --git a/docs/accessanalyzer/11.6/admin/schema/sqldc/reportingtables/overview.md b/docs/accessanalyzer/11.6/admin/schema/sqldc/reportingtables/overview.md
index 024266a3db..b2c72588ce 100644
--- a/docs/accessanalyzer/11.6/admin/schema/sqldc/reportingtables/overview.md
+++ b/docs/accessanalyzer/11.6/admin/schema/sqldc/reportingtables/overview.md
@@ -1,6 +1,6 @@
# Reporting Tables
-The following 59 tables are **denormalized reporting tables** populated by NAA analysis jobs. They use human-readable column names with spaces (e.g., `"Database Type"`, `"Instance"`) and are designed for direct consumption by the NAA console and reports. They do not participate in foreign key relationships with the core tables.
+The following 59 tables are **denormalized reporting tables** that NAA analysis jobs populate. They use human-readable column names with spaces (e.g., `"Database Type"`, `"Instance"`) and support direct consumption by the NAA console and reports. They don't participate in foreign key relationships with the core tables.
:::note
All reporting tables share a common `Database Type` column (varchar/nvarchar) that identifies the SQL Server platform variant (e.g., `"SQL Server"`, `"Azure SQL Database"`, `"Azure SQL Managed Instance"`). None of these tables have primary keys or foreign keys — they are heap tables optimized for bulk INSERT/TRUNCATE patterns.
@@ -625,7 +625,7 @@ All reporting tables share a common `Database Type` column (varchar/nvarchar) th
| Database | nvarchar | 128 | Yes | | Database name |
| Schema | nvarchar | 128 | Yes | | Schema name |
| Table | nvarchar | 128 | Yes | | Table name containing sensitive data |
-| Criteria | nvarchar | MAX | Yes | | Matched SDD criteria name(s) |
+| Criteria | nvarchar | MAX | Yes | | Matched SDD criteria names |
| Table Row Count | bigint | | Yes | | Total rows in the table |
| Match Count | bigint | | Yes | | Number of sensitive data matches |
| Match Types | nvarchar | MAX | Yes | | Types of matches found |
@@ -679,7 +679,7 @@ All reporting tables share a common `Database Type` column (varchar/nvarchar) th
| Client | nvarchar | 128 | Yes | | Client IP or hostname |
| Application | nvarchar | 128 | Yes | | Application name |
| Action | nvarchar | 56 | Yes | | Action type (SELECT, INSERT, UPDATE, etc.) |
-| Criteria | nvarchar | 256 | Yes | | SDD criteria name(s) for the object |
+| Criteria | nvarchar | 256 | Yes | | SDD criteria names for the object |
| Match Data | nvarchar | 256 | Yes | | Sample match data |
---
@@ -710,7 +710,7 @@ All reporting tables share a common `Database Type` column (varchar/nvarchar) th
| Instance | nvarchar | 128 | Yes | | SQL Server instance name |
| Database | nvarchar | 128 | Yes | | Database name |
| Object | nvarchar | 128 | Yes | | Object name containing sensitive data |
-| Criteria | nvarchar | MAX | Yes | | SDD criteria name(s) |
+| Criteria | nvarchar | MAX | Yes | | SDD criteria names |
| Permission | nvarchar | 128 | Yes | | Permission name |
| Grantee | nvarchar | 513 | Yes | | Grantee principal |
| Grantee Id | nvarchar | 128 | Yes | | Grantee identifier |
diff --git a/docs/accessanalyzer/11.6/admin/schema/sqldc/views/overview.md b/docs/accessanalyzer/11.6/admin/schema/sqldc/views/overview.md
index 2d74f9ba6a..06a84c8dd1 100644
--- a/docs/accessanalyzer/11.6/admin/schema/sqldc/views/overview.md
+++ b/docs/accessanalyzer/11.6/admin/schema/sqldc/views/overview.md
@@ -117,7 +117,7 @@
| is_policy_checked | bit | | No | SA_SQLServer_SqlLogins.is_policy_checked | Whether password policy is enforced |
| is_expiration_checked | bit | | No | SA_SQLServer_SqlLogins.is_expiration_checked | Whether password expiration is enforced |
| password_hash | varbinary | 256 | Yes | SA_SQLServer_SqlLogins.password_hash | Hashed password value |
-| is_locked | bit | | Yes | SA_SQLServer_SqlLogins.is_locked | Whether the account is currently locked out |
+| is_locked | bit | | Yes | SA_SQLServer_SqlLogins.is_locked | Whether the account is locked out |
| is_expired | bit | | Yes | SA_SQLServer_SqlLogins.is_expired | Whether the password has expired |
| is_must_change | bit | | Yes | SA_SQLServer_SqlLogins.is_must_change | Whether the password must be changed at next login |
| password_hash_algorithm | int | | Yes | SA_SQLServer_SqlLogins.password_hash_algorithm | Algorithm used to hash the password |
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/overview.md b/docs/accessanalyzer/11.6/admin/settings/access/overview.md
index e8b678351d..065d297c40 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/overview.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/overview.md
@@ -6,12 +6,12 @@ sidebar_position: 10
# Access
-Configure what applications, users, and groups have access to Enterprise Auditor using the Access
-node
+Use the Access node to configure what applications, users, and groups have access to Enterprise
+Auditor.
-The first type of access that can be granted is Role Based Access for a user or group accessing the
+The first type of access you can grant is Role Based Access for a user or group accessing the
Enterprise Auditor Console. The second type of access grants access to an application accessing data
remotely through the Web Service using the REST API. See these sections for additional information:
@@ -24,7 +24,7 @@ credentials stored by the Enterprise Auditor application. See the
topic for additional information.
The **Cancel** and **Save** buttons are in the lower-right corner of the Roles view. These buttons
-are enabled when modifications are made to the Roles global setting.
+become enabled when you modify the Roles global setting.
-Whenever changes are made at the global level, click **Save** and then **OK** to confirm the
+Whenever you make changes at the global level, click **Save** and then **OK** to confirm the
changes. Otherwise, click **Cancel** if no changes were intended.
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/restapi/assignappaccess.md b/docs/accessanalyzer/11.6/admin/settings/access/restapi/assignappaccess.md
index 95cf99ccad..aabb917057 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/restapi/assignappaccess.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/restapi/assignappaccess.md
@@ -6,8 +6,7 @@ sidebar_position: 10
# Assign Application Access through the Web Service
-An application can be assigned to access data remotely through the Web Service. Follow the steps to
-assign roles in the Console.
+You can assign an application to access data remotely through the Web Service. To assign roles in the Console:
@@ -21,8 +20,8 @@ opens.
-**Step 3 –** The Application Access window displays a list of objects available in the database that
-are available for access. Select the database objects the application will access and click **Add**
+**Step 3 –** The Application Access window displays a list of database objects available for access.
+Select the database objects the application will access and click **Add**
to open the Select database objects window.
@@ -50,11 +49,11 @@ name** box to filter the list of objects by the characters entered.
app token.
- Application name – The name of the application accessing that data
-- Access Expiration – The expiration for the client secret. Select an option for the desired access
- expiration:
+- Access Expiration – The expiration for the client secret. Select an option for the access
+ expiration you want:
- - Access expires within – Select a time frame from the drop-down list. The default is 72 hours.
- - Access expires on specified date – Select a date from the drop-down list
+ - Access expires within – Select a time frame from the dropdown list. The default is 72 hours.
+ - Access expires on specified date – Select a date from the dropdown list
- Generate – Click this button to generate the Client ID and Client secret
- Client ID – Copy the Client ID into the application accessing data remotely through the Web
@@ -64,4 +63,4 @@ app token.
**Step 6 –** Click **Finish** to confirm the changes.
-The application is added to the table on the Access page.
+Enterprise Auditor adds the application to the table on the Access page.
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/restapi/getdata.md b/docs/accessanalyzer/11.6/admin/settings/access/restapi/getdata.md
index 0795d56eb1..3ccd08a67e 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/restapi/getdata.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/restapi/getdata.md
@@ -27,15 +27,15 @@ GET, POST
**PARAMETERS**
- **object-name** – Required value that specifies the unique object name.
- **alias-name** – Required value that specifies the unique alias associated with the table, available as a more thoughtfully designed namespace.
-- **jobRuntimeKey**(Optional) – The execution to retrieve information for. If this is omitted the latest report is provided.
-- **filters** (Optional) – A filter to be applied prior to returning data, multiple filters are applied with `and` operators. If an array is specified for the value field for a filter, the filter returns any successful match from the array of values. String comparisons are case insensitive. A list of the available functions is below. Filter functions:
+- **jobRuntimeKey**(Optional) – The execution to retrieve information for. If you omit this parameter, the endpoint returns the latest report.
+- **filters** (Optional) – A filter to apply before returning data. Multiple filters are applied with `and` operators. If an array is specified for the value field for a filter, the filter returns any successful match from the array of values. String comparisons are case insensitive. The following filter functions are available:
- equals
- not_equals
- greater (greater_equal)
- less (less_equal)
- contains
- starts_with
-- **columns** (Optional) – A list of columns to be returned. When not specified all columns are returned. The columns specified by the **groupby** parameter should be omitted from this array.
+- **columns** (Optional) – A list of columns to return. If you don't specify this parameter, the endpoint returns all columns. Omit the columns specified by the **groupby** parameter from this array.
- **groupby** (Optional) – A list of columns to group each row by, resulting in a JSON object that contains those keys followed by an array of entries.
Sample JSON request:
@@ -81,7 +81,7 @@ Sample JSON response:
**ERRORS**
- 400 One or more the parameters passed in are invalid.
-- 404 The object requested does not exist.
+- 404 The object requested doesn't exist.
## PROC
@@ -100,7 +100,7 @@ POST
**PARAMETERS**
- **object-name** – Required value that specifies the unique object name.
-- **groupby**(Optional) – A list of columns to group each row by, resulting in a JSON object that contains those keys followed by an array of entries. The parameters passed in here are passed to the stored procedure untouched. Arrays are mapped to a user defined table type, currently only single value arrays are supported.
+- **groupby**(Optional) – A list of columns to group each row by, resulting in a JSON object that contains those keys followed by an array of entries. The endpoint passes the parameters you provide here to the stored procedure untouched. It maps arrays to a user-defined table type and supports only single-value arrays.
Sample JSON request:
@@ -139,4 +139,4 @@ Sample JSON request:
**ERRORS**
- 400 One or more the parameters passed in are invalid.
-- 404 The object requested does not exist.
\ No newline at end of file
+- 404 The object requested doesn't exist.
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/restapi/obtaintoken.md b/docs/accessanalyzer/11.6/admin/settings/access/restapi/obtaintoken.md
index 7f000d9066..b29dff97d1 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/restapi/obtaintoken.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/restapi/obtaintoken.md
@@ -6,17 +6,17 @@ sidebar_position: 20
# Use the Client Credentials Grant to Obtain an Access Token
-An access token is a credential that can be used by an application to access an API. To obtain an
+An access token is a credential an application uses to access an API. To obtain an
access token, the application accessing data remotely through the Web Service must connect to the
Enterprise Auditor token endpoint and use the Client ID and Client Secret to authenticate the access
-request. This is done using the Client Credentials grant. The Client Credentials grant is used when
-applications request an access token to access their own resources, not on behalf of a user. The
-following request parameters should be used:
+request. This process uses the Client Credentials grant. Applications use the Client Credentials
+grant when they request an access token to access their own resources, not on behalf of a user. Use
+the following request parameters:
- `grant_type` (required) – The `grant_type` parameter must be set to `client_credentials`
- `scope` (optional) – Your service may support different scopes for the client credentials grant
-The client must then be authenticated for the request. Typically, the service will allow either
+The service must then authenticate the client for the request. Typically, the service will allow either
additional request parameters, `client_ID` and `client_secret`, or accept those parameters in the
HTTP Basic auth header.
@@ -31,15 +31,15 @@ grant_type=client_credentials
```
:::info
-Tokens contain sensitive information and should be stored securely. See the
+Store tokens securely because they contain sensitive information. See the
Microsoft
[ConvertTo-SecureString](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.4)
article for additional information.
:::
-If the token does not have the ability to perform this request, is invalid, or the specific resource
-has been blocked from access remotely, an HTTP status code of 401 is returned.
+If the token can't perform this request, is invalid, or the specific resource has been blocked from
+access remotely, the server returns an HTTP status code of 401.
If the request for an access token is valid, the authorization server generates an access token and
returns it to the client. The following example shows a successful access token response:
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/restapi/overview.md b/docs/accessanalyzer/11.6/admin/settings/access/restapi/overview.md
index c8f052bb18..f28ac347a9 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/restapi/overview.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/restapi/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# Web Service REST API for Applications Accessing Data Remotely
-The Enterprise Auditor REST API is integrated into the Web Service as an endpoint using an OAuth 2.0
-client credentials grant for authentication and providing the following access role:
+The Web Service integrates the Enterprise Auditor REST API as an endpoint that uses an OAuth 2.0
+client credentials grant for authentication and provides the following access role:
- Read-Only – Read data only
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/restapi/powershellcommands.md b/docs/accessanalyzer/11.6/admin/settings/access/restapi/powershellcommands.md
index eb33afabe5..32f0d5ea60 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/restapi/powershellcommands.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/restapi/powershellcommands.md
@@ -25,7 +25,7 @@ $refresh_token = $content.refresh_token;
```
:::info
-Tokens contain sensitive information and should be stored securely. See the
+Store tokens securely because they contain sensitive information. See the
Microsoft
[ConvertTo-SecureString](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.4)
article for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/restapi/refreshtoken.md b/docs/accessanalyzer/11.6/admin/settings/access/restapi/refreshtoken.md
index a52d82f245..de14df02bd 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/restapi/refreshtoken.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/restapi/refreshtoken.md
@@ -11,9 +11,9 @@ refresh token when the access token expires.
- `grant_type` (Required) – The `grant_type` parameter must be set to `client_credentials`
- `refresh_token` (Required) – The refresh token previously issue to the client
-- `scope` (Optional) – The requested scope must not include additional scopes that were not issued
- in the original access token. If the scope is not included in the request, the service issues an
- access token with the same scope as previously issued.
+- `scope` (Optional) – The requested scope must not include additional scopes that the service
+ didn't issue in the original access token. If the request doesn't include a scope, the service
+ issues an access token with the same scope it previously issued.
- Client Authentication – Required if the client was issued a secret
The authentication server then verifies the access request. If the request is valid, the service
@@ -30,12 +30,12 @@ grant_type=refresh_token
&client_secret=xxxxxxxxxx
```
-If the token does not have the ability to perform this request, is invalid, or the specific resource
-has been blocked from access remotely, an HTTP status code of 401 is returned.
+If the token can't perform this request, is invalid, or the specific resource has been blocked from
+access remotely, the server returns an HTTP status code of 401.
-The response for a refresh token is the same as the response for an access token. Optionally, a new
-refresh token can be included in the response. If a new refresh token is not included in the
-response, the current refresh token will continue to be valid. The following example shows a
+The response for a refresh token is the same as the response for an access token. Optionally, the
+service can include a new refresh token in the response. If the response doesn't include a new
+refresh token, the current refresh token remains valid. The following example shows a
successful access token response:
```
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/assignroles.md b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/assignroles.md
index f09a26f12a..5b87e7318a 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/assignroles.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/assignroles.md
@@ -6,12 +6,12 @@ sidebar_position: 50
# Assign User to Role Members
-Role Based Access becomes enabled within Enterprise Auditor as soon as the first role has been
-assigned in the Access Role wizard. When saving the first role or set of roles added to the Role
-Membership list in the Roles view, the Administrator role must be included for a least one user or
-an error message displays.
+Role Based Access becomes enabled within Enterprise Auditor as soon as you assign the first role
+in the Access Role wizard. When you save the first role or set of roles added to the Role
+Membership list in the Roles view, you must include the Administrator role for at least one user,
+or an error message displays.
-Follow the steps to assign roles in the Enterprise Auditor Console.
+To assign roles in the Enterprise Auditor Console:
@@ -31,33 +31,33 @@ ellipsis (**…**) to browse for accounts with the Select User or Group window.
[Group Managed Service Accounts](https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview)
article for additional information.
- - Change the location to the desired domain and click **Object Types**, then select **Service
+ - Change the location to the domain you want and click **Object Types**, then select **Service
Accounts**.
- Add the gMSA name (`gMSAadmin$`), then click **OK**.
- The Member Type will show as `msDS-GroupManagedServiceAccount` on the Access page.
-**Step 4 –** Select a role for the group or user from the Role list. Click **Finish**. The group or
-user and role is added to the Role Membership list in the Roles view.
+**Step 4 –** Select a role for the group or user from the Role list, and click **Finish** to add the
+group or user and role to the Role Membership list in the Roles view.
**Step 5 –** Repeat Steps 1-4 to assign roles to other groups or users.
-**Step 6 –** Click **Save** and then **OK** to confirm the changes. All applied roles are lost if
-they are not saved.
+**Step 6 –** Click **Save** and then **OK** to confirm the changes. If you don't save the changes, you
+lose all applied roles.
-Role Based Access is enabled when the first role has been assigned.
+Role Based Access becomes enabled when you assign the first role.
-
+
The first role or set of roles saved must include the Administrator role. Clicking **Save** for the
first role or set or roles without including the Administrator generates an error message in the
Enterprise Auditor Console.
When Role Based Access is first enabled, restart the Enterprise Auditor application to ensure all
-roles are properly active. When saving roles for the first time, permissions for the local Users
-group are applied to the Enterprise Auditor directory. This allows roles to be leveraged without
-requiring local Administrator rights.
+roles are properly active. When you save roles for the first time, Enterprise Auditor applies
+permissions for the local Users group to the Enterprise Auditor directory. This lets you use roles
+without requiring local Administrator rights.
| | |
| ----------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -71,46 +71,46 @@ There are two separate sets of permissions:
## Edit Role Members' Responsibilities
-Follow the steps to edit a Enterprise Auditor user’s role.
+To edit a Enterprise Auditor user's role:
-**Step 1 –** On the Access page, select the desired user and click **Edit Member Role**.
+**Step 1 –** On the Access page, select the user you want and click **Edit Member Role**.
**Step 2 –** Select a new role for the user from the Roles list.
-**Step 3 –** Click **Finish**. The role is updated on the Access page.
+**Step 3 –** Click **Finish** to update the role on the Access page.
**Step 4 –** Repeat Steps 1-3 to edit other users’ roles.
-**Step 5 –** Click **Save** and then **OK** to confirm the changes. All applied roles are lost if
-they are not saved.
+**Step 5 –** Click **Save** and then **OK** to confirm the changes. If you don't save the changes, you
+lose all applied roles.
The changed roles take affect the next time the users logs into the Enterprise Auditor application.
-If a user is actively logged into Enterprise Auditor at the same time the role for that user is
-changed, then the user needs to exit and re-launch the application for the role to take effect.
+If a user is actively logged into Enterprise Auditor when an administrator changes that user's
+role, the user needs to exit and re-launch the application for the role change to take effect.
## Delete Role Member
-Follow the steps to delete a user from having access to the Enterprise Auditor Console.
+To delete a user's access to the Enterprise Auditor Console:
-**Step 1 –** On the Access page, select the desired user and click **Delete Role Member**. The
-selected user will be removed from the list.
+**Step 1 –** On the Access page, select the user you want and click **Delete Role Member** to remove
+the user from the list.
:::note
-No confirmation will be requested. However the changes will not be finalized until Step 3
-is completed.
+Enterprise Auditor doesn't request confirmation. However, the changes aren't final until you
+complete Step 3.
:::
**Step 2 –** Repeat Step 1 to remove other users as desired.
-**Step 3 –** Click **Save** and then **OK** to confirm the deletions. The users will not be deleted
-if the changes are not saved.
+**Step 3 –** Click **Save** and then **OK** to confirm the deletions. Enterprise Auditor doesn't
+delete the users unless you save the changes.
The deleted users will no longer be able to log into the Enterprise Auditor application. If a user
is actively logged into Enterprise Auditor at the same time of the deletion, the user will need to
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/configureroles.md b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/configureroles.md
index 8d66d70fb1..a5a771f889 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/configureroles.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/configureroles.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Configuring Roles
-To ensure a least privilege access model, roles need to be configured within both the Enterprise
+To ensure a least-privilege access model, configure roles within both the Enterprise
Auditor Console for folder rights and SQL Management Studio for database access rights.
This is a three-part process:
@@ -23,7 +23,7 @@ This is a three-part process:
- Delete Role Members
:::note
-This configuration process is not required if only using Role Based Access to secure
+This configuration process isn't required if only using Role Based Access to secure
Published Reports. See the
[Securing Published Reports Only](/docs/accessanalyzer/11.6/admin/settings/access/rolebased/securereports.md)
topic for additional information.
@@ -32,12 +32,12 @@ topic for additional information.
## Configure the Installation Account
-The Enterprise Auditor Installation Account is used both to perform the initial installation of
-Enterprise Auditor and to change Storage Profile settings. It needs additional rights in order to
+Enterprise Auditor uses the Installation Account both to perform the initial installation of
+Enterprise Auditor and to change Storage Profile settings. It needs additional rights to
query objects in the master database. This is only necessary so the user can enumerate the available
databases to choose from when configuring the Enterprise Auditor Storage Profile.
-The following script can be executed to give these necessary rights only to the account performing
+Run the following script to give these necessary rights only to the account that performs
the initial installation of Enterprise Auditor and any changes to the database where Enterprise
Auditor writes data:
@@ -57,15 +57,15 @@ GO
## Configure Roles in SQL Management Studio
-It is necessary to provision rights to the SQL Server database so the Enterprise Auditor application
+Provision rights to the SQL Server database so the Enterprise Auditor application
rights and database access rights are consistent and provide the minimum rights necessary to support
-the Enterprise Auditor roles. This approach involves creating custom database roles which will be
-assigned rights and privileges. Then, individual domain user accounts must be assigned to these
+the Enterprise Auditor roles. This approach involves creating custom database roles and assigning
+rights and privileges to them. Then, assign individual domain user accounts to these
roles.
:::note
-For any SQL Server version prior to 2012, Windows groups cannot be used because SQL Server
-does not allow the assignment of default schemas to Windows groups. Enterprise Auditor requires the
+For any SQL Server version before 2012, you can't use Windows groups because SQL Server
+doesn't allow assigning default schemas to Windows groups. Enterprise Auditor requires the
default schema of [dbo] to function properly.
:::
@@ -77,7 +77,7 @@ To create the roles within the SQL Server database, run the following script.
Be sure to set the context of this query to the Enterprise Auditor database by selecting the right
-database from the drop-down window. Alternatively, prefix the script with a
+database from the dropdown window. Alternatively, prefix the script with a
`USE [Enterprise Auditor DATABASE NAME]` clause.
```
@@ -119,20 +119,20 @@ GO
```
-Once the script has been successfully executed, assign domain users to these database roles.
+After the script runs successfully, assign domain users to these database roles.
### Assigning Users to SQL Roles
-Now that the SQL Server database roles have been created the next step is to assign domain users to
-those roles. This can be done interactively in SQL Management Studio. Follow the steps to assign
-users to SQL Server database roles.
+Now that you've created the SQL Server database roles, the next step is to assign domain users to
+those roles. You can do this interactively in SQL Management Studio. To assign
+users to SQL Server database roles:
**Step 1 –** Connect to the Enterprise Auditor database through SQL Management Studio.
-**Step 2 –** Validate that the roles have been properly created by navigating to **Security** >
-**Roles** > **Database Roles**. The three new roles should be visible:
+**Step 2 –** Navigate to **Security** > **Roles** > **Database Roles** to confirm the script created
+the three new roles. The three new roles should be visible:
- SMP_Admin
- SMP_Builder
@@ -142,8 +142,8 @@ users to SQL Server database roles.
| ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
|  |  |
-**Step 3 –** After confirmation of role creation, the next step is to map users to these roles.
-Right-click on the **Security** > **Users** node and select **New User**.
+**Step 3 –** After you confirm the roles were created, map users to these roles by right-clicking the
+**Security** > **Users** node and selecting **New User**.
@@ -162,5 +162,5 @@ Right-click on the **Security** > **Users** node and select **New User**.
[Role Definitions](/docs/accessanalyzer/11.6/admin/settings/access/rolebased/roledefinitions.md)
topic for more information.
-When all of the users have been assigned to the appropriate SQL Server database roles, complete the
+After you assign all users to the appropriate SQL Server database roles, complete the
process by assigning users to roles within the Enterprise Auditor Console.
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/customroles.md b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/customroles.md
index e971771900..2ce6f31ce3 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/customroles.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/customroles.md
@@ -6,11 +6,10 @@ sidebar_position: 20
# Custom Roles
-A custom role can be created within Enterprise Auditor to combine the rights of other defined roles.
-Follow the steps below to create a custom role.
+You can create a custom role within Enterprise Auditor to combine the rights of other defined roles.
**Step 1 –** In the Enterprise Auditor directory, navigate to **PrivateAssemblies** and edit the
-**rba-roles.conf** file. Add a new section for the custom role as shown in the following
+**rba-roles.conf** file. Add a new section for the custom role as shown in the following
instructions:
```
@@ -23,25 +22,25 @@ instructions:
```
-- Replace `Special User` between the double quotes in the script above with the name of the new
+- Replace `Special User` between the double quotes with the name of the new
role.
-- Replace `Description of Special User` between the double quotes in the script above with a
- description of what a user assigned the new role is able to do.
+- Replace `Description of Special User` between the double quotes with a
+ description of what a user assigned the new role can do.
-**Step 2 –** Add privileged values for the desired rights on new lines between the beginning comment
-`` and ending comment `` in the script above.
+**Step 2 –** Add privileged values for the rights you want on new lines between the beginning comment
+`` and ending comment ``.
- For example, to create a single role which has the same privileges as the Host Management
Administrator and Global Options Administrator roles, copy the privileges from the sections of the
**rba-roles.conf** file to the newly added section, and remove duplicate values if there is any
overlap.
-See the sections below for examples of how roles should be added in the **rba-roles.conf** file.
+See the following sections for examples of how to add roles in the **rba-roles.conf** file.
## Default Global Options Administrator Privileges
-The following example shows what is currently contained in the Global Options Administrator role,
-and how the created role should be added in the **rba-roles.conf** file.
+The following example shows what the Global Options Administrator role contains and how to add the
+created role in the **rba-roles.conf** file.
```
@@ -85,8 +84,8 @@ and how the created role should be added in the **rba-roles.conf** file.
## Default Host Management Administrator Privileges
-The following example shows what is currently contained in the Host Management Administrator role,
-and how the created role should be added in the **rba-roles.conf** file.
+The following example shows what the Host Management Administrator role contains and how to add the
+created role in the **rba-roles.conf** file.
```
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/faq.md b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/faq.md
index de92a9199f..5e05b9623a 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/faq.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/faq.md
@@ -11,24 +11,25 @@ Auditor.
**How do locked jobs affect the role functionality?**
-A lock on a job represents the approval by the Job Approver, and is therefore deemed acceptable to
+A lock on a job represents the Job Approver's approval and therefore makes the job acceptable to
execute. Once a job is locked, Job Builders can no longer modify the job configuration. Furthermore,
-only locked jobs can be run. Therefore, the Job Initiator can only run or schedule jobs which have
-already been locked.
+Enterprise Auditor allows only locked jobs to run. Therefore, the Job Initiator can only run or
+schedule jobs that have already been locked.
:::note
-Locked jobs do not affect the functionality of the Administrator role. See the
+Locked jobs don't affect the functionality of the Administrator role. See the
[Role Definitions](/docs/accessanalyzer/11.6/admin/settings/access/rolebased/roledefinitions.md)
topic for more information.
:::
-How can I make sure that a lock on a job will not get tampered with through the associated XML file?
+How can you ensure that a lock on a job isn't tampered with through the associated XML file?
The Scheduling Service Account provides limited rights for the Job Approver. Previously, the Job
-Approver required permissions on the Jobs folder in order to apply the lock to a job. Now, the
-credentials specified in the Scheduling Service Account will be used to apply the locks. Therefore,
-the Job Approver no longer needs access to the Jobs folder and cannot manually remove or tamper with
+Approver required permissions on the Jobs folder to apply the lock to a job. Now,
+Enterprise Auditor uses the credentials specified in the Scheduling Service Account to apply the
+locks. Therefore,
+the Job Approver no longer needs access to the Jobs folder and can't manually remove or tamper with
the associated XML file.
:::note
@@ -44,31 +45,31 @@ topics for more information.
Why can the Host Management Administrator not manage settings for the Host Discovery and Host
Inventory nodes under Settings?
-The Host Management Administrator role is designed specifically to access the Host Management node.
-Therefore, this role does not grant access to the global settings menu under the Settings node.
+The Host Management Administrator role provides access only to the Host Management node.
+Therefore, this role doesn't grant access to the global settings menu under the Settings node.
:::note
-In order to access this node, the user must have either the Administrator or the Global
+to access this node, the user must have either the Administrator or the Global
Options Administrator role. See the
[Role Definitions](/docs/accessanalyzer/11.6/admin/settings/access/rolebased/roledefinitions.md)
topic for more information.
:::
-What rights do I need to give the user on the local machine in order to use Enterprise Auditor?
+What rights do you need to give the user on the local machine to use Enterprise Auditor?
Enabling Role Based Access removes the necessity to explicitly provide users rights on the
Enterprise Auditor folder structure. Instead, when the Administrator role is first assigned and Role
Based Access is enabled, the roles will set permissions to allow all members of the local users
group the necessary access to Enterprise Auditor.
-When a user’s role is changed, when does the new role take affect?
+When an administrator changes a user's role, when does the new role take effect?
-If a user’s role has been altered while they are in an active Enterprise Auditor session, the user
-must exit the Enterprise Auditor Console and re-open the application for the new role to take
-effect. This is also true if a user has been given an additional role or removed from role
-membership. The capabilities of the new role will not come into effect until the Enterprise Auditor
-application has been restarted.
+If an administrator has altered a user's role while the user is in an active Enterprise Auditor
+session, the user must exit the Enterprise Auditor Console and re-open the application for the new
+role to take effect. This is also true if an administrator has given a user an additional role or
+removed the user from role membership. The capabilities of the new role don't come into effect
+until the user restarts the Enterprise Auditor application.
:::note
See the
@@ -79,14 +80,14 @@ topics for more information.
:::
-I locked a job, but when going back to it, it appears to be unlocked. Why?
+A job was locked, but it appears unlocked when you go back to it. Why?
-A locked job signifies that the job has been approved for execution and should not be modified. If a
-job is modified in any way, the lock is immediately removed. Although most roles should not be able
-to modify locked jobs, the Administrator role can. This role is not governed by the limitations of
-Role Based Access. Thus, if a locked job is modified by an Administrator, the job will become
-unlocked. This event will be logged as a job-change related event by Administrator in the Enterprise
-Auditor Event Log.
+A locked job signifies that the Job Approver has approved the job for execution and that you
+shouldn't modify it. If you modify a job in any way, Enterprise Auditor immediately removes the
+lock. Although most roles shouldn't be able to modify locked jobs, the Administrator role can. This
+role isn't governed by the limitations of Role Based Access. Thus, if an Administrator modifies a
+locked job, the job becomes unlocked. Enterprise Auditor logs this event as a job-change-related
+event performed by the Administrator in the Enterprise Auditor Event Log.
:::note
If using a Job Initiator’s credentials for the Schedule Service Account, all jobs must be
@@ -102,13 +103,12 @@ topics for more information.
What should be the group type when assigning Role Based Access to an AD group in a multi-domain
environment?
-When assigning an Role Based Access to an AD group, it is important to consider the domain
+When assigning Role Based Access to an AD group, consider the domain
relationship between the AD group and the Enterprise Auditor server.
If the Enterprise Auditor server and the AD group are in different domains then the AD group must be
-a universal group. If the group type is not universal then it will result in the RBA being unable to
-access the user's group membership and the user who is a member of that AD group will be unable to
-view any reports.
+a universal group. If the group type isn't universal, Role Based Access can't access the user's
+group membership, and the user in that AD group can't view any reports.
However, if both the Enterprise Auditor server and the AD group are in the same domain, the AD group
can be either a local group, global group, or universal group.
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/overview.md b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/overview.md
index 08533e3f5a..31c05a8f41 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/overview.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/overview.md
@@ -6,45 +6,45 @@ sidebar_position: 10
# Role Based Access
-Role Based Access allows Enterprise Auditor users to not have local Administrator rights on the
-console server. This is done through the creation of different roles which cover all aspects of the
-Enterprise Auditor work flow introduced by enabling Role Based Access. These roles can be leveraged
-without such elevated rights. Responsibilities within the Enterprise Auditor Console have been
-divided among these roles.
-
-Role Based Access also allows users to secure published reports when accessed through the Web
-Console. This is done by first enabling Role Based Access and then by assigning users/groups as
-viewers to the reports to which they should have access.
-
-Report security through Role Based Access can be applied without implementing a least privileged
-access model to the Enterprise Auditor Console. See the
+With Role Based Access, Enterprise Auditor users don't need local Administrator rights on the
+console server. Enterprise Auditor achieves this by creating different roles that cover all aspects
+of the Enterprise Auditor workflow introduced by enabling Role Based Access. You can use these roles
+without such elevated rights. These roles divide responsibilities within the Enterprise Auditor
+Console.
+
+Role Based Access also secures published reports when accessed through the Web
+Console. To do this, first enable Role Based Access, then assign users or groups as viewers to the
+reports they should access.
+
+You can apply report security through Role Based Access without implementing a least-privileged
+access model for the Enterprise Auditor Console. See the
[Securing Published Reports Only](/docs/accessanalyzer/11.6/admin/settings/access/rolebased/securereports.md)
topic for additional information.
:::note
-The least privileged access model to the Enterprise Auditor Console does not work in
-conjunction with the Exchange Solution. Role Based Access can be enabled, but the Administrator role
-is required to run the Exchange Solution jobs.
+The least-privileged access model to the Enterprise Auditor Console doesn't work with the Exchange
+Solution. You can enable Role Based Access, but running the Exchange Solution jobs requires the
+Administrator role.
:::
:::warning
-Please use caution when enabling Role Based Access, as it is a very powerful tool
-within the console designed to be difficult to disable once activated. If Role Based Access is
-enabled by accident, please contact [Netwrix Support](https://www.netwrix.com/support.html) for
-assistance in disabling it.
+Use caution when enabling Role Based Access, as it's a very powerful tool
+within the console that's difficult to disable once activated. If you enable Role Based Access
+by accident, contact [Netwrix Support](https://www.netwrix.com/support.html) for
+help disabling it.
:::
The account used to perform the initial Enterprise Auditor installation, as well as to change
-Storage Profile settings after installation, require additional rights in order to query objects in
+Storage Profile settings after installation, require additional rights to query objects in
the master database. See the
[Configure the Installation Account](/docs/accessanalyzer/11.6/admin/settings/access/rolebased/configureroles.md#configure-the-installation-account)
topic for additional information on this account.
-To enable Role Based Access within Enterprise Auditor, corresponding roles must first be created
-within SQL Management Studio. Then Enterprise Auditor users must be assigned roles both in SQL
-Management Studio and in Enterprise Auditor.
+To enable Role Based Access within Enterprise Auditor, first create the corresponding roles within
+SQL Management Studio. Then assign roles to Enterprise Auditor users both in SQL Management Studio
+and in Enterprise Auditor.
The first Enterprise Auditor user assigned a role must be an Administrator. Assigning this first
user role officially enables Role Based Access within Enterprise Auditor. See the
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/roledefinitions.md b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/roledefinitions.md
index dd80a902ff..503c3797c8 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/roledefinitions.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/roledefinitions.md
@@ -6,19 +6,20 @@ sidebar_position: 10
# Role Definitions
-The following is a list of all roles leveraged within Enterprise Auditor once Role Based Access is
+The following is a list of all roles used within Enterprise Auditor once Role Based Access is
enabled, including their intended functionality. A user may have more than one role assigned to
them.
:::note
-When a job is moved or copied to a separate job group, it inherits the assigned roles at
-the parent and global level from the new job group. Any previous role inheritance is overwritten.
+When you move or copy a job to a separate job group, it inherits the assigned roles at
+the parent and global level from the new job group. Enterprise Auditor overwrites any previous
+role inheritance.
:::
- OS Administrator – Used only for installation purposes
- - This is not not a configured role, but rather the access required during installation
+ - This isn't not a configured role, but rather the access required during installation
- Administrator – At least one must be set before any other roles are assigned
@@ -27,8 +28,8 @@ the parent and global level from the new job group. Any previous role inheritanc
- Rights to preform an upgrade on Enterprise Auditor
:::note
-In order to use Role Base Access with the Exchange Solution, all Exchange users must be
-assigned the Administrator role. This is because the solution requires local Administrator rights on
+To use Role Based Access with the Exchange Solution, assign the Administrator role to all Exchange
+users. This is necessary because the solution requires local Administrator rights on
the Enterprise Auditor Console server.
:::
@@ -58,7 +59,7 @@ the Enterprise Auditor Console server.
- Global Options Administrator
- Able to modify global settings, except for the **Setting** > **Access** node
- - The Exchange node is the exception due to its requirements. Therefore, this node cannot be
+ - The Exchange node is the exception due to its requirements. Therefore, this node can't be
modified by the Global Options Administrator.
- Rights to view report Tags within the Web Console but not report content or permissions
@@ -120,8 +121,8 @@ the Enterprise Auditor Console server.
**Configure** > **Reports**> **Configure** > **Publish Security** page) – Able to view
only this report
-By default, many roles are granted rights to view all reports and report content. The inheritance of
-the Report Viewer role can be broken at the job group, job, or report configuration levels. See the
+By default, many roles have rights to view all reports and report content. You can break the Report
+Viewer role's inheritance at the job group, job, or report configuration levels. See the
[Report Viewer Inheritance](#report-viewer-inheritance) topic for additional information.
## Enterprise Auditor Console Roles & Rights
@@ -194,15 +195,15 @@ This table identifies the rights granted to users who have access only to the We
## SQL Server Database Roles & Rights
-This table describes the roles that will be created within the SQL Server database and what rights
-they will have to the Enterprise Auditor database. It also describes which Enterprise Auditor roles
-they are mapped to.
+This table describes the roles that you'll create within the SQL Server database and what rights
+they'll have to the Enterprise Auditor database. It also describes which Enterprise Auditor roles
+map to them.
-| Database Role(s) | Enterprise Auditor Role | Rights | Role Description |
+| Database Roles | Enterprise Auditor Role | Rights | Role Description |
| --------------------------------------------- | ------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| SMP Administrator db_datareader db_datawriter | Administrator Job Initiator Job Initiator (No Actions) | On the dbo schema: ALTER, EXECUTE, INSERT, UPDATE, REFERENCES On the Enterprise Auditor database: CREATE TABLE, CREATE VIEW, CREATE PROCEDURE, CREATE FUNCTION, CREATE TYPE | This role is used by full Administrators and Job Initiators who must run the 2-FSAA Bulk Import Job which requires manipulation of the Enterprise Auditor database |
| SMP Builder | Job Builder Host Management Administrator | On the dbo schema: ELECT, INSERT, DELETE On the Enterprise Auditor database: CREATE TABLE | This role is used by the Job Builder who must be able to create/delete tables, view data, and insert and delete hosts from the Enterprise Auditor Console |
-| SMP Viewer | Job Viewer Access Administrator Job Approver All other roles | On the dbo schema: SELECT | This role is used by all roles who do not require anything more than just reading data and information from the database |
+| SMP Viewer | Job Viewer Access Administrator Job Approver All other roles | On the dbo schema: SELECT | This role is used by all roles who don't require anything more than just reading data and information from the database |
## Report Viewer Inheritance
@@ -218,9 +219,9 @@ reports and their content:
- Job Viewer
- Web Administrator
-Additional users can be assigned the Report Viewer role at the global, job group, job, or report
-configuration levels. These rights are inherited down through child objects. However, the Report
-Viewer role inheritance can be broken at any level. Break inheritance to remove the right to view
+You can assign additional users the Report Viewer role at the global, job group, job, or report
+configuration levels. Child objects inherit these rights. However, you can break the Report
+Viewer role's inheritance at any level. Break inheritance to remove the right to view
specific reports at:
- Job Group level – **[Job Group]** >**Settings** > **Reporting** node
@@ -241,5 +242,5 @@ There are two options that control inheritance for Report Viewers when selected:
Viewer role inherited from a parent object at the lower levels
- Set all the child objects to inherit these settings – Only available at the Job Group level. Sets
all Jobs and Reports to inherit group settings for all child objects by automatically selecting
- the **Include Report Viewers from this object’s parent** option. Any previous configurations are
- overwritten once **Yes** is selected in the confirmation window.
+ the **Include Report Viewers from this object’s parent** option. The system overwrites any
+ previous configurations after you select **Yes** in the confirmation window.
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/scheduleserviceaccount.md b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/scheduleserviceaccount.md
index 2f44f82dc7..5889a53bc7 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/scheduleserviceaccount.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/scheduleserviceaccount.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Roles & the Schedule Service Account
-Once Role-Based Access is enabled, a user or group with the appropriate access role has the ability
-to schedule a job or job group as a Schedule Service Account at the **Settings** > **Schedule**
+Once Role-Based Access is enabled, a user or group with the appropriate access role can schedule
+a job or job group as a Schedule Service Account at the **Settings** > **Schedule**
node. Multiple accounts can be added as needed.
**Who Configures This Account?**
@@ -25,18 +25,18 @@ Whose Credentials Should Be Used as the Schedule Service Account?
- Job Initiator role
:::note
-In order to run or schedule a Host Inventory query, the Schedule Service Account must have
+to run or schedule a Host Inventory query, the Schedule Service Account must have
an Administrator, Power User, or Host Management Administrator role. Therefore, if the account has
the Job Initiator role assigned, it must have the Host Management Administrator role as well.
:::
-The Schedule Service Account is used to access the Task folders when scheduling tasks and to apply
-locks on jobs.
+Enterprise Auditor uses the Schedule Service Account to access the Task folders when scheduling
+tasks and to apply locks on jobs.
- Schedule Tasks
- - In order to have the appropriate level of rights to schedule tasks, the credentials specified
+ - to have the appropriate level of rights to schedule tasks, the credentials specified
must at least have the following:
- Create Files/Write Data rights on the Windows Task Folder
@@ -44,7 +44,7 @@ locks on jobs.
- Otherwise, they should have local Administrator privileges on the Enterprise Auditor
Console server
- - The user whose credentials are specified must also have a role that allows the scheduling of
+ - The user whose credentials are specified must also have a role that allows scheduling
tasks – Administrator, Power User, or Job Initiator
- Apply Locks
@@ -55,19 +55,19 @@ locks on jobs.
:::
- - These credentials are used to apply locks on jobs, enabling the Job Approver to have fewer
- rights on the Jobs directory. Therefore, the credentials specified must at least have the
- following:
+ - Enterprise Auditor uses these credentials to apply locks on jobs, so the Job Approver needs
+ fewer rights on the Jobs directory. Therefore, the credentials specified must at least have
+ the following:
- Modify rights on this directory
- Otherwise, these credentials should have local Administrator privileges on the Enterprise
Auditor Console server
- - The Job Approver uses these credentials to apply locks. Therefore, the Job Approver must be
- added to the local policy **Impersonate a client after Authentication**.
+ - The Job Approver uses these credentials to apply locks. Therefore, add the Job Approver to
+ the local policy **Impersonate a client after Authentication**.
-Do not choose the **Use local System account to schedule tasks** option. This account does not have
-the appropriate rights to apply locks on jobs. Therefore, it does not work in conjunction with Role
+Don't choose the **Use local System account to schedule tasks** option. This account doesn't have
+the appropriate rights to apply locks on jobs. Therefore, it doesn't work with Role
Based Access.
See the
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/securereports.md b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/securereports.md
index 6cded2f9a2..3d11630e8b 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/securereports.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/securereports.md
@@ -6,9 +6,9 @@ sidebar_position: 60
# Securing Published Reports Only
-In order to secure published reports through the Web Console, it is necessary to enable Role Based
-Access within the Enterprise Auditor Console. If that is the only reason the Role Based Access
-feature is being enabled, ensure the following requirements are met:
+To secure published reports through the Web Console, enable Role Based
+Access within the Enterprise Auditor Console. If that's the only reason you're enabling the Role
+Based Access feature, ensure you meet the following requirements:
- Administrator role assigned to all Enterprise Auditor Console users
@@ -25,7 +25,7 @@ feature is being enabled, ensure the following requirements are met:
- Job Level Assignment – Access to reports published by the job
- Report Configuration Level Assignment – Access to the specific report
-Follow the steps to assign roles at the global level.
+To assign roles at the global level:
**Step 1 –** Navigate to the **Settings** > **Access** node.
@@ -44,8 +44,8 @@ ellipsis (**…**) to browse for accounts with the Select User or Group window.
-**Step 5 –** Select a role for the group or user from the Role list. Click **Finish**. The group or
-user and role is added to the Role Membership list in the Roles view.
+**Step 5 –** Select a role for the group or user from the Role list, and click **Finish** to add the
+group or user and role to the Role Membership list in the Roles view.
:::warning
The first role or set of roles saved must include the Administrator role. Clicking Save
@@ -57,19 +57,19 @@ the Enterprise Auditor Console.
**Step 6 –** Repeat Steps 2-4 to assign the Administrator, Web Administrator, and Report Viewer
roles to other groups or users.
-**Step 7 –** Click **Save** and then **OK** to confirm the changes. All applied roles are lost if
-they are not saved.
+**Step 7 –** Click **Save** and then **OK** to confirm the changes. If you don't save the changes,
+you lose all applied roles.
-Role Based Access is enabled when the first role has been assigned.
+Role Based Access becomes enabled when you assign the first role.
-
+
The first role or set of roles saved must include the Administrator role. Clicking **Save** for the
first role or set or roles without including the Administrator generates an error message in the
Enterprise Auditor Console.
When Role Based Access is first enabled, restart the Enterprise Auditor application to ensure all
-roles are properly active. The Report Viewer role can be assigned at the job group, job, and report
+roles are properly active. You can assign the Report Viewer role at the job group, job, and report
configuration levels. See the
[Reporting Node](/docs/accessanalyzer/11.6/admin/jobs/group/settings/reporting.md),
[Report Roles Tab](/docs/accessanalyzer/11.6/admin/jobs/job/properties/reportroles.md),
diff --git a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/workflow.md b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/workflow.md
index 670df1d19e..ac8f8d32cc 100644
--- a/docs/accessanalyzer/11.6/admin/settings/access/rolebased/workflow.md
+++ b/docs/accessanalyzer/11.6/admin/settings/access/rolebased/workflow.md
@@ -16,11 +16,11 @@ rejects it
-- If a job is approved, then a lock needs to be applied by right-clicking the job title in the Jobs
+- If a job is approved, apply a lock by right-clicking the job title in the Jobs
tree and selecting **Lock Job**
- If a job is rejected, then the job remains unlocked
- If the **Lock Job** option is visible, then the job has not yet been approved
-- If the **Lock Job** option is not visible, then the job has been approved
+- If the **Lock Job** option isn't visible, then the job has been approved
@@ -32,9 +32,9 @@ approved by the grayed-out **Unlock Job** option in the right-click menu.
- For the Job Initiator (No Actions) role, the user is unable to execute a job which contains
configured actions, even if it is approved and locked
- - Both roles can enable and disable job groups and jobs regardless of whether or not they are
- locked. Disabled jobs are grayed out with a red x next to it and are not executed with the job
- group. When applied at the job group level, all nested jobs are disabled and do not run.
+ - Both roles can enable and disable job groups and jobs regardless of whether they are
+ locked. Disabled jobs are grayed out with a red x next to it and aren't executed with the job
+ group. When applied at the job group level, all nested jobs are disabled and don't run.
However, any new job added to that group is enabled by default.
:::note
@@ -50,8 +50,8 @@ approved by the grayed-out **Unlock Job** option in the right-click menu.
-**Step 4 –** After a job has been successfully run, the **Job Viewer** can now view the results of
-the job under the job’s Status and Results node, or in the Web Console. See the
+**Step 4 –** After the Job Initiator successfully runs a job, the **Job Viewer** can view the
+results of the job under the job’s Status and Results node, or in the Web Console. See the
[Viewing Generated Reports](/docs/accessanalyzer/11.6/admin/report/view.md)
topic for additional information.
@@ -64,10 +64,10 @@ Console.
## Other Console Roles
-Any modifications needed in the Settings or Host Management nodes must be done by the corresponding
-administrator role (Global Options Administrator, Access Administrator, or Host Management
-Administrator). These roles can be used in conjunction with any other role (for example, a user can
-be a Job Builder and Global Options Administrator in order to build jobs and manage corresponding
+The corresponding administrator role (Global Options Administrator, Access Administrator, or Host
+Management Administrator) must make any modifications needed in the Settings or Host Management
+nodes. You can combine these roles with any other role (for example, a user can
+be a Job Builder and Global Options Administrator to build jobs and manage corresponding
Connection Profiles).
### Web Administrator
diff --git a/docs/accessanalyzer/11.6/admin/settings/application/overview.md b/docs/accessanalyzer/11.6/admin/settings/application/overview.md
index dafde901ff..e90e06d388 100644
--- a/docs/accessanalyzer/11.6/admin/settings/application/overview.md
+++ b/docs/accessanalyzer/11.6/admin/settings/application/overview.md
@@ -19,9 +19,9 @@ Enterprise Auditor application log.
The Application log level controls the types of messages generated for each job and the application.
-It can be modified at the job level in the **Job Properties** window. See the
+You can modify it at the job level in the **Job Properties** window. See the
[General Tab](/docs/accessanalyzer/11.6/admin/jobs/job/properties/general.md)
-topic for additional information. Options available in the Application log level drop-down menu
+topic for additional information. Options available in the Application log level dropdown menu
include:
- Debug – Records everything that happens during job execution, most verbose level of logging
@@ -52,9 +52,9 @@ Set the log level to **Warning**.
:::
-The other log levels are designed to assist with troubleshooting job execution issues. The Debug
-level is only recommended when experiencing problems. After the problem is fixed or the Application
-log has been sent to [Netwrix Support](https://www.netwrix.com/support.html), reduce the logging
+The other log levels help with troubleshooting job execution issues. Use the Debug
+level only when you're experiencing problems. After you fix the problem or send the Application
+log to [Netwrix Support](https://www.netwrix.com/support.html), reduce the logging
level to **Warning** or **Info**.
**Profile Security**
@@ -64,32 +64,32 @@ various credentials stored by the Enterprise Auditor application.
.
-There are two options available in the Profiles stored with drop-down menu:
+There are two options available in the Profiles stored with dropdown menu:
-- Application – Default setting, does not employ the enhanced encryption
+- Application – Default setting, doesn't employ the enhanced encryption
- Vault – Enables the enhanced encryption of stored credentials. See the
[Vault](/docs/accessanalyzer/11.6/admin/settings/application/vault.md)
topic for requirements and additional information.
**Usage Statistics**
-The Usage Statistics section allows you to select whether to send usage statistics data to Netwrix
-to help us improve our product.
+Use the Usage Statistics section to select whether to send usage statistics data to Netwrix
+to help improve the product.
-- If selected, usage statistics are collected and sent to Netwrix
+- If you select this option, Enterprise Auditor collects and sends usage statistics to Netwrix
- - Upon startup of the Enterprise Auditor console, the system checks if usage statistics have
- been sent in the last 7 days. If they have not been, stored procedures run against the
+ - Upon startup of the Enterprise Auditor console, the system checks whether it has sent usage
+ statistics in the last 7 days. If it hasn't, stored procedures run against the
Enterprise Auditor database and gather data about job runs, access times, and environmental
- details like resource counts, users counts, number of exceptions, and so on. This data is then
- sent back to Netwrix to help us identify usage trends and common pain points, so that we can
- use this information to improve the product.
- - Only anonymous statistic-level data is included. No private company or personal data is
- collected or sent to Netwrix.
+ details like resource counts, users counts, number of exceptions, and so on. Enterprise
+ Auditor then sends this data back to Netwrix to help identify usage trends and common problem
+ areas, which Netwrix uses to improve the product.
+ - Enterprise Auditor includes only anonymous statistic-level data and doesn't collect or send
+ private company or personal data to Netwrix.
-- If cleared, no usage statistics are collected or sent to Netwrix
+- If you clear this option, Enterprise Auditor doesn't collect or send usage statistics to Netwrix
**Host Target Options**
@@ -113,7 +113,7 @@ Console.
- Automatically rename duplicate columns within a table – Checks for and renames columns with
duplicate names
- Automatically correct invalid column names – Checks for and corrects column names which contain
- characters SQL cannot handle
+ characters SQL can't handle
:::info
Leave both options selected.
@@ -121,16 +121,16 @@ Console.
- Save filters and grouping on data grids – Maintains filters configured for a data grid for the
- next viewing. If not selected, filtered data grids reset between viewings.
+ next viewing. If you don't select this option, filtered data grids reset between viewings.
- Maximum row count for interactive grid view – Indicates the number of rows displayed in tables
accessible in under a job’s Status and Results nodes
- - Maximum row count is set to 1000 by default and has a cap of 99,999 rows. This number does not
+ - The default maximum row count is 1000, with a cap of 99,999 rows. This number doesn't
impact the number of rows within the SQL database. To view the full row count for a table
exceeding this size, use the SQL Server Management Studio or another SQL Server interface tool
which displays the full table.
-Filtered data grids are not lost if persistent filters are not saved. The Filtration Dialog
+You keep filtered data grids only if you save persistent filters. The Filtration Dialog
available for every data grid maintains a list of recent filters. See the
[Data Grid Functionality](/docs/accessanalyzer/11.6/admin/navigate/datagrid.md)
topic for additional information.
@@ -142,38 +142,39 @@ when the database is configured to use Simple Recovery Model.
-- Compact Database Transaction Log – If selected, every time the Enterprise Auditor application is
- closed, the Database Transaction Log is compacted
+- Compact Database Transaction Log – If you select this option, Enterprise Auditor compacts the
+ Database Transaction Log every time you close the application
:::info
- In most environments, it is recommended to leave this option selected. If a
+ In most environments, leave this option selected. If a
scheduled task ends while multiple tasks are still running, the process of compacting the
database freezes it and causes the running tasks to fail.
:::
-- Run Post Processing SQL Script to Set Host Status – If selected, this option ascribes the values
- of SUCCESS, WARNING, or ERROR to indicate what happened on that host during job execution
+- Run Post Processing SQL Script to Set Host Status – If you select this option, Enterprise Auditor
+ ascribes the values of SUCCESS, WARNING, or ERROR to indicate what happened on that host during
+ job execution
:::info
- It is recommended that this option be left selected.
+ Leave this option selected.
:::
**Application Exit Options**
-The Application Exit Options section controls whether or not a confirmation is displayed when the
-Enterprise Auditor application is closed.
+The Application Exit Options section controls whether Enterprise Auditor displays a confirmation
+when you close the application.
-If selected, the **Show Confirmation Dialog** option causes a Confirm Exit window to open when the
-Enterprise Auditor user attempts to exit the application. If deselected, the Enterprise Auditor
-application closes without confirmation.
+If you select the **Show Confirmation Dialog** option, a Confirm Exit window opens when the
+Enterprise Auditor user attempts to exit the application. If you don't select this option, the
+Enterprise Auditor application closes without confirmation.
-The Confirm Exit window requires the **Yes** button to be clicked before the Enterprise Auditor
+The Confirm Exit window requires you to click **Yes** before the Enterprise Auditor
application closes.
The **Cancel** and **Save** buttons are in the lower-right corner of the Application view. These
diff --git a/docs/accessanalyzer/11.6/admin/settings/application/vault.md b/docs/accessanalyzer/11.6/admin/settings/application/vault.md
index 8be77691a5..cc52c7a0f0 100644
--- a/docs/accessanalyzer/11.6/admin/settings/application/vault.md
+++ b/docs/accessanalyzer/11.6/admin/settings/application/vault.md
@@ -8,25 +8,24 @@ sidebar_position: 10
The Enterprise Auditor vault provides additional security through enhanced encryption to various
credentials stored by the Enterprise Auditor application, such as Connection Profile credentials or
-Schedule Service Account credentials. In order to enable the vault, the following prerequisites must
-be met in the order listed:
+Schedule Service Account credentials. To enable the vault, meet the following prerequisites in the order listed:
- Enterprise Auditor Vault Service must be running
- This service was installed during the Enterprise Auditor installation and is configured for
Manual Startup Type
- - It needs to be configured to Log On (Service > Properties) with a service account which has
+ - Configure it to Log On (Service > Properties) with a service account that has
Log on as Service rights, as well as Read and Execute rights to the VaultService.exe file
located within the Enterprise Auditor installation directory
- Role Base Access must be enabled within Enterprise Auditor
- - The vault was designed to provide enhanced security when employing the Role Based Access, or
- least privilege, option of Enterprise Auditor
- - At least one Administrator role must be assigned to enable the vault:
+ - The vault provides enhanced security when you employ the Role Based Access, or
+ least-privilege, option of Enterprise Auditor
+ - Assign at least one Administrator role to enable the vault:
- - If full Role Based Access is not desired but enabling the vault is, all of the Enterprise
- Auditor users should be given the Administrator role
+ - If you don't want full Role Based Access but do want to enable the vault, give all
+ Enterprise Auditor users the Administrator role
- No additional Role Based Access prerequisites are required for this option
- See the
@@ -34,9 +33,9 @@ be met in the order listed:
topic for additional information on Role Based Access
:::note
- Once the vault has been enabled, it is not possible to disable Role Based Access
- without first disabling the vault. Please contact
- [Netwrix Support](https://www.netwrix.com/support.html) for assistance in disabling Role Based
+ After you enable the vault, you can't disable Role Based Access
+ without first disabling the vault. Contact
+ [Netwrix Support](https://www.netwrix.com/support.html) for help disabling Role Based
Access.
:::
@@ -45,20 +44,20 @@ be met in the order listed:
- If the previous prerequisites have not been met, then one of the following errors will occur
- when attempting to save the Vault Profile Security setting:
+ If you haven't met the previous prerequisites, one of the following errors occurs
+ when you try to save the Vault Profile Security setting:
- - Role Based Access Error – Role Based Access must be configured in order to use the Enterprise
- Auditor Vault. Please configure Role Based Access and try again
- - Enterprise Auditor Vault Service Error – Enterprise Auditor is not running
+ - Role Based Access Error – Configure Role Based Access to use the Enterprise
+ Auditor Vault, and try again
+ - Enterprise Auditor Vault Service Error – Enterprise Auditor isn't running
- The Netwrix Enterprise Auditor Web Server service must be run with an account that has the
Administrator role assigned
- - If the Administrator role is not assigned, the vault service does not allow the web server to
+ - If the Administrator role isn't assigned, the vault service doesn't allow the web server to
access the SQL profile and throws an access denied error in the web server log file
-The credentials which are encrypted once the vault has been enabled are:
+After you enable the vault, Enterprise Auditor encrypts the following credentials:
- Storage Profile credentials
- Connection Profile credentials
@@ -66,12 +65,13 @@ The credentials which are encrypted once the vault has been enabled are:
- Role Definitions
- Role Assignments
-Once encrypted, the files with these stored credentials are moved into a new directory location.
+Enterprise Auditor moves the encrypted files with these stored credentials into a new directory
+location.
-This location is protected by the service account used to run the Enterprise Auditor Vault Service.
+The service account used to run the Enterprise Auditor Vault Service protects this location.
## Disabling the Vault
To disable the vault, navigate to the **Settings** > **Application** node and change the Profile
-Security section setting to **Application**. It is a best practice to also stop the Enterprise
+Security section setting to **Application**. As a best practice, also stop the Enterprise
Auditor Vault Service.
diff --git a/docs/accessanalyzer/11.6/admin/settings/connection/create/activedirectory.md b/docs/accessanalyzer/11.6/admin/settings/connection/create/activedirectory.md
index cc3df597c9..8fd402fa55 100644
--- a/docs/accessanalyzer/11.6/admin/settings/connection/create/activedirectory.md
+++ b/docs/accessanalyzer/11.6/admin/settings/connection/create/activedirectory.md
@@ -11,9 +11,9 @@ following information is required for the credential:
-- Domain – Drop-down menu with available trusted domains will appear. Either type the short domain
+- Domain – dropdown menu with available trusted domains will appear. Either enter the short domain
name in the textbox or select a domain from the menu.
-- User name – Type the user name
+- User name – Enter the user name
- Password Storage – Choose the option for credential password storage:
- Application – Uses the configured Profile Security setting as selected at the **Settings** >
@@ -22,12 +22,12 @@ following information is required for the credential:
topic for additional information.
- CyberArk – Uses the CyberArk Enterprise Password Vault. See the
[CyberArk Integration](/docs/accessanalyzer/11.6/admin/settings/connection/cyberarkintegration.md)
- topic for additional information. The password fields do not apply for CyberArk password
+ topic for additional information. The password fields don't apply for CyberArk password
storage.
- Managed Service Account – Use previously configured MSA and gMSAs for authentication. The
- password fields are not applicable when this option is selected. See the
+ password fields aren't applicable when this option is selected. See the
[Group Managed Service Accounts (gMSA) Configuration](/docs/accessanalyzer/11.6/admin/settings/connection/gmsa.md)
topic for additional information.
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
diff --git a/docs/accessanalyzer/11.6/admin/settings/connection/create/aws.md b/docs/accessanalyzer/11.6/admin/settings/connection/create/aws.md
index c793913491..0d85731f08 100644
--- a/docs/accessanalyzer/11.6/admin/settings/connection/create/aws.md
+++ b/docs/accessanalyzer/11.6/admin/settings/connection/create/aws.md
@@ -13,17 +13,17 @@ type in the User Credentials window.
The required credentials for Amazon Web Services are:
-- Access Key ID — Used to sign programmatic requests made to AWS. If access keys are not available,
+- Access Key ID — Used to sign programmatic requests made to AWS. If access keys aren't available,
create them with the IAM console.
- Password Storage: Application – Uses the configured Profile Security setting as selected at the
**Settings >** **Application** node
-- Secret Key — Used to sign programmatic requests made to AWS. If secret keys are not available,
+- Secret Key — Used to sign programmatic requests made to AWS. If secret keys aren't available,
create them with the IAM console.
- Scan Roles — Role used to scan other organization accounts
## Create a Connection Profile for AWS
-A new connection profile will need to be created to be leveraged in the AWS Solution.
+Create a new connection profile to use in the AWS Solution.
**Step 1 –** Under Settings > Connection, click Add Connection profile.
@@ -33,7 +33,7 @@ A new connection profile will need to be created to be leveraged in the AWS Solu
Access Token section.
:::tip
-Remember, these are obtained from AWS when the permissions are configured. See the
+Remember, you obtain these from AWS when you configure the permissions. See the
[Configure AWS for Scans](/docs/accessanalyzer/11.6/requirements/aws/configurescans.md)
topic for additional information.
:::
@@ -41,4 +41,4 @@ topic for additional information.
**Step 4 –** Click OK in the User Credentials modal, name the Connection Profile, and click Save.
-This connection profile can now be assigned to the AWS Solution.
+You can now assign this connection profile to the AWS Solution.
diff --git a/docs/accessanalyzer/11.6/admin/settings/connection/create/create.md b/docs/accessanalyzer/11.6/admin/settings/connection/create/create.md
index 8808545310..8ca661940c 100644
--- a/docs/accessanalyzer/11.6/admin/settings/connection/create/create.md
+++ b/docs/accessanalyzer/11.6/admin/settings/connection/create/create.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Create a Connection Profile
-Follow the steps to create a Connection Profile.
+To create a Connection Profile:
@@ -18,16 +18,16 @@ Follow the steps to create a Connection Profile.
name in the Connection profile name textbox.
:::note
-A good profile name should be chosen so that it does not need to be changed at a later
-time. If the profile name is changed after being applied to job groups or jobs, it requires the user
-to go back through all of those job groups or jobs and re-apply the Connection Profile.
+Choose a good profile name so that you don't need to change it later. If you change the
+profile name after applying it to job groups or jobs, you must go back through those job groups or
+jobs and reapply the Connection Profile.
:::
-**Step 3 –** Now it is time to add credentials to this profile. Click Add User credential and the
-User Credentials window opens.
+**Step 3 –** Click Add User credential to add credentials to this profile. The User Credentials
+window opens.
@@ -51,8 +51,8 @@ See the individual account type sections for information on the fields. Then cli
:::note
-If the entered passwords are not the same, an error message will pop-up after clicking OK
-on the User Credentials window. Click OK on the error message and re-type the passwords.
+If the entered passwords aren't the same, an error message will pop-up after clicking OK
+on the User Credentials window. Click OK on the error message and re-enter the passwords.
:::
@@ -68,9 +68,8 @@ domain, and then proceed through all other credentials until authentication is s
are no more credentials to try.
:::info
-Limit the User Credentials list to a minimal number per profile, especially when
-considering that a successful authentication does not automatically mean that particular credential
-has the appropriate level of permissions in order for the data collection to occur.
+Limit the User Credentials list to a minimal number per profile. A successful authentication
+doesn't automatically mean that credential has the permissions required for data collection.
:::
@@ -82,52 +81,52 @@ There are Move Up and Move Down buttons for arranging priority within the User C
**Step 6 –** (Optional): At the bottom of the Connection view, is the Use the Windows account that
Enterprise Auditor runs with before trying the user credentials above option. This option is per
-Connection Profile. If checked, Enterprise Auditor applies the local login credentials prior to any
+Connection Profile. If checked, Enterprise Auditor applies the local login credentials before any
of the credentials saved to the Connection Profile.
:::note
-If a data collector utilizes an applet, this option must be unchecked.
+If a data collector uses an applet, uncheck this option.
:::
-**Step 7 –** When the user credentials have been added and ordered, click Save and then OK to
-confirm the changes to the Connection Profile.
+**Step 7 –** After you add and order the user credentials, click Save and then OK to confirm the
+changes to the Connection Profile.
The new Connection Profile is now visible in the Profile list and available for use at the job group
or job level.
## Edit User Credentials within a Connection Profile
-Follow the steps to edit user credentials within a Connection Profile.
+To edit user credentials within a Connection Profile:
-**Step 1 –** Select the Connection Profile to be modified from the Profile list. Remember, changing
-the Connection Profile name results in breaking job groups or jobs that are assigned this profile.
+**Step 1 –** Select the Connection Profile you want to modify from the Profile list. Remember,
+changing the Connection Profile name breaks job groups or jobs that are assigned this profile.
-**Step 2 –** Select the user credential to be edited from the User Credentials list. Click Edit.
+**Step 2 –** Select the user credential you want to edit from the User Credentials list. Click Edit.
**Step 3 –** Modify the information in the User Credentials window. For the password, choose between
the Use the existing password option or the Specify a new password below option. Click OK.
-**Step 4 –** When the Connection Profile’s user credentials have been edited as desired, click Save
-and then OK to confirm the changes to the Connection Profile.
+**Step 4 –** After you edit the Connection Profile's user credentials as desired, click Save and then
+OK to confirm the changes to the Connection Profile.
-The edited user credentials are now used for authentication to target hosts for this Connection
-Profile.
+Enterprise Auditor now uses the edited user credentials for authentication to target hosts for this
+Connection Profile.
## Delete a User Credential from a Connection Profile
-Follow the steps to delete a user credential from a Connection Profile.
+To delete a user credential from a Connection Profile:
-**Step 1 –** Select the Connection Profile to be modified from the Profile list. Remember, changing
-the Connection Profile name results in breaking job groups or jobs that are assigned this profile.
+**Step 1 –** Select the Connection Profile you want to modify from the Profile list. Remember,
+changing the Connection Profile name breaks job groups or jobs that are assigned this profile.
-**Step 2 –** Select the user credential to be edited from the User Credentials list. Click Delete.
+**Step 2 –** Select the user credential you want to edit from the User Credentials list. Click Delete.
@@ -145,19 +144,19 @@ The default profile is marked with the green checkmark.
-Follow the steps to set a new default Connection Profile.
+To set a new default Connection Profile:
-**Step 1 –** Select the desired profile in the Connection Profile list and click Set as default.
+**Step 1 –** Select the profile you want in the Connection Profile list and click Set as default.
**Step 2 –** The green checkmark moves. Click Save and then OK to confirm the changes.
-This Connection Profile is now used as the default Connection Profile.
+This Connection Profile now serves as the default Connection Profile.
## Delete a Connection Profile
-Follow the steps to delete a Connection Profile.
+To delete a Connection Profile:
diff --git a/docs/accessanalyzer/11.6/admin/settings/connection/create/exchangemodernauth.md b/docs/accessanalyzer/11.6/admin/settings/connection/create/exchangemodernauth.md
index 7e19692f56..6ec94a5220 100644
--- a/docs/accessanalyzer/11.6/admin/settings/connection/create/exchangemodernauth.md
+++ b/docs/accessanalyzer/11.6/admin/settings/connection/create/exchangemodernauth.md
@@ -17,11 +17,11 @@ The values for the required credentials for the Exchange Modern Authentication a
**Settings** > **Application** node. See the
[Application](/docs/accessanalyzer/11.6/admin/settings/application/overview.md)
topic for additional information.)
-- Organization – The primary domain name of the Microsoft Entra tenant being leveraged to make the
+- Organization – The primary domain name of the Microsoft Entra tenant used to make the
connection. See the
[Identify the Tenant's Name](/docs/accessanalyzer/11.6/requirements/exchange/exchangeonline/access.md#identify-the-tenants-name)
topic for additional information.
-- Email Address – The email address for the mailbox to be leveraged in Exchange Online environment
+- Email Address – The email address for the mailbox used in Exchange Online environment
scans. The mailbox must belong to the primary domain used in the Organization field.
- AppID – Application (client) ID of the Enterprise Auditor application registered with Microsoft
Entra ID. See the
diff --git a/docs/accessanalyzer/11.6/admin/settings/connection/create/localwindows.md b/docs/accessanalyzer/11.6/admin/settings/connection/create/localwindows.md
index 1f1a290ec6..0726355664 100644
--- a/docs/accessanalyzer/11.6/admin/settings/connection/create/localwindows.md
+++ b/docs/accessanalyzer/11.6/admin/settings/connection/create/localwindows.md
@@ -13,7 +13,7 @@ User Credentials window.
The required credentials for the Local Windows Account are:
-- User name – Type the user name
+- User name – Enter the user name
- Password Storage – Choose the option for credential password storage:
- Application – Uses the configured Profile Security setting as selected at the **Settings** >
@@ -22,15 +22,15 @@ The required credentials for the Local Windows Account are:
topic for additional information.
- CyberArk – Uses the CyberArk Enterprise Password Vault. See the
[CyberArk Integration](/docs/accessanalyzer/11.6/admin/settings/connection/cyberarkintegration.md)
- topic for additional information. The password fields do not apply for CyberArk password
+ topic for additional information. The password fields don't apply for CyberArk password
storage.
:::note
If using the CyberArk option, then the associated Connection Profile can only have
- one user credential in it. Multiple user credentials are not supported with the CyberArk
+ one user credential in it. Multiple user credentials aren't supported with the CyberArk
integration when using local Windows accounts.
:::
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
diff --git a/docs/accessanalyzer/11.6/admin/settings/connection/create/oracle.md b/docs/accessanalyzer/11.6/admin/settings/connection/create/oracle.md
index 8e4a253602..593fa1f861 100644
--- a/docs/accessanalyzer/11.6/admin/settings/connection/create/oracle.md
+++ b/docs/accessanalyzer/11.6/admin/settings/connection/create/oracle.md
@@ -14,24 +14,24 @@ window.
The required credentials for Oracle are:
- Domain – Field options are dependent upon the additional account type option selected:
- - Oracle Account – Domain is not a field for this type of credential
- - Windows account that Enterprise Auditor is run with – (Domain is not a field for this type of
+ - Oracle Account – Domain isn't a field for this type of credential
+ - Windows account that Enterprise Auditor is run with – (Domain isn't a field for this type of
credential)
- - Active Directory – Drop-down menu with available trusted domains displays. Either type the
+ - Active Directory – dropdown menu with available trusted domains displays. Either enter the
short domain name in the textbox or select a domain from the menu.
-- User name – Type the user name
- - This is not a field for the additional account type of Windows account that Enterprise Auditor
+- User name – Enter the user name
+ - This isn't a field for the additional account type of Windows account that Enterprise Auditor
is run with is selected
- Password Storage: Application – Uses the configured Profile Security setting as selected at the
**Settings >** **Application** node
-- Password – Type the password
- - This is not a field for the additional account type of Windows account that Enterprise Auditor
+- Password – Enter the password
+ - This isn't a field for the additional account type of Windows account that Enterprise Auditor
is run with
-- Confirm – Re-type the password
- - This is not a field for the additional account type of Windows account that Enterprise Auditor
+- Confirm – Re-enter the password
+ - This isn't a field for the additional account type of Windows account that Enterprise Auditor
is run with
-- Role – Specify an Oracle role, if desired. The drop-down menu provides a list of roles. Either
- type the role name in the textbox or select a role from the menu.
+- Role – Specify an Oracle role, if desired. The dropdown menu provides a list of roles. Either
+ enter the role name in the textbox or select a role from the menu.
- **NOTE:** When using a least privileged model for Oracle, **SYSDBA** must be selected for the
Role.
- Additional Account type – Select radio button of the secondary account type from the list at the
diff --git a/docs/accessanalyzer/11.6/admin/settings/connection/create/sql.md b/docs/accessanalyzer/11.6/admin/settings/connection/create/sql.md
index eea52d5037..fe3524bfc2 100644
--- a/docs/accessanalyzer/11.6/admin/settings/connection/create/sql.md
+++ b/docs/accessanalyzer/11.6/admin/settings/connection/create/sql.md
@@ -24,5 +24,5 @@ The required credentials for SQL Authentication are:
**Settings** > **Application** node. See the
[Application](/docs/accessanalyzer/11.6/admin/settings/application/overview.md)
topic for additional information.)
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
diff --git a/docs/accessanalyzer/11.6/admin/settings/connection/create/task.md b/docs/accessanalyzer/11.6/admin/settings/connection/create/task.md
index 6b8207e42c..db432018d2 100644
--- a/docs/accessanalyzer/11.6/admin/settings/connection/create/task.md
+++ b/docs/accessanalyzer/11.6/admin/settings/connection/create/task.md
@@ -17,10 +17,10 @@ The required credentials for Task (Local) and Task (Domain) are:
- Domain
- Local – Not a field for this type of credential, defaults to ``
- - Domain – Drop-down menu with available trusted domains displays. Either type the short domain
+ - Domain – dropdown menu with available trusted domains displays. Either enter the short domain
name in the textbox or select a domain from the menu.
-- User name – Type the user name
+- User name – Enter the user name
- Password Storage: Application – Uses the configured Profile Security setting as selected at the
**Settings > Application** node
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
diff --git a/docs/accessanalyzer/11.6/admin/settings/connection/create/unix.md b/docs/accessanalyzer/11.6/admin/settings/connection/create/unix.md
index fe6faf5cca..ff1bf085d0 100644
--- a/docs/accessanalyzer/11.6/admin/settings/connection/create/unix.md
+++ b/docs/accessanalyzer/11.6/admin/settings/connection/create/unix.md
@@ -21,12 +21,12 @@ The required credentials for the Unix Account are:
- Password/Confirm
- If not using a private key, enter the **Password** and re-type in the **Confirm** field
- - If using a private key, then the password is not needed. Provide the private key information
+ - If using a private key, then the password isn't needed. Provide the private key information
in the **Use the following private key when connecting** field.
- Use the following port/ports (CSV) for SSH
- - The SSH port needs to be opened in software and hardware firewalls
+ - You must open the SSH port in software and hardware firewalls
- If desired, select this option and provide the port value
- Use the following private key when connecting
diff --git a/docs/accessanalyzer/11.6/admin/settings/connection/cyberarkintegration.md b/docs/accessanalyzer/11.6/admin/settings/connection/cyberarkintegration.md
index 2efe12ae2c..4d716aeb64 100644
--- a/docs/accessanalyzer/11.6/admin/settings/connection/cyberarkintegration.md
+++ b/docs/accessanalyzer/11.6/admin/settings/connection/cyberarkintegration.md
@@ -6,20 +6,20 @@ sidebar_position: 20
# CyberArk Integration
-In order for Enterprise Auditor to be able to retrieve service account passwords from the CyberArk
-Password Vault, the following prerequisites must be completed:
+For Enterprise Auditor to retrieve service account passwords from the CyberArk Password Vault,
+complete the following prerequisites:
-- The Secrets Manager must be installed on the Enterprise Auditor Console server. The organization’s
+- Install the Secrets Manager on the Enterprise Auditor Console server. The organization’s
Vault administrator can provide the Secrets Manager installation package and most likely needs to
- be present during the installation to provide credentials in order for the Secrets Manager
+ be present during the installation to provide credentials for the Secrets Manager
installation to complete. See the CyberArk
[Credential Provider (CP)](https://docs.cyberark.com/credential-providers/Latest/en/Content/CP%20and%20ASCP/Installing-CP.htm) article
for additional information.
-- An application must be added to CyberArk for the integration with Enterprise Auditor. The
- Application Id of this application must then be added to the `GlobalOptions.xml` file for
+- Add an application to CyberArk for the integration with Enterprise Auditor. Then add the
+ Application Id of this application to the `GlobalOptions.xml` file for
Enterprise Auditor. See the
[Customize CyberArk Application Id](#customize-cyberark-application-id) topic for additional
- information. The application can be locked down by providing an OS User, a Path, or a Hash. See
+ information. You can lock down the application by providing an OS User, a Path, or a Hash. See
the CyberArk
[Add applications](https://docs.cyberark.com/credential-providers/14.0/en/Content/Common/Adding-Applications.htm) article
for additional information.
@@ -29,9 +29,9 @@ Password Vault, the following prerequisites must be completed:
Account within Enterprise Auditor. More than one OS User can be added.
- The Path should be a local path to the `StealthAUDIT.exe` file. The path should end with the
file name: `…\StealthAUDIT.exe`.
- - The Hash should be generated using the **AimGetAppInfo** tool in the
+ - Generate the Hash using the **AimGetAppInfo** tool in the
`…\CyberArk\ApplicationPasswordProvider\Utils` folder on the server where Secrets Manager is
- installed. AimGetAppInfo should be run in an Administrator Command Prompt. Run the following
+ installed. Run AimGetAppInfo in an Administrator Command Prompt using the following
command:
```
@@ -39,7 +39,7 @@ Password Vault, the following prerequisites must be completed:
```
:::info
- Pipe the output hash value to a file to easily copy and paste it to the
+ Pipe the output hash value to a file to copy and paste it to the
CyberArk application.
:::
@@ -55,32 +55,32 @@ Password Vault, the following prerequisites must be completed:
- - The machine name for the Enterprise Auditor console needs to be added on the Allowed Machines
+ - Add the machine name for the Enterprise Auditor console to the Allowed Machines
list for the CyberArk application
-- Once the Secrets Manager installation has completed and the Enterprise Auditor application has
- been created, the necessary CyberArk accounts must be given access to the Safes in which the
- Enterprise Auditor service accounts are stored. This includes the account which was created
- automatically during the Secrets Manager installation, as well as the account created
- automatically as a result of the application creation.
+- After the Secrets Manager installation completes and you create the Enterprise Auditor
+ application, give the necessary CyberArk accounts access to the Safes that store the
+ Enterprise Auditor service accounts. This includes the account automatically created
+ during the Secrets Manager installation, as well as the account automatically created
+ when you create the application.
- The account created during the AIM installation is under the naming convention
`Prov_[COMPUTERNAME]`, where `COMPUTERNAME` is the name of the computer on which AIM is
- installed. This account should be given **Retrieve accounts**, **List accounts**, and **View
- Safe Members** rights on the desired Safes.
+ installed. Give this account **Retrieve accounts**, **List accounts**, and **View
+ Safe Members** rights on the Safes you want.
- The account created during the application creation has the same name as the application
- itself and should be given **Retrieve accounts** rights on the desired Safes
+ itself; give it **Retrieve accounts** rights on the Safes you want
## Customize CyberArk Application Id
-The Application id value of the application created within CyberArk for the integration with
-Enterprise Auditor must be configured within Enterprise Auditor. This is done in the
+Configure Enterprise Auditor with the Application id value of the application you created within
+CyberArk for the integration. You do this in the
`GlobalOptions.xml` file within the Enterprise Auditor installation directory. The default location
is `…\STEALTHbits\StealthAUDIT\`.
-Follow the steps to customize the CyberArk Application Id within Enterprise Auditor.
+To customize the CyberArk Application Id within Enterprise Auditor:
**Step 1 –** Navigate to the `GlobalOptions.xml` file. Open it with a text editor, for example
Notepad.
@@ -107,7 +107,7 @@ required, customize the Command Timeout and Connection Port properties.
- AppId – The name of the CyberArk application
- CommandTimeout – Set to the suggested default of 30
- ConnectionPort – This is a configurable option found during the installation of the CyberArk
- Credential Provider. After installation, it can be found in the configuration file located in the
+ Credential Provider. After installation, it is in the configuration file located in the
installation folder.
See the CyberArk
@@ -126,8 +126,8 @@ window when configuring an **Active Directory Account** or **Local Windows Accou
The credential information supplied in the User Credentials window must be an exact match to what is
in CyberArk as the privileged account for which it is linked. It is case-sensitive.
-If the Connection Profile with a Local Windows Account credential using CyberArk password storage is
-used to target multiple hosts, then the local credential on each host needs to have the exact same
+If you use a Connection Profile with a Local Windows Account credential using CyberArk password
+storage to target multiple hosts, the local credential on each host needs to have the exact same
username and password combination.
@@ -142,8 +142,8 @@ properties in CyberArk. These values are case-sensitive, and must be an exact ma
-The table below shows the values from your CyberArk configuration that the User Credentials window
-should be populated with:
+The following table shows the values from your CyberArk configuration to populate in the User
+Credentials window:
| Enterprise Auditor | CyberArk Property | CyberArk Description | Example Value |
| ------------------ | ----------------- | -------------------------------------- | ----------------- |
@@ -160,8 +160,8 @@ Auditor Domain value is `` and the CyberArk Address property value is the
-The table below shows the values from your CyberArk configuration that the User Credentials window
-should be populated with:
+The following table shows the values from your CyberArk configuration to populate in the User
+Credentials window:
| Enterprise Auditor | CyberArk Property | CyberArk Description | Example Value |
| ------------------ | ----------------- | -------------------------------------- | ------------- |
@@ -172,7 +172,8 @@ should be populated with:
:::info
Only use one Local Windows Account credential with CyberArk password storage in a
Connection Profile. As part of the Enterprise Auditor to CyberArk integration, the Enterprise
-Auditor job is stopped immediately if the query from Enterprise Auditor to CyberArk for the
-credential fails. Therefore, a second credential within the Connection Profile would not be queried.
+Auditor stops the job immediately if the query from Enterprise Auditor to CyberArk for the
+credential fails. Therefore, Enterprise Auditor wouldn't query a second credential within the
+Connection Profile.
:::
diff --git a/docs/accessanalyzer/11.6/admin/settings/connection/gmsa.md b/docs/accessanalyzer/11.6/admin/settings/connection/gmsa.md
index f0f3fec9ad..8bcc67004c 100644
--- a/docs/accessanalyzer/11.6/admin/settings/connection/gmsa.md
+++ b/docs/accessanalyzer/11.6/admin/settings/connection/gmsa.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Group Managed Service Accounts (gMSA) Configuration
Enterprise Auditor can use a previously-configured Group Managed Service Accounts (gMSA/MSA)
-account. Make sure that Managed Service Account is selected in the User Credentials window. See the
+account. ensure that Managed Service Account is selected in the User Credentials window. See the
[Create a Connection Profile](/docs/accessanalyzer/11.6/admin/settings/connection/create/create.md)
or
[Create a Schedule Service Account](/docs/accessanalyzer/11.6/admin/settings/schedule.md#create-a-schedule-service-account)
@@ -18,7 +18,7 @@ To run a job or scheduled task with a gMSA/MSA account, the following prerequisi
- The account that Enterprise Auditor is run with must have permissions to retrieve the gMSA account
password
- The gMSA account must be a Local Admin in the target hosts
-- The gMSA account does not have to be a local admin in the Enterprise Auditor Console
+- The gMSA account doesn't have to be a local admin in the Enterprise Auditor Console
- The Data Collector used must support unicode characters in the Connection Profile's credential
password to retrieve the gMSA account password
diff --git a/docs/accessanalyzer/11.6/admin/settings/connection/overview.md b/docs/accessanalyzer/11.6/admin/settings/connection/overview.md
index b558c3781f..ef2f6e3899 100644
--- a/docs/accessanalyzer/11.6/admin/settings/connection/overview.md
+++ b/docs/accessanalyzer/11.6/admin/settings/connection/overview.md
@@ -32,7 +32,7 @@ inventory or job execution with the Windows account used to launch Enterprise Au
## Use a Connection Profile
-This method allows you to define a Connection Profile which houses one or several sets of
+Use this method to define a Connection Profile that houses one or several sets of
credentials to be used for authentication on the target hosts during host inventory or job
execution. The credentials specified in a Connection Profile could be any of the following:
@@ -51,8 +51,8 @@ collector being used.
### Password Storage Options
-The password for the credential provided can be stored in Enterprise Auditor application or
-Enterprise Auditor Vault. Certain types of credentials can be stored in CyberArk®.
+You can store the password for the credential provided in the Enterprise Auditor application or
+Enterprise Auditor Vault. You can store certain types of credentials in CyberArk®.
Choosing to store passwords in either the Enterprise Auditor application or the Enterprise Auditor
Vault is a global setting configured in the **Settings** > **Application** node. See the
@@ -74,9 +74,9 @@ topic for additional information.
The **Cancel** and **Save** buttons are in the lower-right corner of the Connection view. These
-buttons become enabled when modifications are made to the Connection global setting.
+buttons become enabled when you make modifications to the Connection global setting.
-Whenever changes are made at the global level, click **Save** and then **OK** to confirm the
-changes. Otherwise, click **Cancel** if no changes were intended.
+Whenever you make changes at the global level, click **Save** and then **OK** to confirm the
+changes. Otherwise, click **Cancel** if you don't want to save the changes.
diff --git a/docs/accessanalyzer/11.6/admin/settings/exchange.md b/docs/accessanalyzer/11.6/admin/settings/exchange.md
index 9a511f3c7a..f2163aca44 100644
--- a/docs/accessanalyzer/11.6/admin/settings/exchange.md
+++ b/docs/accessanalyzer/11.6/admin/settings/exchange.md
@@ -11,18 +11,17 @@ These settings are exclusive to the Enterprise Auditor for Exchange Solution.
-The Exchange node is grayed-out by default. In order for these settings to be enabled, it is
-necessary to install both Enterprise Auditor MAPI CDO and Microsoft Exchange MAPI CDO on the
-Enterprise Auditor Console server. See the
+The Exchange node is grayed out by default. To enable these settings, install both Enterprise
+Auditor MAPI CDO and Microsoft Exchange MAPI CDO on the Enterprise Auditor Console server. See the
[StealthAUDIT MAPI CDO Installation](/docs/accessanalyzer/11.6/install/stealthauditmapicdoinstallation/stealthaudit_mapi_cdo_installation.md)
topic for additional information.
-Once the requirements have been met, the Exchange node is enabled for configuration. These settings
-are utilized to make MAPI connections to the Exchange Server for the Mailbox, PublicFolder,
-Exchange2K, and ExchangePS Data Collectors. The Client Access Server field, or CAS, is also utilized
-by the ExchangePS Data Collector in order to make Remote PowerShell connections for Exchange 2010 or
+After you meet the requirements, the Exchange node is enabled for configuration. These settings
+are used to make MAPI connections to the Exchange Server for the Mailbox, PublicFolder,
+Exchange2K, and ExchangePS Data Collectors. The Client Access Server field, or CAS, is also used
+by the ExchangePS Data Collector to make Remote PowerShell connections for Exchange 2010 or
newer. The data collectors apply these settings unless modified inside the job query.
@@ -45,34 +44,34 @@ on which version of Exchange is audited.
specified for MAPI connections.
- Enter the Alias name in the textbox. The Alias needs to be an Exchange 2010 or newer
- mailbox, not a mail-enabled service account. However, this mailbox does not need
+ mailbox, not a mail-enabled service account. However, this mailbox doesn't need
rights on the Exchange Organization; it only needs to reside within it.
- Enter the name of the physical CAS in the Client Access Server textbox. This server can be
- part of an array, but do not enter the name of a CAS Array. This should also be the
- Exchange CAS where both Remote PowerShell and Windows Authentication on the PowerShell
- Virtual Directory have been enabled.
+ part of an array, but don't enter the name of a CAS Array. This should also be the
+ Exchange CAS where you have enabled both Remote PowerShell and Windows Authentication on
+ the PowerShell Virtual Directory.
:::info
-Once the Exchange Connection Settings have been properly configured for the
-version of Exchange to be audited, it is strongly recommended that the settings be tested.
+After you properly configure the Exchange Connection Settings for the
+version of Exchange you want to audit, test the settings.
:::
In the Test Exchange Connection Settings section:
-- Enter a Mailbox Server with mailboxes to be audited in the Exchange Server textbox.
+- Enter a Mailbox Server with the mailboxes you want to audit in the Exchange Server textbox.
- Click the Test Exchange settings link.
If the Exchange Connection Settings are correct, an output field opens. At the bottom of the output
-field, a mailbox count is stated and a message appears which says, “You have successfully connected
-to this Exchange Server.” Click OK.
+field, the output states a mailbox count and shows a message that reads, “You have successfully
+connected to this Exchange Server.” Click OK.
The Cancel and Save buttons are in the lower-right corner of the Exchange view. These buttons become
-enabled when modifications are made to the Exchange global setting. Whenever changes are made at the
-global level, click Save and then OK to confirm the changes. Otherwise, click Cancel if no changes
-were intended.
+enabled when you make modifications to the Exchange global setting. Whenever you make changes at the
+global level, click Save and then OK to confirm the changes. Otherwise, click Cancel if you don't
+want to save the changes.
diff --git a/docs/accessanalyzer/11.6/admin/settings/history.md b/docs/accessanalyzer/11.6/admin/settings/history.md
index 21cf3e8d05..f121ed1ef7 100644
--- a/docs/accessanalyzer/11.6/admin/settings/history.md
+++ b/docs/accessanalyzer/11.6/admin/settings/history.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# History
-The History node is where the history retention of job data and job logs are configured. The setting
+The History node is where you configure the history retention of job data and job logs. The setting
specified here at the global level applies to all jobs in the Jobs tree unless specifically changed
at the job group or job level. See the
[History Node](/docs/accessanalyzer/11.6/admin/jobs/group/settings/history.md)
@@ -28,15 +28,15 @@ for more control over the quantity of data by applying history retention at the
level. All jobs run with this default setting only keep the most current record set.
:::warning
-It is important to understand that some pre-configured jobs require history retention
-while others do not support it. Changing the history retention settings at the global level can
+Some pre-configured jobs require history retention
+while others don't support it. Changing the history retention settings at the global level can
cause issues with data analysis and reporting on jobs that don't support it. See the relevant job
group and job descriptions for additional information.
:::
-The Diagnostics Retention Period settings determine how long this data is retained for all jobs that
-do not have an explicit setting. Setting the retention period for a specific job overrides the
+The Diagnostics Retention Period settings determine how long Enterprise Auditor retains this data
+for all jobs that don't have an explicit setting. Setting the retention period for a specific job overrides the
default setting. There are two settings:
- Logs and Messages
@@ -61,19 +61,19 @@ default setting. There are two settings:
[Status Node](/docs/accessanalyzer/11.6/admin/jobs/job/status.md)
topic for additional information.
-For both the **Logs and Messages** and **Job Statistics** options above:
+For both the **Logs and Messages** and **Job Statistics** options:
-- Enter a number in the first textbox and select the desired time period from the drop-down menu in
+- Enter a number in the first textbox and select the time period you want from the dropdown menu in
the second box. Retention can be set to a specific number of **Days**, **Weeks**, **Months**, or
**Times** for both.
- All jobs run with this setting add the newly collected data set or job logs on top of the
- previously collected record sets or logs. Any record sets or logs outside the specified historical
- retention limit are dropped.
+ previously collected record sets or logs. Enterprise Auditor drops any record sets or logs outside
+ the specified historical retention limit.
The **Cancel** and **Save** buttons are in the lower-right corner of the History view. These buttons
-become enabled when modifications are made to the History global settings. Whenever changes are made
+become enabled when you make modifications to the History global settings. Whenever you make changes
at the global level, click **Save** and then **OK** to confirm the changes. Otherwise, click
-**Cancel** if no changes were intended.
+**Cancel** if you don't want to save the changes.
## Job Data History Retention & Database Size Concerns
@@ -85,19 +85,19 @@ following scenario explains a common concern.
- To reduce data retention periods, navigate to the **Settings** > **History** node. Change the
time period to a smaller interval, for example 90 days. Click **Save** and rerun the jobs.
- - All of the record sets outside the new retention limit are dropped, and the database size is
- back down where it belongs
+ - Enterprise Auditor drops all record sets outside the new retention limit, reducing the
+ database to a more manageable size
## Job Logs
-The job logs are stored within the output folder of each job. They can be read in the Enterprise
-Auditor Console within the job’s **Status** > **Messages** table. To access the logs within the
-job’s directory, right-click on the job’s node in the Navigation pane and select **Explore Folder**.
+Enterprise Auditor stores the job logs within the output folder of each job. You can read them in
+the Enterprise Auditor Console within the job’s **Status** > **Messages** table. To access the logs within the
+job’s directory, right-click the job’s node in the Navigation pane and select **Explore Folder**.
-The most recent log is open. Older jobs are stored as zip files, according to the Log Retention
-Period setting. Each log is named in the following format:
+The most recent log is open. Enterprise Auditor stores older jobs as zip files, according to the Log
+Retention Period setting. Each log is named in the following format:
- Open/Latest Log Name – `[Jobname]_Log.tsv`
- Older/Zipped Log Name – `[Jobname]_Log_[Date]_[Time].zip`
diff --git a/docs/accessanalyzer/11.6/admin/settings/hostdiscovery.md b/docs/accessanalyzer/11.6/admin/settings/hostdiscovery.md
index 70bcdf9f15..1cc7b1e459 100644
--- a/docs/accessanalyzer/11.6/admin/settings/hostdiscovery.md
+++ b/docs/accessanalyzer/11.6/admin/settings/hostdiscovery.md
@@ -33,8 +33,8 @@ The log levels are:
logging
- Records all Info level information
- - If files are referenced or updated during the process of running the query then the path to
- the affected file is shown
+ - If the query references or updates files while running, the log shows the path to the
+ affected file
- Helps [Netwrix Support](https://www.netwrix.com/support.html) to assist in diagnosing issues
which may be causing host inventories to fail
- Creates the largest file
@@ -56,16 +56,16 @@ The log levels are:
- Error – Records all errors which occur during the host discovery process
:::info
- Set the Log Level to Error. The default setting is Info, but it is
- recommended that the setting for daily use be set to Error. The other log levels are designed to
+ Set the Log Level to Error. The default setting is Info, but Netwrix recommends setting it
+ to Error for daily use. The other log levels are designed to
assist with troubleshooting host discovery and host inventory issues.
:::
The **Cancel** and **Save** buttons are in the lower-right corner of the Host Discovery view. These
-buttons become enabled when modifications are made to the Host Discovery global settings. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you make modifications to the Host Discovery global settings. Whenever
+you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you don't want to save the changes.
diff --git a/docs/accessanalyzer/11.6/admin/settings/hostinventory.md b/docs/accessanalyzer/11.6/admin/settings/hostinventory.md
index 213e427baf..91b5284c99 100644
--- a/docs/accessanalyzer/11.6/admin/settings/hostinventory.md
+++ b/docs/accessanalyzer/11.6/admin/settings/hostinventory.md
@@ -21,7 +21,7 @@ In the Inventory Items section, there are four program property groups:
Each of these groups brings back the properties enumerated in the list below the group title. These
collected properties correspond to the columns in the Host Management tables. Deselecting a checkbox
-prevents that information from being collected for target hosts. However, some solutions require
+stops Enterprise Auditor from collecting that information for target hosts. However, some solutions require
this information.
:::info
@@ -37,9 +37,8 @@ host inventory process:
- Threads – Indicates the number of job threads that are employed during the host inventory process
- The default setting is 20 Threads
- - Maximum thread count is 100. Thread count will revert back to 100 if values over 100 are
- entered.
- - Restart Enterprise Auditor if thread count is changed for changes to take place
+ - Maximum thread count is 100. Thread count reverts to 100 if you enter values over 100.
+ - Restart Enterprise Auditor if you change the thread count, for the changes to take place
- Thread timeout [in seconds] – Indicates the time a thread will spend in retrieving information
from a host
@@ -48,13 +47,13 @@ host inventory process:
- If thread can't receive an active response from target host, the thread will move on to the
next host in the queue
-- Stop on Failed Ping – If the Stop on Failed Ping checkbox is selected, hosts that don't respond
- to pings aren't queried. Otherwise, hosts will be queried regardless.
+- Stop on Failed Ping – If you select the Stop on Failed Ping checkbox, Enterprise Auditor doesn't
+ query hosts that don't respond to pings. Otherwise, Enterprise Auditor queries hosts regardless.
- PING timeout [in seconds] – Indicates the time a thread will spend pinging a host
- Default setting is 4 seconds
- - If thread can't connect with a host, the host will be designated as being offline and the
- thread will move on to the next host in the queue
+ - If the thread can't connect with a host, Enterprise Auditor designates the host as offline
+ and the thread moves on to the next host in the queue
- Only refresh inventory items older than [time selected] – Indicates the time that needs to pass
before the host inventory process is automatically refreshed
@@ -74,24 +73,24 @@ host inventory process:
The Desired Host List Views section at the bottom contains all available host lists, both
built-in lists and custom-created lists. There are seven Default Hosts Lists which correspond
-to the solutions that target them. During the host inventory process, hosts which meet the filter
-criteria for these default lists are automatically populated into that host list. A checkmark in
+to the solutions that target them. During the host inventory process, Enterprise Auditor automatically populates hosts that meet the
+filter criteria for these default lists into that host list. A checkmark in
front of the host list indicates that the list is visible in the **Host Management** > **All Hosts**
node.
The **Cancel** and **Save** buttons are in the lower-right corner of the Host Inventory view. These
-buttons become enabled when modifications are made to the Host Inventory global settings. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you make modifications to the Host Inventory global settings. Whenever
+you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you don't want to save the changes.
## Default Host Lists
-The seven default lists are auto-populated during the host inventory process based on specific
-filter criteria. These lists correspond to the pre-configured solution jobs which target them.
+Enterprise Auditor auto-populates the seven default lists during the host inventory process based
+on specific filter criteria. These lists correspond to the pre-configured solution jobs which target them.
### AD Host List
-The **AD** Host List can be expanded and contains five sub-groups used by the Active Directory
+You can expand the **AD** Host List. It contains five sub-groups used by the Active Directory
Solution and the Active Directory Inventory Solution:
@@ -106,7 +105,7 @@ The sub-groups are:
### ALL WINDOWS HOSTS Host List
-The **ALL WINDOWS HOSTS** Host List is used primarily by the Windows Solution.
+The Windows Solution primarily uses the **ALL WINDOWS HOSTS** Host List.
@@ -114,7 +113,7 @@ There are no sub-groups for ALL WINDOWS HOSTS.
### DG Host List
-The **DG** Host List can be expanded and contains three sub-groups used by the Data Access
+You can expand the **DG** Host List. It contains three sub-groups used by the Data Access
Governance for File System Solution.
@@ -127,8 +126,8 @@ The sub-groups are:
### EXCHANGE Host List
-The **EXCHANGE** Host List can be expanded and contains six sub-groups used by the Exchange
-Solution. Four of these sub-groups can also be expand.
+You can expand the **EXCHANGE** Host List. It contains six sub-groups used by the Exchange
+Solution, and you can also expand four of these sub-groups.
@@ -146,7 +145,7 @@ The sub-groups are:
### SQL Servers Host List
-The **SQL SERVERS** Host List is used primarily by the SQL Solution.
+The SQL Solution primarily uses the **SQL SERVERS** Host List.
@@ -154,7 +153,7 @@ There are no sub-groups for SQL SERVERS.
### Windows Server Host List
-The **Windows Server** Host List can be expanded and contains three sub-groups used by the
+You can expand the **Windows Server** Host List. It contains three sub-groups used by the
Windows Solution.
@@ -167,7 +166,7 @@ The sub-groups are:
### Work Station Host List
-The **Work Station** Host List can be expanded and contains one sub-group used by the Windows
+You can expand the **Work Station** Host List. It contains one sub-group used by the Windows
Solution.
diff --git a/docs/accessanalyzer/11.6/admin/settings/notification.md b/docs/accessanalyzer/11.6/admin/settings/notification.md
index 1e9c6724ba..28c9bc997b 100644
--- a/docs/accessanalyzer/11.6/admin/settings/notification.md
+++ b/docs/accessanalyzer/11.6/admin/settings/notification.md
@@ -12,25 +12,25 @@ alerts, conformance analysis notification, and more.
-To enable notifications from the Enterprise Auditor Console, a mail server must be configured for
-Enterprise Auditor to employ for sending emails.
+To enable notifications from the Enterprise Auditor Console, configure a mail server for
+Enterprise Auditor to use for sending emails.
-Enterprise Auditor supports authentication and encryption when sending email notifications.
-Notifications can be configured based on the requirements of an organizations mail environment.
+Enterprise Auditor supports authentication and encryption when sending email notifications. You can
+configure notifications based on the requirements of an organization's mail environment.
-Enable Enterprise Auditor notifications by configuring the Mail Server and Sender Information. It is
-recommended to send a test email to yourself after initial configuration to ensure proper settings.
+Enable Enterprise Auditor notifications by configuring the Mail Server and Sender Information. Send
+a test email to yourself after initial configuration to ensure proper settings.
See the [Test Notification Settings](#test-notification-settings) topic for additional information.
The **Cancel** and **Save** buttons are in the lower-right corner of the Notification view. These
-buttons become enabled when modifications are made to the Notification global setting. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you make modifications to the Notification global setting. Whenever
+you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you don't want to save the changes.
## Configure SMTP Server Information
-The Mail Server section at the top of the page is where an organization’s SMTP Server information is
-provided.
+The Mail Server section at the top of the page is where you provide an organization’s SMTP Server
+information.
@@ -67,12 +67,12 @@ account.
**Step 2 –** Click **Save**.
-The credentials for Mail Server authentication account have been updated and committed to the
-Console.
+Enterprise Auditor updates and commits the credentials for the Mail Server authentication account
+to the Console.
## Sender Information
-The Sender Information section is where the sender information is provided.
+The Sender Information section is where you provide the sender information.
@@ -82,7 +82,7 @@ Auditor, and are sent to this recipient list unless inheritance is broken at the
level.
- Sender Name – Name displayed in the sent from field of the email
-- Sender Address – Sender’s email address. This does not have to be a real email address, unless
+- Sender Address – Sender’s email address. This doesn't have to be a real email address, unless
required by the organization. It can be something as simple as `accessanalyzer@yourdomain.com`.
## Email Content
@@ -98,14 +98,14 @@ The Email Content section is where the recipient information is provided.
## Test Notification Settings
-Once the global **Notification** settings have been configured, it is recommended to send a test
-email to ensure proper configuration. This verifies all settings are correct and email is received
-as expected.
+After you configure the global **Notification** settings, send a test
+email to ensure proper configuration. This verifies that all settings are correct and that email
+arrives as expected.
-The Test Email Settings button sends a test email to the recipient list. It is recommended that you
-test by sending an email to yourself. Once all Notification settings are configured, click the
+The Test Email Settings button sends a test email to the recipient list. Test by sending an email
+to yourself. After you configure all Notification settings, click the
**Test Email Settings** button.
@@ -123,5 +123,6 @@ successfully.
-This email is sent to all recipients when the **Test Email settings** link is clicked. When the
-Notification settings are configured, click **Save** and then **Ok** to complete the configuration.
+Enterprise Auditor sends this email to all recipients when you click the **Test Email settings**
+link. After you configure the Notification settings, click **Save** and then **Ok** to complete the
+configuration.
diff --git a/docs/accessanalyzer/11.6/admin/settings/overview.md b/docs/accessanalyzer/11.6/admin/settings/overview.md
index 012f5cd255..dc5138983c 100644
--- a/docs/accessanalyzer/11.6/admin/settings/overview.md
+++ b/docs/accessanalyzer/11.6/admin/settings/overview.md
@@ -6,15 +6,15 @@ sidebar_position: 20
# Global Settings
-The global settings have an overall impact on the running ofEnterprise Auditor jobs. Settings are
-inherited through a parent-child structure from the Settings node through the Jobs tree to the
-individual jobs unless inheritance is broken by direct assignment at either the job group or the
-individual job level.
+The global settings have an overall impact on the running ofEnterprise Auditor jobs. Settings inherit
+through a parent-child structure from the Settings node through the Jobs tree to the
+individual jobs, unless you break inheritance by directly assigning settings at either the job
+group or the individual job level.
-Some of these settings are configured during the initial launching of theEnterprise Auditor Console.
-Others are configured as desired by the end-user. Expand the Settings node in the Navigation pane to
+You configure some of these settings during the initial launch of the Enterprise Auditor Console.
+The end-user configures others as desired. Expand the Settings node in the Navigation pane to
select a global setting to configure:
- [Access](/docs/accessanalyzer/11.6/admin/settings/access/overview.md)
@@ -37,11 +37,11 @@ select a global setting to configure:
according to the data collector being used
- [Exchange](/docs/accessanalyzer/11.6/admin/settings/exchange.md)
- Required for auditing an organization’s Exchange environment
- - Only enabled for configuration once the Enterprise Auditor for Exchange Solution prerequisites
+ - Only enabled for configuration after the Enterprise Auditor for Exchange Solution prerequisites
are installed
- Configure Microsoft Exchange server connections and requires Exchange server versions and
names
- - The ExchangeMailbox, Exchange2K, ExchangePS, and ExchangePublicFolder Data Collectors utilize
+ - The ExchangeMailbox, Exchange2K, ExchangePS, and ExchangePublicFolder Data Collectors use
these global settings
- [History](/docs/accessanalyzer/11.6/admin/settings/history.md)
- Configure job data retention period settings
@@ -65,7 +65,7 @@ select a global setting to configure:
- [Schedule](/docs/accessanalyzer/11.6/admin/settings/schedule.md)
- Optional configuration during the initial launch if Windows authentication is used with the
Storage Profile
- - Required in order to schedule host inventory, job, analysis task, and action task execution
+ - Required to schedule host inventory, job, analysis task, and action task execution
- Provide credentials used against the Enterprise Auditor Console server to execute scheduled
jobs with the Windows Task Scheduler
- Creating a Schedule Service Account requires credentials on the Enterprise Auditor Console
diff --git a/docs/accessanalyzer/11.6/admin/settings/reporting.md b/docs/accessanalyzer/11.6/admin/settings/reporting.md
index 2851fec3bd..1eae76f4c0 100644
--- a/docs/accessanalyzer/11.6/admin/settings/reporting.md
+++ b/docs/accessanalyzer/11.6/admin/settings/reporting.md
@@ -7,22 +7,22 @@ sidebar_position: 90
# Reporting
The Reporting node is for configuring the global settings for publishing Enterprise Auditor reports.
-The Web Console is where any reports which have been published can be viewed outside of the
+The Web Console is where you can view any published reports outside of the
Enterprise Auditor Console. The Web Console provides a consolidated logon housing both the published
reports and the AIC (when applicable).
-The publishing of reports can be disabled at the global level by selecting **Do not publish
-reports** from the Publish Option drop-down menu. It can also be disabled at the job group, job, or
+You can disable the publishing of reports at the global level by selecting **Don't publish
+reports** from the Publish Option dropdown menu. You can also disable it at the job group, job, or
report configuration level. See the
[Jobs Tree](/docs/accessanalyzer/11.6/admin/jobs/overview.md) topic
for additional information.
The **Cancel** and **Save** buttons are in the lower-right corner of the Reporting view. These
-buttons become enabled when modifications are made to the Reporting global settings. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you make modifications to the Reporting global settings. Whenever
+you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you don't want to save the changes.
## Website URL
@@ -35,10 +35,10 @@ The default address is:
http://[Fully Qualified Domain Name of the Enterprise Auditor Console server]:8082
-This link is used to access the Web Console, and it is used for the web link in an emailed report.
-The protocol and port number may need to be modified to align with the organization’s environment,
-but it must match the information in the website’s configuration file. If the Web Console has been
-secured, this address must be manually updated:
+Enterprise Auditor uses this address to access the Web Console and for the web link in an emailed
+report. You may need to modify the protocol and port number to align with the organization’s
+environment, but they must match the information in the website’s configuration file. If you have
+secured the Web Console, manually update this address:
https://[Fully Qualified Domain Name of the StealthAUDIT Console server]:[Port Number]
@@ -52,11 +52,11 @@ topic for additional information.
## Publish Option
-The Publish Option allows you to enable or disable the publishing of reports at the global level.
+Use the Publish Option to enable or disable the publishing of reports at the global level.
-Select the **Publish reports** option to publish all Enterprise Auditor reports or select **Do not
+Select the **Publish reports** option to publish all Enterprise Auditor reports or select **Don't
publish reports** to disable the publishing. The inheritance of this setting can be broken at the
job group, job, or report levels.
@@ -68,8 +68,8 @@ Configure email reports sent out by Enterprise Auditor using the Email Report op
The **E-mail reports** checkbox enables recipients to receive all published reports, unless
inheritance is broken at the job group, job, or report level. Separate multiple recipients with a
-semicolon. If commas are used as delimiters for email addresses, they will be converted into
-semicolons when the settings are saved.
+semicolon. If you use commas as delimiters for email addresses, Enterprise Auditor converts them
+into semicolons when you save the settings.
:::info
Configure email reporting at a specific level to ensure recipients only receive
@@ -78,24 +78,24 @@ reports which apply to them.
:::note
-Email reports does not work unless Enterprise Auditor has been configured to send email
+Email reports doesn't work unless you configure Enterprise Auditor to send email
notifications through the **Notification** node. See the
[Notification](/docs/accessanalyzer/11.6/admin/settings/notification.md)
topic for additional information.
:::
-The **Do Not Email Report If Blank** checkbox prevents reports from being sent via email if all
-elements are blank when generated. A blank report can occur if there is an error in data collection
+The **Don't Email Report If Blank** checkbox prevents Enterprise Auditor from sending reports via
+email if all elements are blank when generated. A blank report can occur if there is an error in data collection
or if the report is configured for data which might not always be present (for example, new computer
objects created since last scan).
:::info
-Enable the **Do Not Email Report If Blank** option.
+Enable the **Don't Email Report If Blank** option.
:::
-The report can be sent using the desired **Email Content** option:
+You can send the report using the **Email Content** option you want:
- Web Link – Sends an email notice that the report has been published and provides the recipient
with a link to it in the Web console
@@ -112,7 +112,7 @@ the email subject line.
## Configure JavaScript Settings for the Web Console
Any browser used to access the Web Console must have JavaScript allowed for all features of the Web
-Console to function correctly. If the JavaScript permission is not set as allowed for the entire
+Console to function correctly. If the JavaScript permission isn't set as allowed for the entire
browser, you must add the Web Console as an allowed site.
Follow the steps to allow JavaScript on the Web Console in Microsoft Edge.
@@ -130,9 +130,10 @@ under All permissions.
Console and click **Add**.
:::note
-If the global Allowed option is selected, you do not need to specifically add the Web
+If the global Allowed option is selected, you don't need to specifically add the Web
Console as an allowed site.
:::
-The Web Console's URL is added to the Allow list and JavaScript is enabled for the Web Console.
+Microsoft Edge adds the Web Console's URL to the Allow list and enables JavaScript for the Web
+Console.
diff --git a/docs/accessanalyzer/11.6/admin/settings/schedule.md b/docs/accessanalyzer/11.6/admin/settings/schedule.md
index 5616812592..72c3e6626a 100644
--- a/docs/accessanalyzer/11.6/admin/settings/schedule.md
+++ b/docs/accessanalyzer/11.6/admin/settings/schedule.md
@@ -11,24 +11,24 @@ Account is used to run scheduled tasks on the Enterprise Auditor Console server.
-Jobs can be executed manually as desired or scheduled to execute at designated times. For example,
+You can execute jobs manually as desired or schedule them to execute at designated times. For example,
you could schedule a job to run during hours when the office is closed and network traffic is low.
Windows uses the Schedule Service Account to access the task folders when launching scheduled tasks.
-Schedule Service Accounts are configured at the global level, and this account can be used to
+Schedule Service Accounts are configured at the global level, and you can use this account to
schedule jobs in the Schedule Wizard. See the
[Schedules](/docs/accessanalyzer/11.6/admin/schedule/overview.md)
topic for additional information.
:::warning
-On Windows 2016 servers, the Schedule Service Account cannot be signed into an active
-session when the time comes for a scheduled task to start. Windows blocks the starting or running of
+On Windows 2016 servers, the Schedule Service Account can't be signed into an active
+session when a scheduled task is set to start. Windows blocks the starting or running of
scheduled tasks using an account that is logged into the server.
:::
**Password Storage Options**
-The password for the credential provided can be stored in the Enterprise Auditor application or the
+You can store the password for the credential provided in the Enterprise Auditor application or the
Enterprise Auditor Vault.
Choosing between the Enterprise Auditor application and Enterprise Auditor Vault is a global setting
@@ -69,9 +69,9 @@ least the following to meet Least Privileged specifications:
topic for additional information.
The **Cancel** and **Save** buttons are in the lower-right corner of the Schedule view. These
-buttons become enabled when modifications are made to the Schedule global settings. Whenever changes
-are made at the global level, click **Save** and then **OK** to confirm the changes. Otherwise,
-click **Cancel** if no changes were intended.
+buttons become enabled when you make modifications to the Schedule global settings. Whenever you
+make changes at the global level, click **Save** and then **OK** to confirm the changes. Otherwise,
+click **Cancel** if you don't want to save the changes.
The Enterprise Auditor vault provides enhanced security through enhanced encryption to various
credentials stored by the Enterprise Auditor application. See the
@@ -80,7 +80,7 @@ topic for additional information.
## Schedule Service Account Types
-There are two types of accounts that can be used to configure the Schedule Service Account.
+Use one of two types of accounts to configure the Schedule Service Account.
@@ -91,7 +91,7 @@ Use one of the following options for the Schedule Service Account:
- Credentials must have privileges sufficient for scheduling tasks on the Enterprise Auditor
Console server. If not, scheduled tasks fail to start.
- - This option cannot be edited or deleted
+ - You can't edit or delete this option
- User-supplied credentials – Provide credentials for a specific account with sufficient rights to
schedule tasks on the Enterprise Auditor Console server
@@ -100,19 +100,19 @@ Use one of the following options for the Schedule Service Account:
- A local Windows account is a specific account and not the default local system account
:::tip
-Remember, the Schedule Service Account cannot be signed into an active session on the Enterprise
-Auditor Console server when the time comes for a scheduled task to start when it has a Windows 2016
+Remember, the Schedule Service Account can't be signed into an active session on the Enterprise
+Auditor Console server when a scheduled task is set to start, if the server has a Windows 2016
operating system.
:::
## Create a Schedule Service Account
-Follow the steps to create a Schedule Service Account.
+To create a Schedule Service Account:
:::tip
-Remember, the Schedule Service Account cannot be signed into an active session on the Enterprise
-Auditor Console server when the time comes for a scheduled task to start when it has a Windows 2016
+Remember, the Schedule Service Account can't be signed into an active session on the Enterprise
+Auditor Console server when a scheduled task is set to start, if the server has a Windows 2016
operating system.
:::
@@ -138,12 +138,12 @@ types are:
- Application – Uses Enterprise Auditor’s configured Profile Security setting as selected at
the **Settings** > **Application** node
- Managed Service Account – Use previously configured MSA and gMSAs for authentication. The
- password fields are not applicable when this option is selected. See the
+ password fields aren't applicable when this option is selected. See the
[Group Managed Service Accounts (gMSA) Configuration](/docs/accessanalyzer/11.6/admin/settings/connection/gmsa.md)
topic for additional information.
- - Password – Type the password
- - Confirm – Re-type the password
+ - Password – Enter the password
+ - Confirm – Re-enter the password
- Local Account – Use this option to specify a local account for the Enterprise Auditor Console
server
@@ -154,32 +154,32 @@ types are:
- Application – Uses Enterprise Auditor’s configured Profile Security setting as selected at
the **Settings** > **Application** node
- - Password – Type the password
- - Confirm – Re-type the password
+ - Password – Enter the password
+ - Confirm – Re-enter the password
-**Step 3 –** Click **OK** and the credentials are verified. If there are no problems with the
-provided credentials, the User Credentials window closes. Otherwise, one of the following error
+**Step 3 –** Click **OK**; Enterprise Auditor verifies the credentials. If there are no problems with
+the provided credentials, the User Credentials window closes. Otherwise, one of the following error
messages might appear:
-- Passwords Do Not Match Error
+- Passwords Don't Match Error
- 
+ 
- - This error indicates the two password entries do not match. Click **OK** and reenter the
+ - This error indicates the two password entries don't match. Click **OK** and reenter the
passwords.
- Bad User Name or Password Error
- - This error indicates either the user account does not exist or the username and password do
+ - This error indicates either the user account doesn't exist or the username and password do
not match. Click **OK** and reenter the information.
- Insufficient Rights Error
- - This error indicates the account supplied does not have sufficient rights to create and run
+ - This error indicates the account supplied doesn't have sufficient rights to create and run
scheduled tasks. Click **OK** and provide credentials with sufficient rights.
- GPO Network Security Error
@@ -201,32 +201,32 @@ Enterprise Auditor can now schedule tasks with this Scheduled Service Account.
## Edit a Schedule Service Account
-Follow the steps to edit a Schedule Service Account credentials.
+To edit a Schedule Service Account's credentials:
:::tip
-Remember, the Schedule Service Account cannot be signed into an active session on the Enterprise
-Auditor Console server when the time comes for a scheduled task to start when it has a Windows 2016
+Remember, the Schedule Service Account can't be signed into an active session on the Enterprise
+Auditor Console server when a scheduled task is set to start, if the server has a Windows 2016
operating system.
:::
-**Step 1 –** Select a credential from the User Credentials list and click on **Edit**. The User
+**Step 1 –** Select a credential from the User Credentials list and click **Edit**. The User
Credentials window opens.
**Step 2 –** Modify the credential information as needed. See Step 2 of the
[Create a Schedule Service Account](#create-a-schedule-service-account) topic for additional
information.
-**Step 3 –** Click **OK** and the credentials will be verified. If there are no problems with the
-provided credentials, the User Credentials window closes.
+**Step 3 –** Click **OK**; Enterprise Auditor verifies the credentials. If there are no problems with
+the provided credentials, the User Credentials window closes.
Enterprise Auditor can now schedule tasks with this Scheduled Service Account.
## Delete a Schedule Service Account
-Follow the steps to delete a Schedule Service Account.
+To delete a Schedule Service Account:
@@ -241,6 +241,6 @@ Credentials confirmation window appears.
Account. Click **Save** and then **OK** to confirm the changes. To ensure these changes take effect,
exit and restart the Enterprise Auditor application.
-If all Schedule Service Accounts are removed and only the local System account remains, Enterprise
-Auditor cannot create or run scheduled tasks unless the local system account has adequate
+If you remove all Schedule Service Accounts and only the local System account remains, Enterprise
+Auditor can't create or run scheduled tasks unless the local system account has adequate
permissions.
diff --git a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/criteria.md b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/criteria.md
index 2ce410ed91..5ff75acfde 100644
--- a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/criteria.md
+++ b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/criteria.md
@@ -23,13 +23,13 @@ The options on the Criteria Tab are:
- Search selected criteria – Filter the criteria listed in the Criteria tab
The **Cancel** and **Save** buttons are in the lower-right corner of the Sensitive Data view. These
-buttons become enabled when modifications are made to the Sensitive Data global settings. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you make modifications to the Sensitive Data global settings. Whenever
+you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you don't want to save the changes.
## Select Criteria Window
-Follow the steps to add Search Criteria for Sensitive Data scan jobs.
+To add Search Criteria for Sensitive Data scan jobs:
@@ -45,5 +45,5 @@ search criteria.
**Step 4 –** Click **Save** on the Sensitive Data view to save changes.
-The selected Search Criteria are now inherited by Sensitive Data scan jobs that are set to use
-global sensitive data criteria settings.
+Sensitive Data scan jobs that are set to use global sensitive data criteria settings now inherit
+the selected Search Criteria.
diff --git a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/add.md b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/add.md
index 01df6eaf03..7d68d17a74 100644
--- a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/add.md
+++ b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/add.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Adding False Positive Exclusion Filters
-Follow the steps to add a False Positive Exclusion Filter.
+To add a False Positive Exclusion Filter:
@@ -17,7 +17,7 @@ Follow the steps to add a False Positive Exclusion Filter.
**Step 2 –** Enter the **File Path** according to the type of format for the repository.
**Step 3 –** Indicate the type of repository by selecting either **File System** or **SharePoint**
-from the **Source** drop-down menu.
+from the **Source** dropdown menu.
**Step 4 –** Select the required criteria from the list by selecting the relevant checkboxes. You
can use the **Search Criteria** textbox to filter the list by keywords.
@@ -27,4 +27,4 @@ Exclusion Filter window closes.
**Step 6 –** Click **Save** on the Sensitive Data view to save changes.
-The false positive exclusion filter is now applied to Sensitive Data reports.
+Enterprise Auditor now applies the false positive exclusion filter to Sensitive Data reports.
diff --git a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/delete.md b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/delete.md
index 1df666d811..940f2daa50 100644
--- a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/delete.md
+++ b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/delete.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Deleting False Positive Exclusion Filters
-Follow the steps to delete a False Positive Exclusion Filter.
+To delete a False Positive Exclusion Filter:
@@ -14,4 +14,4 @@ Follow the steps to delete a False Positive Exclusion Filter.
**Step 2 –** Click **Save** on the Sensitive Data view to save changes.
-The false positive exclusion filter has been successfully deleted.
+Enterprise Auditor successfully deletes the false positive exclusion filter.
diff --git a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/edit.md b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/edit.md
index 5b2762af41..aaa2e558e5 100644
--- a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/edit.md
+++ b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/edit.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Editing False Positive Exclusion Filters
-Follow the steps to edit a False Positive Exclusion Filter.
+To edit a False Positive Exclusion Filter:
@@ -21,4 +21,4 @@ closes.
**Step 4 –** Click **Save** on the Sensitive Data view to save changes.
-The false positive exclusion filter has been successfully edited.
+Enterprise Auditor successfully saves your edits to the false positive exclusion filter.
diff --git a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/export.md b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/export.md
index 3bcd7ba6e8..3962755d4c 100644
--- a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/export.md
+++ b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/export.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Exporting False Positive Exclusion Filters
-Follow the steps to export selected False Positive Exclusion Filters into a TXT file.
+To export selected False Positive Exclusion Filters into a TXT file:
@@ -15,7 +15,7 @@ Explorer opens.
-**Step 2 –** Enter a File name for the TXT file that the exported false positive exclusion filters
-will be contained in. Click **Save**.
+**Step 2 –** Enter a File name for the TXT file that will contain the exported false positive
+exclusion filters. Click **Save**.
-The False Positive Exclusion Filters are now exported.
+Enterprise Auditor now exports the False Positive Exclusion Filters.
diff --git a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/import.md b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/import.md
index 71f7506f53..79ff7fcf7e 100644
--- a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/import.md
+++ b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/import.md
@@ -7,10 +7,10 @@ sidebar_position: 40
# Importing False Positive Exclusion Filters
Create an import (TXT) file containing a list of file paths for the files to be excluded from
-Sensitive Data reports. The text file should have one file path per row. The import file needs to be
-scoped to a single solution and a criteria set.
+Sensitive Data reports. The text file should have one file path per row. You must scope the import
+file to a single solution and a criteria set.
-Follow the steps to import a list of False Positive Exclusion Filter.
+To import a list of False Positive Exclusion Filters:
@@ -19,12 +19,12 @@ window.
-**Step 2 –** Navigate to the file that will be imported. Select the file and click **Open**. The
+**Step 2 –** Navigate to the file you want to import. Select the file and click **Open**. The
Configure Imported False Positive Exclusion Filters window opens.
-**Step 3 –** Select the repository type from the **Source** drop-down menu.
+**Step 3 –** Select the repository type from the **Source** dropdown menu.
**Step 4 –** Select the required criteria from the list. You can use the **Search Criteria** textbox
to filter the list by keywords.
@@ -34,7 +34,8 @@ Filters window closes.
**Step 6 –** Click **Save** on the Sensitive Data view to save changes.
-The imported list of False Positive Exclusion Filters are now applied to Sensitive Data reports. If
-all of the files in the import were not meant to have the same Source and Criteria set, see the
+Enterprise Auditor now applies the imported list of False Positive Exclusion Filters to Sensitive
+Data reports. If all of the files in the import weren't meant to have the same Source and Criteria
+set, see the
[Editing False Positive Exclusion Filters](/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/edit.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/overview.md b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/overview.md
index 84c62bb847..9bdfa7bdf7 100644
--- a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/overview.md
+++ b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/exclusions/overview.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# False Positives Tab
-Configure False Positive exclusion filters using the options in the False Positives tab. False
-Positives Filters listed here as False Positives results in the corresponding matches being removed
-from Enterprise Auditor and Access Information Center reports.
+Configure False Positive exclusion filters using the options in the False Positives tab. When you
+list filters here as False Positives, Enterprise Auditor removes the corresponding matches from
+Enterprise Auditor and Access Information Center reports.
@@ -45,6 +45,6 @@ Filters:
- Criteria – Sensitive Data criteria where the exclusion filter is applied
The **Cancel** and **Save** buttons are in the lower-right corner of the Sensitive Data view. These
-buttons become enabled when modifications are made to the Sensitive Data global settings. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you make modifications to the Sensitive Data global settings. Whenever
+you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you don't want to save the changes.
diff --git a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/overview.md b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/overview.md
index 80fe653470..7c1160c579 100644
--- a/docs/accessanalyzer/11.6/admin/settings/sensitivedata/overview.md
+++ b/docs/accessanalyzer/11.6/admin/settings/sensitivedata/overview.md
@@ -12,7 +12,7 @@ positive exclusion filters. These settings require the Sensitive Data Discovery
topic for additional information.
:::note
-Sensitive data exclusion filters can only be applied to the
+You can only apply sensitive data exclusion filters to the
[File System Solution](/docs/accessanalyzer/11.6/solutions/filesystem/overview.md)
and the
[SharePoint Solution](/docs/accessanalyzer/11.6/solutions/sharepoint/overview.md).
diff --git a/docs/accessanalyzer/11.6/admin/settings/servicenow.md b/docs/accessanalyzer/11.6/admin/settings/servicenow.md
index 460a40d20e..c894dfc2bf 100644
--- a/docs/accessanalyzer/11.6/admin/settings/servicenow.md
+++ b/docs/accessanalyzer/11.6/admin/settings/servicenow.md
@@ -7,8 +7,8 @@ sidebar_position: 120
# ServiceNow
The ServiceNow® node is for configuring the settings needed to integrate with ServiceNow. These
-settings are exclusive to the Enterprise Auditor integration with ServiceNow and are used by the
-ServiceNow Action Module. See the
+settings are exclusive to the Enterprise Auditor integration with ServiceNow, and the ServiceNow
+Action Module uses them. See the
[ServiceNow Action Module](/docs/accessanalyzer/11.6/admin/action/servicenow/overview.md)
topic for additional information.
@@ -22,17 +22,17 @@ Provide ServiceNow authentication information to your ServiceNow instance.
field, and any other ServiceNow incident field that references the **sys_user** table.
The **Cancel** and **Save** buttons are in the lower-right corner of the ServiceNow view. These
-buttons become enabled when modifications are made to the ServiceNow global settings. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you make modifications to the ServiceNow global settings. Whenever
+you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you don't want to save the changes.
## Update ServiceNow Authentication Credentials
-Follow the steps to update the ServiceNow authentication credentials.
+To update the ServiceNow authentication credentials:
**Step 1 –** In the ServiceNow Authentication section, enter a new **Password** for the user
account.
**Step 2 –** Click **Save**.
-The credentials have been updated for ServiceNow authentication.
+Enterprise Auditor updates the credentials for ServiceNow authentication.
diff --git a/docs/accessanalyzer/11.6/admin/settings/storage/add.md b/docs/accessanalyzer/11.6/admin/settings/storage/add.md
index cf33b821dc..9a0e61674f 100644
--- a/docs/accessanalyzer/11.6/admin/settings/storage/add.md
+++ b/docs/accessanalyzer/11.6/admin/settings/storage/add.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Add a Storage Profile
-Follow the steps to create a Storage Profile.
+To create a Storage Profile:
@@ -19,7 +19,7 @@ Profile name to a unique and descriptive name.
-**Step 3 –** Type the SQL **Server name** in the textbox provided. This can be a NetBIOS name, a
+**Step 3 –** Enter the SQL **Server name** in the textbox provided. This can be a NetBIOS name, a
fully qualified domain name, or an IP Address. If the SQL Server specified is configured to use a
named instance, provide the **Instance name** in the next textbox.
@@ -45,17 +45,17 @@ for additional information.
| ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| Good Connection Test | Bad Connection Test |
-**Step 6 –** It is recommended to test the credentials provided at this point. The radio button for
-**Use existing database** should be selected by default. Test the SQL Server connection by clicking
-the drop-down arrow for an existing database. If the connection is established, a listing of
-databases appears. If the connection cannot be established, an error warning displays.
+**Step 6 –** Consider testing the credentials provided at this point. By default, Enterprise Auditor
+selects the radio button for **Use existing database**. Test the SQL Server connection by clicking
+the dropdown arrow for an existing database. If the connection succeeds, a listing of
+databases appears. If the connection fails, an error warning displays.
**Step 7 –** Set the database through one of the following options:
- Use existing database – Click this radio button and select a database from this list provided in
- the drop-down menu
+ the dropdown menu
- Create new database – Click this radio button and provide a unique, descriptive name in the
textbox
@@ -66,8 +66,8 @@ the appropriate permissions and lists any that are missing. If no permissions ar
message appears in the Connection report window. When there is a `Successful connection test`, click
**Close**.
-**Step 9 –** If **Create new database** was selected, the new database now exists. If **Use existing
-database** was selected, the Storage Profile is now linked to the database. Click **Save** and then
+**Step 9 –** If you selected **Create new database**, the new database now exists. If you selected
+**Use existing database**, the Storage Profile is now linked to the database. Click **Save** and then
**OK** to complete the creation of the new Storage Profile.
-The new Storage Profile is available to be used by Enterprise Auditor.
+Enterprise Auditor can now use the new Storage Profile.
diff --git a/docs/accessanalyzer/11.6/admin/settings/storage/default.md b/docs/accessanalyzer/11.6/admin/settings/storage/default.md
index 2df7ac4f12..f965b51b89 100644
--- a/docs/accessanalyzer/11.6/admin/settings/storage/default.md
+++ b/docs/accessanalyzer/11.6/admin/settings/storage/default.md
@@ -6,9 +6,9 @@ sidebar_position: 30
# Set a Default Storage Profile
-While multiple Storage Profiles can exist, only one profile can be set as the default. A green
-checkmark next to the profile name indicates the default Storage Profile. Follow the steps to change
-the default Storage Profile at the global level.
+You can create multiple Storage Profiles, but you can set only one as the default. A green
+checkmark next to the profile name indicates the default Storage Profile. To change
+the default Storage Profile at the global level:
@@ -17,8 +17,8 @@ storage profile window opens.
-**Step 2 –** There are three options for host management data migration. Select the desired option,
-choose whether or not to apply the secondary option, and click **OK**.
+**Step 2 –** There are three options for host management data migration. Select the option you want,
+choose whether to apply the secondary option, and click **OK**.
- Merge your host management data with data in the destination table (Recommended) – This option
keeps existing hosts and host discovery tasks in the destination and updates the tasks based on
@@ -33,7 +33,7 @@ choose whether or not to apply the secondary option, and click **OK**.
- Also overwrite shared host inventory data – If selected, host inventory data is also replaced
with data found in the source database
-- Don’t copy your host management data to destination table – This option does not copy, update, or
+- Don’t copy your host management data to destination table – This option doesn't copy, update, or
overwrite information between databases
- Clear data in destination table – If selected, all host management data in the destination
@@ -45,12 +45,12 @@ choose whether or not to apply the secondary option, and click **OK**.
-**Step 4 –** A blue arrow now points to the new default Storage Profile. However, the arrow is also
-an indication that the new default is not fully recognized by Enterprise Auditor. Click **Save** and
+**Step 4 –** A blue arrow now points to the new default Storage Profile. However, the arrow also
+indicates that Enterprise Auditor hasn't fully recognized the new default. Click **Save** and
then **OK** to confirm the changes.
**Step 5 –** Finally, to ensure these changes take effect, exit the Enterprise Auditor application
and relaunch it.
-The blue arrow is replaced by the green checkmark, indicating the new default Storage Profile is
-recognized.
+The green checkmark replaces the blue arrow, indicating that Enterprise Auditor now recognizes the
+new default Storage Profile.
diff --git a/docs/accessanalyzer/11.6/admin/settings/storage/delete.md b/docs/accessanalyzer/11.6/admin/settings/storage/delete.md
index 9329874276..c19703b5bc 100644
--- a/docs/accessanalyzer/11.6/admin/settings/storage/delete.md
+++ b/docs/accessanalyzer/11.6/admin/settings/storage/delete.md
@@ -6,17 +6,17 @@ sidebar_position: 40
# Delete a Storage Profile
-Follow the steps to delete a Storage Profile.
+To delete a Storage Profile:
:::note
-This procedure does not delete databases from the SQL Server. It only removes the selected
+This procedure doesn't delete databases from the SQL Server. It only removes the selected
Storage Profile from this Enterprise Auditor Console.
:::
-**Step 1 –** Select the Storage Profile to be removed, and click **Delete**.
+**Step 1 –** Select the Storage Profile to remove, and click **Delete**.
@@ -25,4 +25,4 @@ Storage Profile from this Enterprise Auditor Console.
**Step 3 –** The profile disappears from the Storage Profiles list. Click **Save** and then **OK**
to confirm the changes.
-The Storage Profile has now been deleted.
+You have now deleted the Storage Profile.
diff --git a/docs/accessanalyzer/11.6/admin/settings/storage/overview.md b/docs/accessanalyzer/11.6/admin/settings/storage/overview.md
index 5c0da1a117..4ce9f85f76 100644
--- a/docs/accessanalyzer/11.6/admin/settings/storage/overview.md
+++ b/docs/accessanalyzer/11.6/admin/settings/storage/overview.md
@@ -28,9 +28,8 @@ Each Storage Profile consists of the following parts:
- Command Timeout – Number of minutes before Enterprise Auditor halts any SQL queries running for
that amount of time. This prevents SQL queries from running excessively long. The default is 1440
minutes.
-- Authentication – Mode of authentication to the SQL Server. In general, it is recommended to
- connect with an account configured with the DBO role (database owner rights) and provisioned to
- use DBO Schema.
+- Authentication – Mode of authentication to the SQL Server. In general, use an account configured
+ with the DBO role (database owner rights) and provisioned to use DBO Schema.
:::info
When possible, use Windows Authentication. Windows Authentication is more
@@ -40,7 +39,7 @@ Each Storage Profile consists of the following parts:
:::
- - Windows authentication – Leverages the account used to run the Enterprise Auditor Console
+ - Windows authentication – Uses the account used to run the Enterprise Auditor Console
:::note
This option affects the credentials used for Schedule Service Accounts. See the
@@ -49,16 +48,16 @@ Each Storage Profile consists of the following parts:
:::
- - SQL Server authentication – Leverages the account provided in the **User name** and
+ - SQL Server authentication – Uses the account provided in the **User name** and
**Password** textboxes
- Use existing password – Use the password configured for the Storage Profile account
- Specify a new password below – Enter a new password for the selected Storage Profile account
- Database name – Name of the Enterprise Auditor database to use in this storage profile
- - Use existing database – Drop-down menu provides a list of databases on the named SQL Server,
+ - Use existing database – dropdown menu provides a list of databases on the named SQL Server,
provided the connection information supplied is correct. If the menu is empty, then a
- connection to the SQL Server was not established.
+ connection to the SQL Server wasn't established.
- Create new database – Enterprise Auditor automatically creates a new database using the name
provided in the textbox. This value should be a unique, descriptive name.
@@ -82,11 +81,11 @@ A green checkmark in the Storage Profiles list indicates the default Storage Pro
The **Cancel** and **Save** buttons are in the lower-right corner of the Storage view. These buttons
-become enabled when modifications are made to the Storage global setting. Whenever changes are made
+become enabled when you make changes to the Storage global setting. Whenever you make changes
at the global level, click **Save** and then **OK** to confirm the changes. Otherwise, click
-**Cancel** if no changes were intended.
+**Cancel** if you don't want to save the changes.
-The vault provides enhanced security through enhanced encryption to various credentials stored by
+The vault provides enhanced security through encryption for various credentials stored by
the Enterprise Auditor application. See the
[Vault](/docs/accessanalyzer/11.6/admin/settings/application/vault.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/admin/settings/storage/updateauth.md b/docs/accessanalyzer/11.6/admin/settings/storage/updateauth.md
index 2515680d1d..b542c5cd40 100644
--- a/docs/accessanalyzer/11.6/admin/settings/storage/updateauth.md
+++ b/docs/accessanalyzer/11.6/admin/settings/storage/updateauth.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# Update Authentication Credentials in a Storage Profile
-Follow the steps to update authentication credentials for a Storage Profile in the Enterprise
-Auditor Console.
+To update authentication credentials for a Storage Profile in the Enterprise
+Auditor Console:
**Step 1 –** Navigate to the **Settings** > **Storage** page.
@@ -21,4 +21,4 @@ Auditor Console.
**Step 5 –** Click **Apply**.
-A new password has been added to a Storage profile.
+You have added a new password to the Storage profile.
diff --git a/docs/accessanalyzer/11.6/cdsa/job.md b/docs/accessanalyzer/11.6/cdsa/job.md
index ac0977cae4..8be1d1f50c 100644
--- a/docs/accessanalyzer/11.6/cdsa/job.md
+++ b/docs/accessanalyzer/11.6/cdsa/job.md
@@ -8,10 +8,10 @@ sidebar_position: 10
The CDSA Job is available through the Instant Job Library under the CDSA library. See the
[Instant Job Wizard](/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md)
-topic for instructions of how to add this instant job to the Jobs tree. When installing the job,
+topic for instructions on adding this instant job to the Jobs tree. When installing the job,
select **Local host** on the Host pages of the Instant Job Wizard.
-Ensure the supporting solutions have successfully collected and analyzed data prior to running this
+Ensure the supporting solutions have successfully collected and analyzed data before running this
job. See the
[Presentation Dependencies](/docs/accessanalyzer/11.6/cdsa/presentation.md)
topic for alignment between presentation slides and jobs that supply the data points.
@@ -30,7 +30,7 @@ The CDSA job generates three PowerPoint files:
self-review as a PDF file
:::warning
-Do not send any these presentations to a customer in PowerPoint format.
+Don't send any these presentations to a customer in PowerPoint format.
:::
@@ -54,7 +54,7 @@ are two presentation options for the live slide show:
- The **ePHI Security Assessment** slide show contains the ending slides with select summary slides
from the Classic slide show and is applicable to the healthcare industry
-Use the Custom Slide Show drop-down menu on the Slide Show ribbon in PowerPoint to select the
+Use the Custom Slide Show dropdown menu on the Slide Show ribbon in PowerPoint to select the
appropriate presentation.
:::note
@@ -63,7 +63,7 @@ Slide 17 is hidden by default as same information is available on Slides 18-20.
Netwrix University includes a training module with details on the key talking points for a live
-delivery of the slide shows. Check out the **315 – Getting Started with Credential & Data Security
+delivery of the slide shows. Refer to the **315 – Getting Started with Credential & Data Security
Assessment** training course.
## Choosing a PDF Version
@@ -74,7 +74,7 @@ Both of the printable assets have two customized options for converting to a PDF
- ePHI Security Assessment – Contains the ending slides with select summary slides from the Classic
slide show and is applicable to the healthcare industry
-Follow the steps to create the appropriate custom PDF.
+To create the appropriate custom PDF:
**Step 1 –** Use the **Save As** option.
@@ -87,7 +87,7 @@ Follow the steps to create the appropriate custom PDF.
**Step 5 –** Click **OK** to confirm the option, and then click **Save** to generate the PDF.
-The presentation is converted to a PDF with only the applicable slides included.
+You have now converted the presentation to a PDF with only the applicable slides included.
:::note
Slide 16 is hidden by default as same information is available on Slides 17-19.
diff --git a/docs/accessanalyzer/11.6/cdsa/overview.md b/docs/accessanalyzer/11.6/cdsa/overview.md
index 50f531df39..bd28e2d3f9 100644
--- a/docs/accessanalyzer/11.6/cdsa/overview.md
+++ b/docs/accessanalyzer/11.6/cdsa/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 70
# Credential & Data Security Assessment Overview
Proper data security begins with a strong foundation. The Credential & Data Security Assessment
-(CDSA) provides a deep-dive into the security of your structured and unstructured data, Active
+(CDSA) provides an in-depth analysis of the security of your structured and unstructured data, Active
Directory, and Windows infrastructure.
The CDSA job depends upon several Enterprise Auditor solutions for data collection. See the
@@ -16,7 +16,7 @@ topic for installation and database requirements.
## Supporting Solutions
-At a minimum the following solutions need to run prior to the CDSA job to provide the data used to
+At a minimum the following solutions need to run before the CDSA job to provide the data used to
generate the CDSA presentations:
- .Active Directory Inventory Solution
diff --git a/docs/accessanalyzer/11.6/cdsa/presentation.md b/docs/accessanalyzer/11.6/cdsa/presentation.md
index 795a74482e..8db4c89934 100644
--- a/docs/accessanalyzer/11.6/cdsa/presentation.md
+++ b/docs/accessanalyzer/11.6/cdsa/presentation.md
@@ -9,7 +9,7 @@ sidebar_position: 20
In the following subsections, each slide is aligned to the jobs that supply its data. The slide
number is specific to the **Netwrix_CDSA_Presentation.pptx** file, as there are slight various in
page numbering with the files designed to be saved as PDFs. Many jobs contribute to multiple slides,
-so jobs are highlighted in bold text the first time they are listed.
+so this topic highlights each job in bold text the first time it's listed.
## Executive Summary Slide
diff --git a/docs/accessanalyzer/11.6/gettingstarted.md b/docs/accessanalyzer/11.6/gettingstarted.md
index 84dfec2e1c..5795894e5d 100644
--- a/docs/accessanalyzer/11.6/gettingstarted.md
+++ b/docs/accessanalyzer/11.6/gettingstarted.md
@@ -6,14 +6,14 @@ sidebar_position: 2
# Getting Started
-Once Enterprise Auditor is installed, the following workflow will quickly enable users to begin
-auditing the organization’s IT infrastructure. See the
+After you install Enterprise Auditor, use the following workflow to quickly begin
+auditing the organization's IT infrastructure. See the
[Navigating the Console](/docs/accessanalyzer/11.6/admin/navigate/overview.md)
topic for additional information and data grid functionality.
## Initial Configuration During First Launch
-During the initial Enterprise Auditor Configuration Wizard, users are walked through configuring
+The initial Enterprise Auditor Configuration Wizard walks you through configuring
several key global settings:
- Storage
@@ -45,8 +45,8 @@ several key global settings:
## Global Settings Configured
-The global Settings have an overall impact on the running of Enterprise Auditor jobs. They are
-managed through the Settings node at the top of the Navigation pane. The following global Settings
+The global Settings affect how Enterprise Auditor runs jobs. You manage them
+through the Settings node at the top of the Navigation pane. The following global Settings
require configuration from the start:
- [Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
@@ -58,15 +58,15 @@ require configuration from the start:
- [Notification](/docs/accessanalyzer/11.6/admin/settings/notification.md)
– Configure an SMTP server for Enterprise Auditor to use for sending email notifications
-The other global Settings provide additional options for impacting how Enterprise Auditor functions:
+The other global Settings provide additional options for how Enterprise Auditor functions:
- [Access](/docs/accessanalyzer/11.6/admin/settings/access/overview.md)
– Enable and configure Role Based Access for a least privileged application of Enterprise Auditor
and report viewing or the enable the REST API
:::note
- If Role Based Access is enabled by accident, contact
- [Netwrix Support](https://www.netwrix.com/support.html) for assistance in disabling it.
+ If you enable Role Based Access by accident, contact
+ [Netwrix Support](https://www.netwrix.com/support.html) for assistance disabling it.
:::
@@ -76,8 +76,8 @@ The other global Settings provide additional options for impacting how Enterpris
Configure Microsoft® Exchange Server connections
:::warning
-Do not configure data retention at the global level without ensuring History is
-supported by ALL solutions to be run.
+Don't configure data retention at the global level unless History supports all
+the solutions you plan to run.
:::
@@ -102,27 +102,27 @@ topic for additional information.
## Discover Hosts for Enterprise Auditor
-Within the terminology of Enterprise Auditor, hosts are the machines being targeted during data
-collection. Hosts can be discovered or manually introduced to Enterprise Auditor. Known hosts are
-then inventoried to populate dynamic host lists. Host discovery is done at the Host Discovery node.
-Hosts are manually introduced at the Host Management node.
+Within the terminology of Enterprise Auditor, hosts are the machines that Enterprise Auditor targets
+during data collection. You can discover hosts or manually introduce them to Enterprise Auditor.
+Enterprise Auditor then inventories known hosts to populate dynamic host lists. You perform host
+discovery at the Host Discovery node. You manually introduce hosts at the Host Management node.
-Host management consists of maintaining up-to-date host inventories and host lists which can be
-assigned to job groups or jobs as targeted hosts. See the
+Host management consists of maintaining up-to-date host inventories and host lists that you can
+assign to job groups or jobs as targeted hosts. See the
[Host Management](/docs/accessanalyzer/11.6/admin/hostmanagement/overview.md)
topic for additional information.
## Enterprise Auditor Job Workflow
-Once the global Settings are configured and hosts have been introduced to Enterprise Auditor, it is
+After you configure the global Settings and introduce hosts to Enterprise Auditor, it's
time to begin auditing. This requires an understanding of the relationship between solutions, job
groups, jobs, queries, analysis, actions, and reports.
The Enterprise Auditor job is the fundamental unit. Jobs are responsible for all data collection
queries, analysis tasks, notification tasks, action tasks, and report generation. When Jobs are
designed to work together, they are housed within job groups to control the order of job execution.
-Solutions are pre-configured job groups which have been designed to target specific types of
-environments to audit for specific data sets, typically the most common types of information
+Solutions are pre-configured job groups that Netwrix designed to target specific types of
+environments and audit specific data sets, typically the most common types of information
desired.
See the [Jobs Tree](/docs/accessanalyzer/11.6/admin/jobs/overview.md)
diff --git a/docs/accessanalyzer/11.6/index.md b/docs/accessanalyzer/11.6/index.md
index d27a560bab..d786835a82 100644
--- a/docs/accessanalyzer/11.6/index.md
+++ b/docs/accessanalyzer/11.6/index.md
@@ -18,8 +18,8 @@ The platform framework contains the following key components:
- Reporting through Published Reports and the Web Console
Enterprise Auditor contains over 40 built-in data collection modules covering both on-premises and
-cloud-based platforms from Operating Systems to Office 365. Leveraging an agentless architectural
-approach, our proprietary AnyData collector provides an easy, wizard-driven interface for
+cloud-based platforms from Operating Systems to Office 365. Using an agentless architectural
+approach, the proprietary AnyData collector provides a wizard-driven interface for
configuring the application to collect exactly the data needed, enabling fast, flawless,
lightest-weight possible data collection from dozens of data sources.
@@ -84,8 +84,8 @@ topic for additional information.
### Active Directory Permissions Analyzer Solution
-The Active Directory Permissions Analyzer Solution is designed to easily and automatically determine
-effective permissions applied to any and all Active Directory objects, at any scope, allowing for
+The Active Directory Permissions Analyzer Solution is designed to automatically determine
+effective permissions applied to any and all Active Directory objects, at any scope, providing
the most authoritative view available of who has access to what in Active Directory.
See the
@@ -117,7 +117,7 @@ topic for additional information.
### Box Solution
The Box solution set contains jobs to provide visibility into Box access rights, policies,
-configurations, activities, and more, ensuring you never lose sight or control of your critical
+configurations, activities, and more, ensuring you maintain visibility and control over your critical
assets residing in Box.
See the
@@ -138,18 +138,18 @@ reports that provide visibility into various aspects of supported databases.
- Instance Discovery – The Instance Discovery Solution discovers instances on supported database
servers.
- MongoDB Solution – The MongoDB Solution automates the process of understanding where MongDB
- databases exist and provides an overview of the MongoDB environment in order to answer questions
- around data access. With visibility into every corner of MongoDB and the operating system it
+ databases exist and provides an overview of the MongoDB environment to answer questions
+ around data access. With visibility into all aspects of MongoDB and the operating system it
relies upon, organizations can proactively highlight and prioritize risks to sensitive data.
Additionally, organizations can automate manual, time-consuming, and expensive processes
- associated with compliance, security, and operations to easily adhere to best practices that keep
+ associated with compliance, security, and operations to adhere to best practices that keep
MongoDB Server safe and operational.
- MySQL Solution – The MySQL Solution automates the process of understanding where SQL databases
- exist and provides an overview of the MySQL environment in order to answer questions around data
- access. With visibility into every corner of Microsoft SQL Server and the Windows operating system
+ exist and provides an overview of the MySQL environment to answer questions around data
+ access. With visibility into all aspects of Microsoft SQL Server and the Windows operating system
it relies upon, organizations can proactively highlight and prioritize risks to sensitive data.
Additionally, organizations can automate manual, time-consuming, and expensive processes
- associated with compliance, security, and operations to easily adhere to best practices that keep
+ associated with compliance, security, and operations to adhere to best practices that keep
SQL Server safe and operational.
- Oracle Solution – The Oracle Solution delivers comprehensive permissions, activity, and sensitive
data auditing and reporting for Oracle databases. Through the power of Enterprise Auditor, users
diff --git a/docs/accessanalyzer/11.6/install/application/database/database.md b/docs/accessanalyzer/11.6/install/application/database/database.md
index b406917e67..4b4453818d 100644
--- a/docs/accessanalyzer/11.6/install/application/database/database.md
+++ b/docs/accessanalyzer/11.6/install/application/database/database.md
@@ -7,19 +7,19 @@ sidebar_position: 10
# Enterprise Auditor Database
The Enterprise Auditor database is dynamic in nature. There are a handful of required system tables
-which are created at installation time or when individual features are used the first time. All
-other data tables in the Enterprise Auditor database are created and bound to individual jobs which
-are added to the Enterprise Auditor Console. As jobs are created and modified, corresponding tables
-are created and modified in the database. A job can generate one or more tables.
+that Enterprise Auditor creates at installation time or when you use individual features for the
+first time. Enterprise Auditor creates and binds all other data tables in the database to individual
+jobs that you add to the Enterprise Auditor Console. As you create and modify jobs, Enterprise
+Auditor creates and modifies corresponding tables in the database. A job can generate one or more tables.
-The structure and schema of each data table is controlled by the Enterprise Auditor data collector
-used to collect data and write results to the table. There is a one-to-one relationship between a
+The Enterprise Auditor data collector that collects data and writes results to the table controls
+the structure and schema of each data table. There is a one-to-one relationship between a
task created within a Enterprise Auditor job and the table to which the task writes results.
Creating tasks or adding and removing properties within a task modifies the schema of the table on
subsequent execution of the job.
Enterprise Auditor offers users the ability to modify its preconfigured jobs or create custom jobs
-and tasks as needed. Therefore, precise schema information for data tables cannot be predicted,
+and tasks as needed. Therefore, precise schema information for data tables can't be predicted,
restricted, or locked down.
## Database Permissions
@@ -34,8 +34,8 @@ access to the database.
:::
-If database owner rights cannot be obtained, the following SQL script can be executed by a database
-administrator (DBA) against the Enterprise Auditor database to grant the necessary permissions to
+If you can't obtain database owner rights, a database administrator (DBA) can execute the following
+SQL script against the Enterprise Auditor database to grant the necessary permissions to
the appropriate users (replacing `` and `` with the appropriate values):
```
@@ -85,17 +85,17 @@ Enterprise Auditor.
user-configured time frame
- Reporting Needs – Anticipated data needed to generate reports
-Recommended SQL Server database sizes are provided for specific solutions in the
+The
[Requirements](/docs/accessanalyzer/11.6/requirements/overview.md)
-topics. These recommendations are based on environmental factors, the number of target objects
-within an environment (users, hosts, mailboxes, etc.), and the applicable factors listed above for
-the specific solution.
+topics provide recommended SQL Server database sizes for specific solutions. These recommendations
+are based on environmental factors, the number of target objects within an environment (users,
+hosts, mailboxes, etc.), and the applicable factors described earlier for the specific solution.
### Customer Examples of Database Sizing
-The overall database size is ultimately governed by an organization’s auditing objectives. The
-examples below provide a glimpse into how these objectives combine with the applicable factors above
-to impact the Enterprise Auditor database resource consumption.
+An organization's auditing objectives ultimately govern the overall database size. The
+following examples provide a glimpse into how these objectives combine with the applicable factors
+described earlier to impact the Enterprise Auditor database resource consumption.
- Example from an Active Directory Solution Customer
- An Active Directory (AD) customer intends to collect AD User/Group/Membership information and
@@ -115,8 +115,8 @@ to impact the Enterprise Auditor database resource consumption.
information on file permissions and ages (and possibly, ad hoc, information on file system
activity) with an overall plan to identify stale data, consolidate active data on a subset of
the organization’s file system infrastructure, and to move that active data to a cloud-based
- platform like SharePoint Online. Activity monitoring (FSAC) is to be used ad hoc against open
- shares to profile resource ownership and also to validate the “staleness” of certain
+ platform like SharePoint Online. The customer plans to use Activity monitoring (FSAC) ad hoc against open
+ shares to profile resource ownership and validate the “staleness” of certain
resources. The database sizing for a project of this scope could be up to 750 GB for the
database, 240 GB for the transaction log, and 380 GB of TEMPDB space.
- Example from an Exchange Solution Customer
@@ -131,12 +131,12 @@ to impact the Enterprise Auditor database resource consumption.
## Securing the Enterprise Auditor Database
-The typical database configuration is to have **sysadmin Server Role** assigned to the ID used to
-connect to the SQL instance. It will allow full control over the instance where the Enterprise
-Auditor database resides. This configuration is chosen because Enterprise Auditor requires some
-interaction with the master database in order to install and configure the initial Enterprise
-Auditor database. When it is necessary to secure the Enterprise Auditor database, the following
-steps should be followed to achieve the minimum SQL security levels without breaking core Enterprise
+The typical database configuration assigns the **sysadmin Server Role** to the ID used to
+connect to the SQL instance, which allows full control over the instance where the Enterprise
+Auditor database resides. Administrators typically choose this configuration because Enterprise
+Auditor requires some interaction with the master database to install and configure the initial
+Enterprise Auditor database. To secure the Enterprise Auditor database, follow these
+steps to achieve the minimum SQL security levels without breaking core Enterprise
Auditor functionality.
### Database Creation & First Level of Security
@@ -146,7 +146,7 @@ settings for the server roles and user mappings.
-**Step 1 –** Create a new database for use with Enterprise Auditor. Right-click on the **Databases**
+**Step 1 –** Create a new database for use with Enterprise Auditor. Right-click the **Databases**
node and choose **New Database**.
@@ -170,17 +170,17 @@ authentication.
-- If **Windows authentication** is desired, then click **Search** and select the desired Windows
- account, which has been set up for use with Enterprise Auditor.
+- If you want **Windows authentication**, click **Search** and select the Windows
+ account you want, which is set up for use with Enterprise Auditor.
-- **_RECOMMENDED:_** If **SQL Server authentication** is desired, use a login name called Enterprise
+- **_RECOMMENDED:_** If you want **SQL Server authentication**, use a login name called Enterprise
Auditor.
:::note
-Set the **Default Database** as Enterprise Auditor (or the desired Enterprise Auditor
-database) and choose English as the **Default Language**.
+Set the **Default Database** as Enterprise Auditor (or the Enterprise Auditor
+database you want) and choose English as the **Default Language**.
:::
@@ -216,24 +216,24 @@ topic for instructions.
-- Click **Apply** and a Connection report window will open. Verify that the connection and test
- table drop were performed successfully.
+- Click **Apply** and a Connection report window will open. Verify that Enterprise Auditor
+ performed the connection and test table drop successfully.
- Click **Close** on the Connection report window and then **Save** the new Storage Profile.
:::note
-If previously connected to another database which already had the Enterprise Auditor DB
-schema applied, then a prompt should appear to merge the host management data. Choose the
+If you previously connected to another database that already had the Enterprise Auditor DB
+schema applied, a prompt should appear to merge the host management data. Choose the
appropriate options and then click **OK** to migrate data.
:::
-**Step 9 –** Make sure to close and re-open the Enterprise Auditor Console before continuing to
-configure or use Enterprise Auditor if a new database Storage Profile was chosen as the default.
+**Step 9 –** Close and reopen the Enterprise Auditor Console before continuing to
+configure or use Enterprise Auditor if you chose a new database Storage Profile as the default.
-The **blue arrow** signifies the default profile was changed but does not take effect until the
-required restart of the Enterprise Auditor Console.
+The **blue arrow** signifies that you changed the default profile, but the change doesn't take
+effect until you restart the Enterprise Auditor Console.
See the
[Enterprise Auditor Initial Configuration](/docs/accessanalyzer/11.6/install/application/firstlaunch.md)
diff --git a/docs/accessanalyzer/11.6/install/application/database/otherlanguages.md b/docs/accessanalyzer/11.6/install/application/database/otherlanguages.md
index 24b43343f4..934a10a05c 100644
--- a/docs/accessanalyzer/11.6/install/application/database/otherlanguages.md
+++ b/docs/accessanalyzer/11.6/install/application/database/otherlanguages.md
@@ -11,7 +11,7 @@ Language environment, specifically when the environment uses a non-Latin alphabe
## Requirements
-The following collation requirements need to be met prior to the Enterprise Auditor installation.
+You must meet the following collation requirements before installing Enterprise Auditor.
### Database & Server Collation Settings
@@ -21,11 +21,11 @@ The collation settings at the database level must match what is set at the serve
Common errors that occur are:
-- Implicit conversion of VARCHAR value to VARCHAR cannot be performed because the collation of the
+- Implicit conversion of VARCHAR value to VARCHAR can't be performed because the collation of the
value is unresolved due to a collation conflict.
- - Could not find stored procedure `#SA_ImportObject`
- - Cannot drop the procedure `#SA_ImportObject`, because it does not exist or lack of permission
-- Cannot resolve the collation conflict between **SQL_Latin1_General_CP1_CI_AS** and
+ - Couldn't find stored procedure `#SA_ImportObject`
+ - Can't drop the procedure `#SA_ImportObject`, because it doesn't exist or lack of permission
+- Can't resolve the collation conflict between **SQL_Latin1_General_CP1_CI_AS** and
**French_CI_AS** in the equal to operation.
**Cause**
@@ -33,20 +33,20 @@ Common errors that occur are:
These errors occur because the Enterprise Auditor solutions use many temporary functions and
procedures which in turn use the collation at the server level. Temporary tables created within a
stored procedure use the TEMPDB database’s collation instead of the current user database’s
-collation. Therefore, there will be issues in analysis due to the mismatch.
+collation. Therefore, the mismatch causes issues in analysis.
**Resolution**
-The following is a work-around which we use to avoid collation errors. However, when making changes
+The following is a work-around used to avoid collation errors. However, when making changes
at the SQL Server level, use caution as it actually rebuilds all user/system database objects. If
-there are schema bound objects (i.e. Constraints), the whole operation will fail. Make sure to have
+there are schema bound objects (i.e. Constraints), the whole operation will fail. ensure to have
all of the information or scripts needed to recreate the Enterprise Auditor user’s databases and all
of the objects in them. Customers should use a localized version of the SQL Server, and this should
not be done in production environments.
#### Change Collation at the Database Level
-Follow the steps to change the collation at the database level.
+To change the collation at the database level:
**Step 1 –** Access the Database Properties in SQL Server Management Studio.
@@ -58,7 +58,7 @@ Now that the collations match, proceed with Enterprise Auditor installation.
#### Change Collation at the SQL Server Level
-Follow the steps to change the collation at the SQL Server level.
+To change the collation at the SQL Server level:
@@ -87,13 +87,13 @@ Now that the collations match, proceed with Enterprise Auditor installation.
### Case Sensitive Collation
-Enterprise Auditor does not support case sensitive collation settings. Case insensitive collations
+Enterprise Auditor doesn't support case sensitive collation settings. Case insensitive collations
are notated by having **CI** in the collation, for example **Latin1_General_CI_AS**.
**Cause**
-For example, `SYS.INDEXES` will be unable to be found if there was an English install of SQL Server
-but a Turkish collation which is case sensitive. So `'SYS.INDEXES != 'sys.indexes' `in the
+For example, if there was an English install of SQL Server but a case-sensitive Turkish
+collation, the system won't find `SYS.INDEXES`. So `'SYS.INDEXES != 'sys.indexes' `in the
environment.
**Resolution**
@@ -104,10 +104,10 @@ All collation settings must be case insensitive.
The following are possible problems for future consideration.
-During comparison or joining of columns, collation conflict error occurs in two cases if collation
-of one column does not match with collation of another column:
+During comparison or joining of columns, a collation conflict error occurs in two cases if one
+column's collation doesn't match another column's:
-This can be generated by the following script:
+The following script generates this:
```
CREATE TABLE TestTab
@@ -119,18 +119,18 @@ INSERT INTO TestTab VALUES (1, 'abc', 'abc')
SELECT * FROM TestTab WHERE CharCol = CharCol2
```
-- Error Returned – Cannot resolve the collation conflict between **Greek_CI_AS** and
+- Error Returned – Can't resolve the collation conflict between **Greek_CI_AS** and
**French_CI_AS** in the equal to operation.
-- Resolution – If the select statement is changed as below, then it would run successfully.
+- Resolution – If you change the select statement as follows, it runs successfully.
```
SELECT * FROM TestTab WHERE CharCol = CharCol2 COLLATE Albanian_CI_AI
```
:::note
-Explicit collation (Albanian_CI_AI) is not one of any column, but after that it will
-complete successfully. The collation of two columns have not been matched, instead the third rule of
-collation precedence was implemented. See the Microsoft
+Explicit collation (Albanian_CI_AI) isn't one of any column, but the query still
+completes successfully. The two columns' collations don't match; instead, SQL Server applies the
+third rule of collation precedence. See the Microsoft
[Collation Precedence](https://learn.microsoft.com/en-us/sql/t-sql/statements/collation-precedence-transact-sql)
article for additional information.
:::
diff --git a/docs/accessanalyzer/11.6/install/application/firstlaunch.md b/docs/accessanalyzer/11.6/install/application/firstlaunch.md
index 79eb01a463..fb34dd781e 100644
--- a/docs/accessanalyzer/11.6/install/application/firstlaunch.md
+++ b/docs/accessanalyzer/11.6/install/application/firstlaunch.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Enterprise Auditor Initial Configuration
-Once the Enterprise Auditor installation process is complete, and before performing actions within
-Enterprise Auditor, the initial settings for the Enterprise Auditor Console must be configured.
+After the Enterprise Auditor installation process finishes, and before performing actions within
+Enterprise Auditor, configure the initial settings for the Enterprise Auditor Console.
@@ -47,22 +47,22 @@ topic for additional information.
- Command timeout [number] minutes – Number of minutes before Enterprise Auditor halts any SQL
queries running for that amount of time. This prevents SQL queries from running excessively long.
The default is 1440 minutes.
-- Windows authentication – Leverages the account used to open the Enterprise Auditor Console. This
+- Windows authentication – Uses the account used to open the Enterprise Auditor Console. This
option will use Windows NT Authentication to authenticate to the SQL Server. It also requires the
Schedule Service Account to have proper permissions on the SQL database.
-- SQL Server authentication – Leverages an account created within the SQL Server.
+- SQL Server authentication – Uses an account created within the SQL Server.
- User name and password – If SQL Server authentication is selected, provide the **User name**
and **Password** for the SQL account.
- Specify a new password below – Specify a new password for the SQL server.
-- Use existing database – Confirm the SQL Server connection has been established by selecting the
- radio button for **Use existing database** and clicking the drop-down arrow. If a listing of
- databases appears, then the connection has been established. Select this option to use a
- pre-existing database. Then select a database from the drop-down menu of available databases.
+- Use existing database – Confirm that the SQL Server connection succeeded by selecting the
+ radio button for **Use existing database** and clicking the dropdown arrow. If a listing of
+ databases appears, the connection succeeded. Select this option to use a
+ pre-existing database. Then select a database from the dropdown menu of available databases.
- Create new database – Select this option to create a new database during the configuration of the
storage profile. Enter a unique, descriptive name for the new database. If multiple databases
- might exist for Enterprise Auditor, then the default name of Enterprise Auditor is not
+ might exist for Enterprise Auditor, then the default name of Enterprise Auditor isn't
recommended.
See the
@@ -71,9 +71,10 @@ topic for additional information on creating a SQL Server database for Enterpris
**Step 5 –** Click **Next**.
-- If SQL Server authentication is used, the Options page is displayed next. Skip to Step 7.
-- If Windows Server authentication is used, the **Schedule Account** page is enabled for
- configuration. Continue to Step 6.
+- If you use SQL Server authentication, Enterprise Auditor displays the Options page next. Skip to
+ Step 7.
+- If you use Windows Server authentication, Enterprise Auditor enables the **Schedule Account**
+ page for configuration. Continue to Step 6.
@@ -82,7 +83,7 @@ page. The account configured here must be an Active Directory account and must h
Enterprise Auditor Console server’s local Task folders as well as sufficient rights to the
Enterprise Auditor database.
-There are two options that can be selected:
+You can select one of two options:
- Skip this step, I will configure a schedule service account later – Select this radio button to
skip this step and configure the schedule service account later
@@ -96,20 +97,20 @@ There are two options that can be selected:
-**Step 7 –** On the Options page, select whether to send usage statistics to Netwrix to help us
-improve our product. After the Usage Statistics option is set as desired, click **Next** to
+**Step 7 –** On the Options page, select whether to send usage statistics to Netwrix to help
+improve the product. After you set the Usage Statistics option as desired, click **Next** to
continue.
- If selected, usage statistics are collected and sent to Netwrix
- - Upon startup of the Enterprise Auditor console, the system checks if usage statistics have
- been sent in the last 7 days. If they have not been, stored procedures run against the
+ - Upon startup of the Enterprise Auditor console, the system checks whether it sent usage
+ statistics in the last 7 days. If not, stored procedures run against the
Enterprise Auditor database and gather data about job runs, access times, and environmental
- details like resource counts, users counts, number of exceptions, and so on. This data is then
- sent back to Netwrix to help us identify usage trends and common pain points, so that we can
- use this information to improve the product.
- - Only anonymous statistic-level data is included. No private company or personal data is
- collected or sent to Netwrix.
+ details like resource counts, user counts, number of exceptions, and so on. Enterprise Auditor
+ then sends this data back to Netwrix to help identify usage trends and common problem areas,
+ which Netwrix uses to improve the product.
+ - Enterprise Auditor includes only anonymous statistic-level data. It doesn't collect or send
+ private company or personal data to Netwrix.
- If cleared, no usage statistics are collected or sent to Netwrix
@@ -130,7 +131,7 @@ topic for more information about logs.
The Enterprise Auditor Console is now ready for custom configuration and use. There are a few
-additional steps to complete in order to begin collecting data, such as configuring a Connection
+additional steps to complete to begin collecting data, such as configuring a Connection
Profile and a Schedule Service account as well as discovering hosts and setting up host lists. See
the [Getting Started](/docs/accessanalyzer/11.6/gettingstarted.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/install/application/overview.md b/docs/accessanalyzer/11.6/install/application/overview.md
index 7145cb1cf8..1583ab308d 100644
--- a/docs/accessanalyzer/11.6/install/application/overview.md
+++ b/docs/accessanalyzer/11.6/install/application/overview.md
@@ -11,7 +11,7 @@ required when first launching the Enterprise Auditor Console. It also includes a
information, such as how to secure the Enterprise Auditor Database, and configuring the Web Console
for viewing reports outside of the Enterprise Auditor Console.
-Prior to installing Enterprise Auditor, please ensure that all of the prerequisites have been met.
+Before installing Enterprise Auditor, ensure that you've met all the prerequisites.
See the
[Requirements](/docs/accessanalyzer/11.6/requirements/overview.md)
topic for more information.
@@ -24,8 +24,8 @@ Your Netwrix Representative will provide the appropriate binaries.
- Enterprise Auditor binary – Core installation package
- Includes data collectors, analysis modules, and action modules
- - An organization’s license key, needed during installation, controls which components are laid
- down during installation
+ - An organization’s license key, needed during installation, controls which components the
+ installer includes
- Installs the Web Console
- File System Proxy binary – Installation package for the File System Proxy Scanning option
diff --git a/docs/accessanalyzer/11.6/install/application/reports/adfs.md b/docs/accessanalyzer/11.6/install/application/reports/adfs.md
index e29140093d..e52f7ea55e 100644
--- a/docs/accessanalyzer/11.6/install/application/reports/adfs.md
+++ b/docs/accessanalyzer/11.6/install/application/reports/adfs.md
@@ -6,11 +6,11 @@ sidebar_position: 80
# Configuring the Web Console to use ADFS
-The Enterprise Auditor Webserver and Access Information Center are able to support Single-Sign-On
+The Enterprise Auditor Webserver and Access Information Center can support Single-Sign-On
(SSO) leveraging WSFederation with SAML tokens. This guide contains steps for implementing SSO using
Active Directory Federation Services (ADFS).
-Follow the steps to configure the Web Console to use ADFS authentication:
+To configure the Web Console to use ADFS authentication:
:::note
A certificate from the ADFS server is required. Confer with a PKI administrator to
@@ -21,7 +21,7 @@ determine which certificate method will conform to the organization's security p
**Step 1 –** Import the certificate for the ADFS server onto the hosting server using the
Certificate Management MMC snap-in.
-- If used, self-signed certificates will also need to be imported
+- If you use self-signed certificates, you'll also need to import them
**Step 2 –** On the ADFS server, open **AD FS Management**.
@@ -33,7 +33,7 @@ Add Relying Party Trust Wizard to configure the relying party trust:
**Next**.
- On the Specify Display Name page, enter a display name for the relying party trust. Click
**Next**.
-- On the Configure URL page, do not select any options and click **Next**.
+- On the Configure URL page, don't select any options and click **Next**.
@@ -46,7 +46,7 @@ Add Relying Party Trust Wizard to configure the relying party trust:
-**Step 4 –** Double-click on the newly added relying party trust to open it's Properties window.
+**Step 4 –** Double-click the newly added relying party trust to open it's Properties window.
Navigate to the Endpoints tab and click **Add WS-Federation**. On the Add an Endpoint window, add
`https://:/federation` as the Trusted URL, then click **OK**.
@@ -65,7 +65,7 @@ right-hand panel.
- On the Configure Claim Rule page, enter a name in the **Claim rule name** field.
-If the SID claim is not configured by default, add it to the Claim Description as follows:
+If the SID claim isn't configured by default, add it to the Claim Description as follows:
@@ -120,13 +120,13 @@ The following is an example of how the parameters should look when configured in
**Step 9 –** Navigate to Services (`services.msc`). Restart the **Enterprise Auditor Web Server**
service.
-ADFS authentication is now enabled for Enterprise Auditor.
+You have now enabled ADFS authentication for Enterprise Auditor.
## Update the Published Reports URL for ADFS
-If ADFS does not accept `http://localhost:8082/` as an acceptable path, the path will need to be
-updated in the Published Reports properties window. Follow the steps to configure the Published
-Reports URL for ADFS:
+If ADFS doesn't accept `http://localhost:8082/` as an acceptable path, you'll need to update the
+path in the Published Reports properties window. To configure the Published
+Reports URL for ADFS:
**Step 1 –** Right-click the Published Reports shortcut on the desktop and select **Properties**.
@@ -136,4 +136,4 @@ Reports URL for ADFS:
**Step 3 –** Click **Apply**. Exit the window.
-The Published Reports URL is now configured for ADFS.
+You have now configured the Published Reports URL for ADFS.
diff --git a/docs/accessanalyzer/11.6/install/application/reports/disclaimer.md b/docs/accessanalyzer/11.6/install/application/reports/disclaimer.md
index d7832496dc..5b2d360a07 100644
--- a/docs/accessanalyzer/11.6/install/application/reports/disclaimer.md
+++ b/docs/accessanalyzer/11.6/install/application/reports/disclaimer.md
@@ -8,7 +8,7 @@ sidebar_position: 70
Users can add a disclaimer message to the logon screen by adding a custom `Disclaimer.txt` file in
the Web folder in the Enterprise Auditor directory and configuring the `WebServer.exe.config` file.
-Follow the steps to configure the optional disclaimer message:
+To configure the optional disclaimer message:
**Step 1 –** Navigate to the Web folder of the installation directory:
` …\STEALTHbits\StealthAUDIT\Web`.
@@ -18,8 +18,8 @@ Follow the steps to configure the optional disclaimer message:
**Step 2 –** Create a `Disclaimer.txt` file in the Web folder. Write a custom disclaimer that
displays on the login page for the Web Console.
-- The text file must be named `Disclaimer.txt`. The disclaimer message option is not configured
- properly if using a text file with a different name.
+- You must name the text file `Disclaimer.txt`. The disclaimer message option isn't configured
+ properly if you use a text file with a different name.
@@ -43,10 +43,10 @@ displays on the login page for the Web Console.
-**Step 7 –** To check if the disclaimer message was configured correctly, open the Web Console to
+**Step 7 –** To check whether you configured the disclaimer message correctly, open the Web Console to
access the login page.
-- If the disclaimer is configured correctly, the custom disclaimer message displays at the bottom of
+- If you configured the disclaimer correctly, the custom disclaimer message displays at the bottom of
the login page.
The disclaimer message displays on the Web Console login page.
diff --git a/docs/accessanalyzer/11.6/install/application/reports/domains.md b/docs/accessanalyzer/11.6/install/application/reports/domains.md
index 099995bc1c..caa1a5942e 100644
--- a/docs/accessanalyzer/11.6/install/application/reports/domains.md
+++ b/docs/accessanalyzer/11.6/install/application/reports/domains.md
@@ -8,23 +8,23 @@ sidebar_position: 30
When the `AuthenticationDomains` parameter in the **WebServer.exe.config** file is blank, only
domain users from the domain where the Enterprise Auditor Console resides can access the Web
-Console. Access can be granted from other domains when specified within this parameter.
+Console. You can grant access from other domains by specifying them within this parameter.
:::note
-Once another domain is added, then it is necessary to also add the domain where the
+After adding another domain, also add the domain where the
Enterprise Auditor Console resides.
:::
All domains provided or enumerated must have a trust relationship with the domain where Enterprise
-Auditor resides. Follow the steps to allow access to the Web Console from other domains.
+Auditor resides. To allow access to the Web Console from other domains:
**Step 1 –** Open the **WebServer.exe.config** file with a text editor, for example Notepad. It is
located within the Web folder of the Enterprise Auditor installation directory.
-**Step 2 –** Add the desired domains to the value for the `AuthenticationDomains` parameter:
+**Step 2 –** Add the domains you want to the value for the `AuthenticationDomains` parameter:
```
@@ -41,10 +41,10 @@ Use domain name in a comma-separated list. For example:
**Step 4 –** Navigate to Services (`services.msc`). Restart the Enterprise Auditor Web Server
service.
-The Web Console can now be accessed from multiple domains.
+You can now access the Web Console from multiple domains.
:::note
-In order for the AIC to be accessed from these domains, this must also be configured for
+To allow access to the AIC from these domains, you must also configure this for
the AIC. See the Multiple Domains topic in the
[Netwrix Access Information Center Documentation](https://helpcenter.netwrix.com/category/accessinformationcenter)
for additional information.
diff --git a/docs/accessanalyzer/11.6/install/application/reports/entraidsso.md b/docs/accessanalyzer/11.6/install/application/reports/entraidsso.md
index 6c0ee7bebd..199a8a2266 100644
--- a/docs/accessanalyzer/11.6/install/application/reports/entraidsso.md
+++ b/docs/accessanalyzer/11.6/install/application/reports/entraidsso.md
@@ -6,9 +6,9 @@ sidebar_position: 50
# Microsoft Entra ID Single Sign-On
-Microsoft Entra ID Single Sign-On (SSO) can be configured for logging in to the Web Console to view
-reports. When configured, users accessing the Web Console are directed to the Microsoft Entra
-ID login page, and can log in using their existing Entra credentials.
+You can configure Microsoft Entra ID Single Sign-On (SSO) for logging in to the Web Console to view
+reports. When configured, the Web Console directs users to the Microsoft Entra
+ID login page, where they can log in using their existing Entra credentials.
The following is required to use Microsoft Entra ID SSO:
@@ -20,9 +20,9 @@ ID, and then configure the Web Console to use it.
## Configure an Application in Microsoft Entra ID
-An application must be registered for the Web Console with your Microsoft Entra ID tenant and be
-configured with the necessary single sign-on settings. Follow the steps to create and configure the
-application.
+You must register an application for the Web Console with your Microsoft Entra ID tenant and
+configure it with the necessary single sign-on settings. To create and configure the
+application:
**Step 1 –** Sign into the [Microsoft Entra admin center](https://entra.microsoft.com/).
@@ -52,8 +52,8 @@ Configuration section. Add your Identifier and Reply URL, and then click **Save*
https://app0190.train90.local:8082/federation
```
-**Step 6 –** Next, click **Edit** on the Attributes & Claims section. The four claims in the table
-below are required. For each of these, click **Add new claim**, enter the information from the
+**Step 6 –** Next, click **Edit** on the Attributes & Claims section. The four claims in the
+following table are required. For each of these, click **Add new claim**, enter the information from the
table, and then click **Save**.
| Name | Namespace | Source attribute |
@@ -63,23 +63,23 @@ table, and then click **Save**.
| sid | http://schemas.xmlsoap.org/ws/2005/05/identity/claims | user.onpremisessecurityidentifier |
| upn | http://schemas.xmlsoap.org/ws/2005/05/identity/claims | user.onpremisesuserprincipalname |
-Once configured they should show under Additional claims as below:
+Once configured, they should show under Additional claims as follows:
**Step 7 –** In the **Manage** > **Users and groups** section for your application, add any required
users or groups to give permission to access the application.
-The application is now configured with the necessary settings. The next step is to enable the use of
-Microsoft Entra ID SSO in the web server config file.
+You have now configured the application with the necessary settings. The next step is to enable the
+use of Microsoft Entra ID SSO in the web server config file.
## Enable in the Web Server Config File
-To enable Microsoft Entra ID SSO for the Web Console, the web server config file needs to be updated
-with values from Microsoft Entra ID. Follow the steps to enable the SSO.
+To enable Microsoft Entra ID SSO for the Web Console, you need to update the web server config file
+with values from Microsoft Entra ID. To enable the SSO:
:::tip
-Remember, Enabling Entra ID SSO requires SSL to already have been enabled for the web server. See
+Before enabling Entra ID SSO, ensure you've already enabled SSL for the web server. See
the
[Securing the Web Console](/docs/accessanalyzer/11.6/install/application/reports/secure.md)
topic for additional information.
@@ -122,4 +122,4 @@ For example:
**Step 4 –** Navigate to Services (`services.msc`). Restart the Netwrix Enterprise Auditor Web
Server service.
-The Web Console has been enabled for Microsoft Entra ID single sign-on.
+You have now enabled the Web Console for Microsoft Entra ID single sign-on.
diff --git a/docs/accessanalyzer/11.6/install/application/reports/kerberosencryption.md b/docs/accessanalyzer/11.6/install/application/reports/kerberosencryption.md
index 17a8d67c76..3e811ebec4 100644
--- a/docs/accessanalyzer/11.6/install/application/reports/kerberosencryption.md
+++ b/docs/accessanalyzer/11.6/install/application/reports/kerberosencryption.md
@@ -10,28 +10,28 @@ If a computer's Local Security Policy, or applicable Group Policy, enforces cert
methods for Kerberos authentication, then the service account running the Enterprise Auditor Web
Server must support the same encryption methods.
-If encryption methods have been configured for Kerberos on the Enterprise Auditor server but not on
-the service account running the Enterprise Auditor Web Server service, then users will not be able
-to log-in to the Web Console and will receive the below error message.
+If you configured encryption methods for Kerberos on the Enterprise Auditor server but not on
+the service account running the Enterprise Auditor Web Server service, users won't be able
+to log in to the Web Console and will receive the following error message.
-When this occurs, the following error will be logged:
+When this occurs, Enterprise Auditor logs the following error:
_ERROR - Unhandled server error: Nancy.RequestExecutionException: Oh noes! --->
-System.Security.SecurityException: The encryption type requested is not supported by the KDC_.
+System.Security.SecurityException: The encryption type requested isn't supported by the KDC_.
-This error will be logged in the following location:
+Enterprise Auditor logs this error in the following location:
**%SAINSTALLDIR%\SADatabase\Logs\Web\service.log**
-While it is not required to configure these settings, this section provides the locations and steps
+While you don't need to configure these settings, this section provides the locations and steps
necessary to configure encryption methods in Local and Group policies to allow Kerberos for the
-Report Index if an error does occur.
+Report Index if an error occurs.
## Local Security Policies
-Follow the steps to configure a Local Security Policy to allow Kerberos.
+To configure a Local Security Policy to allow Kerberos:
**Step 1 –** Open the Local Security Policy window.
@@ -48,14 +48,14 @@ policy > click **Properties**.
**Step 5 –** Click **Apply**, then click **OK**.
-A Local Security Policy has been configured to allow encryption methods for Kerberos. Proceed to the
+You have now configured a Local Security Policy to allow encryption methods for Kerberos. Proceed to the
[Configure Active Directory Users and Computers Settings to allow Kerberos](#configure-active-directory-users-and-computers-settings-to-allow-kerberos)
section of this topic to ensure Active Directory Users and Computer settings are configured to allow
the encryption methods for Kerberos.
## Group Security Policy
-Follow the steps to configure a Local Group Security Policy to allow Kerberos.
+To configure a Local Group Security Policy to allow Kerberos:
**Step 1 –** Open the Local Group Policy Editor window.
@@ -73,7 +73,7 @@ policy, then click **Properties**.
**Step 5 –** Click **Apply**, then click **OK**.
-A Local Group Security Policy has been configured to allow encryption methods for Kerberos. Proceed
+You have now configured a Local Group Security Policy to allow encryption methods for Kerberos. Proceed
to the
[Configure Active Directory Users and Computers Settings to allow Kerberos](#configure-active-directory-users-and-computers-settings-to-allow-kerberos)
section of this topic to ensure Active Directory Users and Computer settings are configured to allow
@@ -81,9 +81,9 @@ the encryption methods for Kerberos.
## Configure Active Directory Users and Computers Settings to allow Kerberos
-Follow the steps to ensure the settings for Active Directory Users and Computers are configured to
-allow the encryption methods to allow Kerberos. Configurations selected in this section should
-reflect the configuration options selected in the two sections above. See the
+To ensure that the settings for Active Directory Users and Computers allow the encryption methods
+for Kerberos, match the configuration options you select in this section to those you selected in
+the two preceding sections. See the
[Local Security Policies](#local-security-policies) and
[Group Security Policy](#group-security-policy) topics for additional information.
@@ -103,6 +103,6 @@ reflect the configuration options selected in the two sections above. See the
**Step 6 –** Click **Apply**, then click **OK**.
-Active Directory Users and Computer settings have been configured to allow the encryption methods
-for Kerberos. These settings should match the configuration options for Local Security Policies and
-Local Group Policies.
+You have now configured Active Directory Users and Computer settings to allow the encryption
+methods for Kerberos. These settings should match the configuration options for Local Security
+Policies and Local Group Policies.
diff --git a/docs/accessanalyzer/11.6/install/application/reports/okta.md b/docs/accessanalyzer/11.6/install/application/reports/okta.md
index 8f4bffc8cb..027097a99d 100644
--- a/docs/accessanalyzer/11.6/install/application/reports/okta.md
+++ b/docs/accessanalyzer/11.6/install/application/reports/okta.md
@@ -8,7 +8,7 @@ sidebar_position: 90
Create an Enterprise Auditor Application in Okta Using the WS-Fed Template
-Follow the steps to create an Enterprise Auditor Application in Okta Using the WS-Fed Template:
+To create an Enterprise Auditor Application in Okta using the WS-Fed template:
**Step 1 –** Log in to Okta.
@@ -28,12 +28,12 @@ Retrieve the Values to Paste into the Enterprise Auditor WebServer.exe.config Fi
**Step 1 –** In the Enterprise Auditor application, click the **Sign On** tab.
-**Step 2 –** Right click on the **Identity Provider metadata** link and select **Copy Link Address**
+**Step 2 –** Right click the **Identity Provider metadata** link and select **Copy Link Address**
to get the value for the WSFederationMetadata URL.
****
-**Step 3 –** Click on the General tab to copy the value for the **Realm**. This value will be unique
+**Step 3 –** Click the General tab to copy the value for the **Realm**. This value will be unique
per tenant.
`https://www.okta.com/`
@@ -44,7 +44,7 @@ per tenant.
Edit the WebServer.exe.config File
-Follow the steps to edit the **WebServer.exe.config** file:
+To edit the **WebServer.exe.config** file:
**Step 1 –** Open the **WebServer.exe.config** file with a text editor, such as Notepad++. It is
located in the Web folder within the Enterprise Auditor installation.
@@ -110,7 +110,7 @@ to populate the following fields.
-**Step 2 –** Navigate to the Directory menu and select **Profile Editor** from the drop-down menu.
+**Step 2 –** Navigate to the Directory menu and select **Profile Editor** from the dropdown menu.
Click the **Edit Profile** button for the Enterprise Auditor application.
@@ -137,12 +137,12 @@ attribute, click **Save and Add Another**.
-**Step 5 –** Navigate to the **Directory** menu and click on the **Provisioning** tab. Click **To
+**Step 5 –** Navigate to the **Directory** menu and click the **Provisioning** tab. Click **To
Okta**.
-**Step 6 –** Locate and map the attributes that were added for the profile by clicking the
+**Step 6 –** Locate and map the attributes that you added for the profile by clicking the
**Pencil** icon to edit attributes. To locate the attributes, scroll down and select **Show Unmapped
Attributes**.
@@ -164,7 +164,7 @@ additional information.
## Setting Up Multi-Factor Authentication
-Follow the steps to configure multi-factor-authentication for Enterprise Auditor:
+To configure multi-factor authentication for Enterprise Auditor:
@@ -180,4 +180,4 @@ opens. Configure the following options:
**Step 2 –** Scroll down to the Access section. Check the **Prompt for factor** box and select
**Every Sign On**. Click **Save**.
-Multi-Factor Authentication is now configured for Enterprise Auditor.
+You have now configured Multi-Factor Authentication for Enterprise Auditor.
diff --git a/docs/accessanalyzer/11.6/install/application/reports/overview.md b/docs/accessanalyzer/11.6/install/application/reports/overview.md
index d416e16a26..409ef77a72 100644
--- a/docs/accessanalyzer/11.6/install/application/reports/overview.md
+++ b/docs/accessanalyzer/11.6/install/application/reports/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# Reports via the Web Console
-The Web Console is where any reports which have been published can be viewed outside of the
-Enterprise Auditor Console.
+The Web Console is where you can view any reports that Enterprise Auditor has published, outside
+of the Enterprise Auditor Console.
- Web Console – This console uses an embedded website for published reports. It provides a
consolidated logon feature for viewing published reports, and accessing the Netwrix Access
@@ -41,25 +41,25 @@ topic for additional information on configuring security polices to allow Kerber
## Log into the Web Console
-In order for a user to log into the Web Console, the user’s account must have the User Principal
+To log into the Web Console, a user's account must have the User Principal
Name (UPN) attribute populated within Active Directory. Then the user can login using domain
-credentials. If multiple domains are being managed by the Netwrix Access Information Center, then
+credentials. If the Netwrix Access Information Center manages multiple domains,
the username needs to be in the `domain\username` format.
-Access to reports in the Web Console can be managed through the Role Based Access feature of
+You can manage access to reports in the Web Console through the Role Based Access feature of
Enterprise Auditor (**Settings** > **Access**). The Web Administrator role and the Report Viewer
role grant access to the published reports. See the
[Role Based Access](/docs/accessanalyzer/11.6/admin/settings/access/rolebased/overview.md)
topic for addition information.
:::note
-Access to the AIC and other Netwrix products is controlled from within those products.
+You control access to the AIC and other Netwrix products from within those products.
:::
-The address to the Web Console can be configured within the Enterprise Auditor Console
+You can configure the address to the Web Console within the Enterprise Auditor Console
(**Settings** > **Reporting**). The default address is `http://[hostname.domain.com]:8082`. From the
-Enterprise Auditor Console server, it can be accessed at `http://localhost/` with any standard
+Enterprise Auditor Console server, you can access it at `http://localhost/` with any standard
browser. To access the Web Console from another machine in or connected to the environment, replace
localhost with the name of the Enterprise Auditor Console. See the
[Update Website URLs](/docs/accessanalyzer/11.6/install/application/reports/secure.md#update-website-urls)
@@ -73,7 +73,7 @@ topic for additional information.
:::
-Follow the steps to login to the Web Console.
+To log in to the Web Console:
**Step 1 –** To open the Web Console page, use one of the following methods:
@@ -84,7 +84,7 @@ Follow the steps to login to the Web Console.
- `https://[machinename]:8082`
:::note
-The URL that is used may need to be added to the browser’s list of trusted sites.
+You may need to add the URL you use to the browser’s list of trusted sites.
:::
diff --git a/docs/accessanalyzer/11.6/install/application/reports/secure.md b/docs/accessanalyzer/11.6/install/application/reports/secure.md
index 8b90dedecb..c63f385973 100644
--- a/docs/accessanalyzer/11.6/install/application/reports/secure.md
+++ b/docs/accessanalyzer/11.6/install/application/reports/secure.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Securing the Web Console
-Published reports can be accessed in the Web Console. There are several options for enhancing
+You can access published reports in the Web Console. There are several options for enhancing
security.
Additional configuration options for enhanced security include:
@@ -29,13 +29,13 @@ Additional configuration options for enhanced security include:
:::
-These parameters can be configured within the **WebServer.exe.config** file in the Web folder of the
-Enterprise Auditor installation directory `…\STEALTHbits\StealthAUDIT\Web`.
+You can configure these parameters within the **WebServer.exe.config** file in the Web folder of
+the Enterprise Auditor installation directory `…\STEALTHbits\StealthAUDIT\Web`.
## Enable SSL for the Web Console
-To enable Secure Sockets Layer (SSL) for secure, remote connections to the Web Console it is
-necessary to bind a certificate to the port. See the
+To enable Secure Sockets Layer (SSL) for secure, remote connections to the Web Console, bind a
+certificate to the port. See the
[Use a Self-Signed Certificate for SSL](#use-a-self-signed-certificate-for-ssl) topic for more
information. Follow the steps on the server where Enterprise Auditor is installed to enable SSL for
the Web Console.
@@ -43,7 +43,7 @@ the Web Console.
:::note
The following steps require a certificate to be available. Organizations typically have
one or more system administrators responsible for Public Key Infrastructure (PKI) and certificates.
-To continue with this configuration it will first be necessary to confer with the PKI administrator
+Before continuing with this configuration, confer with the PKI administrator
to determine which certificate method will conform to the organization’s security policies.
Optionally, see [Use a Self-Signed Certificate for SSL](#use-a-self-signed-certificate-for-ssl) for
an Administrator PowerShell command which will both create and import a self-signed certificate.
@@ -54,16 +54,16 @@ an Administrator PowerShell command which will both create and import a self-sig
snap-in.
:::note
-If using a self-signed certificate, it will also need to be imported.
+If you use a self-signed certificate, you'll also need to import it.
:::
-**Step 2 –** Create an SSL binding. It is necessary to use the certificate’s **Hash** value for the
+**Step 2 –** Create an SSL binding. Use the certificate's **Hash** value for the
`$certHash` value:
:::note
-The following Administrator PowerShell dir command can be run on the certificate's “drive”
-to find the **Hash** value of a certificate which was already created and the output will include
+You can run the following Administrator PowerShell dir command on the certificate's “drive”
+to find the **Hash** value of a certificate that you already created; the output includes
the Thumbprint (**Hash**) value and the certificate name:
:::
@@ -94,8 +94,8 @@ located within the Web folder of the Enterprise Auditor installation directory.
```
-- After changing the `BindingUrl` value in the **WebServer.exe.config** file, the Website URL must
- be updated to match the new value in the following places:
+- After changing the `BindingUrl` value in the **WebServer.exe.config** file, you must update the
+ Website URL to match the new value in the following places:
- Enterprise Auditor's **Settings** > **Reporting** node
- Enterprise Auditor's Published Reports Desktop icon properties
- See the [Update Website URLs](#update-website-urls) topic for additional information.
@@ -106,30 +106,30 @@ located within the Web folder of the Enterprise Auditor installation directory.
Server service.
:::note
-If also using the AIC, then SSL needs to be enabled for the AIC using this certificate.
+If you also use the AIC, you need to enable SSL for the AIC using this certificate.
See the Securing the AIC section of the
[Netwrix Access Information Center Documentation](https://helpcenter.netwrix.com/category/accessinformationcenter)
for additional information.
:::
-The Web Console has been enabled for SSL communication. Access it using the server’s fully qualified
-domain name and the HTTPS port (`https://[hostname.domain.com]:8082`). If a self-signed certificate
-was used, then the client-side access to the Web Console will generate a Certificate error. See the
+You have now enabled the Web Console for SSL communication. Access it using the server’s fully
+qualified domain name and the HTTPS port (`https://[hostname.domain.com]:8082`). If you used a
+self-signed certificate, client-side access to the Web Console will generate a Certificate error. See the
[Add the Certificate for Client-Side Access](#add-the-certificate-for-client-side-access) topic for
additional information.
### Update Website URLs
-If the Binding URL value is updated in Enterprise Auditor's **WebServer.exe.config** file, the
-Website URL must be updated to match the new value in the following places:
+If you update the Binding URL value in Enterprise Auditor's **WebServer.exe.config** file, you must
+update the Website URL to match the new value in the following places:
- Enterprise Auditor's Reporting node (**Settings** > **Reporting**)
- Enterprise Auditor's Published Reports Desktop icon properties
**Update the Website URL in the Reporting Node**
-Follow the steps to update the Website URL in the **Settings** > **Reporting** node.
+To update the Website URL in the **Settings** > **Reporting** node:
**Step 1 –** Expand **Settings** and select the **Reporting** node.
@@ -139,14 +139,14 @@ Follow the steps to update the Website URL in the **Settings** > **Reporting** n
**Step 3 –** Click **Save**.
-The Website URL is now updated.
+You have now updated the Website URL.
Update the URL in the Published Reports Desktop Icon Properties
-Follow the steps to update the URL in the Published Reports desktop icon's Published Report's
-Properties window.
+To update the URL in the Published Reports desktop icon's Published Report's
+Properties window:
-**Step 1 –** Right click on the **Published Reports** desktop shortcut and click **Properties**.
+**Step 1 –** Right click the **Published Reports** desktop shortcut and click **Properties**.
@@ -155,7 +155,7 @@ Properties window.
**Step 3 –** Click **Apply** and then **OK** to exit.
-The URL is now updated.
+You have now updated the URL.
### Remove Certificate from the Port
@@ -196,8 +196,8 @@ The Thumbprint value is the certificate **Hash** value to be used when binding t
can be the same as in HTTP (8082). Use this **Hash** value for Step 2 of the
[Enable SSL for the Web Console](#enable-ssl-for-the-web-console) instructions.
-Creation and import of the self-signed certificate can be validated in Microsoft Management Console.
-Follow these steps to confirm the certificate is in Microsoft Management Console.
+You can validate creation and import of the self-signed certificate in Microsoft Management Console.
+To confirm the certificate is in Microsoft Management Console:
**Step 1 –** Open Microsoft Management Console (`mmc.exe`).
@@ -219,14 +219,14 @@ window. Click **OK** to close the window.
**Step 5 –** Navigate to **Certificates** > **Personal** > **Certificates**. The certificate should
show in the pane on the right.
-The self-signed certificate was created and imported. Repeat these steps for each client-side host.
+You created and imported the self-signed certificate. Repeat these steps for each client-side host.
### Add the Certificate for Client-Side Access
When you open the Web Console with SSL enabled, the web browser shows a Your connection isn't
-private warning message. This can be removed by importing the certificate onto the client server.
+private warning message. You can remove this by importing the certificate onto the client server.
-Follow the steps to remove the certificate error.
+To remove the certificate error:
**Step 1 –** Open the Web Console in your browser.
@@ -242,7 +242,7 @@ Viewer from the warning details.
- In Microsoft Edge, click the **Your Connection to this site isn't secure** section, and then click
the certificate icon.
-- In Google Chrome, click **Certificate is not valid**.
+- In Google Chrome, click **Certificate isn't valid**.
diff --git a/docs/accessanalyzer/11.6/install/application/reports/sso.md b/docs/accessanalyzer/11.6/install/application/reports/sso.md
index 60a9d1acbb..2ea71837a0 100644
--- a/docs/accessanalyzer/11.6/install/application/reports/sso.md
+++ b/docs/accessanalyzer/11.6/install/application/reports/sso.md
@@ -6,10 +6,10 @@ sidebar_position: 40
# Enable Single Sign-On
-Single sign-on using Windows authentication allows users to be automatically log into the Web
-Console according to the user’s current login session. When opening a session from a different
-domain, the user will be prompted for credentials from a pop-up windows. After authenticating, the
-user will be automatically logged in the Web Console.
+With single sign-on using Windows authentication, the Web Console automatically logs users in
+according to the user's current login session. When a user opens a session from a different
+domain, a pop-up window prompts the user for credentials. After the user authenticates, the Web
+Console automatically logs the user in.
:::note
The Web Console also supports using Microsoft Entra ID single sign-on. See the
@@ -18,7 +18,7 @@ topic for additional information.
:::
-Follow the steps to enable single sign-on for the Web Console.
+To enable single sign-on for the Web Console:
**Step 1 –** Open the **WebServer.exe.config** file with a text editor, for example Notepad. It is
located within the Web folder of the Enterprise Auditor installation directory.
@@ -36,15 +36,15 @@ located within the Web folder of the Enterprise Auditor installation directory.
**Step 4 –** Navigate to Services (`services.msc`). Restart the Netwrix Enterprise Auditor Web
Server service.
-The Web Console has been enabled for single sign-on.
+You have now enabled the Web Console for single sign-on.
## Local Intranet Settings
-Next, configure local intranet settings to enable SSO. This enables users to have authentication
-pass through Windows Authentication and bypass SSO configuration Prompts for credentials via Browser
-pop-up.
+Next, configure local intranet settings to enable SSO. This lets authentication
+pass through Windows Authentication and bypass SSO configuration prompts for credentials through a
+browser pop-up.
-Follow the steps to configure local intranet settings.
+To configure local intranet settings:
**Step 1 –** Open Windows Internet Properties (**Control Panel** > **Network and
Internet** > **Internet Options**).
@@ -71,7 +71,7 @@ Authentication will now pass through Windows Authentication and bypass SSO confi
credentials via Browser pop-up
:::note
-A list of allowed authentication servers can also be configured using the
+You can also configure a list of allowed authentication servers using the
AuthServerAllowList policy.
:::
diff --git a/docs/accessanalyzer/11.6/install/application/reports/timeout.md b/docs/accessanalyzer/11.6/install/application/reports/timeout.md
index 81686320ae..0e0eb05a31 100644
--- a/docs/accessanalyzer/11.6/install/application/reports/timeout.md
+++ b/docs/accessanalyzer/11.6/install/application/reports/timeout.md
@@ -6,19 +6,19 @@ sidebar_position: 60
# Timeout Parameter for the Web Console
-The Web Console is configured with a default timeout parameter of 15 minutes. This can be configured
-within the **WebServer.exe.config** file in the Web folder of the Enterprise Auditor installation
-directory:
+By default, Enterprise Auditor configures the Web Console with a timeout parameter of 15 minutes.
+You can configure this within the **WebServer.exe.config** file in the Web folder of the Enterprise
+Auditor installation directory:
**…\STEALTHbits\StealthAUDIT\Web**
-Follow the steps to modify the timeout parameter for the Web Console.
+To modify the timeout parameter for the Web Console:
**Step 1 –** Open the **WebServer.exe.config** file with a text editor, for example Notepad.
-**Step 2 –** Change the value for the `SessionTimeout` parameter to the desired number of minutes:
+**Step 2 –** Change the value for the `SessionTimeout` parameter to the number of minutes you want:
```
diff --git a/docs/accessanalyzer/11.6/install/application/updatelicense.md b/docs/accessanalyzer/11.6/install/application/updatelicense.md
index 930904074c..5fb4bc7db2 100644
--- a/docs/accessanalyzer/11.6/install/application/updatelicense.md
+++ b/docs/accessanalyzer/11.6/install/application/updatelicense.md
@@ -6,22 +6,23 @@ sidebar_position: 60
# Update License Key
-It is necessary to install a new license key for an existing Enterprise Auditor installation due to
+Install a new license key for an existing Enterprise Auditor installation due to
the following:
- To renew a Enterprise Auditor license that is due to expire
- To grant access to additional Solutions
-In these situations it is possible to update the license file without going through the full
+In these situations, you can update the license file without going through the full
installation process.
## Install a New License File
-Follow the steps to update the Enterprise Auditor license key without installing a new version of
-the Enterprise Auditor Console.
+To update the Enterprise Auditor license key without installing a new version of
+the Enterprise Auditor Console:
-**Step 1 –** Ensure the new `StealthAUDIT.lic` license file is stored locally on the Enterprise
-Auditor Console server in order to be referenced during the installation process.
+**Step 1 –** Ensure that you store the new `StealthAUDIT.lic` license file locally on the
+Enterprise Auditor Console server so that the installer can reference it during the installation
+process.
@@ -42,14 +43,15 @@ Features**), select the Enterprise Auditor application and click **Change**.
| Default License File Page | | Mapped License File |
**Step 5 –** On the License File page, click **Browse** and navigate to the **StealthAUDIT.lic**
-file. It must be stored on the Enterprise Auditor Console server before the installation begins.
-When the path to the file is visible in the text box, click **Next**. The license will be imported.
+file. You must store it on the Enterprise Auditor Console server before the installation begins.
+When the path to the file is visible in the text box, click **Next**. Enterprise Auditor imports
+the license.
**Step 6 –** The License Features page displays a list of all features covered by the imported
license. It also displays the name of the organization which owns the license, the expiration date,
-and the host limit. These are the features that will be installed. Click **Next**.
+and the host limit. These are the features that Enterprise Auditor will install. Click **Next**.
@@ -59,5 +61,5 @@ and the host limit. These are the features that will be installed. Click **Next*
**Step 8 –** When the installation has completed, click **Finish** to exit the wizard.
-The new license file has been imported. If the license granted access to any additional solutions,
-they will now be accessible from within the Enterprise Auditor Console.
+You have now imported the new license file. If the license granted access to any additional
+solutions, you can now access them from within the Enterprise Auditor Console.
diff --git a/docs/accessanalyzer/11.6/install/application/upgrade/overview.md b/docs/accessanalyzer/11.6/install/application/upgrade/overview.md
index ae67dee744..63bfc607b0 100644
--- a/docs/accessanalyzer/11.6/install/application/upgrade/overview.md
+++ b/docs/accessanalyzer/11.6/install/application/upgrade/overview.md
@@ -11,15 +11,14 @@ that are no longer supported, contact [Netwrix Support](https://www.netwrix.com/
assistance.
:::note
-If any customizations have been done by a Netwrix Engineer, please ensure custom work is
-not lost during the upgrade process. While using the Upgrade Wizard, customizations are archived
-prior to solution upgrades. These archives are available after the solution upgrades have been
-completed. Contact [Netwrix Support](https://www.netwrix.com/support.html) for additional
+If a Netwrix Engineer has made any customizations, ensure custom work isn't lost during the
+upgrade process. The Upgrade Wizard archives customizations before solution upgrades. These
+archives are available after the solution upgrades finish. Contact [Netwrix Support](https://www.netwrix.com/support.html) for additional
information.
:::
-The purpose of this document is to provide the basic steps needed for upgrading Enterprise Auditor
+This document provides the basic steps needed for upgrading Enterprise Auditor
and the stock solutions. Contact [Netwrix Support](https://www.netwrix.com/support.html) for
additional information.
@@ -28,11 +27,11 @@ additional information.
**Multiple Enterprise Auditor Consoles Connecting to the Same Database**
-In environments where multiple Enterprise Auditor Consoles are using the same SQL Server database,
-every console using the database must also be updated. The act of connecting a Enterprise Auditor
-Console with a newer version to a database updates the database’s schema pursuant to the new
-definition. If a Enterprise Auditor Console with an older version connects to the same database
-after the schema has been updated, corruption to Enterprise Auditor’s system tables can result.
+In environments where multiple Enterprise Auditor Consoles use the same SQL Server database, you
+must also update every console using the database. Connecting an Enterprise Auditor Console with a
+newer version to a database updates the database’s schema according to the new definition. If an
+Enterprise Auditor Console with an older version connects to the same database after you update the
+schema, corruption to Enterprise Auditor’s system tables can result.
**SQL Server Supported Version Change for the Enterprise Auditor Database**
diff --git a/docs/accessanalyzer/11.6/install/application/upgrade/solutionconsiderations.md b/docs/accessanalyzer/11.6/install/application/upgrade/solutionconsiderations.md
index 2d697a8e09..0afed2dd70 100644
--- a/docs/accessanalyzer/11.6/install/application/upgrade/solutionconsiderations.md
+++ b/docs/accessanalyzer/11.6/install/application/upgrade/solutionconsiderations.md
@@ -6,14 +6,14 @@ sidebar_position: 10
# Solution Upgrade Considerations
-The following items must be taken into consideration for upgrades:
+Consider the following items for upgrades:
**Access Information Center**
-- Should be upgraded at the same time as Enterprise Auditor.
+- Upgrade it at the same time as Enterprise Auditor.
:::note
- The Enterprise Auditor upgrade should be completed first.
+ Complete the Enterprise Auditor upgrade first.
:::
@@ -23,15 +23,18 @@ instructions.
**Sensitive Data Discovery Add-on**
-- Needs to be updated on all servers where it was installed. See the
+- Update it on all servers where you installed it. See the
[Upgrade Sensitive Data Discovery Add-on](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/upgrade.md)
topic for instructions.
-- **CAUTION:** The new global Settings will overwrite any previously configured criteria. Make a
- note of any configured Sensitive Data Criteria before upgrading Enterprise Auditor. Sensitive Data
- Criteria must be reconfigured after an upgrade.
-With the new global experience, sensitive data criteria selection is configured globally and used by
-default in all solution sets. See the
+ :::warning
+ The new global Settings will overwrite any previously configured criteria. Make a
+ note of any configured Sensitive Data Criteria before upgrading Enterprise Auditor. You must
+ reconfigure Sensitive Data Criteria after an upgrade.
+ :::
+
+With the new global experience, you configure sensitive data criteria selection globally, and
+Enterprise Auditor uses it by default in all solution sets. See the
[Configure Global Sensitive Data Settings](#configure-global-sensitive-data-settings) for additional
information.
@@ -44,7 +47,7 @@ information.
**File System Solution Considerations**
-- For Proxy Mode as a Service – File System Proxy Service needs to be updated on the proxy servers.
+- For Proxy Mode as a Service – Update the File System Proxy Service on the proxy servers.
See the
[Upgrade Proxy Service Procedure](/docs/accessanalyzer/11.6/install/filesystemproxy/upgrade.md)
topic for instructions.
@@ -55,8 +58,8 @@ information.
**SharePoint Solution Considerations**
-- For SharePoint Agent – Enterprise Auditor SharePoint Agent needs to be updated on the SharePoint
- server where it was installed. See the
+- For SharePoint Agent – Update the Enterprise Auditor SharePoint Agent on the SharePoint
+ server where you installed it. See the
[Upgrade SharePoint Agent](/docs/accessanalyzer/11.6/install/sharepointagent/upgrade.md)
section for instructions.
- For Activity – Ensure the Stealthbits Activity Monitor is a compatible version. See the Upgrade
@@ -80,7 +83,7 @@ After upgrading to Enterprise Auditor 11.6, run the latest version of the **File
**0.Collection** > **0-Create Schema** job to migrate the File System Solution to the latest
database schema.
-This database schema migration should be performed before running other jobs in the File System
+Perform this database schema migration before running other jobs in the File System
Solution after upgrading to Enterprise Auditor 11.6.
See the
@@ -91,23 +94,23 @@ topic for additional information.
:::warning
The new global Settings will overwrite any previously configured criteria. Make a note
-of any configured Sensitive Data Criteria before commencing the upgrade Enterprise Auditor.
-Sensitive Data Criteria must be reconfigured after an upgrade.
+of any configured Sensitive Data Criteria before upgrading Enterprise Auditor.
+You must reconfigure Sensitive Data Criteria after an upgrade.
:::
-If Sensitive Data Criteria are configured differently for each solution, re-configure the criteria
+If you configured Sensitive Data Criteria differently for each solution, re-configure the criteria
selection at the solution level. See the
[Sensitive Data Discovery Add-On](/docs/accessanalyzer/11.6/sensitivedatadiscovery/overview.md)
topic and the topic for the applicable solution for additional information.
-If the same Sensitive Data Criteria are used for all solutions, configure the criteria selection at
-the global **Settings** > **Sensitive Data** node, which will then be used by default in all
+If you use the same Sensitive Data Criteria for all solutions, configure the criteria selection at
+the global **Settings** > **Sensitive Data** node; Enterprise Auditor then uses it by default in all
solutions. See the
[Sensitive Data Discovery Add-On](/docs/accessanalyzer/11.6/sensitivedatadiscovery/overview.md)
topic for additional information.
-Follow the steps to configure Sensitive Data Criteria at the global level.
+To configure Sensitive Data Criteria at the global level:
**Step 1 –** The Sensitive Data node provides configuration options to manage sensitive data
criteria and false positive exclusion filters. These settings require the Sensitive Data Discovery
@@ -117,16 +120,17 @@ topic for additional information.
-**Step 2 –** If the same Sensitive Data Criteria are used for all solutions, configure the criteria
-selection at the global Settings level, which will then be used by default in all solution sets.
+**Step 2 –** If you use the same Sensitive Data Criteria for all solutions, configure the criteria
+selection at the global Settings level; Enterprise Auditor then uses it by default in all solution
+sets.
Navigate to the **Settings** > **Sensitive Data** node and click **Add** to open the Select Criteria
window.
-**Step 3 –** Select the desired criteria. Use the **Search Criteria** text field to filter the list
+**Step 3 –** Select the criteria you want. Use the **Search Criteria** text field to filter the list
using keywords or expand each category to view and select individual Sensitive Data search criteria,
then click **OK**.
-By default, Sensitive Data Criteria configured at the global Settings level is inherited down to the
-applicable solutions.
+By default, Enterprise Auditor applies Sensitive Data Criteria configured at the global Settings
+level to the applicable solutions.
diff --git a/docs/accessanalyzer/11.6/install/application/upgrade/wizard.md b/docs/accessanalyzer/11.6/install/application/upgrade/wizard.md
index 21571813a9..4cf94b55d9 100644
--- a/docs/accessanalyzer/11.6/install/application/upgrade/wizard.md
+++ b/docs/accessanalyzer/11.6/install/application/upgrade/wizard.md
@@ -7,19 +7,18 @@ sidebar_position: 20
# Enterprise Auditor Core Upgrade Instructions
:::warning
-If Role Based Access has been enabled, a user with the Administrator role must perform
-the upgrade. Other user roles do not have the necessary permissions to perform upgrades.
+If you enabled Role Based Access, a user with the Administrator role must perform
+the upgrade. Other user roles don't have the necessary permissions to perform upgrades.
:::
-Follow the steps to upgrade to Enterprise Auditor 11.6 on the same server where an older version of
-Enterprise Auditor is installed.
+To upgrade to Enterprise Auditor 11.6 on the same server where an older version of
+Enterprise Auditor is installed:
:::note
-If any customizations have been done by a Netwrix Engineer, please ensure the custom work
-is not lost during the upgrade process. While using the Upgrade Wizard, customizations are archived
-prior to solution upgrades. These archives are available after the solution upgrades have been
-completed. Contact [Netwrix Support](https://www.netwrix.com/support.html) for additional
+If a Netwrix Engineer has made any customizations, ensure the custom work isn't lost during the
+upgrade process. The Upgrade Wizard archives customizations before solution upgrades. These
+archives are available after the solution upgrades finish. Contact [Netwrix Support](https://www.netwrix.com/support.html) for additional
information.
:::
@@ -27,7 +26,7 @@ information.
:::warning
The new global Settings will overwrite any previously configured Sensitive Data
criteria. Make a note of any configured Sensitive Data Criteria before upgrading Enterprise Auditor.
-Sensitive Data Criteria must be reconfigured after an upgrade. See the
+You must reconfigure Sensitive Data Criteria after an upgrade. See the
[Configure Global Sensitive Data Settings](/docs/accessanalyzer/11.6/install/application/upgrade/solutionconsiderations.md#configure-global-sensitive-data-settings)
topic for additional information.
:::
@@ -39,9 +38,9 @@ topic for additional information.
Features**), uninstall the previous version of Enterprise Auditor. Jobs, application configuration
files, and reports remain in the installation directory after the uninstall process.
-- The `WebServer.exe.config` file is automatically retained in a Backup folder created under the Web
- folder of the installation directory. Any custom application settings contained in this file are
- kept as part of this upgrade process.
+- Enterprise Auditor automatically retains the `WebServer.exe.config` file in a Backup folder created
+ under the Web folder of the installation directory. It keeps any custom application settings
+ contained in this file as part of this upgrade process.
@@ -49,31 +48,31 @@ files, and reports remain in the installation directory after the uninstall proc
[Enterprise Auditor Core Installation](/docs/accessanalyzer/11.6/install/application/wizard.md)
topic for detailed instructions.
-- Before installation, ensure the new `StealthAUDIT.lic` license file is stored locally on the
- Enterprise Auditor Console in order to be referenced during the installation process
-- Enterprise Auditor is installed to the following directory by default:
+- Before installation, ensure that you store the new `StealthAUDIT.lic` license file locally on the
+ Enterprise Auditor Console so that the installer can reference it during the installation process
+- By default, the installer places Enterprise Auditor in the following directory:
`…\STEALTHbits\StealthAUDIT`
- If another installation path is designated, please be sure to leave `STEALTHbits\StealthAUDIT`
+ If you designate another installation path, be sure to leave `STEALTHbits\StealthAUDIT`
as the path suffix in the installation wizard.
-- During the installation, any customizations to the settings in the `WebServer.exe.config` file are
- automatically restored from the backup file retained when installing the previous version. The
- `../Web/Backup` folder is deleted after the settings have been restored.
+- During the installation, Enterprise Auditor automatically restores any customizations to the
+ settings in the `WebServer.exe.config` file from the backup file retained when installing the
+ previous version. It deletes the `../Web/Backup` folder after restoring the settings.
-After the installation is completed, the upgrade wizard launches from the Enterprise Auditor desktop
+After the installation finishes, the upgrade wizard launches from the Enterprise Auditor desktop
icon.
## Upgrade Wizard
-Once the Enterprise Auditor installation process is complete, it is necessary to go through the
+After the Enterprise Auditor installation process finishes, go through the
Upgrade Wizard. There are three Upgrade options for a solution:
- Full Upgrade – Performs a full synchronization of the directory and file structure of the solution
to mirror the Instant Solution
- Upgrade in place – Performs file content updates of jobs matching the Instant Solutions but does
not change the Jobs tree structure
-- Do not upgrade – No upgrade is performed, leaving the previous version of the solution
+- Don't upgrade – Performs no upgrade, leaving the previous version of the solution
The default settings configured within the Advanced Upgrade Options window align with the best
practices of the Netwrix Professional Services and Support teams.
@@ -85,25 +84,25 @@ Upgrade action is set to **Full Upgrade** or **Upgrade in place**:
| -------- | ----------------------------------------------------------------------------------- | -------------------- | ------------------------ |
| Normal | Job exists in Locked state and has matching ID in Instant Solutions | Upgrade | Upgrade |
| New | Job exists in Instant Solutions but not in the Jobs tree for an existing solution | Install | Install |
-| Removed | Job exists in Locked state in the Jobs tree but does not exist in Instant Solutions | Delete | Nothing |
+| Removed | Job exists in Locked state in the Jobs tree but doesn't exist in Instant Solutions | Delete | Nothing |
| Copied | Original job exists in original location, but multiple instances of the job exists | Delete | Upgrade |
| Moved | Original job exists but in a different location than in the Instant Solutions | Move & Upgrade | Upgrade |
| Renamed | Job found via ID match but was renamed | Rename & Upgrade | Upgrade |
| Conflict | Changes have been made to the job | Overwrite | Overwrite |
-Conflicts are identified when customizations have been made by either a user or a Netwrix engineer.
-Conflicts need to be either resolved prior to the upgrade action or manually applied after the
-upgrade is complete. Conflict resolution can be done on the Changes window by undoing a
-customization. However, if the conflict is undone prior to a solution upgrade, then the
-customization will not be archived.
+The Upgrade Wizard identifies conflicts when a user or a Netwrix engineer has made customizations
+to the job. You need to either resolve conflicts before the upgrade action or manually apply them
+after the upgrade finishes. You can resolve a conflict on the Changes window by undoing a
+customization. However, if you undo the conflict before a solution upgrade, the
+customization won't be archived.
:::warning
-If Role Based Access has been enabled, a user with the Administrator role must perform
-the upgrade. Other user roles do not have the necessary permissions to perform upgrades.
+If you enabled Role Based Access, a user with the Administrator role must perform
+the upgrade. Other user roles don't have the necessary permissions to perform upgrades.
:::
-Follow the steps to use the Upgrade Wizard.
+To use the Upgrade Wizard:
**Step 1 –** Launch the Enterprise Auditor application. The installation wizard placed the
Enterprise Auditor icon on the desktop.
@@ -113,18 +112,18 @@ Enterprise Auditor icon on the desktop.
**Step 2 –** The Enterprise Auditor Configuration Wizard opens. Click **Next** to continue.
:::note
-When Enterprise Auditor11.6 is installed on a server where a previous version of
-Enterprise Auditor had been installed, the Version Selection page of the Configuration Wizard will
-not appear.
+When you install Enterprise Auditor 11.6 on a server where a previous version of
+Enterprise Auditor was installed, the Version Selection page of the Configuration Wizard doesn't
+appear.
:::
-**Step 3 –** On the Solution Set Files page, only upgrade conflicts are displayed by default.
+**Step 3 –** On the Solution Set Files page, the wizard displays only upgrade conflicts by default.
:::info
-Investigate the changes where conflicts have been identified before proceeding.
+Investigate the changes where the wizard identified conflicts before proceeding.
:::
@@ -139,29 +138,29 @@ Additional options include:
-**Step 5 –** (Optional) Conflicts can be resolved on the Changes window, which is opened by the
-**View conflicts** button. Remember, if the conflict is resolved prior to a solution upgrade, then
-the customization will not be archived. To resolve a conflict, select it from the list and click
+**Step 5 –** (Optional) You can resolve conflicts on the Changes window, which the **View conflicts**
+button opens. If you resolve the conflict before a solution upgrade,
+the customization won't be archived. To resolve a conflict, select it from the list and click
**Undo**.
-**Step 6 –** When the Upgrade options have been set as desired. Click **Next**.
+**Step 6 –** After you set the Upgrade options as desired, click **Next**.
-**Step 7 –** On the Options page, select whether to send usage statistics to Netwrix to help us
-improve our product. After the Usage Statistics option is set as desired, click **Next** to
+**Step 7 –** On the Options page, select whether to send usage statistics to Netwrix to help
+improve the product. After you set the Usage Statistics option as desired, click **Next** to
continue.
- If selected, usage statistics are collected and sent to Netwrix
- - Upon startup of the Enterprise Auditor console, the system checks if usage statistics have
- been sent in the last 7 days. If they have not been, stored procedures run against the
+ - Upon startup of the Enterprise Auditor console, the system checks whether it sent usage
+ statistics in the last 7 days. If not, stored procedures run against the
Enterprise Auditor database and gather data about job runs, access times, and environmental
- details like resource counts, users counts, number of exceptions, and so on. This data is then
- sent back to Netwrix to help us identify usage trends and common pain points, so that we can
- use this information to improve the product.
- - Only anonymous statistic-level data is included. No private company or personal data is
- collected or sent to Netwrix.
+ details like resource counts, user counts, number of exceptions, and so on. Enterprise Auditor
+ then sends this data back to Netwrix to help identify usage trends and common problem areas,
+ which Netwrix uses to improve the product.
+ - Enterprise Auditor includes only anonymous statistic-level data. It doesn't collect or send
+ private company or personal data to Netwrix.
- If cleared, no usage statistics are collected or sent to Netwrix
diff --git a/docs/accessanalyzer/11.6/install/application/wizard.md b/docs/accessanalyzer/11.6/install/application/wizard.md
index 50e5f015e5..091a942a61 100644
--- a/docs/accessanalyzer/11.6/install/application/wizard.md
+++ b/docs/accessanalyzer/11.6/install/application/wizard.md
@@ -7,8 +7,8 @@ sidebar_position: 20
# Enterprise Auditor Core Installation
Save the organization’s Enterprise Auditor license key, received from your Netwrix Sales
-Representative, to the server where Enterprise Auditor is to be installed. Then follow the steps to
-install Enterprise Auditor.
+Representative, to the server where you'll install Enterprise Auditor. Then, to
+install Enterprise Auditor:
:::note
The process explained in this topic assumes that both the downloaded binary and the
@@ -17,8 +17,8 @@ license (.lic) file are located on the server which will become the Enterprise A
:::warning
-If User Account Control (UAC) is enabled on the server, ensure the installation package
-is run in Administrative/privilege mode.
+If User Account Control (UAC) is enabled on the server, ensure that you run the installation
+package in Administrative/privilege mode.
:::
@@ -49,7 +49,7 @@ install Enterprise Auditor. The default destination folder is
file. When the path to the file is visible in the textbox, click **Next**.
:::note
-The license file must be stored on the Enterprise Auditor Console server before the
+You must store the license file on the Enterprise Auditor Console server before the
installation begins.
:::
@@ -58,7 +58,7 @@ installation begins.
**Step 6 –** The License Features page displays a list of all features covered by the imported
license. It also displays the name of the organization which owns the license, the expiration date,
-and the host limit. These are the features that will be installed. Click **Next**.
+and the host limit. These are the features that Enterprise Auditor will install. Click **Next**.
@@ -69,6 +69,6 @@ installation.
**Step 8 –** When the installation has completed, click **Finish** to exit the wizard.
-The Enterprise Auditor Console has been installed, and two desktop icons have been created:
-Enterprise Auditor and Published Reports. Launch the Enterprise Auditor application to complete the
+You have now installed the Enterprise Auditor Console, and the installer has created two desktop
+icons: Enterprise Auditor and Published Reports. Launch the Enterprise Auditor application to complete the
initial configuration.
diff --git a/docs/accessanalyzer/11.6/install/filesystemproxy/configuredatacollector.md b/docs/accessanalyzer/11.6/install/filesystemproxy/configuredatacollector.md
index 2a0f9c1358..119b2fc503 100644
--- a/docs/accessanalyzer/11.6/install/filesystemproxy/configuredatacollector.md
+++ b/docs/accessanalyzer/11.6/install/filesystemproxy/configuredatacollector.md
@@ -12,7 +12,7 @@ Access Auditor Data Collector Wizard from the job’s query.
On the Applet Settings wizard page, select the following option:
-- Require applet to be running as service on target – Must be selected in the Applet Launch
+- Require applet to be running as service on target – Select this option in the Applet Launch
Mechanism section to prevent the deployment of the applet or the ad hoc installation of the
service during the scan
diff --git a/docs/accessanalyzer/11.6/install/filesystemproxy/overview.md b/docs/accessanalyzer/11.6/install/filesystemproxy/overview.md
index a2a34dfd74..901fcdbf8d 100644
--- a/docs/accessanalyzer/11.6/install/filesystemproxy/overview.md
+++ b/docs/accessanalyzer/11.6/install/filesystemproxy/overview.md
@@ -6,20 +6,20 @@ sidebar_position: 20
# File System Proxy as a Service Overview
-The File System Solution can be enabled to use proxy servers for scanning targeted file systems in
+You can enable the File System Solution to use proxy servers for scanning targeted file systems in
very large or widely dispersed environments.
-When File System scans are run in proxy mode as a service, there are two methods available for
+When you run File System scans in proxy mode as a service, two methods are available for
deploying the service:
-- Pre-Installed File System Proxy Service – File System Proxy Service installation package must be
- installed on the Windows proxy servers prior to executing the scans. This is the recommended
+- Pre-Installed File System Proxy Service – Install the File System Proxy Service installation
+ package on the Windows proxy servers before executing the scans. This is the recommended
method.
-- Ad Hoc File System Proxy Service Deployment – File System Proxy Service is installed on the
- Windows proxy server when the job is executed
+- Ad Hoc File System Proxy Service Deployment – Enterprise Auditor installs the File System Proxy
+ Service on the Windows proxy server when the job runs
-The data collection processing is conducted by the proxy server where the service is running and
-leverages a local mode-type scan to each of the target hosts. The final step in data collection is
+The proxy server where the service is running conducts the data collection processing and uses a
+local mode-type scan to each of the target hosts. The final step in data collection is
to compress and transfer the data collected in the SQLite databases, or Tier 2 databases, back to
the Enterprise Auditor Console server.
@@ -34,7 +34,7 @@ topic for information on the required prerequisites.
## Supported Platforms
-The File System Proxy Service for the Enterprise Auditor File System Solution can be installed on
+You can install the File System Proxy Service for the Enterprise Auditor File System Solution on
the following Windows operating systems:
- Windows Server 2022
@@ -43,15 +43,15 @@ the following Windows operating systems:
## Proxy Scanning Architecture
-Enterprise Auditor is configured by default to process data collection against ten target hosts
-simultaneously. When File System scans are run in local mode ten hosts process simultaneously, and
-processing against the eleventh host begins after the processing against the first host is
-completed. Proxy scanning architecture supports large deployments or widely dispersed environments.
+By default, Enterprise Auditor processes data collection against ten target hosts
+simultaneously. When you run File System scans in local mode, ten hosts process simultaneously, and
+processing against the eleventh host begins after processing against the first host completes.
+Proxy scanning architecture supports large deployments or widely dispersed environments.
-A proxy server is any server that can be leveraged to process data collection against target hosts.
+A proxy server is any server that processes data collection against target hosts.
:::warning
-The File System Proxy Service cannot be installed on the same server as Enterprise
+You can't install the File System Proxy Service on the same server as Enterprise
Auditor.
:::
@@ -63,9 +63,9 @@ Two options are available for implementing the proxy scanning architecture:
### Proxy Mode with Applet
-When File System scans are run in proxy mode with applet, it means the File System applet is
-deployed to the Windows proxy server when the job is executed to conduct data collection. The data
-collection processing is initiated by the proxy server where the applet is deployed and leverages a
+When you run File System scans in proxy mode with applet, Enterprise Auditor deploys the File
+System applet to the Windows proxy server when the job runs to conduct data collection. The proxy
+server where the applet is deployed initiates the data collection processing and uses a
local mode-type scan to each of the target hosts. The final step in data collection is to compress
and transfer the data collected in the SQLite databases, or Tier 2 databases, back to the Enterprise
Auditor Console server.
@@ -77,25 +77,25 @@ which runs the scan against a file server, and then returns data to the Enterpri
### Proxy Mode as a Service
-When File System scans are run in proxy mode as a service, there are two methods available for
+When you run File System scans in proxy mode as a service, two methods are available for
deploying the service:
-- Pre-Installed File System Proxy Service – File System Proxy Service installation package must be
- installed on the Windows proxy servers prior to executing the scans. This is the recommended
+- Pre-Installed File System Proxy Service – Install the File System Proxy Service installation
+ package on the Windows proxy servers before executing the scans. This is the recommended
method.
-- Ad Hoc File System Proxy Service Deployment – File System Proxy Service is installed on the
- Windows proxy server when the job is executed
+- Ad Hoc File System Proxy Service Deployment – Enterprise Auditor installs the File System Proxy
+ Service on the Windows proxy server when the job runs
-The data collection processing is conducted by the proxy server where the service is running and
-leverages a local mode-type scan to each of the target hosts. The final step in data collection is
+The proxy server where the service is running conducts the data collection processing and uses a
+local mode-type scan to each of the target hosts. The final step in data collection is
to compress and transfer the data collected in the SQLite databases, or Tier 2 databases, back to
the Enterprise Auditor Console server.
-The proxy communication is configured during the installation of the service on the proxy server and
-certificate exchange options are configured via the Applet Settings page of the File System Access
-Auditing Data Collector Wizard. The credential provided for the secure communications in the
-installation wizard is also added to the Enterprise Auditor Connection Profile assigned to the File
-System Solution.
+You configure the proxy communication during installation of the service on the proxy server, and
+you configure certificate exchange options via the Applet Settings page of the File System Access
+Auditing Data Collector Wizard. The installation wizard also adds the credential you provide for
+secure communications to the Enterprise Auditor Connection Profile assigned to the File System
+Solution.
See the
[File System Proxy Service Installation](/docs/accessanalyzer/11.6/install/filesystemproxy/wizard.md)
@@ -107,25 +107,25 @@ The diagram illustrates the Enterprise Auditor server communicating securely wit
on a proxy server, which runs the scan against a file server, collecting the data locally and
securely. Then the proxy service returns data securely to the Enterprise Auditor server.
-When a proxy mode scan is initiated from the Enterprise Auditor Console, it will distribute hosts to
+When you initiate a proxy mode scan from the Enterprise Auditor Console, it distributes hosts to
be scanned across all proxy hosts. Enterprise Auditor monitors the scans from the central console.
-Once all proxy hosts have completed scanning, all results and SQLite databases are returned to the
+Once all proxy hosts complete scanning, they return all results and SQLite databases to the
Enterprise Auditor Console server.
The diagram shows the difference between an implementation of Enterprise Auditor without proxy
-servers (on the left) and with proxy servers (on the right). On the right side of the diagram, the
-scans have been configured to use the local host and two additional proxy servers to perform the
+servers (on the left) and with proxy servers (on the right). On the right side of the diagram, you configured the
+scans to use the local host and two additional proxy servers to perform the
FSAA Data Collector scans. This allows it to execute three times as many concurrent hosts than would
be possible without proxy servers. This provides a clear benefit in scalability and scan times.
The proxy functionality for the FSAA Data Collector provides security and reliability.
:::tip
-Remember, It is recommended that the File System Proxy Service is installed on the proxy server
-before running File System scans in proxy mode as a service. Once installed, the FileSystemAccess
-(FSAA) Data Collector must be configured to use the service. See the
+Install the File System Proxy Service on the proxy server
+before running File System scans in proxy mode as a service. After installation, you must configure
+the FileSystemAccess (FSAA) Data Collector to use the service. See the
[File System Data Collection Configuration for Proxy as a Service](/docs/accessanalyzer/11.6/install/filesystemproxy/configuredatacollector.md)
topic for additional information.
:::
@@ -133,18 +133,18 @@ topic for additional information.
## Sensitive Data Discovery Auditing Consideration
-Sensitive Data Discovery Auditing scans also require the Sensitive Data Add-on – FSAA & SPAA
-Agentless (or x86) version of the Sensitive Data Discovery Add-On be installed on the proxy server.
+Sensitive Data Discovery Auditing scans also require you to install the Sensitive Data Add-on –
+FSAA & SPAA Agentless (or x86) version of the Sensitive Data Discovery Add-On on the proxy server.
This requirement is in addition to having the Sensitive Data Discovery Add-on installed on the
Enterprise Auditor Console server. See the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
topic for additional information.
:::note
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
+If you run Sensitive Data Discovery (SDD) scans, you'll need to increase the
minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By
-default, SDD scans are configured to run two concurrent threads. For example, if the job is
-configured to scan 8 hosts at a time with two concurrent SDD threads, then an extra 32 GB of RAM are
-required (8x2x2=32).
+default, Enterprise Auditor configures SDD scans to run two concurrent threads. For example, if you
+configure the job to scan 8 hosts at a time with two concurrent SDD threads, you need an extra 32 GB
+of RAM (8x2x2=32).
:::
diff --git a/docs/accessanalyzer/11.6/install/filesystemproxy/silentinstall.md b/docs/accessanalyzer/11.6/install/filesystemproxy/silentinstall.md
index 55b9bd0a51..db8b45613e 100644
--- a/docs/accessanalyzer/11.6/install/filesystemproxy/silentinstall.md
+++ b/docs/accessanalyzer/11.6/install/filesystemproxy/silentinstall.md
@@ -6,12 +6,12 @@ sidebar_position: 30
# Silent Installer Option for Proxy
-It is possible to use one of the following methods to complete a silent installation of the File
+Use one of the following methods to complete a silent installation of the File
System Proxy Service.
:::warning
For all Active Directory versions, aside from Windows 2012 R2, the silent installer
-does not prompt an error message if a duplicate SPN value exists in the targeted domain for
+doesn't prompt an error message if a duplicate SPN value exists in the targeted domain for
[Option 1: Run as LocalSystem](#option-1-run-as-localsystem). Having duplicate SPN’s in the targeted
Active Directory environment prohibits connection to the proxy service, resulting in a failed scan.
:::
@@ -21,16 +21,16 @@ If a desired SPN already exists in a Windows 2012 R2 domain, the silent installe
following message:
> _There is a problem with this Windows Installer package. A script required for this install to
-> complete could not be run. Contact your support personnel or package vendor_.
+> complete couldn't be run. Contact your support personnel or package vendor_.
To resolve the problem, remove the duplicate SPN value and rerun the installer to complete
-installation. For any additional issues, verbose logging is included in the silent installer and
+installation. For any additional issues, the silent installer includes verbose logging and
creates an `install.txt` file on the desktop.
## Option 1: Run as LocalSystem
-Follow the steps to install the File System Proxy Service on the targeted proxy servers with a
-silent installer.
+To install the File System Proxy Service on the targeted proxy servers with a
+silent installer:
**Step 1 –** Copy the `FileSystemProxy.msi` executable to the desktop of the server designated as
the proxy server.
@@ -43,7 +43,7 @@ msiexec /i FileSystemProxy.msi /qb /l*v install.log SVC_ACCOUNT_TYPE=SYSTEM
- To add a non-default install directory, append `PRODUCTDIR="[path]"` to the command.
- - `path` – The path to the desired installation directory and must include
+ - `path` – The path to the installation directory you want and must include
`...\STEALTHbits\StealthAUDIT\FSAA\...`
For example:
@@ -52,12 +52,12 @@ msiexec /i FileSystemProxy.msi /qb /l*v install.log SVC_ACCOUNT_TYPE=SYSTEM
msiexec /i FileSystemProxy.msi /qb /l*v install.log SVC_ACCOUNT_TYPE=SYSTEM PRODUCTDIR="E:\STEALTHbits\StealthAUDIT\FSAA"
```
-The SPN value is automatically added to the computer object in Active Directory with this option.
+This option automatically adds the SPN value to the computer object in Active Directory.
## Option 2: Run as a Service Account
-Follow the steps to install the File System Proxy Service on the targeted proxy servers with a
-silent installer.
+To install the File System Proxy Service on the targeted proxy servers with a
+silent installer:
**Step 1 –** Copy the `FileSystemProxy.exe` executable to the desktop of the server designated as
the proxy server.
@@ -71,11 +71,11 @@ msiexec /i FileSystemProxy.msi /qb /l*v install.log SVC_ACCOUNT_TYPE=DOMAIN SVC_
- `DOMAIN\USERNAME` – The service account credentials, which need to be a member the Local
Administrators group and have the**Log on as a service** local policy (**Local Policies** >
**User Rights Assignment**)
-- `secret` – The password for the credentials provided above (within quotes)
+- `secret` – The password for the credentials provided earlier (within quotes)
- To add a non-default install directory, append `PRODUCTDIR="[path]"` to the command.
- - `path` – The path to the desired installation directory and must include
+ - `path` – The path to the installation directory you want and must include
`...\STEALTHbits\StealthAUDIT\FSAA\...`
For example:
diff --git a/docs/accessanalyzer/11.6/install/filesystemproxy/troubleshooting.md b/docs/accessanalyzer/11.6/install/filesystemproxy/troubleshooting.md
index d2bd218720..e6ecc43b90 100644
--- a/docs/accessanalyzer/11.6/install/filesystemproxy/troubleshooting.md
+++ b/docs/accessanalyzer/11.6/install/filesystemproxy/troubleshooting.md
@@ -10,20 +10,20 @@ The following are potential errors that may occur during installation and how to
| Error Message | Resolution |
| -------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Service ‘Enterprise Auditor FSAA Proxy Scanner’ (StealthAUDITFSAA) failed to start. Verify that you have sufficient privileges to start system services. | The domain account used during setup does not have sufficient privileges to start the service. Open Local Security Policies on the proxy server. In User Rights Assignment under Local policies, add the desired user to the Log on as a service policy. Once the user has this privilege, retry the installation. |
+| Service ‘Enterprise Auditor FSAA Proxy Scanner’ (StealthAUDITFSAA) failed to start. Verify that you have sufficient privileges to start system services. | The domain account used during setup doesn't have sufficient privileges to start the service. Open Local Security Policies on the proxy server. In User Rights Assignment under Local policies, add the user you want to the Log on as a service policy. After the user has this privilege, retry the installation. |
The following are potential errors that may occur during File System scans and how to resolve each.
| Error Message | Resolution |
| --------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Failed to launch SDD client (2): The system cannot find the file specified. | This indicates the Sensitive Data Discovery Add-On is not installed on the proxy server. |
-| Error creating DLP components. Error:Error initializing DLP communications, received invalid pipe handle. | This indicates the Sensitive Data Discovery Add-On is not installed on the proxy server. |
-| Unable to start scan: Could not initialize scan session with any proxy host supplied | This can indicate a few things and is a broad error: - The Enterprise Auditor Console cannot reach the proxy server via the network.
- Network communications are blocked for TCP on port 8766 – possibly by the Windows Firewall on the Enterprise Auditor Console server or proxy server, or by another firewall in the network (it is possible for this port to be customized through the FSAA Data Collector query configuration).
- The Netwrix Enterprise Auditor FSAA Proxy Scanner service is not running or is not installed on the target proxy server.
|
+| Failed to launch SDD client (2): The system can't find the file specified. | This indicates the Sensitive Data Discovery Add-On isn't installed on the proxy server. |
+| Error creating DLP components. Error:Error initializing DLP communications, received invalid pipe handle. | This indicates the Sensitive Data Discovery Add-On isn't installed on the proxy server. |
+| Unable to start scan: Couldn't initialize scan session with any proxy host supplied | This can indicate a few things and is a broad error: - The Enterprise Auditor Console can't reach the proxy server via the network.
- The Windows Firewall on the Enterprise Auditor Console server or proxy server, or another firewall in the network, might block network communications for TCP on port 8766 (you can customize this port through the FSAA Data Collector query configuration).
- The Netwrix Enterprise Auditor FSAA Proxy Scanner service isn't running or isn't installed on the target proxy server.
|
## Verbose Logging
-Sometimes it is necessary to enable verbose logging in order to troubleshoot a problem with the
+Sometimes you need to enable verbose logging to troubleshoot a problem with the
proxy server.
Run the following command in the directory where the installer lives (to prompt the install):
diff --git a/docs/accessanalyzer/11.6/install/filesystemproxy/uninstall.md b/docs/accessanalyzer/11.6/install/filesystemproxy/uninstall.md
index d2c3694cd9..5868728ced 100644
--- a/docs/accessanalyzer/11.6/install/filesystemproxy/uninstall.md
+++ b/docs/accessanalyzer/11.6/install/filesystemproxy/uninstall.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# Uninstall Proxy Service Process
-The process to properly uninstall the File System Proxy Service is completed through the
-uninstalling of the Enterprise Auditor File System Scanning Proxy program.
+To properly uninstall the File System Proxy Service, uninstall the Enterprise Auditor File System
+Scanning Proxy program.
**Step 1 –** Open Control Panel and select **Programs** > **Uninstall a program**.
@@ -16,12 +16,12 @@ uninstalling of the Enterprise Auditor File System Scanning Proxy program.
**Step 2 –** Select Netwrix Enterprise Auditor File System Scanning Proxy and click **Uninstall**.
:::note
-If the installation was configured to use the LocalSystem account to run the RPC service
-the two SPN values are removed for that machine in Active Directory. If the service is running with
-a supplied account, the SPN values would need to be manually removed for that machine in Active
-Directory (unless the uninstall was completed as part of the
+If the installation was configured to use the LocalSystem account to run the RPC service, the
+uninstall process removes the two SPN values for that machine in Active Directory. If the service is
+running with a supplied account, you must manually remove the SPN values for that machine in Active
+Directory (unless you completed the uninstall as part of the
[Upgrade Proxy Service Procedure](/docs/accessanalyzer/11.6/install/filesystemproxy/upgrade.md)).
:::
-When the uninstall process is complete, this program is removed from the list.
+When the uninstall process completes, the program no longer appears in the list.
diff --git a/docs/accessanalyzer/11.6/install/filesystemproxy/upgrade.md b/docs/accessanalyzer/11.6/install/filesystemproxy/upgrade.md
index 5a6351873e..ebcbdcaeb3 100644
--- a/docs/accessanalyzer/11.6/install/filesystemproxy/upgrade.md
+++ b/docs/accessanalyzer/11.6/install/filesystemproxy/upgrade.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Upgrade Proxy Service Procedure
-When the Enterprise Auditor Console and File System Solution are upgraded, it is necessary to also
+When you upgrade the Enterprise Auditor Console and File System Solution, also
upgrade the File System Proxy Service when running Enterprise Auditor in Proxy Mode as a Service.
This upgrade can be done in two ways:
@@ -16,15 +16,15 @@ This upgrade can be done in two ways:
:::warning
When upgrading the Proxy Service to 11.6 from a previous version for the first time,
you must manually uninstall the previous version and follow the [Manual Upgrade](#manual-upgrade)
-steps below. Subsequent 11.6 upgrades can be done using the automatic upgrade option.
+steps. You can use the automatic upgrade option for subsequent 11.6 upgrades.
:::
## Automatic Upgrade
The **FS_UpdateProxy** Job is available through the Instant Job Wizard. This job updates the File
-System Proxy Service on all servers in the assigned host list. Follow the steps to instantiate this
-job.
+System Proxy Service on all servers in the assigned host list. To instantiate this
+job:
**Step 1 –** Within the **Jobs** tree, right-click and select **Add Instant Job**. The Instant Job
Wizard window opens.
@@ -39,15 +39,15 @@ Expand the category and select the **FS_UpgradeProxy** Job. Click **Next**.
**Step 4 –** On the Host Assignment page, select the **Specify individual hosts or host lists**
option and click **Next**.
-**Step 5 –** On the Host Lists page, assign the host lists containing the proxy servers to be
-updated . Multiple host lists can be added. Click Next.
+**Step 5 –** On the Host Lists page, assign the host lists containing the proxy servers to update.
+You can add multiple host lists. Click Next.
**Step 6 –** On the Individual Hosts page, click **Next**.
**Step 7 –** Review the Summary and click either **Save & Exit** or **Save & Run Jobs Now**.
-The proxy does not update until the job is run. Once successfully ran, the servers in the assigned
-host lists have been updated.
+The proxy doesn't update until you run the job. After the job runs successfully, the servers in the
+assigned host lists are updated.
## Manual Upgrade
diff --git a/docs/accessanalyzer/11.6/install/filesystemproxy/wizard.md b/docs/accessanalyzer/11.6/install/filesystemproxy/wizard.md
index f7281c00c7..92a504e05c 100644
--- a/docs/accessanalyzer/11.6/install/filesystemproxy/wizard.md
+++ b/docs/accessanalyzer/11.6/install/filesystemproxy/wizard.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# File System Proxy Service Installation
-The File System Proxy installer is designed to simplify the process of setting up File System
+The File System Proxy installer simplifies the process of setting up File System
Scanning Proxy as a service on the designated proxy server. It is a best practice to use a
specifically provisioned domain account as the File System Proxy service account. Follow the steps
to install the FSAA service on the targeted proxy servers.
@@ -34,8 +34,8 @@ folder page.
On the Change destination folder page, choose a different destination folder for the installation.
- Look in – Select which folder or sub-folder to complete installation in using the Look in
- drop-down
-- Up one level – Click the Up one level button to select the folder one level above the currently
+ dropdown
+- Up one level – Click the Up one level button to select the folder one level above the
selected one
- Create a new folder – Click to create a new folder for the destination of the installation
@@ -62,25 +62,25 @@ radio buttons. Then, click **Next**.
**Step 7 –** When the installation completes, click **Finish** to exit the wizard.
:::note
-If the File System Proxy Service is installed on multiple servers, then a custom host list
-of proxy servers should also be created in Netwrix Enterprise Auditor.
+If you install the File System Proxy Service on multiple servers, also create a custom host list
+of proxy servers in Netwrix Enterprise Auditor.
:::
-Once the File System Proxy Service has been installed on any proxy server, it is necessary to
+After you install the File System Proxy Service on any proxy server,
configure the File System Solution certificate exchange method for Proxy Mode as a Service. See the
[FSAA Applet Certificate Management Overview](/docs/accessanalyzer/11.6/admin/datacollector/fsaa/certificatemanagement/certificatemanagement.md)
topic for additional information.
## Custom Parameters for File System Proxy Service
-The port and priority parameters can be modified for the File System Proxy Service on the registry
+You can modify the port and priority parameters for the File System Proxy Service on the registry
key:
**HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\StealthAUDITFSAA\ImagePath**
- Port parameter – Only needs to be added to the registry key value if a custom port is used. The
- default port of 8766 does not need to be set as a parameter
+ default port of 8766 doesn't need to be set as a parameter
- Append `-e [PORT NUMBER]` to the ImagePath key value
- Priority parameter – Can be modified so that the service runs as a background priority, which may
be desired if the service has been installed directly on a file server
@@ -98,12 +98,12 @@ key:
:::
-Follow the steps to configure these service parameters.
+To configure these service parameters:
**Step 1 –** After installing the File System Proxy Service, open Services Management Console
-(`services.msc`). To stop the service, right-click on the Netwrix Enterprise Auditor FSAA Proxy
+(`services.msc`). To stop the service, right-click the Netwrix Enterprise Auditor FSAA Proxy
Scanner service and select **Stop**.
@@ -112,8 +112,8 @@ Scanner service and select **Stop**.
**HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\StealthAUDITFSAA\ImagePath**
-**Step 3 –** Right-click on the **ImagePath** key and select **Modify**. The Value data was set
-during installation according to the installation directory location selected.
+**Step 3 –** Right-click the **ImagePath** key and select **Modify**. The installer set the Value
+data during installation according to the installation directory location you selected.
- Priority set to background priority:
- Add `-r 0` to the end of the path value
@@ -151,5 +151,5 @@ section for additional configurations required to run scans in proxy mode as a s
**Step 7 –** Repeat the previous step for each of the **FileSystem** > **0.Collection** jobs to
employ this proxy service.
-The custom port identified is now used for communication between the File System Proxy Service and
-Enterprise Auditor.
+Enterprise Auditor and the File System Proxy Service now use the custom port you identified for
+communication.
diff --git a/docs/accessanalyzer/11.6/install/overview.md b/docs/accessanalyzer/11.6/install/overview.md
index 7e6205d6f1..b302f2a678 100644
--- a/docs/accessanalyzer/11.6/install/overview.md
+++ b/docs/accessanalyzer/11.6/install/overview.md
@@ -23,7 +23,7 @@ topic for additional information.
## Sensitive Data Discovery Add-on
The Sensitive Data Discovery Add-On enables Enterprise Auditor to scan files for criteria matches
-which indicate the existence of sensitive data. Sensitive Data Discovery scans can be run against
+which indicate the existence of sensitive data. You can run Sensitive Data Discovery scans against
Windows file system servers, Network Attached Storage (NAS) devices, SharePoint on-premises,
SharePoint Online, OneDrive for Business, DropBox for Business, SQL Server databases, and Exchange
mailboxes.
@@ -34,7 +34,7 @@ topic for additional information.
## File System Proxy Service
-The File System Solution can be enabled to use proxy servers for scanning targeted file systems in
+You can enable the File System Solution to use proxy servers for scanning targeted file systems in
very large or widely dispersed environments. The File System Proxy installer is designed to simplify
the process of setting up File System Scanning Proxy as a service on the designated proxy server.
diff --git a/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md b/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md
index c8dd0a6cc0..d8f17aab83 100644
--- a/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md
+++ b/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Sensitive Data Discovery Add-On Installation
The Sensitive Data Discovery Add-On enables Enterprise Auditor to scan files for criteria matches
-which indicate the existence of sensitive data. Sensitive Data Discovery scans can be run against
+which indicate the existence of sensitive data. You can run Sensitive Data Discovery scans against
Windows file system servers, Network Attached Storage (NAS) devices, SharePoint on-premises,
SharePoint Online, OneDrive for Business, DropBox for Business, SQL Server databases, and Exchange
mailboxes.
@@ -19,7 +19,7 @@ The version of the SharePoint Agent must also match the major version of Enterpr
## Supported Platforms
-The Sensitive Data Discovery Add-On can be installed on the following servers:
+You can install the Sensitive Data Discovery Add-On on the following servers:
- Windows Server 2016 through Windows Server 2022
- On the Enterprise Auditor Console Server
diff --git a/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/upgrade.md b/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/upgrade.md
index 9cc92f7cc8..d44c3bbc64 100644
--- a/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/upgrade.md
+++ b/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/upgrade.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Upgrade Sensitive Data Discovery Add-on
-When the Enterprise Auditor Console and applicable solutions are upgraded, it is necessary to also
+When you upgrade the Enterprise Auditor Console and applicable solutions, also
upgrade the Sensitive Data Discovery Add-On.
diff --git a/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/wizard.md b/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/wizard.md
index fddbbd0c8c..d19a5eda68 100644
--- a/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/wizard.md
+++ b/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/wizard.md
@@ -9,32 +9,32 @@ sidebar_position: 10
Remember, the following additional considerations:
- File System Considerations:
- - To run the **FileSystem** Job Group in Applet Mode or Proxy Mode with Applet, the targeted
- file servers also need .NET Framework 4.7.2 or later to be installed in order for Sensitive
- Data Discovery collections to successfully occur.
- - To run the **FileSystem** Job Group in File System Proxy Mode as a Service, the Sensitive Data
- Discovery Add-On (32-bit `SensitiveDataAddon.msi`) also needs to be installed on the proxy
+ - To run the **FileSystem** Job Group in Applet Mode or Proxy Mode with Applet, install .NET
+ Framework 4.7.2 or later on the targeted file servers so Sensitive Data Discovery collections
+ can occur successfully.
+ - To run the **FileSystem** Job Group in File System Proxy Mode as a Service, also install the
+ Sensitive Data Discovery Add-On (32-bit `SensitiveDataAddon.msi`) on the proxy
server. The proxy server also requires the .NET Framework 4.7.2 or later. The Enterprise
Auditor license file will need to be accessible locally for this installation. See the
[File System Proxy as a Service Overview](/docs/accessanalyzer/11.6/install/filesystemproxy/overview.md)
topic for additional information.
-- SharePoint Consideration – To use the SharePoint Agent to scan for sensitive data, the Sensitive
- Data Discovery Add-On (64-bit `SensitiveDataAddon.msi`) will also need to be installed on the
+- SharePoint Consideration – To use the SharePoint Agent to scan for sensitive data, also install
+ the Sensitive Data Discovery Add-On (64-bit `SensitiveDataAddon.msi`) on the
application server which hosts the Central Administration component of the targeted SharePoint
- farms after the Enterprise Auditor SharePoint Agent has been installed on that server. The
+ farms, after you install the Enterprise Auditor SharePoint Agent on that server. The
SharePoint server also requires .NET Framework 4.7.2 or later. The Enterprise Auditor license file
will need to be accessible locally for this installation. See the
[SharePoint Agent Installation](/docs/accessanalyzer/11.6/install/sharepointagent/overview.md)
topic for additional information.
:::note
-Before running the installation package, please close the Enterprise Auditor application.
+Before running the installation package, close the Enterprise Auditor application.
:::
-The Enterprise Auditor license file is needed during installation. It can be imported from the
-Enterprise Auditor installation directory when the add-on is installed on the Enterprise Auditor
-Console server. Follow the steps to install the Sensitive Data Discovery Add-On.
+You need the Enterprise Auditor license file during installation. You can import it from the
+Enterprise Auditor installation directory when you install the add-on on the Enterprise Auditor
+Console server. To install the Sensitive Data Discovery Add-On:
**Step 1 –** Run the `SensitiveDataAddon.exe` executable.
@@ -95,7 +95,7 @@ solutions, according to the organization’s license:
- SharePoint
- SQL
-Prior to job execution, ensure the desired criteria have been properly configured for each job. See
+Before job execution, ensure you have properly configured the criteria you want for each job. See
the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/install/sharepointagent/overview.md b/docs/accessanalyzer/11.6/install/sharepointagent/overview.md
index 2f606f00fc..422f54a968 100644
--- a/docs/accessanalyzer/11.6/install/sharepointagent/overview.md
+++ b/docs/accessanalyzer/11.6/install/sharepointagent/overview.md
@@ -22,8 +22,8 @@ The version of the SharePoint Agent must also match the major version of Enterpr
## Supported Platforms
-The SharePoint Agent for the Enterprise Auditor SharePoint & SharePoint Online Solution can be
-installed on the following SharePoint versions as targeted environments:
+You can install the SharePoint Agent for the Enterprise Auditor SharePoint & SharePoint Online
+Solution on the following SharePoint versions as targeted environments:
- SharePoint® 2019
- SharePoint® 2016
@@ -31,17 +31,17 @@ installed on the following SharePoint versions as targeted environments:
## Sensitive Data Discovery Auditing Consideration
-If utilizing the SharePoint Agent to scan for Sensitive Data, install the Sensitive Data Add-on –
-SPAA Agent (or x64) version of the Sensitive Data Discovery Add-On after the SharePoint Agent has
-been installed on the SharePoint server. This requirement is in addition to having the Sensitive
+If using the SharePoint Agent to scan for Sensitive Data, install the Sensitive Data Add-on –
+SPAA Agent (or x64) version of the Sensitive Data Discovery Add-On after you install the SharePoint
+Agent on the SharePoint server. This requirement is in addition to having the Sensitive
Data Discovery Add-on installed on the Enterprise Auditor Console server. Sensitive Data Discovery
Auditing scans also require .NET Framework 4.7.2 or later.
:::note
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
+If running Sensitive Data Discovery (SDD) scans, you must increase the
minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For
-example, if the job is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are
-required (8x2=16).
+example, if you configure the job to scan 8 hosts at a time, the job requires an extra 16 GB of RAM
+(8x2=16).
:::
diff --git a/docs/accessanalyzer/11.6/install/sharepointagent/upgrade.md b/docs/accessanalyzer/11.6/install/sharepointagent/upgrade.md
index cd050de11c..a1996d3418 100644
--- a/docs/accessanalyzer/11.6/install/sharepointagent/upgrade.md
+++ b/docs/accessanalyzer/11.6/install/sharepointagent/upgrade.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Upgrade SharePoint Agent
-Follow the steps to upgrade the SharePoint Agent.
+To upgrade the SharePoint Agent:
@@ -17,11 +17,11 @@ Features**), uninstall the previous version of SharePoint Agent.
[Installing the SharePoint Agent](/docs/accessanalyzer/11.6/install/sharepointagent/wizard.md)
topic for instructions.
-**Step 3 –** If also conducting Sensitive Data Discovery Auditing, after the installation is
-completed upgrade the Sensitive Data Discovery Add-on on the SharePoint server. See the
+**Step 3 –** If also conducting Sensitive Data Discovery Auditing, after the installation completes,
+upgrade the Sensitive Data Discovery Add-on on the SharePoint server. See the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
topic for additional information.
-Now that the SharePoint Agent has been upgraded, it can be used by the SharePoint Solution. See the
+Now that you have upgraded the SharePoint Agent, the SharePoint Solution can use it. See the
[SharePoint Solution](/docs/accessanalyzer/11.6/solutions/sharepoint/overview.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/install/sharepointagent/wizard.md b/docs/accessanalyzer/11.6/install/sharepointagent/wizard.md
index b329afc712..71db1055f0 100644
--- a/docs/accessanalyzer/11.6/install/sharepointagent/wizard.md
+++ b/docs/accessanalyzer/11.6/install/sharepointagent/wizard.md
@@ -16,7 +16,7 @@ the Enterprise Auditor Console. See the
topic for detailed permission information.
:::note
-If utilizing the SharePoint Agent to scan for Sensitive Data, the 64-bit
+If using the SharePoint Agent to scan for Sensitive Data, the 64-bit
`SensitiveDataAddon.msi` needs to be installed after the SharePoint Agent has been installed on the
SharePoint server. See the
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
@@ -24,8 +24,8 @@ topic for additional information.
:::
-Follow the steps to install the SharePoint Agent on the application server which hosts the Central
-Administration component of the targeted SharePoint farms.
+To install the SharePoint Agent on the application server which hosts the Central
+Administration component of the targeted SharePoint farms:
**Step 1 –** Run the `SharePointAgent.exe` executable to open the Netwrix Enterprise Auditor
SharePoint Agent Setup Wizard.
diff --git a/docs/accessanalyzer/11.6/install/stealthauditmapicdoinstallation/appendix.md b/docs/accessanalyzer/11.6/install/stealthauditmapicdoinstallation/appendix.md
index 2740c9d681..183ff4ab75 100644
--- a/docs/accessanalyzer/11.6/install/stealthauditmapicdoinstallation/appendix.md
+++ b/docs/accessanalyzer/11.6/install/stealthauditmapicdoinstallation/appendix.md
@@ -7,22 +7,22 @@ sidebar_position: 10
# Appendix for the StealthAUDIT MAPI CDO Installation Guide
:::warning
-The Enterprise Auditor MAPI CDO must be installed first before installing the Microsoft
+You must install the Enterprise Auditor MAPI CDO first before installing the Microsoft
Exchange MAPI CDO.
:::
-Before installing either binary, close the Enterprise Auditor application and ensure the following
-requirements have been met:
+Before installing either binary, close the Enterprise Auditor application and ensure you meet the
+following requirements:
-- Exchange System Manager for Exchange 2003 is not installed on the Enterprise Auditor Console
+- Exchange System Manager for Exchange 2003 isn't installed on the Enterprise Auditor Console
server.
-- Microsoft Outlook is not installed on the Enterprise Auditor Console server.
+- Microsoft Outlook isn't installed on the Enterprise Auditor Console server.
These programs will interfere with the Microsoft Exchange MAPI CDO installation and with MAPI
-connections if they are installed on the Enterprise Auditor Console server.
+connections if you install them on the Enterprise Auditor Console server.
-Follow these steps to install the Microsoft Exchange MAPI CDO.
+To install the Microsoft Exchange MAPI CDO:
**Step 1 –** Download and run the ExchangeMapiCDO application from Microsoft.
@@ -55,5 +55,4 @@ agreement and click Next.
**Step 6 –** When the installation is complete, click Finish.
-Reopen the Enterprise Auditor application, and the Settings > Exchange node is enabled for
-configuration.
+Reopen the Enterprise Auditor application. You can now configure the Settings > Exchange node.
diff --git a/docs/accessanalyzer/11.6/install/stealthauditmapicdoinstallation/stealthaudit_mapi_cdo_installation.md b/docs/accessanalyzer/11.6/install/stealthauditmapicdoinstallation/stealthaudit_mapi_cdo_installation.md
index 2723c66504..3814db4e12 100644
--- a/docs/accessanalyzer/11.6/install/stealthauditmapicdoinstallation/stealthaudit_mapi_cdo_installation.md
+++ b/docs/accessanalyzer/11.6/install/stealthauditmapicdoinstallation/stealthaudit_mapi_cdo_installation.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# StealthAUDIT MAPI CDO Installation
-Both the Enterprise Auditor MAPI CDO and the Microsoft® Exchange MAPI CDO must to be installed in
-order to enable the Settings > Exchange node.
+You must install both the Enterprise Auditor MAPI CDO and the Microsoft® Exchange MAPI CDO to
+enable the Settings > Exchange node.
@@ -15,29 +15,29 @@ The Microsoft Exchange MAPI CDO is only required to run the MAPI-based data coll
[Exchange Solution](/docs/accessanalyzer/11.6/solutions/exchange/overview.md)
topic for additional information.
-The Enterprise Auditor MAPI CDO can be downloaded from the
-[Product Downloads](https://www.stealthbits.com/product-downloads) page of the Netwrix website. The
-Microsoft Exchange MAPI CDO can be downloaded directly from Microsoft. See the
+You can download the Enterprise Auditor MAPI CDO from the
+[Product Downloads](https://www.stealthbits.com/product-downloads) page of the Netwrix website. You
+can download the Microsoft Exchange MAPI CDO directly from Microsoft. See the
[Appendix for the StealthAUDIT MAPI CDO Installation Guide](/docs/accessanalyzer/11.6/install/stealthauditmapicdoinstallation/appendix.md)
for requirements and installation steps to install the Microsoft Exchange MAPI CDO.
:::warning
-The Enterprise Auditor MAPI CDO must be installed first before installing the Microsoft
+You must install the Enterprise Auditor MAPI CDO first before installing the Microsoft
Exchange MAPI CDO.
:::
-Before installing either binary, close the Enterprise Auditor application and ensure the following
-requirements have been met:
+Before installing either binary, close the Enterprise Auditor application and ensure you meet the
+following requirements:
-- Exchange System Manager for Exchange 2003 is not installed on the Enterprise Auditor Console
+- Exchange System Manager for Exchange 2003 isn't installed on the Enterprise Auditor Console
server.
-- Microsoft Outlook is not installed on the Enterprise Auditor Console server.
+- Microsoft Outlook isn't installed on the Enterprise Auditor Console server.
-These programs interfere with MAPI connections if they are installed on the Enterprise Auditor
+These programs interfere with MAPI connections if you install them on the Enterprise Auditor
Console server.
-Follow the steps to install the Enterprise Auditor MAPI CDO.
+To install the Enterprise Auditor MAPI CDO:
**Step 1 –** Run the StealthAuditMapiCDO executable.
diff --git a/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory.md b/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory.md
index 960b926772..85a67e7734 100644
--- a/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory.md
+++ b/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory.md
@@ -11,8 +11,8 @@ Server, and Access Information Center. See the
[Requirements](/docs/accessanalyzer/11.6/requirements/overview.md)
topic for the core requirements.
-In addition to these, integration with either the Netwrix Activity Monitor or the Netwrix Threat
-Prevention is required for event activity data to be scanned. See the
+In addition to these, you need integration with either the Netwrix Activity Monitor or the Netwrix
+Threat Prevention to scan event activity data. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor) or
the
[Netwrix Threat Prevention Documentation](https://helpcenter.netwrix.com/category/threatprevention)
diff --git a/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/access.md b/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/access.md
index 1666cfd408..206c327cd3 100644
--- a/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/access.md
+++ b/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/access.md
@@ -47,7 +47,7 @@ passwords, permissions, group policies, and domain information:
- Member of the Domain Administrators group
The majority of jobs in the Active Directory solutions rely on tables with queried data from the
-data collectors mentioned above to perform analysis and generate reports. The remaining jobs utilize
+data collectors mentioned previously to perform analysis and generate reports. The remaining jobs use
data collectors to scan environments, and require additional permissions on the target host.
:::info
@@ -104,14 +104,14 @@ The following firewall ports are needed:
## Least Privilege Model
-A least privilege model can be configured based on your auditing needs and the data collection jobs
-you will be using. The following jobs and their corresponding data collectors can be run with a
+You can configure a least privilege model based on your auditing needs and the data collection jobs
+you will be using. You can run the following jobs and their corresponding data collectors with a
least privilege permissions model.
**1-AD_Scan Job Permissions**
The ADInventory Data Collector in the .Active Directory Inventory > 1-AD_Scan Job has the following
-minimum requirements, which must be configured at the Domain level in Active Directory:
+minimum requirements, which you must configure at the Domain level in Active Directory:
- Read access to directory tree
- List Contents & Read Property on the Deleted Objects Container
@@ -141,15 +141,15 @@ requirements:
**AD_CPassword Job Permissions**
While the PowerShell Data Collector typically requires Domain Administrator permissions when
-targeting a domain controller, that level of access is not required to run the 4.Group Policy >
+targeting a domain controller, that level of access isn't required to run the 4.Group Policy >
AD_CPasswords job. The minimum requirements for running this job are:
-- Read access to SYSVOL on the targeted Domain Controller(s) and all of its children
+- Read access to SYSVOL on the targeted Domain Controllers and all of its children
**AD_GroupPolicy Job Permissions**
While the GroupPolicy Data Collector typically requires Domain Administrator permissions when
-targeting a domain controller, that level of access is not required to run the 4.Group Policy >
+targeting a domain controller, that level of access isn't required to run the 4.Group Policy >
AD_GroupPolicy Job. The minimum requirements for running this job are:
- Requires Read permissions on Group Policy Objects
@@ -157,7 +157,7 @@ AD_GroupPolicy Job. The minimum requirements for running this job are:
**AD_PasswordPolicies Job Permissions**
While the LDAP Data Collector typically requires Domain Administrator permissions when targeting a
-domain controller, that level of access is not required to run the 4.Group Policy >
+domain controller, that level of access isn't required to run the 4.Group Policy >
AD_PasswordPolicies Job. The minimum requirements for running this job are:
- Requires Read permissions on the Password Settings Container
@@ -165,7 +165,7 @@ AD_PasswordPolicies Job. The minimum requirements for running this job are:
**AD_DomainControllers Job Permissions**
While the LDAP Data Collector and Active Directory Data Collector typically requires Domain
-Administrator permissions when targeting a domain controller, that level of access is not required
+Administrator permissions when targeting a domain controller, that level of access isn't required
to run the 5.Domains > 0.Collection > AD_DomainControllers Job. The minimum requirements for running
this job are:
@@ -179,7 +179,7 @@ See the [Variable Definitions](#variable-definitions) for variable definitions.
**AD_DSRM Job Permissions**
While the Registry Data Collector typically requires Domain Administrator permissions when targeting
-a domain controller, that level of access is not required to run the 5.Domains > 0.Collection >
+a domain controller, that level of access isn't required to run the 5.Domains > 0.Collection >
AD_DSRM Job. The minimum requirements for running this job are:
- Requires read access to the following Registry key and its children:
@@ -192,7 +192,7 @@ Alternatively, granting access to the Server Operators group also allows read-on
**AD_TimeSync Job Permissions**
While the Registry Data Collector typically requires Domain Administrator permissions when targeting
-a domain controller, that level of access is not required to run the 5.Domains > 0.Collection >
+a domain controller, that level of access isn't required to run the 5.Domains > 0.Collection >
AD_TimeSync Job. The minimum requirements for running this job are:
- Requires Read access to the following Registry keys and its children:
@@ -205,9 +205,9 @@ Alternatively, granting access to the Network Configuration Operators group also
**AD_DomainInfo Job Permissions**
While the LDAP Data Collector and Active Directory Data Collector typically requires Domain
-Administrator permissions when targeting a domain controller, that level of access is not required
-to run the 5.Domains > AD_DomainInfo Job. The minimum requirements for running this job, which must
-be configured at the Domain level in Active Directory, are:
+Administrator permissions when targeting a domain controller, that level of access isn't required
+to run the 5.Domains > AD_DomainInfo Job. The minimum requirements for running this job, which you
+must configure at the Domain level in Active Directory, are:
- Read access to: %DOMAINDN% and its children
- Read access to: CN=System,%DOMAINDN% and its children
diff --git a/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/activity/activity.md b/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/activity/activity.md
index 7af3705508..ae6fa56982 100644
--- a/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/activity/activity.md
+++ b/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/activity/activity.md
@@ -31,8 +31,8 @@ In this method, you will be deploying two agents:
- Next, deploy the AD Agent to all domain controllers in the target domain.
-Follow the steps to setup integration between Activity Monitor and Enterprise Auditor through an API
-server.
+To set up integration between Activity Monitor and Enterprise Auditor through an API
+server:
**Step 1 –** Deploy the Activity Agent to the API server.
@@ -42,7 +42,7 @@ The next step is to configure the agent deployed to the API server.
## Configure API Server Agent
-Follow the steps to configure the agent deployed to the API server.
+To configure the agent deployed to the API server:
**Step 1 –** On the Agents tab of the Activity Monitor Console, select the agent deployed to the
API server.
@@ -52,8 +52,8 @@ API server.
**Step 3 –** Select the **API Server** tab and configure the following:
- Select the **Enable API access on this agent** checkbox.
-- The default **API server port (TCP)** is 4494, but it can be modified if desired. Ensure the
- modified port is also used by Enterprise Auditor.
+- The default **API server port (TCP)** is 4494, but you can modify it if desired. Ensure
+ Enterprise Auditor also uses the modified port.
- Click **Add Application**. The Add or edit API client window opens.
- Configure the following:
@@ -64,19 +64,19 @@ API server.
- Click **Copy** and save the Client Secret value to a text file.
:::warning
- It is not possible to retrieve the value after closing the Add or edit
- API client window. It must be copied first.
+ You can't retrieve the value after closing the Add or edit
+ API client window. Copy it first.
:::
- - By default, the **Secret Expires** in 3 days. That means it must be used in the Enterprise
- Auditor Connection Profile within 72 hours or a new secret will need to be generated. Modify
+ - By default, the **Secret Expires** in 3 days. That means you must use it in the Enterprise
+ Auditor Connection Profile within 72 hours, or you'll need to generate a new secret. Modify
if desired.
- Click **OK** to save the configuration and close the Add or edit API client window.
-- If the Activity Monitor Console server is not the API Server, then click **Use this console** to
+- If the Activity Monitor Console server isn't the API Server, then click **Use this console** to
grant the Activity Monitor the ability to manage the API server.
-- The IPv4 or IPv6 allowlist allows you to limit access to the API server data to specific hosts.
+- Use the IPv4 or IPv6 allowlist to limit access to the API server data to specific hosts.
**Step 4 –** Click **OK** to save the configuration and close the Agent properties window.
@@ -84,7 +84,7 @@ The next step is to configure the agents deployed to the domain controllers.
## Configure Domain Controller Agent
-Follow the steps to configure the agent deployed to the domain controller.
+To configure the agent deployed to the domain controller:
**Step 1 –** On the Agents tab of the Activity Monitor Console, select an agent deployed to domain
controller.
@@ -95,9 +95,9 @@ controller.
- Select the **Enable Archiving for this agent** checkbox.
- Select the **Archive log files on a UNC path** option. Click the **...** button and navigate to
- the desired network share on the API server.
-- The **User name** and **User password** fields only need to be filled in if the account used to
- install the agent does not have access to this share.
+ the network share you want on the API server.
+- Fill in the **User name** and **User password** fields only if the account used to
+ install the agent doesn't have access to this share.
:::tip
Remember, The account used to install the agent on a domain controller is a Domain
@@ -111,21 +111,21 @@ controller.
**Step 5 –** Repeat Steps 1-4 for each agent deployed to domain controller.
-These agent are configured to save the Archive logs to the selected share.
+These agents now save the Archive logs to the selected share.
## Configure Monitored Domain Output
-Follow the steps configure the monitored domain output for Netwrix Enterprise Auditor.
+To configure the monitored domain output for Netwrix Enterprise Auditor:
**Step 1 –** Select the **Monitored Domains** tab.
-**Step 2 –** Select the desired domain and click **Add Output**. The Add New Ouptut window opens.
+**Step 2 –** Select the domain you want and click **Add Output**. The Add New Ouptut window opens.
**Step 3 –** Configure the following:
-- Configure the desired number of days for the **Period to keep Log files**. This is the number of
- days the log files are kept on the API server configured in the sections above. This needs to be
- set to a greater value than the days between Enterprise Auditor scans.
+- Configure the number of days you want for the **Period to keep Log files**. This is the number of
+ days the log files are kept on the API server configured in the preceding sections. Set this to a
+ greater value than the days between Enterprise Auditor scans.
- For example, if Enterprise Auditor runs the **AD_ActivityCollection** Job once a week (every 7
days), then the Activity Monitor output should be configured to retain at least 10 days of log
@@ -142,12 +142,12 @@ Enterprise Auditor now has access to the agent log files for this domain.
## Configure Enterprise Auditor Connection Profile
-Follow the steps to configure the Connection Profile in Enterprise Auditor.
+To configure the Connection Profile in Enterprise Auditor:
:::tip
-Remember, the Client ID and Client Secret were generated by the API server and copied to a text
-file. If the secret expired before the Connection Profile is configured, it will need to be
-re-generated.
+Remember, the API server generated the Client ID and Client Secret, which you copied to a text
+file. If the secret expires before you configure the Connection Profile, you'll need to
+regenerate it.
:::
@@ -172,19 +172,19 @@ name.
Group. Select the **Settings > Connection** node.
**Step 7 –** Select the **Select one of the following user defined profiles** option. Expand the
-drop-down menu and select the Connection Profile with this credential.
+dropdown menu and select the Connection Profile with this credential.
**Step 8 –** Click **Save** and then **OK** to confirm the changes to the job group settings.
-The Connection Profile will now be used for AD Activity collection.
+Enterprise Auditor will now use the Connection Profile for AD Activity collection.
## Configure the AD_ActivityCollection Job
-The Enterprise Auditor requires additional configurations in order to collect domain activity data.
-Follow the steps to configure the **AD_ActivityCollection** Job.
+The Enterprise Auditor requires additional configurations to collect domain activity data.
+To configure the **AD_ActivityCollection** Job:
:::note
-Ensure that the **.Active Directory Inventory** Job Group has been successfully run
+Ensure that you have successfully run the **.Active Directory Inventory** Job Group
against the target domain.
:::
@@ -223,10 +223,10 @@ last step.
- Absolute Timespan – Set the date range for activity logs to collect when the scan is run
:::info
-The threshold should be set to ensure the logs are collected before the Activity
+Set the threshold to ensure you collect the logs before the Activity
Monitor domain output log retention expires. For example, if Enterprise Auditor runs the
-**AD_ActivityCollection** Job once a week (every 7 days), then the Activity Monitor output should be
-configured to retain at least 10 days of log files.
+**AD_ActivityCollection** Job once a week (every 7 days), then configure the Activity Monitor
+output to retain at least 10 days of log files.
:::
@@ -246,30 +246,29 @@ Credential with the Refresh token:
- Click **OK** to save and close the User Credentials window.
- Click **Save** and then **OK** to confirm the changes to the Connection Profile.
-The query is now configured to target the Activity Monitor API Server to collect domain activity
-logs.
+The query now targets the Activity Monitor API Server to collect domain activity logs.
### (Optional) Configure Import of AD Activity into Netwrix Access Information Center
-AD Activity data can be imported into Netwrix Access Information Center by the
-**AD_ActivityCollection** Job. However, this is disabled by default. Follow the steps to enable the
-importing of AD activity data into the Access Information Center.
+The **AD_ActivityCollection** Job can import AD Activity data into Netwrix Access Information
+Center. However, this feature is disabled by default. To enable the import of AD activity data
+into the Access Information Center:
**Step 1 –** Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **0.Collection** >
**AD_ActivityCollection** Job.
**Step 2 –** On the job's Overview page, enable the import of AD Events.
-- Click on the **Enable to import AD events into the AIC** parameter.
+- Click the **Enable to import AD events into the AIC** parameter.
- On the Parameter Configuration window, select the **Enabled** checkbox and click **Save**.
**Step 3 –** On the job's Overview page, enable the import of authentication Events.
-- Click on the **Enable to import authentication events into the AIC** parameter.
+- Click the **Enable to import authentication events into the AIC** parameter.
- On the Parameter Configuration window, select the **Enabled** checkbox and click **Save**.
**Step 4 –** Optionally, modify the **List of attributes to track for Object Modified changes** and
**Number of days to retain activity data in the AIC** parameters.
-The **AD_ActivityCollection** Job is now configured to import both AD events and authentication
+The **AD_ActivityCollection** Job now imports both AD events and authentication
events into the Netwrix Access Information Center.
diff --git a/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/activity/filearchive.md b/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/activity/filearchive.md
index 077a809fb8..5181043238 100644
--- a/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/activity/filearchive.md
+++ b/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/activity/filearchive.md
@@ -16,7 +16,7 @@ Deploy the AD Agent to each domain controller in the target domain.
## Configure Domain Controller Agent
-Follow the steps to configure the agent deployed to the domain controller.
+Configure the agent deployed to the domain controller.
:::note
These steps assume the network share where the activity log files will be archived already
@@ -35,7 +35,7 @@ controller.
- Select the **Archive log files on a UNC path** option. Click the ... button and navigate to the
desired network share.
- The **User name** and **User password** fields only need to be filled in if the account used to
- install the agent does not have access to this share.
+ install the agent doesn't have access to this share.
:::tip
Remember, The account used to install the agent on a domain controller is a Domain
@@ -52,7 +52,7 @@ controller.
**Step 5 –** Repeat Steps 1-4 for each agent deployed to domain controller pointing to the same
network share in Step 3 for each agent.
-These agent are configured to save the Archive logs to the selected share.
+These agents now save the Archive logs to the selected share.
## Configure Monitored Domain Output
@@ -60,13 +60,13 @@ Follow the steps configure the monitored domain output for Netwrix Enterprise Au
**Step 1 –** Select the **Monitored Domains** tab.
-**Step 2 –** Select the desired domain and click **Add Output**. The Add New Ouptut window opens.
+**Step 2 –** Select the domain you want and click **Add Output**. The Add New Ouptut window opens.
**Step 3 –** Configure the following:
-- Configure the desired number of days for the **Period to keep Log files**. This is the number of
- days the log files are kept on the API server configured in the sections above. This needs to be
- set to a greater value than the days between Enterprise Auditor scans.
+- Configure the number of days you want for the **Period to keep Log files**. This is the number of
+ days the log files are kept on the API server configured in the preceding sections. Set this to a
+ greater value than the days between Enterprise Auditor scans.
- For example, if Enterprise Auditor runs the **AD_ActivityCollection** Job once a week (every 7
days), then the Activity Monitor output should be configured to retain at least 10 days of log
@@ -83,7 +83,7 @@ Enterprise Auditor now has access to the agent log files for this domain.
## Configure Enterprise Auditor Connection Profile
-Follow the steps to configure the Connection Profile in Enterprise Auditor.
+Configure the Connection Profile in Enterprise Auditor.
**Step 1 –** On the Settings > Connection node of the Enterprise Auditor Console, select the
Connection Profile for the Active Directory solution. If you haven't yet created a Connection
@@ -111,19 +111,19 @@ name.
the **Settings > Connection** node.
**Step 7 –** Select the **Select one of the following user defined profiles** option. Expand the
-drop-down menu and select the Connection Profile with this credential.
+dropdown menu and select the Connection Profile with this credential.
**Step 8 –** Click **Save** and then **OK** to confirm the changes to the job group settings.
-The Connection Profile will now be used for AD Activity collection.
+Enterprise Auditor will now use the Connection Profile for AD Activity collection.
## Configure the AD_ActivityCollection Job
-The Enterprise Auditor requires additional configurations in order to collect domain activity data.
-Follow the steps to configure the **AD_ActivityCollection** Job.
+The Enterprise Auditor requires additional configurations to collect domain activity data.
+Configure the **AD_ActivityCollection** Job.
:::note
-Ensure that the .Active Directory Inventory Job Group has been successfully run against
+Ensure that you have successfully run the .Active Directory Inventory Job Group against
the target domain.
:::
@@ -154,10 +154,10 @@ Click **Next**.
- Absolute Timespan – Set the date range for activity logs to collect when the scan is run
:::info
-The threshold should be set to ensure the logs are collected before the Activity
+Set the threshold to ensure you collect the logs before the Activity
Monitor domain output log retention expires. For example, if Enterprise Auditor runs the
-**AD_ActivityCollection** Job once a week (every 7 days), then the Activity Monitor output should be
-configured to retain at least 10 days of log files.
+**AD_ActivityCollection** Job once a week (every 7 days), then configure the Activity Monitor
+output to retain at least 10 days of log files.
:::
@@ -168,5 +168,5 @@ keeps the collected data in the SQL Server database.
**Step 9 –** Click **OK** to save the changes and close the Query Properties page.
-The query is now configured to target the network share where the Activity Monitor domain activity
-logs are archived.
+The query now targets the network share where the Activity Monitor archives domain activity
+logs.
diff --git a/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/activity/threatprevention.md b/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/activity/threatprevention.md
index 9bf711d9c7..ae37df26f7 100644
--- a/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/activity/threatprevention.md
+++ b/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/activity/threatprevention.md
@@ -6,19 +6,19 @@ sidebar_position: 20
# Getting Data from NTP for AD Activity Reporting
-When Netwrix Threat Prevention is configured to monitor a domain, the event data collected by the
-policies can be provided to Netwrix Enterprise Auditor for Active Directory Activity reporting. This
-is accomplished by configuring Threat Prevention to send data to Netwrix Activity Monitor, which in
-turn creates the activity log files that Enterprise Auditor collects.
+When you configure Netwrix Threat Prevention to monitor a domain, you can provide the event data
+collected by the policies to Netwrix Enterprise Auditor for Active Directory Activity reporting. To
+do this, configure Threat Prevention to send data to Netwrix Activity Monitor, which in turn creates
+the activity log files that Enterprise Auditor collects.
:::note
-Threat Prevention can only be configured to send event data to one Netwrix application,
-either Netwrix Activity Monitor or Netwrix Threat Manager but not both. However, the Activity
-Monitor can be configured with outputs for Enterprise Auditor and Threat Manager
+You can only configure Threat Prevention to send event data to one Netwrix application,
+either Netwrix Activity Monitor or Netwrix Threat Manager but not both. However, you can configure
+the Activity Monitor with outputs for Enterprise Auditor and Threat Manager.
:::
-Follow these steps to configure this integration.
+Configure this integration.
:::info
It is a best practice to use the API Server option of the Activity Monitor for
@@ -36,17 +36,16 @@ Threat Manager Configuration** on the menu. The Netwrix Threat Manager Configura
`amqp://localhost:4499`
- You must use localhost, even if Activity Monitor and Threat Prevention are installed on
+ You must use localhost, even if you install Activity Monitor and Threat Prevention on
different servers.
- App Token – Leave this field blank for integration with Activity Monitor
- Policies – The table displays all policies created in Threat Prevention along with a State icon
- indicating if the policy is active. Check the **Send** box for the desired policies monitoring the
- target domain activity.
+ indicating if the policy is active. Check the **Send** box for the policies you want to send that
+ monitor the target domain activity.
**Step 3 –** Click **Save**.
-All real-time event data from the selected policies are now being sent to Activity Monitor.
-Additional policies can be added to this data stream through the Netwrix Threat Manager
-Configuration window or by selecting the **Send to Netwrix Threat Manager** option on the Actions
-tab of the policy.
+Activity Monitor now receives all real-time event data from the selected policies. You can add
+additional policies to this data stream through the Netwrix Threat Manager Configuration window or
+by selecting the **Send to Netwrix Threat Manager** option on the Actions tab of the policy.
diff --git a/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/overview.md b/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/overview.md
index 8c17dbdcdf..5d6efdac10 100644
--- a/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# Active Directory Domain Target Requirements
-Netwrix Enterprise Auditor can execute scans on Active Directory domains. The Netwrix Activity
-Monitor can be configured to monitor activity on Active Directory domains and make the event data
+Netwrix Enterprise Auditor can execute scans on Active Directory domains. You can configure the
+Netwrix Activity Monitor to monitor activity on Active Directory domains and make the event data
available for Enterprise Auditor Active Directory Activity scans.
## Auditing Permissions
@@ -29,7 +29,7 @@ topic for additional information.
## Activity Auditing Permissions
:::note
-Active Directory domain activity events can also be monitored through Netwrix Threat
+You can also monitor Active Directory domain activity events through Netwrix Threat
Prevention. This requires integration between it and Netwrix Activity Monitor to enable access to
the data for Enterprise Auditor Active Directory Activity scans. See the
[Getting Data from NTP for AD Activity Reporting](/docs/accessanalyzer/11.6/requirements/activedirectory/activedirectory/activity/threatprevention.md)
@@ -39,8 +39,8 @@ topic for additional information.
Requirements to Deploy the AD Agent on the Domain Controller
-The Netwrix Activity Monitor must have an AD Agent deployed on the domain controller to be
-monitored. While actively monitoring, the AD Agent generates activity log files stored on the
+The Netwrix Activity Monitor must have an AD Agent deployed on the domain controller you want to
+monitor. While actively monitoring, the AD Agent generates activity log files stored on the
server. The credential used to deploy the AD Agent must have the following permissions on the
server:
@@ -48,8 +48,8 @@ server:
- READ and WRITE access to the archive location for Archiving feature only
:::note
-For monitoring an Active Directory domain, the AD Agent must be installed on all domain
-controllers within the domain to be monitored.
+To monitor an Active Directory domain, install the AD Agent on all domain
+controllers within the domain you want to monitor.
:::
@@ -58,8 +58,8 @@ Enterprise Auditor to read the activity log files must have also have this permi
**Activity Monitor Archive Location**
-If the activity log files are being archived, configurable within the Netwrix Activity Monitor
-Console, then the credential used by Enterprise Auditor to read the activity log files must also
+If you archive the activity log files, configurable within the Netwrix Activity Monitor
+Console, then the credential Enterprise Auditor uses to read the activity log files must also
have READ and WRITE permissions on the archive location.
**Integration with Enterprise Auditor**
@@ -77,9 +77,9 @@ are required for communication between the Agent server and the Netwrix Activity
| -------------------------------- | -------- | ----- | ------------------- |
| Activity Monitor to Agent Server | TCP | 4498 | Agent Communication |
-The Windows firewall rules need to be configured on the Windows server, which require certain
-inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+You need to configure the Windows firewall rules on the Windows server, which require certain
+inbound rules if the scans run in applet mode. These scans operate over a default
+port range that you can't specify via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/11.6/requirements/aws/aws.md b/docs/accessanalyzer/11.6/requirements/aws/aws.md
index a0abe6e7a6..2c6fa5b5d8 100644
--- a/docs/accessanalyzer/11.6/requirements/aws/aws.md
+++ b/docs/accessanalyzer/11.6/requirements/aws/aws.md
@@ -32,10 +32,10 @@ These are dependent upon the size of the target environment:
| Disk Space | 30 GB | 30 GB |
:::note
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
+If running Sensitive Data Discovery (SDD) scans, you must increase the
minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For
-example, if the job is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are
-required (8x2=16).
+example, if you configure the job to scan 8 hosts at a time, the job requires an extra 16 GB of RAM
+(8x2=16).
:::
@@ -47,10 +47,9 @@ The following is required to run Sensitive Data Discovery scans:
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
-configuration; it has been preconfigured to work with Enterprise Auditor and should never be
-customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
-environment.
+(Java) version on the server. The deployed JDK is prepackaged, requires no configuration, comes
+preconfigured to work with Enterprise Auditor, and should never be customized through Java. It
+doesn't conflict with other JDKs or Java Runtimes in the same environment.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/aws/configurescans.md b/docs/accessanalyzer/11.6/requirements/aws/configurescans.md
index 83ebe03894..27531bd5a0 100644
--- a/docs/accessanalyzer/11.6/requirements/aws/configurescans.md
+++ b/docs/accessanalyzer/11.6/requirements/aws/configurescans.md
@@ -6,31 +6,31 @@ sidebar_position: 20
# Configure AWS for Scans
-In order to scan multiple AWS accounts using one account you need to create a role in each target
-account, so that It can provide the designated scanning account permissions to scan resources it
-controls. This is achieved through the following steps which will need to be completed leveraging a
-user with administrative access to each target account:
+To scan multiple AWS accounts using one account, create a role in each target
+account so it can grant the designated scanning account permission to scan the resources it
+controls. Complete the following steps using a user with administrative access to each target
+account:
-**Step 1 –** Create a Managed Policy in each target account that will be used to allow access to
-account (S3, Org and IAM).
+**Step 1 –** Create a Managed Policy in each target account to allow access to
+account (S3, Org, and IAM).
-**Step 2 –** Create a Role in each target account that will be used to allow access to listing IAM
+**Step 2 –** Create a Role in each target account to allow access to listing IAM
users.
-**Step 3 –** Create a Managed Policy in the designated scanning account that will be used to allow
+**Step 3 –** Create a Managed Policy in the designated scanning account to allow
the service account to assume the configured role in each target account.
-**Step 4 –** Add Role to Enterprise Auditor. The Role created in the scanning account will need to
-be added to the **1-AWS_OrgScan**, **2-AWS_S3Scan**, and **3-AWS_IAMScan** job query configurations.
+**Step 4 –** Add Role to Enterprise Auditor. Add the Role created in the scanning account
+to the **1-AWS_OrgScan**, **2-AWS_S3Scan**, and **3-AWS_IAMScan** job query configurations.
See the
[AWS: Login Roles](/docs/accessanalyzer/11.6/admin/datacollector/aws/loginroles.md)
topic for additional information.
-Once these steps are completed, the role must be added to the AWS queries within Enterprise Auditor.
+After you complete these steps, add the role to the AWS queries within Enterprise Auditor.
## Create a Managed Policy in Each Target Account
-The following steps will need to be completed in each target account.
+Complete the following steps in each target account.
**Step 1 –** Sign into the Identity and Access Management Console (IAM) as an administrator of the
Trusting account.
@@ -87,7 +87,7 @@ and click **Create policy**.
**Step 7 –** Click **Create Policy**.
:::note
-If the designated scanning account is not in Root (Master Account), create a second policy
+If the designated scanning account isn't in Root (Master Account), create a second policy
in the Master Account with the following JSON definition:
:::
@@ -110,12 +110,11 @@ in the Master Account with the following JSON definition:
}
```
-The next step is to create a role in each target account that will be used to allow access to
-listing IAM users.
+Next, create a role in each target account to allow access to listing IAM users.
## Create a Role in Each Target Account
-The following steps will need to be completed in each target account. For this, you will need the
+Complete the following steps in each target account. For this, you will need the
Account ID of the designating scanning account.
:::note
@@ -134,7 +133,7 @@ target account.
**Step 3 –** Select the **Another AWS Account** option and add the Account ID of the scanning
-account that will be leveraged within Enterprise Auditor.
+account that Enterprise Auditor will use.
**Step 4 –** Click **Next: Permissions**.
@@ -152,12 +151,12 @@ account that will be leveraged within Enterprise Auditor.
**Step 9 –** Click **Create Role**.
-The next step is to create a Managed Policy in the designated scanning account that will be used to
-allow the service account to assume the configured role in each target account.
+Next, create a Managed Policy in the designated scanning account to allow the service account to
+assume the configured role in each target account.
## Configure the Scanning Account
-Create a Managed Policy in the scanning account that will be used to allow the user to assume the
+Create a Managed Policy in the scanning account to allow the user to assume the
roles configured in each target account.
**Step 1 –** Sign into the Identity and Access Management Console (IAM) as an administrator of the
@@ -199,7 +198,7 @@ scanning account.
:::note
Replace `ROLENAME` with the name of the role that was created. If the `ROLENAME` is
-different in each account, then a policy will need to be created for each distinct role name.
+different in each account, then create a policy for each distinct role name.
:::
@@ -217,8 +216,8 @@ different in each account, then a policy will need to be created for each distin
-**Step 10 –** In the Security credentials tab, click **Create access key**. Make sure to note the
-Access key ID and Secret access key which need to be input into Enterprise Auditor.
+**Step 10 –** In the Security credentials tab, click **Create access key**, and note the
+Access key ID and Secret access key. You'll need to enter them into Enterprise Auditor.
You can now create the Connection Profile for the AWS Solution. See the
[Amazon Web Services for User Credentials](/docs/accessanalyzer/11.6/admin/settings/connection/create/aws.md)
diff --git a/docs/accessanalyzer/11.6/requirements/aws/target.md b/docs/accessanalyzer/11.6/requirements/aws/target.md
index d4b6da5a76..0baba4f98a 100644
--- a/docs/accessanalyzer/11.6/requirements/aws/target.md
+++ b/docs/accessanalyzer/11.6/requirements/aws/target.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Target Amazon Web Service Requirements, Permissions, and Ports
-The Enterprise Auditor for AWS Solution provides the ability to audit Amazon Web Services (AWS) to
+The Enterprise Auditor for AWS Solution lets you audit Amazon Web Services (AWS) to
collect IAM users, groups, roles, and policies, as well as S3 permissions, content, and sensitive
data from target AWS accounts. It scans:
@@ -24,11 +24,11 @@ This solution employs the following data collector to scan the target environmen
The permissions required to scan an AWS account are based on the type of information being
collected:
-- To collect details about the AWS Organization, the following permission is required:
+- To collect details about the AWS Organization, you need the following permission:
- organizations:DescribeOrganization
-- To collect details regarding IAM, the following permissions are required:
+- To collect details regarding IAM, you need the following permissions:
- iam:GenerateCredentialReport
- iam:GenerateServiceLastAccessedDetails
@@ -37,7 +37,7 @@ collected:
- iam:Simulate\*
- sts:GetAccessKeyInfo
-- To collect details related to S3 buckets and objects, the following permissions are required:
+- To collect details related to S3 buckets and objects, you need the following permissions:
- s3:Describe\*
- s3:Get\*
diff --git a/docs/accessanalyzer/11.6/requirements/box/target.md b/docs/accessanalyzer/11.6/requirements/box/target.md
index a336f4071b..04bc1f486f 100644
--- a/docs/accessanalyzer/11.6/requirements/box/target.md
+++ b/docs/accessanalyzer/11.6/requirements/box/target.md
@@ -42,7 +42,7 @@ This solution employs the following data collector to scan the target environmen
**For Box Data Collection**
Box scans require the Enterprise Admin or Co-Admin account credentials to generate an authorization
-code. The following can be used as a least privilege model:
+code. You can use the following as a least privilege model:
- Enterprise Admin account
- Co-Admin account with the permission to **Run new reports and access existing reports** enabled
diff --git a/docs/accessanalyzer/11.6/requirements/databases/databases.md b/docs/accessanalyzer/11.6/requirements/databases/databases.md
index cb9290680d..aa654780ea 100644
--- a/docs/accessanalyzer/11.6/requirements/databases/databases.md
+++ b/docs/accessanalyzer/11.6/requirements/databases/databases.md
@@ -11,8 +11,8 @@ Server, and Access Information Center. See the
[Requirements](/docs/accessanalyzer/11.6/requirements/overview.md)
topic for the core requirements.
-In addition to these, integration with either the Netwrix Activity Monitor is required for event
-activity data to be scanned. See the
+In addition to these, you need integration with the Netwrix Activity Monitor to scan event
+activity data. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor)
for installation requirements and information on collecting activity data.
@@ -43,10 +43,10 @@ These are dependent upon the size of the target environment:
| Disk Space | 460 GB | 280 GB | 160 GB | 80 GB |
:::note
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
-minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host.For
-example, if the job is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are
-required (8x2=16).
+If running Sensitive Data Discovery (SDD) scans, you must increase the
+minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For
+example, if you configure the job to scan 8 hosts at a time, the job requires an extra 16 GB of RAM
+(8x2=16).
:::
@@ -74,10 +74,9 @@ The following is required to run Sensitive Data Discovery scans:
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
-configuration; it has been preconfigured to work with Enterprise Auditor and should never be
-customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
-environment.
+(Java) version on the server. The deployed JDK is prepackaged, requires no configuration, comes
+preconfigured to work with Enterprise Auditor, and should never be customized through Java. It
+doesn't conflict with other JDKs or Java Runtimes in the same environment.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/databases/db2.md b/docs/accessanalyzer/11.6/requirements/databases/db2.md
index 4451fd6807..a40216996b 100644
--- a/docs/accessanalyzer/11.6/requirements/databases/db2.md
+++ b/docs/accessanalyzer/11.6/requirements/databases/db2.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Target Db2 Requirements, Permissions, and Ports
-The Enterprise Auditor for Databases Solution provides the ability to audit and monitor Db2 database
+The Enterprise Auditor for Databases Solution lets you audit and monitor Db2 database
environments to collect permissions and sensitive data. It scans:
- DB2LUW 11+
@@ -25,7 +25,7 @@ addition, the following clients and drivers must be installed:
- IBM .NET Driver NuGet
:::note
-All necessary clients and drivers can be found on IBM Support's
+You can find all necessary clients and drivers on IBM Support's
[Download initial version 11.5 clients and drivers](https://www.ibm.com/support/pages/download-initial-version-115-clients-and-drivers)
page. From the list of available packages, select the IBM Data Server Client, which is the
all-in-one client package. This package includes all of the client tools and available libraries, as
diff --git a/docs/accessanalyzer/11.6/requirements/databases/mongodb.md b/docs/accessanalyzer/11.6/requirements/databases/mongodb.md
index 4bb081559e..a3393de7d5 100644
--- a/docs/accessanalyzer/11.6/requirements/databases/mongodb.md
+++ b/docs/accessanalyzer/11.6/requirements/databases/mongodb.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Target MongoDB Requirements, Permissions, and Ports
-The Enterprise Auditor for Databases Solution provides the ability to audit and monitor MongoDB
+The Enterprise Auditor for Databases Solution lets you audit and monitor MongoDB
database environments to collect permissions and sensitive data. It scans:
- MongoDB 5.0
diff --git a/docs/accessanalyzer/11.6/requirements/databases/mysql.md b/docs/accessanalyzer/11.6/requirements/databases/mysql.md
index 6756c54a8d..dbd4dbb1b0 100644
--- a/docs/accessanalyzer/11.6/requirements/databases/mysql.md
+++ b/docs/accessanalyzer/11.6/requirements/databases/mysql.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Target MySQL Requirements, Permissions, and Ports
-The Enterprise Auditor for Databases Solution provides the ability to audit and monitor MySQL
+The Enterprise Auditor for Databases Solution lets you audit and monitor MySQL
database environments to collect permissions and sensitive data. It scans:
- MySQL 5.x
diff --git a/docs/accessanalyzer/11.6/requirements/databases/oracle/leastprivilege.md b/docs/accessanalyzer/11.6/requirements/databases/oracle/leastprivilege.md
index 6d5e6c0e0d..4bdc3efbe7 100644
--- a/docs/accessanalyzer/11.6/requirements/databases/oracle/leastprivilege.md
+++ b/docs/accessanalyzer/11.6/requirements/databases/oracle/leastprivilege.md
@@ -6,9 +6,9 @@ sidebar_position: 10
# Oracle Target Least Privilege Model
-We recommend using an account DBA privilege to run Enterprise Auditor against an Oracle database.
-However, if that is not acceptable all the privileges that are required to configure and run the
-solution are below and can be used to implement the least privileges necessary.
+Netwrix recommends using an account with DBA privilege to run Enterprise Auditor against an Oracle
+database. However, if that isn't acceptable, the following privileges are required to configure and
+run the solution and implement the least privileges necessary.
## Create Session Privilege
@@ -21,7 +21,7 @@ GRANT CREATE SESSION TO %USERNAME%;
```
:::note
-The above command will grant the privilege only in the current container. To follow the
+This command grants the privilege only in the current container. To follow the
least privilege model, only grant the privilege on the containers (or pluggable databases) that you
will be scanning with Enterprise Auditor.
:::
@@ -45,8 +45,8 @@ topic for additional information.
This Job uses Nmap to locate listening Oracle ports on servers by scanning for ports using the
service Oracle TNS Listener or optionally using specified ports, such as 1521. The Nmap utility can
-be downloaded from [nmap.org](http://www.nmap.org/). To run this job, the user needs to have a
-permission to execute any PowerShell script on the local host if the host is running the Microsoft
+be downloaded from [nmap.org](http://www.nmap.org/). To run this job, the user needs permission to
+execute any PowerShell script on the local host if the host is running the Microsoft
Windows operating system. In addition, on the Windows host, PowerShell execution policy needs to be
sent as well. For example, to set the execution policy to `Unrestricted`, run the following command
on the PowerShell command line:
@@ -55,12 +55,12 @@ on the PowerShell command line:
Set-ExecutionPolicy -ExecutionPolicy Unrestricted
```
-In case of Linux and UNIX hosts, the `plink` command needs to be executed on the Enterprise Auditor
+In case of Linux and UNIX hosts, you must execute the `plink` command on the Enterprise Auditor
Console server to update the local file with the SSH keys.
:::note
-The plink utility in the Enterprise Auditor installation directory has to be used. A
-version of plink gets installed with the Nmap utility.
+You must use the plink utility in the Enterprise Auditor installation directory. The
+Nmap utility installs a version of plink.
:::
@@ -77,11 +77,11 @@ C:\Program Files (x86)\Stealthbits\StealthAUDIT\plink -store_new_k
## Oracle SID Discovery
This Job collects the Oracle SID from discovered Oracle servers and uses WMI or SSH to collect
-running Oracle processes from the Oracle servers. The process is used to determine the name of the
+running Oracle processes from the Oracle servers. It uses this process to determine the name of the
Oracle SID. When multiple Oracle instances are running on a server, each SID will have its own entry
in this table.
-This Job requires local administrator rights on the target hosts in order to read the running
+This Job requires local administrator rights on the target hosts to read the running
processes using either WMI or SSH.
## Oracle Instance Discovery
@@ -117,12 +117,12 @@ ALTER USER %USERNAME% SET CONTAINER_DATA=ALL CONTAINER = CURRENT;
## Oracle Permission Auditing
-The Oracle Permissions Scan job is responsible for collecting all permissions from all licensed
+The Oracle Permissions Scan job collects all permissions from all licensed
database types for all target instances.
### Oracle Database 19c Series Permissions
-In order to collect permissions from Oracle Database 19c series, the user credential requires at
+to collect permissions from Oracle Database 19c series, the user credential requires at
least the following `SELECT` privilege on the targeted database for the following views and tables:
- CDB_COL_PRIVS view
@@ -152,7 +152,7 @@ least the following `SELECT` privilege on the targeted database for the followin
- DBA_SYS_PRIVS view
- DBA_TAB_PRIVS view
-For example, to grant all of the above privileges, run the following set of commands in SQL
+For example, to grant all of the preceding privileges, run the following set of commands in SQL
Developer or SQL\*Plus:
```
@@ -189,7 +189,7 @@ GRANT SELECT ON DBA_TAB_PRIVS TO %USERNAME%;
### Oracle Database 12c Series Permissions
-In order to collect permissions from Oracle Database 12c series, the user credential requires at
+to collect permissions from Oracle Database 12c series, the user credential requires at
least the following `SELECT` privilege on the targeted database for the following views and tables:
- CDB_COL_PRIVS view
@@ -209,7 +209,7 @@ least the following `SELECT` privilege on the targeted database for the followin
- V_$CONTAINERS view.
- SYS.USER$ table.
-For example, to grant all of the above privileges, run the following set of commands in SQL
+For example, to grant all of the preceding privileges, run the following set of commands in SQL
Developer or SQL\*Plus:
```
@@ -233,7 +233,7 @@ GRANT SELECT ON SYS.USER$ TO %USERNAME%;
### Oracle Database 11g Series Permissions
-In order to collect permissions from Oracle Database 11g series, the user credential requires at
+to collect permissions from Oracle Database 11g series, the user credential requires at
least the following `SELECT` privileges on the targeted database for the following views and tables:
- DBA_COL_PRIVS view
@@ -251,7 +251,7 @@ least the following `SELECT` privileges on the targeted database for the followi
- V_$PARAMETER view
- SYS.USER$ table
-For example, to grant all of the above privileges, run the following set of commands in Oracle SQL
+For example, to grant all of the preceding privileges, run the following set of commands in Oracle SQL
Developer or SQL\*Plus:
```
@@ -273,7 +273,7 @@ GRANT SELECT ON SYS.USER$ TO %USERNAME%;
## Oracle Sensitive Data Auditing
-This job is responsible for identifying sensitive data that has been stored within target database
+This job identifies sensitive data stored within target database
instances.
Before running this scan, ensure that Oracle database statistics are up to date at least for the
@@ -286,7 +286,7 @@ EXEC DBMS_STATS.GATHER_TABLE_STATS('%SCHEMA_NAME%', ‘%TABLE_NAME%’);
### Oracle Database 12c Series Sensitive Data
-In order to perform a sensitive data scan on Oracle database 12c series, the user credential
+to perform a sensitive data scan on Oracle database 12c series, the user credential
requires at least the following `SELECT` privileges on the targeted database for the following
views:
@@ -295,7 +295,7 @@ views:
- CDB_TAB_COLS view
- CDB_OBJECTS view
-For example, to grant the above privileges, run the following set of commands in SQL Developer or
+For example, to grant the preceding privileges, run the following set of commands in SQL Developer or
SQL\*Plus:
```
@@ -307,7 +307,7 @@ GRANT SELECT ON CDB_OBJECTS TO %USERNAME%;
### Oracle Database 11g Series Sensitive Data
-In order to perform a sensitive data scan on Oracle database 11g series, the user credential
+to perform a sensitive data scan on Oracle database 11g series, the user credential
requires at least the following `SELECT` privileges on the targeted database for the following
views:
@@ -315,7 +315,7 @@ views:
- DBA_TAB_COLS view
- DBA_OBJECTS view
-For example, to grant the above privileges, run the following set of commands in SQL Developer or
+For example, to grant the preceding privileges, run the following set of commands in SQL Developer or
SQL\*Plus:
```
@@ -324,9 +324,12 @@ GRANT SELECT ON DBA_TAB_COLS TO %USERNAME%;
GRANT SELECT ON DBA_OBJECTS TO %USERNAME%;
```
-Please note that the `SELECT` privilege needs to be granted individually on all sensitive data
-tables to be targeted (more secure). To accomplish it, run the following command for each targeted
-sensitive data table:
+:::note
+The `SELECT` privilege needs to be granted individually on all sensitive data tables to be
+targeted (more secure).
+:::
+
+To accomplish it, run the following command for each targeted sensitive data table:
```
GRANT SELECT ON %YOUR_SENSITIVE_DATA_TABLE% TO %USERNAME%;
@@ -341,12 +344,12 @@ GRANT SELECT ANY TABLE TO %USERNAME%;
## Oracle Activity Auditing
-This job is responsible for collecting audit data from configured database server audits on target
+This job collects audit data from configured database server audits on target
endpoints.
### Oracle Database 12c Series Activity Data
-In order to perform an activity data scan on Oracle database 12c series, the user credential
+to perform an activity data scan on Oracle database 12c series, the user credential
requires at least the following `SELECT` privileges on the targeted database for the following
views:
@@ -354,7 +357,7 @@ views:
- CDB_COMMON_AUDIT_TRAIL view
- UNIFIED_AUDIT_TRAIL view
-For example, to grant the above privileges, run the following set of commands in SQL Developer or
+For example, to grant the preceding privileges, run the following set of commands in SQL Developer or
SQL\*Plus:
```
@@ -363,7 +366,7 @@ GRANT SELECT ON CDB_COMMON_AUDIT_TRAIL TO %USERNAME%;
GRANT SELECT ON UNIFIED_AUDIT_TRAIL TO %USERNAME%;
```
-If the audit trail mode is `QUEUED`, then audit records are not written to disk until the in-memory
+If the audit trail mode is `QUEUED`, then audit records aren't written to disk until the in-memory
queues are full. The following procedure explicitly flushes the queues to disk, so that the audit
trail records are viewable in the `UNIFIED_AUDIT_TRAIL` view:
@@ -373,14 +376,14 @@ EXEC SYS.DBMS_AUDIT_MGMT.FLUSH_UNIFIED_AUDIT_TRAIL;
### Oracle Database 11g Series Activity Data
-In order to perform an activity data scan on Oracle database 11g series, the user credential
+to perform an activity data scan on Oracle database 11g series, the user credential
required at least the following `SELECT` privileges on the targeted database for the following
views:
- V_$DATABASE view
- DBA_COMMON_AUDIT_TRAIL view
-For example, to grant the above privileges, run the following set of commands in SQL Developer or
+For example, to grant the preceding privileges, run the following set of commands in SQL Developer or
SQL\*Plus:
```
@@ -390,7 +393,7 @@ GRANT SELECT ON DBA_COMMON_AUDIT_TRAIL TO %USERNAME%;
## Oracle Users with Default Passwords Job
-The 4-Oracle_DefaultPasswordUsers job is responsible for collecting usernames of users whose
+The 4-Oracle_DefaultPasswordUsers job collects usernames of users whose
passwords have not been updated since the database creation.
The user needs to have a `SELECT` privilege on `CDB_USERS_WITH_DEFPWD` table for Oracle container
diff --git a/docs/accessanalyzer/11.6/requirements/databases/oracle/oracle.md b/docs/accessanalyzer/11.6/requirements/databases/oracle/oracle.md
index 8edd619d92..0163215e87 100644
--- a/docs/accessanalyzer/11.6/requirements/databases/oracle/oracle.md
+++ b/docs/accessanalyzer/11.6/requirements/databases/oracle/oracle.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Target Oracle Requirements, Permissions, and Ports
-The Enterprise Auditor for Databases Solution provides the ability to audit and monitor Oracle
+The Enterprise Auditor for Databases Solution lets you audit and monitor Oracle
database environments to collect permissions, sensitive data, and activity events. It scans:
- Oracle Database 12c
diff --git a/docs/accessanalyzer/11.6/requirements/databases/postgresql.md b/docs/accessanalyzer/11.6/requirements/databases/postgresql.md
index eb0efa22a0..37854a4d62 100644
--- a/docs/accessanalyzer/11.6/requirements/databases/postgresql.md
+++ b/docs/accessanalyzer/11.6/requirements/databases/postgresql.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Target PostgreSQL Requirements, Permissions, and Ports
-The Enterprise Auditor for Databases Solution provides the ability to audit and monitor PostgreSQL
+The Enterprise Auditor for Databases Solution lets you audit and monitor PostgreSQL
database environments to collect permissions and sensitive data. It scans:
- Open Source PostgreSQL 9x through 12x
diff --git a/docs/accessanalyzer/11.6/requirements/databases/redshift.md b/docs/accessanalyzer/11.6/requirements/databases/redshift.md
index 7695bb3084..6dd930709d 100644
--- a/docs/accessanalyzer/11.6/requirements/databases/redshift.md
+++ b/docs/accessanalyzer/11.6/requirements/databases/redshift.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# Target Redshift Requirements, Permissions, and Ports
-The Enterprise Auditor for Databases Solution provides the ability to audit and monitor Redshift
+The Enterprise Auditor for Databases Solution lets you audit and monitor Redshift
database environments to collect permissions and sensitive data. It scans:
- Amazon AWS Redshift
diff --git a/docs/accessanalyzer/11.6/requirements/databases/sql/azuresql.md b/docs/accessanalyzer/11.6/requirements/databases/sql/azuresql.md
index 802afb4d1e..04fb7d223a 100644
--- a/docs/accessanalyzer/11.6/requirements/databases/sql/azuresql.md
+++ b/docs/accessanalyzer/11.6/requirements/databases/sql/azuresql.md
@@ -7,15 +7,15 @@ sidebar_position: 10
# AzureSQL Target Least Privilege Model
To access the AzureSQL database, users require the Control permission for the target database. Users
-with the Control Database permission have access to perform activity scans due to the function
-leveraged by AzureSQL to return the required audit logs. See the
+with the Control Database permission can perform activity scans due to the function
+AzureSQL uses to return the required audit logs. See the
[Auditing for Azure SQL Database and Azure Synapse Analytics](https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview?view=azuresql)
Microsoft Knowledge Base article for additional information.
:::info
-It is recommended to create a new user when leveraging a least privilege access
-model to access the AzureSQL database because the user must exist in the master database and all
-target database(s). A least privilege access model is one that uses the bare minimum privileges
+Netwrix recommends creating a new user when using a least privilege access
+model to access the AzureSQL database, because the user must exist in the master database and all
+target databases. A least privilege access model uses the bare minimum privileges
required to carry out collections for the AzureSQL data collector.
:::
@@ -24,14 +24,14 @@ The following role and permission are required for the Least Privilege Model:
- db_datareader role
- View Database Performance State permission
-- Control permission on target database(s)
+- Control permission on target databases
:::note
- Control permission must be granted on any database you wish to collect data for.
+ You must grant Control permission on any database you want to collect data for.
:::
-Follow the steps to configure the least privilege access model for AzureSQL collections.
+Configure the least privilege access model for AzureSQL collections.
**Step 1 –** To login with the user, run the following script against the master database:
@@ -59,4 +59,4 @@ script:
`GRANT CONTROL ON DATABASE`
-The user is granted Control permission based on the least privilege access model.
+These steps grant the user Control permission based on the least privilege access model.
diff --git a/docs/accessanalyzer/11.6/requirements/databases/sql/azuresqlaccess.md b/docs/accessanalyzer/11.6/requirements/databases/sql/azuresqlaccess.md
index ae5a6b8c82..f07f4dd92c 100644
--- a/docs/accessanalyzer/11.6/requirements/databases/sql/azuresqlaccess.md
+++ b/docs/accessanalyzer/11.6/requirements/databases/sql/azuresqlaccess.md
@@ -12,7 +12,7 @@ Azure SQL Auditing supports three different audit log destinations. At present E
only supports storage as the audit log destination. This document describes the necessary
permissions required to configure the Enterprise Auditor Azure SQL Job Group.
-Enterprise Auditorfor Azure SQL enables users to create custom roles which allow for differential
+With Enterprise Auditor for Azure SQL, you can create custom roles that allow for differential
access to Enterprise Auditor.
Within Enterprise Auditor for Azure SQL, roles are created specifically to target Azure SQL
@@ -32,7 +32,7 @@ This will enable Enterprise Auditor to discover all the SQL databases present in
## Create a StealthAUDIT Custom Role
-Follow the steps below to create an Azure SQL custom role at the subscription level.
+Create an Azure SQL custom role at the subscription level.
@@ -47,7 +47,7 @@ subscriptions in the left-hand menu.
**Step 3 –** Click **Add** > Add **Custom Role**.
**Step 4 –** Create a JSON file using the subscription ID provided by Microsoft Azure (see the
-example below) and save it to a local directory.
+following example) and save it to a local directory.
```json
{
@@ -167,17 +167,16 @@ example below) and save it to a local directory.
Once that file is chosen, the Review + Create button should be enabled.
Click **Review + Create** to create the role or click **Next** to review and edit the permissions.
-Once the JSON file is opened, the Custom Role Name and Description boxes will be populated
-automatically. The name and description of the custom role can be customized if required in this
-step.
+After the JSON file is opened, Azure automatically populates the Custom Role Name and Description
+boxes. You can customize the name and description of the custom role in this step, if required.
**Step 6 –** Click Create. This action will save and finalize a custom role entitled Enterprise
Auditor Azure SQL Role.
-**Step 7 –** Click OK on the final screen to complete the custom role creation process. The custom
-role can now be used to register the Enterprise Auditor application within the Azure portal.
+**Step 7 –** Click OK on the final screen to complete the custom role creation process. You can now
+use the custom role to register the Enterprise Auditor application within the Azure portal.
:::note
Depending upon the number of resources in the Azure tenancy, it might take some time for
@@ -187,7 +186,7 @@ the role to be made available to the resources.
## Register an Azure SQL Application
-Follow the steps below to create an Azure SQL Application Registration in the Azure portal.
+Create an Azure SQL Application Registration in the Azure portal.
**Step 1 –** In the Azure portal under Azure Services, click the **App Registration** icon.
@@ -200,8 +199,8 @@ Follow the steps below to create an Azure SQL Application Registration in the A
**Step 3 –** Enter a **Name** for the application and select an appropriate option from the
Supported account types options.
-**Step 4 –** Click **Register** at the bottom of the page when finished. Once the application has
-been registered, the App registration overview blade will appear. Take note of the _Application
+**Step 4 –** Click **Register** at the bottom of the page when finished. After you register the
+application, the App registration overview blade appears. Take note of the _Application
(client) ID_ on this page.
:::note
@@ -216,10 +215,10 @@ Enterprise Auditor.
secret**.
**Step 6 –** Enter a unique identifier in the Description field of the Add a client secret window.
-Select a Expiration time frame from the drop down. Click **Add** when finished.
+Select a Expiration time frame from the dropdown. Click **Add** when finished.
:::tip
-Remember, you will have to update the Enterprise Auditor Connection Profile once the expiration
+Remember, you will have to update the Enterprise Auditor Connection Profile when the expiration
time frame is reached (within 24 months, for example).
:::
@@ -236,29 +235,29 @@ profile.
## Add a Role Assignment
-Follow the steps below to add a role assignment to the custom role and newly registered Enterprise
-Auditor Azure SQL application.
+Add a role assignment to the custom role and newly registered Enterprise
+Auditor Azure SQL application.
**Step 1 –** Navigate to the Subscriptions blade and click the **Access Control (IAM)** option.
-Click the **Add** drop down > Click **Add role assignment**.
+Click the **Add** dropdown > Click **Add role assignment**.
-**Step 2 –** Search for and click the recently created custom role from the Role drop down. See
+**Step 2 –** Search for and click the recently created custom role from the Role dropdown. See
[Create a StealthAUDIT Custom Role](#create-a-stealthaudit-custom-role) for steps required to create
a custom role in the Azure portal.
**Step 3 –** Search for and select the recently registered Azure SQL application from the Select
-drop down. See [Register an Azure SQL Application](#register-an-azure-sqlapplication) for steps
+dropdown. See [Register an Azure SQL Application](#register-an-azure-sqlapplication) for steps
required to register an Azure SQL application in the Azure portal. The registered application will
be visible in the Selected members window. Click **Save** when finished.
-**Step 4 –** Search for and select the SQL Server Contributor role in the Role drop down.
+**Step 4 –** Search for and select the SQL Server Contributor role in the Role dropdown.
**Step 5 –** Search for and select the recently registered Azure SQL application from the Select
-drop down. See [Register an Azure SQL Application](#register-an-azure-sqlapplication) for steps
+dropdown. See [Register an Azure SQL Application](#register-an-azure-sqlapplication) for steps
required to register an Azure SQL application in the Azure portal. The registered application will
be visible in the Selected members window. Click **Save** when finished.
@@ -267,7 +266,7 @@ be visible in the Selected members window. Click **Save** when finished.
**Step 6 –** Navigate to the **Subscriptions** blade. Click **Access Control (IAM)**.
**Step 7 –** Click the **Check access** menu tab Search for and select the recently registered Azure
-SQL application from the drop down. See
+SQL application from the dropdown. See
[Register an Azure SQL Application](#register-an-azure-sqlapplication) for steps required to
register an Azure SQL application in the Azure portal. A preview window will appear on the
right-hand side of the window.
diff --git a/docs/accessanalyzer/11.6/requirements/databases/sql/sql.md b/docs/accessanalyzer/11.6/requirements/databases/sql/sql.md
index cef509e708..1092a69d52 100644
--- a/docs/accessanalyzer/11.6/requirements/databases/sql/sql.md
+++ b/docs/accessanalyzer/11.6/requirements/databases/sql/sql.md
@@ -6,7 +6,7 @@ sidebar_position: 70
# Target SQL Server Requirements, Permissions, and Ports
-The Enterprise Auditor for Databases Solution provides the ability to audit and monitor SQL Server
+The Enterprise Auditor for Databases Solution lets you audit and monitor SQL Server
database environments to collect permissions, sensitive data, and activity events. It scans:
- Azure SQL
@@ -80,7 +80,7 @@ This solution employs the following data collector to scan the target environmen
- Read access to SQL instance
- Requires SQL Full-Text and Semantic Extractions for Search feature to be installed on the
- target SQL instance(s) when using the **Scan full rows for sensitive data** option on the
+ target SQL instances when using the **Scan full rows for sensitive data** option on the
Options wizard page
- Grant Authenticate Server to [DOMAIN\USER]
- Grant Connect SQL to [DOMAIN\USER]
diff --git a/docs/accessanalyzer/11.6/requirements/dropbox/dropbox.md b/docs/accessanalyzer/11.6/requirements/dropbox/dropbox.md
index d384f3117f..6465392b82 100644
--- a/docs/accessanalyzer/11.6/requirements/dropbox/dropbox.md
+++ b/docs/accessanalyzer/11.6/requirements/dropbox/dropbox.md
@@ -39,7 +39,7 @@ These are dependent upon the size of the target environment:
| Disk Space | 30 GB | 30 GB |
:::note
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
+If running Sensitive Data Discovery (SDD) scans, you must increase the
minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host.For
example, if the job is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are
required (8x2=16).
@@ -54,7 +54,7 @@ The following is required to run Sensitive Data Discovery scans:
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
configuration; it has been preconfigured to work with Enterprise Auditor and should never be
customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
diff --git a/docs/accessanalyzer/11.6/requirements/dropbox/target.md b/docs/accessanalyzer/11.6/requirements/dropbox/target.md
index f6b2f10fe2..7ba362bae3 100644
--- a/docs/accessanalyzer/11.6/requirements/dropbox/target.md
+++ b/docs/accessanalyzer/11.6/requirements/dropbox/target.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Target Dropbox Requirements, Permissions, and Ports
-The Enterprise Auditor for AWS Solution provides the ability to audit Dropbox. It scans:
+The Enterprise Auditor for AWS Solution lets you audit Dropbox. It scans:
- Dropbox
@@ -20,10 +20,10 @@ This solution employs the following data collector to scan the target environmen
- Dropbox Team Administrator
-The DropboxAccess Data Collector requires the generation of an access token that is used to
-configure the Connection Profile for Dropbox. The access token is generated from within the Dropbox
-Access Auditor Data Collector Wizard on the Scan Options page. Once the access token is copied into
-a Connection Profile for Dropbox, it will be saved and does not need to be generated again. See the
+The DropboxAccess Data Collector requires an access token to configure the Connection Profile for
+Dropbox. Generate the access token from within the Dropbox Access Auditor Data Collector Wizard on
+the Scan Options page. After you copy the access token into a Connection Profile for Dropbox, it's
+saved and you don't need to generate it again. See the
[DropboxAccess: Scan Options](/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/scanoptions.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/requirements/entraid/entraid/access.md b/docs/accessanalyzer/11.6/requirements/entraid/entraid/access.md
index 0f6d234b09..7e24686647 100644
--- a/docs/accessanalyzer/11.6/requirements/entraid/entraid/access.md
+++ b/docs/accessanalyzer/11.6/requirements/entraid/entraid/access.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Microsoft Entra ID Auditing Configuration
-The Enterprise Auditor for Entra ID Solution provides the ability to audit Microsoft Entra ID,
+The Enterprise Auditor for Entra ID Solution lets you audit Microsoft Entra ID,
formerly Azure Active Directory. It scans:
- Microsoft Entra ID (formerly Azure AD)
@@ -23,19 +23,19 @@ Microsoft Entra ID.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you register the application:
- Client ID – This is the Application (client) ID for the registered application
- Key – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
- copied first.
+ You can't retrieve the value after saving the new key. Copy it
+ first.
:::
:::note
-In order to add custom attributes, you will also need to know the Tenant name of the Entra
+to add custom attributes, you will also need to know the Tenant name of the Entra
ID environment.
:::
@@ -67,10 +67,10 @@ The following permissions are required:
## Register a Microsoft Entra ID Application
-Follow the steps to register Enterprise Auditor with Microsoft Entra ID.
+Register Enterprise Auditor with Microsoft Entra ID.
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -92,14 +92,14 @@ registrations.
**Step 5 –** Click **Register**.
The Overview page for the newly registered app opens. Review the newly created registered
-application. Now that the application has been registered, permissions need to be granted to it.
+application. Now that you've registered the application, you need to grant it permissions.
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
+Grant permissions to the registered application.
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -131,15 +131,15 @@ tab. Select the following permissions:
**Step 6 –** Click **Grant Admin Consent for [tenant]**. Then click **Yes** in the confirmation
window.
-Now that the permissions have been granted to it, the Connection Profile and host settings for
-Enterprise Auditor need to be collected.
+Now that you've granted the permissions, you need to collect the Connection Profile and host
+settings for Enterprise Auditor.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
+Find the registered application's Client ID.
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -162,18 +162,18 @@ topic for additional information. Next generate the application’s Client Secre
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
+Find the registered application's Client Secret, create a new key, and save its
value when saving the new key.
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
+It isn't possible to retrieve the value after saving the new key. It must be copied
first.
:::
@@ -200,12 +200,12 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
-this process will have to be repeated.
+If you leave this page before copying the key, the key isn't retrievable, and
+you'll have to repeat this process.
:::
-**Step 6 –** The Client Secret will be displayed in the Value column of the table. You can use the
+**Step 6 –** The Value column of the table displays the Client Secret. You can use the
Copy to clipboard button to copy the Client Secret.
**Step 7 –** Save this value in a text file.
@@ -219,10 +219,10 @@ topic for additional information.
## Identify the Tenant Name
-Follow the steps to find the Tenant Name where the registered application resides.
+Find the Tenant Name where the registered application resides.
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/entraid/entraid/overview.md b/docs/accessanalyzer/11.6/requirements/entraid/entraid/overview.md
index b511d87de8..00dae46617 100644
--- a/docs/accessanalyzer/11.6/requirements/entraid/entraid/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/entraid/entraid/overview.md
@@ -10,8 +10,8 @@ Netwrix Enterprise Auditor can execute scans on Microsoft Entra ID, formerly Azu
## Auditing Permissions
-It is necessary to register Enterprise Auditor as a web application to the targeted Microsoft Entra
-ID in order for Enterprise Auditor to scan the environment. This generates the Client ID (App ID)
+Register Enterprise Auditor as a web application with the targeted Microsoft Entra
+ID so Enterprise Auditor can scan the environment. This generates the Client ID (App ID)
and Key (App Key) needed for the Connection Profile credentials and the Custom Attributes Import
Wizard page.
diff --git a/docs/accessanalyzer/11.6/requirements/exchange/exchange.md b/docs/accessanalyzer/11.6/requirements/exchange/exchange.md
index 8e2dce4af6..abbc9ee63a 100644
--- a/docs/accessanalyzer/11.6/requirements/exchange/exchange.md
+++ b/docs/accessanalyzer/11.6/requirements/exchange/exchange.md
@@ -40,7 +40,7 @@ These are dependent upon the size of the target environment:
| Disk Space | 120 GB | 120 GB |
:::note
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
+If running Sensitive Data Discovery (SDD) scans, you must increase the
minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host.For
example, if the job is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are
required (8x2=16).
@@ -55,7 +55,7 @@ The following is required to run Sensitive Data Discovery scans:
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
configuration; it has been preconfigured to work with Enterprise Auditor and should never be
customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
@@ -67,7 +67,7 @@ environment.
The following are additional requirements for the Enterprise Auditor Console server specific to
running the Exchange Solution:
-- Outlook should not be installed
+- Outlook shouldn't be installed
- StealthAUDIT MAPI CDO installed (for MAPI- based data collectors). See the
[StealthAUDIT MAPI CDO Installation](/docs/accessanalyzer/11.6/install/stealthauditmapicdoinstallation/stealthaudit_mapi_cdo_installation.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/requirements/exchange/exchangeonline/access.md b/docs/accessanalyzer/11.6/requirements/exchange/exchangeonline/access.md
index 568500de4d..bf1348c07d 100644
--- a/docs/accessanalyzer/11.6/requirements/exchange/exchangeonline/access.md
+++ b/docs/accessanalyzer/11.6/requirements/exchange/exchangeonline/access.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# Exchange Online Auditing Configuration
-It is necessary to register Enterprise Auditor as a web application to the targeted Microsoft Entra
-ID, formerly Azure Active Directory, in order for Enterprise Auditor to scan the environment. This
+Register Enterprise Auditor as a web application with the targeted Microsoft Entra
+ID, formerly Azure Active Directory, so Enterprise Auditor can scan the environment. This
generates the Client ID (App ID) and self-signed certificate (Certificate Thumbprint) needed for the
Connection Profile credentials and/or the Custom Attributes Import Wizard page. See
[Microsoft Support](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-reporting-api-prerequisites-azure-portal)
@@ -21,7 +21,7 @@ Microsoft Entra ID.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you register the application:
- Client ID – This is the Application (client) ID for the registered application
- Tenant name – This is the primary domain name of the Microsoft Entra tenant
@@ -30,9 +30,9 @@ The following settings are needed from your tenant once you have registered the
Configure Modern Authentication for Exchange Online using EX_RegisterAzureAppAuth Instant Job
-Registering a Microsoft Entra ID application and provisioning it to grant permissions to Exchange
-Online can be automated using the EX_RegisterAzureAppAuth job from the Enterprise Auditor Instant
-Job Library. The EX_RegisterAzureAppAuth job uses the PowerShell Data Collector to automatically
+The EX_RegisterAzureAppAuth job from the Enterprise Auditor Instant Job Library can automate
+registering a Microsoft Entra ID application and provisioning it to grant permissions to Exchange
+Online. The EX_RegisterAzureAppAuth job uses the PowerShell Data Collector to automatically
configure modern authentication for Exchange Online. It requires:
- A Connection Profile containing a Microsoft Entra ID Global Admin credential with an Account Type
@@ -48,7 +48,7 @@ configure modern authentication for Exchange Online. It requires:
- Azure AD PowerShell module installed on targeted hosts
:::note
- If the module is not already installed, the job will attempt to install it.
+ If the module isn't already installed, the job will attempt to install it.
:::
@@ -107,12 +107,12 @@ The following permissions are required:
## Create Self–Signed Certificate
-A self signed certificate needs to be created on the Enterprise Auditor console server. This is used
-by Enterprise Auditor to connect to the Microsoft Entra tenant.
+You need to create a self-signed certificate on the Enterprise Auditor console server. Enterprise
+Auditor uses this certificate to connect to the Microsoft Entra tenant.
Follow the steps create the self-signed certificate.
-**Step 1 –** To generate a certificate, use the sample PowerShell command below:
+**Step 1 –** To generate a certificate, use the following sample PowerShell command:
- Change the following parameters in the sample PowerShell command. See the Microsoft
[New-SelfSignedCertificate](https://docs.microsoft.com/en-us/powershell/module/pki/new-selfsignedcertificate)
@@ -122,9 +122,9 @@ Follow the steps create the self-signed certificate.
certificate
- Subject – A unique name for the new App (always starts with CN=, to denote a canonical name)
- FriendlyName – Same as Subject name minus the canonical name prefix
- - NotAfter – A datetime string denoting the certificate's expiration date - in the above sample,
- Get-Date.AddYears(11) specifies that the certificate will expire 11 years from the current
- datetime
+ - NotAfter – A datetime string denoting the certificate's expiration date - in the following
+ sample, Get-Date.AddYears(11) specifies that the certificate will expire 11 years from the
+ current datetime
Example PowerShell:
@@ -138,7 +138,7 @@ $certPath variable (see Step 1).
:::note
The environment variable `SAINSTALLDIR` always points to the base Enterprise Auditor
-install directory; simply append the PrivateAssemblies to point to that folder with the following
+install directory; append the PrivateAssemblies to point to that folder with the following
cmdlet:
:::
@@ -168,15 +168,15 @@ Export-PfxCertificate -Cert $cert -FilePath "$($env:SAINSTALLDIR)PrivateAssembli
[Export-PfxCertificate](https://docs.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate)
article for additional information.
-The self signed certificate has been created. The next steps are to create a Microsoft Entra ID
+You've created the self-signed certificate. Next, create a Microsoft Entra ID
application and then upload this certificate to it.
## Register a Microsoft Entra ID Application
-Follow the steps to register Enterprise Auditor with Microsoft Entra ID.
+Register Enterprise Auditor with Microsoft Entra ID.
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -198,14 +198,14 @@ registrations.
**Step 5 –** Click **Register**.
The Overview page for the newly registered app opens. Review the newly created registered
-application. Now that the application has been registered, permissions need to be granted to it.
+application. Now that you've registered the application, you need to grant it permissions.
## Upload Self-Signed Certificate
Follow the steps upload your self-signed certificate.
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -233,10 +233,10 @@ topic for additional information.
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
+Grant permissions to the registered application.
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -265,15 +265,15 @@ uses tab to find and select Office 365 Exchange Online. Select the following per
**Step 6 –** Click **Grant Admin Consent for [tenant]**. Then click **Yes** in the confirmation
window.
-Now that the permissions have been granted to it, the Connection Profile and host settings for
-Enterprise Auditor need to be collected.
+Now that you've granted the permissions, you need to collect the Connection Profile and host
+settings for Enterprise Auditor.
## Identify the Tenant's Name
-Follow the steps to find the Tenant Name where the registered application resides.
+Find the Tenant Name where the registered application resides.
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -294,10 +294,10 @@ topic for additional information. Next identify the application’s Client ID.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
+Find the registered application's Client ID.
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/exchange/exchangeonline/exchangeonline.md b/docs/accessanalyzer/11.6/requirements/exchange/exchangeonline/exchangeonline.md
index d3debcdc99..40537e5391 100644
--- a/docs/accessanalyzer/11.6/requirements/exchange/exchangeonline/exchangeonline.md
+++ b/docs/accessanalyzer/11.6/requirements/exchange/exchangeonline/exchangeonline.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Target Exchange Online Requirements, Permissions, and Ports
-The Enterprise Auditor for Exchange Solution provides the ability to audit Exchange Online. It
+The Enterprise Auditor for Exchange Solution lets you audit Exchange Online. It
scans:
- Exchange Online (Limited)
diff --git a/docs/accessanalyzer/11.6/requirements/exchange/support/mailflow.md b/docs/accessanalyzer/11.6/requirements/exchange/support/mailflow.md
index a0a46ca194..2dcc1154a6 100644
--- a/docs/accessanalyzer/11.6/requirements/exchange/support/mailflow.md
+++ b/docs/accessanalyzer/11.6/requirements/exchange/support/mailflow.md
@@ -8,7 +8,7 @@ sidebar_position: 10
The ExchangeMetrics Data Collector collects Mail-Flow metrics from the Exchange Message Tracking
Logs on the Exchange servers. Some examples of this include server volume and message size
-statistics. This data collector utilizes an applet to process and collect summarized metrics from
+statistics. This data collector uses an applet to process and collect summarized metrics from
the Message Tracking Log.
1. HUB Metrics Job Group Requirement
@@ -17,7 +17,7 @@ In addition to the permissions required by the ExchangeMetrics Data Collector, t
Profile assigned to the 1. HUB Metrics Job Group requires the following permission and User Rights
(based on default settings):
-- Member of the local Administrator group on the targeted Exchange server(s) where the Hub Transport
+- Member of the local Administrator group on the targeted Exchange servers where the Hub Transport
service is running
- Log on as a Service Group Policy:
@@ -30,7 +30,7 @@ Profile assigned to the 1. HUB Metrics Job Group requires the following permissi
This is required because the ExchangeMetrics Data Collector is an applet-based data collector. It
requires
-- Member of the local Administrator group on the targeted Exchange server(s)
+- Member of the local Administrator group on the targeted Exchange servers
This grants access to the Message Tracking Logs and the ability to create the
`SA_ExchangeMetricsData` folder, which will contain the applet files and the processed message
@@ -39,7 +39,7 @@ tracking log files stored inside a SQLite database for each day. For example:
\\ExchangeServerName\c$\Program Files\Microsoft\Exchange
Server\V14\TransportRoles\Logs\MessageTracking
-If there have been additional security or permission modifications on the server(s), the following
+If there have been additional security or permission modifications on the servers, the following
rights and policies may need to be enabled on the targeted host:
- Ensure the Administrator group has been granted Full Control over Message Tracking Log Directories
diff --git a/docs/accessanalyzer/11.6/requirements/exchange/support/mapi.md b/docs/accessanalyzer/11.6/requirements/exchange/support/mapi.md
index cfef76637d..c367cb88b9 100644
--- a/docs/accessanalyzer/11.6/requirements/exchange/support/mapi.md
+++ b/docs/accessanalyzer/11.6/requirements/exchange/support/mapi.md
@@ -10,7 +10,7 @@ The Exchange2K, ExchangeMailbox, and ExchangePublicFolder data collectors have o
requirements.
These data collectors supports Exchange 2010 through Exchange 2013. Since this data collectors are
-MAPI-based, they do not support Exchange Online, Exchange 2019, nor Exchange 2016.
+MAPI-based, they don't support Exchange Online, Exchange 2019, nor Exchange 2016.
All MAPI-based data collectors have the following prerequisites:
diff --git a/docs/accessanalyzer/11.6/requirements/exchange/support/powershell.md b/docs/accessanalyzer/11.6/requirements/exchange/support/powershell.md
index b4f194b3fb..cd477dcf56 100644
--- a/docs/accessanalyzer/11.6/requirements/exchange/support/powershell.md
+++ b/docs/accessanalyzer/11.6/requirements/exchange/support/powershell.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Exchange PowerShell Permissions
-The ExchangePS Data Collector utilizes PowerShell to collect various information from the Exchange
-environment. This data collector utilizes Remote PowerShell to collect information about Exchange
+The ExchangePS Data Collector uses PowerShell to collect various information from the Exchange
+environment. This data collector uses Remote PowerShell to collect information about Exchange
Users Configuration, Mailboxes, Public Folders, and Exchange Online Mail-Flow.
**Job Group Requirements in Addition to ExchangePS**
@@ -48,13 +48,13 @@ assigned to these job groups requires the following permissions:
**Remote PowerShell and Windows Authentication Enabled**
-The Remote PowerShell and Windows Authentication configurations for Exchanges servers are required
-to be enabled on at least one Exchange server running the Client Access Service so that the
+You must enable the Remote PowerShell and Windows Authentication configurations for Exchange
+servers on at least one Exchange server running the Client Access Service so that the
ExchangePS Data Collector can make a remote PowerShell connection and authenticate through
Enterprise Auditor.
Enterprise Auditor passes credentials saved in the Connection Profile to the data collector so that
-it is able to connect to the targeted host. This requires the Exchange server to allow for Windows
+it can connect to the targeted host. This requires the Exchange server to allow for Windows
Authentication. See the
[Enable Remote PowerShell for ExchangePS Data Collector](#enable-remote-powershell-for-exchangeps-data-collector)
topic and the
@@ -63,19 +63,19 @@ topic for additional information.
**View-Only Organization Management Role Group**
-This is required so the ExchangePS Data Collector is able to run the various Exchange PowerShell
+This is required so the ExchangePS Data Collector can run the various Exchange PowerShell
cmdlets.
**Public Folder Management**
-This permission is only required if utilizing the ExchangePublicFolder Data Collector or
+This permission is only required if using the ExchangePublicFolder Data Collector or
ExchangeMailbox Data Collector, as well as the PublicFolder or Mailbox Action Modules. This is
-required in order to make a connection through the MAPI protocol. The following job group requires
+required to make a connection through the MAPI protocol. The following job group requires
the Public Folder Management Role Group:
- **5. Public Folders > Ownership**
-If not running this collection, then this permission is not required.
+If not running this collection, then this permission isn't required.
**Mailbox Search Role**
@@ -94,14 +94,14 @@ topic for additional information.
There are five different scoping options within this data collector. Since not all query categories
support all scoping options, No Scoping is an option. If there are no scoping options available,
-then the data collector should be run against the host specified in the Summary page of the data
+run the data collector against the host specified in the Summary page of the data
collector wizard.
**No Scoping**
This option will gather information about the entire Exchange Organization. When using the applet,
the data collector will gather information about the Exchange Forest in which the Enterprise Auditor
-Console currently resides. For Remote PowerShell, the data collector will gather information about
+Console resides. For Remote PowerShell, the data collector will gather information about
the Exchange Organization to which the Remote PowerShell connection was made. This refers to the
server entered in the Client Access Server (CAS) field of the global configuration from the
**Settings** > **Exchange** node or on the Scope Page of the data collector wizard. See the
@@ -110,9 +110,9 @@ topic for additional information.
**Scope by Database**
-This option will gather information about any databases which are chosen. When using the applet, the
+This option will gather information about any databases you choose. When using the applet, the
data collector will return databases in the Scope by DB page of the data collector wizard for the
-Exchange Organization in which the Enterprise Auditor Console currently resides, as well as, only
+Exchange Organization in which the Enterprise Auditor Console resides, as well as, only
return information about those databases. For Remote PowerShell, the data collector will return
databases in the Scope by DB page of the data collector wizard for the Exchange Forest, as well as,
only return information about those databases. See the
@@ -121,9 +121,9 @@ topic for additional information.
**Scope by Mailbox**
-This option will gather information about any mailboxes which are chosen. When using the applet, the
+This option will gather information about any mailboxes you choose. When using the applet, the
data collector will return mailboxes in the Scope by Mailboxes page of the data collector wizard for
-the Exchange Forest in which the Enterprise Auditor Console currently resides, as well as, only
+the Exchange Forest in which the Enterprise Auditor Console resides, as well as, only
return information about those mailboxes. For Remote PowerShell, the data collector will return
mailboxes in the Scope by Mailboxes page of the data collector wizard for the Exchange Forest, as
well as, only return information about those mailboxes. See the
@@ -136,14 +136,14 @@ This option will gather information about objects which reside on the chosen ser
this option, the data collector will then use the Host List applied to the job’s **Configure** >
**Hosts** node as the servers scoping list. When using the applet, the data collector will deploy a
process to the targeted host to run the PowerShell on that server. For Remote PowerShell, the data
-collector will deploy no applet and utilize the WinRM protocol to gather information about the
+collector will deploy no applet and use the WinRM protocol to gather information about the
objects on that server.
**Scope by Public Folder**
-This option will gather information about any public folders which are chosen. When using the
+This option will gather information about any public folders you choose. When using the
applet, the data collector will return public folders in the Scope by Public Folders page of the
-data collector wizard for the Exchange Forest in which the Enterprise Auditor Console currently
+data collector wizard for the Exchange Forest in which the Enterprise Auditor Console
resides, as well as, only return information about those public folders. For Remote PowerShell, the
data collector will return public folders in the Scope by Public Folders page of the data collector
wizard for the Exchange Forest, as well as, only return information about those public folders. See
@@ -153,7 +153,7 @@ topic for additional information.
## Enable Remote PowerShell for ExchangePS Data Collector
-Follow these steps to enable Remote PowerShell.
+Enable Remote PowerShell.
**Step 1 –** On the server that Enterprise Auditor will connect with Remote PowerShell, open
PowerShell.
@@ -166,7 +166,7 @@ Enable-PSRemoting
**Step 3 –** When prompted, type `A` and `A` again to enable the appropriate services and protocols.
-Remote PowerShell has been enabled. See the Microsoft
+You've enabled Remote PowerShell. See the Microsoft
[Tip: Enable and Use Remote Commands in Windows PowerShell](https://technet.microsoft.com/en-us/library/ff700227.aspx)
article for additional information.
@@ -174,9 +174,8 @@ Next, enable Windows Authentication for PowerShell Virtual Directory on the same
## Enable Windows Authentication for PowerShell Virtual Directory
-Once Remote PowerShell has been enabled on an Exchange Server in the environment, it is necessary to
-also enable Windows Authentication for the PowerShell Virtual Directory on the same Exchange server.
-Follow these steps to enable Windows Authentication.
+After you've enabled Remote PowerShell on an Exchange Server in the environment, also enable
+Windows Authentication for the PowerShell Virtual Directory on the same Exchange server.
**Step 1 –** On the server where Remote PowerShell was enabled, open the Internet Information
Services (IIS) Manager.
@@ -188,13 +187,13 @@ Services (IIS) Manager.
-**Step 3 –** Right-click on **Windows Authentication** and select **Enable**.
+**Step 3 –** Right-click **Windows Authentication** and select **Enable**.
-Windows Authentication has been enabled for the PowerShell Virtual Directory.
+You've enabled Windows Authentication for the PowerShell Virtual Directory.
## Create Custom Application Impersonation Role in Exchange
-Follow the steps to create the custom Application Impersonation role. The process is the same for
+Create the custom Application Impersonation role. The process is the same for
Exchange 2010 Service Pack 1 through Exchange 2019 and Exchange Online.
**Step 1 –** Within the Exchange Admin Center, navigate to the permissions section and select admin
@@ -214,7 +213,7 @@ roles.
**ApplicationImpersonation** role from the available list and click **Add**. Then click **OK** to
close the Select a Role window.
- Members – Click the + button to open the Select Members window. Select the account from the
- available list and click **Add**. Remember, the account needs to be assigned the other permissions
+ available list and click **Add**. Remember, you need to assign the account the other permissions
required for the **EWSMailbox** and/or **EWSPublicFolder** data collectors. Then click **OK** to
close the Select Members window.
@@ -224,8 +223,8 @@ The new role group appears in the list.
## Enable Exchange Mailbox Access Auditing
-The 4. Mailboxes Job Group requires the Exchange Mailbox Access Auditing to be enabled. In order to
-collect Mailbox Access Auditing events, it is necessary to enable Exchange Mailbox Access Auditing
+The 4. Mailboxes Job Group requires the Exchange Mailbox Access Auditing to be enabled. To
+collect Mailbox Access Auditing events, enable Exchange Mailbox Access Auditing
for Exchange. See the following Microsoft articles:
- Exchange Online –
diff --git a/docs/accessanalyzer/11.6/requirements/exchange/support/remoteconnections.md b/docs/accessanalyzer/11.6/requirements/exchange/support/remoteconnections.md
index 6d151cf7ee..f603712200 100644
--- a/docs/accessanalyzer/11.6/requirements/exchange/support/remoteconnections.md
+++ b/docs/accessanalyzer/11.6/requirements/exchange/support/remoteconnections.md
@@ -16,7 +16,7 @@ In addition to the permissions required by the SMARTLog Data Collector, the Conn
assigned to the 2. CAS Metrics Job Group requires the following permissions and User Rights (based
on default settings):
-- Member of the local Administrator group on the targeted Exchange server(s) where the Client Access
+- Member of the local Administrator group on the targeted Exchange servers where the Client Access
Service is running
- Log on as a Service Group Policy:
@@ -40,7 +40,7 @@ example:
**\\ExchangeServerName\c$\Program Files (x86)\STEALTHbits\StealthAUDIT\LogProcessor**
-If there have been additional security or permission modifications on the server(s), the following
+If there have been additional security or permission modifications on the servers, the following
rights and policies may need to be enabled on the targeted host:
- Ensure the Administrator group has been granted Full Control over IIS Log Directories
diff --git a/docs/accessanalyzer/11.6/requirements/exchange/support/webservicesapi.md b/docs/accessanalyzer/11.6/requirements/exchange/support/webservicesapi.md
index e7d63767fd..e40ef43db1 100644
--- a/docs/accessanalyzer/11.6/requirements/exchange/support/webservicesapi.md
+++ b/docs/accessanalyzer/11.6/requirements/exchange/support/webservicesapi.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Exchange Web Services API Permissions
-The EWSMailbox and EWSPublicFolder data collectors utilizes Exchange Web Services API to access and
+The EWSMailbox and EWSPublicFolder data collectors uses Exchange Web Services API to access and
communicate with Exchange. These data collectors collect statistical, content, permission, and
sensitive data information from mailboxes and public folders.
diff --git a/docs/accessanalyzer/11.6/requirements/exchange/target.md b/docs/accessanalyzer/11.6/requirements/exchange/target.md
index 9429da26b4..ff2f75b59b 100644
--- a/docs/accessanalyzer/11.6/requirements/exchange/target.md
+++ b/docs/accessanalyzer/11.6/requirements/exchange/target.md
@@ -25,16 +25,16 @@ The following are requirements for the Exchange servers to be scanned:
- Enable Remote PowerShell on one Client Access Server (CAS)
- Enable Windows Authentication for the PowerShell Virtual Directory on the same CAS
- .NET Framework 4.5+ installed on all Exchange servers to be targeted
-- WINRM Service installed on all Exchange servers to be targeted as a back up in the event of a
+- WINRM Service installed on all Exchange servers to be targeted as a backup if there is a
remote PowerShell failure
- Within the Enterprise Auditor Console, the global **Settings > Exchange** node must be configured
:::note
For Exchange 2013, 2016, and 2019 – If the global Settings have been configured for
- "MAPI over HTTP," then an actual CAS server name was supplied and will be used by the ExchangePS
- Data Collector. If the global Settings have been configured for "MAPI over HTTPS," then the
- global Settings will have a web address instead of an actual server. Therefore, each ExchangePS
- query requires the CAS server to be set as the specific server on the Category page. See the
+ "MAPI over HTTP," then an actual CAS server name was supplied, and the ExchangePS
+ Data Collector uses it. If the global Settings have been configured for "MAPI over HTTPS," then the
+ global Settings will have a web address instead of an actual server. Therefore, for each ExchangePS
+ query, you must set the CAS server as the specific server on the Category page. See the
[ExchangePS Data Collector & Client Access Server](/docs/accessanalyzer/11.6/solutions/exchange/recommended.md)
topic for a list of queries for which this would apply.
:::
@@ -106,7 +106,7 @@ topic for additional information.
**For Exchange Mail Flow with ExchangeMetrics Data Collector**
-- Member of the local Administrator group on the targeted Exchange server(s)
+- Member of the local Administrator group on the targeted Exchange servers
See the
[Exchange Mail-Flow Permissions](/docs/accessanalyzer/11.6/requirements/exchange/support/mailflow.md)
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystem.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystem.md
index 8669690e0b..096a4b9c86 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystem.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystem.md
@@ -27,8 +27,8 @@ The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor
which enables Sensitive Data criteria for scans.
:::note
-If proxy server scan options are used, it may also be necessary for the Sensitive Data
-Discovery Add-On to be installed on those servers as well.
+If you use proxy server scan options, you may also need to install the Sensitive Data
+Discovery Add-On on those servers as well.
:::
@@ -50,26 +50,26 @@ These are dependent upon the size of the target environment:
| Cores | 8 CPU | 8 CPU | 8 CPU | 4 CPU | 2 CPU |
| Disk Space | 1.5 TB | 770 GB | 470 GB | 270 GB | 130 GB |
-The above recommended disk space sizing information is based on the needs of Enterprise Auditor as
+This recommended disk space sizing information is based on the needs of Enterprise Auditor as
well as the File System solution for running Permission scans with default configuration (500 MB per
million files and folders), that means no tag collection, file-level scanning, activity, or
sensitive data.
-- For tag collection, add 125 MB per million documents to the totals above
+- For tag collection, add 125 MB per million documents to those totals
- For activity collection, add 250 MB per million files and folders and another 125 MB per million
- activity events to the totals above
+ activity events to those totals
- For sensitive data collection, add 500 MB per million files and folders and another 1%-10% of the
total size of the documents scanned for sensitive data (depending on targeted document types and
- selected criteria) to the totals above
+ selected criteria) to those totals
-For example, in order to scan 200 million files and folders, of which 10 million files will be
+For example, to scan 200 million files and folders, of which 10 million files will be
scanned for tag collection and sensitive data with a total size of 6 TB, you would need: 160 GB for
permission collection + 1.25 GB for tag collection (10x125 MB) + 100 GB for sensitive data
collection (200x500 MB) + 600 GB additional for sensitive data collection (10% of 6 TB) = 861.25 GB
total disk space.
:::note
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
+If running Sensitive Data Discovery (SDD) scans, you must increase the
minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By
default, SDD scans are configured to run two concurrent threads. For example, if the job is
configured to scan 8 hosts at a time with two concurrent SDD threads, then an extra 32 GB of RAM are
@@ -81,7 +81,7 @@ required (8x2x2=32).
If Data Activity Tracking for NAS is required or if NetApp Filers running Clustered Data ONTAP are
in scope, reducing latency between the scanning server and the target device is highly recommended.
-Additional hardware may be required, especially if the target NAS devices are not collocated with
+Additional hardware may be required, especially if the target NAS devices aren't collocated with
the Enterprise Auditor Console server.
**Sensitive Data Discovery Auditing Requirement**
@@ -92,7 +92,7 @@ The following is required to run Sensitive Data Discovery scans:
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
configuration; it has been preconfigured to work with Enterprise Auditor and should never be
customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
@@ -113,7 +113,7 @@ mode, applet mode, or proxy mode with applet:
- Administrators
These permissions grant the credential the ability to create a high integrity token capable of
-leveraging the “Back up files and directories” from where the Enterprise Auditor executable is run.
+using the “Back up files and directories” right from where the Enterprise Auditor executable is run.
Additionally, the credential must have `WRITE` access to the `…\StealthAUDIT\FSAA` folder in the
installation directory. This is required by either the user account running the Enterprise Auditor
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md
index 3548687f18..b6ef35c5de 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/azureinformationprotection.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# **Azure Information Protection Target Requirements**
-Microsoft® Azure is a cloud-based computing platform that provides a range of services, such as file storage. Azure uses Azure Information Protection (AIP) labels, a Microsoft tool used to classify and protect stored files. Access Analyzer employs the File System Solution to execute Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing scans in order to find AIP Protection labels and scan protected (i.e. encrypted) files for sensitive data.
+Microsoft® Azure is a cloud-based computing platform that provides a range of services, such as file storage. Azure uses Azure Information Protection (AIP) labels, a Microsoft tool used to classify and protect stored files. Access Analyzer employs the File System Solution to execute Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing scans to find AIP Protection labels and scan protected (i.e. encrypted) files for sensitive data.
This document provides information needed to properly configure access required by Access Analyzer to successfully scan for Azure Information Protection labels in a targeted environment.
@@ -14,7 +14,7 @@ This document provides information needed to properly configure access required
:::info
**NOTE**
-Access Analyzer does not scan for AIP Marking labels, only Protection labels.
+Access Analyzer doesn't scan for AIP Marking labels, only Protection labels.
:::
@@ -43,7 +43,7 @@ Ensure the following prerequisites are met before configuring AIP scanning:
### Rights Management Service Client Installation
-The Rights Management Service Client must be installed on the applet servers where FSAA is running. This may be the local Access Analyzer server, a Proxy server, or a File Server running in applet mode.
+You must install the Rights Management Service Client on the applet servers where FSAA is running. This may be the local Access Analyzer server, a Proxy server, or a File Server running in applet mode.
* To install the Rights Management Service Client 2.1 on the server where the scan is taking place, go to the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=38396):
@@ -74,7 +74,7 @@ Read the System Requirements and Install Instructions provided by Microsoft to c
:::warning
- This will disappear once you leave the page!
+ This will disappear when you leave the page.
:::
4. Add API permissions
@@ -92,13 +92,13 @@ Read the System Requirements and Install Instructions provided by Microsoft to c
## **Enable the Account as an AIP Super User using PowerShell**
-Follow the steps to enable the Service Principal Account in AIP as a Super User:
+Enable the Service Principal Account in AIP as a Super User:
:::info
**NOTE**
-All PowerShell commands should be run in order through PowerShell as an Admin.
+Run all PowerShell commands in order through PowerShell as an Admin.
:::
@@ -119,7 +119,7 @@ All PowerShell commands should be run in order through PowerShell as an Admin.
`Enable-AIPServiceSuperUserFeature`
-The Service Principal Account is now added to the Rights Management service as a Super User, and the Super User feature is enabled.
+You've added the Service Principal Account to the Rights Management service as a Super User, and enabled the Super User feature.
## Add App Registration to the AIP Role in Microsoft® Azure
@@ -130,33 +130,33 @@ In Microsoft Azure, add the Account to the Azure Information Protection Administ
2. Navigate to **Roles and Administrators**. On the Administrative Roles page, select the **Azure Information Protection Administrator** role.
3. Use the **Add Assignment** button to display the Add assignments pane. Search for the name of the new service principal account (the **DisplayName** entered in PowerShell) and add it to the list of assignments.
-The Service Principal Account is now successfully added to the Azure Information Protection Administrator role.
+You've now successfully added the Service Principal Account to the Azure Information Protection Administrator role.
## **Access Analyzer Configurations**
-Before Access Analyzer can scan for AIP labels, two configurations must be done prior to the initial scan.
+Complete two configurations before the initial scan so Access Analyzer can scan for AIP labels.
* [Azure Connection Profile](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#azure-connection-profile)
* [Configure FSAA Data Collector](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#configure-fsaa-data-collector)
### **Azure Connection Profile**
-To collect tags for files protected with Azure Information Protection, an Azure connection profile must be configured in Access Analyzer before an FSAA scan runs. See the [Global Settings](https://docs.netwrix.com/docs/accessanalyzer/12_0/admin/settings/overview) topic for additional information on how to set up a connection profile at the global level.
+To collect tags for files protected with Azure Information Protection, you must configure an Azure connection profile in Access Analyzer before an FSAA scan runs. See the [Global Settings](https://docs.netwrix.com/docs/accessanalyzer/12_0/admin/settings/overview) topic for additional information on how to set up a connection profile at the global level.
1. In Access Analyzer, add a credential for an Azure Active Directory account type to the existing Connection Profile used for File System scanning. Supply the Client ID field with the **AppID** and the Key field with the **Secret Value** created upon creation of the new service principal.
2. At the job level, apply the connection profile that contains both the Microsoft Entra ID credential and credentials required for File System scanning under the **Jobs** > \[**Job**\] > **Settings** > **Connection** node.
3. Ensure that the job is configured correctly before running a scan. See the [Configure FSAA Data Collector](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#configure-fsaa-data-collector) topic for additional information.
-An Azure Connection Profile has now been successfully created for an FSAA scan.
+You've now successfully created an Azure Connection Profile for an FSAA scan.
### **Configure FSAA Data Collector**
-In Access Analyzer, configure the FSAA Data Collector wizard pages to scan files protected by Azure Information Protection. This can be done for both FSAA System Scans and SEEK System Scans. In the FSAA Data Collector Wizard, configure the following menus to scan for AIP protection labels:
+In Access Analyzer, configure the FSAA Data Collector wizard pages to scan files protected by Azure Information Protection. You can do this for both FSAA System Scans and SEEK System Scans. In the FSAA Data Collector Wizard, configure the following menus to scan for AIP protection labels:
For FSAA System Scans:
-* Scan Server Selection – Choose the server that scanning is executed on. Target the server that has the Rights Management Service Client 2.1 installed where the applet is running.
+* Scan Server Selection – Choose the server where scanning runs. Target the server that has the Rights Management Service Client 2.1 installed where the applet is running.
* This may be a proxy server, file server (applet mode), or the local Access Analyzer console depending on scan configuration
* Scan Settings – Select the **Enable scanning of files protected by Azure Information Protection** checkbox to add AIP files to the scan criteria
* Azure Tenant Mapping page – Add the **AppID** and the **Domain Name** or **Tenant ID**
@@ -175,7 +175,7 @@ For FSAA System Scans:
For SEEK System Scans:
-* Scan Server Selection – Choose the server that scanning is executed on. Target the server that has the Rights Management Service Client 2.1 installed where the applet is running.
+* Scan Server Selection – Choose the server where scanning runs. Target the server that has the Rights Management Service Client 2.1 installed where the applet is running.
* This may be a proxy server, file server (applet mode), or the local Access Analyzer console depending on scan configuration
* Scan Settings – Select the **Enable scanning of files protected by Azure Information Protection** checkbox to add AIP files to the scan criteria
* Azure Tenant Mapping page – Add the **AppID** and the **Domain Name** or **Tenant ID**
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/access.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/access.md
index 2b7f11c235..e84f160895 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/access.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/access.md
@@ -14,7 +14,7 @@ Follow the steps assign group membership through Computer Management.
**Step 1 –** Open Computer Management (`compmgmt.msc`).
-**Step 2 –** Right-click on the Computer Management (local) node and select Connect to another
+**Step 2 –** Right-click the Computer Management (local) node and select Connect to another
computer.
**Step 3 –** Enter the name of the Dell device in the textbox and click OK.
@@ -25,4 +25,4 @@ computer.
**Step 6 –** Select the Power Users group and add the account being provisioned.
-The account has been provisioned for Access Auditing and Sensitive Data Discovery Auditing.
+You've provisioned the account for Access Auditing and Sensitive Data Discovery Auditing.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/activity/activity.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/activity/activity.md
index 907fe1610b..da6be779a2 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/activity/activity.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/activity/activity.md
@@ -6,20 +6,20 @@ sidebar_position: 20
# Dell Celerra & Dell VNX Activity Auditing Configuration
-An Dell Celerra or VNX device can be configured to audit Server Message Block (SMB) protocol access
-events. All audit data can be forwarded to the Dell Common Event Enabler (CEE). The Activity Monitor
+You can configure a Dell Celerra or VNX device to audit Server Message Block (SMB) protocol access
+events. The device can forward all audit data to the Dell Common Event Enabler (CEE). The Activity Monitor
listens for all events coming through the Dell CEE and translates all relevant information into
entries in the Log files or syslog messages.
-Complete the following checklist prior to configuring the Activity Monitor to monitor the host.
+Complete the following checklist before configuring the Activity Monitor to monitor the host.
Instructions for each item of the checklist are detailed within the following sections.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - DNS name of Celerra or VNX CIFS share(s) to be monitored
- - Data Mover or Virtual Data Mover hosting the share(s) to be monitored
+ - DNS name of Celerra or VNX CIFS shares to be monitored
+ - Data Mover or Virtual Data Mover hosting the shares to be monitored
- Account with access to the CLI
- Download the Dell CEE from:
@@ -27,20 +27,20 @@ Instructions for each item of the checklist are detailed within the following se
**Checklist Item 2: Install Dell CEE**
-- Dell CEE can be installed on the same Windows server as the Activity Agent, or on a different
- server. If it is installed on the same host, the activity agent can configure it automatically.
+- You can install Dell CEE on the same Windows server as the Activity Agent, or on a different
+ server. If you install it on the same host, the activity agent can configure it automatically.
:::info
- The latest version of Dell CEE is the recommended version to use with the
+ Netwrix recommends using the latest version of Dell CEE with the
asynchronous bulk delivery (VCAPS) feature.
:::
- Important:
- - Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE
+ - Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE
is installed
- - Dell CEE 8.4.2 through Dell CEE 8.6.1 are not supported for use with the VCAPS feature
+ - Dell CEE 8.4.2 through Dell CEE 8.6.1 aren't supported for use with the VCAPS feature
- Dell CEE requires .NET Framework 3.5 to be installed on the Windows proxy server
- See the
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/activity/installcee.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/activity/installcee.md
index e864633b2a..311c022bf2 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/activity/installcee.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/activity/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install & Configure Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+You should install Dell CEE on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -15,15 +15,15 @@ Remember, the latest version is the recommended version of Dell CEE.
:::info
-The Dell CEE package can be installed on the Windows server where the Activity
+You can install the Dell CEE package on the Windows server where the Activity
Monitor agent will be deployed (recommended) or on any other Windows or Linux server.
:::
-Follow the steps to install the Dell CEE.
+Install the Dell CEE.
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
-this component. It is recommended to use the most current version.
+this component. Netwrix recommends using the most current version.
**Step 2 –** Follow the instructions in the Dell
[Using the Common Event Enabler on Windows Platforms](https://www.dell.com/support/home/en-us/product-support/product/common-event-enabler/docs)
@@ -33,7 +33,7 @@ guide to install and configure the CEE. The installation will add two services t
- EMC CEE Monitor (Display Name: EMC CEE Monitor)
:::info
-The latest version of .NET Framework and Dell CEE is recommended to use with the
+Netwrix recommends using the latest version of .NET Framework and Dell CEE with the
asynchronous bulk delivery (VCAPS) feature.
:::
@@ -42,14 +42,14 @@ See the
[CEE Debug Logs](/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/validate.md#cee-debug-logs)
section for information on troubleshooting issues related to Dell CEE.
-After Dell CEE installation is complete, it is necessary to
+After Dell CEE installation is complete, proceed to
[Connect Data Movers to the Dell CEE Server](#connect-data-movers-to-the-dell-cee-server).
## Configure Dell Registry Key Settings
-There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+There may be situations when you need to install Dell CEE on a different Windows server than the
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell
+CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -59,12 +59,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
@@ -75,13 +75,13 @@ Examples:
**StealthAUDIT@192.168.30.15**
-**Step 7 –** Click OK. The Edit String window closes. Registry Editor can be closed.
+**Step 7 –** Click OK. The Edit String window closes. You can close Registry Editor.
**Step 8 –** Open Services (run `services.msc`). Start or Restart the EMC CEE Monitor service.
-The Dell CEE registry key is now properly configured to forward event to the Activity Monitor
+You've now properly configured the Dell CEE registry key to forward events to the Activity Monitor
activity agent.
## Connect Data Movers to the Dell CEE Server
@@ -95,19 +95,19 @@ Mover.
administrative account should have a $ character in the terminal.
:::note
-Do not use a # charter.
+Don't use a # charter.
:::
**Step 2 –** Create or retrieve the `cepp.conf` file.
-If there is not a `cepp.conf` file on the Data Mover(s), use a text editor to create a new blank
+If there isn't a `cepp.conf` file on the Data Movers, use a text editor to create a new blank
file in the home directory named `cepp.conf`. The following is an example command if using the text
editor ‘vi’ to create a new blank file:
**$ vi cepp.conf**
-If a `cepp.conf` file already exists, it can be retrieved from the Data Movers for modification
+If a `cepp.conf` file already exists, you can retrieve it from the Data Movers for modification
with the following command:
`$ server_file [DATA_MOVER_NAME] -get cepp.conf cepp.conf`
@@ -117,17 +117,17 @@ with the following command:
guide instructions on how to add parameters or edit the values or existing parameters.
:::note
-The information can be added to the file on one line or separate lines by using a space
+You can add the information to the file on one line or separate lines by using a space
and a ”\” at the end of each line, except for the last line and the lines that contain global
options: `cifsserver`, `surveytime`, `ft`, and `msrpcuser`.
:::
-The Activity Monitor requires the following parameters to be set in the `cepp.conf` file:
+You must set the following parameters for the Activity Monitor in the `cepp.conf` file:
- `pool name= `
- This should equal the name assigned to the configuration container. This container is composed
- of the server(s) IP Address or FQDN where the Dell CEE is installed and where the list of
+ of the servers IP Address or FQDN where the Dell CEE is installed and where the list of
events to be monitored is located. It can be named as desired but must be a pool name.
- `servers= `
- This should equal the IP Address or FQDN of the Windows server where the Dell CEE is
@@ -173,7 +173,7 @@ The Activity Monitor requires the following parameters to be set in the `cepp.co
postevents=CloseModified|CloseUnmodified|CreateDir|CreateFile|DeleteDir|DeleteFile|RenameDir|RenameFile|SetAclDir|SetAclFile
```
-**Step 4 –** Move the `cepp.conf` file to the Data Mover(s) root file system. Run the following
+**Step 4 –** Move the `cepp.conf` file to the Data Movers root file system. Run the following
command:
`$ server_file [DATA_MOVER_NAME]‑put cepp.conf cepp.conf`
@@ -199,7 +199,7 @@ Then verify the CEPA status using the following command:
`server_cepp [DATA_MOVER_NAME] -service –status`
-Once the `cepp.config` file has been configured, it is time to configure and enable monitoring with
+After you've configured the `cepp.config` file, configure and enable monitoring with
the Activity Monitor. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor)
for additional information.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/activity/validate.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/activity/validate.md
index bf31934f05..92c4443daa 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/activity/validate.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/activity/validate.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
+After the Activity Monitor agent is configured to monitor the Dell device, the automated
configuration must be validated to ensure events are being monitored.
## Validate Dell CEE Registry Key Settings
@@ -19,12 +19,13 @@ topic for information on manually setting the registry key.
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
-configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
+configure the Dell Common Event Enabler (CEE) automatically if it is installed on the same server as
+the agent. This needs
to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
+a different server than the Windows proxy servers where the Activity Monitor activity agent is
deployed.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -91,7 +92,7 @@ additional information.
## Validate Dell CEE Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -121,19 +122,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/overview.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/overview.md
index 9285ad28d2..0cfe451ea0 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellcelerravnx/overview.md
@@ -39,7 +39,7 @@ topic for additional information.
Troubleshooting Dell Celerra & Dell VNX Denied Access Errors
If there are folders to which the credential is denied access, it is likely that the Backup
-Operators group does not have the “Back up files and directories” right. In that case, it is
+Operators group doesn't have the “Back up files and directories” right. In that case, it is
necessary to assign additional the “Back up files and directories” right to those groups or to
create a new local group, using Computer Management from a Windows server. Then assign rights to it
using the CelerraManagementTool.msc plugin, which is available to Dell customers. For further
@@ -104,7 +104,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/activity.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/activity.md
index 0d614adcd1..8264a8cb31 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/activity.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/activity.md
@@ -20,15 +20,15 @@ initiated the activity. The stored events are then forwarded by the node to the
concurrently to several instances. At this point, Dell CEE forwards the audit event to a defined
endpoint, such as Activity Monitor agent.
-Complete the following checklist prior to configuring Activity Monitor to monitor the host.
+Complete the following checklist before configuring Activity Monitor to monitor the host.
Instructions for each item of the checklist are detailed within the following sections.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - DNS name of Isilon/PowerScale CIFS share(s) to be monitored
- - Access Zone(s) containing the CIFS shares to be monitored
+ - DNS name of Isilon/PowerScale CIFS shares to be monitored
+ - Access Zones containing the CIFS shares to be monitored
- Account with access to the OneFS UI or CLI
- Download the Dell CEE from:
@@ -36,8 +36,8 @@ Instructions for each item of the checklist are detailed within the following se
:::info
You can achieve higher throughput and fault tolerance by monitoring the
-Isilon/PowerScale cluster with more than one pair of Dell CEE and Activity Monitor Agent. The
-activity will be evenly distributed between the pairs.
+Isilon/PowerScale cluster with more than one pair of Dell CEE and Activity Monitor Agent. Activity
+Monitor distributes the activity evenly between the pairs.
:::
@@ -80,20 +80,20 @@ Checklist Item 3: Configure Auditing on the Dell Isilon/PowerScale Cluster
- Important:
- Value of the **Storage Cluster Name** field must exactly match the name entered for the
- monitored host in the Activity Monitor Console. If the Storage Cluster Name cannot be modified
+ monitored host in the Activity Monitor Console. If the Storage Cluster Name can't be modified
(for example, another 3rd party depends on it), you need to set the Host Aliases parameter in
the Activity Monitor Console. Otherwise, if for some reason the Storage Cluster Name must be
- left empty, one can list OneFS cluster node names in the Host Aliases.
+ left empty, list the OneFS cluster node names in the Host Aliases instead.
- - If the Storage Cluster Name is not empty, set the Host Aliases parameter to its value
+ - If the Storage Cluster Name isn't empty, set the Host Aliases parameter to its value
- If the Storage Cluster Name is empty, set the Host Aliases to a semicolon-separated list
of OneFS node names
- Include all Access Zones to be monitored in the auditing configuration
- As soon as the first CEE is installed, Isilon/PowerScale will start to send all activity,
- including all previous audit events, to the agent. The start time can be modified to exclude
- previously recorded audit events to prevent the agent from becoming overloaded with data. It
- can be done using OneFS CLI only with isi audit modify command to edit the start time.
+ including all previous audit events, to the agent. You can modify the start time to exclude
+ previously recorded audit events and prevent the agent from becoming overloaded with data. You
+ can edit the start time only through the OneFS CLI, using the `isi audit modify` command.
- Start time command:
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/installcee.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/installcee.md
index ba11066859..0c0da683a9 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/installcee.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/installcee.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
-product. Dell customers have a support account with Dell to access the download.
+The Dell Common Event Enabler (CEE) should be installed on a Windows or a Linux server. The Dell CEE
+software isn't a Netwrix product. Dell customers have a support account with Dell to access the download.
:::tip
Remember, the latest version is the recommended version of Dell CEE.
@@ -20,7 +20,7 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
+Install the Dell CEE.
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -45,8 +45,8 @@ section for information on troubleshooting issues related to Dell CEE.
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell
+CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -56,12 +56,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/manualconfiguration.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/manualconfiguration.md
index 4a7eb156ef..1f8fc2a084 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/manualconfiguration.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/manualconfiguration.md
@@ -20,11 +20,11 @@ Administration Console.
is typically used. If the CIFS or NFS shares are accessible through different zones on the OneFS
cluster, include all relevant zones.
-Ensure that OneFS collects only events you are interested in. By default, OneFS may monitor things
-like directory reads, which can take up a large amount of space. Configuring the OneFS events that
-need monitoring is not done through the Activity Monitor console. Configure OneFS event monitoring
-using OneFS CLI with the isi audit modify command for each access zone. Enabling monitoring for only
-what is needed for the environment will reduce the data load to the agent.
+Ensure that OneFS collects only events you are interested in. By default, OneFS may monitor items
+such as directory reads, which can use significant space. You can't configure which OneFS events
+need monitoring through the Activity Monitor console. Configure OneFS event monitoring using the
+OneFS CLI with the isi audit modify command for each access zone. Enabling monitoring only for what
+your environment needs reduces the data load on the agent.
Activity Monitor monitors the following events: `close_file_modified`, `close_file_unmodified`,
`create_file`, `create_directory`, `delete_file`, `delete_directory`, `rename_file`,
@@ -53,10 +53,10 @@ server hosting CEE. Use either of the following format:
http://[SERVER Name]:[PORT]/cee
:::info
-When deploying multiple Dell CEE instances at scale, it is recommended that an
-accommodating agent must be configured with each CEE instance. If multiple CEE instances send events
-to just one agent, it may create an overflow of data and overload the agent. Distributing the
-activity stream into pairs will be the most efficient way of monitoring large data sets at scale.
+When deploying multiple Dell CEE instances at scale, configure an accommodating agent
+for each CEE instance. If multiple CEE instances send events
+to just one agent, it may create an overflow of data and overload the agent. Distribute the
+activity stream into pairs to monitor large data sets most efficiently at scale.
:::
@@ -65,7 +65,7 @@ be an exact match to the name which is entered in the Activity Monitor for the *
list.
This name is used as a ‘tag’ on all events coming through the CEE. This name must exactly match what
-is in the Activity Monitor or it does not recognize the events.
+is in the Activity Monitor or it doesn't recognize the events.
:::info
Use the CIFS DNS name for Dell OneFS.
@@ -78,10 +78,10 @@ the name entered here must exactly match what is used for Enterprise Auditor as
:::
-If the Storage Cluster Name cannot be modified (for example, another third-party depends on it), you
+If the Storage Cluster Name can't be modified (for example, another third-party depends on it), you
need to set the Host Aliases parameter in the Activity Monitor Console:
-- If the Storage Cluster Name is not empty, set the Host Aliases parameter to its value
+- If the Storage Cluster Name isn't empty, set the Host Aliases parameter to its value
- If the Storage Cluster Name is empty, set the Host Aliases to a semicolon-separated list of OneFS
node names
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/validate.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/validate.md
index c4a2e2af40..cf58786278 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/validate.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/activity/validate.md
@@ -6,18 +6,19 @@ sidebar_position: 30
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
+After the Activity Monitor agent is configured to monitor the Dell device, the automated
configuration must be validated to ensure events are being monitored.
## Validate Dell CEE Registry Key Settings
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
-configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
+configure the Dell Common Event Enabler (CEE) automatically if it is installed on the same server as
+the agent. This needs
to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
+a different server than the Windows proxy servers where the Activity Monitor activity agent is
deployed.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -84,7 +85,7 @@ additional information.
## Validate Dell CEE Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -114,19 +115,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
@@ -158,8 +159,7 @@ The debug log is stored in `/opt/CEEPack/emc_cee_svc.log` file. To enable verbos
and Verbose parameters under **Configuration** to 255 and restart the CEE.
:::note
-Debug logs should only be used for troubleshooting purposes. It's recommended to have
-Debug Logs disabled by default.
+Use debug logs only for troubleshooting. Disable them by default.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/overview.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/overview.md
index 15c8a019fb..2ddb401a01 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellpowerscale/overview.md
@@ -38,7 +38,7 @@ topic for additional information.
**Additional Sensitive Data Discovery Auditing Permission**
-In order to execute scoped Sensitive Data Discovery Auditing scans, the credential must also have
+to execute scoped Sensitive Data Discovery Auditing scans, the credential must also have
the LOCAL:System provider selected in each access zone in which the shares to be scanned reside.
The credential must have an Authentication Provider configured for the Isilon/PowerScale device. For
@@ -71,8 +71,8 @@ Share permissions can now be granted to this credential.
## BackupAdmin Role Assignment for OneFS
-Follow the steps to assign the credential to the **BackupAdmin** role through OneFS Storage
-Administration Console.
+Assign the credential to the **BackupAdmin** role through the OneFS Storage
+Administration Console using the following steps.
**Step 1 –** Navigate to the **Access** tab > **Membership & Roles** for the System Access Zone.
@@ -112,7 +112,7 @@ export** (per NFS export):
- Root Clients
The NFS export to be scanned also needs to be configured so root squash is disabled, which is
-performed in the same Edit export menu as the above settings.
+performed in the same Edit export menu as the preceding settings.
**Step 1 –** Navigate to the export's **Root user mapping** settings.
@@ -125,8 +125,8 @@ scan.
### Troubleshooting NFSv3 Export Access
-If Enterprise Auditor is not discovering the expected NFS export, it is possible that the export
-policy is not properly configured to allow the Enterprise Auditor server or proxy server IP Address
+If Enterprise Auditor isn't discovering the expected NFS export, it is possible that the export
+policy isn't properly configured to allow the Enterprise Auditor server or proxy server IP Address
to mount the NFS export. One step in troubleshooting this issue is to confirm a Unix client (or WSL
for Windows) in the same IP range as the Enterprise Auditor server or proxy server can mount the NFS
export.
@@ -198,7 +198,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/access.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/access.md
index 8434e7f0bb..f4e1623f62 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/access.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/access.md
@@ -14,7 +14,7 @@ Follow the steps assign group membership through Computer Management.
**Step 1 –** Open Computer Management (`compmgmt.msc`).
-**Step 2 –** Right-click on the Computer Management (local) node and select Connect to another
+**Step 2 –** Right-click the Computer Management (local) node and select Connect to another
computer.
**Step 3 –** Enter the name of the Dell device in the textbox and click OK.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/activity.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/activity.md
index d1bb999b41..9f0eaada21 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/activity.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/activity.md
@@ -20,14 +20,14 @@ activity log file is created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Dell Unity devices.
+Complete the following checklist before configuring activity monitoring of Dell Unity devices.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - Data Mover or Virtual Data Mover hosting the share(s) to be monitored
+ - Data Mover or Virtual Data Mover hosting the shares to be monitored
- Account with access to the CLI
- Download the Dell CEE from:
@@ -36,7 +36,7 @@ Instructions for each item of the checklist are detailed within the following to
Checklist Item 2:
[Install Dell CEE](/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/installcee.md)
-- Dell CEE should be installed on the Windows proxy server(s) where the Activity Monitor activity
+- Dell CEE should be installed on the Windows proxy servers where the Activity Monitor activity
agent will be deployed
:::info
@@ -47,9 +47,9 @@ Checklist Item 2:
- Important:
- - Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE
+ - Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE
is installed
- - Dell CEE 8.4.2 through Dell CEE 8.6.1 are not supported for use with the VCAPS feature
+ - Dell CEE 8.4.2 through Dell CEE 8.6.1 aren't supported for use with the VCAPS feature
- Dell CEE requires .NET Framework 3.5 to be installed on the Windows proxy server
**Checklist Item 3: Dell Unity Device Configuration**
@@ -70,8 +70,8 @@ Checklist Item 2:
Checklist Item 5: Configure Dell CEE to Forward Events to the Activity Agent
:::note
-When Dell CEE is installed on Windows proxy server(s) where the Activity Monitor activity
-agent will be deployed, the following steps are not needed.
+When Dell CEE is installed on Windows proxy servers where the Activity Monitor activity
+agent will be deployed, the following steps aren't needed.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/installcee.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/installcee.md
index 358642e989..9fdcf4ae2d 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/installcee.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/installcee.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
-product. Dell customers have a support account with Dell to access the download.
+The Dell Common Event Enabler (CEE) should be installed on a Windows or a Linux server. The Dell CEE
+software isn't a Netwrix product. Dell customers have a support account with Dell to access the download.
:::tip
Remember, the latest version is the recommended version of Dell CEE.
@@ -20,7 +20,7 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
+Install the Dell CEE using the following steps.
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -38,14 +38,14 @@ asynchronous bulk delivery (VCAPS) feature.
:::
-After Dell CEE installation is complete, it is necessary to complete the
+After you install Dell CEE, complete the
[Unity Initial Setup with Unisphere](/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/setupunisphere.md).
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the
+Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -55,12 +55,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/setupunisphere.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/setupunisphere.md
index a8be8dce3d..64c540cc24 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/setupunisphere.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/setupunisphere.md
@@ -6,12 +6,12 @@ sidebar_position: 20
# Unity Initial Setup with Unisphere
-Follow the steps to configure the initial setup for a Unity device with Unisphere.
+Configure the initial setup for a Unity device with Unisphere using the following steps.
**Step 1 –** Edit the NAS Server > Protection and Events > Events Publishing > Select Pool settings:
-- Add CEPA server – This is the server where CEE is installed. It is recommended that this is also
- the server were the Activity Monitor activity agent is deployed.
+- Add CEPA server – This is the server where the Dell Common Event Enabler (CEE) is installed. This
+ should also be the server where the Activity Monitor activity agent is deployed.
- Enable the following events for Post Events.
Required Unity events needed for CIFS Activity:
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/validate.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/validate.md
index 54b1932f77..c563bd3df2 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/validate.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/activity/validate.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
+After the Activity Monitor agent is configured to monitor the Dell device, the automated
configuration must be validated to ensure events are being monitored.
## Validate CEE Registry Key Settings
@@ -19,12 +19,13 @@ topic for information on manually setting the registry key.
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
-configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
+configure the Dell Common Event Enabler (CEE) automatically if it is installed on the same server as
+the agent. This needs
to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
+a different server than the Windows proxy servers where the Activity Monitor activity agent is
deployed.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -91,7 +92,7 @@ additional information.
## Validate Dell CEE Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -121,19 +122,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/overview.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/overview.md
index 114d4a906f..95e373598b 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/dellunity/overview.md
@@ -39,7 +39,7 @@ topic for additional information.
**Troubleshooting Dell Unity Denied Access Errors**
If there are folders to which the credential is denied access, it is likely that the Backup
-Operators group does not have the “Back up files and directories” right. In that case, it is
+Operators group doesn't have the “Back up files and directories” right. In that case, it is
necessary to assign additional the “Back up files and directories” right to those groups or to
create a new local group, using Computer Management from a Windows server. Then assign rights to it
using the CelerraManagementTool.msc plugin, which is available to Dell customers. For further
@@ -104,7 +104,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/filesystems.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/filesystems.md
index 129aa2f50f..9ba731e576 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/filesystems.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/filesystems.md
@@ -111,7 +111,7 @@ See the
[Hitachi Target Requirements](/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/overview.md)
topic for target environment requirements.
-**Nasuni Nasuni Edge Appliances**
+**Nasuni Edge Appliances**
- 8.0+
@@ -125,7 +125,7 @@ for target environment requirements.
- Cluster-Mode 8.2+
:::note
- The Resiliency feature introduced in ONTAP 9.0 is not supported.
+ The Resiliency feature introduced in ONTAP 9.0 isn't supported.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/activity/activity.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/activity/activity.md
index 0851cb0914..f0aab74c80 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/activity/activity.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/activity/activity.md
@@ -11,7 +11,7 @@ multiple file systems. Auditing is enabled and configured per file system. This
to enable auditing on an HNAS and to configure the Activity Monitor to monitor activity coming from
the Hitachi device auditing.
-The Activity Monitor does not use the EVS or file system name to connect to HNAS. Therefore, all
+The Activity Monitor doesn't use the EVS or file system name to connect to HNAS. Therefore, all
that is required of the user for HNAS activity collection is the following:
- Logs path (UNC)
@@ -39,11 +39,11 @@ clients using other protocols would be costly in terms of system performance, be
operation would have to be audited as an open operation. **Therefore, when file system auditing is
enabled, by default, only clients connecting through the CIFS protocol are allowed access to the
file system.** Access by clients using other protocols, like NFS, can, however, be allowed. When
-such access is allowed, access to file system objects through these protocols is not audited.”
+such access is allowed, access to file system objects through these protocols isn't audited.”
:::note
File system auditing can be configured to deny access to clients connecting with protocols
-that cannot be audited (NFS). Please see the Hitachi
+that can't be audited (NFS). see the Hitachi
[Server and Cluster Administration Guide](https://support.hds.com/download/epcra/hnas0106.pdf) for
additional information.
:::
@@ -51,7 +51,7 @@ additional information.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Hitachi devices.
+Complete the following checklist before configuring activity monitoring of Hitachi devices.
Instructions for each item of the checklist are detailed within the following topics.
Checklist Item 1:
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/activity/configureaccesstologs.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/activity/configureaccesstologs.md
index deade0c148..5a1ece6217 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/activity/configureaccesstologs.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/activity/configureaccesstologs.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# Configure Access to HNAS Audit Logs on Activity Agent Server
-Follow the steps to configure access to the HNAS audit logs on the Windows server hosting the
-Activity Monitor activity agent.
+Configure access to the HNAS audit logs on the Windows server hosting the
+Activity Monitor activity agent using the following steps.
**Step 1 –** On the Windows computer, go to Run and type `compmgmt.msc`.
@@ -22,7 +22,7 @@ Folders > Shares.
**Step 5 –** Select the Security tab and click Advanced.
**Step 6 –** In the Advanced Security Settings dialog box, select the Audit tab. Click Add or Edit
-to select the users and groups to be audited and add the desired user or group.
+to select the users and groups to be audited and add the user or group you want.
**Step 7 –** Select All for Type, and Full Control for Basic permissions.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/activity/configurelogs.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/activity/configurelogs.md
index 1b4ca664f9..b9d4262eca 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/activity/configurelogs.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/activity/configurelogs.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Configure Audit Logs on HNAS
-Follow the steps to configure access to the HNAS audit logs on the Hitachi device.
+Configure access to the HNAS audit logs on the Hitachi device using the following steps.
**Step 1 –** Open a browser and enter the IP Address for HNAS in the address bar to launch the
Hitachi Storage Navigator (SN). Enter the username and password.
@@ -33,7 +33,7 @@ auditing). In the Audit Log section, set the maximum log file size to a value of
is recommended to set it to 16 MB. In the Log roll over policy section, select New. The product does
not support the Wrap policy. Click OK to close.
-Once access has been configured on the Hitachi device, it is necessary to configure access to the
+Once access has been configured on the Hitachi device, configure access to the
HNAS audit logs on the Windows server. See the
[Configure Access to HNAS Audit Logs on Activity Agent Server](/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/activity/configureaccesstologs.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/overview.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/overview.md
index 75ae42426d..17cd25e5f0 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/hitachi/overview.md
@@ -88,7 +88,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nasuni/access.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nasuni/access.md
index d39752986a..8c0d490a98 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nasuni/access.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nasuni/access.md
@@ -6,12 +6,12 @@ sidebar_position: 10
# Nasuni Edge Appliance Access & Sensitive Data Auditing Configuration
-It is necessary to generate an API Key Name and Passcode for each on-premise Nasuni Edge Appliance
+Generate an API Key Name and Passcode for each on-premise Nasuni Edge Appliance
and cloud filer.
## Nasuni Filer Management Interface
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Filer Management Interface.
+Generate a Nasuni API Access Key in the Nasuni Filer Management Interface using the following steps.
**Step 1 –** Within the **Configuration** menu, under **USERS & SECURITY**, select API Access Keys.
The API Access Keys page opens.
@@ -39,14 +39,14 @@ documentation for additional information.
## Nasuni Management Console
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Management Console.
+Generate a Nasuni API Access Key in the Nasuni Management Console using the following steps.
**Step 1 –** Click Filers and select API Keys from the menu on the left. The Filer API Access Key
Settings page opens.
**Step 2 –** Click New API Key button. The Add API Access Key window opens.
-**Step 3 –** From the Filer drop-down menu, select the desired Nasuni Edge Appliance. Then enter a
+**Step 3 –** From the Filer dropdown menu, select the Nasuni Edge Appliance you want. Then enter a
Name for the key; for example, the name of the application.
**Step 4 –** Click Add API Key.
@@ -68,13 +68,12 @@ documentation for additional information.
## Nasuni Best Practices for Access Auditing
-Nasuni is a hybrid NAS where actively-used data is stored on a Nasuni Edge appliance while the
-authoritative copy of all files and meta data is stored in private or public cloud object storage
-platforms by the UniFS® global file system, and there are egress fees associated with transferring
-data between the two. In order to minimize these egress fees and optimize scan performance, it is
-recommended to deploy a dedicated Nasuni Edge Appliance with all shares to be scanned by Enterprise
-Auditor mounted, and the Enterprise Auditor console server, in the same region where the
-authoritative copy resides.
+Nasuni is a hybrid NAS: a Nasuni Edge Appliance stores actively used data locally, while the UniFS®
+global file system stores the authoritative copy of all files and metadata in private or public
+cloud object storage platforms. Transferring data between the two incurs egress fees. To minimize
+these fees and optimize scan performance, deploy a dedicated Nasuni Edge Appliance with all shares
+that Enterprise Auditor scans mounted, and place the Enterprise Auditor console server in the same
+region as the authoritative copy.
See the
[External Auditing and Nasuni Best Practices](https://nasuni.my.salesforce.com/sfc/p/#external-auditing-and-nasuni-best-practices)
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nasuni/activity.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nasuni/activity.md
index b4a1c231fb..df486b6ca1 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nasuni/activity.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nasuni/activity.md
@@ -6,14 +6,14 @@ sidebar_position: 20
# Nasuni Edge Appliance Activity Auditing Configuration
-Generation of an API Access Key is required for Nasuni activity monitoring. The Nasuni Edge
-Appliance generates its own audit trail. An API Access Key is used by the Activity Monitor to form a
-network connection to the appliance. Nasuni will then stream event data to the activity agent. See
+Nasuni activity monitoring requires an API Access Key. The Nasuni Edge Appliance generates its own
+audit trail. The Activity Monitor uses an API Access Key to form a network connection to the
+appliance. Nasuni then streams event data to the activity agent. See
[Nasuni Support Documentation](https://www.nasuni.com/support/) for additional information.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Nasuni Edge Appliances.
+Complete the following checklist before configuring activity monitoring of Nasuni Edge Appliances.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Generate Nasuni API Access Key**
@@ -30,7 +30,7 @@ Instructions for each item of the checklist are detailed within the following to
## Nasuni Filer Management Interface
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Filer Management Interface.
+Generate a Nasuni API Access Key in the Nasuni Filer Management Interface using the following steps.
**Step 1 –** Within the **Configuration** menu, under **USERS & SECURITY**, select API Access Keys.
The API Access Keys page opens.
@@ -43,9 +43,9 @@ The API Access Keys page opens.
**Step 5 –** In the Successfully Generated API Key window, copy the Key Passcode.
-Both the Key Name and the Key Passcode are required by the Activity Monitor in order to connect to
-the Nasuni Edge Appliance. Once the API Key has been generated, it is time to configure and enable
-monitoring with the Activity Monitor console.
+The Activity Monitor requires both the Key Name and the Key Passcode to connect to the Nasuni Edge
+Appliance. After you generate the API Key, configure and enable monitoring with the Activity Monitor
+console.
:::note
Nasuni API key names are case sensitive. When providing them, ensure they are entered in
@@ -55,23 +55,23 @@ the exact same case as generated.
## Nasuni Management Console
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Management Console.
+Generate a Nasuni API Access Key in the Nasuni Management Console using the following steps.
**Step 1 –** Click Filers and select API Keys from the menu on the left. The Filer API Access Key
Settings page opens.
**Step 2 –** Click New API Key button. The Add API Access Key window opens.
-**Step 3 –** From the Filer drop-down menu, select the desired Nasuni Edge Appliance. Then enter a
+**Step 3 –** From the Filer dropdown menu, select the Nasuni Edge Appliance you want. Then enter a
Name for the key; for example, the name of the application.
**Step 4 –** Click Add API Key.
**Step 5 –** A message appears which includes the Key Passcode; copy the Key Passcode.
-Both the Key Name and the Key Passcode are required by the Activity Monitor in order to connect to
-the Nasuni Edge Appliance. Once the API Key has been generated, it is time to configure and enable
-monitoring with the Activity Monitor console.
+The Activity Monitor requires both the Key Name and the Key Passcode to connect to the Nasuni Edge
+Appliance. After you generate the API Key, configure and enable monitoring with the Activity Monitor
+console.
:::note
Nasuni API key names are case sensitive. When providing them, ensure they are entered in
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nasuni/overview.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nasuni/overview.md
index 2ddd4251f7..c7dc39dd6c 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nasuni/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nasuni/overview.md
@@ -59,7 +59,7 @@ Enterprise Auditor to read the activity log files must have also have this permi
**Nasuni Edge Appliance Requirements**
-Additionally, it is necessary to generate an API Access Key for Nasuni activity monitoring. See the
+Additionally, generate an API Access Key for Nasuni activity monitoring. See the
[Nasuni Edge Appliance Activity Auditing Configuration](/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nasuni/activity.md)
topic for instructions.
@@ -80,7 +80,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/access/access.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/access/access.md
index 745d396054..aeaaca57be 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/access/access.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/access/access.md
@@ -30,7 +30,7 @@ api-volume-list-info-iter-*
## Bypass NTFS Security for 7-Mode
-In order to bypass NTFS, the credential needs to at least have the following permissions on the
+to bypass NTFS, the credential needs to at least have the following permissions on the
NetApp device:
- Group membership in both of the following groups:
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/access/provisionaccess.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/access/provisionaccess.md
index 87eaed619c..0a1e6d688c 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/access/provisionaccess.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/access/provisionaccess.md
@@ -8,13 +8,13 @@ sidebar_position: 10
This section describes the steps needed to create a user account with the privileges required to
execute Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing scans from Enterprise
-Auditor. It is necessary to:
+Auditor. This requires the following tasks:
- Create Role
- Create a Group & Assign Role
- Add User to Group
-Relevant NetApp Documentation: To learn more about node access controls, please visit the NetApp
+Relevant NetApp Documentation: For more information about node access controls, visit the NetApp
website and read the
[na_useradmin – Administers node access controls](https://library.netapp.com/ecmdocs/ECMP1511537/html/man1/na_useradmin.1.html)
article.
@@ -47,7 +47,7 @@ After the role is created, Create a Group & Assign Role.
## Create a Group & Assign Role
-Once the role has been created, it must be attached to a group. The following command needs to be
+After the role is created, it must be attached to a group. The following command needs to be
run to create a group and assign the role to it.
```
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/activity.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/activity.md
index afeb718bc4..917595a49b 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/activity.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/activity.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# NetApp Data ONTAP 7-Mode Activity Auditing Configuration
-The Activity Monitor agent employed to monitor NetApp leverages 128-bit encrypted Remote Procedure
+The Activity Monitor agent employed to monitor NetApp uses 128-bit encrypted Remote Procedure
Calls (RPC), NetApp ONTAP-API, and NetApp FPolicy to monitor file system events. This includes both
-NetApp 7-Mode and Cluster-Mode configurations. To learn more about FPolicy please visit the NetApp
+NetApp 7-Mode and Cluster-Mode configurations. For more information about FPolicy, visit the NetApp
website and read the
[What FPolicy is](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html)
article.
@@ -17,7 +17,7 @@ If the activity agent is stopped, a notification will be sent to the NetApp devi
disable the associated FPolicy policy, but it will not be removed.
If the network connection is lost between the activity agent and the NetApp device, the NetApp
-device is configured with a default timeout to wait for a response. If a response is not received
+device is configured with a default timeout to wait for a response. If a response isn't received
from the Activity Agent within the timeout, then the NetApp device will disconnect and disable the
FPolicy policy. The Activity Agent will check every minute by default to see if the FPolicy policy
has been disabled and will enable it (if the auto-enable functionality is enabled for the agent).
@@ -29,7 +29,7 @@ No activity log file will be created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of NetApp Data ONTAP
+Complete the following checklist before configuring activity monitoring of NetApp Data ONTAP
7-Mode devices. Instructions for each item of the checklist are detailed within the following
topics.
@@ -37,7 +37,7 @@ topics.
- Gather the following information:
- Names of the vFiler™(s) to be monitored
- - DNS name of the CIFS shares(s) to be monitored
+ - DNS name of the CIFS sharess to be monitored
Checklist Item 2:
[Provision FPolicy Account](/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/provisionactivity.md)
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/configurefpolicy.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/configurefpolicy.md
index 09fa54419c..5aedf9d29a 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/configurefpolicy.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/configurefpolicy.md
@@ -8,7 +8,7 @@ sidebar_position: 30
Select a method to configure the FPolicy for NetApp Data ONTAP 7-Mode devices:
-**:::info**
+:::info
[Manually Configure FPolicy (Recommended Option)](#manually-configure-fpolicy-recommended-option) –
A tailored FPolicy
@@ -30,7 +30,7 @@ A tailored FPolicy
## Manually Configure FPolicy (Recommended Option)
This section describes how to manually configure FPolicy. Manual configuration of the FPolicy is
-recommended so that the policy can be scoped. It is necessary to create six FPolicy components and
+recommended so that the policy can be scoped. Create six FPolicy components and
then enable the FPolicy. See the sections corresponding to each part of this list:
- [Part 1: Create FPolicy](#part-1-create-fpolicy)
@@ -46,7 +46,7 @@ vFiler. This is because FPolicy operates on the affected vFiler. Therefore, when
commands on a vFiler, the commands must be run from a vFiler context (e.g. via the vFiler run
command).
-Relevant NetApp Documentation: To learn more about configuring file policies, please visit the
+Relevant NetApp Documentation: For more information about configuring file policies, visit the
NetApp website and read
[na_fpolicy – configure file policies](https://library.netapp.com/ecmdocs/ECMP1196890/html/man1/na_fpolicy.1.html)
article.
@@ -68,8 +68,8 @@ fpolicy create StealthAUDIT screen
### Part 2: Set FPolicy Required to Off
-If the `FPolicy Required` value is set to on, user requests are denied if an FPolicy server is not
-available to implement the policy. If it is set to off, user requests are allowed when it is not
+If the `FPolicy Required` value is set to on, user requests are denied if an FPolicy server isn't
+available to implement the policy. If it is set to off, user requests are allowed when it isn't
possible to apply the policy to the file because no FPolicy server is available.
IMPORTANT:
@@ -175,6 +175,6 @@ fpolicy enable StealthAUDIT
## Automatic Configuration of FPolicy
The Activity Monitor can automatically configure FPolicy on the targeted NetApp Data ONTAP 7-Mode
-device. The FPolicy created monitors all file system activity. This is done when the NetApp device
-is assigned to the agent for monitoring. This option is enabled on the NetApp FPolicy Configuration
-page of the Add New Host window.
+device. The FPolicy it creates monitors all file system activity. The Activity Monitor configures
+FPolicy automatically when you assign the NetApp device to the agent for monitoring. You enable this
+option on the NetApp FPolicy Configuration page of the Add New Host window.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/customizefpolicy.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/customizefpolicy.md
index 77843dad69..4d90aecbe9 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/customizefpolicy.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/customizefpolicy.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Customize FPolicy Policy Name
There may be situations when FPolicy needs to be named something other than StealthAUDIT. In those
-cases it is necessary to manually add a parameter to the Activity Monitor agent’s `sbtfilemon.ini`
+cases, manually add a parameter to the Activity Monitor agent’s `sbtfilemon.ini`
file. After the monitoring agent has been deployed, follow the steps.
**Step 1 –** Open to the `sbtfilemon.ini` file on the agent server in a text editor:
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/enablehttp.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/enablehttp.md
index 2cdbc8a4ce..68937894ee 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/enablehttp.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/enablehttp.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# Enable HTTP or HTTPS
-The Activity Monitor Activity Agent must be able to send ONTAPI calls to the vFiler’s data LIF over
-HTTP or HTTPS. The following commands will enable the HTTP or HTTPS communication between the vFiler
-and the Activity Monitor.
+The Activity Monitor Activity Agent must be able to send ONTAP API (ONTAPI) calls to the vFiler’s
+data Logical Interface (LIF) over HTTP or HTTPS. The following commands will enable the HTTP or
+HTTPS communication between the vFiler and the Activity Monitor.
Use the following command to enable HTTP:
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/provisionactivity.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/provisionactivity.md
index 690a741a7c..4f6ce9549d 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/provisionactivity.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/activity/provisionactivity.md
@@ -16,10 +16,9 @@ Provisioning this account is a three part process:
- Part 2: Create a Group & Assign Role
- Part 3: Add User to Group
-Relevant NetApp Documentation: To learn more about node access controls, please visit the NetApp
-website and read the
+Relevant NetApp Documentation: For information about node access controls, see the
[na_useradmin – Administers node access controls](https://library.netapp.com/ecmdocs/ECMP1511537/html/man1/na_useradmin.1.html)
-article.
+article on the NetApp website.
## Part 1: Create Role with API/CLI Access
@@ -74,7 +73,7 @@ After the role is created, complete Part 2: Create a Group & Assign Role.
## Part 2: Create a Group & Assign Role
-Once the role has been created, it must be attached to a group. The following command needs to be
+After the role is created, attach it to a group. The following command needs to be
run to create a group and assign the role to it.
```
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/overview.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/overview.md
index a4d1cafe78..b98f737800 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netapp7mode/overview.md
@@ -116,7 +116,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
@@ -140,7 +140,7 @@ Agent server and the target NetApp Data ONTAP 7-Mode device:
Activity Monitor.
:::note
-If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
+If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
device must be configured manually. Also, the External Engine will not reconnect automatically in
the case of a server reboot or service restart.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/access/access.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/access/access.md
index 435d7d4fc2..8f4e4b2624 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/access/access.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/access/access.md
@@ -21,8 +21,8 @@ an alternative method.
### Configure Data LIF to Allow HTTPS Traffic
-As of NetApp Clustered ONTAP 9.6, users can assign service policies (instead of LIF roles) to LIFs
-that determine the kind of traffic that is supported for the LIFs.
+As of NetApp Clustered ONTAP 9.6, users can assign service policies (instead of Logical Interface
+(LIF) roles) to LIFs that determine the kind of traffic that is supported for the LIFs.
- Starting with ONTAP 9.5, ONTAP supports service policies
- Starting with ONTAP 9.6, LIF roles are deprecated and service policies are supported for all types
@@ -72,8 +72,8 @@ Example:
network interface modify -vserver testserver -lif lif_1 -service-policy new_service_policy
```
-A service policy can only be used by LIFs in the same SVM that is specified when creating the
-service policy.
+A service policy can only be used by LIFs in the same Storage Virtual Machine (SVM) that is
+specified when creating the service policy.
## CIFS Method 2 Credential Configuration
@@ -104,8 +104,8 @@ The following permissions are required:
cifs users-and-groups local-group add-members ‑group-name "BUILTIN\Backup Operators" ‑member-names [DOMAIN_USER] ‑vserver [SVM_NAME]
```
-If an ACE does not already exist for a specific user/group on an SVM's c$ share, then it needs to be
-added with the desired rights (No_access, Read, Change, or Full_Control). To check the current ACE
+If an ACE doesn't already exist for a specific user/group on an SVM's c$ share, add one with the
+rights you want (No_access, Read, Change, or Full_Control). To check the current ACE
for a user or group on each SVM's c$ share, the following ONTAP CLI command should be used at the
cluster management level.
@@ -117,18 +117,17 @@ The output will list each SVM's ACL for its c$ share. For example:
-If the desired ACE does not exist on an SVM's c$ share, then one can be created with the following
-command:
+If the ACE you want doesn't exist on an SVM's c$ share, create one with the following command:
```
vserver cifs share access-control create -share c$ -user-or-group [USER_OR_GROUP_NAME] -permission Read -vserver [SVM_NAME]
```
-If an existing ACE needs to be modified, the following command should be used:
+To modify an existing ACE, use the following command:
:::warning
-The following command will overwrite an existing ACE. For example, it is possible to
-downgrade a user with Full_Control to Read, or vice versa.
+The following command will overwrite an existing ACE. For example, you can
+downgrade a user from Full_Control to Read, or the reverse.
:::
@@ -137,19 +136,19 @@ vserver cifs share access-control modify -share c$ -user-or-group [USER_OR_GROUP
```
:::note
-If users would prefer to avoid permissioning C$, then there is an alternative. Users can
-instead give the SVM's Backup Operators group read-only access to each share to be scanned.
+If you want to avoid permissioning C$, give the SVM's Backup Operators group read-only access to
+each share you want to scan instead.
:::
-In order to utilize Enterprise Auditor’s LAT Preservation (Last Access Time) feature during
-sensitive data scans and metadata tag collection, applying ONTAP’s SeRestorePrivilege to the service
-account is also required.
+To use Enterprise Auditor’s LAT Preservation (Last Access Time) feature during
+sensitive data scans and metadata tag collection, also apply ONTAP’s SeRestorePrivilege to the
+service account.
-As an alternative to membership in BUILTIN\Backup Operators, SeBackupPrivilege can be directly
-applied to a user via the NetApp command line.
+As an alternative to BUILTIN\Backup Operators membership, apply SeBackupPrivilege directly to a
+user via the NetApp command line.
-The following commands can be used to grant these permissions to the service account to be used for
+Use the following commands to grant these permissions to the service account used for
scanning by Enterprise Auditor.
Use the following commands to add SeBackupPrivilege to the Service Account (or a BUILTIN Group):
@@ -196,13 +195,13 @@ cifs share access-control show ‑vserver [SVM_NAME] ‑share c$
## NFSv3 Credential Configuration
-The following is a list of example commands that can be used to configure a NetApp export policy to
+Use the following example commands to configure a NetApp export policy to
scan a volume via NFSv3 using the Enterprise Auditor File System Solution.
:::warning
The export policy for a volume's parent (ex. the SVM's root volume), or the export
policy for a qtree's parent, must have access rights that are equal or wider in scope to the export
-policy for the target volume/qtree. If Enterprise Auditor cannot access all segments of a target
+policy for the target volume/qtree. If Enterprise Auditor can't access all segments of a target
volume/qtree's junction path, then NFS access will be denied.
:::
@@ -259,7 +258,7 @@ volume modify ‑vserver testserver ‑volume testVolume ‑policy testNFS
### Troubleshooting NFSv3 Export Access
If Enterprise Auditoris not discovering the expected NFS export, it is possible that the export
-policy is not properly configured to allow the Enterprise Auditor server or proxy server IP Address
+policy isn't properly configured to allow the Enterprise Auditor server or proxy server IP Address
to mount the NFS export. One step in troubleshooting this issue is to confirm a Unix client (or WSL
for Windows) in the same IP range as the Enterprise Auditor server or proxy server can mount the NFS
export.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/access/configureemptyfpolicy.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/access/configureemptyfpolicy.md
index 372b98e3aa..2f75613fb7 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/access/configureemptyfpolicy.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/access/configureemptyfpolicy.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# Configure Empty FPolicy
-The credential used to just run Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing
-scans requires access to the specified API calls as well as association to an FPolicy. Therefore, it
+The credential used to run Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing
+scans requires access to the specified API calls and association with an FPolicy. Therefore, it
is necessary to:
- [Create Security Role for FSAA Scans](#create-security-role-for-fsaa-scans)
@@ -95,14 +95,13 @@ Example:
security login role show enterpriseauditor
```
-Relevant NetApp Documentation: To learn more about creating security login roles, please visit the
-NetApp website and read the
+Relevant NetApp Documentation: For information about creating security login roles, see the
[security login role create](https://library.netapp.com/ecmdocs/ECMP1196817/html/security/login/role/create.html)
-article.
+article on the NetApp website.
## Create Security Login for FSAA Scans
-Once the access control role has been created, apply it to a domain account.
+After you create the access control role, apply it to a domain account.
- The SVM used in the following command must be the same SVM used when creating the role. See the
[Create Security Role for FSAA Scans](#create-security-role-for-fsaa-scans) topic for additional
@@ -149,10 +148,9 @@ Verify that the output is displayed as follows:
-Relevant NetApp Documentation: To learn more about creating security logins, please visit the NetApp
-website and read the
+Relevant NetApp Documentation: For information about creating security logins, see the
[security login create](https://library.netapp.com/ecmdocs/ECMP12452955/html/security/login/create.html)
-article.
+article on the NetApp website.
## Create External Engine for Empty FPolicy
@@ -206,10 +204,9 @@ Verify that the output is displayed as follows:
-Relevant NetApp Documentation: To learn more about creating an external engine, please visit the
-NetApp website and read the
+Relevant NetApp Documentation: For information about creating an external engine, see the
[vserver fpolicy policy external-engine create](https://library.netapp.com/ecmdocs/ECMP1366832/html/vserver/fpolicy/policy/external-engine/create.html)
-article.
+article on the NetApp website.
## Create FPolicy Event for Empty FPolicy
@@ -254,14 +251,13 @@ Verify that the output is displayed as follows:
-Relevant NetApp Documentation: To learn more about creating an event, please visit the NetApp
-website and read the
+Relevant NetApp Documentation: For information about creating an event, see the
[vserver fpolicy policy event create](https://library.netapp.com/ecmdocs/ECMP1196817/html/vserver/fpolicy/policy/event/create.html)
-article.
+article on the NetApp website.
## Create Empty FPolicy Policy
-The FPolicy policy associates the other three FPolicy components and allows for the designation of a
+The FPolicy policy associates the other three FPolicy components and designates a
privileged FPolicy user, or the account granted Security Login.
IMPORTANT:
@@ -308,10 +304,9 @@ fpolicy policy show ‑instance
-Relevant NetApp Documentation: To learn more about creating a policy, please visit the NetApp
-website and read the
+Relevant NetApp Documentation: For information about creating a policy, see the
[vserver fpolicy policy create](https://library.netapp.com/ecmdocs/ECMP1366832/html/vserver/fpolicy/policy/create.html)
-article.
+article on the NetApp website.
## Create Empty FPolicy Scope
@@ -320,9 +315,9 @@ The FPolicy scope creates the filters necessary to perform scans on specific sha
IMPORTANT:
- The SVM used must be the SVM hosting the CIFS shares.
-- It is not necessary to specify both volumes and shares. One or the other is sufficient.
+- It isn't necessary to specify both volumes and shares. One or the other is sufficient.
-Use the following command to create the FPolicy scope by volume(s):
+Use the following command to create the FPolicy scope by volumes:
```
vserver fpolicy policy scope create ‑vserver [SVM_NAME] ‑policy-name StealthAUDIT ‑volumes-to-include
@@ -334,7 +329,7 @@ Example:
vserver fpolicy policy scope create ‑vserver testserver ‑policy-name StealthAUDIT ‑volumes-to-include
```
-Use the following command to create the FPolicy scope by share(s):
+Use the following command to create the FPolicy scope by shares:
```
vserver fpolicy policy scope create ‑vserver [SVM_NAME] ‑policy-name StealthAUDIT ‑shares-to-include
@@ -358,14 +353,13 @@ fpolicy policy scope show ‑instance
-Relevant NetApp Documentation: To learn more about creating scope, please visit the NetApp website
-and read the
+Relevant NetApp Documentation: For information about creating scope, see the
[vserver fpolicy policy scope create](https://library.netapp.com/ecmdocs/ECMP1196817/html/vserver/fpolicy/policy/scope/create.html)
-article.
+article on the NetApp website.
## Enable the Empty FPolicy
-Once the empty FPolicy has been created, it must be enabled.
+After you create the empty FPolicy, enable it.
IMPORTANT:
@@ -395,7 +389,6 @@ vserver fpolicy show
-Relevant NetApp Documentation: To learn more about enabling a policy, please visit the NetApp
-website and read the
+Relevant NetApp Documentation: For information about enabling a policy, see the
[vserver fpolicy enable](https://library.netapp.com/ecmdocs/ECMP1196817/html/vserver/fpolicy/enable.html)
-article.
+article on the NetApp website.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/activity.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/activity.md
index 14c513620b..8eda5fe192 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/activity.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/activity.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# NetApp Data ONTAP Cluster-Mode Activity Auditing Configuration
-The Activity Monitor agent employed to monitor NetApp leverages NetApp ONTAP API, and the NetApp
+The Activity Monitor agent employed to monitor NetApp uses the NetApp ONTAP API and the NetApp
FPolicy framework to monitor file system events. This includes both NetApp 7-Mode and Cluster-Mode
configurations. For more information about FPolicy read the
[What are the two parts of the FPolicy solution ](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html)
@@ -25,17 +25,17 @@ list of volumes, list of LIFs. Depending on the configuration, the agent can als
of FPolicy to ensure it is enabled; configure FPolicy and register or unregister itself.
The FPolicy framework enables the collection of audit events on the ONTAP side and their transfer to
-the agent(s) via the designated Data LIFs. Each LIF establishes its own connection with one or
+the agents via the designated Data LIFs. Each LIF establishes its own connection with one or
several agents and sends notifications as soon as the file transaction occurs. The FPolicy
connection is asynchronous and buffered; both ONTAP and Activity Monitor have techniques in place to
-make sure that connections are alive and working. The connection can be secured using TLS with
+ensure that connections are alive and working. The connection can be secured using TLS with
server or mutual authentication.
FPolicy may have a significant impact on file system throughput, and it is always a best practice to
monitor performance when enabling FPolicy.
:::info
-Create a tailored FPolicy which only collects the desired activity from the
+Create a tailored FPolicy which only collects the activity you want from the
environment to limit the scope and impact.
:::
@@ -43,12 +43,12 @@ environment to limit the scope and impact.
For scale-out and fault tolerance purposes, the product supports a range of deployment options. A
single agent can receive events from multiple SVMs. Or events from a single SVM can be distributed
among multiple agents. Or a set of SVMs can distribute events among a set of agents. The choice
-depends on the fault tolerance requirements and the expected event flow. As a rule of thumb, the
-_average_ load on a single agent should not exceed 5000 events per second.
+depends on the fault tolerance requirements and the expected event flow. In general, the
+_average_ load on a single agent shouldn't exceed 5000 events per second.
**Configuration Checklist**
-Complete the following checklist prior to configuring the activity monitoring of NetApp Data ONTAP
+Complete the following checklist before configuring the activity monitoring of NetApp Data ONTAP
Cluster-Mode devices. Instructions for each item of the checklist are detailed within the following
sections.
@@ -56,10 +56,10 @@ sections.
- Gather the following information:
- - Names of the SVM(s) to be monitored
+ - Names of the SVMs to be monitored
- FPolicy is configured for each SVM separately
- - This should be the SVM(s) hosting the CIFS or NFS shares(s) to be monitored
+ - This should be the SVMs hosting the CIFS or NFS sharess to be monitored
- Credentials to access ONTAP to provision a role and account.
- Desired functionality level:
@@ -80,7 +80,7 @@ sections.
- Limiting the FPolicy to specific file operations is an effective way to limit the
performance impact of FPolicy
- - IP Address of the server(s) where the Activity Monitor Agent is deployed
+ - IP Address of the servers where the Activity Monitor Agent is deployed
- API enabled in ONTAP: the classic ONTAPI/ZAPI or the new REST API
- The product supports the REST API for ONTAP 9.13.1 and above.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/configurefirewall.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/configurefirewall.md
index 50b58da056..56c4003976 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/configurefirewall.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/configurefirewall.md
@@ -30,11 +30,11 @@ Monitor.
Both classic ONTAPI/ZAPI and the new REST API are supported. Starting with ONTAP 9.13.1, the product
uses REST API by default if it is available. HTTP and HTTPS protocols are supported. For HTTPS, two
-modes are supported: strict and ignore errors. For the strict mode, the product allows you to
-disable the host name validation in case the agent cannot resolve the FQDN of the LIF.
+modes are supported: strict and ignore errors. With strict mode, you can
+disable the host name validation in case the agent can't resolve the FQDN of the LIF.
Enabling the API access varies depending on ONTAP version. The following sections list common steps
-on enabling the API access. Please refer to the NetApp documentation for more details.
+on enabling the API access. refer to the NetApp documentation for more details.
### Management-http Service
@@ -74,7 +74,7 @@ network interface service-policy add-service -service management-https -policy d
### Firewall Policy
-For ONTAP 9.5 and older, the following commands can be used to either create a new firewall policy
+For ONTAP 9.5 and older, use the following commands to either create a new firewall policy
or modify an existing policy if ONTAPI is blocked.
#### Create New Firewall HTTP Policy
@@ -148,15 +148,15 @@ Verify that the output is displayed as follows:
## FPolicy
The FPolicy framework enables the collection of audit events on the ONTAP side and their transfer to
-the agent(s) via the designated Data LIFs. Each LIF establishes its own connection with one or
+the agents via the designated Data LIFs. Each LIF establishes its own connection with one or
several agents and sends notifications as soon as the file transaction occurs. The FPolicy
connection is asynchronous and buffered; both ONTAP and Activity Monitor have techniques in place to
-make sure that connections are alive and working. The connection can be secured using TLS with
+ensure that connections are alive and working. The connection can be secured using TLS with
server or mutual authentication.
ONTAP cluster nodes connect to the agent on port 9999 by default. The port can be changed in the
-agent's settings. The agent adds this port to Windows Firewall exclusions automatically. Please
-ensure the port is not blocked by other firewalls between ONTAP and the agent.
+agent's settings. The agent adds this port to Windows Firewall exclusions automatically. Ensure
+the port isn't blocked by other firewalls between ONTAP and the agent.
### Data-fpolicy-client Service
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/configurefpolicy.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/configurefpolicy.md
index 853640604c..e10e9bc001 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/configurefpolicy.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/configurefpolicy.md
@@ -13,11 +13,11 @@ There are two ways to configure FPolicy:
- Activity Monitor agent can facilitate the
[Automatic Configuration of FPolicy](#automatic-configuration-of-fpolicy) for the monitored SVM
- using the ONTAP API. This mode is simple, but does not allow you to exclude certain volumes or
+ using the ONTAP API. This mode is simple, but it doesn't let you exclude certain volumes or
shares of the SVM from being monitored. It also requires additional permissions to create and
modify FPolicy.
-- Another option is to [Manually Configure FPolicy](#manually-configure-fpolicy) for each SVM. This
- mode allows you to fine tune FPolicy by excluding certain volumes or shares from being monitored.
+- Another option is to [Manually Configure FPolicy](#manually-configure-fpolicy) for each SVM. With
+ this mode, you can fine-tune FPolicy by excluding certain volumes or shares from being monitored.
It also reduces product permissions.
Regardless of the chosen approach for FPolicy configuration, one also needs to perform extra steps
@@ -55,8 +55,8 @@ A certificate (Server Certificate) for the Agent server needs to be generated an
file. This is required for both of the TLS authentication options.
The PEM file must contain both Public Key and Private Key parts. A certificate may be self-signed or
-issued by a certification authority. Below are the steps for generation of a self-signed certificate
-using OpenSSL toolkit.
+issued by a certification authority. The following steps generate a self-signed certificate
+using the OpenSSL toolkit.
Use the following command on the agent server to create the Server Certificate and copy it to a .pem
file:
@@ -88,8 +88,8 @@ locally on the Activity Monitor Console server.
### Create PEM File for Client Certificate
A certificate (Client Certificate) for the SVM needs to be copied to a PEM file. This is required
-for the TLS, mutual authentication option. Follow the steps to create the PEM file for the Client
-Certificate.
+for the TLS, mutual authentication option. Complete the following steps to create the PEM file for
+the Client Certificate.
**Step 1 –** On the SVM , use the following command to show the security certificate details:
@@ -105,7 +105,7 @@ security certificate show -vserver testserver -type server instance
**Step 2 –** Copy the security certificate details into a text file and copy the public key to a PEM
file. The following variables from security details will be needed to set mutual-authentication
-during Part 6 of manual configuration and prior to automatic configuration:
+during Part 6 of manual configuration and before automatic configuration:
- SVM
- Common Name
@@ -120,8 +120,8 @@ The Client Certificate PEM file has been created.
## Manually Configure FPolicy
This section describes how to manually configure FPolicy. Manual configuration of the FPolicy is
-recommended if the policy needs to be scoped to monitor select volumes or shares. It is necessary to
-create several FPolicy components and then enable the FPolicy. See the sections corresponding to
+recommended if the policy needs to be scoped to monitor select volumes or shares. Create several
+FPolicy components and then enable the FPolicy. See the sections corresponding to
each part of this list:
- Part 1: Install Server Certificate on the SVM (only if using TLS authentication)
@@ -135,12 +135,12 @@ each part of this list:
- Part 3: Create FPolicy Events
- - An FPolicy event defines which protocol(s) to monitor and which file access events to monitor.
+ - An FPolicy event defines which protocols to monitor and which file access events to monitor.
- Part 4: Create FPolicy Policy
- - The FPolicy policy associates the other three FPolicy components and allows for the
- designation of a privileged FPolicy user
+ - The FPolicy policy associates the other three FPolicy components and designates a
+ privileged FPolicy user
- If running the Access Auditing (FSAA), Activity Auditing (FSAC), and/or Sensitive Data
Discovery Auditing scans, then this is the user account credential to be added to the
Enterprise Auditor Connection Profile.
@@ -156,7 +156,7 @@ each part of this list:
- Part 7: Enable the FPolicy
- - Once the FPolicy is enabled, the Activity Monitor Agent can be configured to monitor the SVM.
+ - After the FPolicy is enabled, the Activity Monitor Agent can be configured to monitor the SVM.
- Part 8: Connect FPolicy Server / Agent to Cluster Node (optional)
@@ -165,7 +165,7 @@ each part of this list:
### Part 1: Install Server Certificate on the SVM
-If using the TLS authentication options, it is necessary to install the Server Certificate on the
+If using the TLS authentication options, install the Server Certificate on the
SVM.
Use the following command to install the Server Certificate:
@@ -212,7 +212,7 @@ IMPORTANT:
- The following values are required:
- `engine-name StealthAUDITEngine`, the names of the external engine object can be customized
- (see below).
+ (see [Customization of FPolicy Object Names](#customization-of-fpolicy-object-names)).
- `port 9999`, Port number can be customized, but it is recommended to use 9999.
- `extern-engine-type asynchronous`
- `ssl-option no-auth`
@@ -249,10 +249,9 @@ Verify that the output is displayed as follows:
-Relevant NetApp Documentation: To learn more about creating an external engine, please visit the
-NetApp website and read the
+Relevant NetApp Documentation: For information about creating an external engine, see the
[vserver fpolicy policy external-engine create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-external-engine-create.html)
-article.
+article on the NetApp website.
### Part 3: Create FPolicy Event
@@ -262,7 +261,7 @@ IMPORTANT:
- The SVM used must be the SVM hosting the CIFS or NFS shares to be monitored.
- Enterprise Auditor and the Activity Monitor are capable of monitoring both NFS and CIFS. However,
- it is necessary to create separate events for each protocol.
+ you must create separate events for each protocol.
- The following values are required:
- `event-name`
@@ -281,8 +280,8 @@ IMPORTANT:
reported.
- Limiting the file operations to be monitored is an excellent way to limit the performance impact
- the FPolicy will have on the NetApp device. The file operations from which to choose are below
- with additional filter options:
+ the FPolicy will have on the NetApp device. Choose from the following file operations, with
+ additional filter options:
- `create` – File create operations
- `create_dir` – Directory create operations
@@ -308,7 +307,7 @@ IMPORTANT:
- `read` – File read operations
- `first-read` – Limits notification to only first read operations for CIFS protocol. For
- ONTAP 9.2+, this filter can be used for both CIFS and NFS protocols.
+ ONTAP 9.2+, you can use this filter for both CIFS and NFS protocols.
- `rename`– File rename operations
- `rename_dir`– Directory rename operations
@@ -340,7 +339,7 @@ IMPORTANT:
- `write` – File write operations
- `first-write` – Limits notification to only first write operations for CIFS protocol. For
- ONTAP 9.2+, this filter can be used for both CIFS and NFS protocols.
+ ONTAP 9.2+, you can use this filter for both CIFS and NFS protocols.
- For failed/denied events, the list of supported file operations is limited to the following
values:
@@ -410,14 +409,13 @@ Verify that the output is displayed as follows:
-Relevant NetApp Documentation: To learn more about creating an event, please visit the NetApp
-website and read the
+Relevant NetApp Documentation: For information about creating an event, see the
[vserver fpolicy policy event create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-event-create.html)
-article.
+article on the NetApp website.
### Part 4: Create FPolicy Policy
-The FPolicy policy associates the other three FPolicy components and allows for the designation of a
+The FPolicy policy associates the other three FPolicy components and designates a
privileged FPolicy user, or the provisioned FPolicy account. If running the Access Auditing (FSAA),
Activity Auditing (FSAC), and/or Sensitive Data Discovery Auditing scans in Enterprise Auditor, then
this is also the user account credential to be added to the Enterprise Auditor Connection Profile.
@@ -490,10 +488,9 @@ fpolicy policy show -instance
-Relevant NetApp Documentation: To learn more about creating a policy, please visit the NetApp
-website and read the
+Relevant NetApp Documentation: For information about creating a policy, see the
[vserver fpolicy policy create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-create.html)
-article.
+article on the NetApp website.
### Part 5: Create FPolicy Scope
@@ -504,10 +501,10 @@ variable [SVM_NAME] in the command with an asterisk (\*).
IMPORTANT:
- The SVM used must be the SVM hosting the CIFS or NFS shares to be monitored.
-- It is not necessary to specify both volumes and shares. One or the other is sufficient.
+- It isn't necessary to specify both volumes and shares. One or the other is sufficient.
- If you want to monitor everything, set the "`volumes-to-include`" value to "`*`".
-Use the following command to create the FPolicy scope by specifying volume(s):
+Use the following command to create the FPolicy scope by specifying volumes:
```
vserver fpolicy policy scope create -vserver [SVM_NAME] -policy-name StealthAUDIT -volumes-to-include [VOLUME_NAME],[VOLUME_NAME]
@@ -519,7 +516,7 @@ Example:
vserver fpolicy policy scope create -vserver testserver -policy-name StealthAUDIT -volumes-to-include samplevolume1,samplevolume2
```
-Use the following command to create the FPolicy scope by specifying share(s):
+Use the following command to create the FPolicy scope by specifying shares:
```
vserver fpolicy policy scope create -vserver [SVM_NAME] -policy-name StealthAUDIT -shares-to-include [SHARE_NAME],[SHARE_NAME]
@@ -541,14 +538,13 @@ fpolicy policy scope show -instance
-Relevant NetApp Documentation: To learn more about creating scope, please visit the NetApp website
-and read the
+Relevant NetApp Documentation: For information about creating scope, see the
[vserver fpolicy policy scope create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-scope-create.html)
-article.
+article on the NetApp website.
### Part 6: Set TLS Authentication
-If using the TLS authentication options, it is necessary to set authentication for the type of
+If using the TLS authentication options, set authentication for the type of
authentication.
#### Set Server-Authentication
@@ -617,10 +613,9 @@ vserver fpolicy show
-Relevant NetApp Documentation: To learn more about enabling a policy, please visit the NetApp
-website and read the
+Relevant NetApp Documentation: For information about enabling a policy, see the
[vserver fpolicy enable](https://docs.netapp.com/us-en/ontap-cli-9121//vserver-fpolicy-enable.html)
-article.
+article on the NetApp website.
### Part 8: Connect FPolicy Server / Agent to Cluster Node
@@ -663,7 +658,7 @@ will also be necessary to set mutual authentication on the SVM.
### Set TLS Mutual-Authentication
-If using the TLS, mutual authentication options, it is necessary to set authentication.
+If using the TLS, mutual authentication options, set authentication.
Use the following command to set mutual-authentication:
@@ -702,6 +697,6 @@ These names can be customized in the monitored host's settings in the Activity M
useful in two scenarios:
- You want the names to match the company policies;
-- You want to configure FPolicy manually using your custom names, but also want to leverage the
+- You want to configure FPolicy manually using your custom names, but also want to use the
"Enable and Connect FPolicy" feature of the Activity Monitor, so that the product ensures that
FPolicy stays enabled and connected at all times.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/provisionactivity.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/provisionactivity.md
index 1246f12520..da5f1db4d5 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/provisionactivity.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/provisionactivity.md
@@ -26,13 +26,13 @@ The permissions needed depends on the functionality level:
- Least Privileged: ONLY Collect Events – This is the minimal functionality level. A user manually
configures FPolicy and ensures that it stays enabled and connected. The product only collects
- events. This functionality level is not recommended as it requires an additional solution that
+ events. This functionality level isn't recommended as it requires an additional solution that
tracks the state of FPolicy and fixes the problem should ONTAP disconnect or should the policy
become disabled.
- **_RECOMMENDED:_** Less Privileged: Enable/Connect Policy & Collect Events – With this level, the
user still performs the initial FPolicy configuration manually. The product tracks the state of
FPolicy with periodic checks to ensure it stays enabled and connected all the time.
-- **_RECOMMENDED:_** Automatically Configure the FPolicy – With this full-blown level, no manual
+- **_RECOMMENDED:_** Automatically Configure the FPolicy – With this comprehensive level, no manual
configuration is needed. The product performs the initial FPolicy configuration; updates FPolicy
to reflect configuration changes; ensures that FPolicy stays enabled and connected all the time.
@@ -105,7 +105,7 @@ security login rest-role create -role enterpriseauditorrest -api "/api/svm/svms"
```
:::note
-If the FPolicy account is configured with these permissions, it is necessary to manually
+If the FPolicy account is configured with these permissions, you must manually
configure the FPolicy. See the
[Configure FPolicy](/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/configurefpolicy.md)
topic for additional information.
@@ -130,7 +130,7 @@ permissions to collect events:
:::tip
Remember, this permission permits the Activity Monitor to enable the FPolicy. If the “Enable
- and connect FPolicy” option is employed but the permission is not provided, the agent will
+ and connect FPolicy” option is employed but the permission isn't provided, the agent will
encounter “Failed to enable policy” errors, but it will still be able to connect to the FPolicy.
Since this permission model requires a manual configuration of the FPolicy, then the need to
manually enable the FPolicy will be met.
@@ -195,7 +195,7 @@ security login rest-role create -role enterpriseauditorrest -api "/api/protocols
```
:::note
-If the FPolicy account is configured with these permissions, it is necessary to manually
+If the FPolicy account is configured with these permissions, you must manually
configure the FPolicy. See the
[Configure FPolicy](/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/activity/configurefpolicy.md)
topic for additional information.
@@ -345,7 +345,7 @@ article.
## Part 2: Create Security Login
-Once the access control role has been created, apply it to a domain account. Ensure the following
+After the access control role is created, apply it to a domain account. Ensure the following
requirements are met:
- The SVM used in the following command must be the same SVM used when creating the access control
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/overview.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/overview.md
index 3812c4f488..947df26c89 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/netappcmode/overview.md
@@ -133,7 +133,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
@@ -152,7 +152,7 @@ Agent server and the target NetApp Data ONTAP Cluster-Mode device:
Activity Monitor.
:::note
-If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
+If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
device must be configured manually. Also, the External Engine will not reconnect automatically in
the case of a server reboot or service restart.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nutanix/access.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nutanix/access.md
index 5d9cdcdf81..a616baf183 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nutanix/access.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nutanix/access.md
@@ -11,7 +11,7 @@ Admin: Backup Access only** role assigned.
## Nutanix Prism Central Interface
-Follow the steps to configure the required account in the Nutanix Prism Central Interface.
+Complete the following steps to configure the required account in the Nutanix Prism Central Interface.
**Step 1 –** Select the **Home** dropdown and select **File Server**.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nutanix/overview.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nutanix/overview.md
index 1445c90d3c..ff57e89047 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nutanix/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/nutanix/overview.md
@@ -55,7 +55,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/qumulo/activity.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/qumulo/activity.md
index 9dedbfce85..d2463930ff 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/qumulo/activity.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/qumulo/activity.md
@@ -32,7 +32,7 @@ advanced filtering of Microsoft Office activity also requires the JSON format.
The JSON format for audit events was introduced in Qumulo Core 6.0.1. The new format can be enabled
via an SSH session to the Qumulo cluster.
-Follow the steps to verify that audit event format and change the format, if needed.
+Complete the following steps to verify the audit event format and change it, if needed.
**Step 1 –** Connect to the Qumulo cluster with SSH.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/qumulo/overview.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/qumulo/overview.md
index 909948f96b..f1b192625e 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/qumulo/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/qumulo/overview.md
@@ -52,7 +52,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/windowsfile/access.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/windowsfile/access.md
index 64f9611994..a9c8f3c3a3 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/windowsfile/access.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/windowsfile/access.md
@@ -17,7 +17,7 @@ Namespaces.
## Windows File System (Standard)
-Configure the credential(s) with the following rights on the Windows host(s):
+Configure the credentials with the following rights on the Windows hosts:
- Granted the "Network access: Restrict clients allowed to make remote calls to SAM" Local Policies > Security Options privilege
- Granted the “Backup files and directories” local policy privilege
@@ -30,11 +30,11 @@ Configure the credential(s) with the following rights on the Windows host(s):
- Local Administrators
- Granted the “Log on as a batch” privilege
- Remote Registry service must be enabled on the host where the applet is deployed (Applet or Proxy w/ Applet scans) to determine the system platform and where to deploy the applet.
- - The local policy, “Network access: Do not allow storage of passwords and credentials for network authentication” must be disabled in order for the applet to start.
- - Sensitive Data Discovery Auditing scans require .NET Framework 4.7.2 or later to be installed on the server where the applet is to be deployed in order for Sensitive Data Discovery collections to successfully occur.
+ - The local policy, “Network access: Don't allow storage of passwords and credentials for network authentication” must be disabled for the applet to start.
+ - Sensitive Data Discovery Auditing scans require .NET Framework 4.7.2 or later on the server where the applet is deployed, for Sensitive Data Discovery collections to succeed.
:::note
-In order to collect data on administrative shares and local policies (logon policies) for a Windows target, the credential must have group membership in the local Administrators group.
+to collect data on administrative shares and local policies (logon policies) for a Windows target, the credential must have group membership in the local Administrators group.
:::
## Windows File System Clusters
@@ -43,7 +43,7 @@ The permissions necessary to collect file system data from a Windows File System
for all nodes that comprise the cluster.
:::note
-It is necessary to target the Windows Cluster File Server Role Server (name clients connect to) of interest when running a File System scan against a Windows File System Cluster.
+Target the Windows Cluster File Server Role Server (name clients connect to) of interest when running a File System scan against a Windows File System Cluster.
:::
Configure credentials on all cluster nodes according to the Windows File System (Standard) permissions, with the following additional requirements:
@@ -54,7 +54,7 @@ Configure credentials on all cluster nodes according to the Windows File System
### Host List Considerations
-It is necessary to target the Windows File Server Cluster (name of the cluster) of interest when running a File System scan against a Windows File System Cluster. Within the Master Host Table, there should be a host entry for the cluster as well as for each node. Additionally, each of these host entries must have the name of the cluster in the `WinCluster` column in the host inventory data. This may need to be updated manually.
+Target the Windows File Server Cluster (name of the cluster) of interest when running a File System scan against a Windows File System Cluster. Within the Master Host Table, there should be a host entry for the cluster as well as for each node. Additionally, each of these host entries must have the name of the cluster in the `WinCluster` column in the host inventory data. This may need to be updated manually.
See the View/Edit section of the [Host Management Activities](https://docs.netwrix.com/docs/accessanalyzer/11_6/admin/hostmanagement/actions/overview) topic for additional information on host inventory.
@@ -62,7 +62,7 @@ See the View/Edit section of the [Host Management Activities](https://docs.netwr
The host targeted by the File System scans is only the host entry for the cluster. For example:
-The environment has a Windows File System Cluster named `ExampleCluster1` with three nodes named `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. There would be four host entries in the Access Analyzer Master Host Table: `ExampleCluster1`, `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. Each of these four entries would have the same value of the cluster name in the `WinCluster` column: `ExampleCluster1`. An additional entry containing the File Server Role Server name(s) should also be added, including the WinCluster name of the nodes. **This File Server Role Server name will be our target host.**
+The environment has a Windows File System Cluster named `ExampleCluster1` with three nodes named `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. There would be four host entries in the Access Analyzer Master Host Table: `ExampleCluster1`, `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. Each of these four entries would have the same value of the cluster name in the `WinCluster` column: `ExampleCluster1`. An additional entry containing the File Server Role Server names should also be added, including the WinCluster name of the nodes. **This File Server Role Server name is the target host.**
### Least Privilege Permission Model for Windows Clusters
@@ -84,7 +84,7 @@ comprise the cluster:
The FileSystem > 0.Collection > 0-FSDFS System Scans Job is configured by default to target the
default domain controller for the domain in which Access Analyzer resides. This is the appropriate
target host for this job when targeting a domain-based namespace. To target a standalone namespace
-or multiple namespaces, create a custom host list of the server(s) hosting the namespace(s). Then
+or multiple namespaces, create a custom host list of the servers hosting the namespaces. Then
assign the custom host list to the 0-FSDFS System Scans Job. No additional host list is require for
the FileSystem > 0.Collection Job Group unless additional file servers are also being targeted.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/windowsfile/activity.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/windowsfile/activity.md
index fedf4acdee..6bb24d0c01 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/windowsfile/activity.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/windowsfile/activity.md
@@ -6,11 +6,11 @@ sidebar_position: 20
# Windows File Server Activity Auditing Configuration
-In order for Netwrix Access Analyzer to collect and store Windows file server activity, an activity monitor agent for Netwrix Activity Monitor must be deployed to the server and monitoring. See the [Single Activity Agent Deployment](https://docs.netwrix.com/docs/activitymonitor/9_0/admin/agents/overview) topic for additional information.
+For Netwrix Access Analyzer to collect and store Windows file server activity, an activity monitor agent for Netwrix Activity Monitor must be deployed to the server and monitoring. See the [Single Activity Agent Deployment](https://docs.netwrix.com/docs/activitymonitor/9_0/admin/agents/overview) topic for additional information.
## Windows File System (Standard)
-Configure the credential(s) with the following rights on the Windows host(s):
+Configure the credentials with the following rights on the Windows hosts:
- For **Local** or **Proxy as a Service Mode** Scans:
- Group membership in both of the following local groups:
@@ -21,7 +21,7 @@ Configure the credential(s) with the following rights on the Windows host(s):
- Local Administrators
- Granted the “Log on as a batch” privilege
- Remote Registry service must be enabled on the host where the applet is deployed (Applet or Proxy w/ Applet scans) to determine the system platform and where to deploy the applet.
- - The local policy, “Network access: Do not allow storage of passwords and credentials for network authentication” must be disabled in order for the applet to start.
+ - The local policy, “Network access: Don't allow storage of passwords and credentials for network authentication” must be disabled for the applet to start.
- Granted the "Network access: Restrict clients allowed to make remote calls to SAM" Local Policies > Security Options privilege
- Granted the “Backup files and directories” local policy privilege
- The service account in the credential profile requires access to the admin share (e.g. `C$`) where the `sbtfilemon.ini` file exists
@@ -29,10 +29,10 @@ Configure the credential(s) with the following rights on the Windows host(s):
## Windows File System Clusters
-In order to monitor a Windows File System Cluster, an Activity Agent needs to be deployed on all nodes that comprise the Windows File System Cluster.
+to monitor a Windows File System Cluster, an Activity Agent needs to be deployed on all nodes that comprise the Windows File System Cluster.
:::note
-It is necessary to target the Windows Cluster File Server Role Server (name clients connect to) when running a File System scan against a Windows File System Cluster.
+Target the Windows Cluster File Server Role Server (name clients connect to) when running a File System scan against a Windows File System Cluster.
:::
Configure credentials according to the Windows File System (Standard) permissions on all cluster nodes that comprise the cluster, with the following additional requirements:
@@ -43,7 +43,7 @@ Configure credentials according to the Windows File System (Standard) permission
### Host List Considerations
-It is necessary to target the Windows File Server Cluster (name of the cluster) of interest when running a File System scan against a Windows File System Cluster. Within the Master Host Table, there should be a host entry for the cluster as well as for each node. Additionally, each of these host entries must have the name of the cluster in the `WinCluster` column in the host inventory data. This may need to be updated manually.
+Target the Windows File Server Cluster (name of the cluster) of interest when running a File System scan against a Windows File System Cluster. Within the Master Host Table, there should be a host entry for the cluster as well as for each node. Additionally, each of these host entries must have the name of the cluster in the `WinCluster` column in the host inventory data. This may need to be updated manually.
See the View/Edit section of the [Host Management Activities](https://docs.netwrix.com/docs/accessanalyzer/11_6/admin/hostmanagement/actions/overview) topic for additional information on host inventory.
@@ -53,7 +53,7 @@ The host targeted by the File System scans is only the host entry for the cluste
:::note Example:
-The environment has a Windows File System Cluster named `ExampleCluster1` with three nodes named `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. There would be four host entries in the Access Analyzer Master Host Table: `ExampleCluster1`, `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. Each of these four entries would have the same value of the cluster name in the `WinCluster` column: `ExampleCluster1`. An additional entry containing the File Server Role Server name(s) should also be added, including the WinCluster name of the nodes. This File Server Role Server name will be our target host.
+The environment has a Windows File System Cluster named `ExampleCluster1` with three nodes named `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. There would be four host entries in the Access Analyzer Master Host Table: `ExampleCluster1`, `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. Each of these four entries would have the same value of the cluster name in the `WinCluster` column: `ExampleCluster1`. An additional entry containing the File Server Role Server names should also be added, including the WinCluster name of the nodes. This File Server Role Server name is the target host.
:::
### Host Mapping
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/windowsfile/overview.md b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/windowsfile/overview.md
index 213e9d4458..4253a9658f 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/windowsfile/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/windowsfile/overview.md
@@ -61,7 +61,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/appletmodescans/appletmodepermissions.md b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/appletmodescans/appletmodepermissions.md
index 3d85f230e9..7a19571262 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/appletmodescans/appletmodepermissions.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/appletmodescans/appletmodepermissions.md
@@ -6,13 +6,13 @@ sidebar_position: 10
# Applet Mode Permissions
-When File System scans are run in applet mode, it means the File System applet is deployed to the target host when the job is executed to conduct data collection. However, the applet can only be deployed to a server with a Windows operating system. The data is collected on the Windows target host where the applet is deployed. The final step in data collection is to compress and transfer the data collected in the SQLite database(s), or Tier 2 database(s), back to the Access Analyzer Console server. If the target host is a NAS device, the File System scans will default to local mode for that host.
+When File System scans are run in applet mode, it means the File System applet is deployed to the target host when the job is executed to conduct data collection. However, the applet can only be deployed to a server with a Windows operating system. The data is collected on the Windows target host where the applet is deployed. The final step in data collection is to compress and transfer the data collected in the SQLite databases, or Tier 2 databases, back to the Access Analyzer Console server. If the target host is a NAS device, the File System scans will default to local mode for that host.
Additionally, the credential must have `WRITE` access to the `…\StealthAUDIT\FSAA` folder in the installation directory on the target host/proxy server as well as on the Access Analyzer Console server. This is required by either the user account running the Access Analyzer application, when manually executing jobs within the console, or the Schedule Service Account assigned within Access Analyzer, when running jobs as a scheduled tasks.
-Sensitive Data Discovery Auditing scans require .NET Framework 4.7.2 or later to be installed on the server where the applet is to be deployed in order for Sensitive Data Discovery collections to successfully occur.
+Sensitive Data Discovery Auditing scans require .NET Framework 4.7.2 or later on the server where the applet is deployed, for Sensitive Data Discovery collections to succeed.
:::tip
Remember, Remote Registry Service must be enabled on the host where the applet is deployed (for
@@ -21,8 +21,8 @@ the applet.
:::
:::warning
-The local policy, “Network access: Do not allow storage of passwords and credentials
-for network authentication” must be disabled in order for the applet to start.
+The local policy, “Network access: Don't allow storage of passwords and credentials
+for network authentication” must be disabled for the applet to start.
:::
See the [Applet Mode Port Requirements](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/scanoptions/applet-mode-scans/appletmodeports) topic for firewall rule information.
@@ -37,7 +37,7 @@ By default, the Applet will run as the connection profile account unless an addi
The account used in the connection profile associated with the File System scan jobs, should have the appropriate permissions required to access the target host. See the [File System Supported Platforms](https://docs.netwrix.com/docs/accessanalyzer/11_6/requirements/filesystem/filesystems/) page for specific requirements per target file system.
-## How do I determine if I’m using Applet Mode scanning?
+## Determine whether you're using Applet Mode scanning
The best way to verify if you’re using Applet Mode scanning is via the FSAA Data Collector Query Settings > [Scan Server Selection](https://docs.netwrix.com/docs/accessanalyzer/11_6/admin/datacollector/fsaa/scanserverselection) page:
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/appletmodescans/appletmodeports.md b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/appletmodescans/appletmodeports.md
index d2d362b931..62656bed67 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/appletmodescans/appletmodeports.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/appletmodescans/appletmodeports.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Applet Mode Port Requirements
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
+The following firewall settings are required when executing the Access Auditing (FSAA)
and/or Sensitive Data Discovery Auditing scans in applet mode for communication between Enterprise
Auditor and the host:
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/localmodescans/localmodepermissions.md b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/localmodescans/localmodepermissions.md
index 4c6bcba5b4..3bac7da5f8 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/localmodescans/localmodepermissions.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/localmodescans/localmodepermissions.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Local Mode Permissions
-When File System scans are run in local mode, it means all of the data collection processing is conducted by the Access Analyzer Console server across the network. The data is collected in the SQLite database(s), or Tier 2 database(s), on the Access Analyzer Console server, and then imported into the Access Analyzer database, or Tier 1 database, on the SQL Server.
+When File System scans are run in local mode, it means all of the data collection processing is conducted by the Access Analyzer Console server across the network. The data is collected in the SQLite databases, or Tier 2 databases, on the Access Analyzer Console server, and then imported into the Access Analyzer database, or Tier 1 database, on the SQL Server.
The account used to run either a manual execution or a scheduled execution of the File System scans, must have the following permissions on the Access Analyzer Console server:
@@ -19,7 +19,7 @@ The account used to run either a manual execution or a scheduled execution of th
Additionally, the credential must have `WRITE` access to the `…\StealthAUDIT\FSAA` folder in the installation directory on the Access Analyzer Console server. This is required by either the user account running the Access Analyzer application, when manually executing jobs within the console, or the Schedule Service Account assigned within Access Analyzer, when running jobs as a scheduled tasks.
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By default, SDD scans are configured to run two concurrent threads. For example, if the job is configured to scan 8 hosts at a time with two concurrent SDD threads, then an extra 32 GB of RAM are required (8x2x2=32).
+If running Sensitive Data Discovery (SDD) scans, you must increase the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By default, SDD scans are configured to run two concurrent threads. For example, if the job is configured to scan 8 hosts at a time with two concurrent SDD threads, then an extra 32 GB of RAM are required (8x2x2=32).
Firewall rules must be configured to allow for communication between the applicable servers. See the [Local Mode Port Requirements](https://docs.netwrix.com/docs/accessanalyzer/11_6/requirements/filesystem/scanoptions/local-mode-scans/localmodeports) topic for firewall rule information.
@@ -30,9 +30,9 @@ Firewall rules must be configured to allow for communication between the applica
The account used in the connection profile associated with the File System scan jobs, should have the appropriate permissions required to access the target host. See the [File System Supported Platforms](https://docs.netwrix.com/docs/accessanalyzer/11_6/requirements/filesystem/filesystems/) page for specific requirements per target file system.
-## How do I determine if I’m using Local Mode scanning?
+## Determine whether you're using Local Mode scanning
The best way to verify if you’re using Local Mode scanning is via the FSAA Data Collector Query Settings > [Scan Server Selection](https://docs.netwrix.com/docs/accessanalyzer/11_6/admin/datacollector/fsaa/scanserverselection) page:
-- **Automatic** — If the target host being scanned is a NAS/Non-Windows host, a Local Mode scan will be utilized.
-- **Local Server** — This will utilize a Local Mode scan, regardless of the OSType of the target host.
+- **Automatic** — If the target host being scanned is a NAS/Non-Windows host, a Local Mode scan will be used.
+- **Local Server** — This will use a Local Mode scan, regardless of the OSType of the target host.
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/localmodescans/localmodeports.md b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/localmodescans/localmodeports.md
index 8af86641b8..72f5d83a92 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/localmodescans/localmodeports.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/localmodescans/localmodeports.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Local Mode Port Requirements
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
+The following firewall settings are required when executing the Access Auditing (FSAA)
and/or Sensitive Data Discovery Auditing scans in local mode for communication between Enterprise
Auditor and the target host:
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/asaservice/proxymodeserviceports.md b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/asaservice/proxymodeserviceports.md
index 4c1658ad19..683898fe4b 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/asaservice/proxymodeserviceports.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/asaservice/proxymodeserviceports.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Proxy Mode as a Service Port Requirements
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
+The following firewall settings are required when executing the Access Auditing (FSAA)
and/or Sensitive Data Discovery Auditing scans in proxy mode as a service for communication between
Enterprise Auditor and the proxy server:
@@ -22,7 +22,7 @@ Data Collector Wizard.
:::
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
+The following firewall settings are required when executing the Access Auditing (FSAA)
and/or Sensitive Data Discovery Auditing scans in proxy mode as a service for communication between
the proxy server and the target host:
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/proxymodeserver.md b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/proxymodeserver.md
index 995ae52b86..a24b18c97a 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/proxymodeserver.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/proxymodeserver.md
@@ -27,7 +27,7 @@ The server can be physical or virtual. The requirements for Enterprise Auditor a
RAM, CPU, and Disk Space are dependent upon the size of the target environment:
:::warning
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
+If running Sensitive Data Discovery (SDD) scans, you must increase the
minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By
default, SDD scans are configured to run two concurrent threads. For example, if the job is
configured to scan 8 hosts at a time with two concurrent SDD threads, then an extra 32 GB of RAM are
@@ -65,19 +65,19 @@ required (8x2x2=32).
- 2 CPU Cores
- 130 GB Disk Space
-The above recommended disk space sizing information is based on the needs of Enterprise Auditor as
-well as the File System solution for running Permission scans with out of the box configuration (500
+This recommended disk space sizing information is based on the needs of Enterprise Auditor as
+well as the File System solution for running Permission scans with the default configuration (500
MB per million files and folders), that means no tag collection, file-level scanning, activity, or
sensitive data.
-- For tag collection, add 125 MB per million documents to the totals above
+- For tag collection, add 125 MB per million documents to these totals
- For activity collection, add 250 MB per million files and folders and another 125 MB per million
- activity events to the totals above
+ activity events to these totals
- For sensitive data collection, add 500 MB per million files and folders and another 1%-10% of the
total size of the documents scanned for sensitive data (depending on targeted document types and
- selected criteria) to the totals above
+ selected criteria) to these totals
-For example, in order to scan 200 million files and folders, of which 10 million files will be
+For example, to scan 200 million files and folders, of which 10 million files will be
scanned for tag collection and sensitive data with a total size of 6 TB, you would need: 160 GB for
permission collection + 1.25 GB for tag collection (10x125 MB) + 100 GB for sensitive data
collection (200x500 MB) + 600 GB additional for sensitive data collection (10% of 6 TB) = 861.25 GB
@@ -112,7 +112,7 @@ The following is required to run Sensitive Data Discovery scans:
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
configuration. It will not conflict with other JDKs or Java Runtimes in the same environment.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/withapplet/proxymodeappletpermissions.md b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/withapplet/proxymodeappletpermissions.md
index b0ecccea55..07009548c5 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/withapplet/proxymodeappletpermissions.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/withapplet/proxymodeappletpermissions.md
@@ -29,9 +29,9 @@ for network authentication” must be disabled for the applet to start.
:::
-Sensitive Data Discovery Auditing scans require .NET Framework 4.7.2 or later to be installed on the
-server where the applet is to be deployed in order for Sensitive Data Discovery collections to
-successfully occur.
+Sensitive Data Discovery Auditing scans require .NET Framework 4.7.2 or later on the
+server where the applet is deployed, for Sensitive Data Discovery collections to
+succeed.
See the [Proxy Mode with Applet Port Requirements](https://docs.netwrix.com/docs/accessanalyzer/11_6/requirements/filesystem/scanoptions/proxy-mode-scans/with-applet/proxymodeappletports) topic for firewall rule
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/withapplet/proxymodeappletports.md b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/withapplet/proxymodeappletports.md
index 5ca6e91edc..7c73e9a95d 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/withapplet/proxymodeappletports.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/proxymodescans/withapplet/proxymodeappletports.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Proxy Mode with Applet Port Requirements
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
+The following firewall settings are required when executing the Access Auditing (FSAA)
and/or Sensitive Data Discovery Auditing scans in proxy mode with applet for communication between
Enterprise Auditor and the proxy server:
@@ -23,7 +23,7 @@ Data Collector Wizard.
:::
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
+The following firewall settings are required when executing the Access Auditing (FSAA)
and/or Sensitive Data Discovery Auditing scans in proxy mode with applet for communication between
the proxy server and the target host:
diff --git a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/scanoptions.md b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/scanoptions.md
index 236d0c4aa4..047cf8f2d8 100644
--- a/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/scanoptions.md
+++ b/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/scanoptions.md
@@ -11,16 +11,16 @@ targeted but also the mode in which the data collection scan is executed. There
types of scan modes: local, applet, or proxy. The proxy mode can be conducted via applet deployment,
or via running as a service (installed in advance).
-For the purpose of this document, “applet” refers to the runtime deployment of the
+In this document, “applet” refers to the runtime deployment of the
`FSAAAppletServer.exe` to either the target host (applet mode scans) or the proxy host (proxy mode
-with applet scans) via Microsoft Task Scheduler. A “proxy” host is any host which can be leveraged
+with applet scans) via Microsoft Task Scheduler. A “proxy” host is any host that can be used
for running File System scans against target hosts.
## Local Mode
When File System scans are run in local mode, it means all of the data collection processing is
conducted by the Enterprise Auditor Console server across the network. The data is collected in the
-SQLite database(s), or Tier 2 database(s), on the Enterprise Auditor Console server, and then
+SQLite databases, or Tier 2 databases, on the Enterprise Auditor Console server, and then
imported into theEnterprise Auditor database, or Tier 1 database, on the SQL Server.
@@ -35,8 +35,8 @@ See the following topics for additional information:
## Applet Mode
:::warning
-The local policy, “Network access: Do not allow storage of passwords and credentials
-for network authentication” must be disabled in order for the applet to start.
+The local policy, “Network access: Don't allow storage of passwords and credentials
+for network authentication” must be disabled for the applet to start.
:::
@@ -44,7 +44,7 @@ When File System scans are run in applet mode, it means the File System applet i
target host when the job is executed to conduct data collection. However, the applet can only be
deployed to a server with a Windows operating system. The data is collected on the Windows target
host where the applet is deployed. The final step in data collection is to compress and transfer the
-data collected in the SQLite database(s), or Tier 2 database(s), back to the Enterprise Auditor
+data collected in the SQLite databases, or Tier 2 databases, back to the Enterprise Auditor
Console server. If the target host is a NAS device, the File System scans will default to local mode
for that host.
@@ -62,14 +62,14 @@ See the following topics for additional information:
## Proxy Mode with Applet
:::warning
-The local policy, “Network access: Do not allow storage of passwords and credentials
-for network authentication” must be disabled in order for the applet to start.
+The local policy, “Network access: Don't allow storage of passwords and credentials
+for network authentication” must be disabled for the applet to start.
:::
When File System scans are run in proxy mode with applet, it means the File System applet is
deployed to the Windows proxy server when the job is executed to conduct data collection. The data
-collection processing is initiated by the proxy server where the applet is deployed and leverages a
+collection processing is initiated by the proxy server where the applet is deployed and uses a
local mode-type scan to each of the target hosts. The final step in data collection is to compress
and transfer the data collected in the SQLite databases, or Tier 2 databases, back to the Enterprise
Auditor Console server.
@@ -91,13 +91,13 @@ When File System scans are run in proxy mode as a service, there are two methods
deploying the service:
- Pre-Installed File System Proxy Service – File System Proxy Service installation package must be
- installed on the Windows proxy servers prior to executing the scans. This is the recommended
+ installed on the Windows proxy servers before executing the scans. This is the recommended
method.
- Ad Hoc File System Proxy Service Deployment – File System Proxy Service is installed on the
Windows proxy server when the job is executed
The data collection processing is conducted by the proxy server where the service is running and
-leverages a local mode-type scan to each of the target hosts. The final step in data collection is
+uses a local mode-type scan to each of the target hosts. The final step in data collection is
to compress and transfer the data collected in the SQLite databases, or Tier 2 databases, back to
the Enterprise Auditor Console server.
diff --git a/docs/accessanalyzer/11.6/requirements/overview.md b/docs/accessanalyzer/11.6/requirements/overview.md
index e8863beb45..9aec52fcac 100644
--- a/docs/accessanalyzer/11.6/requirements/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/overview.md
@@ -8,7 +8,7 @@ sidebar_position: 20
This topic describes the recommended configuration of the servers needed to install the application
in a production environment. Depending on the size of the organization, it is recommended to review
-your environment and requirements with a Netwrix engineer prior to deployment to ensure all
+your environment and requirements with a Netwrix engineer before deployment to ensure all
exceptions are covered.
## Architecture Overview
@@ -46,9 +46,9 @@ The following servers and applications are required for installation of the appl
**File System Solution-Specific Components**
- Enterprise Auditor File System Proxy Server – In certain environments, a proxy server may be
- utilized to scan hosts in remote or firewalled sites to increase scan capacity in large
+ used to scan hosts in remote or firewalled sites to increase scan capacity in large
environments. This feature can be implemented through either an applet or a service. The applet
- would be deployed as part of the data collection process. The service should be installed prior to
+ would be deployed as part of the data collection process. The service should be installed before
data collection. See the
[Proxy Mode as a Service](/docs/accessanalyzer/11.6/requirements/filesystem/scanoptions/scanoptions.md#proxy-mode-as-a-service)
topic for server requirements.
@@ -60,7 +60,7 @@ The following servers and applications are required for installation of the appl
- Enterprise Auditor SharePoint Agent Server – For agent-based scans, this application can be
installed on the SharePoint application server that hosts the “Central Administration” component
- of the targeted farm(s) to auditing permissions, content, and sensitive data for SharePoint
+ of the targeted farms to auditing permissions, content, and sensitive data for SharePoint
On-Premise. See the
[SharePoint Scan Options](/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/scanoptions.md)
topic for server requirements.
@@ -76,7 +76,7 @@ The following servers and applications are required for installation of the appl
for installation requirements and information on collecting activity data.
- Netwrix Threat Prevention – Enterprise Auditor can integrate with Threat Prevention for Active
Directory and Windows File System event data. This integration works in conjunction with Netwrix
- Activity Monitor. See the the
+ Activity Monitor. See the
[Netwrix Threat Prevention Documentation](https://helpcenter.netwrix.com/category/threatprevention)
for installation requirements and information on collecting activity data.
@@ -192,7 +192,7 @@ The following additional considerations are recommended for the SQL Server:
- The standard Autogrowth setting can cause Enterprise Auditor job delays. Database growth is
computationally intensive. While SQL Server is growing the database, no other activity can occur.
- If this option is employed, please speak with a Netwrix engineer to determine an appropriate
+ If this option is employed, speak with a Netwrix engineer to determine an appropriate
setting for best performance.
- Microsoft SQL Server supports TLS 1.2, which requires the Enterprise Auditor Console server to
have either SQL Server Native Client 11 or Microsoft OleDB 18 installed.
@@ -207,8 +207,8 @@ The following permissions are required on the databases:
## Virtual Environment Recommendations
-While physical machines are always preferred, we fully support the use of virtual machines. This
-section contains special considerations when leveraging virtualization.
+While physical machines are always preferred, virtual machines are fully supported. This
+section contains special considerations when using virtualization.
- VMWare® ESX® – If using ESX, the following specifications are recommended:
diff --git a/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/agentbasedscans/agentpermissions.md b/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/agentbasedscans/agentpermissions.md
index 437cdd76c1..a241598c76 100644
--- a/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/agentbasedscans/agentpermissions.md
+++ b/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/agentbasedscans/agentpermissions.md
@@ -8,7 +8,7 @@ sidebar_position: 10
When Enterprise Auditor SharePoint scans are run in agent-based mode, the Enterprise Auditor
SharePoint Agent must be installed on the SharePoint Application server which hosts the Central
-Administration component prior to executing the scans. This is typically the first server stood up
+Administration component before executing the scans. This is typically the first server deployed
during the SharePoint farm installation process in this mode. The data collection processing is
conducted by the SharePoint Agent for the target environment. The final step in data collection is
to transfer the data collected in the SQLite databases, or Tier 2 databases, on the Enterprise
@@ -30,7 +30,7 @@ The following are additional requirements for the Enterprise Auditor SharePoint
**Sensitive Data Discovery Auditing Requirement**
-In addition to having the Sensitive Data Discovery Add-on be installed on the Enterprise Auditor
+In addition to having the Sensitive Data Discovery Add-on installed on the Enterprise Auditor
Console server, The following is required to run Sensitive Data Discovery scans:
- Sensitive Data Discovery Add-On, 64-bit version, installed on the Enterprise Auditor SharePoint
@@ -39,20 +39,20 @@ Console server, The following is required to run Sensitive Data Discovery scans:
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
configuration; it has been preconfigured to work with Enterprise Auditor and should never be
customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
:::
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
+If running Sensitive Data Discovery (SDD) scans, you must increase the minimum amount
of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
## Permissions Explained
-If limited provisioning of the service account is not required by the organization, then the
+If limited provisioning of the service account isn't required by the organization, then the
following permissions are sufficient for successful agent-based scans:
- Membership in the local Administrator group on the on server where the Enterprise Auditor
@@ -85,10 +85,10 @@ following permissions are sufficient for successful agent-based scans:
- This is required so the Enterprise Auditor auditing account can make calls against the
SharePoint web services to remotely gather information around permissions, site hierarchy,
content and more
- - If the group does not exist already, then you need to create a new group at that level and
+ - If the group doesn't exist already, then you need to create a new group at that level and
grant it Read access. Specifically, it is a group that exists within Central
Administration at the farm administrator level. This group only requires Read access and
- is not giving farm admin access. Once the group is created, add the service account that
+ isn't giving farm admin access. After the group is created, add the service account that
Enterprise Auditor will be leveraging to scan SharePoint.
- Web Application permissions:
@@ -103,7 +103,7 @@ following permissions are sufficient for successful agent-based scans:
- SPDataAccess on the SharePoint Content database and all Configuration databases
- - This permission should be applied on the desired Configuration database and all Content
+ - This permission should be applied on the Configuration database and all Content
databases for the SharePoint version
- This version-specific permission is required for Enterprise Auditor to execute read
operations directly against the SharePoint databases, gather information from the
@@ -127,7 +127,7 @@ Additional permission models are explained for a less and least permission model
If restricted permissions are desired by the organization, then the following permissions are needed
for the service account to successfully run SharePoint Agent-based scans.
-Prior to installation of the SharePoint Agent, the service account to be supplied during
+Before installation of the SharePoint Agent, the service account to be supplied during
installation and later used to run the Access Auditing (SPAA) and Sensitive Data Discovery Auditing
scans against the targeted SharePoint environment needs the following permissions:
@@ -156,8 +156,8 @@ following permissions:
`C:\Program Files\STEALTHbits\StealthAUDIT\SPAA`
-The Enterprise Auditor SharePoint Agent utilizes Microsoft APIs. The Microsoft APIs require an
-account with the following permissions in order to collect all of the data:
+The Enterprise Auditor SharePoint Agent uses Microsoft APIs. The Microsoft APIs require an
+account with the following permissions to collect all of the data:
- WSS_CONTENT_APPLICATION_POOLS on the SharePoint Content databases
- WSS_CONTENT_APPLICATION_POOLS on the SharePoint Configuration database
@@ -172,7 +172,7 @@ If scans include Web Application scoping, this last permission requirement is al
If a least privilege model is required by the organization, then the following permissions are
needed for the service account to successfully run SharePoint Agent-based scans.
-Prior to installation of the SharePoint Agent, the service account to be supplied during
+Before installation of the SharePoint Agent, the service account to be supplied during
installation and later used to run the Access Auditing (SPAA) and Sensitive Data Discovery Auditing
scans the targeted SharePoint environment needs the following permissions:
@@ -217,8 +217,8 @@ following permissions:
`C:\Program Files\STEALTHbits\StealthAUDIT\SPAA`
-The Enterprise Auditor SharePoint Agent utilizes Microsoft APIs. The Microsoft APIs require an
-account with the following permissions in order to collect all of the data:
+The Enterprise Auditor SharePoint Agent uses Microsoft APIs. The Microsoft APIs require an
+account with the following permissions to collect all of the data:
- `'GRANT EXECUTE'` permissions on the following stored procedures in the SharePoint Configuration
database:
@@ -230,7 +230,7 @@ account with the following permissions in order to collect all of the data:
- `proc_ReturnWebFeatures`
:::note
- The above four stored procedures would already have the correct permissions if Web
+ These four stored procedures would already have the correct permissions if Web
Application scoping is desired.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/agentbasedscans/agentports.md b/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/agentbasedscans/agentports.md
index 41676bcdfc..faa5610b72 100644
--- a/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/agentbasedscans/agentports.md
+++ b/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/agentbasedscans/agentports.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# SharePoint Agent Ports
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
+The following firewall settings are required when executing the Access Auditing (FSAA)
and/or Sensitive Data Discovery Auditing scans in Agent-based mode for communication between
Enterprise Auditor and the target host:
diff --git a/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/scanoptions.md b/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/scanoptions.md
index 255995711d..9402719fda 100644
--- a/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/scanoptions.md
+++ b/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/scanoptions.md
@@ -6,22 +6,21 @@ sidebar_position: 10
# SharePoint Scan Options
-Required permissions on the targeted SharePoint environment are dependent upon not only the type of
-environment targeted but also the type of data collection scan being executed. There are two types
-of Access Auditing (SPAA) and/or Sensitive Data Discovery Auditing scans: agent-based and
-agent-less. The Activity Auditing (SPAC) scans run as agent-less scans from Enterprise Auditor, but
-they require the Netwrix Activity Monitor to have an activity agent deployed in the target
-environment.
+Required permissions on the targeted SharePoint environment depend on both the type of environment
+you target and the type of data collection scan you run. There are two types of Access Auditing
+(SPAA) and/or Sensitive Data Discovery Auditing scans: agent-based and agent-less. The Activity
+Auditing (SPAC) scans run as agent-less scans from Enterprise Auditor, but they require the Netwrix
+Activity Monitor to have an activity agent deployed in the target environment.
## Agent-Based Type
-When Enterprise Auditor SharePoint scans are run in agent-based mode, the Enterprise Auditor
-SharePoint Agent must be installed on the SharePoint Application server which hosts the Central
-Administration component prior to executing the scans. This is typically the first server stood up
-during the SharePoint farm installation process in this mode. The data collection processing is
-conducted by the SharePoint Agent for the target environment. The final step in data collection is
-to transfer the data collected in the SQLite databases, or Tier 2 databases, on the Enterprise
-Auditor SharePoint Agent server back to the Enterprise Auditor Console server.
+Before you run Enterprise Auditor SharePoint scans in agent-based mode, install the Enterprise
+Auditor SharePoint Agent on the SharePoint Application server that hosts the Central Administration
+component. This is typically the first server set up during the SharePoint farm installation
+process in this mode. The SharePoint Agent conducts data collection processing for the target
+environment. The final step in data collection is to transfer the data collected in the SQLite
+databases, or Tier 2 databases, on the Enterprise Auditor SharePoint Agent server back to the
+Enterprise Auditor Console server.
:::note
Agent-based scans can only target on-premise environments.
@@ -35,8 +34,8 @@ See the following topics for additional information:
## Agent-Less Type
-When SharePoint agent-less scans are run, it means all of the data collection processing is
-conducted by the Enterprise Auditor Console server across the network.
+When you run SharePoint agent-less scans, the Enterprise Auditor Console server conducts all data
+collection processing across the network.
:::note
Agent-less scans can target both on-premise and online environments. This is the only scan
diff --git a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint.md b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint.md
index 7e59dc0d48..8ae2b4c3f4 100644
--- a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint.md
+++ b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint.md
@@ -11,19 +11,19 @@ Server, and Access Information Center. See the
[Requirements](/docs/accessanalyzer/11.6/requirements/overview.md)
topic for the core requirements.
-The SharePoint solution can be configure to run without an agent or to use the Enterprise Auditor
+You can configure the SharePoint solution to run without an agent or to use the Enterprise Auditor
SharePoint Agent. See the
[SharePoint Agent Installation](/docs/accessanalyzer/11.6/install/sharepointagent/overview.md)
topic for additional information.
-In addition to these, integration with either the Netwrix Activity Monitor is required for event
-activity data to be scanned. See the
+In addition, scanning event activity data requires integration with the Netwrix Activity Monitor.
+See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor)
for installation requirements and information on collecting activity data.
:::note
-For Activity Auditing (SPAC) scans, the audit logs generated by SharePoint must be
-retained for more days than the number of days between the Enterprise Auditor scans.
+For Activity Auditing (SPAC) scans, retain the audit logs generated by SharePoint for more days
+than the number of days between the Enterprise Auditor scans.
:::
@@ -33,12 +33,12 @@ in both the Documents and Items section and the List, Libraries, and Site sectio
:::
-The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans.
+Install the Sensitive Data Discovery Add-On on the Enterprise Auditor Console server to enable
+Sensitive Data criteria for scans.
:::note
-If the Enterprise Auditor SharePoint Agent scan option is used, it is also be necessary
-for the Sensitive Data Discovery Add-On to be installed on the servers as well.
+If you use the Enterprise Auditor SharePoint Agent scan option, also install the Sensitive Data
+Discovery Add-On on the servers.
:::
@@ -60,7 +60,7 @@ topic for additional information.
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment:
+These depend on the size of the target environment:
| Environment | Extra-Large | Large | Medium | Small |
| ----------- | ------------------------------------------------ | ------------------------------------------------- | ------------------------------------------------- | ----------------------------------------------- |
@@ -70,10 +70,9 @@ These are dependent upon the size of the target environment:
| Disk Space | 460 GB | 280 GB | 160 GB | 80 GB |
:::note
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
-minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host.For
-example, if the job is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are
-required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if you configure the job to
+scan 8 hosts at a time, it requires an extra 16 GB of RAM (8 x 2 = 16).
:::
@@ -85,10 +84,9 @@ The following is required to run Sensitive Data Discovery scans:
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
-configuration; it has been preconfigured to work with Enterprise Auditor and should never be
-customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
-environment.
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
+configuration. The package preconfigures it to work with Enterprise Auditor, so never customize it
+through Java. It doesn't conflict with other JDKs or Java Runtimes in the same environment.
:::
@@ -96,7 +94,7 @@ environment.
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment.
+These depend on the size of the target environment.
| Environment | Extra-Large | Large | Medium | Small |
| ------------------------ | ------------------------------------------------ | ------------------------------------------------- | ------------------------------------------------- | ----------------------------------------------- |
diff --git a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint.md b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint.md
index e1451663de..662c889d20 100644
--- a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint.md
+++ b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint.md
@@ -10,7 +10,7 @@ Netwrix products audit and monitor Microsoft® SharePoint® environments. Enterp
the SharePoint solution to execute Access Auditing (SPAA) and Sensitive Data Discovery Auditing
scans against SharePoint on-premise and SharePoint Online. Through integration with Activity
Monitor, Enterprise Auditor can also execute Activity Auditing (SPAC) scans against SharePoint
-on-premise and SharePoint online environments. Additionally, Activity Monitor can be configured to
+on-premise and SharePoint online environments. Additionally, you can configure Activity Monitor to
provide activity data to various SIEM products.
Ports and permissions vary based on the scan mode option selected as well as the target environment.
diff --git a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint/access.md b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint/access.md
index 1aa2e80922..904f0616a4 100644
--- a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint/access.md
+++ b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint/access.md
@@ -30,14 +30,14 @@ The service account must be a member of the `Farm Read` group at the farm level.
Enterprise Auditor to call the SharePoint web services to gather permissions, site hierarchy, and
content information remotely.
-Follow these steps to configure farm-level permissions on SharePoint 2013 through SharePoint 2019:
+### Configure farm-level permissions on SharePoint 2013 through SharePoint 2019
1. In the SharePoint **Central Administration Center**, navigate to the **Security** section.
2. Select **Manage the farm administrators group** under **Users**.
3. If the `Farm Read` group exists, add the service account to that group. If the group has been
deleted, create a new group:
- Select **More** under the **Groups** section.
- - Select **New Group** from the **New** drop-down menu.
+ - Select **New Group** from the **New** dropdown menu.
- Ensure the group has the `Read – Can view pages and list items and download documents`
permission.
- Add the service account to the new group.
@@ -50,8 +50,7 @@ The service account requires a custom policy role with `Site Collection Auditor`
permissions at the web application level. This allows Enterprise Auditor to execute web service
calls against **Central Administration**.
-Follow these steps to configure web application-level permissions on SharePoint 2013 through
-SharePoint 2019:
+### Configure web application-level permissions on SharePoint 2013 through SharePoint 2019
1. In the **Central Administration Center**, navigate to the **Application Management** section.
2. Select **Manage web applications** under **Web Applications**.
@@ -72,8 +71,8 @@ SharePoint 2019:
then click **Finish**.
6. Repeat step 5 for each web application in scope.
-The service account is provisioned as `Site Collection Auditor` on all web applications to be
-audited.
+The service account now has `Site Collection Auditor` access on all web applications you want to
+audit.
## SharePoint database server permissions
@@ -82,7 +81,7 @@ configuration database and all content databases. This allows Enterprise Auditor
operations directly against the SharePoint databases and gather information about web application
and content database locations.
-Follow these steps to configure database server permissions:
+### Configure database server permissions
1. Open the SharePoint database server user configuration in SQL Server Management Studio.
2. Grant the service account the `SPDataAccess` database role membership on the following
@@ -91,7 +90,7 @@ Follow these steps to configure database server permissions:
- All SharePoint Content databases that house web application data (by default, content
databases begin with `WSS_Content`, but they can be customized)
-The service account is provisioned with the required SharePoint database permissions.
+The service account now has the required SharePoint database permissions.
## MySites and OneDrive permissions
@@ -102,5 +101,5 @@ MySites and OneDrive permissions depend on the SharePoint Access Data Collector
requires the SharePoint Farm Administrator role or `Site Collection Auditor` at the web
application that hosts MySites.
- **Skip inaccessible personal sites**: This option scans only sites where the service account
- already has administrative access. You must provision the service account before the scan to
- scan OneDrives and personal sites.
+ already has administrative access. To scan OneDrives and personal sites, provision the service
+ account with access before running the scan.
diff --git a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint/activity.md b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint/activity.md
index 6654e8582a..da4c8d22e2 100644
--- a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint/activity.md
+++ b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint/activity.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# SharePoint On-Premise Activity Auditing Configuration
-SharePoint Event Auditing must be enabled for each site collection to be monitored by the Netwrix
-Activity Monitor and/or audited by Netwrix Enterprise Auditor.
+Enable SharePoint Event Auditing for each site collection that the Netwrix Activity Monitor
+monitors or Netwrix Enterprise Auditor audits.
## User Requirements
diff --git a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint/overview.md b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint/overview.md
index eb214eae7b..21f64e930c 100644
--- a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# SharePoint Target Requirements
Netwrix Enterprise Auditor can execute Access Auditing (SPAA) and/or Sensitive Data Discovery
-Auditing scans on SharePoint farms. The Netwrix Activity Monitor can be configured to monitor
+Auditing scans on SharePoint farms. You can configure the Netwrix Activity Monitor to monitor
activity on SharePoint farms and make the event data available for Enterprise Auditor Activity
Auditing (SPAC) scans.
@@ -39,7 +39,7 @@ Activity Agent must have the following permissions on the proxy server:
- Membership in the local Administrators group
- READ and WRITE access to the archive location for Archiving feature only
-It is also necessary to enable the Remote Registry Service on the Activity Agent server.
+Also enable the Remote Registry Service on the Activity Agent server.
For integration between the Activity Monitor and Enterprise Auditor, the credential used by
Enterprise Auditor to read the activity log files must have also have this permission.
@@ -65,15 +65,15 @@ are required for communication between the Agent server and the Netwrix Activity
| -------------------------------- | -------- | ----- | ------------------- |
| Activity Monitor to Agent Server | TCP | 4498 | Agent Communication |
-The Windows firewall rules need to be configured on the Windows server, which require certain
-inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+Configure the Windows firewall rules on the Windows server. If the scans run in applet mode, you
+must create certain inbound rules. These scans operate over a default
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
Additional Firewall Rules for Integration between Enterprise Auditor and Activity Monitor
-Firewall settings are dependent upon the type of environment being targeted. The following firewall
+Firewall settings depend on the type of environment you target. The following firewall
settings are required for communication between the agent server and the Enterprise Auditor Console:
| Communication Direction | Protocol | Ports | Description |
diff --git a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepointonline/access.md b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepointonline/access.md
index 92db88805d..5d56eea176 100644
--- a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepointonline/access.md
+++ b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepointonline/access.md
@@ -19,7 +19,7 @@ Microsoft Entra ID.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you register the application:
- Client ID – This is the Application (client) ID for the registered application
- Key – The comma delimited string containing the path to the certificate PFX file, certificate
@@ -28,9 +28,9 @@ The following settings are needed from your tenant once you have registered the
Configure Modern Authentication for SharePoint Online using SP_RegisterAzureAppAuth Instant Job
-Registering a Microsoft Entra ID application and provisioning it to grant permissions to SharePoint
-Online can be automated using the SP_RegisterAzureAppAuth job from the Enterprise Auditor Instant
-Job Library. The SP_RegisterAzureAppAuth job uses the PowerShell Data Collector to automatically
+The SP_RegisterAzureAppAuth job from the Enterprise Auditor Instant Job Library can automate
+registering a Microsoft Entra ID application and provisioning it to grant permissions to SharePoint
+Online. The SP_RegisterAzureAppAuth job uses the PowerShell Data Collector to automatically
configure modern authentication for SharePoint Online. It requires:
- A Connection Profile containing the following two user credentials, both with an Account Type of
@@ -103,9 +103,7 @@ against Entra ID while requesting the App Only access token. See the Microsoft
[Granting access via Azure AD App-Only](https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread)
article for additional information.
-Follow the steps create the self-signed X.509 certificate.
-
-**Step 1 –** To generate a certificate, use the sample PowerShell command below:
+**Step 1 –** To generate a certificate, use the following sample PowerShell command:
- Change the following parameters in the sample PowerShell command. See the Microsoft
[New-SelfSignedCertificate](https://docs.microsoft.com/en-us/powershell/module/pki/new-selfsignedcertificate)
@@ -115,9 +113,9 @@ Follow the steps create the self-signed X.509 certificate.
certificate
- Subject – A unique name for the new App (always starts with CN=, to denote a canonical name)
- FriendlyName – Same as Subject name minus the canonical name prefix
- - NotAfter – A datetime string denoting the certificate's expiration date - in the above sample,
- Get-Date.AddYears(11) specifies that the certificate will expire 11 years from the current
- datetime
+ - NotAfter – A datetime string denoting the certificate's expiration date - in the following
+ sample, Get-Date.AddYears(11) specifies that the certificate will expire 11 years from the
+ current datetime
Example PowerShell:
@@ -131,7 +129,7 @@ $certPath variable (see Step 1).
:::note
The environment variable `SAINSTALLDIR` always points to the base Enterprise Auditor
-install directory; simply append the PrivateAssemblies to point to that folder with the following
+install directory; append PrivateAssemblies to point to that folder with the following
cmdlet:
:::
@@ -163,10 +161,8 @@ more secure before running this cmdlet.
## Register a Microsoft Entra ID Application
-Follow the steps to register Enterprise Auditor with Microsoft Entra ID.
-
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -188,14 +184,12 @@ registrations.
**Step 5 –** Click **Register**.
The Overview page for the newly registered app opens. Review the newly created registered
-application. Now that the application has been registered, permissions need to be granted to it.
+application, then grant it permissions.
## Upload Self-Signed Certificate
-Follow the steps to provision the upload your self-signed certificate.
-
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -220,10 +214,8 @@ The upload certificate public key .cer file is an application key credential.
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
-
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -299,15 +291,13 @@ Select the following permissions:
**Step 12 –** Click **Grant Admin Consent for [tenant]**. Then click **Yes** in the confirmation
window.
-Now that the permissions have been granted to it, the Connection Profile and host settings for
-Enterprise Auditor need to be collected.
+Now that you've granted the permissions, collect the Connection Profile and host settings for
+Enterprise Auditor.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
-
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
diff --git a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepointonline/activity.md b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepointonline/activity.md
index a6c6df8664..1217544c01 100644
--- a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepointonline/activity.md
+++ b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepointonline/activity.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# SharePoint Online Activity Auditing Configuration
-In order to collect logs and monitor SharePoint Online activity using the Netwrix Activity Monitor,
-it needs to be registered with Microsoft® Entra ID® (formerly Azure AD).
+To collect logs and monitor SharePoint Online activity, the Netwrix Activity Monitor requires an
+application registered with Microsoft® Entra ID® (formerly Azure AD).
:::note
A user account with the Global Administrator role is required to register an app with
@@ -26,14 +26,14 @@ additional information.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you register the application:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
+ It isn't possible to retrieve the value after saving the new key. It must be
copied first.
:::
@@ -55,10 +55,8 @@ The following settings are needed from your tenant once you have registered the
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
-
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -84,14 +82,12 @@ registrations.
**Step 5 –** Click **Register**.
The Overview page for the newly registered app opens. Review the newly created registered
-application. Now that the application has been registered, permissions need to be granted to it.
+application, then grant it permissions.
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
-
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -131,15 +127,12 @@ Microsoft APIs tab. Select the following permissions:
**Step 9 –** Click **Grant Admin Consent for [tenant]**. Then click **Yes** in the confirmation
window.
-Now that the permissions have been granted to it, the settings required for Activity Monitor need to
-be collected.
+Now that you've granted the permissions, collect the settings required for Activity Monitor.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
-
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -174,10 +167,8 @@ application’s Client Secret Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
-
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
@@ -194,18 +185,15 @@ application’s Client Secret Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
-value when saving the new key.
-
:::note
-The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
+The following steps are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
additional information.
:::
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
+It isn't possible to retrieve the value after saving the new key. It must be copied
first.
:::
@@ -232,13 +220,13 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
-this process will have to be repeated.
+If you leave this page before copying the key, the key isn't retrievable and you'll have to repeat
+this process.
:::
-**Step 6 –** The Client Secret will be displayed in the Value column of the table. You can use the
-Copy to clipboard button to copy the Client Secret.
+**Step 6 –** The Value column of the table displays the Client Secret. You can use the Copy to
+clipboard button to copy the Client Secret.
**Step 7 –** Save this value in a text file.
@@ -246,15 +234,14 @@ This is needed for adding a SharePoint Online host in the Activity Monitor.
## Enable Auditing for SharePoint Online
-Follow the steps to enable auditing for SharePoint Online so the Activity Monitor can receive
-events.
+Enable auditing for SharePoint Online so the Activity Monitor can receive events.
**Step 1 –** In the Microsoft Purview compliance portal at
[https://compliance.microsoft.com](https://compliance.microsoft.com/), go to **Solutions** >
**Audit**. Or, to go directly to the Audit page at
[https://compliance.microsoft.com/auditlogsearch](https://compliance.microsoft.com/auditlogsearch).
-**Step 2 –** If auditing is not turned on for your organization, a banner is displayed prompting you
+**Step 2 –** If auditing isn't turned on for your organization, a banner is displayed prompting you
start recording user and admin activity.
**Step 3 –** Select the **Start recording** user and **admin activity** banner.
diff --git a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepointonline/overview.md b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepointonline/overview.md
index ac66bb3cd9..c2f746f589 100644
--- a/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepointonline/overview.md
+++ b/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepointonline/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# SharePoint Online Target Requirements
Netwrix Enterprise Auditor can execute Access Auditing (SPAA) and Sensitive Data Discovery Auditing
-scans on SharePoint Online. The Netwrix Activity Monitor can be configured to monitor activity on
+scans on SharePoint Online. You can configure the Netwrix Activity Monitor to monitor activity on
SharePoint Online and make the event data available for Enterprise Auditor Activity Auditing (SPAC)
scans.
@@ -48,7 +48,7 @@ server:
- Membership in the local Administrators group
- READ and WRITE access to the archive location for Archiving feature only
-It is also necessary to enable the Remote Registry Service on the Activity Agent server.
+Also enable the Remote Registry Service on the Activity Agent server.
For integration between the Activity Monitor and Enterprise Auditor, the credential used by
Enterprise Auditor to read the activity log files must have also have this permission.
@@ -74,15 +74,15 @@ are required for communication between the Agent server and the Netwrix Activity
| -------------------------------- | -------- | ----- | ------------------- |
| Activity Monitor to Agent Server | TCP | 4498 | Agent Communication |
-The Windows firewall rules need to be configured on the Windows server, which require certain
-inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+Configure the Windows firewall rules on the Windows server. If the scans run in applet mode, you
+must create certain inbound rules. These scans operate over a default
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
Additional Firewall Rules for Integration between Enterprise Auditor and Activity Monitor
-Firewall settings are dependent upon the type of environment being targeted. The following firewall
+Firewall settings depend on the type of environment you target. The following firewall
settings are required for communication between the agent server and the Enterprise Auditor Console:
| Communication Direction | Protocol | Ports | Description |
diff --git a/docs/accessanalyzer/11.6/requirements/unix/target.md b/docs/accessanalyzer/11.6/requirements/unix/target.md
index 52af30d3f0..8fe7b9cbdd 100644
--- a/docs/accessanalyzer/11.6/requirements/unix/target.md
+++ b/docs/accessanalyzer/11.6/requirements/unix/target.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Target Unix Requirements, Permissions, and Ports
-The Enterprise Auditor for Unix Solution provides the ability to audit Unix servers. It scans:
+The Enterprise Auditor for Unix Solution lets you audit Unix servers. It scans:
- AIX® 4+
- Solaris™ 8+
@@ -33,8 +33,8 @@ This solution employs the following data collectors to scan the target environme
- Root permissions in Unix/Linux
-If the Root permission is unavailable, a least privileged model can be used. See the
-[Least Privilege Model](#least-privilege-model) topic additional information.
+If the Root permission is unavailable, you can use a least privileged model. See the
+[Least Privilege Model](#least-privilege-model) topic for additional information.
## Ports
@@ -53,17 +53,17 @@ The following firewall ports are needed:
## Least Privilege Model
Enterprise Auditor for Unix collects information from Unix devices by running commands or executing
-scripts on your Unix hosts (if configured properly our tool can SCP scripts to your hosts before
-execution). Therefore, the domain or local user credentials entered in the Connection Profile within
-the Enterprise Auditor must be capable of running the necessary commands, executing the necessary
-scripts or, in some cases, have rights to SCP scripts to the host.
+scripts on your Unix hosts (if configured properly, Enterprise Auditor can SCP scripts to your hosts
+before execution). Therefore, the domain or local user credentials entered in the Connection Profile within
+the Enterprise Auditor must be able to run the necessary commands, execute the necessary
+scripts, or, in some cases, have rights to SCP scripts to the host.
### Connecting to Unix Hosts
Enterprise Auditor for Unix connects to your host in two ways:
-- Plink – This mechanism is leveraged during our tools Host Inventory to test connectivity to a host
- and to collect basic details about a host (Host Name, OS Type, etc.)
+- Plink – Enterprise Auditor uses this mechanism during Host Inventory to test connectivity to a
+ host and to collect basic details about a host (Host Name, OS Type, etc.)
- Implementation of the SSH2 protocol built into Enterprise Auditor – This is how the Unix Data
Collector interacts with and pulls information from your environment
@@ -81,13 +81,13 @@ Enterprise Auditor for Unix connects to your host in two ways:
- SSH port opened in software and hardware firewalls. Default is 22.
- - If you do not use Port 22, you can specify your SSH port in the Connection Profile
+ - If you don't use Port 22, you can specify your SSH port in the Connection Profile
### Commands for Non-Root Accounts
-We recommend using the root account to run Enterprise Auditor against a Unix system. However, if
-that is not acceptable all the commands we leverage in the solution set are below and can be used to
-implement least privilege:
+Netwrix recommends using the root account to run Enterprise Auditor against a Unix system. However,
+if that isn't acceptable, the following commands used in the solution set implement least
+privilege:
All Perl scripts require the account to be able to execute the following commands:
@@ -118,7 +118,7 @@ environment to run the following commands:
- `cat /etc/security/user` (read access)
- `cat /etc/shadow`
- - Requires root or customization to job to utilize sudo without password prompt (:NOPASSWD)
+ - Requires root or customization to job to use sudo without password prompt (:NOPASSWD)
- `egrep /etc/security/user` (read access)
- `egrep /etc/login.defs` (read access)
@@ -150,8 +150,8 @@ The 2.PrivilegedAccess > Sudoers > 0.Collection > UX_ParseSudoers Job requires p
Unix environment to run the following commands:
:::note
-To parse sudoers we either need root or an account that has access to use sudo without
-password prompt (:NOPASSWD)
+To parse sudoers, the account needs root access or access to use sudo without a
+password prompt (:NOPASSWD).
:::
diff --git a/docs/accessanalyzer/11.6/requirements/unix/unix.md b/docs/accessanalyzer/11.6/requirements/unix/unix.md
index 3012e2b3db..3a728755a5 100644
--- a/docs/accessanalyzer/11.6/requirements/unix/unix.md
+++ b/docs/accessanalyzer/11.6/requirements/unix/unix.md
@@ -19,7 +19,7 @@ topic for target environment requirements.
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment:
+These depend on the size of the target environment:
| Environment | Large | Medium – Small |
| ----------- | ------ | -------------- |
@@ -31,7 +31,7 @@ These are dependent upon the size of the target environment:
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment.
+These depend on the size of the target environment.
| Environment | Large | Medium – Small |
| ------------------------ | ------ | -------------- |
diff --git a/docs/accessanalyzer/11.6/requirements/windows/windows.md b/docs/accessanalyzer/11.6/requirements/windows/windows.md
index d7b2c400a4..45c0b16b47 100644
--- a/docs/accessanalyzer/11.6/requirements/windows/windows.md
+++ b/docs/accessanalyzer/11.6/requirements/windows/windows.md
@@ -19,7 +19,7 @@ topic for target environment requirements.
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment:
+These depend on the size of the target environment:
| Environment | Large | Medium – Small |
| ----------- | ------ | -------------- |
@@ -31,7 +31,7 @@ These are dependent upon the size of the target environment:
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment.
+These depend on the size of the target environment.
| Environment | Large | Medium – Small |
| ------------------------ | ------ | -------------- |
diff --git a/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/configuration.md b/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/configuration.md
index b9848b1bf1..633226a714 100644
--- a/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/configuration.md
+++ b/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/configuration.md
@@ -11,7 +11,7 @@ edit, and remove sub-criteria information for User Criteria.
-The information in the configuration pane changes based on the criteria currently selected in the
+The information in the configuration pane changes based on the criteria selected in the
navigation pane.
@@ -19,7 +19,7 @@ navigation pane.
The options at the top of the Configuration Pane are:
:::note
-Configuration settings for System Criteria cannot be modified.
+Configuration settings for System Criteria can't be modified.
:::
@@ -40,7 +40,7 @@ Configuration settings for System Criteria cannot be modified.
- The risk score can be set to **Low**, **Medium**, or **High**
- Click the **Risk Score** button to change the risk score for user-configured criteria
-- Required matched criteria list – Lists the sub-criteria configured for the currently selected
+- Required matched criteria list – Lists the sub-criteria configured for the selected
top-level criteria in the navigation pane. The columns in the table are:
- Name – Name of the sub-criteria
@@ -54,7 +54,7 @@ Configuration settings for System Criteria cannot be modified.
The options at the bottom of the configuration pane are:
:::note
-Configuration settings for System Criteria cannot be modified.
+Configuration settings for System Criteria can't be modified.
:::
@@ -67,7 +67,7 @@ Configuration settings for System Criteria cannot be modified.
- [Summary Criteria](/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/summary.md)
- Remove – Remove sub-criteria from the Required matched sub-criteria list
-- Edit – Edit the currently selected sub-criteria
+- Edit – Edit the selected sub-criteria
- Must match at least this many criteria – Adjust the slider to configure how many sub-criteria must
be matched for the sensitive data criteria to be reported
@@ -76,13 +76,13 @@ Configuration settings for System Criteria cannot be modified.
required matched criteria list
:::warning
- The character distance feature does not account for summaries that are nested
+ The character distance feature doesn't account for summaries that are nested
within other summaries.
:::
- Matches should be within this proximity of characters – Match hits for this criteria should be
- within this many characters of one another in order for there to be a match. Adjust the slider to
+ within this many characters of one another for a match to occur. Adjust the slider to
set the default character distance required for match hits.
- The minimum value is 0
@@ -90,15 +90,15 @@ Configuration settings for System Criteria cannot be modified.
- Using this feature requires any combination of two or more Regular Expression (Pattern) and
Keyword sub-criteria
-- Include keywords as part of match hits – Select this option to enable the inclusion of keywords as
+- Include keywords as part of match hits – Select this option to include keywords as
part of match hits. This option determines whether a match found based on a Keyword Criteria is
reported as a match hit. When this option is selected, any matches found for a word in the Keyword
- list is reported as match hit. If this option is not selected, then only matches found based on
+ list is reported as match hit. If this option isn't selected, then only matches found based on
Pattern or child Summary Criteria are reported as a match hit.
- Metadata for this criteria – Click the green plus (**+**) button to add a new metadata type for
the criteria. Delete a metadata type by clicking the **X** button in the gray metadata tag.
- - For a list of available out-of-the-box metadata tags, see the
+ - For a list of available default metadata tags, see the
[Default Metadata Tag Values](/docs/accessanalyzer/11.6/sensitivedatadiscovery/metadatatags.md)
topic for additional information
@@ -116,8 +116,8 @@ The options in the Criteria Tester are:
- Use the following sample text – Enter sample text to test against current configured criteria in
the **Use the following sample text** textbox
- Use the following file – Click **Browse** to import a file as sample text to test against
- currently configured criteria
-- Test Data – Click **Test Data** to test the sample text against currently configured criteria.
+ configured criteria
+- Test Data – Click **Test Data** to test the sample text against configured criteria.
Match hits show in the **Test Results** section.
- Test Results – Displays match hits for the sample text typed into the text box. The two tabs under
Test Results are:
diff --git a/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/keyword.md b/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/keyword.md
index 2f5bb7c9ef..addcc80468 100644
--- a/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/keyword.md
+++ b/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/keyword.md
@@ -21,8 +21,8 @@ The options on the Keywords window are:
- Match Type – Choose whether keyword matches for the Keyword criteria **Must match** or **Must not
match**
- Case Sensitive Keywords – If enabled, checks letter case when matching keywords
-- Count only distinct occurrences – Select the checkbox to enable only distinct occurrences to be
- counted during scan jobs
+- Count only distinct occurrences – Select the checkbox to count only distinct occurrences during
+ scan jobs
- Apply these keywords to these file components – Select which file components the keywords apply
to:
diff --git a/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/overview.md b/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/overview.md
index 8194843a3d..96c11db28f 100644
--- a/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/overview.md
+++ b/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/overview.md
@@ -6,10 +6,10 @@ sidebar_position: 50
# Sensitive Data Criteria Editor
-The Sensitive Data Criteria Editor is accessed from the Criteria Tab in the
-**Settings** > **Sensitive Data** node. Use the Sensitive Data Criteria Editor to view pre-defined
-criteria and to customize or create user-defined criteria. Sensitive Data Criteria can be configured
-in individual data collectors that use the Sensitive Data Discovery Add-On or can be configured to
+Access the Sensitive Data Criteria Editor from the Criteria tab in the
+**Settings** > **Sensitive Data** node. Use it to view pre-defined
+criteria and to customize or create user-defined criteria. You can configure Sensitive Data Criteria
+in individual data collectors that use the Sensitive Data Discovery Add-On, or configure them to
inherit Sensitive Data Criteria settings from the **Settings** > **Sensitive Data** node. See the
[Sensitive Data](/docs/accessanalyzer/11.6/admin/settings/sensitivedata/overview.md)
topic for additional information.
@@ -18,10 +18,9 @@ topic for additional information.
The Sensitive Data Criteria Editor contains two sections:
-- Navigation pane – User-configured criteria can be added and removed in the navigation pane using
- the Add or Remove options. See the [Navigation Pane](#navigation-pane) topic for additional
- information.
-- Configuration pane – Displays configured settings for the currently selected criteria in the
+- Navigation pane – Add or remove user-configured criteria using the Add or Remove options. See the
+ [Navigation Pane](#navigation-pane) topic for additional information.
+- Configuration pane – Displays configured settings for the selected criteria in the
navigation pane. See the
[Configuration Pane](/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/configuration.md)
topic for additional information.
@@ -42,6 +41,6 @@ The options in the Navigation Pane are:
[Sensitive Data System Criteria](/docs/accessanalyzer/11.6/sensitivedatadiscovery/systemcriteria.md)
topic for additional information.
- - System Criteria cannot be modified or removed. To use existing System Criteria configurations
- in a User Criteria, right-click on a System Criteria and select **Duplicate** from the
+ - System Criteria can't be modified or removed. To use existing System Criteria configurations
+ in a User Criteria, right-click a System Criteria and select **Duplicate** from the
right-click menu. A configurable copy of the System Criteria appears under User Criteria.
diff --git a/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/regularexpression.md b/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/regularexpression.md
index 2d04bbc35a..15e7d8403e 100644
--- a/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/regularexpression.md
+++ b/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/regularexpression.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# Regular Expression (Pattern) Criteria
Regular Expression criteria are a set of pattern matching rules that provide a concise and flexible
-means for matching strings of text. This criteria type can be used to verify a series of numbers as
+means for matching strings of text. Use this criteria type to verify a series of numbers as
potentially valid, for example credit card numbers.
@@ -18,7 +18,7 @@ The options on the Regular Expression window are:
- Expression – Enter the Regular Expression in the Expression text box
- Case Sensitive Expression – Select the checkbox for case sensitive Regular Expression pattern
matching
-- Validation – Select a validation method from the Validation drop-down. The default value is **No
+- Validation – Select a validation method from the Validation dropdown. The default value is **No
validation required**.
:::note
@@ -35,9 +35,9 @@ The options on the Regular Expression window are:
- Match Type – Choose whether pattern matches for the Regular Expression criteria **Must match** or
**Must not match**
- - Must match – The Regular Expression must be matched for there to be a match
- - Must not match – If the Regular Expression is matched and is designated **Must not match**,
- then the potential match is invalidated
+ - Must match – The criteria counts as a match only if the Regular Expression matches
+ - Must not match – If the Regular Expression matches while set to **Must not match**, the
+ potential match is invalid
- Apply this expression to these file components – Select which file components the expression
applies to:
diff --git a/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/summary.md b/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/summary.md
index 19eab66527..e0ed6152c1 100644
--- a/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/summary.md
+++ b/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/summary.md
@@ -6,8 +6,7 @@ sidebar_position: 40
# Summary Criteria
-Summary criteria are designed as a way of combining Regular Expression (Pattern) criteria and
-Keyword criteria.
+Summary criteria combine Regular Expression (Pattern) criteria and Keyword criteria.
@@ -23,7 +22,7 @@ The options on the Summary criteria configuration page are:
See the
[Criteria Tester Window](/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/configuration.md#criteria-tester-window) topic
for additional information.
-- Required matched criteria – Lists sub-criteria configured for currently selected criteria in the
+- Required matched criteria – Lists sub-criteria configured for selected criteria in the
navigation pane. The columns in the table are:
- Name – Name of the sub-criteria
@@ -35,7 +34,7 @@ The options on the Summary criteria configuration page are:
- Add – Add a sub-criteria to the required matched criteria list. The three types of sub-criteria
that can be added are **Keyword**, **Pattern**, and **Summary**.
- Remove – Remove the selected sub-criteria from the Required matched criteria list
-- Edit – Edit the currently selected sub-criteria
+- Edit – Edit the selected sub-criteria
- Match Type – Choose whether match hits for the Summary criteria **Must match** or **Must not
match**
- Must match at least this many criteria – Adjust the slider to configure how many sub-criteria must
@@ -46,7 +45,7 @@ The options on the Summary criteria configuration page are:
Required matched criteria list
:::warning
-The character distance feature does not account for summaries that are nested within
+The character distance feature doesn't account for summaries that are nested within
other summaries.
:::
@@ -62,4 +61,4 @@ other summaries.
- Include keywords as part of match hits – Select this checkbox to enable the inclusion of keywords
as part of match hits
- Cancel – Exit the Sensitive Data Criteria Editor without saving changes
-- Save – Save changes made to the currently selected criteria
+- Save – Save changes made to the selected criteria
diff --git a/docs/accessanalyzer/11.6/sensitivedatadiscovery/overview.md b/docs/accessanalyzer/11.6/sensitivedatadiscovery/overview.md
index 16bac42cf7..4a60dc34e3 100644
--- a/docs/accessanalyzer/11.6/sensitivedatadiscovery/overview.md
+++ b/docs/accessanalyzer/11.6/sensitivedatadiscovery/overview.md
@@ -10,7 +10,7 @@ The Sensitive Data Discovery Add-On allows Enterprise Auditor to scan file conte
the sensitive data criteria. There are several pre-defined criteria, but you can also customize
existing criteria or create new criteria.
-The Sensitive Data Discovery Add-on can be used with any of the following Enterprise Auditor
+You can use the Sensitive Data Discovery Add-on with any of the following Enterprise Auditor
solutions:
- AWS Solution
@@ -44,10 +44,9 @@ Sensitive Data Discovery Add-on.
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
-configuration; it has been preconfigured to work with Enterprise Auditor and should never be
-customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
-environment.
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
+configuration. The package preconfigures it to work with Enterprise Auditor, so never customize it
+through Java. It doesn't conflict with other JDKs or Java Runtimes in the same environment.
:::
diff --git a/docs/accessanalyzer/11.6/sensitivedatadiscovery/supportedformats.md b/docs/accessanalyzer/11.6/sensitivedatadiscovery/supportedformats.md
index 77a2e4fdbe..0c2a7fbd7e 100644
--- a/docs/accessanalyzer/11.6/sensitivedatadiscovery/supportedformats.md
+++ b/docs/accessanalyzer/11.6/sensitivedatadiscovery/supportedformats.md
@@ -166,15 +166,15 @@ multimedia. The following file formats are supported as metadata only formats.
## Scans Against Files with no Extensions
-Files with no extensions can be scanned by modifying the XML file for each job where this type of
-scan is desired. Add the following line to the `PerScanExtraScanOptions` section of a job's XML
+You can scan files with no extensions by modifying the XML file for each job where you want this
+type of scan. Add the following line to the `PerScanExtraScanOptions` section of a job's XML
script:
```
true
```
-This line must be added to a specific location within the XML script. See below:
+Add this line to the specific location shown in the following XML script:
```
@@ -193,5 +193,5 @@ This line must be added to a specific location within the XML script. See below:
```
-Once this line has been added to the job's XML script and the XML file is saved, files with no
+After you add this line to the job's XML script and save the XML file, files with no
extensions are included in scans for the job.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_activitycollection.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_activitycollection.md
index a2b10a9d7c..fec9539bb5 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_activitycollection.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_activitycollection.md
@@ -7,23 +7,23 @@ sidebar_position: 20
# 0.Collection > AD_ActivityCollection Job
The AD_ActivityCollection Job located in the 0.Collection Job Group, imports data from the Netwrix
-Activity Monitor logs into the Enterprise Auditor Database. Retention can be modified in the query
+Activity Monitor logs into the Enterprise Auditor Database. You can modify retention in the query
(120 days default).
-There are two ways AD Activity data can be retrieved by Enterprise Auditor:
+Enterprise Auditor can retrieve AD Activity data in two ways:
- Network share containing the archive logs
- API Server connected to the archive logs
-This is configured in the query. See the
+You configure this in the query. See the
[Queries for the AD_ActivityCollection Job](#queries-for-the-ad_activitycollection-job) topic for
additional information.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+With the Configuration section on a job's overview page, you can modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -57,8 +57,8 @@ The AD Activity Collection query uses the ADActivity Data Collector to target th
archive logs for AD Activity.
:::note
-The query can be configured to connect directly to the network share where the archive
-logs are stored or the API Server.
+You can configure the query to connect directly to the network share where the archive
+logs are stored, or to the API Server.
:::
@@ -70,9 +70,8 @@ The AD_ActivityCollection Job uses the ADActivity Data Collector for the followi
### Configure the Query to Import from the Activity Monitor
-The AD_ActivityCollection Job requires configuration to collect data. Follow the steps to modify the
-query configuration when Netwrix Activity Monitor is configured to host domain activity logs on an
-API server.
+The AD_ActivityCollection Job requires configuration to collect data. Modify the query configuration
+when Netwrix Activity Monitor is configured to host domain activity logs on an API server.
:::note
Ensure the Activity Monitor API Server and the required Connection Profile are
@@ -116,10 +115,10 @@ last step.
- Absolute Timespan – Set the date range for activity logs to collect when the scan is run
:::info
-The threshold should be set to ensure the logs are collected before the Activity
+Set the threshold to ensure the logs are collected before the Activity
Monitor domain output log retention expires. For example, if Enterprise Auditor runs the
-**AD_ActivityCollection** Job once a week (every 7 days), then the Activity Monitor output should be
-configured to retain at least 10 days of log files.
+**AD_ActivityCollection** Job once a week (every 7 days), configure the Activity Monitor output to
+retain at least 10 days of log files.
:::
@@ -139,14 +138,12 @@ Credential with the Refresh token:
- Click **OK** to save and close the User Credentials window.
- Click **Save** and then **OK** to confirm the changes to the Connection Profile.
-The query is now configured to target the Activity Monitor API Server to collect domain activity
-logs.
+The query now targets the Activity Monitor API Server to collect domain activity logs.
### Configure the Query to Import from a Share
-The AD_ActivityCollection Job requires configuration to collect data. Follow the steps to modify the
-query configuration when Netwrix Activity Monitor is configured to store activity logs on a network
-share.
+The AD_ActivityCollection Job requires configuration to collect data. Modify the query configuration
+when Netwrix Activity Monitor is configured to store activity logs on a network share.
:::note
Ensure the Activity Monitor domain output and the required Connection Profile are
@@ -182,10 +179,10 @@ Click **Next**.
- Absolute Timespan – Set the date range for activity logs to collect when the scan is run
:::info
-The threshold should be set to ensure the logs are collected before the Activity
+Set the threshold to ensure the logs are collected before the Activity
Monitor domain output log retention expires. For example, if Enterprise Auditor runs the
-**AD_ActivityCollection** Job once a week (every 7 days), then the Activity Monitor output should be
-configured to retain at least 10 days of log files.
+**AD_ActivityCollection** Job once a week (every 7 days), configure the Activity Monitor output to
+retain at least 10 days of log files.
:::
@@ -196,8 +193,8 @@ keeps the collected data in the SQL Server database.
**Step 9 –** Click **OK** to save the changes and close the Query Properties page.
-The query is now configured to target the network share where the Activity Monitor domain activity
-logs are archived.
+The query now targets the network share where the Activity Monitor domain activity logs are
+archived.
## Analysis Tasks for the AD_ActivityCollection Job
@@ -205,7 +202,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **0.Collecti
**AD_ActivityCollection** Job. Select the **Configure** > **Analysis** node.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -218,9 +215,9 @@ The following analysis tasks are selected by default:
- AIC Import - AD Activity Events – Imports AD events to the Access Information Center for domain
objects
- - The `@ADEvents` and `@AuthEvents` parameters must be enabled for AD events and authentication
- events to be imported into the Access Information Center
- - The list of attributes to track for Object Modified changes can be customized by the
+ - You must enable the `@ADEvents` and `@AuthEvents` parameters to import AD events and
+ authentication events into the Access Information Center
+ - You can customize the list of attributes to track for Object Modified changes using the
`#modifiedAttributeList` parameter
- AIC Import - Activity Retention – Deletes older activity data from the Access Information Center
@@ -229,7 +226,7 @@ The following analysis tasks are selected by default:
### Customize Analysis Parameters for the AD_ActivityCollection Job
-The customizable parameters for this job allow you to configure importing of AD activity data into
+Use the customizable parameters for this job to configure how the job imports AD activity data into
the Netwrix Access Information Center.
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_ldapqueries.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_ldapqueries.md
index 40792972f0..af765ff756 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_ldapqueries.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_ldapqueries.md
@@ -7,8 +7,8 @@ sidebar_position: 50
# LDAP > AD_LDAPQueries Job
The **LDAP** > **AD_LDAPQueries** Job analyzes LDAP traffic to determine trends such as most
-expensive queries, most active servers and users, successful/failed and signing status. This data
-can be used to troubleshoot performance issues, load balancing, and poorly configured services.
+expensive queries, most active servers and users, successful/failed and signing status. Use this
+data to troubleshoot performance issues, load balancing, and poorly configured services.
@@ -23,7 +23,7 @@ Navigate to the **Active Directory** > **6.Activity** > **LDAP** > **AD_LDAPQuer
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Except for the **Largest Queries** task, do not modify or deselect the remaining
+Except for the **Largest Queries** task, don't modify or deselect the remaining
selected analysis tasks. The remaining analysis tasks are preconfigured for this job.
:::
@@ -38,7 +38,7 @@ The following non-configurable analysis tasks are selected by default:
- User Summary – Creates the SA_AD_LDAPQueries_UserSummary table accessible under the job’s Results
node
-The following configurable analysis task can be optionally enabled:
+You can enable the following configurable analysis task:
- Largest Queries – Creates the SA_AD_LDAPQueries_ExpensiveQueries table accessible under the job’s
Results node
@@ -54,10 +54,9 @@ pre-configured reports:
### Configure the Largest Queries Analysis Task
-Customizable parameters enable you to set the values used to control the minimum objects returned
-and the days of traffic to analyze during this job’s analysis. The parameters can be customized and
-are listed in a section at the bottom of the SQL Script Editor. Follow the steps to customize an
-analysis task’s parameters.
+Use customizable parameters to set the values used to control the minimum objects returned
+and the days of traffic to analyze during this job’s analysis. You can customize the parameters;
+they're listed in a section at the bottom of the SQL Script Editor.
**Step 1 –** Navigate to the **Active Directory** > **6.Activity** > **LDAP** > **AD_LDAPQueries** >
**Configure** node and select **Analysis**.
@@ -68,14 +67,14 @@ analysis task’s parameters.
**Analysis Configuration**. The SQL Script Editor opens.
:::warning
-Do not change any parameters where the Value states `Created during execution`.
+Don't change any parameters where the Value states `Created during execution`.
:::
**Step 3 –** In the parameters section at the bottom of the editor, find the Value column. There are
-two integer variables that can be modified. Double-click on the current **value** and change as
+two integer variables you can modify. Double-click the current **value** and change as
desired:
- @objects_returned – Controls the minimum number of objects returned for the queries to be
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_lockouts.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_lockouts.md
index 7c70020cb6..3948f46b80 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_lockouts.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_lockouts.md
@@ -7,7 +7,7 @@ sidebar_position: 60
# Lockouts > AD_Lockouts Job
The **Lockouts** > **AD_Lockouts** Job provides a listing of all account lockouts. For any lockout
-occurring in the past 30 days, failed authentications and host information is provided to aid
+occurring in the past 30 days, it also provides failed authentications and host information to aid
troubleshooting.
@@ -23,7 +23,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Lockouts** > **AD_Lock
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -42,4 +42,4 @@ pre-configured reports:
| Report | Description | Default Tags | Report Elements |
| -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Lockouts | This report tracks all lockouts for user accounts. For any lockout occurring in the past 30 days, failed authentications and host information are provided to aid troubleshooting. | CCPA GDPR SOX HIPPA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of two elements: - Table – Displays account lockouts details
- Table – Displays failed authentications in the past 30 days
|
+| Lockouts | This report tracks all lockouts for user accounts. For any lockout occurring in the past 30 days, it also lists failed authentications and host information to aid troubleshooting. | CCPA GDPR SOX HIPPA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of two elements: - Table – Displays account lockouts details
- Table – Displays failed authentications in the past 30 days
|
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/ad_computermodifications.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/ad_computermodifications.md
index 742de2d4cf..3f2b42b6a5 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/ad_computermodifications.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/ad_computermodifications.md
@@ -14,7 +14,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Changes** > **AD_Compu
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/ad_groupmodifications.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/ad_groupmodifications.md
index 8d5e1c2864..20945a87ea 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/ad_groupmodifications.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/ad_groupmodifications.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# AD_GroupModifications Job
-The AD_GroupModifications Job provides a report of all changes to group objects. A separate report
-is provided to highlight group membership changes. The list of top perpetrators can be used to
-identify out of band changes.
+The AD_GroupModifications Job provides a report of all changes to group objects, and a separate
+report to highlight group membership changes. Use the list of top perpetrators to identify
+out of band changes.
## Analysis Tasks for the AD_GroupModifications Job
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **Changes** >
**AD_GroupModifications** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/ad_usermodifications.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/ad_usermodifications.md
index 6d9d04f211..8632665f30 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/ad_usermodifications.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/ad_usermodifications.md
@@ -14,7 +14,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **Changes** >
**AD_UserModifications** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/overview.md
index 128f6eaa2f..398724398d 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Changes Job Group
-The Changes Job Group provides an audit trail for changes made to Computer, Group and User objects
+The Changes Job Group provides an audit trail for changes made to Computer, Group, and User objects
within the environment.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/groupusage/ad_accesschanges.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/groupusage/ad_accesschanges.md
index 2aa638f403..4ec081892d 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/groupusage/ad_accesschanges.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/groupusage/ad_accesschanges.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **Group Usage
**AD_AccessChanges** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/groupusage/ad_grouphosts.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/groupusage/ad_grouphosts.md
index 61d83689b8..1487813e1a 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/groupusage/ad_grouphosts.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/groupusage/ad_grouphosts.md
@@ -14,7 +14,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **GroupUsage*
**AD_GroupHosts** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -35,4 +35,4 @@ following pre-configured reports:
| Report | Description | Default Tags | Report Elements |
| ---------------- | ------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Group Host Usage | Understand what groups are utilizing what hosts in the environment. | CCPA GDPR SOX HIPPA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of three elements: - Table – Displays security groups by target hosts
- Table – Displays hosts by associated groups
- Table – Displays authentication details
|
+| Group Host Usage | Understand what groups are using what hosts in the environment. | CCPA GDPR SOX HIPPA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of three elements: - Table – Displays security groups by target hosts
- Table – Displays hosts by associated groups
- Table – Displays authentication details
|
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/groupusage/ad_groupmemberactivity.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/groupusage/ad_groupmemberactivity.md
index 35c0b9ae78..be3415fcd5 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/groupusage/ad_groupmemberactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/groupusage/ad_groupmemberactivity.md
@@ -32,9 +32,9 @@ follow pre-configured report:
### Configure the Group Member Activity Analysis Task
-Customizable parameters enable you to set the values used to include the SIDs for admin groups
+Use customizable parameters to set the values used to include the SIDs for admin groups
during this job’s analysis. The parameters can be customized and are listed in a section at the
-bottom of the SQL Script Editor. Follow the steps to customize an analysis task’s parameters.
+bottom of the SQL Script Editor.
**Step 1 –** Navigate to the **Active Directory** > **6.Activity** > **Group Usage** >
**AD_GroupMemberActivity** > **Configure** node and select **Analysis**.
@@ -42,10 +42,10 @@ bottom of the SQL Script Editor. Follow the steps to customize an analysis task
**Step 2 –** In the Analysis Selection view, select the Group Member Activity analysis task and
-click on **Analysis Configuration**. The SQL Script Editor opens.
+click **Analysis Configuration**. The SQL Script Editor opens.
:::warning
-Do not change any parameters where the Value states `Created during execution`.
+Don't change any parameters where the Value states `Created during execution`.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_authenticationprotocol.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_authenticationprotocol.md
index 89590158e7..c367db4904 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_authenticationprotocol.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_authenticationprotocol.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Operations** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_domaincontrollertraffic.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_domaincontrollertraffic.md
index 4b5d53057b..bfc5e61a85 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_domaincontrollertraffic.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_domaincontrollertraffic.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# AD_DomainControllerTraffic Job
The AD_DomainControllerTraffic Job provides a summary of the amount of traffic for Changes,
-Authentication, Replication, and LDAP Queries for each domain controller which can be used to
+Authentication, Replication, and LDAP Queries for each domain controller. Use this information to
identify issues with load balancing. If the AD_DCSummary job has been run, the roles for each domain
controller will be provided.
@@ -18,7 +18,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Operations** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_hardcodeddcs.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_hardcodeddcs.md
index d0e5808b23..1cc5921c92 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_hardcodeddcs.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_hardcodeddcs.md
@@ -14,7 +14,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Operations** > **AD_Ha
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_loadbalancing.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_loadbalancing.md
index 69f4347964..e113298039 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_loadbalancing.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_loadbalancing.md
@@ -7,8 +7,8 @@ sidebar_position: 40
# AD_LoadBalancing Job
The AD_LoadBalancing Job analyzes each domain controller's traffic to show what percent of all LDAP,
-Replication, Authentication and Changes are being handled by that particular machine. This helps to
-highlight domain controllers which are over utilized relative to others within the domain, or unused
+Replication, Authentication, and Changes are being handled by that particular machine. This helps to
+highlight domain controllers which are over used relative to others within the domain, or unused
domain controllers which may be decommissioned.
## Analysis Task for the AD_LoadBalancing Job
@@ -17,7 +17,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Operations** > **AD_Lo
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_machineowners.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_machineowners.md
index 1efa29f971..2782adcabf 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_machineowners.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_machineowners.md
@@ -14,7 +14,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Operations** > **AD_Ma
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/overview.md
index 1c8be7b00a..b1987b917c 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/overview.md
@@ -24,14 +24,14 @@ Schedule these jobs to run with the 0.Collection job group.
identify what services and computers may be affected when disabling NTLM
- [AD_DomainControllerTraffic Job](/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_domaincontrollertraffic.md)
– Provides a summary of the amount of traffic for Changes, Authentication, Replication, and LDAP
- Queries for each domain controller which can be used to identify issues with load balancing. If
+ Queries for each domain controller. Use this summary to identify issues with load balancing. If
the AD_DCSummary job has been run, the roles for each DC will be provided.
- [AD_HardcodedDCs Job](/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_hardcodeddcs.md)
– Highlight machines that have communicated with only one DC
- [AD_LoadBalancing Job](/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_loadbalancing.md)
– Analyzes each domain controller's traffic to show what percent of all LDAP, Replication,
Authentication and Changes are being handled by that particular machine. This helps to highlight
- domain controllers which are over utilized relative to others within the domain, or unused domain
+ domain controllers which are over used relative to others within the domain, or unused domain
controllers which may be decommissioned.
- [AD_MachineOwners Job](/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/ad_machineowners.md)
– Helps to identify the owner of a particular host
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/overview.md
index f0ed2e14fc..ede2f08060 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/overview.md
@@ -27,7 +27,7 @@ The 6.Activity Job Group is comprised of the following jobs:
– Imports data from the Netwrix Activity Monitor logs into the Enterprise Auditor Database.
Retention can be modified in the query (120 days default).
- [Changes Job Group](/docs/accessanalyzer/11.6/solutions/activedirectory/activity/changes/overview.md)
- – Provides an audit trail for changes made to Computer, Group and User objects within the
+ – Provides an audit trail for changes made to Computer, Group, and User objects within the
environment
- [Group Usage Job Group](/docs/accessanalyzer/11.6/solutions/activedirectory/activity/groupusage/overview.md)
– Shows how group membership changes have affected access across the entire environment, the
@@ -35,10 +35,10 @@ The 6.Activity Job Group is comprised of the following jobs:
in applications
- [LDAP > AD_LDAPQueries Job](/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_ldapqueries.md)
– Analyzes LDAP traffic to determine trends such as most expensive queries, most active servers
- and users, successful/failed and signing status. This data can be used to troubleshoot performance
+ and users, successful/failed and signing status. Use this data to troubleshoot performance
issues, load balancing, and poorly configured services.
- [Lockouts > AD_Lockouts Job](/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_lockouts.md)–
- Provides a listing of all account lockouts with relevant details which can be used to aid
+ Provides a listing of all account lockouts with relevant details to aid
troubleshooting
- [Operations Job Group](/docs/accessanalyzer/11.6/solutions/activedirectory/activity/operations/overview.md)
– Reports on Active Directory activity events related to operational activity. This group can help
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/privilegedaccounts/ad_adminaccounts.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/privilegedaccounts/ad_adminaccounts.md
index 828f547779..a30725e2ff 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/privilegedaccounts/ad_adminaccounts.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/privilegedaccounts/ad_adminaccounts.md
@@ -14,7 +14,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **Privileged
**AD_AdminAccounts** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -41,9 +41,9 @@ follow pre-configured reports:
### Configure the Summarize Administrative Account Activity Analysis Task
-Customizable parameters enable you to set the values used to include the NT Account name for admin
-groups during this job’s analysis. The parameters can be customized and are listed in a section at
-the bottom of the SQL Script Editor. Follow the steps to customize an analysis task’s parameters.
+With the customizable parameters, you can set the values used to include the NT Account name for admin
+groups during this job’s analysis. The parameters are listed in a section at
+the bottom of the SQL Script Editor. Complete the following steps to customize an analysis task’s parameters.
**Step 1 –** Navigate to the **Active Directory** > **6.Activity** > **Privileged Accounts** >
**AD_AdminAccounts** > **Configure** node and select **Analysis**.
@@ -54,7 +54,7 @@ the bottom of the SQL Script Editor. Follow the steps to customize an analysis t
Activity** analysis task and click **Analysis Configuration**. The SQL Script Editor opens.
:::warning
-Do not change any parameters where the Value states `Created during execution`.
+Don't change any parameters where the Value states `Created during execution`.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/privilegedaccounts/ad_serviceaccountauth.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/privilegedaccounts/ad_serviceaccountauth.md
index 1ec147ee6f..1567a9d1bb 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/privilegedaccounts/ad_serviceaccountauth.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/privilegedaccounts/ad_serviceaccountauth.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **Operations*
**AD_ServiceAccountAuth** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/recommended.md b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/recommended.md
index d5f02c1d54..a53bcd163c 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/activity/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/activity/recommended.md
@@ -7,19 +7,19 @@ sidebar_position: 10
# Recommended Configurations for the 6.Activity Job Group
The **Active Directory** > **6.Activity** Job Group has been configured by default to run with the
-out-of-the-box settings. It can be run directly or scheduled.
+default settings. It can be run directly or scheduled.
**Dependencies**
- Successfully execute the **.Active Directory Inventory** Job Group
- Netwrix Activity Monitor 4.1+ is archiving AD Activity Logs
-- Successfully execute the **Active Directory** > **5.Domains Job Group** prior to running the
+- Successfully execute the **Active Directory** > **5.Domains Job Group** before running the
Operations Job Group
- (Optional) Successfully execute the **Active Directory Permissions Analyzer** > **0.Collection**
Job Group
- (Optional) Successfully execute the **FileSystem** > **0.Collection** Job Group
-**Targeted Host(s)**
+**Targeted Hosts**
Netwrix Activity Monitor API Server or the host with the network share housing archived log files.
@@ -27,7 +27,7 @@ Netwrix Activity Monitor API Server or the host with the network share housing a
Connection Profiles must be set directly on the
[0.Collection > AD_ActivityCollection Job](/docs/accessanalyzer/11.6/solutions/activedirectory/activity/ad_activitycollection.md)
-in order to connect to either the SAM API Server or the host with the network share housing the
+to connect to either the SAM API Server or the host with the network share housing the
archived log files.
**Access Token**
@@ -40,18 +40,18 @@ Required for SAM API Server integration for the
This group can be scheduled to run as desired.
:::info
-Run from the 6.Activity Job Group level in order to correlate 0.Collection job
+Run from the 6.Activity Job Group level to correlate 0.Collection job
group data with other jobs.
:::
**History Retention**
-History is not supported. Turning on history will cause issues with data analysis and reporting.
+History isn't supported. Turning on history will cause issues with data analysis and reporting.
**Multi-Console Support**
-Multiple Enterprise Auditor Consoles are not supported. This group should be run from a single
+Multiple Enterprise Auditor Consoles aren't supported. This group should be run from a single
Enterprise Auditor Console.
**Workflow**
@@ -70,7 +70,7 @@ Monitor API Server or the host with the network share housing the archived log f
**Step 6 –** Run the jobs as desired.
-**Step 7 –** Run from the **6.Activity** Job Group level in order to correlate 0.Collection job
+**Step 7 –** Run from the **6.Activity** Job Group level to correlate 0.Collection job
group data with other jobs.
**Step 8 –** Review the reports generated by the jobs.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/ad_securityassessment.md b/docs/accessanalyzer/11.6/solutions/activedirectory/ad_securityassessment.md
index c26f6f04b8..7a843dbb0f 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/ad_securityassessment.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/ad_securityassessment.md
@@ -9,7 +9,7 @@ sidebar_position: 80
The AD_SecurityAssessment Job performs checks against Active Directory security best practices in
order to proactively identify critical security configurations that leave Active Directory
vulnerable to attack. The result are reports that provide a listing of findings by severity and
-category with corresponding details that can be used to prioritize and remediate security issues.
+category with corresponding details. Use these details to prioritize and remediate security issues.
@@ -51,14 +51,14 @@ One or more of the following job groups or jobs must be run to produce results:
- Windows > Privileged Accounts > Service Accounts > SG_ServiceAccounts
:::note
-If any of the above jobs are not completed, the AD_SecurityAssessment job will run but all
+If any of the preceding jobs aren't completed, the AD_SecurityAssessment job will run but all
checks will not be assessed.
:::
**Target Host**
-This job group does not collect data. No target host is required.
+This job group doesn't collect data. No target host is required.
**Connection Profile**
@@ -70,11 +70,11 @@ Scheduled to run as desired
**History Retention**
-History is not supported. Turning on history will cause issues with data analysis and reporting.
+History isn't supported. Turning on history will cause issues with data analysis and reporting.
**Multi-console Support**
-Multiple StealthAUDIT consoles are not supported. This job should be run from a single StealthAUDIT
+Multiple StealthAUDIT consoles aren't supported. This job should be run from a single StealthAUDIT
console.
## Analysis Task for the AD_SecurityAssessment Job
@@ -83,7 +83,7 @@ Navigate to the **Jobs** > Active Directory > AD_SecurityAssessment > Configure
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/ad_cleanupprogress.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/ad_cleanupprogress.md
index 516df64a9d..83938d4438 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/ad_cleanupprogress.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/ad_cleanupprogress.md
@@ -9,7 +9,7 @@ sidebar_position: 50
The AD_CleanupProgress Job performs checks against Active Directory security best practices in order
to proactively identify critical security configurations that leave Active Directory vulnerable to
attack. The result is a report which provides a listing of findings by severity and category with
-corresponding details that can be used to prioritize and remediate security issues.
+corresponding details. Use these details to prioritize and remediate security issues.
@@ -17,8 +17,8 @@ corresponding details that can be used to prioritize and remediate security issu
**Step 1 –** Ensure the following prerequisites are met:
-- The .Active Directory Inventory Job Group needs to be successfully run prior to running this job
-- The following jobs from the Active Directory Solution must be run prior to running this job:
+- The .Active Directory Inventory Job Group needs to be successfully run before running this job
+- The following jobs from the Active Directory Solution must be run before running this job:
- **Active Directory** > **1.Groups** > **AD_DuplicateGroups**
- **Active Directory** > **2.Users** > **AD_DirectMembership**
@@ -35,7 +35,7 @@ Navigate to the **Active Directory** > **Cleanup** > **AD_CleanupProgress** > **
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers.md
index 22251880b9..7ae2476336 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers.md
@@ -19,7 +19,7 @@ staging OU. The default is 365 days.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -52,7 +52,7 @@ The default analysis tasks are:
### Customizable Analysis Parameters for the AD_DeprovisionComputers Job
-Customizable parameters enable you to set the values used to classify user and group objects during
+With the customizable parameters, you can set the values used to classify user and group objects during
this job’s analysis.
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
@@ -69,7 +69,7 @@ Navigate to the **Active Directory** > **Cleanup** > **3.Computers** > **AD_Depr
**Configure** node and select **Actions** to view the actions.
:::warning
-Do not enable the actions unless it is required. Disable the actions after execution to
+Don't enable the actions unless it is required. Disable the actions after execution to
prevent making unintended and potentially harmful changes to Active Directory.
:::
@@ -85,7 +85,7 @@ The action tasks must be executed together and in order.
- Move Computers – Move computers to staging OU for deletion
- - The target staging OU must be set in the Move Computers Action Task prior to executing the
+ - The target staging OU must be set in the Move Computers Action Task before executing the
action tasks. See the
[Configure the Target OU](/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/configuretargetou.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers_status.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers_status.md
index f0577c0c78..00b51f10f3 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers_status.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers_status.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **Cleanup** > **3.Computers** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/computers/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/computers/overview.md
index c62debf1a9..df55ad2b2a 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/computers/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/computers/overview.md
@@ -24,10 +24,10 @@ The jobs in the 3.Computers Job Group are:
- The .Active Directory Inventory Job Group needs to be successfully run
- For the AD_DeprovisionComputers Job, the target OU needs to be manually set in the Move Computers
- Action Task prior to executing the actions. See the
+ Action Task before executing the actions. See the
[Action Tasks for the AD_DeprovisionComputers Job](/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers.md#action-tasks-for-the-ad_deprovisioncomputers-job)
topic for additional information.
-- The AD_DeprovisionComputers Job needs to be run prior to running the
+- The AD_DeprovisionComputers Job needs to be run before running the
AD_DeprovisionComputers_Status Job
**Step 2 –** Schedule the 3.Computers Job Group to run as desired after the prerequisites have been
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/configuretargetou.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/configuretargetou.md
index a12d8a71f9..14055b233d 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/configuretargetou.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/configuretargetou.md
@@ -6,13 +6,13 @@ sidebar_position: 60
# Configure the Target OU
-Follow the steps to configure the target staging OU.
+Complete the following steps to configure the target staging OU.
**Step 1 –** Navigate to the **[Job]** > **Configure** > **Actions** node.
-**Step 2 –** On the Action Selection page, select the desired action task and click **Action
+**Step 2 –** On the Action Selection page, select the action task you want and click **Action
Properties**.
**Step 3 –** In the Action Properties window, select **Configure Action**. The Active Directory
@@ -21,8 +21,8 @@ Action Module Wizard opens.
**Step 4 –** Navigate to the Move Objects page of the Active Directory Action Module Wizard. In the
-OU field, enter or browse to the desired target OU. To create the target OU location, select the
-**Create target OU location if it does not already exist** checkbox.
+OU field, enter or browse to the target OU. To create the target OU location, select the
+**Create target OU location if it doesn't already exist** checkbox.
**Step 5 –** Navigate to the Summary page and click **Finish**.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups.md
index 5c42d0c038..dda17ce4ea 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups.md
@@ -22,7 +22,7 @@ staging OU. The default is 365 days.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -54,7 +54,7 @@ The default analysis tasks are:
### Customizable Analysis Parameters for the AD_DeprovisionGroups Job
-Customizable parameters enable you to set the values used to classify user and group objects during
+With the customizable parameters, you can set the values used to classify user and group objects during
this job’s analysis.
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
@@ -71,7 +71,7 @@ Navigate to the **Active Directory** > **Cleanup** > **1.Groups** > **1. Deprovi
**AD_DeprovisonGroups** > **Configure** node and select **Actions** to view the action tasks.
:::warning
-Do not enable the actions unless it is required. Disable the actions after execution to
+Don't enable the actions unless it is required. Disable the actions after execution to
prevent making unintended and potentially harmful changes to Active Directory.
:::
@@ -87,7 +87,7 @@ The action tasks must be executed together and in order.
- Move Groups – Move groups to staging OU
- - The target staging OU must be set in the Move Groups Action Task prior to executing the action
+ - The target staging OU must be set in the Move Groups Action Task before executing the action
tasks. See the
[Configure the Target OU](/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/configuretargetou.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups_status.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups_status.md
index 9613603754..6ed94e556d 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups_status.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups_status.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **Cleanup** > **1.Groups** > **1. Deprovi
tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis tasks is
+Don't modify or deselect the selected analysis task. The analysis tasks is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/overview.md
index f39083e8ad..380d3f484b 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/overview.md
@@ -39,10 +39,10 @@ The jobs in the 1.Groups Job Group are:
- The .Active Directory Inventory Job Group needs to be successfully run
- For the AD_DeprovisionGroups Job, the target OU needs to be manually set in the Move Groups Action
- Task prior to executing the actions. See the
+ Task before executing the actions. See the
[Action Tasks for the AD_DepvisionGroups Job](/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups.md#action-tasks-for-the-ad_depvisiongroups-job)
topic for additional information.
-- The AD_DeprovisionGroups Job needs to be run prior to running the AD_DeprovisionGroups_Status Job
+- The AD_DeprovisionGroups Job needs to be run before running the AD_DeprovisionGroups_Status Job
**Step 2 –** Schedule the 1.Groups Job Group to run as desired after the prerequisites have been
satisfied.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/stamping/ad_groupcleanup_permissions.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/stamping/ad_groupcleanup_permissions.md
index eb71ac9160..5138ee2696 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/stamping/ad_groupcleanup_permissions.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/stamping/ad_groupcleanup_permissions.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# AD_GroupCleanup_Permissions Job
The AD_GroupCleanup_Permissions Job reports on where security groups are being used to assign
-permissions. This can be used to prioritize remediation for groups that are rarely used.
+permissions. Use these results to prioritize remediation for groups that are rarely used.
## Analysis Tasks for the AD_GroupCleanup_Permissions Job
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **Cleanup** > **1.Groups** > **2. Group S
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/stamping/ad_groupstamping.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/stamping/ad_groupstamping.md
index 0ed8a51880..4bbc60be9d 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/stamping/ad_groupstamping.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/groups/stamping/ad_groupstamping.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **Cleanup** > **1.Groups** > **2. Group S
AD_GroupStamping** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/recommended.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/recommended.md
index 4ae21882f5..9238cbd6b6 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/recommended.md
@@ -14,7 +14,7 @@ The Cleanup job group has the following prerequisites:
- The Active Directory Actions license feature is required
- The Active Directory Actions Module must be installed
-- The .Active Directory Inventory Job Group needs to be successfully run prior to running this job
+- The .Active Directory Inventory Job Group needs to be successfully run before running this job
group
- The following job groups from the Activity Directory job group need to be successfully run prior
to running this job group:
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/users/ad_deprovisionusers.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/users/ad_deprovisionusers.md
index 7013cad81d..8cde9f2fac 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/users/ad_deprovisionusers.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/users/ad_deprovisionusers.md
@@ -11,11 +11,11 @@ accounts.
**Step 1 –** Move stale users to a staging OU for deletion.
-**Step 2 –** The assigned manager is alerted by email of the impending deletion.
+**Step 2 –** Notify the assigned manager by email of the impending deletion.
-**Step 3 –** User accounts are disabled.
+**Step 3 –** Disable the user accounts.
-**Step 4 –** Users are flagged as **To Be Deleted**.
+**Step 4 –** Flag users as **To Be Deleted**.
**Step 5 –** Delete users from the staging OU.
@@ -23,7 +23,7 @@ accounts.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -57,7 +57,7 @@ The default analysis tasks are:
### Customizable Analysis Parameters for the AD_DeprovisionUsers Job
-Customizable parameters enable you to set the values used to classify user and group objects during
+With the customizable parameters, you can set the values used to classify user and group objects during
this job’s analysis.
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
@@ -74,7 +74,7 @@ Navigate to the **Active Directory** > **Cleanup** > **2.Users** > **AD_Deprovis
**Configure** node and select **Actions** to view the actions.
:::warning
-Do not enable the actions unless it is required. Disable the actions after execution to
+Don't enable the actions unless it is required. Disable the actions after execution to
prevent making unintended and potentially harmful changes to Active Directory.
:::
@@ -90,7 +90,7 @@ The action tasks must be executed together and in order.
- Move Users – Move users to staging OU for deletion
- - The target OU must be set in the Move Users Action Task prior to executing the action tasks.
+ - The target OU must be set in the Move Users Action Task before executing the action tasks.
See the
[Configure the Target OU](/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/configuretargetou.md)
topic for additional information.
@@ -101,6 +101,6 @@ The action tasks must be executed together and in order.
- Delete Users – Delete users from staging OU
- Remove Membership – Remove stale users from all groups
-After the `@days_before_deleting` analysis parameter has been configured and the target OU has been
-set in the Move Users Action Task, select the checkboxes next to all of the action tasks and click
+After you configure the `@days_before_deleting` analysis parameter and set the target OU in the Move
+Users Action Task, select the checkboxes next to all of the action tasks and click
**Execute Action** to execute the action tasks.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/users/ad_deprovisionusers_status.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/users/ad_deprovisionusers_status.md
index 702ebf0972..eb86ccec95 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/users/ad_deprovisionusers_status.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/users/ad_deprovisionusers_status.md
@@ -14,7 +14,7 @@ Navigate to the **Active Directory** > **Cleanup** > **2.Users** > **AD_Deprovis
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/users/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/users/overview.md
index 914dfd7d34..87291e028e 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/users/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/users/overview.md
@@ -23,10 +23,10 @@ The jobs in the 2.Users Job Group are:
- The .Active Directory Inventory Job Group needs to be successfully run
- For the AD_DeprovisionUsers Job, the target OU needs to be manually set in the Move Users Action
- Task prior to executing the actions. See the
+ Task before executing the actions. See the
[Action Tasks for the AD_DeprovisionUsers Job](/docs/accessanalyzer/11.6/solutions/activedirectory/cleanup/users/ad_deprovisionusers.md#action-tasks-for-the-ad_deprovisionusers-job)
topic for additional information.
-- The AD_DeprovisionUsers Job needs to be run prior to running the AD_DeprovisionUsers_Status Job
+- The AD_DeprovisionUsers Job needs to be run before running the AD_DeprovisionUsers_Status Job
**Step 2 –** Schedule the 2.Users Job Group to run as desired after the prerequisites have been
satisfied.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/computers/ad_computerdelegation.md b/docs/accessanalyzer/11.6/solutions/activedirectory/computers/ad_computerdelegation.md
index 1b6cec31ac..46b85c6de0 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/computers/ad_computerdelegation.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/computers/ad_computerdelegation.md
@@ -7,10 +7,10 @@ sidebar_position: 20
# AD_ComputerDelegation Job
The AD_ComputerDelegation Job provides details on computer accounts that have been enabled for
-unconstrained delegation. Once this configuration is enabled for a computer, any time an account
+unconstrained delegation. After this configuration is enabled for a computer, any time an account
connects to the computer for any reason, their ticket-granting ticket (TGT) is stored in memory so
it can be used later by the computer for impersonation, which exposes a significant security risk in
-cases where privileged accounts access the computer. See the
+cases where privileged accounts access the computer. See the
[What Is Kerberos Delegation?](https://blog.netwrix.com/2021/11/30/what-is-kerberos-delegation-an-overview-of-kerberos-delegation/) Netwrix
blog article for more information about this configuration and the related security risks.
@@ -20,7 +20,7 @@ Navigate to the **Active Directory** > **3.Computers** > **AD_ComputerDelegation
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the analysis task. The analysis task is preconfigured for
+Don't modify or deselect the analysis task. The analysis task is preconfigured for
this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/computers/ad_stalecomputers.md b/docs/accessanalyzer/11.6/solutions/activedirectory/computers/ad_stalecomputers.md
index c594efb1b0..96799cea4f 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/computers/ad_stalecomputers.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/computers/ad_stalecomputers.md
@@ -10,7 +10,7 @@ The AD_StaleComputers Job provides details on stale computers that may be candid
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -30,7 +30,7 @@ Navigate to the **Active Directory** > **3.Computers** > **AD_StaleComputers** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the **2. Summarize by Domain** analysis task. This analysis
+Don't modify or deselect the **2. Summarize by Domain** analysis task. This analysis
task is preconfigured for this job.
:::
@@ -64,7 +64,7 @@ Analysis parameters that can be customized have the following default values:
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
| --------------------------- | --------------------------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1. Identify Stale Computers | @days_since_last_logon | 90 | A computer object that has been inactive for 90 days or more |
-| 1. Identify Stale Computers | @consider_disable | 1 | A computer object that has been disabled: - Value 1 = Disabled computers are included as stale
- Value 0 = Disabled computers are not included as stale
|
+| 1. Identify Stale Computers | @consider_disable | 1 | A computer object that has been disabled: - Value 1 = Disabled computers are included as stale
- Value 0 = Disabled computers aren't included as stale
|
See the
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/computers/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectory/computers/overview.md
index 5e6a6164cc..48ba09cf56 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/computers/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/computers/overview.md
@@ -14,11 +14,11 @@ computer accounts, including stale computers and computers that have been truste
The following jobs comprise the 3.Computers Job Group:
- [AD_ComputerDelegation Job](/docs/accessanalyzer/11.6/solutions/activedirectory/computers/ad_computerdelegation.md)
- – Provides details on computer accounts that have been trusted for delegation. Once this
+ – Provides details on computer accounts that have been trusted for delegation. After this
configuration is enabled for a computer, any time an account connects to the computer for any
reason, their ticket-granting ticket (TGT) is stored in memory so it can be used later by the
computer for impersonation, which exposes a significant security risk in cases where privileged
- accounts access the computer. See the
+ accounts access the computer. See the
[What Is Kerberos Delegation?](https://blog.netwrix.com/2021/11/30/what-is-kerberos-delegation-an-overview-of-kerberos-delegation/) Netwrix
blog article for more information about this configuration and the related security risks.
- [AD_StaleComputers Job](/docs/accessanalyzer/11.6/solutions/activedirectory/computers/ad_stalecomputers.md)
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/computers/recommended.md b/docs/accessanalyzer/11.6/solutions/activedirectory/computers/recommended.md
index 521cf0da01..8987a72571 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/computers/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/computers/recommended.md
@@ -11,22 +11,22 @@ default settings. It can be run directly or scheduled.
**Dependencies**
-The **.Active Directory Inventory** Job Group needs to be successfully executed prior to running
+The **.Active Directory Inventory** Job Group needs to be successfully executed before running
this job group.
**Target Host**
-This job group does not collect data. No target host is required.
+This job group doesn't collect data. No target host is required.
**Connection Profile**
-This job group does not collect data. No specific Connection Profile is required.
+This job group doesn't collect data. No specific Connection Profile is required.
**Schedule Frequency**
-The data analyzed by the 3.Computers Job Group jobs is collected by the .Active Directory Inventory
-Job Group. Therefore, it is recommended to schedule these jobs to run after the .Active Directory
-Inventory job group collection has completed. These jobs can be scheduled to run as desired.
+The .Active Directory Inventory Job Group collects the data that the 3.Computers Job Group jobs
+analyze. Schedule the 3.Computers Job Group jobs to run after the .Active Directory Inventory job
+group collection completes. You can schedule these jobs to run as desired.
**Run at the Job Group Level**
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_dcsummary.md b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_dcsummary.md
index 7572950163..3d7330e5b0 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_dcsummary.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_dcsummary.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory > 5.Domains > AD_DCSummary > Configure** node
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_domaininfo.md b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_domaininfo.md
index eb7242a3bc..ff9ea4d9b6 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_domaininfo.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_domaininfo.md
@@ -16,7 +16,7 @@ The AD_DomainInfo Job uses the ActiveDirectory Data Collector and the LDAP Data
following queries:
:::warning
-Do not modify the queries. The queries are preconfigured for this job.
+Don't modify the queries. The queries are preconfigured for this job.
:::
@@ -42,7 +42,7 @@ Navigate to the **Active Directory > 5.Domains > AD_DomainInfo > Configure** nod
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_dsrmsettings.md b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_dsrmsettings.md
index 81772ef3bc..49bfd078eb 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_dsrmsettings.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_dsrmsettings.md
@@ -6,10 +6,11 @@ sidebar_position: 50
# AD_DSRMSettings Job
-The AD_DRSMSettings Job provides details on domain controller registry settings for the
-DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the DSRM Admin Account can be used to log
-in to the domain controller even if it has not been started in DSRM which can present a potential
-security vulnerability. Additional information on this registry key is available in this
+The AD_DSRMSettings Job provides details on domain controller registry settings for the
+DSRMAdminLogonBehavior key. If this key is set to 1 or 2, you can use the Directory Services Restore
+Mode (DSRM) Admin Account to log in to the domain controller even if it has not been started in
+DSRM, which can present a potential security vulnerability. Additional information on this
+registry key is available in this
[Microsoft Document](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732714(v=ws.10)?redirectedfrom=MSDN).
## Analysis Tasks for the AD_DSRMSettings Job
@@ -18,7 +19,7 @@ Navigate to the **Active Directory > 5.Domains > AD_DSRMSettings > Configure** n
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -37,4 +38,4 @@ the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| DSRM Admin Security | This report highlights domain controller registry settings for the DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the DSRM Admin account can be used to log in to the domain controller even if it has not been started in DSRM. This is a potential vulnerability. See the Microsoft [Restartable AD DS Step-by-Step Guide](https://technet.microsoft.com/en-us/library/cc732714(v=ws.10).aspx) for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays DSRM admin logon by domain controller
- Table – Provides details on domain controllers
|
+| DSRM Admin Security | This report highlights domain controller registry settings for the DSRMAdminLogonBehavior key. If this key is set to 1 or 2, you can use the DSRM Admin account to log in to the domain controller even if it has not been started in DSRM. This is a potential vulnerability. See the Microsoft [Restartable AD DS Step-by-Step Guide](https://technet.microsoft.com/en-us/library/cc732714(v=ws.10).aspx) for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays DSRM admin logon by domain controller
- Table – Provides details on domain controllers
|
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_domaincontrollers.md b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_domaincontrollers.md
index b2f7266516..7e8115a42c 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_domaincontrollers.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_domaincontrollers.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# AD_DomainControllers Job
The 0.Collection > AD_DomainControllers Job collects domain controller details which will be further
-analyzed in order to provide information on domains, sites, and trusts.
+analyzed to provide information on domains, sites, and trusts.
## Queries for the AD_DomainControllers Job
@@ -15,7 +15,7 @@ The AD_DomainControllers Job uses the LDAP Data Collector and the ActiveDirector
the following queries:
:::warning
-Except the first query, do not modify the remaining queries. The remaining queries are
+Except the first query, don't modify the remaining queries. The remaining queries are
preconfigured for this job.
:::
@@ -50,7 +50,7 @@ The Domain Controller Listing Query in the AD_DomainControllers Job is configure
Data Collector. This query can be optionally configured to connect securely with TLS/SSL.
:::warning
-Do not modify any other settings in this query.
+Don't modify any other settings in this query.
:::
@@ -72,6 +72,6 @@ opens.
**Ignore Certificate Errors** to connect even if certificate errors occur. Use **Server Port** 686
for a secure connection. Click **OK** to close the Options page.
-**Step 6 –** Step 13 – Then click **OK** to close the LDAP template form wizard.
+**Step 6 –** Click **OK** to close the LDAP template form wizard.
The job now connects securely with TLS/SSL.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_dsrm.md b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_dsrm.md
index 3c4316714f..cb3c8312d7 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_dsrm.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_dsrm.md
@@ -7,17 +7,18 @@ sidebar_position: 20
# AD_DSRM Job
The **0.Collection > AD_DSRM** Job collects data related to domain controller registry settings for
-the DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the DSRM Admin Account can be used to
-log in to the domain controller even if it has not been started in DSRM which can present a
-potential security vulnerability. Additional information on this registry key is available in this
+the DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the Directory Services Restore Mode
+(DSRM) Admin Account can log in to the domain controller even if it has not been started in DSRM,
+which can present a potential security vulnerability. Additional information on this registry key
+is available in this
[Microsoft Document](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732714(v=ws.10)?redirectedfrom=MSDN).
## Query for the AD_DSRM Job
-The AD_TimeSync Job uses the Registry Data Collector for the following query:
+The AD_DSRM Job uses the Registry Data Collector for the following query:
:::warning
-Do not modify this query. The query is preconfigured for this job.
+Don't modify this query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_timesync.md b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_timesync.md
index 5cf2a98f22..a5f90b0f80 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_timesync.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_timesync.md
@@ -14,7 +14,7 @@ domain controller within the domain.
The AD_TimeSync Job uses the Registry Data Collector for the following query:
:::warning
-Do not modify this query. The query is preconfigured for this job.
+Don't modify this query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/overview.md
index 343313ee71..fc5ffabe66 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/overview.md
@@ -14,13 +14,13 @@ to provide details on domains, sites, and trusts.
The 0.Collection Job Group is comprised of:
- [AD_DomainControllers Job](/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_domaincontrollers.md)
- – Collects domain controller details which will be further analyzed in order to provide
+ – Collects domain controller details which will be further analyzed to provide
information on domains, sites, and trusts.
- [AD_DSRM Job](/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_dsrm.md)
– Collects data related to domain controller registry settings for the DSRMAdminLogonBehavior key.
- If this key is set to 1 or 2, the DSRM Admin Account can be used to log in to the domain
- controller even if it has not been started in DSRM which can present a potential security
- vulnerability. Additional information on this registry key is available in this
+ If this key is set to 1 or 2, the Directory Services Restore Mode (DSRM) Admin Account can log in
+ to the domain controller even if it has not been started in DSRM, which can present a potential
+ security vulnerability. Additional information on this registry key is available in this
[Microsoft Document](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732714(v=ws.10)?redirectedfrom=MSDN).
- [AD_TimeSync Job](/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/ad_timesync.md)
– Collects TimeSync information from the registry for each domain controller within the domain
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/overview.md
index 9dfc4caf04..70dbeff862 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/overview.md
@@ -14,7 +14,7 @@ configurations that may leave your environment at risk.
The following components comprises the 5.Domains Job Group:
- [0.Collection Job Group](/docs/accessanalyzer/11.6/solutions/activedirectory/domains/collection/overview.md)
- – Collects the data which will be further analyzed in order to provide details on domains, sites,
+ – Collects the data which will be further analyzed to provide details on domains, sites,
and trusts.
- [AD_DCSummary Job](/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_dcsummary.md)
– Provides operational reporting related to the details collected for each domain controller. For
@@ -26,7 +26,8 @@ The following components comprises the 5.Domains Job Group:
and types and directions of trusts
- [AD_DSRMSettings Job](/docs/accessanalyzer/11.6/solutions/activedirectory/domains/ad_dsrmsettings.md)
– Provides details on domain controller registry settings for the DSRMAdminLogonBehavior key. If
- this key is set to 1 or 2, the DSRM Admin Account can be used to log in to the domain controller
- even if it has not been started in DSRM which can present a potential security vulnerability.
+ this key is set to 1 or 2, the Directory Services Restore Mode (DSRM) Admin Account can log in to
+ the domain controller even if it has not been started in DSRM, which can present a potential
+ security vulnerability.
Additional information on this registry key is available in this
[Microsoft Document](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732714(v=ws.10)?redirectedfrom=MSDN).
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/recommended.md b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/recommended.md
index c4d52f12aa..b21b98eff9 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/domains/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/domains/recommended.md
@@ -11,7 +11,7 @@ default settings. It can be run directly or scheduled.
**Dependencies**
-This job group does not have dependencies.
+This job group doesn't have dependencies.
**Targeted Hosts**
@@ -50,7 +50,7 @@ entire job group, instead of the individual jobs.
**Query Configuration**
The 5.Domains > 0.Collection > AD_DomainControllers job should be run with the default query
-configurations. Most of these queries are preconfigured for this Job Group and should not be
+configurations. Most of these queries are preconfigured for this Job Group and shouldn't be
modified.
The following query can be modified to use a secure connection with TLS/SSL:
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_cpassword.md b/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_cpassword.md
index 87e7173e69..d953cc0aca 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_cpassword.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_cpassword.md
@@ -8,20 +8,20 @@ sidebar_position: 20
The AD_CPassword Job identifies passwords that are stored in Group Policy Preferences which present
a security risk allowing attackers access to these passwords. Microsoft published the AES private
-key, which can be used to decrypt passwords stored in Group Policy Preferences. See the Microsoft
+key, which attackers can use to decrypt passwords stored in Group Policy Preferences. See the Microsoft
[2.2.1.1.4 Password Encryption](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gppref/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be)
article for additional information. Since Authenticated Users have read access to SYSVOL, any
malicious insider or attacker can search for the cPassword file inside XML files shared through
SYSVOL to decrypt them. GPOs can be stored in the `%ProgramData%\Microsoft\Group Policy\History`
folder on each machine, meaning any results found by this job should be deleted off every computer
-once this policy has been removed.
+after this policy has been removed.
## Query for the AD_CPassword Job
The AD_CPassword Job uses the PowerShell Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job
+Don't modify the query. The query is preconfigured for this job
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_grouppolicy.md b/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_grouppolicy.md
index bf968755ff..d06b6d59ca 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_grouppolicy.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_grouppolicy.md
@@ -14,7 +14,7 @@ provides details on the containers they are linked to, and the settings that are
The AD_GroupPolicy Job uses the GroupPolicy Data Collector for the following query:
:::warning
-Do not modify the queries. The queries are preconfigured for this job.
+Don't modify the queries. The queries are preconfigured for this job.
:::
@@ -35,7 +35,7 @@ Navigate to the **Active Directory** > **4.GroupPolicy** > **AD_GroupPolicy** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_overlappinggpos.md b/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_overlappinggpos.md
index a4231ed91a..e668c4bad2 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_overlappinggpos.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_overlappinggpos.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **4. Group Policy** > **AD_OverlappingGPO
node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected first analysis task. The first analysis task is
+Don't modify or deselect the selected first analysis task. The first analysis task is
preconfigured for this job.
:::
@@ -30,7 +30,7 @@ The default analysis tasks are:
The following analysis tasks are deselected by default:
:::note
-Deselect the **Conflicting** analysis task before selecting the analysis tasks below.
+Deselect the **Conflicting** analysis task before selecting the following analysis tasks.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_passwordpolicies.md b/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_passwordpolicies.md
index 574ee6dcec..d9b0782813 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_passwordpolicies.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_passwordpolicies.md
@@ -15,7 +15,7 @@ different password policies within a single domain.
The AD_PasswordPolicies Job uses the LDAP Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -36,7 +36,7 @@ Navigate to the **Active Directory** > **4.GroupPolicy** > **AD_PasswordPolicies
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -48,7 +48,7 @@ The default analysis tasks are:
- Determine fine-grained password policy details – Creates the SA_AD_PasswordPolicies_Details table
accessible under the job’s Results node
-In addition to the tables and views created by the analysis task, the AD_UserDelegation Job produces
+In addition to the tables and views created by the analysis task, the AD_PasswordPolicies Job produces
the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/overview.md
index 7a57f1ccfe..832a4c66b0 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/overview.md
@@ -23,7 +23,7 @@ The following components comprise the 4.Group Policy Job Group:
malicious insider or attacker can search for the cPassword file inside XML files shared through
SYSVOL to decrypt them. GPOs can be stored in the `%ProgramData%\Microsoft\Group Policy\History`
folder on each machine, meaning any results found by this job should be deleted off every computer
- once this policy has been removed.
+ after this policy has been removed.
- [AD_GroupPolicy Job](/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/ad_grouppolicy.md)
– Audits all Group Policies that are present on the Domain Controller, and provides details on the
containers they are linked to and the settings that are configured
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/recommended.md b/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/recommended.md
index 4db5174f78..e1b535ee27 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/grouppolicy/recommended.md
@@ -11,7 +11,7 @@ settings. It can be run directly or scheduled.
**Dependencies**
-This job group does not have dependencies.
+This job group doesn't have dependencies.
**Targeted Hosts**
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_circularnesting.md b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_circularnesting.md
index aaceeef214..3627415c57 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_circularnesting.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_circularnesting.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_CircularNesting** > *
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_dclogongroups.md b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_dclogongroups.md
index c5fce3cba2..e1a61a5a4f 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_dclogongroups.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_dclogongroups.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# AD_DCLogonGroups Job
-The AD_DCLogonGroups Job identifies users who are able to log on to Domain Controllers through
+The AD_DCLogonGroups Job identifies users who can log on to Domain Controllers through
effective membership to the Enterprise Admins, Domain Admins, Administrators, Backup Operators,
Account Operators, Print Operators, or Remote Desktop Users groups. This type of access should be
limited to only those individuals who require this level of administrative privileges.
@@ -17,7 +17,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_DCLogonGroups** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_duplicategroups.md b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_duplicategroups.md
index be31dcd508..7bd8727f67 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_duplicategroups.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_duplicategroups.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_DuplicateGroups** > *
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_emptygroups.md b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_emptygroups.md
index d8938ebc0d..411c56a839 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_emptygroups.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_emptygroups.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_EmptyGroups** > **Con
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_groupprobableowners.md b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_groupprobableowners.md
index d51f220024..0438338636 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_groupprobableowners.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_groupprobableowners.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_GroupProbableOwners**
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_largestgroups.md b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_largestgroups.md
index fb5fce2a30..33db331cec 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_largestgroups.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_largestgroups.md
@@ -6,9 +6,8 @@ sidebar_position: 70
# AD_LargestGroups Job
-The AD_LargestGroups Job identifies groups with large effective member counts. These types of groups
-may cause administrative overhead and burden in being able to easily understand who is getting
-access to resources, or how much access is being granted to resources through these groups.
+The AD_LargestGroups Job identifies groups with large effective member counts. These groups can
+make it hard to determine who has access to resources or how much access these groups grant.
## Analysis Task for the AD_LargestGroups Job
@@ -16,7 +15,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_LargestGroups** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_mailsecuritygroups.md b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_mailsecuritygroups.md
index 8b219c0fdd..efde1b98d8 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_mailsecuritygroups.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_mailsecuritygroups.md
@@ -14,7 +14,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_MailSecurityGroups**
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_nestedgroups.md b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_nestedgroups.md
index df817e8379..735580dbe1 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_nestedgroups.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_nestedgroups.md
@@ -7,8 +7,8 @@ sidebar_position: 90
# AD_NestedGroups Job
The AD_NestedGroups Job identifies nested groups within Active Directory and provides details such
-as the levels of nesting. While Active Directory provides the ability to nest certain types of
-groups within other groups, Microsoft recommends nesting does not go beyond two levels in order to
+as the levels of nesting. While Active Directory lets you nest certain types of
+groups within other groups, Microsoft recommends nesting doesn't go beyond two levels to
avoid difficulties in understanding effective membership and access.
## Analysis Tasks for the AD_NestedGroups Job
@@ -17,7 +17,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_NestedGroups** > **Co
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_sensitivesecuritygroups.md b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_sensitivesecuritygroups.md
index 5edd9f1ce5..620ed2382b 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_sensitivesecuritygroups.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_sensitivesecuritygroups.md
@@ -17,7 +17,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_SensitiveSecurityGrou
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_stalegroups.md b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_stalegroups.md
index 3816f6e6bb..67e3e39ee2 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_stalegroups.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_stalegroups.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_StaleGroups** > **Con
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -37,4 +37,4 @@ the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Stale Effective Membership (A.K.A. Stale Groups) | This report identifies groups with stale effective membership. A stale user is defined as someone who has not logged into the domain in over 60 days, is expired, or currently disabled. | None | This report is comprised of three elements: - Bar Chart – Displays group membership
- Table – Provides details on membership
- Table – Provides details on group membership
|
+| Stale Effective Membership (A.K.A. Stale Groups) | This report identifies groups with stale effective membership. A stale user is defined as someone who has not logged into the domain in over 60 days, is expired, or disabled. | None | This report is comprised of three elements: - Bar Chart – Displays group membership
- Table – Provides details on membership
- Table – Provides details on group membership
|
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/overview.md
index 2770f2655f..9577b397dd 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/overview.md
@@ -17,7 +17,7 @@ The following jobs comprise the 1.Groups Job Group:
– Identifies circularly nested groups within Active Directory which can pose administrative and
operational challenges with identifying effective access to resources
- [AD_DCLogonGroups Job](/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_dclogongroups.md)
- – Identifies users who are able to log on to Domain Controllers through effective membership to
+ – Identifies users who can log on to Domain Controllers through effective membership to
the Enterprise Admins, Domain Admins, Administrators, Backup Operators, Account Operators, Print
Operators, or Remote Desktop Users groups. This type of access should be limited to only those
individuals who require this level of administrative privileges.
@@ -28,7 +28,7 @@ The following jobs comprise the 1.Groups Job Group:
– Identifies empty and single member groups which are suitable candidates for consolidation or
cleanup
- [AD_GroupProbableOwners Job](/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_groupprobableowners.md)
- – Determines potential owners for Active Directory Groups which can be used to perform automated
+ – Determines potential owners for Active Directory Groups, which you can use to perform automated
membership reviews and enable self-service group management and membership requests
- [AD_LargestGroups Job](/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_largestgroups.md)
– Identifies groups with large effective member counts. These types of groups may cause
@@ -44,8 +44,8 @@ The following jobs comprise the 1.Groups Job Group:
– Identifies mail-enabled security groups within Active Directory
- [AD_NestedGroups Job](/docs/accessanalyzer/11.6/solutions/activedirectory/groups/ad_nestedgroups.md)
– Identifies nested groups within Active Directory and provides details such as the levels of
- nesting. While Active Directory provides the ability to nest certain types of groups within other
- groups, Microsoft recommends nesting does not go beyond two levels in order to avoid difficulties
+ nesting. While Active Directory lets you nest certain types of groups within other
+ groups, Microsoft recommends nesting doesn't go beyond two levels to avoid difficulties
in understanding effective membership and access.
- The definition of a deeply nested group is set by the **.Active Directory Inventory** >
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/recommended.md b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/recommended.md
index 63a9a82ec0..5fe1445160 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/groups/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/groups/recommended.md
@@ -11,16 +11,16 @@ settings. It can be run directly or scheduled.
**Dependencies**
-The **.Active Directory Inventory** Job Group needs to be successfully executed prior to running
+The **.Active Directory Inventory** Job Group needs to be successfully executed before running
this job group.
**Target Host**
-This job group does not collect data. No target host is required.
+This job group doesn't collect data. No target host is required.
**Connection Profile**
-This job group does not collect data. No specific Connection Profile is required.
+This job group doesn't collect data. No specific Connection Profile is required.
**Schedule Frequency**
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_directmembership.md b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_directmembership.md
index bca6f50668..24e6c94754 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_directmembership.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_directmembership.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# AD_DirectMembership Job
-The AD_DirectMembership Job identifies users who do not have any group membership. This condition
+The AD_DirectMembership Job identifies users who don't have any group membership. This condition
may indicate unnecessary user accounts that are suitable candidates for review and cleanup.
## Analysis Tasks for the AD_DirectMembership Job
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_DirectMembership** > *
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_duplicateusers.md b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_duplicateusers.md
index 34069e96c9..205608974d 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_duplicateusers.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_duplicateusers.md
@@ -6,9 +6,9 @@ sidebar_position: 30
# AD_DuplicateUsers Job
-The AD_DuplicateUsers Job helps to identify multiple user accounts which may be owned by a single
-employee. A user may have accounts in multiple domains or administrative accounts with greater
-access than their normal account.
+The AD_DuplicateUsers Job identifies multiple user accounts that a single employee may own. A user
+may have accounts in multiple domains or administrative accounts with greater access than their
+normal account.
## Analysis Tasks for the AD_DuplicateUsers Job
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_DuplicateUsers** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_orphanedusers.md b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_orphanedusers.md
index 9941572cf1..bc032fed2d 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_orphanedusers.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_orphanedusers.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_OrphanedUsers** > **Co
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_passwordstatus.md b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_passwordstatus.md
index 25507822b2..bb61792edc 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_passwordstatus.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_passwordstatus.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_PasswordStatus** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigure for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_serviceaccounts.md b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_serviceaccounts.md
index 276cf326e6..7e4ff8252a 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_serviceaccounts.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_serviceaccounts.md
@@ -11,7 +11,7 @@ Kerberoasting. An account is deemed vulnerable to a Kerberoasting attack if the
msDS-SupportedEncryptionTypes value supports RC4 as the highest encryption type.
:::tip
-Remember, the 1-AD_Scan Job needs to be configured to collect these Custom Attributes:
+Configure the 1-AD_Scan Job to collect these custom attributes:
:::
@@ -26,7 +26,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_ServiceAccounts** > **
select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_sidhistory.md b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_sidhistory.md
index 75dd4546ff..35bb9c97cd 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_sidhistory.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_sidhistory.md
@@ -17,7 +17,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_SIDHistory** > **Confi
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -36,4 +36,4 @@ produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SID History | This report lists historical SIDs in the audited environment. Additionally, it highlights exceptions involving the SIDHistory attribute on AD user objects. Considered in particular are when a user has a historical SID from their current domain, or when a non-admin user has a historical SID with administrative rights. | None | This report is comprised of three elements: - Bar Chart – Displays historical SIDs by domain
- Table – Provides details on SID history
- Table – Provides details on historical SIDs by domain
|
+| SID History | This report lists historical SIDs in the audited environment. Additionally, it highlights exceptions involving the SIDHistory attribute on AD user objects. It pays particular attention to cases where a user has a historical SID from their current domain, or where a non-admin user has a historical SID with administrative rights. | None | This report is comprised of three elements: - Bar Chart – Displays historical SIDs by domain
- Table – Provides details on SID history
- Table – Provides details on historical SIDs by domain
|
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_staleusers.md b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_staleusers.md
index cbc848c1a5..3053399388 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_staleusers.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_staleusers.md
@@ -7,12 +7,12 @@ sidebar_position: 80
# AD_StaleUsers Job
The AD_StaleUsers job identifies potentially stale users based on the amount of time since their
-last login to the domain, or if the account has been disabled. These accounts should be reviewed and
-cleaned up in order to increase security and reduce complexity.
+last log in to the domain, or if the account has been disabled. These accounts should be reviewed and
+cleaned up to increase security and reduce complexity.
:::note
The definition of a stale user is set by the .Active Directory Inventory solution. These
-parameters, including the number of days since last login to be considered stale (by default 60
+parameters, including the number of days since last log in to be considered stale (by default 60
days), can be customized within the **.Active Directory Inventory** > **3-AD_Exceptions** job's
**Stale Users** analysis task. See the
[3-AD_Exceptions Job](/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/3-ad_exceptions.md)
@@ -26,7 +26,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_StaleUsers** > **Confi
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -44,4 +44,4 @@ the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Stale Users | This report identifies user accounts which have not logged into the domain for an extended amount of time or are currently disabled. A user account is considered stale if the last logon is over 60 days ago, is currently disabled, or expired. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays users by domain
- Table – Provides details on users
- Table – Provides details on users by domain
|
+| Stale Users | This report identifies user accounts which have not logged into the domain for an extended amount of time or are disabled. A user account is considered stale if the last logon is over 60 days ago, is disabled, or expired. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays users by domain
- Table – Provides details on users
- Table – Provides details on users by domain
|
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_userattributecompletion.md b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_userattributecompletion.md
index d385030328..3650521e96 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_userattributecompletion.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_userattributecompletion.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_UserAttributeCompletio
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_userdelegation.md b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_userdelegation.md
index 587a51831b..ce9717ff1c 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_userdelegation.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_userdelegation.md
@@ -8,7 +8,7 @@ sidebar_position: 100
The AD_Delegation Job highlights user accounts which are trusted for delegation. Kerberos delegation
enables an application to access resources hosted on a different server, and opens up several
-avenues to compromise based on the type of delegation enabled. See the
+avenues to compromise based on the type of delegation enabled. See the
[What Is Kerberos Delegation?](https://blog.netwrix.com/2021/11/30/what-is-kerberos-delegation-an-overview-of-kerberos-delegation/) Netwrix
blog article for more information about this configuration and the related security risks.
@@ -18,7 +18,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_UserDelegation** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_usertoken.md b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_usertoken.md
index 50bc54ecd9..15d3b8a47b 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_usertoken.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_usertoken.md
@@ -18,7 +18,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_UserToken** > **Config
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_weakpasswords.md b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_weakpasswords.md
index 82827a6f99..ef525d59c9 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_weakpasswords.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_weakpasswords.md
@@ -19,20 +19,20 @@ dictionaries and other exceptions. Exceptions include:
- Delegable Admins – Administrator account is allowed to be delegated to a service
- DES Encryption Only – Account is using Kerberos DES encryption. DES encryption is considered weak
as the 56-bit key is prone to brute force attacks. See the Microsoft
- [AD DS: User accounts and trusts in this domain should not be configured for DES only](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff646918(v=ws.10))
+ [AD DS: User accounts and trusts in this domain shouldn't be configured for DES only](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff646918(v=ws.10))
article for additional information.
- Empty Password – Account has an empty password
-- Kerberos Pre-authentication is not required – Account does not require Kerberos
+- Kerberos Pre-authentication isn't required – Account doesn't require Kerberos
pre-authentication. Kerberos pre-authentication can mitigate against brute force attacks. See the
Microsoft
- [Kerberos Pre-Authentication: Why It Should Not Be Disabled](https://learn.microsoft.com/en-us/archive/technet-wiki/23559.kerberos-pre-authentication-why-it-should-not-be-disabled)
+ [Kerberos Pre-Authentication: Why It Shouldn't Be Disabled](https://learn.microsoft.com/en-us/archive/technet-wiki/23559.kerberos-pre-authentication-why-it-should-not-be-disabled)
article for additional information.
- LM Hash – Account has stored LM hashes. The LM hash is a relatively weak hash that is prone to
brute force attacks. See the Microsoft
[How to prevent Windows from storing a LAN manager hash of your password in Active Directory and local SAM databases](https://learn.microsoft.com/en-US/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password)
article for additional information.
- Password Never Expires – Account has a password that never expires
-- Password Not Required – Account does not require a password
+- Password Not Required – Account doesn't require a password
- Weak Historical Password – Account has a historical password that was found in the dictionary
- Weak Password – Account has a password that was found in the dictionary
- Shares Common Password – Account shares a password with another account
@@ -53,8 +53,7 @@ The query for this job are:
### Configure the Weak Passwords Query
-The PasswordSecurity Data Collector can be scoped if desired. Follow the steps to modify the query
-configuration.
+The PasswordSecurity Data Collector can be scoped if desired. To modify the query configuration:
**Step 1 –** Navigate to the job’s Configure node and select Queries.
@@ -67,7 +66,7 @@ Collector Wizard opens.
:::warning
-Read the warning prior to enabling the cleartext password feature.
+Read the warning before enabling the cleartext password feature.
:::
@@ -95,7 +94,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_WeakPasswords** > **Co
select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/users/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectory/users/overview.md
index 9fc3cf6f22..668732776d 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/users/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/users/overview.md
@@ -14,7 +14,7 @@ concern such as weak passwords, user token size, or stale users.
The following components comprise the 2.Users Job Group:
- [AD_DirectMembership Job](/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_directmembership.md)
- – Identifies users who do not have any group membership. This condition may indicate unnecessary
+ – Identifies users who don't have any group membership. This condition may indicate unnecessary
user accounts that are suitable candidates for review and cleanup.
- [AD_DuplicateUsers Job](/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_duplicateusers.md)
– Identifies multiple user accounts which may be owned by a single employee. A user may have
@@ -36,7 +36,7 @@ The following components comprise the 2.Users Job Group:
SID from their current domain, or when a non-admin user has a historical SID with administrative
rights, both of which may be indicators of compromise.
- [AD_StaleUsers Job](/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_staleusers.md)
- – Identifies potentially stale users based on the amount of time since their last login to the
+ – Identifies potentially stale users based on the amount of time since their last log in to the
domain, or if the account has been disabled. These accounts should be reviewed and cleaned up in
order to increase security and reduce complexity.
- [AD_UserAttributeCompletion Job](/docs/accessanalyzer/11.6/solutions/activedirectory/users/ad_userattributecompletion.md)
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectory/users/recommended.md b/docs/accessanalyzer/11.6/solutions/activedirectory/users/recommended.md
index d45aae4a32..8389e016a9 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectory/users/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectory/users/recommended.md
@@ -6,16 +6,16 @@ sidebar_position: 10
# Recommended Configurations for the 2.Users Job Group
-The **Active Directory** > **2.Users** Job Group has been configured by default to run with the
-out-of-the-box settings. It can be run directly or scheduled.
+The **Active Directory** > **2.Users** Job Group is configured to run with the default settings.
+It can be run directly or scheduled.
**Dependencies**
-- The **.Active Directory Inventory** Job Group needs to be successfully executed prior to running
+- The **.Active Directory Inventory** Job Group needs to be successfully executed before running
this job group
- - For the **AD_ServiceAccounts** Job, the **.Active Directory Inventory** > **1-AD_Scan** Job
- needs to be configured to collect **servicePrincipalName** as a Custom Attribute
+ - For the **AD_ServiceAccounts** Job, configure the **.Active Directory Inventory** >
+ **1-AD_Scan** Job to collect **servicePrincipalName** as a Custom Attribute
- For the **AD_WeakPassword** Job:
@@ -27,12 +27,12 @@ out-of-the-box settings. It can be run directly or scheduled.
topic for additional information.
:::info
- If this job is not to be used, disable the job to prevent execution when the
- job group is executed.
+ If you don't need this job, disable it to prevent it from running with the job
+ group.
:::
-**Targeted Host(s)**
+**Targeted Hosts**
Only the **AD_WeakPasswords** Job requires a host list. The host list assignment has been configured
under the **2. Users** > **AD_WeakPasswords** > **Configure** > **Hosts** node. It is set to target
@@ -41,8 +41,8 @@ the host inventory value in the **isDomainController** field in the Host Master
**Connection Profile**
-Only the **AD_WeakPasswords** Job requires a Connection Profile. It must be set directly on the
-**AD_WeakPasswords** Job (through the Job Properties window) with Domain Administrator privileges.
+Only the **AD_WeakPasswords** Job requires a Connection Profile. Set it directly on the
+**AD_WeakPasswords** Job (through the Job Properties window) using Domain Administrator privileges.
:::note
The **AD_WeakPassword** Job can be executed with a least privilege credential. See the
@@ -64,7 +64,7 @@ Run the jobs in the **2.Users** Job Group together and in order by running the e
instead of the individual jobs.
:::tip
-Remember, if the **AD_WeakPassword** Job is not to be executed, it can be disabled.
+If you don't need to run the **AD_WeakPassword** Job, disable it.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/1-ad_scan.md b/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/1-ad_scan.md
index 1fad4a84ef..5fb9049f07 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/1-ad_scan.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/1-ad_scan.md
@@ -8,7 +8,7 @@ sidebar_position: 20
The 1-AD_Scan Job collects data from Active Directory. In most environments, this job requires no
additional customizations before running it. Optionally, the job can be configured to scope scan
-options and to collect custom attributes. For enable SSL encryption for communication with Active
+options and to collect custom attributes. To enable SSL encryption for communication with Active
Directory, see the [Enable SSL Option](#enable-ssloption) topic for additional information.
## Queries for the 1-AD Scan Job
@@ -27,8 +27,8 @@ The 1-AD_Scan Job uses the ADInventory Data Collector for the following query:
### Customize the 1-AD_Scan Query
The 1-AD_Scan Job has been preconfigured to run with the default settings with the category of Scan
-Active Directory. Follow the steps to set any desired customizations to scan options or to collect
-custom attributes.
+Active Directory. To set any desired customizations to scan options or to collect
+custom attributes:
**Step 1 –** Navigate to the **.Active Directory Inventory** > **1-AD_Scan** > **Configure** node
and select **Queries**.
@@ -40,7 +40,7 @@ opens.
DC Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -68,16 +68,16 @@ topic for additional information.
click **Cancel** if no changes were made. Then click **OK** to close the Query Properties window.
:::note
-In order for the Access Information Center to populate NFS permissions within File System
-reports, the .Active Directory Inventory Job Group must be configured to collect the **uid** and
-**uidNumber** attributes for Users. See the
+To let the Access Information Center populate NFS permissions within File System reports,
+configure the .Active Directory Inventory Job Group to collect the **uid** and **uidNumber**
+attributes for Users. See the
[NFS Permissions for the AIC ](#nfs-permissions-for-the-aic) topic for additional information.
:::
The 1-AD_Scan Job is now ready to run with the customized settings. If any custom attributes are
added to the data collection, the **Create Extended Attributes View** analysis task can be enabled
-in order to have visibility into the collected data.
+to have visibility into the collected data.
## Analysis Tasks for the 1-AD_Scan Job
@@ -85,7 +85,7 @@ View the analysis tasks by navigating to the **.Active Directory Inventory** > *
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -124,14 +124,14 @@ topic, the 1-AD_Scan Job produces the following pre-configured report:
## NFS Permissions for the AIC
-In order for the Access Information Center to populate NFS resources within all File System
-permissions and resource audit reports, the .Active Directory Inventory Job Group must be configured
-to collect the following custom attributes for Users:
+To let the Access Information Center populate NFS resources within all File System permissions and
+resource audit reports, configure the .Active Directory Inventory Job Group to collect the following
+custom attributes for Users:
- uid
- uidNumber
-Follow the steps to add the custom attributes.
+To add the custom attributes:
**Step 1 –** Navigate to the Active Directory Inventory DC Wizard for the AD Inventory Query within
the 1-AD_Scan Job.
@@ -142,7 +142,7 @@ the 1-AD_Scan Job.
option is deselected.
:::note
-Whenever query configurations are modified, it is necessary to do a full scan. After the
+Whenever query configurations are modified, run a full scan. After the
first full scan, differential scanning can be re-enabled.
:::
@@ -176,7 +176,7 @@ The .Active Directory Inventory Job Group is now collecting attributes required
visible within the Access Information Center.
:::tip
-Remember, it is necessary to re-enable differential scanning after Step 5 if desired.
+Remember to re-enable differential scanning after Step 5 if desired.
:::
@@ -186,7 +186,7 @@ for additional information.
## Enable SSL Option
-Follow the steps to enable SSL encryption for communications with Active Directory:
+To enable SSL encryption for communications with Active Directory:
**Step 1 –** Navigate to the **1-AD_Scan > Configure** node and select **Queries**.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/2-ad_changes.md b/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/2-ad_changes.md
index b92a1d099b..2804cfc58c 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/2-ad_changes.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/2-ad_changes.md
@@ -11,8 +11,8 @@ Directory changes which have occurred since the last time the .Active Directory
was run. It is dependent on the running of the 1-AD_Scan Job, also located in the .Active Directory
Inventory Job Group.
-The 1-AD_Scan Job must have the Query Option to **Track changes into Change tracking tables**
-selected in order for the Analysis Tasks in the 2-AD_Changes Job to work. See Step 4 of the
+Select the Query Option to **Track changes into Change tracking tables** in the 1-AD_Scan Job so the
+Analysis Tasks in the 2-AD_Changes Job work. See Step 4 of the
[Customize the 1-AD_Scan Query](/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/1-ad_scan.md#customize-the-1-ad_scan-query)
topic for additional information.
@@ -22,7 +22,7 @@ View the analysis tasks by navigating to the **.Active Directory Inventory** > *
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -125,32 +125,31 @@ following pre-configured reports:
| Group Membership Changes (A.K.A. Most Active Groups) | This report tracks group membership changes in Active Directory. | None | This report is comprised of three elements: - Bar graph – Displays Most Active Groups (Past 24 Hours)
- Table – Provides details on the most active groups (Past 24 Hours)
- Table – Provides details on the most active groups
|
| New Principals | This report identifies when principals have been created on the targeted domains. | None | This report is comprised of two elements: - Bar graph – Displays New Principals by Domain (Past 24 Hours)
- Table – Provides details on the new principals by domain
|
| Object Moves | This report tracks object moves in Active Directory. | None | This report is comprised of two elements: - Table – Displays Most Active OUs (Past 24 Hours)
- Table – Provides details on the most active OUs
|
-| Org Changes (A.K.A. Organizational Changes) | This report tracks organizational moves such as manager, title or department changes. | None | This report is comprised of three elements: - Bar graph – Displays Organizational Changes (Past 24 Hours)
- Table – Provides details on organizational changes (Past 24 Hours)
- Table – Provides details on the organizational changes
|
+| Org Changes (A.K.A. Organizational Changes) | This report tracks organizational moves such as manager, title, or department changes. | None | This report is comprised of three elements: - Bar graph – Displays Organizational Changes (Past 24 Hours)
- Table – Provides details on organizational changes (Past 24 Hours)
- Table – Provides details on the organizational changes
|
| Principal Deletions (A.K.A. Past 24 Hours) | This report identifies when principals have been deleted from the targeted domains. | None | This report is comprised of three elements: - Bar graph – Displays Deleted Principals by Domain (Past 24 Hours)
- Table – Provides details on deleted principals by domain (Past 24 Hours)
- Table – Provides details on the principals by domain
|
| User Account Status Changes | This report tracks user account status changes. | None | This report is comprised of three elements: - Bar graph – Displays User Account Control Changes (Past 24 Hours)
- Table – Provides details on user account control changes (Past 24 Hours)
- Table – Provides details on the user account control changes
|
### Notification Analysis Tasks for the 2-AD_Changes Job
-In order for Enterprise Auditor to send email notifications, it is necessary for the **Settings** >
-**Notification** node to be properly configured. See the
+To send email notifications, configure the **Settings** > **Notification** node properly. See the
[Notification](/docs/accessanalyzer/11.6/admin/settings/notification.md)
topic for instructions on enabling the Enterprise Auditor Console to send email notifications. Once
email notifications have been enabled, the individual notification analysis tasks can be configured
-and enabled. Follow the steps to configure a notification analysis task.
+and enabled. To configure a notification analysis task:
**Step 1 –** Navigate to the **.Active Directory Inventory** > **2-AD_Changes** > **Configure** node
and select **Analysis**.
-**Step 2 –** In the Analysis Selection view, select the desired notification analysis task and click
+**Step 2 –** In the Analysis Selection view, select the notification analysis task you want and click
**Analysis Configuration**. The Notification Data Analysis Module opens.
:::warning
-Do not make changes to the pages preceding the SMTP page.
+Don't make changes to the pages preceding the SMTP page.
:::
@@ -169,9 +168,9 @@ provided. You can use the following options:
-**Step 5 –** In the Message section, edit the **Subject**. It is not recommended to remove any
-parameters. Then, customize the email content in the textbox to provide an explanation of the
-notification to the recipients.
+**Step 5 –** In the Message section, edit the **Subject**. Don't remove any parameters. Then,
+customize the email content in the textbox to provide an explanation of the notification to the
+recipients.
**Step 6 –** Click **Next** to save these configuration changes and navigate to the Summary page. Do
not make changes to any other pages. Click **Finish**. The Notification Data Analysis Module window
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/3-ad_exceptions.md b/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/3-ad_exceptions.md
index cb03286eae..e586598a5e 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/3-ad_exceptions.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/3-ad_exceptions.md
@@ -12,7 +12,7 @@ running the 1-AD_Scan Job, also located in the .Active Directory Inventory Job G
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+The Configuration section on a Job's overview page lets you modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -34,11 +34,11 @@ topic for additional information.
## Analysis Tasks for the 3-AD_Exceptions Job
View the analysis tasks by navigating to the **.Active Directory Inventory** > **3-AD_Exceptions** >
-**Configure** node and select **Analysis**. Analysis tasks with configuration parameters that define
-the security concerns within them can be modified.
+**Configure** node and select **Analysis**. You can modify analysis tasks whose configuration
+parameters define their security concerns.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/overview.md
index 1276f491e6..f32050da62 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/overview.md
@@ -50,7 +50,7 @@ Inventory Job Group.
The .Active Directory Inventory Solution is a core component of all Enterprise Auditor
installations. Typically this solution is instantiated during installation, but it can be installed
-from the Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to the
+from the Instant Job Wizard. After it has been installed into the Jobs tree, navigate to the
solution: **Jobs** > **.Active Directory Inventory**. This group has been named in such a way to
keep it at the top of the Jobs tree.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/recommended.md b/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/recommended.md
index 4078b5bedc..a2fa1d4633 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectoryinventory/recommended.md
@@ -6,13 +6,13 @@ sidebar_position: 10
# Recommended Configurations for the .Active Directory Inventory Solution
-The .Active Directory Inventory Solution has been configured by default to run with the
-out-of-the-box settings, but some settings are optional for configuration. It can be run directly or
+The .Active Directory Inventory Solution is configured to run with the
+default settings, but some settings are optional for configuration. It can be run directly or
scheduled.
**Dependencies**
-This job group does not have dependencies.
+This job group doesn't have dependencies.
**Targeted Hosts**
@@ -57,8 +57,8 @@ It is best to rerun it anytime AD changes might have occurred.
**Run at the Solution Level**
-The jobs in the .Active Directory Inventory Job Group should be run together and in order by running
-the entire solution, instead of the individual jobs.
+Run the jobs in the .Active Directory Inventory Job Group together and in order by running the
+entire solution, instead of the individual jobs.
**Query Configuration**
@@ -92,6 +92,6 @@ when targeting multiple domains.
**Step 2 –** Set a Connection Profile.
-**Step 3 –** chedule the .Active Directory Inventory Job Group to run as desired.
+**Step 3 –** Schedule the .Active Directory Inventory Job Group to run as desired.
**Step 4 –** Review the reports generated by the .Active Directory Inventory Job Group.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_brokeninheritance.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_brokeninheritance.md
index c50ed8f3de..f3573ca9ac 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_brokeninheritance.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_brokeninheritance.md
@@ -19,7 +19,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **6.BrokenInheritanc
**AD_BrokenInheritance** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_openaccess.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_openaccess.md
index 5e1be00912..6796b3dc4e 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_openaccess.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_openaccess.md
@@ -20,7 +20,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **5.Open Access** >
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_oupermissions.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_oupermissions.md
index 08df3b0389..9dc3c1c3b7 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_oupermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_oupermissions.md
@@ -19,7 +19,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **3.OUs** > **AD_OUP
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_shadowaccess.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_shadowaccess.md
index 64d289ae2f..eaa205d585 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_shadowaccess.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_shadowaccess.md
@@ -33,7 +33,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **AD_ShadowAccess**
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks, with the exception of the
+Don't modify or deselect the selected analysis tasks, with the exception of the
**Calculate Shadow Access** analysis tasks. The analysis tasks are preconfigured for this job. The
**Calculate Shadow Access** analysis task is the only analysis task that has customizable
parameters.
@@ -95,8 +95,8 @@ topic for additional information.
Customizable parameters enable Enterprise Auditor users to set the values used to classify user and
group objects during this job’s analysis. The parameters can be customized and are listed in a
-section at the bottom of the SQL Script Editor. Follow the steps to customize an analysis task’s
-parameters.
+section at the bottom of the SQL Script Editor. To customize an analysis task’s
+parameters:
**Step 1 –** Navigate to the **Active Directory Permissions Analyzer** > **AD_ShadowAccess** >
**Configure** node and select **Analysis** to view analysis tasks.
@@ -109,12 +109,12 @@ then click **Analysis Configuration**. The SQL Script Editor opens.
**Step 3 –** In the parameters section at the bottom of the editor, find the Value column.
-Double-click on the current value and change as desired.
+Double-click the current value and change as desired.
- If the variable type is a table, select the cell and click **Edit Table** to modify the value.
:::warning
-Do not change any parameters where the Value states `Created during execution`.
+Don't change any parameters where the Value states `Created during execution`.
:::
@@ -154,9 +154,9 @@ domain and sensitive data.
The last report element displays information on potential attack paths for users found in the
-targeted domain. Clicking on the green plus sign next to an attack path will open an Attack Path
-window that displays a step-by-step process of how a user object, if compromised, can be used to
-conduct a shadow attack.
+targeted domain. Click the green plus sign next to an attack path to open an Attack Path window that
+displays a step-by-step process of how an attacker can use a compromised user object to conduct a
+shadow attack.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_computerrights.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_computerrights.md
index 196ea8441d..3dcb8656e7 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_computerrights.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_computerrights.md
@@ -14,7 +14,7 @@ Active Directory.
The AD_ComputerRights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -32,7 +32,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** >
**AD_ComputerRights** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_containerrights.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_containerrights.md
index 617e21d516..725578fe32 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_containerrights.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_containerrights.md
@@ -14,7 +14,7 @@ Active Directory.
The AD_ContainerRights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -32,7 +32,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** >
**AD_ContainerRights** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_domainrights.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_domainrights.md
index d9e103d04c..e4a865273a 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_domainrights.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_domainrights.md
@@ -14,7 +14,7 @@ Active Directory.
The AD_DomainRights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -32,7 +32,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** > *
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_grouprights.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_grouprights.md
index 8adb3aeb02..268cd8bb03 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_grouprights.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_grouprights.md
@@ -14,7 +14,7 @@ Directory.
The AD_GroupRights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -32,7 +32,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** > *
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_ourights.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_ourights.md
index 0d3a884ecb..16514300da 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_ourights.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_ourights.md
@@ -14,7 +14,7 @@ in Active Directory.
The AD_OURights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -32,7 +32,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** > *
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_siterights.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_siterights.md
index 5b52b0a0ba..2fe5159113 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_siterights.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_siterights.md
@@ -14,7 +14,7 @@ Directory.
The AD_SiteRights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -32,7 +32,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** > *
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_userrights.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_userrights.md
index 9f6684cdae..9ab47c4a3c 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_userrights.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/collection/ad_userrights.md
@@ -14,7 +14,7 @@ Directory.
The AD_UserRights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -32,7 +32,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** > *
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/computers/ad_computerpermissions.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/computers/ad_computerpermissions.md
index ad8dd9826a..eaabf66ca0 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/computers/ad_computerpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/computers/ad_computerpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **4.Computers** >
**AD_ComputerPermissions** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/computers/ad_lapspermissions.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/computers/ad_lapspermissions.md
index 776c5d7037..126fc8aa7c 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/computers/ad_lapspermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/computers/ad_lapspermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **4.Computers** >
**AD_LAPSPermissions** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/containers/ad_adminsdholder.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/containers/ad_adminsdholder.md
index fa4a2ee7f2..420a7fb92a 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/containers/ad_adminsdholder.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/containers/ad_adminsdholder.md
@@ -15,7 +15,7 @@ Container in Active Directory.
The AD_AdminSDHolder Job uses the PowerShell Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -33,7 +33,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **7.Containers** >
**AD_AdminSDHolder** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/containers/ad_containerpermissions.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/containers/ad_containerpermissions.md
index 814b60bb81..d8f729ea39 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/containers/ad_containerpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/containers/ad_containerpermissions.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# AD_ContainerPermissions Job
-The AD_ContainerPermissions Job is responsible for reporting on all Active Directory permissions
+The AD_ContainerPermissions Job reports on all Active Directory permissions
applied to container objects within the targeted domains.
## Analysis Tasks for the AD_ContainerPermissions Job
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **7.Containers** >
**AD_ContainerPermissions** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/containers/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/containers/overview.md
index c751c853a8..34e52faf9a 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/containers/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/containers/overview.md
@@ -15,7 +15,7 @@ The jobs in the 7.Containers Job Group are:
- [AD_AdminSDHolder Job](/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/containers/ad_adminsdholder.md)
– Reports on all non-default Active Directory permissions applied to the AdminSDHolder container
- within the targeted domains. The AdminSDHolder container can be leveraged by an attacker to create
+ within the targeted domains. An attacker can use the AdminSDHolder container to create
persistence within the environment. See the Microsoft
[AdminSDHolder, Protected Groups and SDPROP](https://technet.microsoft.com/en-us/library/2009.09.sdadminholder.aspx)
article for additional information.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/domains/ad_domainpermissions.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/domains/ad_domainpermissions.md
index 8672ae1ec9..7053a6a59a 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/domains/ad_domainpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/domains/ad_domainpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **8.Domains** >
**AD_DomainPermissions** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/domains/ad_domainreplication.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/domains/ad_domainreplication.md
index 25753e3d5c..9abb71a50c 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/domains/ad_domainreplication.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/domains/ad_domainreplication.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **8.Domains** >
**AD_DomainReplication** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/ad_groupmembershippermissions.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/ad_groupmembershippermissions.md
index 7e9ec9ad88..799ac62e02 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/ad_groupmembershippermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/ad_groupmembershippermissions.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# AD_GroupMembershipPermissions Job
-The AD_GroupMembershipPermissions Job highlights all Active Directory users that are capable of
-modifying group membership within the targeted domains.
+The AD_GroupMembershipPermissions Job highlights all Active Directory users that can modify group
+membership within the targeted domains.
## Analysis Tasks for the AD_GroupMembershipPermissions Job
@@ -16,7 +16,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **2.Groups** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/ad_grouppermissions.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/ad_grouppermissions.md
index ec46d0fa16..e853130048 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/ad_grouppermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/ad_grouppermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **2.Groups** > **AD_
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/overview.md
index d52b451ee3..3bfbbf9352 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/overview.md
@@ -14,7 +14,7 @@ the targeted domains.
The jobs in the 2.Groups Job Group are:
- [AD_GroupMembershipPermissions Job](/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/ad_groupmembershippermissions.md)
- – Highlights all Active Directory users that are capable of modifying group membership within the
+ – Highlights all Active Directory users that can modify group membership within the
targeted domains
- [AD_GroupPermissions Job](/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/groups/ad_grouppermissions.md)
– Reports on all Active Directory permissions applied to group objects within the targeted domains
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/overview.md
index 0d51dd6de1..76499465cf 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 50
# Active Directory Permissions Analyzer Solution
The Enterprise Auditor Active Directory Permissions Analyzer Solution enables organizations to
-easily and automatically determine effective permissions applied to any and all Active Directory
-(AD) objects. AD, Security, and Network Administrators can easily browse and compare information
+automatically determine effective permissions applied to all Active Directory
+(AD) objects. AD, Security, and Network Administrators can browse and compare information
from individual or multiple domains using comprehensive, preconfigured analyses and reports focused
on permissions associated with AD domains, organizational units, groups, users, and computers. These
capabilities enable them to obtain the most authoritative view of who has access to what in AD.
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/recommended.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/recommended.md
index 4bbecb3511..2d1890f089 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/recommended.md
@@ -12,7 +12,7 @@ The following Enterprise Auditor job groups need to be successfully run:
- .Active Directory Inventory Job Group
-The following jobs need to be run prior to running the
+The following jobs need to be run before running the
[AD_ShadowAccess Job](/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/ad_shadowaccess.md):
- .Active Directory Inventory >1-AD_Scan > ADInventory
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/ad_dcshadowpermissions.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/ad_dcshadowpermissions.md
index 97aa4c2c52..baee6076eb 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/ad_dcshadowpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/ad_dcshadowpermissions.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# AD_DCShadowPermissions Job
-The AD_DCShadowPermissions Job highlights all Active Directory users that are capable of potentially
-performing a DCShadow attack within the targeted domains.
+The AD_DCShadowPermissions Job highlights all Active Directory users that can perform a DCShadow
+attack within the targeted domains.
## Analysis Tasks for the AD_DCShadowPermissions Job
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **9.Sites** >
**AD_DCShadowPermissions** > **Configure** node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/ad_sitepermissions.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/ad_sitepermissions.md
index 70bda7b571..77c3224bb3 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/ad_sitepermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/ad_sitepermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **9.Sites** > **AD_S
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/overview.md
index c7613b3c83..19d81a71c3 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/overview.md
@@ -14,7 +14,7 @@ targeted domains.
The jobs in the 9.Sites Job Group are:
- [AD_DCShadowPermissions Job](/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/ad_dcshadowpermissions.md)
- – Highlights all Active Directory users that are capable of potentially performing a DCShadow
+ – Highlights all Active Directory users that can perform a DCShadow
attack within the targeted domains
- [AD_SitePermissions Job](/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/sites/ad_sitepermissions.md)
– Reports on all Active Directory permissions applied to site objects within the targeted domains
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/ad_resetpasswordpermissions.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/ad_resetpasswordpermissions.md
index 8fc8f721bf..925e29a79f 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/ad_resetpasswordpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/ad_resetpasswordpermissions.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# AD_ResetPasswordPermissions Job
-The AD_ResetPasswordPermissions Job highlights all Active Directory users that are capable of
-resetting another user's password within the targeted domains. It uses the data collected by the
+The AD_ResetPasswordPermissions Job highlights all Active Directory users that can reset another
+user's password within the targeted domains. It uses the data collected by the
0.Collection Job Group to provide information on permissions applied to user objects in Active
Directory.
@@ -18,7 +18,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **1.Users** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/ad_userpermissions.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/ad_userpermissions.md
index cafe946361..921fb71fbe 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/ad_userpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/ad_userpermissions.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **1.Users** > **AD_U
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/overview.md b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/overview.md
index 852e647802..03dcb277c8 100644
--- a/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/overview.md
@@ -14,7 +14,7 @@ targeted domains
The following jobs comprise the 1.Users Job Group:
- [AD_ResetPasswordPermissions Job](/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/ad_resetpasswordpermissions.md)
- – Highlights all Active Directory users that are capable of resetting another user’s password
+ – Highlights all Active Directory users that can reset another user’s password
within the targeted domains
- [AD_UserPermissions Job](/docs/accessanalyzer/11.6/solutions/activedirectorypermissionsanalyzer/users/ad_userpermissions.md)
– Reports on all Active Directory permissions applied to user objects within the targeted domains
diff --git a/docs/accessanalyzer/11.6/solutions/anyid/anyid_csv.md b/docs/accessanalyzer/11.6/solutions/anyid/anyid_csv.md
index 840b6dfb09..25dec74474 100644
--- a/docs/accessanalyzer/11.6/solutions/anyid/anyid_csv.md
+++ b/docs/accessanalyzer/11.6/solutions/anyid/anyid_csv.md
@@ -33,7 +33,7 @@ Local Host
**Connection Profile**
-The AnyID_CSV job does not require a connection profile.
+The AnyID_CSV job doesn't require a connection profile.
**History Retention**
@@ -82,7 +82,7 @@ The query is:
### Configure the AnyID_CSV Query
-Follow the steps to configure the AnyID_CSV query.
+To configure the AnyID_CSV query:
@@ -111,7 +111,7 @@ The following attributes must be configured in order for the job to execute prop
- $inputfile – File path to the CSV file which contains the identity and attribute information
-- $RequiredAttributes – The list of attributes that need to be found in the document in order to
+- $RequiredAttributes – The list of attributes that need to be found in the document to
trigger a match
- An attribute in the Attributes list will not be considered a match (in reporting and AIC)
@@ -141,7 +141,7 @@ Navigate to the **Jobs** > **AnyID Connectors** > **AnyID_CSV** > **Configure**
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/anyid/anyid_epicclarity.md b/docs/accessanalyzer/11.6/solutions/anyid/anyid_epicclarity.md
index 6607ab58e6..cb7591f789 100644
--- a/docs/accessanalyzer/11.6/solutions/anyid/anyid_epicclarity.md
+++ b/docs/accessanalyzer/11.6/solutions/anyid/anyid_epicclarity.md
@@ -8,7 +8,7 @@ sidebar_position: 20
The AnyID_EpicClarity job collects patient information from Epic including MRNs, SSNs, Subscriber
IDs, and Account IDs. An account with read access to the underlying Clarity Oracle database is
-required in order to run queries.
+required to run queries.
@@ -45,7 +45,7 @@ Not supported
**Schedule Frequency**
-This job should be run based on the desired frequency of Sensitive Data Scans.
+This job should be run based on the frequency you want for Sensitive Data Scans.
**Query Configuration**
@@ -78,13 +78,13 @@ The queries are:
- Epic Clarity Coverage – Imports Epic Clarity subject profile information on coverage
- Epic Clarity Identity IDs – Imports Epic Clarity subject profile information on identity IDs
-The above queries have configurable parameters. See the
+The preceding queries have configurable parameters. See the
[Configure the AnyID_EpicClarity Queries](#configure-the-anyid_epicclarity-queries) topic for
additional information.
### Configure the AnyID_EpicClarity Queries
-Follow the steps to configure the AnyID_EpicClarity queries.
+To configure the AnyID_EpicClarity queries:
**Step 1 –** Navigate to the **AnyID Connectors** > **AnyID_EpicClarity** > **Configure** node and
select **Queries**.
@@ -111,7 +111,7 @@ topic for additional information. Configure the following attributes as needed:
- An attribute in the Attributes list will not be considered a match (in reporting and AIC)
unless an attribute in the RequiredAttributes list is also found in the same file
-- $RequiredAttributes – The list of attributes that need to be found in the document in order to
+- $RequiredAttributes – The list of attributes that need to be found in the document to
trigger a match. The default values are SSN, MRN, and IdentityID.
- An attribute in the Attributes list will not be considered a match (in reporting and AIC)
@@ -131,7 +131,7 @@ Navigate to the **Jobs** > **AnyID Connectors** > **AnyID_EpicClarity** > **Con
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/anyid/anyid_paycom.md b/docs/accessanalyzer/11.6/solutions/anyid/anyid_paycom.md
index ff83b472e2..bb2ace90b8 100644
--- a/docs/accessanalyzer/11.6/solutions/anyid/anyid_paycom.md
+++ b/docs/accessanalyzer/11.6/solutions/anyid/anyid_paycom.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# AnyID_Paycom Job
The AnyID_Paycom job pulls employee information from Paycom including name, address, date of Birth,
-and SSN. Contact the organization's Paycom administrator in order to generate the CSV export
+and SSN. Contact the organization's Paycom administrator to generate the CSV export
required for this job. The recommended approach is to copy the CSV file to the Enterprise Auditor
Console for best import performance.
@@ -29,7 +29,7 @@ Local Host
**Connection Profile**
-The AnyID_Paycom job does not require a connection profile.
+The AnyID_Paycom job doesn't require a connection profile.
**History Retention**
@@ -43,7 +43,7 @@ Not supported
**Schedule Frequency**
-This job should be run based on the desired frequency of Sensitive Data Scans.
+This job should be run based on the frequency you want for Sensitive Data Scans.
**Query Configuration**
@@ -78,7 +78,7 @@ The queries are:
### Configure the AnyID_Paycom Job
-Follow the steps to configure the AnyID_Paycom query.
+To configure the AnyID_Paycom query:
**Step 1 –** Navigate to the **AnyID Connectors** > **AnyID_Paycom** > **Configure** node and select
**Queries**.
@@ -96,16 +96,16 @@ the page to expand the Parameters window. See the
[PowerShell: Edit Query](/docs/accessanalyzer/11.6/admin/datacollector/powershell/editquery.md)
topic for additional information. Configure the following attributes as needed:
-- $SAHOSTNAME – Created during execution. This parameter cannot be modified.
-- $JobCredential – Created during execution. This parameter cannot be modified.
-- $JobCredentials – Created during execution. This parameter cannot be modified.
+- $SAHOSTNAME – Created during execution. This parameter can't be modified.
+- $JobCredential – Created during execution. This parameter can't be modified.
+- $JobCredentials – Created during execution. This parameter can't be modified.
- $inputfile – File path to the CSV file which contains the identity and attribute information
- $Attributes – The list of attributes that will be scanned for during sensitive data scanning
- An attribute in the Attributes list will not be considered a match (in reporting and AIC)
unless an attribute in the RequiredAttributes list is also found in the same file
-- $RequiredAttributes – The list of attributes that need to be found in the document in order to
+- $RequiredAttributes – The list of attributes that need to be found in the document to
trigger a match
- An attribute in the Attributes list will not be considered a match (in reporting and AIC)
@@ -130,7 +130,7 @@ Navigate to the **Jobs** > **AnyID Connectors** > **AnyID_Paycom** > **Configur
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/anyid/anyid_salesforce.md b/docs/accessanalyzer/11.6/solutions/anyid/anyid_salesforce.md
index b6e55e8e32..fa68909f44 100644
--- a/docs/accessanalyzer/11.6/solutions/anyid/anyid_salesforce.md
+++ b/docs/accessanalyzer/11.6/solutions/anyid/anyid_salesforce.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# AnyID_Salesforce Job
The AnyID_Salesforce job collects Salesforce contact details including phone, address, email, and
-date of birth. This job requires API access to Salesforce in order to collect this information. The
+date of birth. This job requires API access to Salesforce to collect this information. The
list of collected attributes can be adjusted as necessary.
@@ -88,7 +88,7 @@ The query is:
### Configure the AnyID_Salesforce Query
-Follow the steps to configure the AnyID_Salesforce query.
+To configure the AnyID_Salesforce query:
**Step 1 –** Navigate to the **AnyID Connectors** > **AnyID_Salesforce** > **Configure** node and
select **Queries**.
@@ -106,15 +106,15 @@ the page to expand the Parameters window. See the
[PowerShell: Edit Query](/docs/accessanalyzer/11.6/admin/datacollector/powershell/editquery.md)
topic for additional information. Configure the following attributes as needed:
-- $SAHOSTNAME – Created during execution. This parameter cannot be modified.
-- $JobCredential – Created during execution. This parameter cannot be modified.
-- $JobCredentials – Created during execution. This parameter cannot be modified.
+- $SAHOSTNAME – Created during execution. This parameter can't be modified.
+- $JobCredential – Created during execution. This parameter can't be modified.
+- $JobCredentials – Created during execution. This parameter can't be modified.
- $Attributes – The list of attributes that will be scanned for during sensitive data scanning
- An attribute in the Attributes list will not be considered a match (in reporting and AIC)
unless an attribute in the RequiredAttributes list is also found in the same file
-- $RequiredAttributes – The list of attributes that need to be found in the document in order to
+- $RequiredAttributes – The list of attributes that need to be found in the document to
trigger a match
- An attribute in the Attributes list will not be considered a match (in reporting and AIC)
@@ -136,7 +136,7 @@ Navigate to the **Jobs** > **AnyID Connectors** > **AnyID_Salesforce** > **Conf
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/anyid/overview.md b/docs/accessanalyzer/11.6/solutions/anyid/overview.md
index 2b31c0337f..293ea877f9 100644
--- a/docs/accessanalyzer/11.6/solutions/anyid/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/anyid/overview.md
@@ -6,23 +6,23 @@ sidebar_position: 60
# AnyID Connectors Solution
-The AnyID Connectors Solution allows you to quickly find where data for identities are stored,
+The AnyID Connectors Solution lets you quickly find where data for identities are stored,
reducing the response time to Data Subject Access Requests (DSARs). Integration with third party
-repositories allows you to perform exact data matching for profiles such as employees, customers,
+repositories lets you perform exact data matching for profiles such as employees, customers,
students, or patients across any data repository.
Data Privacy Engine works in conjunction with Enterprise Auditor Sensitive Data Discovery scans to
create an efficient, secure IdentityIndex™ that privacy, security, and legal professionals can
-leverage to quickly and easily map the location of subject information. Through a series of
-preconfigured Identity Connectors,you can easily extract identity-related attributes about customers
+use to map the location of subject information. Through a series of
+preconfigured Identity Connectors, you can extract identity-related attributes about customers
and other potential subjects from verified systems of record like Salesforce, Epic, Peoplesoft, and
Paycom, as well as homegrown or alternative platforms.
Through the creation of a Subject Profile for each individual, Enterprise Auditor’s broad-reaching
Sensitive Data Discovery engine accurately identifies the specific location of a subject’s data
-across virtually any cloud or on-premises data repository. With this context in tow, organizations
-can now easily perform Data Subject Access Requests (DSARs), zero-in on where the implementation of
-Privacy by Design principles are needed most urgently, and know for certain when breach attempts and
+across virtually any cloud or on-premises data repository. With this context, organizations
+can perform Data Subject Access Requests (DSARs), prioritize where Privacy by Design
+principles are needed most, and confirm when breach attempts and
activities involve consumer, patient, resident, and other subject data.
## Supported Platforms
@@ -50,10 +50,10 @@ integrate with third-party systems of record such as Paycom or Salesforce, to ex
potential data subjects along with relevant bits of PII such as Social Security Number, Address, or
Phone Number.
-The jobs within this group create and add to the secure IdentityIndex™ containing identity-related
-attributes about potential subjects which are then used by Enterprise Auditor’s Sensitive Data
-Discovery engine to perform exact data matching against virtually any cloud or on-premises data
-repository.
+The jobs within this group create and add to the secure IdentityIndex™, which contains
+identity-related attributes about potential subjects. Enterprise Auditor’s Sensitive Data
+Discovery engine then uses this index to perform exact data matching against virtually any
+cloud or on-premises data repository.
@@ -64,14 +64,14 @@ The jobs in the AnyID Connectors Solution are:
may not be available, or an export is the best option.
- [AnyID_EpicClarity Job](/docs/accessanalyzer/11.6/solutions/anyid/anyid_epicclarity.md)
– Collects patient information from Epic including MRNs, SSNs, Subscriber IDs, and Account IDs. An
- account with read access to the underlying Clarity Oracle database is required in order to run
+ account with read access to the underlying Clarity Oracle database is required to run
queries.
- [AnyID_Paycom Job](/docs/accessanalyzer/11.6/solutions/anyid/anyid_paycom.md)
– Pulls employee information from Paycom including Name, Address, Date of Birth, and SSN. Contact
- your Paycom administrator in order to generate the CSV export required for this job.
+ your Paycom administrator to generate the CSV export required for this job.
- [AnyID_Salesforce Job](/docs/accessanalyzer/11.6/solutions/anyid/anyid_salesforce.md)
– Collects Salesforce Contact details including Phone, Address, Email, and Date of birth. This job
- requires API access to Salesforce in order to collect this information.
+ requires API access to Salesforce to collect this information.
:::note
See the individual job topics for information on recommended configurations.
diff --git a/docs/accessanalyzer/11.6/solutions/aws/collection/1.aws_orgscan.md b/docs/accessanalyzer/11.6/solutions/aws/collection/1.aws_orgscan.md
index 76f57bd4c8..54a959bd3f 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/collection/1.aws_orgscan.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/collection/1.aws_orgscan.md
@@ -23,7 +23,7 @@ The 1.AWS_OrgScan job has the following configurable query:
### Configure the Org Scan Query
The Org Scan query in the 1.AWS_OrgScan job has been preconfigured to run with the default settings
-with the category of Collect Org Data. Follow the steps to set any desired customizations.
+with the category of Collect Org Data. To set any desired customizations:
**Step 1 –** Navigate to the **AWS** > **0.Collection** > **1.AWS_OrgScan** > **Configure** node and
select the **Queries** node.
diff --git a/docs/accessanalyzer/11.6/solutions/aws/collection/2.aws_s3scan.md b/docs/accessanalyzer/11.6/solutions/aws/collection/2.aws_s3scan.md
index a12c4fbcb9..5de25860bc 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/collection/2.aws_s3scan.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/collection/2.aws_s3scan.md
@@ -23,7 +23,7 @@ The 2.AWS_S3Scan job has the following configurable query:
### Configure the S3 Scan Query
The S3 Scan query in the 2.AWS_S3 Scan job has been preconfigured to run with the default settings
-with the category of Collect S3. Follow the steps to set any desired customizations.
+with the category of Collect S3. To set any desired customizations:
**Step 1 –** Navigate to the **AWS** > **0.Collection** > **2.AWS_S3Scan** > **Configure** node and
select the **Queries** node.
@@ -65,7 +65,7 @@ Navigate to the **AWS** > **0.Collection** > **2.AWS_S3Scan** > **Configure** no
**Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/collection/3.aws_iamscan.md b/docs/accessanalyzer/11.6/solutions/aws/collection/3.aws_iamscan.md
index 5ae6ab2180..65f291b452 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/collection/3.aws_iamscan.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/collection/3.aws_iamscan.md
@@ -23,7 +23,7 @@ The 3.AWS_IAMScan job has the following configurable query:
### Configure the IAM Scan Query
The IAM Scan query in the 3.AWS_IAMScan job has been preconfigured to run with the default settings
-with the category of Collect IAM Data. Follow the steps to set any desired customizations.
+with the category of Collect IAM Data. To set any desired customizations:
**Step 1 –** Navigate to the **AWS** > **0.Collection** > **3.AWS_IAMScan** > **Configure** node and
select the **Queries** node.
@@ -55,7 +55,7 @@ View the analysis tasks by navigating to the **AWS** > **0.Collection** > **3.AW
**Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/collection/4.aws_s3sddscan.md b/docs/accessanalyzer/11.6/solutions/aws/collection/4.aws_s3sddscan.md
index 6ccd9bcc25..15e9750c77 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/collection/4.aws_s3sddscan.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/collection/4.aws_s3sddscan.md
@@ -22,8 +22,8 @@ The 4.AWS_S3SDDScan job has the following configurable query:
### Configure the AWS S3 Sensitive Data Scan Query
The AWS S3 Sensitive Data Scan query in the 4.AWS_S3SDDScan job has been preconfigured to run with
-the default settings with the category of Collect SDD Data. Follow the steps to set any desired
-customizations.
+the default settings with the category of Collect SDD Data. To set any desired
+customizations:
**Step 1 –** Navigate to the **AWS** > **0.Collection** > **4.AWS_S3SDD Scan** > **Configure** node
and select the **Queries** node.
@@ -96,7 +96,7 @@ View the analysis tasks by navigating to the **AWS** > **0.Collection** > **4.AW
**Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/collection/overview.md b/docs/accessanalyzer/11.6/solutions/aws/collection/overview.md
index 7618ed66fa..e763389ea0 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/collection/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/collection/overview.md
@@ -19,6 +19,6 @@ The 0.Collection Job Group is comprised of:
- [2.AWS_S3Scan Job](/docs/accessanalyzer/11.6/solutions/aws/collection/2.aws_s3scan.md)
– Collects details about the AWS S3 buckets including details about the objects in those buckets
- [3.AWS_IAMScan Job](/docs/accessanalyzer/11.6/solutions/aws/collection/3.aws_iamscan.md)
- – Collects details about users, groups, policies, roles and other IAM related identities
+ – Collects details about users, groups, policies, roles, and other IAM related identities
- [4.AWS_S3SDDScan Job](/docs/accessanalyzer/11.6/solutions/aws/collection/4.aws_s3sddscan.md)
– Collects details about S3 objects containing sensitive data
diff --git a/docs/accessanalyzer/11.6/solutions/aws/groups/aws_groupmembers.md b/docs/accessanalyzer/11.6/solutions/aws/groups/aws_groupmembers.md
index 8d2ecefc24..ffce0c7067 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/groups/aws_groupmembers.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/groups/aws_groupmembers.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **3.Groups** > **AWS_GroupMembers** > **Configure** no
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/groups/aws_nopolicygroups.md b/docs/accessanalyzer/11.6/solutions/aws/groups/aws_nopolicygroups.md
index 9863da016e..3ec1b9195a 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/groups/aws_nopolicygroups.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/groups/aws_nopolicygroups.md
@@ -14,7 +14,7 @@ Navigate to the **AWS** > **3.Groups** > **AWS_NoPolicyGroups** > **Configure**
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -35,4 +35,4 @@ produces the following preconfigured report:
| Report | Description | Default Tags | Report Element |
| ----------------------- | ----------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Groups With No Policies | This report identifies groups that do not have a policy assigned. | None | This report is comprised of the following elements: - Stacked Bar Chart – Displays top accounts by no policy group counts
- Table – Shows no policy groups by accounts
- Table – Provides details on no policy groups
|
+| Groups With No Policies | This report identifies groups that don't have a policy assigned. | None | This report is comprised of the following elements: - Stacked Bar Chart – Displays top accounts by no policy group counts
- Table – Shows no policy groups by accounts
- Table – Provides details on no policy groups
|
diff --git a/docs/accessanalyzer/11.6/solutions/aws/groups/aws_stalegroups.md b/docs/accessanalyzer/11.6/solutions/aws/groups/aws_stalegroups.md
index d1f3d123fa..2e0fdebfa7 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/groups/aws_stalegroups.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/groups/aws_stalegroups.md
@@ -11,14 +11,14 @@ definition for staleness is set by default to 60 days. This can be configured.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+The Configuration section on a Job's overview page lets you modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
The AWS_StaleGroups job has the following configurable parameter:
-- Days without login to consider an account stale
+- Days without log in to consider an account stale
See the
[Customizable Analysis Tasks for the AWS_StaleGroups Job](#customizable-analysis-tasks-for-the-aws_stalegroups-job)
@@ -30,7 +30,7 @@ Navigate to the **AWS** > **3.Groups** > **AWS_StaleGroups** > **Configure** nod
**Analysis** to view the analysis tasks.
:::warning
-Do not deselect the selected analysis tasks. The analysis tasks are preconfigured for
+Don't deselect the selected analysis tasks. The analysis tasks are preconfigured for
this job. Only modify the analysis tasks listed in the customizable analysis tasks section.
:::
@@ -42,7 +42,7 @@ The following analysis tasks are selected by default:
- Stale Group Details – Highlights the staleness of users in AWS groups. Creates the
AWS_StaleGroup_Details table accessible under the job’s Results node.
- - The number of days without login to consider an account stale can be customized. By default it
+ - The number of days without log in to consider an account stale can be customized. By default it
is set to 60. See the
[Customizable Analysis Tasks for the AWS_StaleGroups Job](#customizable-analysis-tasks-for-the-aws_stalegroups-job)
topic for additional information.
@@ -57,7 +57,7 @@ The default values for parameters that can be customized are:
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
| ------------------- | --------------------------- | ------------- | ----------------------------------------------- |
-| Stale Group Details | @StaleThreshold | 60 | Days without login to consider an account stale |
+| Stale Group Details | @StaleThreshold | 60 | Days without log in to consider an account stale |
See the
[Configure the Customizable Parameters in an Analysis Task](/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md)
diff --git a/docs/accessanalyzer/11.6/solutions/aws/organizations/aws_accounts.md b/docs/accessanalyzer/11.6/solutions/aws/organizations/aws_accounts.md
index 1cb32163ad..183afb6aa7 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/organizations/aws_accounts.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/organizations/aws_accounts.md
@@ -17,7 +17,7 @@ Navigate to the **AWS** > **1.Organizations** > **AWS_Accounts** > **Configure**
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/organizations/aws_memberaccountusers.md b/docs/accessanalyzer/11.6/solutions/aws/organizations/aws_memberaccountusers.md
index da09d1e711..36b26ac95c 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/organizations/aws_memberaccountusers.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/organizations/aws_memberaccountusers.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# AWS_MemberAccountUsers Job
-The AWS_MemberAccountUsers job highlights users that are not located in the primary AWS Identity
+The AWS_MemberAccountUsers job highlights users that aren't located in the primary AWS Identity
Source, which is generally the Master AWS Account for the Organization.
## Analysis Tasks for the AWS_MemberAccountUsers Job
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **1.Organizations** > **AWS_MemberAccountUsers** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -36,4 +36,4 @@ produces the following preconfigured report:
| Report | Description | Default Tags | Report Element |
| -------------------- | -------------------------------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Member Account Users | This report highlights user accounts that are not contained in the AWS Master Account. | None | This report is comprised of the following elements: - Stacked Bar Chart – Displays top member account users by org
- Table – Shows member account users by Org
- Table – Provides details on member account users
|
+| Member Account Users | This report highlights user accounts that aren't contained in the AWS Master Account. | None | This report is comprised of the following elements: - Stacked Bar Chart – Displays top member account users by org
- Table – Shows member account users by Org
- Table – Provides details on member account users
|
diff --git a/docs/accessanalyzer/11.6/solutions/aws/organizations/overview.md b/docs/accessanalyzer/11.6/solutions/aws/organizations/overview.md
index f2dcf21188..197e1ce4b5 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/organizations/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/organizations/overview.md
@@ -19,5 +19,5 @@ The 1.Organizations job jroup is comprised of:
manually by adding a line for each Organization in the temporary table #IdentitySourceAccount in
the analysis task parameters for this job.
- [AWS_MemberAccountUsers Job](/docs/accessanalyzer/11.6/solutions/aws/organizations/aws_memberaccountusers.md)
- – Highlights users that are not located in the primary AWS Identity Source, which is generally the
+ – Highlights users that aren't located in the primary AWS Identity Source, which is generally the
Master AWS Account for the Organization
diff --git a/docs/accessanalyzer/11.6/solutions/aws/overview.md b/docs/accessanalyzer/11.6/solutions/aws/overview.md
index 51f1a65efe..b2c4c0248f 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/overview.md
@@ -6,9 +6,9 @@ sidebar_position: 70
# AWS Solution
-Enterprise Auditor for AWS allows organizations to secure their data residing in Amazon Web Services
-(AWS) S3 platform, reducing their risk exposure through proactive, automated auditing and reporting
-of S3 permissions, sensitive data, and ultimately a consolidated view of user access rights across
+Enterprise Auditor for AWS helps organizations secure data stored in the Amazon Web Services
+(AWS) S3 platform. It reduces risk exposure through proactive, automated auditing and reporting
+of S3 permissions and sensitive data, giving you a consolidated view of user access rights across
dozens of structured and unstructured data resources both on-premises and in the cloud.
The AWS Solution is designed to provide information about data access such as:
@@ -17,10 +17,10 @@ The AWS Solution is designed to provide information about data access such as:
- Who is accessing your data
- What sensitive data is being stored and accessed
-The AWS Solution provides the ability to audit AWS IAM and S3. Enterprise Auditor uses the AWS
+The AWS Solution lets you audit AWS IAM and S3. Enterprise Auditor uses the AWS
solution to collect IAM users, groups, roles, and policies, as well as S3 permissions, content, and
sensitive data from target AWS accounts. The solution requires a special Enterprise Auditor license.
-It can be focused to only conduct auditing of AWS IAM. Additionally, the Sensitive Data Discovery
+You can focus it to audit only AWS IAM. Additionally, the Sensitive Data Discovery
Add-On enables the solution to search AWS S3 content for sensitive data.
**Supported Platforms**
@@ -37,16 +37,16 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
-then an extra 16 GB of RAM are required (8x2=16).
+which enables Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans,
+increase the minimum amount of RAM. Each thread requires a minimum of 2
+additional GB of RAM per host. For example, if you configure the job to scan 8 hosts at a time,
+it requires an extra 16 GB of RAM (8 x 2 = 16).
:::note
-The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
-configuration; it has been preconfigured to work with Enterprise Auditor and should never be
-customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
+The Sensitive Data Discovery Add-on installation package installs the appropriate Java
+Development Kit (JDK) version on the server. The deployed JDK is prepackaged and doesn't require
+any configuration; it comes preconfigured to work with Enterprise Auditor. Don't customize it
+through Java. It won't conflict with other JDKs or Java Runtimes in the same
environment.
:::
@@ -58,7 +58,7 @@ Enterprise Auditor Instant Job Wizard. See the
[Instant Job Wizard](/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md)
topic for information on installing instant solutions from the Enterprise Auditor Library.
-Once it has been installed into the Jobs tree, navigate to the solution: **Jobs** > **AWS**.
+After it has been installed into the Jobs tree, navigate to the solution: **Jobs** > **AWS**.
## Job Groups
diff --git a/docs/accessanalyzer/11.6/solutions/aws/policies/aws_custommanagedpolicies.md b/docs/accessanalyzer/11.6/solutions/aws/policies/aws_custommanagedpolicies.md
index c572cbdcd5..eba8e250fd 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/policies/aws_custommanagedpolicies.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/policies/aws_custommanagedpolicies.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **5.Policies** > **AWS_CustomManagedPolicies** > **Con
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/policies/aws_inlinepolicies.md b/docs/accessanalyzer/11.6/solutions/aws/policies/aws_inlinepolicies.md
index f77fe04a05..92673ceb2d 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/policies/aws_inlinepolicies.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/policies/aws_inlinepolicies.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **5.Policies** > **AWS_InlinePolicies** > **Configure*
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/policies/aws_managedpolicies.md b/docs/accessanalyzer/11.6/solutions/aws/policies/aws_managedpolicies.md
index 73aa0a4c6d..247bb3852c 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/policies/aws_managedpolicies.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/policies/aws_managedpolicies.md
@@ -14,7 +14,7 @@ Navigate to the **AWS** > **5.Policies** > **AWS_ManagedPolicies** > **Configure
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/policies/aws_sensitivepolicies.md b/docs/accessanalyzer/11.6/solutions/aws/policies/aws_sensitivepolicies.md
index 80bbaa301a..c012ae1dba 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/policies/aws_sensitivepolicies.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/policies/aws_sensitivepolicies.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **5.Policies** > **AWS_SensitivePolicies** > **Configu
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/policies/aws_unusedmanagedpolicies.md b/docs/accessanalyzer/11.6/solutions/aws/policies/aws_unusedmanagedpolicies.md
index 30e1bb42fb..f0d13e382e 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/policies/aws_unusedmanagedpolicies.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/policies/aws_unusedmanagedpolicies.md
@@ -12,7 +12,7 @@ analysis task.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+The Configuration section on a Job's overview page lets you modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -31,7 +31,7 @@ Navigate to the **AWS** > **5.Policies** > **AWS_UnusedManagedPolicies** > **Con
select **Analysis** to view the analysis tasks.
:::warning
-Do not deselect the selected analysis tasks. The analysis tasks are preconfigured for
+Don't deselect the selected analysis tasks. The analysis tasks are preconfigured for
this job. Only modify the analysis tasks listed in the customizable analysis tasks section.
:::
@@ -69,4 +69,4 @@ produces the following preconfigured report:
| Report | Description | Default Tags | Report Element |
| ----------------------- | --------------------------------------------------------------------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Unused Managed Policies | This report identifies policies that are not assigned to any group or user. | None | This report is comprised of the following elements: - Stacked Bar Chart – Displays unused managed policies by account
- Table – Shows unused managed policies by account
- Table – Provides details on unused managed policies
|
+| Unused Managed Policies | This report identifies policies that aren't assigned to any group or user. | None | This report is comprised of the following elements: - Stacked Bar Chart – Displays unused managed policies by account
- Table – Shows unused managed policies by account
- Table – Provides details on unused managed policies
|
diff --git a/docs/accessanalyzer/11.6/solutions/aws/policies/aws_userpolicies.md b/docs/accessanalyzer/11.6/solutions/aws/policies/aws_userpolicies.md
index fb6674f5b0..e3b502dd5e 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/policies/aws_userpolicies.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/policies/aws_userpolicies.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **5.Policies** > **AWS_UserPolicies** > **Configure**
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/recommended.md b/docs/accessanalyzer/11.6/solutions/aws/recommended.md
index 1ac9319ac8..53f4de1ec5 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/recommended.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Recommended Configuration for the AWS Solution
The AWS Solution is configured to inherit settings from the global Settings node. The Connection
-Profile must be assigned before job execution. Once it is assigned to the job group, it can be run
+Profile must be assigned before job execution. After it is assigned to the job group, it can be run
directly or scheduled.
**Dependencies**
@@ -31,25 +31,25 @@ For AWS S3 Sensitive Data Discovery Auditing:
[Sensitive Data Discovery Add-On Installation](/docs/accessanalyzer/11.6/install/sensitivedatadiscovery/overview.md)
topic for additional information
-Some of the 0.Collection job group queries can be scoped to target specific S3 Objects. However, it
-is necessary for the SA_AWS_Instances table to be populated before attempting to scope the queries.
-Therefore, the AWS_S3Scan job must be manually executed before attempting to scope the S3 queries.
+Some of the 0.Collection job group queries can be scoped to target specific S3 Objects. However, the
+SA_AWS_Instances table must be populated before you scope the queries. Therefore, run the
+AWS_S3Scan job manually before you scope the S3 queries.
**Target Host**
-The AWS Data Collector identifies AWS instances via the created Roles and therefore does not require
+The AWS Data Collector identifies AWS instances via the created Roles and therefore doesn't require
a host list to be assigned. No target host is required (assign Local Host).
**Connection Profile**
The AWS Data Collector requires a specific set of permissions. The account used can be either a Web
-Services (JWT) account or an Amazon Web Services account. Once the account has been provisioned,
+Services (JWT) account or an Amazon Web Services account. After the account has been provisioned,
create a custom Connection Profile containing the credentials for the targeted environment. See the
[Amazon Web Services for User Credentials](/docs/accessanalyzer/11.6/admin/settings/connection/create/aws.md)
topic for additional information.
The Connection Profile is assigned under the **AWS** > **Settings** > **Connection** node. It is set
-to **Use Default Profile**, as configured at the global Settings level. However, if this is not the
+to **Use Default Profile**, as configured at the global Settings level. However, if this isn't the
Connection Profile with the necessary permissions for targeting the AWS instances, click the
**Select one of the following user defined profiles** option and select the appropriate Connection
Profile.
@@ -60,16 +60,16 @@ topic for additional information on creating a Connection Profile.
**Access Token**
-Creating the Connection Profile requires having the **Access Key ID** and the **Secret Access Key**
-that was generated by the Amazon Web Services application. See the
+To create the Connection Profile, you need the **Access Key ID** and the **Secret Access Key**
+that the Amazon Web Services application generated. See the
[Configure AWS for Scans](/docs/accessanalyzer/11.6/requirements/aws/configurescans.md)
topic for additional information.
**Schedule Frequency**
Schedule the AWS job group to run weekly or daily, depending on the amount of data in the
-environment. If there are frequent AWS changes within the target environment, then it can be
-executed more often. It is best to rerun it anytime AWS changes might have occurred.
+environment. If there are frequent AWS changes within the target environment, you can run it
+more often. It is best to rerun it anytime AWS changes might have occurred.
**History Retention**
diff --git a/docs/accessanalyzer/11.6/solutions/aws/roles/aws_roles.md b/docs/accessanalyzer/11.6/solutions/aws/roles/aws_roles.md
index 5bf92f8b2a..7e0971842f 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/roles/aws_roles.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/roles/aws_roles.md
@@ -14,7 +14,7 @@ Navigate to the **AWS** > **4.Roles** > **AWS_Roles** > **Configure** node and s
to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/roles/aws_staleroles.md b/docs/accessanalyzer/11.6/solutions/aws/roles/aws_staleroles.md
index 004ed1a065..4dae5d687a 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/roles/aws_staleroles.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/roles/aws_staleroles.md
@@ -6,20 +6,20 @@ sidebar_position: 20
# AWS_StaleRoles Job
-The AWS_StaleRoles job provides details on roles that are considered stale. Highlighting roles that
-have not been used in more than 60 days and those that have never been used. The 60 day parameter is
+The AWS_StaleRoles job provides details on roles that are considered stale, highlighting roles that
+haven't been used in more than 60 days and those that have never been used. The 60 day parameter is
configurable.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+The Configuration section on a Job's overview page lets you modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
The AWS_StaleRoles job has the following configurable parameter:
-- Days without login to consider an account stale
+- Days without log in to consider an account stale
See the
[Customizable Analysis Tasks for the AWS_StaleRoles Job](#customizable-analysis-tasks-for-the-aws_staleroles-job)
@@ -31,7 +31,7 @@ Navigate to the **AWS** > **4.Roles** > **AWS_StaleRoles** > **Configure** node
**Analysis** to view the analysis tasks.
:::warning
-Do not deselect the selected analysis tasks. The analysis tasks are preconfigured for
+Don't deselect the selected analysis tasks. The analysis tasks are preconfigured for
this job. Only modify the analysis tasks listed in the customizable analysis tasks section.
:::
@@ -43,7 +43,7 @@ The following analysis tasks are selected by default:
- Stale Role Details – Highlights the roles in AWS that are considered stale. Creates the
AWS_StaleRole_Details table accessible under the job’s Results node.
- - The number of days without login to consider an account stale can be customized. By default it
+ - The number of days without log in to consider an account stale can be customized. By default it
is set to 60. See the
[Customizable Analysis Tasks for the AWS_StaleRoles Job](#customizable-analysis-tasks-for-the-aws_staleroles-job)
topic for additional information.
@@ -57,7 +57,7 @@ The default values for parameters that can be customized are:
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
| ------------------ | --------------------------- | ------------- | ------------------------------------------------ |
-| Stale Role Details | @StaleThreshold | 60 | Days without login to consider an account stale. |
+| Stale Role Details | @StaleThreshold | 60 | Days without log in to consider an account stale. |
See the
[Configure the Customizable Parameters in an Analysis Task](/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md)
diff --git a/docs/accessanalyzer/11.6/solutions/aws/roles/overview.md b/docs/accessanalyzer/11.6/solutions/aws/roles/overview.md
index 79d33702fd..5c833d6853 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/roles/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/roles/overview.md
@@ -15,5 +15,5 @@ The 4.Roles job group is comprised of:
- [AWS_Roles Job](/docs/accessanalyzer/11.6/solutions/aws/roles/aws_roles.md)
– Provides details on roles in the AWS IAM environment
- [AWS_StaleRoles Job](/docs/accessanalyzer/11.6/solutions/aws/roles/aws_staleroles.md)
- – Provides details on roles that are considered stale. Highlighting roles that have not been used
+ – Provides details on roles that are considered stale, highlighting roles that haven't been used
in more than 60 days and those that have never been used.
diff --git a/docs/accessanalyzer/11.6/solutions/aws/s3content/aws_s3buckets.md b/docs/accessanalyzer/11.6/solutions/aws/s3content/aws_s3buckets.md
index 2321c25df7..54cd40d914 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/s3content/aws_s3buckets.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/s3content/aws_s3buckets.md
@@ -14,7 +14,7 @@ Navigate to the **AWS** > **7.S3 Content** > **AWS_S3Buckets** > **Configure** n
**Analysis** to view the analysis task.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/s3content/aws_s3buckettags.md b/docs/accessanalyzer/11.6/solutions/aws/s3content/aws_s3buckettags.md
index 9a5a9c8488..6375ecf74d 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/s3content/aws_s3buckettags.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/s3content/aws_s3buckettags.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **7.S3 Content** > **AWS_S3BucketTags** > **Configure*
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/s3permissions/aws_brokeninheritance.md b/docs/accessanalyzer/11.6/solutions/aws/s3permissions/aws_brokeninheritance.md
index 6e1ddedc0f..4f8665efe9 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/s3permissions/aws_brokeninheritance.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/s3permissions/aws_brokeninheritance.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **6.S3 Permissions** > **AWS_BrokenInheritance** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/s3permissions/aws_effectivepermissions.md b/docs/accessanalyzer/11.6/solutions/aws/s3permissions/aws_effectivepermissions.md
index b8f5fa5160..e1f93554d6 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/s3permissions/aws_effectivepermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/s3permissions/aws_effectivepermissions.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **6.S3 Permissions** > **AWS_EffectivePermissions** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/s3permissions/aws_openbuckets.md b/docs/accessanalyzer/11.6/solutions/aws/s3permissions/aws_openbuckets.md
index 95196c3989..f7a3e9f687 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/s3permissions/aws_openbuckets.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/s3permissions/aws_openbuckets.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **6.S3 Permissions** > **AWS_OpenBuckets** > **Configu
**Analysis** to view the analysis task.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/sensitivedata/aws_sensitivedata.md b/docs/accessanalyzer/11.6/solutions/aws/sensitivedata/aws_sensitivedata.md
index 62af019e74..f39192555e 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/sensitivedata/aws_sensitivedata.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/sensitivedata/aws_sensitivedata.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **8.S3 Sensitive Data** > **AWS_SensitiveData** > **Co
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/sensitivedata/aws_sensitivedata_permissions.md b/docs/accessanalyzer/11.6/solutions/aws/sensitivedata/aws_sensitivedata_permissions.md
index e6f4bef4e7..9c21d5b586 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/sensitivedata/aws_sensitivedata_permissions.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/sensitivedata/aws_sensitivedata_permissions.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **8.S3 Sensitive Data** > **AWS_SensitiveData_Permissi
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/users/aws_accesskeys.md b/docs/accessanalyzer/11.6/solutions/aws/users/aws_accesskeys.md
index d5c6af5a1d..c5bfc1f9f0 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/users/aws_accesskeys.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/users/aws_accesskeys.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **2.Users** > **AWS_AccessKeys** > **Configure** node
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/users/aws_mfastatus.md b/docs/accessanalyzer/11.6/solutions/aws/users/aws_mfastatus.md
index 0a152a3939..392d4efad6 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/users/aws_mfastatus.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/users/aws_mfastatus.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **2.Users** > **AWS_MFAStatus** > **Configure** node a
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/users/aws_rootaccounts.md b/docs/accessanalyzer/11.6/solutions/aws/users/aws_rootaccounts.md
index 4dc182a0f8..7ac67b26ea 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/users/aws_rootaccounts.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/users/aws_rootaccounts.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **2.Users** > **AWS_RootAccounts** > **Configure** nod
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/aws/users/aws_staleusers.md b/docs/accessanalyzer/11.6/solutions/aws/users/aws_staleusers.md
index f3ffd13f26..4e52c163e8 100644
--- a/docs/accessanalyzer/11.6/solutions/aws/users/aws_staleusers.md
+++ b/docs/accessanalyzer/11.6/solutions/aws/users/aws_staleusers.md
@@ -11,7 +11,7 @@ used, highlighting those over specified number of days (default 60) or that have
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+The Configuration section on a Job's overview page lets you modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -30,7 +30,7 @@ Navigate to the **AWS** > **2.Users** > **AWS_StaleUsers** > **Configure** node
**Analysis** to view the analysis tasks.
:::warning
-Do not deselect the selected analysis tasks. The analysis tasks are preconfigured for
+Don't deselect the selected analysis tasks. The analysis tasks are preconfigured for
this job. Only modify the analysis tasks listed in the customizable analysis tasks section.
:::
@@ -39,7 +39,7 @@ this job. Only modify the analysis tasks listed in the customizable analysis tas
The following analysis tasks are selected by default:
-- Stale Users – Identifies user accounts that have not been logged in to in the last 60 days.
+- Stale Users – Identifies user accounts that have not logged in during the last 60 days.
Creates the AWS_StaleUser_Details table accessible under the job’s Results node.
- The number of days can be customized from the default value of 60. See the
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_deletions.md b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_deletions.md
index 7f02069345..63e945e5ae 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_deletions.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_deletions.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Forensics** > **Box_Deletions** > **Con
select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_downloads.md b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_downloads.md
index a761c01b0d..7852e55b4e 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_downloads.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_downloads.md
@@ -15,7 +15,7 @@ Navigate to **Box** > **1.Activity** > **Forensics** > **Box_Downloads** > **Con
select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_externaluseractivity.md b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_externaluseractivity.md
index 53363675c7..a750a1d7fc 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_externaluseractivity.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_externaluseractivity.md
@@ -17,7 +17,7 @@ Navigate to **Box** > **1.Activity** > **Forensics** > **Box_ExternalUserActivit
node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_externalusercollaborations.md b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_externalusercollaborations.md
index 78a5fff721..fa96b398aa 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_externalusercollaborations.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_externalusercollaborations.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Forensics** > **Box_ExternalUserCollabo
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_permissionchanges.md b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_permissionchanges.md
index a8d7053430..82251dfd5a 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_permissionchanges.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_permissionchanges.md
@@ -15,7 +15,7 @@ Navigate to **Box** > **1.Activity** > **Forensics** > **Box_PermissionChanges**
node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_sharing.md b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_sharing.md
index 6efc486ab4..d4a87de329 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_sharing.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_sharing.md
@@ -14,7 +14,7 @@ Navigate to **Box** > **1.Activity** > **Forensics** > **Box_Sharing** > **Confi
select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/overview.md b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/overview.md
index 61f097bcd6..d9ebc48e58 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/forensics/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/forensics/overview.md
@@ -8,7 +8,7 @@ sidebar_position: 10
The Forensics Job Group highlights deletions, file downloads, permissions changes, external user
activity, collaboration activity and high-risk collaborations within the targeted Box environment.
-It is dependent on data collected by the 0.Collection Job Group, also housed in the Box Job Group.
+It depends on data collected by the 0.Collection Job Group, also housed in the Box Job Group.
The jobs that comprise the 1.Activity Job Group process analysis tasks and generate a report.
@@ -23,7 +23,7 @@ The Forensics Job Group is comprised of:
– Identifies and analyzes external user activity which has occurred over the past 30 days
- [Box_ExternalUserCollaborations Job](/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_externalusercollaborations.md)
– Identifies collaboration invites sent to external users. These collaborations should be reviewed
- to ensure sensitive data is not being shared outside of your organization.
+ to ensure sensitive data isn't being shared outside of your organization.
- [Box_PermissionChanges Job](/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_permissionchanges.md)
– Provides details on permission changes that have occurred over the past 30 days
- [Box_Sharing Job](/docs/accessanalyzer/11.6/solutions/box/activity/forensics/box_sharing.md)
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_failedlogins.md b/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_failedlogins.md
index bc98ff2534..bab6450c17 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_failedlogins.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_failedlogins.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Suspicious Activity** > **Box_FailedLog
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_firsttimefolderaccess.md b/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_firsttimefolderaccess.md
index 2db8168705..6227531eaa 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_firsttimefolderaccess.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_firsttimefolderaccess.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Box** > **1.Activity** > **Suspic
**Box_FirstTimeFolderAccess** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_unusualdownloadactivity.md b/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_unusualdownloadactivity.md
index 05cb379a03..fd0d2d32cc 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_unusualdownloadactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_unusualdownloadactivity.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Suspicious Activity** > **Box_UnusualDo
**Configure** node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -33,4 +33,4 @@ produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Unusual Download Activity | This report provides insight into download activity that deviates from the normal range of expected downloads. This is determined by using historical data for each file. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 most recent unusual download activity
- Table – Provides details on unusual download activity
|
+| Unusual Download Activity | This report provides insight into download activity that deviates from the normal range of expected downloads. This is determined by using historical data for each file. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 most recent unusual download activity
- Table – Provides details on unusual download activity
|
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_unusualuseractivity.md b/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_unusualuseractivity.md
index 1774bb9acc..19cb96bc30 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_unusualuseractivity.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_unusualuseractivity.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Suspicious Activity** > **Box_UnusualUs
**Configure** node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -33,4 +33,4 @@ pre-configured report:
| Report | Description | Default Tags | Report Elements |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Unusual User Activity | This report provides insight into user activity that deviates from the normal range of expected activity. This is determined by using historical data for each user. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 most recent unusual user activity
- Table – Provides details on unusual user activity
|
+| Unusual User Activity | This report provides insight into user activity that deviates from the normal range of expected activity. This is determined by using historical data for each user. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 most recent unusual user activity
- Table – Provides details on unusual user activity
|
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_weekendactivity.md b/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_weekendactivity.md
index c7924e7ab7..bb2e5e16f1 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_weekendactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/suspiciousactivity/box_weekendactivity.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Suspicious Activity** > **Box_WeekendAc
**Configure** node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/usagestatistics/box_folders_mostactive.md b/docs/accessanalyzer/11.6/solutions/box/activity/usagestatistics/box_folders_mostactive.md
index 06eec4748d..0291f6b7b9 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/usagestatistics/box_folders_mostactive.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/usagestatistics/box_folders_mostactive.md
@@ -15,7 +15,7 @@ Navigate to **Box** > **1.Activity** > **Usage Statistics** > **Box_Folders_Most
**Configure** node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/usagestatistics/box_folders_stale.md b/docs/accessanalyzer/11.6/solutions/box/activity/usagestatistics/box_folders_stale.md
index 21185f5f7c..c9cccf481b 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/usagestatistics/box_folders_stale.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/usagestatistics/box_folders_stale.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Usage Statistics** > **Box_Folders_Stal
node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/activity/usagestatistics/box_users_mostactive.md b/docs/accessanalyzer/11.6/solutions/box/activity/usagestatistics/box_users_mostactive.md
index d5a9eaa41b..050a6f00ab 100644
--- a/docs/accessanalyzer/11.6/solutions/box/activity/usagestatistics/box_users_mostactive.md
+++ b/docs/accessanalyzer/11.6/solutions/box/activity/usagestatistics/box_users_mostactive.md
@@ -15,7 +15,7 @@ Navigate to **Box** > **1.Activity** > **Usage Statistics** > **Box_Users_MostAc
**Configure** node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/box_access.md b/docs/accessanalyzer/11.6/solutions/box/box_access.md
index 517c7610cf..ec234621b3 100644
--- a/docs/accessanalyzer/11.6/solutions/box/box_access.md
+++ b/docs/accessanalyzer/11.6/solutions/box/box_access.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# Box_Access Job
The Box_Access Job analyzes access granted to users and groups in an organization's Box environment
-in order to report on effective access rights, file-level permissions, and inactive access rights
+to report on effective access rights, file-level permissions, and inactive access rights
that can be revoked.
## Analysis Tasks for the Box_Access Job
@@ -16,7 +16,7 @@ Navigate to **Box** > **Box_Access** > **Configure** node and select **Analysis*
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/box_groupmembership.md b/docs/accessanalyzer/11.6/solutions/box/box_groupmembership.md
index c6e3efd09c..edb8018763 100644
--- a/docs/accessanalyzer/11.6/solutions/box/box_groupmembership.md
+++ b/docs/accessanalyzer/11.6/solutions/box/box_groupmembership.md
@@ -15,7 +15,7 @@ Navigate to **Box** > **Box_GroupMembership** > **Configure** node and select **
analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/collection/1-box_access_scans.md b/docs/accessanalyzer/11.6/solutions/box/collection/1-box_access_scans.md
index a4e1f9477e..570929b948 100644
--- a/docs/accessanalyzer/11.6/solutions/box/collection/1-box_access_scans.md
+++ b/docs/accessanalyzer/11.6/solutions/box/collection/1-box_access_scans.md
@@ -6,24 +6,24 @@ sidebar_position: 10
# 1-Box_Access Scans Job
-The 1-Box_Access Scans Job collects the data which will be further analyzed in order to provide
+The 1-Box_Access Scans Job collects the data which will be further analyzed to provide
details on Box access rights, policies, configurations, and content.
## Queries for the 1-Box_Access Scans Job
The Scan Query uses the Box Data Collector to target all Box hosts and has been preconfigured to use
-the Scan Box Permissions Category. If this query is not configured but has the access token, a full
-scan of all folders at full depth is performed. Optionally, configure the query to limit the depth
+the Scan Box Permissions Category. If this query isn't configured but has the access token, the query
+performs a full scan of all folders at full depth. Optionally, configure the query to limit the depth
of the scan.
The 1-Box_Access Scans Job has the following queries:
-- Scan Query – Collects access data which will be further analyzed in order to provide details on
+- Scan Query – Collects access data which will be further analyzed to provide details on
Box access rights, policies, configurations, and content
-Prior to the first execution, it is necessary to authenticate to the targeted Box environment. This
+Before the first execution, authenticate to the targeted Box environment. This
is done on the Authenticate page of the Scan query. Additionally, the following default
configurations are commonly customized:
@@ -40,49 +40,49 @@ instructions.
### Configure the 1-Box_Access Scans Job
-The 1-Box_Access Scans Job contains the Scan Query. Follow the steps to configure the query.
+The 1-Box_Access Scans Job contains the Scan Query. To configure the query:
**Step 1 –** Navigate to the **Box** > **0.Collection** > **1-Box_Access Scans** > **Configure**
node and select **Queries**.
-**Step 1 –** In the Query Selection view, select the Scan Query and click **Query Properties**. The
+**Step 2 –** In the Query Selection view, select the Scan Query and click **Query Properties**. The
Query Properties window opens.
-**Step 2 –** Select the **Data Source** tab, and click **Configure**. The Box Data Collector Wizard
+**Step 3 –** Select the **Data Source** tab, and click **Configure**. The Box Data Collector Wizard
opens.
-**Step 3 –** On the Exclusions Page:
+**Step 4 –** On the Exclusions Page:
- Add folders to be excluded
- Add folders to be included (scope scan to only these folders)
-**Step 4 –** On the Additional Scoping page:
+**Step 5 –** On the Additional Scoping page:
- Optionally, select this option to limit the depth of the scan across the targeted Box account
-**Step 5 –** On the Scope By User Page:
+**Step 6 –** On the Scope By User Page:
- Optionally, limit the scope of the scan to specified users by providing a CSV file
-**Step 6 –** The Authenticate page is where the connection to the target Box environment is
+**Step 7 –** The Authenticate page is where the connection to the target Box environment is
configured. Click **Authorize** to launch the BoxLogin window and generate an authorization code.
This code allows Enterprise Auditor to report on the Box Enterprise.
:::note
-Authentication to the target Box environment only needs to be completed once, prior to the
+Authentication to the target Box environment only needs to be completed once, before the
first scan and only in one of the scan jobs.
:::
-**Step 7 –** Navigate to the Summary page, click **Finish** to save any setting modifications or
+**Step 8 –** Navigate to the Summary page, click **Finish** to save any setting modifications or
click **Cancel** if no changes were made. Then click **OK** to close the Query Properties window.
The 1-Box_Access Scans Job will execute according to the connection settings configuration.
diff --git a/docs/accessanalyzer/11.6/solutions/box/collection/1-box_activity_scans.md b/docs/accessanalyzer/11.6/solutions/box/collection/1-box_activity_scans.md
index 75e5edee31..6cbb24091c 100644
--- a/docs/accessanalyzer/11.6/solutions/box/collection/1-box_activity_scans.md
+++ b/docs/accessanalyzer/11.6/solutions/box/collection/1-box_activity_scans.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# 1-Box_Activity Scans Job
-The 1-Box_Activity Scans Job collects the data which will be further analyzed in order to provide
+The 1-Box_Activity Scans Job collects the data which will be further analyzed to provide
visibility into user activity events within Box.
## Queries for the 1-Box_Activity Scans Job
@@ -18,12 +18,12 @@ the Scan Box Permissions Category.
The 1-Box_Activity Scans Job has the following queries:
-- Activity Scan – Collects activity data which will be further analyzed in order to provide
+- Activity Scan – Collects activity data which will be further analyzed to provide
visibility into user activity events within Box.
-Prior to the first execution, it is necessary to authenticate to the targeted Box environment if
-this has not already been done when configuring the 1-Box_Access Scans Job. This is done on the
-Authenticate page of the Activity Scan query. Additionally, the following default configurations are
+Before the first execution, authenticate to the targeted Box environment if you haven't already done
+so while configuring the 1-Box_Access Scans Job. This is done on the Authenticate page of the
+Activity Scan query. Additionally, the following default configurations are
commonly customized:
- Exclusions page:
@@ -39,8 +39,8 @@ for instructions.
### Configure the 1-Box_Activity Scans Job
-The 1-Box_Activity Scans Job contains the Activity Scan Query. Follow the steps to configure the
-query.
+The 1-Box_Activity Scans Job contains the Activity Scan Query. To configure the
+query:
**Step 1 –** Navigate to the **Box** > **0.Collection** > **1-Box_Activity Scans** > **Configure**
node and select **Queries**.
@@ -90,7 +90,7 @@ configured. Click **Authorize** to launch the BoxLogin window and generate an au
This code allows Enterprise Auditor to report on the Box Enterprise.
:::note
-Authentication to the target Box environment only needs to be completed once, prior to the
+Authentication to the target Box environment only needs to be completed once, before the
first scan and only in one of the scan jobs.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/collection/2-box_import.md b/docs/accessanalyzer/11.6/solutions/box/collection/2-box_import.md
index fe89ebe8c3..a2832f43f5 100644
--- a/docs/accessanalyzer/11.6/solutions/box/collection/2-box_import.md
+++ b/docs/accessanalyzer/11.6/solutions/box/collection/2-box_import.md
@@ -7,8 +7,8 @@ sidebar_position: 30
# 2-Box_Import Job
The 2-Box_Import Job takes the data that has been collected from the 1-Box_Access Scans Job and the
-1-Box_Activity Scans Job and imports it to the Enterprise Auditor database to be analyzed in order
-to provide detailed reports on Box access rights, policies, configurations, activities, and content.
+1-Box_Activity Scans Job and imports it to the Enterprise Auditor database to be analyzed to provide
+detailed reports on Box access rights, policies, configurations, activities, and content.
## Queries for the 2-Box_Import Job
@@ -20,5 +20,5 @@ Permissions Category.
The 2-Box_Import Job has the following query:
- Import - Takes the data that has been collected from Box and imports it to the Enterprise Auditor
- database to be analyzed in order to provide detailed reports on Box access rights, policies,
+ database to be analyzed to provide detailed reports on Box access rights, policies,
configurations, activities, and content.
diff --git a/docs/accessanalyzer/11.6/solutions/box/collection/overview.md b/docs/accessanalyzer/11.6/solutions/box/collection/overview.md
index 735ebba523..c6e3b63b7a 100644
--- a/docs/accessanalyzer/11.6/solutions/box/collection/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/box/collection/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# 0.Collection Job Group
-The 0.Collection Job Group collects data which will be further analyzed in order to provide details
+The 0.Collection Job Group collects data which will be further analyzed to provide details
on Box access rights, policies, configurations, activities, and content.
@@ -14,12 +14,12 @@ on Box access rights, policies, configurations, activities, and content.
The 0.Collection Job Group is comprised of:
- [1-Box_Access Scans Job](/docs/accessanalyzer/11.6/solutions/box/collection/1-box_access_scans.md)
- – Collects the data which will be further analyzed in order to provide details on Box access
+ – Collects the data which will be further analyzed to provide details on Box access
rights, policies, configurations, and content
- [1-Box_Activity Scans Job](/docs/accessanalyzer/11.6/solutions/box/collection/1-box_activity_scans.md)
- – Collects the data which will be further analyzed in order to provide visibility into user
+ – Collects the data which will be further analyzed to provide visibility into user
activity events within Box
- [2-Box_Import Job](/docs/accessanalyzer/11.6/solutions/box/collection/2-box_import.md)
– Takes the data that has been collected from Box and imports it to the Enterprise Auditor
- database to be analyzed in order to provide detailed reports on Box access rights, policies,
+ database to be analyzed to provide detailed reports on Box access rights, policies,
configurations, activities, and content
diff --git a/docs/accessanalyzer/11.6/solutions/box/content/box_filemetrics.md b/docs/accessanalyzer/11.6/solutions/box/content/box_filemetrics.md
index d40b9eac91..7fb4f55c99 100644
--- a/docs/accessanalyzer/11.6/solutions/box/content/box_filemetrics.md
+++ b/docs/accessanalyzer/11.6/solutions/box/content/box_filemetrics.md
@@ -20,7 +20,7 @@ Navigate to **Box** > **2.Content** > **Box_FileMetrics** > **Configure** node a
**Analysis** to view analysis tasks.
:::warning
-Most of these analysis tasks should never be modified and never be deselected.
+Don't modify or deselect most of these analysis tasks.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/content/box_foldermetrics.md b/docs/accessanalyzer/11.6/solutions/box/content/box_foldermetrics.md
index 64d01c8a3a..22137ef40e 100644
--- a/docs/accessanalyzer/11.6/solutions/box/content/box_foldermetrics.md
+++ b/docs/accessanalyzer/11.6/solutions/box/content/box_foldermetrics.md
@@ -22,7 +22,7 @@ Navigate to **Box** > **2.Content** > **Box_FolderMetrics** > **Configure** node
**Analysis** to view analysis tasks.
:::warning
-Most of these analysis tasks should never be modified and never be deselected.
+Don't modify or deselect most of these analysis tasks.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/box/overview.md b/docs/accessanalyzer/11.6/solutions/box/overview.md
index c5427e87dc..c5b7248bf7 100644
--- a/docs/accessanalyzer/11.6/solutions/box/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/box/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 80
# Box Solution
The Box solution set contains jobs to provide visibility into Box access rights, policies,
-configurations, activities, and more, ensuring you never lose sight or control of your critical
-assets residing in Box.
+configurations, activities, and more, so you can monitor and control your critical assets residing in
+Box.
**Supported Platforms**
@@ -23,7 +23,7 @@ topic for additional information.
**Location**
The Box Solution requires a special Enterprise Auditor license. It can be installed from the Instant
-Job Wizard. Once it has been installed into the Jobs tree, navigate to the solution: **Jobs** >
+Job Wizard. After it has been installed into the Jobs tree, navigate to the solution: **Jobs** >
**Box**.
@@ -41,7 +41,7 @@ an organization's Box environment.
The Box Solution has the following job groups and jobs:
- [0.Collection Job Group](/docs/accessanalyzer/11.6/solutions/box/collection/overview.md)
- – Collects the data which will be further analyzed in order to provide details on Box access
+ – Collects the data which will be further analyzed to provide details on Box access
rights, policies, configurations, activities, and content
- [1.Activity Job Group](/docs/accessanalyzer/11.6/solutions/box/activity/overview.md)
– Identifies long term trends of activity providing insight into user activity, usage statistics,
@@ -50,7 +50,7 @@ The Box Solution has the following job groups and jobs:
– Analyzes and summarizes the content of the Box environment, highlighting users with the most
content as well as what type of content exists
- [Box_Access Job](/docs/accessanalyzer/11.6/solutions/box/box_access.md)
- – Analyzes access granted to users and groups in an organization's Box environment in order to
+ – Analyzes access granted to users and groups in an organization's Box environment to
report on effective access rights, file-level permissions, and inactive access rights that can be
revoked
- [Box_GroupMembership Job](/docs/accessanalyzer/11.6/solutions/box/box_groupmembership.md)
diff --git a/docs/accessanalyzer/11.6/solutions/box/recommended.md b/docs/accessanalyzer/11.6/solutions/box/recommended.md
index 1de3044c39..72e0c207b5 100644
--- a/docs/accessanalyzer/11.6/solutions/box/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/box/recommended.md
@@ -6,11 +6,11 @@ sidebar_position: 10
# Recommended Configurations for the Box Solution
-The jobs that run analysis tasks in the Box Solution requires the host list to be assigned.
+The jobs that run analysis tasks in the Box Solution require you to assign the host list.
**Dependencies**
-- The .Active Directory Inventory Job Group must be successfully run prior to running this Job Group
+- The .Active Directory Inventory Job Group must be successfully run before running this Job Group
- 2-Box_Import Job – Imports data collected by the 1-Box_Access Scans Job and 1-Box_Activity Scans
Job
@@ -20,20 +20,20 @@ The jobs that run analysis tasks in the Box Solution requires the host list to b
Within host inventory, the Box hosts will return a HostStatus of **Offline**.
-If multiple Enterprise_IDs are to be scanned, it is necessary to duplicate the jobs within the
-0.Collection Job Group for each target host. Since the 2-Box_Import Job must always be run after the
-1-Box_Access Scans Job and 1-Box_Activity Scans Job, it is a best practice to set up sub-job groups
-for each target named to identify the target, for example EMEA Box. Copying the jobs will append a
-number to the job’s name. Once authorization codes have been generated for each 1-Box_Access Scans
-Job and 1-Box_Activity Scans Job, then the solution can be scheduled to run as desired.
+To scan multiple Enterprise_IDs, duplicate the jobs within the 0.Collection Job Group for each target
+host. Since the 2-Box_Import Job must always run after the 1-Box_Access Scans Job and
+1-Box_Activity Scans Job, set up sub-job groups for each target, named to identify the target, for
+example EMEA Box. Copying the jobs will append a number to the job’s name. After you generate
+authorization codes for each 1-Box_Access Scans Job and 1-Box_Activity Scans Job, you can schedule
+the solution to run as desired.
**Connection Profile**
The Box Solution requires a specific credential for the Connection Profile which has access to the
-SA Installer location. It is also necessary to authenticate to the target Box environment, which is
-done through the Box Data Collector query configuration. An Enterprise Admin account (or Co-Admin
-account with permission to **Run new reports and access existing reports** enabled) credential is
-needed to generate an authorization code in the form of an Access Token. This can be done through
+SA Installer location. You must also authenticate to the target Box environment through the Box Data
+Collector query configuration. You need an Enterprise Admin account (or Co-Admin account with
+permission to **Run new reports and access existing reports** enabled) to generate an authorization
+code in the form of an Access Token. This can be done through
the query configuration either in the 1-Box_Access Scans Job’ Authentication wizard page or the
1-Box_Activity Scans Job’s Authentication wizard page of the Box Data Collector Wizard. See the
[Box Data Collector](/docs/accessanalyzer/11.6/admin/datacollector/box/overview.md)
@@ -43,7 +43,7 @@ topic for additional information.
The Access Token is valid for 60 days. If Box scans are running on a regular schedule, then the
Access Token automatically refreshes once an hour. However, if it has been more than 60 days since
-the last scan, it is necessary to regenerate the Access Token.
+the last scan, regenerate the Access Token.
**Schedule Frequency**
@@ -57,15 +57,15 @@ This solution can be run with the default query configuration. However, the foll
- 1-Box_Access Scans Scan query
- 1-Box_Activity Scans Activity Scan query
-The Box_Import Job's Import query is preconfigured to run a full import and should not be modified.
+The Box_Import Job's Import query is preconfigured to run a full import and shouldn't be modified.
**Analysis Configuration**
This solution can be run with the default analysis configuration. However, the following parameters
can be modified:
-- The @STALETHRESHOLD parameter determines the number of days after which content is considered
- stale. It is set to default of 30 days. The @STALETHRESHOLD parameter can be customized in the
+- The @STALETHRESHOLD parameter determines the number of days after which the job considers content
+ stale. It defaults to 30 days. The @STALETHRESHOLD parameter can be customized in the
following analysis tasks:
- 2.Content > Box_FileMetrics in the File Metrics Details analysis task
- 2.Content > Box_FolderMetrics Folder in the Metrics Details analysis task
@@ -78,8 +78,7 @@ can be modified:
depth.
**Step 3 –** In the 1-Box_Access Scans Job, configure the Scan query to generate an authentication
-code to authenticate to the targeted Box environment. This step only needs to be run prior to the
-first scan.
+code to authenticate to the targeted Box environment. Run this step only before the first scan.
**Step 4 –** (Optional) Modify analysis task parameters for the reporting jobs.
diff --git a/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_configuration.md b/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_configuration.md
index a673a52350..513d58dd63 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_configuration.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_configuration.md
@@ -21,12 +21,12 @@ The query is:
## Recommended Configuration for the Configuration Query
-Prior to running an Db2 0.Collection query, you must establish a connection to the appropriate IBM
-Db2 server. As long as that connection is set up first, it is recommended that no configuration
-changes be made to the 0.Collection jobs before they run.
+Before running an Db2 0.Collection query, you must establish a connection to the appropriate IBM
+Db2 server. As long as that connection is set up first, don't make configuration
+changes to the 0.Collection jobs before they run.
It is also recommended that the connection only be established for the 1-Db2 SensitiveDataScan Job.
-Once the connection is established, it applies to all jobs in the 0.Collection job group. It does
+After the connection is established, it applies to all jobs in the 0.Collection job group. It does
not apply to any other job groups. For additional information on establishing a database connection,
see
[1-Db2_SensitiveDataScan](/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_sensitivedatascan.md).
diff --git a/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_permissionscan.md b/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_permissionscan.md
index 7826540635..919bd54af6 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_permissionscan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_permissionscan.md
@@ -13,7 +13,7 @@ This job collects Db2 database level permissions from all the targeted Db2 datab
The 2-Db2_PermissionScan Job uses the SQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -25,12 +25,12 @@ The query is:
## Recommended Configuration for the Db2 Permission Query
-Prior to running an Db2 0.Collection query, you must establish a connection to the appropriate IBM
-Db2 server. As long as that connection is set up first, it is recommended that no configuration
-changes be made to the 0.Collection jobs before they run.
+Before running an Db2 0.Collection query, you must establish a connection to the appropriate IBM
+Db2 server. As long as that connection is set up first, don't make configuration
+changes to the 0.Collection jobs before they run.
It is also recommended that the connection only be established for the 1-Db2 SensitiveDataScan Job.
-Once the connection is established, it applies to all jobs in the 0.Collection job group. It does
+After the connection is established, it applies to all jobs in the 0.Collection job group. It does
not apply to any other job groups. For additional information on establishing a database connection,
see
[1-Db2_SensitiveDataScan](/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_sensitivedatascan.md).
@@ -41,7 +41,7 @@ Navigate to the **Databases** > **0.Collection** > **Db2** > **2-Db2_PermissionS
**Configure** node and select Analysis to view the Analysis Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -52,5 +52,5 @@ The default analysis tasks are:
- Update Instance Name — Updates the instance name with a port if there are multiple instances in a
single host
-- AIC Permissions Import — Imports Db2 permissions to the AIC
+- AIC Permissions Import — Imports Db2 permissions to the Access Information Center (AIC)
- AIC Roles Import — Imports roles to the AIC for Db2
diff --git a/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_sensitivedatascan.md b/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_sensitivedatascan.md
index 5cf531ef35..df98278ac4 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_sensitivedatascan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/db2/collection/db2_sensitivedatascan.md
@@ -21,14 +21,14 @@ The query is:
## Recommended Configuration for the SensitiveDataScan Query
-It is only necessary to set up the connection for the 1-Db2 SensitiveDataScan Job. Once the
-connection is established, custom configurations apply to all other job queries within the
-0.Collection job group. Follow the steps to customize configurations.
+You only need to set up the connection for the 1-Db2 SensitiveDataScan Job. After you establish the
+connection, custom configurations apply to all other job queries within the 0.Collection job group.
+To customize configurations:
**Step 1 –** Navigate to the Databases > 0.Collection > Db2 > 1-Db2_SensitiveDataScan > Configure
node and select Queries.
-**Step 2 –** In the Query Selection view, select the SensitiveDataScan query click on Query
+**Step 2 –** In the Query Selection view, select the SensitiveDataScan query click Query
Properties. The Query Properties window appears.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard opens
@@ -40,7 +40,7 @@ with Sensitive Data Collection category selected.
-**Step 5 –** To modify sensitive data scan options, select the desired scan options. See the
+**Step 5 –** To modify sensitive data scan options, select the scan options you want. See the
[SQL: Options](/docs/accessanalyzer/11.6/admin/datacollector/sql/options.md)
page for additional information.
@@ -55,7 +55,7 @@ may significantly increase scan time.
-**Step 7 –** To modify criteria, click on **Use the following selected criteria:** and select your
+**Step 7 –** To modify criteria, click **Use the following selected criteria:** and select your
choices. By default, the Sensitive Data Scan job is set to **Use Global Criteria**.
:::note
@@ -84,14 +84,14 @@ query, you must establish a connection to the database.
**Step 10 –** In the Manage Connections window, enter the following information:
- Instance Label — Custom name of the instance
-- Database System — A drop down containing all available database servers. Select the Db2LUW server
+- Database System — A dropdown containing all available database servers. Select the Db2LUW server
to configure Db2 queries.
- Service Name — Custom name of the service
- Host — Name or IP address of the host where the database is located. Host list is IBM DB2
- Port Number — Port number for the selected database
- Default Database — Default Database
-**Step 11 –** After completing the above information fields, click **Test Connection** to validate
+**Step 11 –** After completing these information fields, click **Test Connection** to validate
the new connection. Once validated, click **Create New Connection** to finalize the connection.
**Step 12 –** Navigate to the Filter page. Select Only select database objects or **All database
@@ -106,14 +106,14 @@ page.
**Step 13 –** Click Retrieve. The Available database objects box will populate.
-**Step 14 –** Add the Databases and instances to be audited. Databases and instances can be added in
+**Step 14 –** Add the databases and instances that you want to audit. Add them in
the following ways:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Optionally use the Add Custom Filter button to create and apply a custom filter.
-Selected database objects to be audited will display.
+Selected database objects will display.
**Step 15 –** Click **Next** and navigate to the Summary page, click Finish to save any setting
modifications or click Cancel if no changes were made. Then click OK to close the Query Properties
@@ -127,7 +127,7 @@ Navigate to the **Databases** > **0.Collection** > **Db2** > **1-Db2_SensitiveDa
**Configure** node and select **Analysis** to view the Analysis Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -140,4 +140,5 @@ The default analysis tasks are:
single host
- Db2 Matches — Brings the Db2 SDD Matches View to the Enterprise Auditor console
- Db2 Match Hits — Brings the Db2 Match Hits View to the Enterprise Auditor console
-- AIC Sensitive Data Import — Db2 Match Imports discovered Db2 sensitive data to the AIC
+- AIC Sensitive Data Import — Db2 Match Imports discovered Db2 sensitive data to the Access
+ Information Center (AIC)
diff --git a/docs/accessanalyzer/11.6/solutions/databases/db2/db2_databasesizing.md b/docs/accessanalyzer/11.6/solutions/databases/db2/db2_databasesizing.md
index 4b1b4c2212..37a5ba4356 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/db2/db2_databasesizing.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/db2/db2_databasesizing.md
@@ -18,7 +18,7 @@ Navigate to the **Jobs** > **Databases** > **Db2** > **Configuration** > **Db2_
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/db2/overview.md b/docs/accessanalyzer/11.6/solutions/databases/db2/overview.md
index f3a20ec617..0c68bf283f 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/db2/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/db2/overview.md
@@ -30,7 +30,7 @@ then an extra 16 GB of RAM are required (8x2=16).
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
configuration; it has been preconfigured to work with Enterprise Auditor and should never be
customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
@@ -40,7 +40,7 @@ environment.
**Location**
The Db2 Solution requires a special Enterprise Auditor license. It can be installed from the
-Enterprise Auditor Instant Job Wizard. Once it has been installed in the Jobs tree, navigate to the
+Enterprise Auditor Instant Job Wizard. After it has been installed in the Jobs tree, navigate to the
solution: Jobs > **Databases** > **Db2**.
The 0.Collection Job Group collects the data. The Db2 Solution Set Collection group is designed to
diff --git a/docs/accessanalyzer/11.6/solutions/databases/db2/permissions/db2_directpermissions.md b/docs/accessanalyzer/11.6/solutions/databases/db2/permissions/db2_directpermissions.md
index c39fdf4969..99efcabec8 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/db2/permissions/db2_directpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/db2/permissions/db2_directpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Databases** > **Db2** > **Permissions** > **Db2_Dir
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/db2/permissions/db2_effectivepermissions.md b/docs/accessanalyzer/11.6/solutions/databases/db2/permissions/db2_effectivepermissions.md
index 32a88aea72..7e848cb622 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/db2/permissions/db2_effectivepermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/db2/permissions/db2_effectivepermissions.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Databases** > **Db2** > **Permissions** >
Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/db2/recommended.md b/docs/accessanalyzer/11.6/solutions/databases/db2/recommended.md
index 04fa896d49..0c210be6e7 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/db2/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/db2/recommended.md
@@ -25,7 +25,7 @@ scheduled.
- IBM .NET Driver NuGet
:::note
- All necessary clients and drivers can be found on IBM Support's
+ IBM Support provides all necessary clients and drivers on its
[Download initial version 11.5 clients and drivers](https://www.ibm.com/support/pages/download-initial-version-115-clients-and-drivers)
page.
:::
@@ -33,7 +33,7 @@ scheduled.
- .Instance Discovery Job Group run successfully
-**Targeted Host(s)**
+**Targeted Hosts**
The Db2 Job Group has been configured to inherit the host list assignment from the collection group
level.
@@ -45,7 +45,7 @@ The host list assignment should be assigned under the **Databases** > **0.Collec
The SQL Data Collector requires a specific set of permissions. See the Permissions section for
necessary permissions. The account used can be either an Active Directory account or a SQL account.
-Once the account has been provisioned, create a custom Connection Profile containing the credentials
+After the account has been provisioned, create a custom Connection Profile containing the credentials
for the targeted environment. See the
[SQL Custom Connection Profile & Default Dynamic Host List](/docs/accessanalyzer/11.6/admin/datacollector/sql/configurejob.md)
topic for additional information.
@@ -54,7 +54,7 @@ The Connection Profile should be assigned under the Databases > 0.Collection > D
Connection node. It is set to Use the Default Profile, as configured at the global settings level.
However, since this may not be the Connection Profile with the necessary permissions for the
assigned hosts, click the radio button for the Select one of the following user defined profiles
-option and select the appropriate Connection Profile drop-down menu.
+option and select the appropriate Connection Profile dropdown menu.
See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
@@ -77,7 +77,7 @@ Run the solution at the top level.
**Workflow**
1. Install IBM Db2 Server Client and required clients and drivers
-2. Configure and assign host list and connection profile(s)
+2. Configure and assign host list and connection profiles
3. Define the connection information
4. Schedule the .Instance Discovery job group and 0.Collection job group to run as desired
5. Review the reports generated by the 0.Collection job group
diff --git a/docs/accessanalyzer/11.6/solutions/databases/db2/sensitivedata/db2_sensitivedata.md b/docs/accessanalyzer/11.6/solutions/databases/db2/sensitivedata/db2_sensitivedata.md
index 54075bc468..15cc92d08a 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/db2/sensitivedata/db2_sensitivedata.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/db2/sensitivedata/db2_sensitivedata.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Databases** > **Db2** > **Sensitive Data** > **Db2_
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/db2/sensitivedata/db2_sensitivedatapermissions.md b/docs/accessanalyzer/11.6/solutions/databases/db2/sensitivedata/db2_sensitivedatapermissions.md
index 825bc13d59..ee34866614 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/db2/sensitivedata/db2_sensitivedatapermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/db2/sensitivedata/db2_sensitivedatapermissions.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Databases** > **Db2** > **Sensitive Data** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mongodb/collection/mongodb_configuration.md b/docs/accessanalyzer/11.6/solutions/databases/mongodb/collection/mongodb_configuration.md
index e2b646d5f3..85e12a386e 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mongodb/collection/mongodb_configuration.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mongodb/collection/mongodb_configuration.md
@@ -14,7 +14,7 @@ configuration settings for use in the following analysis jobs and respective rep
The MongoDB_Configuration Job uses the NoSQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mongodb/collection/mongodb_sensitivedatascan.md b/docs/accessanalyzer/11.6/solutions/databases/mongodb/collection/mongodb_sensitivedatascan.md
index 887beddcfe..9e0bcea2f3 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mongodb/collection/mongodb_sensitivedatascan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mongodb/collection/mongodb_sensitivedatascan.md
@@ -26,7 +26,7 @@ The query is:
## Configure the MongoDB SDD Query
The MongoDB SDD Query is preconfigured to run using the default settings for the Sensitive Data
-Collection category. Follow the steps to customize configurations.
+Collection category. To customize configurations:
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **MongoDB** >
**MongoDB_SensitiveDataScan** > **Configure** node and select Queries.
@@ -37,7 +37,7 @@ The Query Properties window opens.
**Step 3 –** Select the Data Source tab, and click Configure. The NoSQL Data Collector Wizard opens.
:::warning
-Do not make changes to wizard pages not listed in these steps. They have been
+Don't make changes to wizard pages not listed in these steps. They have been
pre-configured for this job.
:::
@@ -47,7 +47,7 @@ pre-configured for this job.
-**Step 5 –** Select the desired scan options.
+**Step 5 –** Select the scan options you want.
**Step 6 –** Navigate to the
[NoSQL: Criteria](/docs/accessanalyzer/11.6/admin/datacollector/nosql/criteria.md)
@@ -103,7 +103,7 @@ Connections window.
**Step 13 –** On the Filter page, click Retrieveto populate the Servers pane with the databases and
collections.
-**Step 14 –** (Optional) Right click on an object in the list to include or exclude it from the
+**Step 14 –** (Optional) Right click an object in the list to include or exclude it from the
sensitive data scan, or build /edit a pattern to create a custom filter. See the
[NoSQL: Filter](/docs/accessanalyzer/11.6/admin/datacollector/nosql/filter.md)
topic for additional information.
@@ -122,7 +122,7 @@ Navigate to the Databases > > 0.Collection > MongoDB > MongoDB_SensitiveDataScan
and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -134,4 +134,4 @@ The default analysis tasks are:
- NoSQL Instances — Brings the SA_NoSQL_Instances to view in SA
- Matches View — Brings the MongoDB matches view to the Enterprise Auditor console
- Match Hits View — Brings the MongoDB match hits view to the Enterprise Auditor console
-- MongoDB SDD AIC Import — Imports MongoDB SDD into the AIC
+- MongoDB SDD AIC Import — Imports MongoDB SDD into the Access Information Center (AIC)
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mongodb/collection/overview.md b/docs/accessanalyzer/11.6/solutions/databases/mongodb/collection/overview.md
index db106a3e21..4e8477cbd6 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mongodb/collection/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mongodb/collection/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# 0.Collection Job Group
The MongoDB Solution Collection group is designed to collect high level summary information from
-targeted MongoDB Servers. This information is used by other jobs in the MongoDB Solution Set for
+targeted MongoDB Servers. This information is used by other jobs in the MongoDB Solution Set for
further analysis and producing respective reports.
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mongodb/mongodb_databasesizing.md b/docs/accessanalyzer/11.6/solutions/databases/mongodb/mongodb_databasesizing.md
index 45af4c7cc8..d24e6540e6 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mongodb/mongodb_databasesizing.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mongodb/mongodb_databasesizing.md
@@ -12,7 +12,7 @@ Navigate to the **Jobs > Databases > MongoDB > Configuration > MongoDB_Databa
node and select Analysis to view the Analysis Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mongodb/mongodb_sensitivedata.md b/docs/accessanalyzer/11.6/solutions/databases/mongodb/mongodb_sensitivedata.md
index c1ce414157..707ecc1af1 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mongodb/mongodb_sensitivedata.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mongodb/mongodb_sensitivedata.md
@@ -22,7 +22,7 @@ Navigate to the MongoDB > **Databases** > **Sensitive Data**> MongoDB_SensitiveD
and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mongodb/overview.md b/docs/accessanalyzer/11.6/solutions/databases/mongodb/overview.md
index 2039fb8c46..ec89f9429d 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mongodb/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mongodb/overview.md
@@ -15,16 +15,16 @@ access the data, and how each database has been configured.
As part of Stealthbits comprehensive Data Access Governance suite for structured and unstructured
data, Enterprise Auditor for MongoDB automates the process of understanding where MongoDB databases
-exist and provides an overview of the MongoDB environment in order to answer questions around data
+exist and provides an overview of the MongoDB environment to answer questions around data
access:
- Who has access to your data?
- Where is sensitive data being stored?
-With visibility into every corner of MongoDB, organizations can proactively highlight and prioritize
-risks to sensitive data. Additionally, organizations can automate manual, time-consuming, and
-expensive processes associated with compliance, security, and operations to easily adhere to best
-practices that keep MongoDB Server safe and operational.
+With complete visibility into MongoDB, organizations can proactively highlight and prioritize risks
+to sensitive data. Additionally, organizations can automate manual, time-consuming, and expensive
+processes associated with compliance, security, and operations to adhere to best practices that keep
+MongoDB Server safe and operational.
**Supported Platforms**
@@ -52,7 +52,7 @@ resources on the Enterprise Auditor server.
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
configuration; it has been preconfigured to work with Enterprise Auditor and should never be
customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
@@ -62,7 +62,7 @@ environment.
**Location**
The Structured Sensitive Data Discovery License is required to run the MongoDB Solution. The MongoDB
-Solution can be installed from the Enterprise Auditor Instant Job Wizard. Once it has been installed
+Solution can be installed from the Enterprise Auditor Instant Job Wizard. After it has been installed
into the Jobs tree, navigate to the solution: Jobs > **Databases** > MongoDB.
The 0.Collection Job Group scans MongoDB instances on the target hosts, and collects
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mongodb/recommended.md b/docs/accessanalyzer/11.6/solutions/databases/mongodb/recommended.md
index b17ed9c6ee..53896b14f3 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mongodb/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mongodb/recommended.md
@@ -18,9 +18,9 @@ scheduled.
StealthAUDIT Console server
Some of the 0.Collection Job Group queries can be scoped to target specific databases/instances.
-However, it is necessary to add the databases to the query first.
+However, add the databases to the query first.
-**Targeted Host(s)**
+**Targeted Hosts**
The 0.Collection Job Group must be set to run against a custom host list containing the MongoDB
database instances / clusters.
@@ -29,7 +29,7 @@ database instances / clusters.
The NoSQL Data Collector requires a specific set of permission. See the Permissions section for
necessary permissions. The account used can be either an Active Directory account or a SQL account.
-Once the account has been provisioned, create a custom Connection Profile containing the credentials
+After the account has been provisioned, create a custom Connection Profile containing the credentials
for the targeted environment. See the
[NoSQL Custom Connection Profile & Host List](/docs/accessanalyzer/11.6/admin/datacollector/nosql/configurejob.md)
topic for additional information.
@@ -38,7 +38,7 @@ The Connection Profile should be assigned under the MongoDB > 0.Collection > Set
node. It is set to Use the Default Profile, as configured at the global settings level. However,
since this may not be the Connection Profile with the necessary permissions for the assigned hosts,
click the radio button for the Select one of the following user defined profiles option and select
-the appropriate Connection Profile drop-down menu.
+the appropriate Connection Profile dropdown menu.
See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
@@ -48,8 +48,7 @@ topic for additional information.
One of the most important decisions to make is how frequently to collect this data. The MongoDB Job
Group can be scheduled to run as desired depending on the types of auditing being conducted and the
-scope of the target environment. The general recommendation is to schedule the solution to run
-daily.
+scope of the target environment. Schedule the solution to run daily.
**Run Order**
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mysql/collection/mysql_configuration.md b/docs/accessanalyzer/11.6/solutions/databases/mysql/collection/mysql_configuration.md
index f89ec97af2..20f13c79ff 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mysql/collection/mysql_configuration.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mysql/collection/mysql_configuration.md
@@ -14,7 +14,7 @@ settings for use in the following analysis jobs and respective reports.
The MySQL_Configuration Job uses the SQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mysql/collection/mysql_sensitivedatascan.md b/docs/accessanalyzer/11.6/solutions/databases/mysql/collection/mysql_sensitivedatascan.md
index d9fb59b921..c89c1ed8b7 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mysql/collection/mysql_sensitivedatascan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mysql/collection/mysql_sensitivedatascan.md
@@ -24,25 +24,25 @@ The query is:
### Configure the SensitiveDataScan Query
The MySQL_SensitiveDataScan Job is preconfigured to run using the default settings for the Sensitive
-Data Collection category. Follow the steps to customize configurations.
+Data Collection category. To customize configurations:
**Step 1 –** Navigate to the Databases > 0.Collection > MySQL > MySQL_SensitiveDataScan > Configure
node and select Queries.
-**Step 2 –** In the Query Selection view, select the Sensitive Data Scan query click on Query
+**Step 2 –** In the Query Selection view, select the Sensitive Data Scan query click Query
Properties. The Query Properties window appears.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for this
+Don't make changes to other wizard pages as they have been pre-configured for this
job.
:::
-**Step 4 –** To modify sensitive data scan options, select the desired scan options. See the
+**Step 4 –** To modify sensitive data scan options, select the scan options you want. See the
[SQL: Options](/docs/accessanalyzer/11.6/admin/datacollector/sql/options.md)
page for additional information.
@@ -84,7 +84,7 @@ objects. Click Retrieve. The Available database objects box will populate. The d
scan all MySQL Databases returned, excluding the listed system schemas and tables in red. Databases
and instances can be added in the following ways:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Use the Add Custom Filter button to create and apply a custom filter.
@@ -99,7 +99,7 @@ Navigate to the **Databases** > **0.Collection** > **MySQL** > **MySQL_Sensitive
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mysql/collection/mysql_tableprivileges.md b/docs/accessanalyzer/11.6/solutions/databases/mysql/collection/mysql_tableprivileges.md
index 578d06883e..e4f69cac31 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mysql/collection/mysql_tableprivileges.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mysql/collection/mysql_tableprivileges.md
@@ -14,7 +14,7 @@ servers.
The MySQL_TablePrivileges Job uses the SQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -30,7 +30,7 @@ Navigate to the **Databases** > **0.Collection** > **MySQL** > **MySQL_TablePriv
**Configure** node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mysql/mysql_databasesizing.md b/docs/accessanalyzer/11.6/solutions/databases/mysql/mysql_databasesizing.md
index 3b2a68d119..2bcb36ee5f 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mysql/mysql_databasesizing.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mysql/mysql_databasesizing.md
@@ -20,7 +20,7 @@ Navigate to the **Jobs > Databases > MySQL > Configuration > MySQL_DatabaseSi
and select Analysis to view the Analysis Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mysql/overview.md b/docs/accessanalyzer/11.6/solutions/databases/mysql/overview.md
index 656291266c..b5b7fd623a 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mysql/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mysql/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# MySQL Solution
-Data privacy and security is quickly evolving to be on equal footing with traditional security
-measures focused on the network, hardware, or software the data is contained within. Organizations
+Data privacy and security is quickly becoming as important as traditional security
+measures focused on the network, hardware, or software that stores the data. Organizations
aligning to concepts like Data-Centric Audit and Protection (DCAP) as defined by Gartner, or the
requirements of strict compliance regulations like EU GDPR, are looking to implement processes that
help them understand where sensitive data is stored, who or what is leveraging their privileges to
@@ -15,19 +15,19 @@ access the data, and how each database has been configured.
As part of Stealthbits comprehensive Data Access Governance suite for structured and unstructured
data, Enterprise Auditor for MySQL automates the process of understanding where MySQL databases
-exist and provides an overview of the MySQL environment in order to answer questions around data
+exist and provides an overview of the MySQL environment to answer questions around data
access:
- Who has access to your data?
- Where is sensitive data being stored?
-With visibility into every corner of MySQL, organizations can proactively highlight and prioritize
+With visibility into every part of the MySQL environment, organizations can proactively highlight and prioritize
risks to sensitive data. Additionally, organizations can automate manual, time-consuming, and
-expensive processes associated with compliance, security, and operations to easily adhere to best
+expensive processes associated with compliance, security, and operations to adhere to best
practices that keep MySQL Server safe and operational.
The MySQL Solution requires a special Enterprise Auditor license. The Database Solution license
-includes all supported database platforms supported by Enterprise Auditor. Additionally, the
+includes all database platforms that Enterprise Auditor supports. Additionally, the
Sensitive Data Discovery Add-On enables the solution to search database content for sensitive data.
By default, the job is configured to use 10 threads, which can be adjusted based on available
@@ -57,7 +57,7 @@ an extra 16 GB of RAM are required (8x2=16).
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
configuration; it has been preconfigured to work with Enterprise Auditor and should never be
customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
@@ -67,15 +67,15 @@ environment.
**Location**
The Structured Sensitive Data Discovery License is required to run the MySQL Solution. It can be
-installed from the Enterprise Auditor Instant Job Wizard. Once it has been installed into the Jobs
+installed from the Enterprise Auditor Instant Job Wizard. After it has been installed into the Jobs
tree, navigate to the solution: Jobs > **Databases** > MySQL.
The 0.Collection Job Group discovers configuration settings and Sensitive Data in MySQL Instances on
the target hosts. The other job groups analyze and report on the data collected by the 0.Collection
Job Group.
-The Database Solution license includes all supported database platforms supported by Enterprise
-Auditor. Additionally, the Sensitive Data Discovery Add-On enables the solution to search database
+The Database Solution license includes all database platforms that Enterprise
+Auditor supports. Additionally, the Sensitive Data Discovery Add-On enables the solution to search database
content for sensitive data.
## Job Groups
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mysql/recommended.md b/docs/accessanalyzer/11.6/solutions/databases/mysql/recommended.md
index 0db5d8d93b..b851dc9956 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mysql/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mysql/recommended.md
@@ -8,8 +8,8 @@ sidebar_position: 10
The MySQL Solution has been configured to inherit down from the MySQL > Settings node. However, it
is best practice to assign the host list and the Connection Profile at the data collection level,
-0.Collection Job Group. Once these are assigned to the job group, it can be run directly or
-scheduled.
+0.Collection Job Group. After you assign these to the job group, you can run it directly or
+schedule it.
**Dependencies**
@@ -17,9 +17,9 @@ scheduled.
Enterprise Auditor Console server
- For AWS RDS and Aurora instances, right-click a job in the **MySQL** > **0.Collection** folder and
open the properties window. Select the **Performance** tab and ensure that the **Skip Hosts that
- do not respond to PING**checkbox is not selected.
+ don't respond to PING**checkbox isn't selected.
-**Targeted Host(s)**
+**Targeted Hosts**
- The 0.Collection Job Group must be set to run against a custom host list containing the
MySQL database instances / clusters.
@@ -36,7 +36,7 @@ topic for additional information on permissions and creating a SQL custom connec
The Connection Profile is set to Use the Default Profile, as configured at the global settings
level. However, since this may not be the Connection Profile with the necessary permissions for the
assigned hosts, click the radio button for the Select one of the following user defined profiles
-option and select the appropriate Connection Profile drop-down menu.
+option and select the appropriate Connection Profile dropdown menu.
**Schedule Frequency**
@@ -61,12 +61,12 @@ topic for additional information.
**Analysis Configuration**
This solution should be run with the default analysis configurations. These analysis tasks are
-preconfigured and should not be modified or deselected.
+preconfigured and shouldn't be modified or deselected.
Disabling obsolete or run-desired jobs allows the solution to run more efficiently. To disable a job
-or job group, right-click on the item and select Disable Job.
+or job group, right-click the item and select Disable Job.
:::info
-Do not delete any jobs. Instead, jobs should be disabled.
+Don't delete any jobs. Disable them instead.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mysql/sensitivedata/mysql_sensitivedata.md b/docs/accessanalyzer/11.6/solutions/databases/mysql/sensitivedata/mysql_sensitivedata.md
index ec1df04cc5..d4cd8c9990 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mysql/sensitivedata/mysql_sensitivedata.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mysql/sensitivedata/mysql_sensitivedata.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs > MySQL > Sensitive Data > MySQL_SensitiveData > Conf
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/mysql/sensitivedata/mysql_sensitivedatapermissions.md b/docs/accessanalyzer/11.6/solutions/databases/mysql/sensitivedata/mysql_sensitivedatapermissions.md
index 58c9c94e52..e7e7006fd7 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/mysql/sensitivedata/mysql_sensitivedatapermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/mysql/sensitivedata/mysql_sensitivedatapermissions.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs > MySQL > Sensitive Data > MySQL_SensitiveDataPermissi
and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_activity.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_activity.md
index c8207faaf6..db51f65a41 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_activity.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_activity.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_Activity** > **Configure*
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_logons.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_logons.md
index c2404162b8..05962e91aa 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_logons.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_logons.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_Logons** > **Configure**
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_permissionchanges.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_permissionchanges.md
index 8f89ccb815..675ff2ce9b 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_permissionchanges.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_permissionchanges.md
@@ -16,7 +16,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_PermissionChanges** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_schemachanges.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_schemachanges.md
index 8fb56c421e..1ccbf615bb 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_schemachanges.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_schemachanges.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_SchemaChanges** > **Confi
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_sensitivedataactivity.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_sensitivedataactivity.md
index 1010e06d3b..f0b976eedf 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_sensitivedataactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_sensitivedataactivity.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_SensitiveDataActivity** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_suspiciousactivity.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_suspiciousactivity.md
index aae76fc305..8b06367f0a 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_suspiciousactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_suspiciousactivity.md
@@ -7,7 +7,7 @@ sidebar_position: 60
# Oracle_SuspiciousActivity Job
The Oracle_SuspiciousActivity job is designed to provide insight into suspicious behavior based on
-user activity that does not conform to normal database activity.
+user activity that doesn't conform to normal database activity.
## Analysis Tasks for the Oracle_SuspiciousActivity Job
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_SuspiciousActivity** > **
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_unusualactivity.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_unusualactivity.md
index 042b171e5c..e407dfcdbb 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_unusualactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_unusualactivity.md
@@ -16,7 +16,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_UnusualActivity** > **Con
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/overview.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/overview.md
index 171be621f5..49d22fc269 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/overview.md
@@ -33,7 +33,7 @@ The jobs in the 2.Activity Job Group are:
TRUNCATE) against objects containing sensitive data
- [Oracle_SuspiciousActivity Job](/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_suspiciousactivity.md)
– This job is designed to provide insight into suspicious behavior based on user activity that
- does not conform to normal database activity
+ doesn't conform to normal database activity
- [Oracle_UnusualActivity Job](/docs/accessanalyzer/11.6/solutions/databases/oracle/activity/oracle_unusualactivity.md)
– This job is designed to analyze user activity based on the audited actions and identify any
outliers based on a modified z-score. Modified z-scores of 3.5 or higher are considered to be
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/0-oracle_servers.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/0-oracle_servers.md
index 5d79970168..766ff857b6 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/0-oracle_servers.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/0-oracle_servers.md
@@ -14,7 +14,7 @@ running on the targeted servers.
The Server Discovery query uses the PowerShell Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -22,9 +22,9 @@ Do not modify the query. The query is preconfigured for this job.
- Oracle Servers – Returns a list of Oracle servers from the specified host list
-Regarding Oracle instance discovery, there may be errors running the query that are not reported. An
+Errors running the query during Oracle instance discovery might not be reported. An
additional log to store the issues has been added for instance discoveries named
-`Oracle_Server_log_[target_hostname]`. This file can be found in
+`Oracle_Server_log_[target_hostname]`. This file is in
`%sainstalldir%\Jobs\GROUP_ORACLE_0.Collection\GROUP_1.Discovery\JOB_Oracle_Servers\OUTPUT`. See the
[PowerShell Data Collector](/docs/accessanalyzer/11.6/admin/datacollector/powershell/overview.md)
topic for additional information.
@@ -35,7 +35,7 @@ Navigate to the **Databases** > **0.Collection** > **Oracle** > **0-Oracle_Serve
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/1-oracle_permissionsscan.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/1-oracle_permissionsscan.md
index 2b9e53dcf1..3af54a77bd 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/1-oracle_permissionsscan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/1-oracle_permissionsscan.md
@@ -20,19 +20,19 @@ The PermissionsScan query uses the SQL Data Collector for the following query:
### Configure the 1-Oracle_PermissionsScan Query
The 1-Oracle_PermissionsScan Job is preconfigured to run using the default settings for the
-Permissions Collection category in the SQL Data Collector. Follow the steps to customize
+Permissions Collection category in the SQL Data Collector. To customize
configurations:
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **Oracle** >
**1-Oracle_PermissionsScan** > **Configure** node and select Queries.
-**Step 2 –** In the Query Selection view, select the PermissionScan query and click on Query
+**Step 2 –** In the Query Selection view, select the PermissionScan query and click Query
Properties. The Query Properties window opens.
**Step 3 –** Select the Data Source tab and click Configure. The SQL Data Collector wizard opens.
:::warning
-Do not make changes to wizard pages not listed in these steps. They have been
+Don't make changes to wizard pages not listed in these steps. They have been
pre-configured for this job.
:::
@@ -44,7 +44,7 @@ query target is All Databases. The default query scope is Only select database o
Retrieve. The Available database objects section will be populated. Databases and instances can be
added in the following ways:
-- Select the desired database objects and click Add
+- Select the database objects you want and click Add
- Use the Import CSV button to import a list from a CSV file, if desired
- Optionally, use the Add Custom Filter button to create and apply a custom filter
@@ -59,7 +59,7 @@ Navigate to the **Databases** > **0.Collection** > **Oracle** > **1-Oracle_Permi
**Configure** node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/2-oracle_sensitivedatascan.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/2-oracle_sensitivedatascan.md
index bcdb36f682..fbf0d99301 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/2-oracle_sensitivedatascan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/2-oracle_sensitivedatascan.md
@@ -36,19 +36,19 @@ The SensitiveDataScan Query uses the SQL Data Collector for the following query:
### Configure the 2-Oracle_SensitiveDataScan Query
The 2-Oracle_SensitiveDataScan Job is preconfigured to run using the default settings for the
-Sensitive Data Collection category in the SQL Data Collector. Follow the steps to customize
+Sensitive Data Collection category in the SQL Data Collector. To customize
configurations:
**Step 1 –** Navigate to the **Databases > 0.Collection >** Oracle > > 2-Oracle_SensitiveDataScan >
Configure node and select Queries.
-**Step 2 –** In the Query Selection view, select the SensitiveDataScan query and click on Query
+**Step 2 –** In the Query Selection view, select the SensitiveDataScan query and click Query
Properties. The Query Properties window opens.
**Step 3 –** Select the Data Source tab and click Configure. The SQL Data Collector wizard opens.
:::warning
-Do not make changes to wizard pages not listed in these steps. They have been
+Don't make changes to wizard pages not listed in these steps. They have been
pre-configured for this job.
:::
@@ -70,7 +70,7 @@ query target is All Databases. The default query scope is Only select database o
Retrieve. The Available database objects section will be populated. Databases and instances can be
added in the following ways:
-- Select the desired database objects and click Add
+- Select the database objects you want and click Add
- Use the Import CSV button to import a list from a CSV file, if desired
- Optionally, use the Add Custom Filter button to create and apply a custom filter
@@ -85,7 +85,7 @@ Navigate to the **Databases** > **0.Collection** > **Oracle** > **2-Oracle_Sensi
**Configure** node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/3-oracle_activityscan.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/3-oracle_activityscan.md
index 4ec990442c..baae8f05be 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/3-oracle_activityscan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/3-oracle_activityscan.md
@@ -27,19 +27,19 @@ The ActivityScan Query uses the SQL Data Collector for the following query:
### Configure the 3-Oracle_ActivityScan Query
The 3-Oracle_ActivityScan Job is preconfigured to run using the default settings for the Server
-Audit Events Collection category in the SQL Data Collector. Follow the steps to customize
+Audit Events Collection category in the SQL Data Collector. To customize
configurations:
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **Oracle** >
**3-Oracle_ActivityScan** > **Configure** node and select Queries.
-**Step 2 –** In the Query Selection view, select the ActivityScan query and click on Query
+**Step 2 –** In the Query Selection view, select the ActivityScan query and click Query
Properties. The Query Properties window opens.
**Step 3 –** Select the Data Source tab and click Configure. The SQL Data Collector wizard opens.
:::warning
-Do not make changes to wizard pages not listed in these steps. They have been
+Don't make changes to wizard pages not listed in these steps. They have been
pre-configured for this job.
:::
@@ -56,7 +56,7 @@ query target is All Databases. The default query scope is Only select database o
Retrieve. The Available database objects section will be populated. Databases and instances can be
added in the following ways:
-- Select the desired database objects and click Add
+- Select the database objects you want and click Add
- Use the Import CSV button to import a list from a CSV file, if desired
- Optionally, use the Add Custom Filter button to create and apply a custom filter
@@ -71,7 +71,7 @@ Navigate to the **Databases** > **0.Collection** > **Oracle** > **3-Oracle_Activ
**Configure** node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/4-oracle_defaultpasswordusers.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/4-oracle_defaultpasswordusers.md
index 191bdf71bc..c85fb09489 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/4-oracle_defaultpasswordusers.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/4-oracle_defaultpasswordusers.md
@@ -21,19 +21,19 @@ The 4-Oracle_DefaultPasswordUsers Job uses the SQL Data Collector for the follow
### Configure the 4-Oracle_DefaultPasswordUsers Query
The 4-Oracle_DefaultPasswordUsers Job is preconfigured to run using the default settings for the
-Permissions Collection category in the SQL Data Collector. Follow the steps to customize
+Permissions Collection category in the SQL Data Collector. To customize
configurations:
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **Oracle** >
**4-Oracle_DefaultPasswordUsers** > **Configure** node and select Queries.
-**Step 2 –** In the Query Selection view, select the Users with Default Passwords query and click on
+**Step 2 –** In the Query Selection view, select the Users with Default Passwords query and click
Query Properties. The Query Properties window opens.
**Step 3 –** Select the Data Source tab and click Configure. The SQL Data Collector wizard opens.
:::warning
-Do not make changes to wizard pages not listed in these steps. They have been
+Don't make changes to wizard pages not listed in these steps. They have been
pre-configured for this job.
:::
@@ -45,7 +45,7 @@ query target is All Databases. The default query scope is Only select database o
Retrieve. The Available database objects section will be populated. Databases and instances can be
added in the following ways:
-- Select the desired database objects and click Add
+- Select the database objects you want and click Add
- Use the Import CSV button to import a list from a CSV file, if desired
- Optionally, use the Add Custom Filter button to create and apply a custom filter
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/5-oracle_configuration.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/5-oracle_configuration.md
index 44368c2f0e..18860f699e 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/5-oracle_configuration.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/5-oracle_configuration.md
@@ -23,18 +23,18 @@ The queries are:
### Configure the 5-Oracle_Configuration Queries
The 5-Oracle_Configuration Job is preconfigured to run using the default settings for the Custom
-Oracle Query category in the SQL Data Collector. Follow the steps to customize configurations:
+Oracle Query category in the SQL Data Collector. To customize configurations:
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **Oracle** >
**5-Oracle_Configuration Job** > **Configure** node and select Queries.
-**Step 2 –** In the Query Selection view, select one of the queries and click on Query Properties.
+**Step 2 –** In the Query Selection view, select one of the queries and click Query Properties.
The Query Properties window opens.
**Step 3 –** Select the Data Source tab and click Configure. The SQL Data Collector wizard opens.
:::warning
-Do not make changes to wizard pages not listed in these steps. They have been
+Don't make changes to wizard pages not listed in these steps. They have been
pre-configured for this job.
:::
@@ -46,7 +46,7 @@ query target is All Databases. The default query scope is Only select database o
Retrieve. The Available database objects section will be populated. Databases and instances can be
added in the following ways:
-- Select the desired database objects and click Add
+- Select the database objects you want and click Add
- Use the Import CSV button to import a list from a CSV file, if desired
- Optionally, use the Add Custom Filter button to create and apply a custom filter
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_databaselinks.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_databaselinks.md
index 9e3173b825..298f7ba5a1 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_databaselinks.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_databaselinks.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Oracle_DatabaseLinks Job
The Oracle_DatabaseLinks Job contains a report that provides information on Database Links where the
-listed Oracle Server is able to execute remote commands.
+listed Oracle Server can execute remote commands.
## Analysis Tasks for the Oracle_DatabaseLinks Job
@@ -15,7 +15,7 @@ Navigate to the **Jobs > Databases > Oracle > 4.Configuration > Oracle_Databas
Job >Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -32,4 +32,4 @@ the following preconfigured report:
| Report | Description | Default Tags | Report Elements |
| -------------- | -------------------------------------------------------------------------------------------------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Database Links | This report highlights Database Links where the listed Oracle Server is able to execute remote commands. | None | This report is comprised of three elements: - Bar Chart – Provides information on top five database links by instance
- Bar Chart – Provides information on database links by instance (GB)
- Table – Provides details on database links
|
+| Database Links | This report highlights Database Links where the listed Oracle Server can execute remote commands. | None | This report is comprised of three elements: - Bar Chart – Provides information on top five database links by instance
- Bar Chart – Provides information on database links by instance (GB)
- Table – Provides details on database links
|
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_databasesizing.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_databasesizing.md
index a3c4df6307..8765d526d1 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_databasesizing.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_databasesizing.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs > Databases > Oracle > 4.Configuration > Oracle_Databas
Job >Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_datadictionaryprotection.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_datadictionaryprotection.md
index 9790c78d38..de03f42eea 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_datadictionaryprotection.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_datadictionaryprotection.md
@@ -17,7 +17,7 @@ Navigate to the **Jobs > Databases > Oracle > 4.Configuration > Oracle_DataDic
Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_instancenameissues.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_instancenameissues.md
index 630506ba27..62d9a8a5ef 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_instancenameissues.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_instancenameissues.md
@@ -8,7 +8,7 @@ sidebar_position: 40
The Oracle_InstanceNameIssues Job discovers if names used for Oracle database instances conform to
Oracle recommended best practices. The job also checks to see if Oracle SIDs conform to DISA STIG
-V-61413 – Oracle instance name or SID should not contain Oracle version numbers.
+V-61413 – Oracle instance name or SID shouldn't contain Oracle version numbers.
## Analysis Tasks for the Oracle_InstanceNameIssues Job
@@ -16,7 +16,7 @@ Navigate to the **Jobs > Databases > Oracle > 4.Configuration > Oracle_InstanceN
Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_remoteosauthentication.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_remoteosauthentication.md
index f3426cd1c6..2db7c5f61b 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_remoteosauthentication.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_remoteosauthentication.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs > Databases > Oracle > 4.Configuration > Oracle_RemoteOSA
Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/overview.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/overview.md
index ed5fb2e7cb..57290f0a97 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/overview.md
@@ -14,8 +14,8 @@ related to Oracle Database Instance configuration settings.
The jobs in the 4.Configuration Job Group are:
- [Oracle_DatabaseLinks Job](/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_databaselinks.md)
- – Contains a report that provides information on Database Links where the listed Oracle Server is
- able to execute remote commands
+ – Contains a report that provides information on Database Links where the listed Oracle Server
+ can execute remote commands
- [Oracle_DatabaseSizing Job](/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_databasesizing.md)
– Provides details on tablespace file sizes and overall tablespace sizes
- [Oracle_DataDictionaryProtection Job](/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_datadictionaryprotection.md)
@@ -25,7 +25,7 @@ The jobs in the 4.Configuration Job Group are:
- [Oracle_InstanceNameIssues Job](/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_instancenameissues.md)
– This job is designed to find out if the names used for the Oracle database instances conform to
Oracle recommended best practices. The job also checks to see if the Oracle SID conforms to DISA
- STIG V-61413 – Oracle instance name or SID should not contain Oracle version numbers.
+ STIG V-61413 – Oracle instance name or SID shouldn't contain Oracle version numbers.
- [Oracle_RemoteOSAuthentication Job](/docs/accessanalyzer/11.6/solutions/databases/oracle/configuration/oracle_remoteosauthentication.md)
– This job is designed to find out if remote OS authentication is enabled for the targeted Oracle
database servers
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/overview.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/overview.md
index 16d59208ba..b8070f5f6a 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# Oracle Solution
-Data privacy and security is quickly evolving to be on equal footing with traditional security
-measures focused on the network, hardware, or software the data is contained within. Organizations
+Data privacy and security is becoming as important as traditional security measures that focus on
+the network, hardware, or software where the data resides. Organizations
aligning to concepts like Data-Centric Audit and Protection (DCAP) as defined by Gartner, or the
requirements of strict compliance regulations like EU GDPR, are looking to implement processes that
help them understand where sensitive data is stored, who or what is leveraging their privileges to
@@ -15,7 +15,7 @@ access the data, and how each database has been configured.
This solution is a comprehensive part of the Data Access Governance suite for structured and
unstructured data. Enterprise Auditor for Oracle automates the process of understanding where Oracle
-databases exist and provides an overview of the Oracle environment in order to answer questions
+databases exist and provides an overview of the Oracle environment to answer questions
around data access:
- Who HAS access to your data?
@@ -25,11 +25,11 @@ around data access:
With visibility into every corner of Oracle® server and the Windows® operating system it relies
upon, organizations can proactively highlight and prioritize risks to sensitive data. Additionally,
organizations can automate manual, time-consuming, and expensive processes associated with
-compliance, security, and operations to easily adhere to best practices that keep Oracle Server safe
+compliance, security, and operations to adhere to best practices that keep Oracle Server safe
and operational.
The Oracle Solution requires a special Enterprise Auditor license. The Database Solution license
-includes all supported database platforms supported by Enterprise Auditor. Additionally, the
+includes all database platforms supported by Enterprise Auditor. Additionally, the
Sensitive Data Discovery Add-On enables the solution to search database content for sensitive data.
**Supported Platforms**
@@ -46,15 +46,15 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount
of RAM. Each thread requires a minimum of 2 additional GB of RAM per host.For example, if the job is
configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
-configuration; it has been preconfigured to work with Enterprise Auditor and should never be
-customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
+configuration; it has been preconfigured to work with Enterprise Auditor. Never customize it through
+Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
:::
@@ -62,7 +62,7 @@ environment.
**Location**
The Oracle Solution requires a special Enterprise Auditor license. It can be installed from the
-Enterprise Auditor Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to
+Enterprise Auditor Instant Job Wizard. After it has been installed into the Jobs tree, navigate to
the solution: **Jobs** > **Databases** > **0.Collection** > **Oracle** for the 0.Collection job
group for Oracle.
@@ -70,7 +70,7 @@ The 0.Collection Job Group discovers Oracle Instances on the target hosts. The o
**Jobs** > **Databases** > **Oracle** analyze and report on the data collected by the 0.Collection
Job Group.
-The Database Solution license includes all supported database platforms supported by Enterprise
+The Database Solution license includes all database platforms supported by Enterprise
Auditor. Additionally, the Sensitive Data Discovery Add-On enables the solution to search database
content for sensitive data.
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_domainuserpermissions.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_domainuserpermissions.md
index e280617f9d..cae79442bc 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_domainuserpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_domainuserpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **3.Permissions** > **Oracle_DomainUserPermissions*
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_objectpermissions.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_objectpermissions.md
index 6a6545bfd5..7306a140ed 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_objectpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_objectpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **3.Permissions** > **Oracle_ObjectPermissions** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_publicpermissions.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_publicpermissions.md
index 11bb53c4fa..d84ad993b1 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_publicpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_publicpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **3.Permissions** > **Oracle_PublicPermissions** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_serverpermissions.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_serverpermissions.md
index 316ed05de0..cbbadb2fd3 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_serverpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_serverpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **3.Permissions** > **Oracle_ServerPermissions** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_sysschemapermissions.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_sysschemapermissions.md
index f6225102f9..7a90ec58ec 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_sysschemapermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/permissions/oracle_sysschemapermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **3.Permissions** > **Oracle_SysSchemaPermissions**
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/recommended.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/recommended.md
index 5a2f716055..0e0a3cc549 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/recommended.md
@@ -8,8 +8,8 @@ sidebar_position: 10
The Oracle Solution has been configured to inherit down from the Oracle > Settings node. However, it
is best practice to assign the host list and the Connection Profile at the data collection level,
-0.Collection Job Group. Once these are assigned to the job group, it can be run directly or
-scheduled.
+0.Collection Job Group. After you assign the host list and Connection Profile to the job group, you
+can run it directly or schedule it.
**Dependencies**
@@ -20,19 +20,18 @@ scheduled.
Enterprise Auditor Console server
Some of the queries in the **Jobs** > **Databases** > **0.Collection** > **Oracle Job Group** can be
-scoped to target specific databases and/or instances. However, it is necessary for the
-SA_SQL_Instances table to be populated before attempting to scope the queries. Therefore, the
-0-Oracle_Servers job must be executed before attempting to scope the rest of the 0.Collection Job
-Group queries.
+scoped to target specific databases and/or instances. However, the SA_SQL_Instances table must be
+populated before you scope the queries. Therefore, you must run the 0-Oracle_Servers job before
+scoping the rest of the 0.Collection Job Group queries.
-**Targeted Host(s)**
+**Targeted Hosts**
The 0.Collection Job Group must be set to run against the following dynamic host list:
- Oracle Servers
Default dynamic host lists are populated from hosts in the Host Master Table which meet the host
-inventory criteria for the list. Ensure the appropriate host list(s) have been populated through
+inventory criteria for the list. Ensure the appropriate host lists have been populated through
host inventory results.
**Connection Profile**
@@ -40,11 +39,11 @@ host inventory results.
The SQL Data Collector requires a specific set of permissions. The account used can be either an
Active Directory account or an Oracle account.
-For a Windows-integrated Oracle instance it is possible to use one Active Directory credential that
+For a Windows-integrated Oracle instance, you can use one Active Directory credential that
has permissions on both the Oracle database and the server. This will not generally be the case in
most customer environments, but it is possible.
-If the required permissions are assigned to one Active Directory credential, once the account has
+If the required permissions are assigned to one Active Directory credential, after the account has
been provisioned, create a custom Connection Profile containing the credentials for the targeted
environment. See the
[SQL Data Collector](/docs/accessanalyzer/11.6/admin/datacollector/sql/overview.md)
@@ -66,10 +65,10 @@ node as follows:
- 4-Oracle_DefaultPasswordUsers Job
- 5-Oracle_Configuration Job
-The Connection Profile is set to Use the Default Profile, as configured at the global settings
-level. However, since this may not be the Connection Profile with the necessary permissions for the
-assigned hosts, click the radio button for the Select one of the following user defined profiles
-option and select the appropriate Connection Profile drop-down menu.
+The Connection Profile defaults to the profile configured at the global settings level. If that
+profile doesn't have the permissions the assigned hosts need, select the radio button for the Select
+one of the following user defined profiles option, then choose the correct profile from the
+Connection Profile dropdown menu.
See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
@@ -84,7 +83,7 @@ daily.
**Run Order**
-The 0-Oracle_Servers Job within the Oracle 0.Collection Job Group must be run first, before running
+Run the 0-Oracle_Servers Job within the Oracle 0.Collection Job Group first, before running
the rest of the jobs.
:::info
@@ -107,9 +106,9 @@ SQL Data Collector configurations can be modified if desired:
- 2-Oracle_SensitiveDataScan Job
- Filter page – Scope the query to target specific databases/instances in the following jobs:
- Remember, it is necessary for the
+ Remember, the
[0-Oracle_Servers Job](/docs/accessanalyzer/11.6/solutions/databases/oracle/collection/0-oracle_servers.md)
- to run at least once before attempting to scope any of the following queries:
+ must run at least once before you scope any of the following queries:
- 1-Oracle_PermissionsScan Job
- 2-Oracle_SensitiveDataScan Job
@@ -126,13 +125,13 @@ SQL Data Collector configurations can be modified if desired:
**Analysis Configuration**
This solution should be run with the default analysis configurations. These analysis tasks are
-preconfigured and should not be modified or deselected!
+preconfigured and shouldn't be modified or deselected.
Remember, disabling obsolete or un-desired jobs allows the solution to run more efficiently. To
-disable a job or job group, right-click on the item and select Disable Job.
+disable a job or job group, right-click the item and select Disable Job.
:::info
-Do not delete any jobs. Instead, jobs should be disabled.
+Don't delete any jobs. Disable them instead.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/sensitivedata/oracle_sensitivedata.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/sensitivedata/oracle_sensitivedata.md
index dc312139f7..6773f7a616 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/sensitivedata/oracle_sensitivedata.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/sensitivedata/oracle_sensitivedata.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle > 5.Sensitve Data > Oracle_SensitveData > Configure** n
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/sensitivedata/oracle_sensitivedatapermissions.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/sensitivedata/oracle_sensitivedatapermissions.md
index 8bc06f0e70..b89fdaadee 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/sensitivedata/oracle_sensitivedatapermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/sensitivedata/oracle_sensitivedatapermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle > 5.Sensitive Data > Oracle_SensitiveDataPermissions >
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_passwordissues.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_passwordissues.md
index b80c2a0f75..12c62388d7 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_passwordissues.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_passwordissues.md
@@ -15,7 +15,7 @@ passwords.
The Oracle_PasswordIssues Job uses the PowerShell Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -34,7 +34,7 @@ Navigate to the **Jobs** > **Oracle** > **1.Users and Roles** > **Oracle_Passwor
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_rolemembers.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_rolemembers.md
index 9d28525729..3b9c4c794e 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_rolemembers.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_rolemembers.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **1.Users and Roles** > **Oracle_RoleMembers** > Co
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_systemadministrators.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_systemadministrators.md
index a8a6450f51..30d8ede62d 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_systemadministrators.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_systemadministrators.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **1.Users and Roles** > **Oracle_SystemAdministrato
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_users.md b/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_users.md
index 405d8d476c..e26ad4d1ff 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_users.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/oracle/usersroles/oracle_users.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **1.Users and Roles** > **Oracle_Users** > **Config
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/overview.md b/docs/accessanalyzer/11.6/solutions/databases/overview.md
index 90e49df74c..fe9b3023ff 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/overview.md
@@ -15,18 +15,18 @@ reports that provide visibility into various aspects of supported databases:
and Sensitive Data.
- [MongoDB Solution](/docs/accessanalyzer/11.6/solutions/databases/mongodb/overview.md)
– Enterprise Auditorfor MongoDB automates the process of understanding where MongoDB databases
- exist and provides an overview of the MongoDB environment in order to answer questions around data
+ exist and provides an overview of the MongoDB environment to answer questions around data
access.
- [MySQL Solution](/docs/accessanalyzer/11.6/solutions/databases/mysql/overview.md)
– Enterprise Auditor for MySQL automates the process of understanding where MySQL databases exist
- and provides an overview of the MySQL environment in order to answer questions around data access.
+ and provides an overview of the MySQL environment to answer questions around data access.
- [Oracle Solution](/docs/accessanalyzer/11.6/solutions/databases/oracle/overview.md)
– Enterprise Auditor for Oracle automates the process of understanding where Oracle databases
- exist and provides an overview of the Oracle environment in order to answer questions around data
+ exist and provides an overview of the Oracle environment to answer questions around data
access.
- [PostgreSQL Solution](/docs/accessanalyzer/11.6/solutions/databases/postgresql/overview.md)
– Enterprise Auditor for PostgreSQL automates the process of understanding where
- PostgreSQL databases exist and provides an overview of the PostgreSQL environment in order to
+ PostgreSQL databases exist and provides an overview of the PostgreSQL environment to
answer questions around data access.
- [Redshift Solution](/docs/accessanalyzer/11.6/solutions/databases/redshift/overview.md)
– Redshift Solution Set is a comprehensive set of pre-configured audit jobs and reports that
@@ -37,7 +37,7 @@ reports that provide visibility into various aspects of supported databases:
information on users and roles, activity, permissions, configuration, sensitive data, and overall
security assessment for both the SQL 0.Collection Job Group and Azure SQL 0.Collection Job Group.
-The Database Solution license includes all supported database platforms supported by Enterprise
+The Database Solution license includes all database platforms supported by Enterprise
Auditor. Additionally, the Sensitive Data Discovery Add-On enables the solution to search database
content for sensitive data.
@@ -53,7 +53,7 @@ The following table identifies the type of audit functionality for each supporte
| PostgreSQL | | \*Partially Supported | | Fully Supported | \*\*Partially Supported |
| Redshift | | \*Partially Supported | | Fully Supported | \*\*Partially Supported |
-In the above table:
+The following notes apply to the table:
- \*Partially Supported, "Permission Audit" means the permissions as solely collected at the table
level.
diff --git a/docs/accessanalyzer/11.6/solutions/databases/postgresql/collection/pgsql_configuration.md b/docs/accessanalyzer/11.6/solutions/databases/postgresql/collection/pgsql_configuration.md
index aeccb79e94..8a061586fc 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/postgresql/collection/pgsql_configuration.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/postgresql/collection/pgsql_configuration.md
@@ -14,7 +14,7 @@ PostgreSQL servers.
The PgSQL_Configuration Job uses the SQL Data Collector.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/postgresql/collection/pgsql_sensitivedatascan.md b/docs/accessanalyzer/11.6/solutions/databases/postgresql/collection/pgsql_sensitivedatascan.md
index 55b15a912f..0e39f2c910 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/postgresql/collection/pgsql_sensitivedatascan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/postgresql/collection/pgsql_sensitivedatascan.md
@@ -24,18 +24,18 @@ The query is:
### Configure the SensitiveDataScan Query
The PgSQL_SensitiveDataScan Job is preconfigured to run using the default settings for the Sensitive
-Data Collection category. Follow the steps to customize configurations.
+Data Collection category. To customize configurations:
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **PostgreSQL** >
**PgSQL_SensitiveDataScan** > **Configure** node and select Queries.
-**Step 2 –** In the Query Selection view, select the **PostgreSQL** query click on Query Properties.
+**Step 2 –** In the Query Selection view, select the **PostgreSQL** query click Query Properties.
The Query Properties window appears.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for this
+Don't make changes to other wizard pages as they have been pre-configured for this
job.
:::
@@ -44,7 +44,7 @@ job.
**Step 4 –** To modify sensitive data scan options, navigate to the
[SQL Data Collector](/docs/accessanalyzer/11.6/admin/datacollector/sql/overview.md)
-page. Select the desired scan options.
+page. Select the scan options that you want.
:::note
The Sensitive Data Scan Settings are pre-configured for optimal performance for a
@@ -64,7 +64,7 @@ topic for additional information.
-**Step 6 –** PostgreSQL databases must be added to the query before they can be scanned. Navigate to
+**Step 6 –** Add PostgreSQL databases to the query before you scan them. Navigate to
the **Filter** page and click **Connections** to open the Manage Connections window.
@@ -85,7 +85,7 @@ objects. Click Retrieve. The Available database objects box will populate. The d
scan all PostgreSQL databases returned, excluding the listed system or default schemas and tables in
red. Databases and instances can be added in the following ways:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Use the Add Custom Filter button to create and apply a custom filter.
@@ -100,7 +100,7 @@ Navigate to the **Databases** > **0.Collection** > **PostgreSQL** > **PgSQL_Sen
**Configure** node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -112,4 +112,4 @@ The default analysis tasks are:
- Bring SA_SQL_Instances to View — Displays the SA_SQL_Instances table
- PostgreSQL SDD Matches View — Bring the PostgreSQL SDD Matches View to the SA console
- PostgreSQL SDD Match Hits View — Bring the PostgreSQL SDD Match Hits View to the SA console
-- PostgreSQL SDD AIC Import — Imports PostgreSQL SDD into the AIC
+- PostgreSQL SDD AIC Import — Imports PostgreSQL SDD into the Access Information Center (AIC)
diff --git a/docs/accessanalyzer/11.6/solutions/databases/postgresql/collection/pgsql_tableprivileges.md b/docs/accessanalyzer/11.6/solutions/databases/postgresql/collection/pgsql_tableprivileges.md
index 98ace0c5c9..5c2cfba0d2 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/postgresql/collection/pgsql_tableprivileges.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/postgresql/collection/pgsql_tableprivileges.md
@@ -14,7 +14,7 @@ targeted servers.
The PgSQL_TablePrivileges Job uses the SQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -30,7 +30,7 @@ Navigate to the **Databases** > **0.Collection** > **PostgreSQL** > **PgSQL_Tabl
**Configure** node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -39,5 +39,6 @@ preconfigured for this job.
The default analysis task is:
-- AIC Import - PostgreSQL Permissions – Imports PostgreSQL permissions to the AIC.
+- AIC Import - PostgreSQL Permissions – Imports PostgreSQL permissions to the Access Information
+ Center (AIC).
- AIC Import - Databases – Imports PostgreSQL database and schema nodes to the AIC.
diff --git a/docs/accessanalyzer/11.6/solutions/databases/postgresql/overview.md b/docs/accessanalyzer/11.6/solutions/databases/postgresql/overview.md
index cc736a3f22..16629c085f 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/postgresql/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/postgresql/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# PostgreSQL Solution
-Data privacy and security is quickly evolving to be on equal footing with traditional security
-measures focused on the network, hardware, or software the data is contained within. Organizations
+Data privacy and security is becoming as important as traditional security measures that focus on
+the network, hardware, or software where the data resides. Organizations
aligning to concepts like Data-Centric Audit and Protection (DCAP) as defined by Gartner, or the
requirements of strict compliance regulations like EU GDPR, are looking to implement processes that
help them understand where sensitive data is stored, who or what is leveraging their privileges to
@@ -15,7 +15,7 @@ access the data, and how each database has been configured.
As part of Netwrix comprehensive Data Access Governance suite for structured and unstructured data,
Enterprise Auditor for PostgreSQL automates the process of understanding where PostgreSQL databases
-exist and provides an overview of the PostgreSQL environment in order to answer questions around
+exist and provides an overview of the PostgreSQL environment to answer questions around
data access:
- Who has access to your data?
@@ -23,7 +23,7 @@ data access:
With visibility into every corner of PostgreSQL, organizations can proactively highlight and
prioritize risks to sensitive data. Additionally, organizations can automate manual, time-consuming,
-and expensive processes associated with compliance, security, and operations to easily adhere to
+and expensive processes associated with compliance, security, and operations to adhere to
best practices that keep PostgreSQL Server safe and operational.
**Supported Platforms**
@@ -42,8 +42,8 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
+which enables Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans,
+increase the minimum amount of RAM. Each thread requires a minimum of 2
additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
then an extra 16 GB of RAM are required (8x2=16).
@@ -52,9 +52,9 @@ resources on the Enterprise Auditor server.
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
-configuration; it has been preconfigured to work with Enterprise Auditor and should never be
-customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
+configuration; it has been preconfigured to work with Enterprise Auditor. Never customize it through
+Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
:::
@@ -62,14 +62,14 @@ environment.
**Location**
The Structured Sensitive Data Discovery License is required to run the PostgreSQL Solution. It can
-be installed from theEnterprise Auditor Instant Job Wizard. Once it has been installed into the Jobs
+be installed from theEnterprise Auditor Instant Job Wizard. After it has been installed into the Jobs
tree, navigate to the solution: Jobs > **Databases** > PostgreSQL.
The 0.Collection Job Group performs sensitive data discovery and collects information on database
configurations on the target hosts. The other job groups analyze and report on the data collected by
the 0.Collection Job Group.
-The Database Solution license includes all supported database platforms supported by Enterprise
+The Database Solution license includes all database platforms supported by Enterprise
Auditor. Additionally, the Sensitive Data Discovery Add-On enables the solution to search database
content for sensitive data.
diff --git a/docs/accessanalyzer/11.6/solutions/databases/postgresql/pgsql_databasesizing.md b/docs/accessanalyzer/11.6/solutions/databases/postgresql/pgsql_databasesizing.md
index 5a2980c0e6..9d560ece47 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/postgresql/pgsql_databasesizing.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/postgresql/pgsql_databasesizing.md
@@ -21,7 +21,7 @@ Navigate to the **Jobs > Databases > PostgreSQL > Configuration > PgSQL_Databa
node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/postgresql/recommended.md b/docs/accessanalyzer/11.6/solutions/databases/postgresql/recommended.md
index acd80433d3..41341e1e46 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/postgresql/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/postgresql/recommended.md
@@ -8,8 +8,8 @@ sidebar_position: 10
The jobs in the PostgreSQL Solution has been configured to inherit down from the **PostgreSQL** >
**Settings** node. However, it is best practice to assign the host list and the Connection Profile
-at the data collection level, 0.Collection Job Group. Once these are assigned to the job group, it
-can be run directly or scheduled.
+at the data collection level, 0.Collection Job Group. After you assign the host list and Connection
+Profile to the job group, you can run it directly or schedule it.
**Dependencies**
@@ -18,9 +18,9 @@ can be run directly or scheduled.
Enterprise Auditor Console server
- For AWS RDS and Aurora instances, right-click a job in the **PostgreSQL** > **0.Collection**
folder and open the properties window. Select the **Performance** tab and ensure that the **Skip
- Hosts that do not respond to PING**checkbox is not selected.
+ Hosts that don't respond to PING**checkbox isn't selected.
-**Targeted Host(s)**
+**Targeted Hosts**
- The 0.Collection Job Group must be set to run against a custom host list containing the
PostgreSQL database instances / clusters.
@@ -35,10 +35,10 @@ the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
topic for additional information on permissions and creating a SQL custom connection profile.
-The Connection Profile is set to **Use the Default Profile**, as configured at the global settings
-level. However, since this may not be the Connection Profile with the necessary permissions for the
-assigned hosts, click the radio button for the **Select one of the following user defined profiles**
-option and select the appropriate Connection Profile drop-down menu.
+The Connection Profile defaults to the **Use the Default Profile** setting, configured at the global
+settings level. If that profile doesn't have the permissions the assigned hosts need, select the
+radio button for the **Select one of the following user defined profiles** option, then choose the
+correct profile from the Connection Profile dropdown menu.
**Schedule Frequency**
@@ -46,7 +46,7 @@ Daily
**Run Order**
-The 0.Collection Job Group must be run first before running the other jobs and job groups.
+Run the 0.Collection Job Group first, before running the other jobs and job groups.
:::info
Run the solution at the top level: PostgreSQL Job Group
@@ -63,12 +63,12 @@ topic for additional information.
**Analysis Configuration**
This solution should be run with the default analysis configurations. These analysis tasks are
-preconfigured and should not be modified or deselected!
+preconfigured and shouldn't be modified or deselected.
Disabling obsolete or run-desired jobs allows the solution to run more efficiently. To disable a job
-or job group, right-click on the item and select **Disable Job**.
+or job group, right-click the item and select **Disable Job**.
:::info
-Do not delete any jobs. Instead, jobs should be disabled.
+Don't delete any jobs. Disable them instead.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedata.md b/docs/accessanalyzer/11.6/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedata.md
index 1df3808ffa..f94d75faf3 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedata.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedata.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs > Databases > PostgreSQL > Sensitive Data > PgSQL_Sens
node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedatapermissions.md b/docs/accessanalyzer/11.6/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedatapermissions.md
index 7d6e30433a..036662ed2c 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedatapermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedatapermissions.md
@@ -17,7 +17,7 @@ Data > PgSQL_SensitiveDataPermissions > Configure** node and select Analysis t
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/overview.md b/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/overview.md
index af71412166..2101ba3187 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# 0.Collection Job Group
The Redshift Solution Collection group collects high level summary information from targeted
-Redshift Servers. Other jobs in the Redshift Solution Set use this information for further analysis
+Redshift Servers. Other jobs in the Redshift Solution Set use this information for further analysis
and for producing respective reports.
diff --git a/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_configuration.md b/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_configuration.md
index efaa04d3e1..33e0f0433f 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_configuration.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_configuration.md
@@ -13,7 +13,7 @@ The Redshift_Configuration job returns additional configuration settings from Re
The Redshift_Configuration Job uses the SQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_sensitivedatascan.md b/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_sensitivedatascan.md
index fea66473ba..cfab61e4b3 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_sensitivedatascan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_sensitivedatascan.md
@@ -22,14 +22,13 @@ The query is:
## Recommended Configuration for the SensitiveDataScan Query
The Redshift_SensitiveDataScan Job is preconfigured to run using the default settings for the
-Sensitive Data Collection category. It is necessary only to set up the connection for the Redshift-
-SensitiveDataScan Job. Once the connection is established, it applies to any other 0.Collection job
-query. Follow the steps to customize configurations.
+Sensitive Data Collection category. You only need to set up the connection for the Redshift_SensitiveDataScan Job. After you establish
+the connection, it applies to any other 0.Collection job query. To customize configurations:
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **Redshift** >
**Redshift_SensitiveDataScan** > **Configure** node and select Queries.
-**Step 2 –** In the Query Selection view, select the Redshift Sensitive Data Scan query click on
+**Step 2 –** In the Query Selection view, select the Redshift Sensitive Data Scan query click
Query Properties. The Query Properties window appears.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard opens
@@ -41,7 +40,7 @@ with Sensitive Data Collection category selected.
-**Step 5 –** To modify sensitive data scan options, select the desired scan options. See the
+**Step 5 –** To modify sensitive data scan options, select the scan options you want. See the
[SQL: Options](/docs/accessanalyzer/11.6/admin/datacollector/sql/options.md)
page for additional information.
@@ -56,7 +55,7 @@ may significantly increase scan time.
-**Step 7 –** To modify criteria, click on **Use the following selected criteria:** and select your
+**Step 7 –** To modify criteria, click **Use the following selected criteria:** and select your
choices. By default, the Sensitive Data Scan job is set to **Use Global Criteria**. Also by default,
the following System Criteria have been selected:
@@ -117,7 +116,7 @@ page.
**Step 14 –** Add the Databases and instances to be audited. Databases and instances can be added in
the following ways:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Optionally use the Add Custom Filter button to create and apply a custom filter.
@@ -131,13 +130,13 @@ The 1-Db2_SensitsveDataScan Job is now ready to run with the customized settings
## Analysis Tasks for the Redshift_SensitiveDataScan
-Navigate to the _**_Databases > 0.Collection >**Redshift >__ **Redshift_SensitiveDataScan** >
-**Configure** node and select **Analysis** to view the Analysis Tasks. The Analysis tasks do not
+Navigate to the **Databases** > **0.Collection** > **Redshift** > **Redshift_SensitiveDataScan** >
+**Configure** node and select **Analysis** to view the Analysis Tasks. The Analysis tasks don't
require any configuration as they just populate the reports with the collected information and do
not collect data themselves.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_tableprivileges.md b/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_tableprivileges.md
index e3e5791d24..15ba204ac6 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_tableprivileges.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_tableprivileges.md
@@ -14,7 +14,7 @@ targeted servers.
The Redshift_TablePrivileges Job uses the SQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -30,7 +30,7 @@ Navigate to the **Databases** > **0.Collection** > **Redshift** > **Redshift_Tab
**Configure** node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/redshift/overview.md b/docs/accessanalyzer/11.6/solutions/databases/redshift/overview.md
index 01301ddf1f..0900226650 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/redshift/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/redshift/overview.md
@@ -15,8 +15,8 @@ Data Discovery Add-On enables the solution to search Redshift and AWS content fo
**Supported Platforms**
-- Amazon AWS Redshift
-- AWS Redshift Cluster
+- Amazon AWS Redshift
+- AWS Redshift Cluster
**Requirements, Permissions, and Ports**
@@ -26,18 +26,18 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
-then an extra 16 GB of RAM are required (8x2=16).
+Install the Sensitive Data Discovery Add-On on the Enterprise Auditor Console server to enable
+Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans, increase the
+minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For
+example, if the job is configured to scan 8 hosts at a time, it requires an extra 16 GB of RAM
+(8x2=16).
By default, the job is configured to use 10 threads, which can be adjusted based on available
resources on the Enterprise Auditor server.
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
configuration; it has been preconfigured to work with Enterprise Auditor and should never be
customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
@@ -47,20 +47,19 @@ environment.
**Location**
The Redshift Solution requires a special Enterprise Auditor license. It can be installed from the
-Enterprise Auditor Instant Job Wizard. Once it has been installed in the **Jobs** tree, navigate to
+Enterprise Auditor Instant Job Wizard. After it has been installed in the **Jobs** tree, navigate to
the solution: **Jobs** > **Databases** > **Redshift Solution**.
The 0.Collection Job Group discovers SQL instances on the target hosts, and collects the data. The
other job groups analyze the collected data and generate reports.
-The Database Solution license includes all supported database platforms supported by Enterprise
-Auditor. Additionally, the Sensitive Data Discovery Add-On enables the solution to search database
+The Database Solution license includes all database platforms supported by Enterprise Auditor. Additionally, the Sensitive Data Discovery Add-On enables the solution to search database
content for sensitive data.
## Redshift Job Group
-The Enterprise Auditor Redshift Solution Set is a set of preconfigured audit jobs and reports that
-provides visibility into Redshift Sensitive Data.
+The Enterprise Auditor Redshift Solution Set is a set of preconfigured audit jobs and reports that
+provides visibility into Redshift Sensitive Data.
@@ -69,7 +68,7 @@ The following job groups comprise the Redshift Job Group:
- [0.Collection Job Group](/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/overview.md)
— Collects high level summary information from targeted Redshift Servers. Other jobs in the
Redshift Solution Set use this information for further analysis and producing respective report.
- This Job Group is comprised of the following jobs(s)
+ This Job Group is comprised of the following jobs
- [Redshift_Configuration Job](/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_configuration.md)
- [Redshift_SensitiveDataScan Job](/docs/accessanalyzer/11.6/solutions/databases/redshift/collection/redshift_sensitivedatascan.md)
@@ -81,7 +80,7 @@ The following job groups comprise the Redshift Job Group:
- [Sensitive Data Job Group](/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/overview.md)
— Provides insight into where sensitive data exists and who has access to it across all the
- targeted Redshift databases.This Job Group is comprised of the following job(s):
+ targeted Redshift databases. This Job Group is comprised of the following jobs:
- [Redshift_SensitiveData Job](/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/redshift_sensitivedata.md)
- [Redshift_SensitiveDataPermissions Job](/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/redshift_sensitivedatapermissions.md)
diff --git a/docs/accessanalyzer/11.6/solutions/databases/redshift/recommended.md b/docs/accessanalyzer/11.6/solutions/databases/redshift/recommended.md
index 356fbdfe57..e4104a114e 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/redshift/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/redshift/recommended.md
@@ -8,7 +8,7 @@ sidebar_position: 10
The Redshift Solution is configured to inherit settings from the global Settings node. However, it
is best practice to assign the host list and the Connection Profile at the data collection level,
-the 0.Collection Job Group. Once these are assigned to the job group, it can be run directly or
+the 0.Collection Job Group. After these are assigned to the job group, it can be run directly or
scheduled.
**Dependencies**
@@ -16,7 +16,7 @@ scheduled.
- For Sensitive Data Discovery Auditing – Sensitive Data Discovery Add-On installed on the
Enterprise Auditor Console server
-**Targeted Host(s)**
+**Targeted Hosts**
The Redshift Job Group has been configured to inherit the host list assignment from the collection
group level.
@@ -28,7 +28,7 @@ The host list assignment should be assigned under the **Redshift** > **0.Collect
The SQL Data Collector requires a specific set of permissions. See the Permissions section for
necessary permissions. The account used can be either an Active Directory account or a SQL account.
-Once the account has been provisioned, create a custom Connection Profile containing the credentials
+After the account has been provisioned, create a custom Connection Profile containing the credentials
for the targeted environment. See the
[SQL Custom Connection Profile & Default Dynamic Host List](/docs/accessanalyzer/11.6/admin/datacollector/sql/configurejob.md)
topic for additional information.
@@ -37,7 +37,7 @@ The Connection Profile should be assigned under the **Redshift** > **0.Collectio
**Connection** node. It is set to **Use the Default Profile**, as configured at the global settings
level. However, since this may not be the Connection Profile with the necessary permissions for the
assigned hosts, click the radio button for the **Select one of the following user defined profiles**
-option and select the appropriate Connection Profile drop-down menu.
+option and select the appropriate Connection Profile dropdown menu.
See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
diff --git a/docs/accessanalyzer/11.6/solutions/databases/redshift/redshift_databasesizing.md b/docs/accessanalyzer/11.6/solutions/databases/redshift/redshift_databasesizing.md
index ed25a6b867..fc47afe84b 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/redshift/redshift_databasesizing.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/redshift/redshift_databasesizing.md
@@ -11,7 +11,7 @@ vulnerabilities related to instance configuration settings.
-The job(s) in the Configuration Job Group are:
+The jobs in the Configuration Job Group are:
- Redshift_DatabaseSizing Job — Provides details about Redshift databases and overall database size.
@@ -21,7 +21,7 @@ Navigate to the **Jobs** > **Databases**> **Redshift** > **Configuration** >
**Redshift_DatabaseSizing** > **Configure** node and select **Analysis** to view the Analysis Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/overview.md b/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/overview.md
index 3c5a302d3e..61eda88a86 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/overview.md
@@ -11,7 +11,7 @@ targeted Redshift databases.
-The job(s) in the Sensitive Data Job Group are:
+The jobs in the Sensitive Data Job Group are:
- [Redshift_SensitiveData Job](/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/redshift_sensitivedata.md) -
Provides information on all the data that was discovered in the targeted Redshift database servers
diff --git a/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/redshift_sensitivedata.md b/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/redshift_sensitivedata.md
index 2418374e0c..ea103abb8e 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/redshift_sensitivedata.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/redshift_sensitivedata.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Databases** > **Redshift** > **Sensitive Data** >
**Redshift_SensitiveData** > **Configure** node and select **Analysis** to view the Analysis Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/redshift_sensitivedatapermissions.md b/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/redshift_sensitivedatapermissions.md
index 0042bef71d..213c3b0bb6 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/redshift_sensitivedatapermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/redshift/sensitivedata/redshift_sensitivedatapermissions.md
@@ -17,7 +17,7 @@ Data > Redshift_SensitiveDataPermissions > Configure** node and select Analysi
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_activity.md b/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_activity.md
index 62c0302942..39a701f5eb 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_activity.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_activity.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 2.Activity > SQL_Activity > Configure node
to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_logons.md b/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_logons.md
index 5db2f078c9..3a470b4277 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_logons.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_logons.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 2.Activity > SQL_Logons > Configure node
to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_permissionchanges.md b/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_permissionchanges.md
index 3ae0d356e3..2b22089357 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_permissionchanges.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_permissionchanges.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 2.Activity > SQL_PermissionChanges > Conf
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_sensitivedataactivity.md b/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_sensitivedataactivity.md
index baf074ecf3..ec487f4621 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_sensitivedataactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_sensitivedataactivity.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 2.Activity > SQL_SensitiveDataActivity > C
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_unusualactivity.md b/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_unusualactivity.md
index 0d16e0a701..3f52cd8b98 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_unusualactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/activity/sql_unusualactivity.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 2.Activity > SQL_UnusualActivity > Config
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/0-azuresql_instancediscovery.md b/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/0-azuresql_instancediscovery.md
index 9cc2d3f36c..6cdf5ee53c 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/0-azuresql_instancediscovery.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/0-azuresql_instancediscovery.md
@@ -25,7 +25,7 @@ Navigate to the **Databases** > **0.Collection** > **AzureSQL** > **0-AzureSQL_I
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/1-azuresql_permissionscan.md b/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/1-azuresql_permissionscan.md
index 9f5315601f..5dbfb74734 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/1-azuresql_permissionscan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/1-azuresql_permissionscan.md
@@ -20,18 +20,18 @@ The 1–AzureSQL_PermissionsScan Job uses the SQL Data Collector for the followi
### Configure the PermissionsScan Query
The 1-AzureSQL_PermissionScan Job is preconfigured to run using the default settings within the
-Permissions Collection category. Follow the steps to customize configurations.
+Permissions Collection category. To customize configurations:
**Step 1 –** Navigate to the **Databases** > 0.Collection > AzureSQL > 1-AzureSQL_PermissionsScan >
Configure node and select **Queries**.
-**Step 2 –** In the Query Selection view, select the PermissionsScan query and click on Query
+**Step 2 –** In the Query Selection view, select the PermissionsScan query and click Query
Properties. The Query Properties window appears.
**Step 3 –** Select the Data Source tab and click Configure. The SQL Data Collector Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for this
+Don't make changes to other wizard pages as they have been pre-configured for this
job.
:::
@@ -44,7 +44,7 @@ page. The default query target is All databases. The default query scope is Only
objects and click Retrieve. The Available database objects will be populated. Databases and
instances can be added in the following ways:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Optionally, use the Add Custom Filter button to create and apply a custom filter.
@@ -71,7 +71,7 @@ Navigate to the Databases > 0.Collection > **AzureSQL** > 1-AzureSQL_Permissions
node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/2-azuresql_sensitivedatascan.md b/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/2-azuresql_sensitivedatascan.md
index 1620360dcd..2b565c0946 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/2-azuresql_sensitivedatascan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/2-azuresql_sensitivedatascan.md
@@ -23,7 +23,7 @@ Navigate to the **Databases** > **0.Collection** > **AzureSQL** > **2–AzureSQL
**Configure** node and select Analysis to view the analysis task.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/3-azuresql_activityscan.md b/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/3-azuresql_activityscan.md
index 4265140207..a39058fa10 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/3-azuresql_activityscan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/3-azuresql_activityscan.md
@@ -23,7 +23,7 @@ Navigate to the **Databases** > **0.Collection** > **Azure SQL** >
**3–AzureSQL_ActivityScan** > **Configure** node and select **Analysis** to view the analysis task.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/4-azuresql_serversettings.md b/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/4-azuresql_serversettings.md
index 261db9ba83..263ff6c87c 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/4-azuresql_serversettings.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/4-azuresql_serversettings.md
@@ -29,7 +29,7 @@ Navigate to the **Databases** > **0.Collection** > **Azure SQL** >
task.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/collection/0-sql_instancediscovery.md b/docs/accessanalyzer/11.6/solutions/databases/sql/collection/0-sql_instancediscovery.md
index 839d1e5b40..72db443e22 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/collection/0-sql_instancediscovery.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/collection/0-sql_instancediscovery.md
@@ -24,7 +24,7 @@ Navigate to the **Databases** > **0.Collection** > **SQL** > **0-SQL_InstanceDis
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/collection/1-sql_permissionsscan.md b/docs/accessanalyzer/11.6/solutions/databases/sql/collection/1-sql_permissionsscan.md
index a6e1cfc613..a1b8009e8e 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/collection/1-sql_permissionsscan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/collection/1-sql_permissionsscan.md
@@ -23,18 +23,18 @@ The 1-SQL_PermissionsScan Job uses the SQL Data Collector for the following quer
### Configure the PermissionsScan Query
The 1-SQL_PermissionScan Job is preconfigured to run using the default settings within the
-Permissions Collection category. Follow the steps to customize configurations.
+Permissions Collection category. To customize configurations:
**Step 1 –** Navigate to the **Databases** > 0.Collection > SQL > 1-SQL_PermissionsScan > Configure
node and select Queries.
-**Step 2 –** In the Query Selection view, select the PermissionsScan query and click on Query
+**Step 2 –** In the Query Selection view, select the PermissionsScan query and click Query
Properties. The Query Properties window appears.
**Step 3 –** Select the Data Source tab and click Configure. The SQL Data Collector Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for this
+Don't make changes to other wizard pages as they have been pre-configured for this
job.
:::
@@ -47,7 +47,7 @@ page. The default query target is All databases. The default query scope is Only
objects and click Retrieve. The Available database objects will be populated. Databases and
instances can be added in the following ways:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Optionally, use the Add Custom Filter button to create and apply a custom filter.
@@ -62,7 +62,7 @@ Navigate to the **Databases** > 0.Collection > SQL > 1-SQL_PermissionsScan > Con
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -71,7 +71,7 @@ preconfigured for this job.
The default analysis tasks are:
-- Remove Old AIC Resources — Removes AIC resources using the old path that did not include the
+- Remove Old AIC Resources — Removes AIC resources using the old path that didn't include the
schema
- AIC Import – Hosts — Imports SQL hosts to the AIC
- AIC Import – Instance Permissions Node — Imports a node for instance permissions for each instance
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/collection/2-sql_sensitivedatascan.md b/docs/accessanalyzer/11.6/solutions/databases/sql/collection/2-sql_sensitivedatascan.md
index f6b65f89c7..10a9ba344e 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/collection/2-sql_sensitivedatascan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/collection/2-sql_sensitivedatascan.md
@@ -36,25 +36,25 @@ The SensitiveDataScan Job uses the SQL Data Collector for the following query:
### Configure the SensitiveDataScan Query
The 2-SQL_SensitiveDataScan Job is preconfigured to run using the default settings for the Sensitive
-Data Collection category. Follow the steps to customize configurations.
+Data Collection category. To customize configurations:
**Step 1 –** Navigate to the **Databases** > 0.Collection > SQL > 2-SQL_SensitiveDataScan >
Configure node and select Queries.
-**Step 2 –** In the Query Selection view, select the SensitiveDataScan query click on Query
+**Step 2 –** In the Query Selection view, select the SensitiveDataScan query click Query
Properties. The Query Properties window appears.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for this
+Don't make changes to other wizard pages as they have been pre-configured for this
job.
:::
-**Step 4 –** Select the desired scan options. Navigate to the
+**Step 4 –** Select the scan options you want. Navigate to the
[SQL: Options](/docs/accessanalyzer/11.6/admin/datacollector/sql/options.md)
page for additional information.
@@ -89,7 +89,7 @@ page. The query is configured by default to target Only select database objects.
Available database objects box will populate. Databases and instances can be added in the following
ways:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Optionally use the Add Custom Filter button to create and apply a custom filter.
@@ -104,7 +104,7 @@ Navigate to the **Databases** > 0.Collection > SQL > 2-SQL_SensitiveDataScan >
select Analysis to view the analysis task.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/collection/3-sql_activityscan.md b/docs/accessanalyzer/11.6/solutions/databases/sql/collection/3-sql_activityscan.md
index 8bdc9de65d..8e0c599c19 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/collection/3-sql_activityscan.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/collection/3-sql_activityscan.md
@@ -30,18 +30,18 @@ The ActivityScan Job uses the SQL Data Collector for the following query:
### Configure the ActivityScan Query
The 3-SQL_ActivityScan Job is preconfigured to run using the default settings within the Server
-Audits Events Collection category. Follow the steps to customize configurations.
+Audits Events Collection category. To customize configurations:
**Step 1 –** Navigate to the **Databases** > 0.Collection > SQL > 3-SQL_ActivityScan > Configure
node and select Queries.
-**Step 2 –** In the Query Selection view, click on Query Properties. The Query Properties window
+**Step 2 –** In the Query Selection view, click Query Properties. The Query Properties window
appears.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -50,7 +50,7 @@ purpose of this job.
**Step 4 –** To modify scan options, navigate to the
[SQL Data Collector](/docs/accessanalyzer/11.6/admin/datacollector/sql/overview.md)
-page. Select the desired scan options. The query is preconfigured with the following default
+page. Select the scan options you want. The query is preconfigured with the following default
settings:
- Collect only events since last scan – Collects activity recorded since the previous scan
@@ -66,7 +66,7 @@ page. The query is configured by default to target Only select database objects.
Available database objects will be populated. Databases and instances can be added in the following
ways:
-Select the desired database objects and click Add.
+Select the database objects you want and click Add.
Use the Import CSV button to import a list from a CSV file.
@@ -83,7 +83,7 @@ Navigate to the **Databases** > 0.Collection > SQL > 3-SQL_ActivityScan > Config
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/collection/4-sql_serverlogons.md b/docs/accessanalyzer/11.6/solutions/databases/sql/collection/4-sql_serverlogons.md
index 371447770e..cc50b2fc80 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/collection/4-sql_serverlogons.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/collection/4-sql_serverlogons.md
@@ -15,7 +15,7 @@ The AppnLogSQL Query uses the SMARTLog Data Collector and has been preconfigured
Windows Event Log Type.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/collection/5-sql_serversettings.md b/docs/accessanalyzer/11.6/solutions/databases/sql/collection/5-sql_serversettings.md
index 47238b4103..cf32d36c64 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/collection/5-sql_serversettings.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/collection/5-sql_serversettings.md
@@ -35,19 +35,19 @@ The 5-SQL_ServerSettings Job uses the SQL Data Collector for the following queri
### Configure the Configuration Query
The 5-SQL_ServerSettings Job’s Configuration Query is configured to run with the default settings
-with the Configuration Properties category. Follow the steps to customize configurations.
+with the Configuration Properties category. To customize configurations:
**Step 1 –** Navigate to the **Databases** > 0.Collection > SQL > 5-SQL_ServerSettings > Configure
node and select Queries.
-**Step 2 –** In the Query Selection view, select the Configuration Query and click on Query
+**Step 2 –** In the Query Selection view, select the Configuration Query and click Query
Properties. The Query Properties window will appear.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard will
open.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -60,7 +60,7 @@ page. The query is configured by default to target All instances. Change the que
select instances, and click Retrieve. The Available server audits will be populated. Databases and
instances can be added in the following ways:
-- Select the desired instances and click Add.
+- Select the instances you want and click Add.
- Use the Import CSV button to import a list from a CSV file.
- (Optional) Use the Add Custom Filter button to create and apply a custom filter.
@@ -73,20 +73,20 @@ The 5-SQL_ServerSettings Job is now ready to run with the customized settings.
The 5-SQL_ServerSettingsJob > Server Query has been preconfigured to run with the default settings
with the category of Server Properties. However, the query can be scoped to target specific
-databases/instances on the Filters page of the SQL Data Collector Wizard. Follow these steps to
-modify the query configuration.
+databases/instances on the Filters page of the SQL Data Collector Wizard. To
+modify the query configuration:
**Step 1 –** Navigate to the **Databases** > 0.Collection > SQL > 5-SQL_ServerSettings > Configure
node and select Queries.
-**Step 2 –** In the Query Selection view, select the Server query click on Query Properties. The
+**Step 2 –** In the Query Selection view, select the Server query click Query Properties. The
Query Properties window will appear.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard will
open.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -99,7 +99,7 @@ page. The query is configured by default to target All instances. Change the que
select instances, and click Retrieve. The Available server audits will be populated. Databases and
instances can be added in the following ways:
-- Select the desired instances and click Add.
+- Select the instances you want and click Add.
- Use the Import CSV button to import a list from a CSV file.
- Optionally use the Add Custom Filter button to create and apply a custom filter.
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/overview.md b/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/overview.md
index 0bbc16ddf2..492e7181f1 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/overview.md
@@ -16,7 +16,7 @@ The jobs in the 4.Configuration Job Group are:
- [SQL_Authentication Job](/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_authentication.md)
– This job identifies authentication settings on targeted SQL and Azure SQL servers that allow SQL
server authentication in addition to Windows authentication. Microsoft recommends that the SQL and
- Azure SQL servers should be generally configured to utilize Windows authentication versus SQL
+ Azure SQL servers should be generally configured to use Windows authentication versus SQL
authentication.
- [SQL_BestPractices Job](/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_bestpractices.md)
– This job is designed to analyze SQL and Azure SQL server configuration settings and report on
@@ -25,12 +25,12 @@ The jobs in the 4.Configuration Job Group are:
- [SQL_CMDShell Job](/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_cmdshell.md)
– This job is designed to report if the `xp_cmdshell `stored procedure is enabled or disabled.
Since `xp_cmdshell` allows a user to execute operating system commands when connected to the SQL
- or Azure SQL server, it can be used to launch malicious attacks. Microsoft recommends that the
+ or Azure SQL server, attackers can use it to launch malicious attacks. Microsoft recommends that the
`xp_cmdshell` stored procedure be disabled.
- [SQL_DatabaseSizing Job](/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_databasesizing.md)
– Provides details on database file sizes and overall database sizes
- [SQL_LinkedServers Job](/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_linkedservers.md)
– Identifies Linked Servers or remote database servers on which the identified SQL and Azure
SQL server can execute commands. Some of the common remote OLE DB providers include IBM DB2,
- Oracle, Access and Excel. Typically, linked servers are used to handle distributed queries in SQL
+ Oracle, Access, and Excel. Typically, linked servers are used to handle distributed queries in SQL
and Azure SQL server.
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_authentication.md b/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_authentication.md
index 113794dbd4..aa04c331b3 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_authentication.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_authentication.md
@@ -8,7 +8,7 @@ sidebar_position: 10
The SQL_Authentication Job identifies authentication settings on targeted SQL and Azure SQL servers
that allow SQL server authentication in addition to Windows authentication. Microsoft recommends
-that SQL and Azure SQL servers should be generally configured to utilize Windows authentication
+that SQL and Azure SQL servers should be generally configured to use Windows authentication
versus SQL server authentication.
## Analysis Tasks for the SQL_Authentication Job
@@ -17,7 +17,7 @@ Navigate to the **Databases** > SQL > 4.Configuration > SQL_Authentication > Con
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -36,4 +36,4 @@ produces the following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SQL Authentication | This report identifies authentication settings on the targeted servers, and highlights those with SQL Authentication enabled. Additionally, the number of SQL logins on a given instance, and whether or not the 'sa' login exists, are indicated. Best practices recommend that SQL instances be integrated login only, and that the 'sa' principal be renamed or removed. | None | This report is comprised of two elements: - Pie Chart – Displays instances with integrated security only
- Table – Displays integrated security details by instance
|
+| SQL Authentication | This report identifies authentication settings on the targeted servers, and highlights those with SQL Authentication enabled. Additionally, the number of SQL logins on a given instance, and whether the 'sa' login exists, are indicated. Best practices recommend that SQL instances be integrated login only, and that the 'sa' principal be renamed or removed. | None | This report is comprised of two elements: - Pie Chart – Displays instances with integrated security only
- Table – Displays integrated security details by instance
|
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_bestpractices.md b/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_bestpractices.md
index d6c08ab147..36e78ddbd9 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_bestpractices.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_bestpractices.md
@@ -16,7 +16,7 @@ Navigate to the **Databases** > SQL > 4.Configuration > SQL_BestPractices > Con
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_cmdshell.md b/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_cmdshell.md
index 7cef870ba5..80a725834a 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_cmdshell.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_cmdshell.md
@@ -7,8 +7,8 @@ sidebar_position: 30
# SQL_CMDShell Job
The SQL_CMDShell Job reports on whether the `xp_cmdshell` stored procedure is enabled or disabled.
-Since `xp_cmdshell` allows users to execute operating system commands when connected to the SQL or
-the Azure SQL server, it can be used to launch malicious attacks. Microsoft recommends that the
+Since `xp_cmdshell` lets users execute operating system commands when connected to the SQL or
+the Azure SQL server, attackers can use it to launch malicious attacks. Microsoft recommends that the
`xp_cmdshell` stored procedure be disabled.
## Analysis Tasks for the SQL_CMDShell Job
@@ -17,7 +17,7 @@ Navigate to the **Databases** > SQL > 4.Configuration > SQL_CMDShell > Configure
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_databasesizing.md b/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_databasesizing.md
index 86f0bf4aab..9f3a063ee9 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_databasesizing.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_databasesizing.md
@@ -14,7 +14,7 @@ Navigate to the **Databases** > Jobs > SQL > 4.Configuration > SQL_DatabaseSizi
node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_linkedservers.md b/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_linkedservers.md
index fa96ccd638..0cfbde1ecd 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_linkedservers.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/configuration/sql_linkedservers.md
@@ -8,7 +8,7 @@ sidebar_position: 50
The SQL_LinkedServers Job identifies Linked Servers or remote database servers on which the
identified SQL and Azure SQL servers can execute commands. Some of the common remote
-OLE DB providers include IBM DB2, Oracle, Access and Excel. Typically, linked servers are used to
+OLE DB providers include IBM DB2, Oracle, Access, and Excel. Typically, linked servers are used to
handle distributed queries in SQL and Azure SQL server .
## Analysis Tasks for the SQL_LinkedServers Job
@@ -17,7 +17,7 @@ Navigate to the **Databases** > Jobs > SQL > 4.Configuration > SQL_LinkedServers
and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
pre-configured for this job.
:::
@@ -34,4 +34,4 @@ following preconfigured report:
| Report | Description | Default Tags | Report Elements |
| -------------- | ----------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Linked Servers | This report highlights Linked Servers where the listed SQL Server is able to execute remote commands. | None | This report is comprised of three elements: - Bar Chart – Provides information on top five linked servers by instance
- Table – Provides details on linked servers by instance
- Table – Provides details on linked servers
|
+| Linked Servers | This report highlights Linked Servers where the listed SQL Server can execute remote commands. | None | This report is comprised of three elements: - Bar Chart – Provides information on top five linked servers by instance
- Table – Provides details on linked servers by instance
- Table – Provides details on linked servers
|
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/overview.md b/docs/accessanalyzer/11.6/solutions/databases/sql/overview.md
index 211a22e835..2ad8fe090b 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/overview.md
@@ -29,14 +29,14 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans.If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host.For example, if the job is configured to scan 8 hosts at a time , then
-an extra 16 GB of RAM are required (8x2=16).
+which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, you
+must increase the minimum amount of RAM. Each thread requires a minimum of 2
+additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time, you
+need an extra 16 GB of RAM (8 x 2 = 16).
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
configuration; it has been preconfigured to work with Enterprise Auditor and should never be
customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/overview.md b/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/overview.md
index 0c5fa1d070..a8ddb2d9c6 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/overview.md
@@ -15,7 +15,7 @@ The jobs in the 3.Permissions Job Group are:
- [SQL_ControlServer Job](/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_controlserver.md)
– This job will provide information on control server permissions. Users with control server
- permissions allow users to command full control of a SQL and Azure SQL server instances
+ permissions can command full control of a SQL and Azure SQL server instances
- [SQL_DirectPermissions Job](/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_directpermissions.md)
– This job will provide information about the permissions granted to users at the schema,
database, and server levels
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_controlserver.md b/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_controlserver.md
index b8fb6ba3c7..64aa997e73 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_controlserver.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_controlserver.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Permissions > SQL_ControlServer > Confi
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_directpermissions.md b/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_directpermissions.md
index 28f344c825..42f1601132 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_directpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_directpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Permissions > SQL_DirectPermissions > Co
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_domainuserpermissions.md b/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_domainuserpermissions.md
index 7d50e25482..6146a2b921 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_domainuserpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_domainuserpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Permissions > SQL_DomainUserPermissions
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_publicpermissions.md b/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_publicpermissions.md
index 4705686043..24a4ab2aaf 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_publicpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_publicpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 5.Permissions > SQL_PublicPermissions > C
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -29,7 +29,7 @@ The default analysis tasks are:
- Public Permissions Summary – Creates the SA_SQLServer_PublicPermissions_DatabaseSummary table
accessible under the job’s Results node
- Public Permissions Summary – Highlights permissions that have been granted to the public role on
- objects that are not-default SQL or Azure SQL server objects
+ non-default SQL or Azure SQL server objects
- Public Permissions Instance Summary (Non-Default) – Summarizes non-default SQL and Azure SQL
server public permissions by instance
@@ -38,4 +38,4 @@ produces the following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| ------------------ | -------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Public Permissions | This report determines highlights objects with public permissions applied. | None | This report is comprised of three elements: - Bar Chart – Displays top databases by public permission count
- Table – Provides details on databases by public permission count
- Table – Provides details on public permission details
|
+| Public Permissions | This report highlights objects with public permissions applied. | None | This report is comprised of three elements: - Bar Chart – Displays top databases by public permission count
- Table – Provides details on databases by public permission count
- Table – Provides details on public permission details
|
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_serverpermissions.md b/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_serverpermissions.md
index 36dc355de6..b7e291dd62 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_serverpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/permissions/sql_serverpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Permissions > SQL_ServerPermissions > C
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/recommended.md b/docs/accessanalyzer/11.6/solutions/databases/sql/recommended.md
index 4e894a7d4d..ed0dcfe4c2 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/recommended.md
@@ -18,8 +18,8 @@ The SQL Solution Jobs report on both the SQL and Azure SQL Collection Jobs.
The SQL Solution has been configured to inherit down from the SQL > Settings node. However, it is
best practice to assign the host list and the Connection Profile at the data collection level, the
-0.Collection Job Group. Once these are assigned to the job group, it can be run directly or
-scheduled.
+0.Collection Job Group. After you assign these to the job group, you can run it directly or
+schedule it.
**Dependencies**
@@ -40,13 +40,13 @@ scheduled.
- [Privileged Accounts Job Group](/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/overview.md)
- [Privileged Accounts Job Group](/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/overview.md)
-Some of the 0.Collection Job Group queries can be scoped to target specific databases/instances.
-However, it is necessary for the SA_SQL_Instances table to be populated before attempting to scope
-the queries. Therefore, the
+You can scope some of the 0.Collection Job Group queries to target specific databases/instances.
+However, you must populate the SA_SQL_Instances table before scoping the queries. Therefore,
+manually run the
[0-SQL_InstanceDiscovery Job](/docs/accessanalyzer/11.6/solutions/databases/sql/collection/0-sql_instancediscovery.md)
-must be manually executed before attempting to scope the 0.Collection Job Group queries.
+before scoping the 0.Collection Job Group queries.
-**Targeted Host(s)**
+**Targeted Hosts**
The 0.Collection Job Group has been set to run against the following default dynamic host list:
@@ -54,7 +54,7 @@ The 0.Collection Job Group has been set to run against the following default dyn
:::note
Default dynamic host lists are populated from hosts in the Host Master Table which
- meet the host inventory criteria for the list. Ensure the appropriate host list(s) have been
+ meet the host inventory criteria for the list. Ensure the appropriate host lists have been
populated through host inventory results.
:::
@@ -63,16 +63,16 @@ The 0.Collection Job Group has been set to run against the following default dyn
The SQL Data Collector requires a specific set of permissions. See the Permissions section for
necessary permissions. The account used can be either an Active Directory account or a SQL account.
-Once the account has been provisioned, create a custom Connection Profile containing the credentials
+After the account has been provisioned, create a custom Connection Profile containing the credentials
for the targeted environment. See the
[SQL Custom Connection Profile & Default Dynamic Host List](/docs/accessanalyzer/11.6/admin/datacollector/sql/configurejob.md)
topic for additional information.
-The Connection Profile should be assigned under the SQL > 0.Collection > Settings > Connection node.
+Assign the Connection Profile under the SQL > 0.Collection > Settings > Connection node.
It is set to Use the Default Profile, as configured at the global settings level. However, since
this may not be the Connection Profile with the necessary permissions for the assigned hosts, click
the radio button for the Select one of the following user defined profiles option and select the
-appropriate Connection Profile drop-down menu.
+appropriate Connection Profile dropdown menu.
See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
@@ -80,15 +80,15 @@ topic for additional information.
**Schedule Frequency**
-One of the most important decisions to make is how frequently to collect this data. The SQL Job
-Group can be scheduled to run as desired depending on the types of auditing being conducted and the
-scope of the target environment. The general recommendation is to schedule the solution to run
+One of the most important decisions to make is how frequently to collect this data. You can
+schedule the SQL Job Group to run as desired depending on the types of auditing being conducted and
+the scope of the target environment. Schedule the solution to run
daily.
**Run Order**
-The 0.Collection Jobs must be run first and in order. The other SQL Solution sub-job groups can be
-run in any order, together or individually, after running the 0.Collection Job Group.
+Run the 0.Collection Jobs first and in order. You can run the other SQL Solution sub-job groups in
+any order, together or individually, after running the 0.Collection Job Group.
:::info
Run the solution at the top level.
@@ -124,20 +124,20 @@ Prerequisites:
The Azure SQL Solution has been configured to inherit down from the Azure SQL > Settings node.
However, it is best practice to assign the host list and the Connection Profile at the data
-collection level, the 0.Collection Job Group. Once these are assigned to the job group, it can be
-run directly or scheduled.
+collection level, the 0.Collection Job Group. After you assign these to the job group, you can
+run it directly or schedule it.
**Dependencies**
- Full registration within Microsoft's Azure portal:
- - Creation of a Enterprise Auditor Azure SQL Role in the Access control (IAM) section
+ - Creation of an Enterprise Auditor Azure SQL Role in the Access control (IAM) section
- Successful registration of the Enterprise Auditor app
- Successful creation of an Application (client) ID
- Successful configuration of an AzureSQL-specific connection profile
- Creation of an Azure Tenancy host list (ex. COMPANY.onmicrosoft.com) and Azure Active Directory
- user credential(s)
+ user credentials
:::info
To avoid functional issues with Enterprise Auditor, create multiple
@@ -149,7 +149,7 @@ run directly or scheduled.
- [0-AzureSQL_InstanceDiscovery Job](/docs/accessanalyzer/11.6/solutions/databases/sql/collection-azuresql/0-azuresql_instancediscovery.md)
run successfully
-**Targeted Host(s)**
+**Targeted Hosts**
The 0.Collection Job Group has been set to run against the following default dynamic host list:
@@ -159,16 +159,16 @@ The 0.Collection Job Group has been set to run against the following default dyn
The SQL Data Collector requires a specific set of permissions. See the Permissions section for
necessary permissions. The account used can be either an Active Directory account with database
-login enabled or a SQL account. Once the account has been provisioned, create a custom Connection
+login enabled or a SQL account. After the account has been provisioned, create a custom Connection
Profile containing the credentials for the targeted environment. See the
[SQL Custom Connection Profile & Default Dynamic Host List](/docs/accessanalyzer/11.6/admin/datacollector/sql/configurejob.md)
topic for additional information.
-The Connection Profile should be assigned under the **Databases** > 0.Collection > Azure SQL >
+Assign the Connection Profile under the **Databases** > 0.Collection > Azure SQL >
Settings > Connection node. It is set to Use the Default Profile, as configured at the global
settings level. However, since this may not be the Connection Profile with the necessary permissions
for the assigned hosts, click the radio button for the Select one of the following user defined
-profiles option and select the appropriate Connection Profile drop-down menu.
+profiles option and select the appropriate Connection Profile dropdown menu.
See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
@@ -176,15 +176,15 @@ topic for additional information.
**Schedule Frequency**
-One of the most important decisions to make is how frequently to collect this data. The Azure SQL
-Job Group can be scheduled to run as desired depending on the types of auditing being conducted and
-the scope of the target environment. The general recommendation is to schedule the solution to run
+One of the most important decisions to make is how frequently to collect this data. You can
+schedule the Azure SQL Job Group to run as desired depending on the types of auditing being conducted
+and the scope of the target environment. Schedule the solution to run
daily.
**Run Order**
-The 0.Collection Jobs must be run first and in order. The other Azure SQL Solution sub-job groups
-can be run in any order, together or individually, after running the 0.Collection Job Group.
+Run the 0.Collection Jobs first and in order. You can run the other Azure SQL Solution sub-job groups
+in any order, together or individually, after running the 0.Collection Job Group.
:::info
Run the solution at the top level.
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/sensitivedata/sql_sensitivedata.md b/docs/accessanalyzer/11.6/solutions/databases/sql/sensitivedata/sql_sensitivedata.md
index 715292d5f4..0bf7f629a2 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/sensitivedata/sql_sensitivedata.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/sensitivedata/sql_sensitivedata.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 5.Sensitve Data > SQL_SensitiveData > Con
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/sensitivedata/sql_sensitivedatapermissions.md b/docs/accessanalyzer/11.6/solutions/databases/sql/sensitivedata/sql_sensitivedatapermissions.md
index 5f83d9be8d..81b8c37c95 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/sensitivedata/sql_sensitivedatapermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/sensitivedata/sql_sensitivedatapermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 5.Sensitve Data > SQL_SensitiveDataPermi
node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/overview.md b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/overview.md
index 74703f2864..230dcd6723 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/overview.md
@@ -20,7 +20,7 @@ The jobs in the 1.Users and Roles Job Group are:
– This job group is designed to analyze the SQL or Azure SQL login passwords and evaluate if they
comply with the prescribed password policies. In addition, it checks for weak passwords.
- [SQL_RoleMembers Job](/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_rolemembers.md)
- – This job is designed to analyze and provide information about all the role members in each o the
+ – This job is designed to analyze and provide information about all the role members in each of the
SQL or Azure SQL server role groups, both at the instance and database level, across all the
targeted SQL or Azure SQL servers
- [SQL_ServerPrincipals Job](/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_serverprincipals.md)
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_databaseprinciples.md b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_databaseprinciples.md
index 5eb38651eb..54483444cb 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_databaseprinciples.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_databaseprinciples.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# SQL_DatabasePrinciples Job
-The SQL_DatabasePrinciplesJob provides detailed information on database principals across all
+The SQL_DatabasePrinciples Job provides detailed information on database principals across all
targeted SQL or Azure SQL server instances.
## Analysis Tasks for the SQL_DatabasePrinciples Job
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Users and Roles > SQL_DatabasePrinciple
and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -29,7 +29,7 @@ The default analysis tasks are:
- Summarize by instance – Creates the SA_SQLServer_DatabasePrincipals_InstanceSummary table
accessible under the job’s Results node
-In addition to the tables and views created by the analysis tasks, the SQL_DataPrinciples Job
+In addition to the tables and views created by the analysis tasks, the SQL_DatabasePrinciples Job
produces the following pre-configured report.
| Report | Description | Default Tags | Report Elements |
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_passwordissues.md b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_passwordissues.md
index 0e88d570c7..5d0d126b73 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_passwordissues.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_passwordissues.md
@@ -15,7 +15,7 @@ weak passwords.
The Collect Weak Passwords Job uses the PowerShell Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -33,7 +33,7 @@ Navigate to the Jobs > **Databases** > SQL > 3.Users and Roles > SQL_PasswordIs
and select Analysis to view the analysis tasks.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified and or
+Most of these analysis tasks are preconfigured and shouldn't be modified and or
deselected unless otherwise specified.
:::
@@ -50,7 +50,7 @@ The default analysis tasks are:
[Configure the Customizable Parameters in an Analysis Task](/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md)
topic for additional information on modifying analysis parameters.
- Shared Passwords – Highlights SQL Server Logins with shared password hashes
-- No Password – Inserts users that do not have a password set into the details table
+- No Password – Inserts users that don't have a password set into the details table
- Summarize the Weak Password Results – Summarizes the data that has been collected by the weak
passwords job
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_rolemembers.md b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_rolemembers.md
index 2de1a8e0b9..225049ce78 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_rolemembers.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_rolemembers.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Users and Roles > SQL_RoleMembers > Conf
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_serverprincipals.md b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_serverprincipals.md
index e141eff5b0..394c04cfa1 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_serverprincipals.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_serverprincipals.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Users and Roles > SQL_ServerPrincipals
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_sqllogins.md b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_sqllogins.md
index a441127dab..173d3d733e 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_sqllogins.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_sqllogins.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Users and Roles > SQL_SQLLogins > Config
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_sysadmins.md b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_sysadmins.md
index 07f7a6ad4e..66f38b166c 100644
--- a/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_sysadmins.md
+++ b/docs/accessanalyzer/11.6/solutions/databases/sql/usersroles/sql_sysadmins.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Users and Roles > SQL_SysAdmins > Config
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/dropbox/collection/1-dropbox_permissions_scan.md b/docs/accessanalyzer/11.6/solutions/dropbox/collection/1-dropbox_permissions_scan.md
index 954f9357d3..5d4e8a18c8 100644
--- a/docs/accessanalyzer/11.6/solutions/dropbox/collection/1-dropbox_permissions_scan.md
+++ b/docs/accessanalyzer/11.6/solutions/dropbox/collection/1-dropbox_permissions_scan.md
@@ -10,7 +10,7 @@ The 1-Dropbox_Permissions Scan job collects data from the Dropbox environment on
sharing policies, configurations, and content.
:::warning
-This job should not be run if running sensitive data scans against the Dropbox Business
+This job shouldn't be run if running sensitive data scans against the Dropbox Business
environment.
:::
@@ -28,8 +28,8 @@ The query for the 1-Dropbox_Permissions Scan job is:
### Configure the Dropbox Access Query
-Follow the steps to either generate the access token needed for the Connection Profile (only done
-prior to first execution) or to set any desired customizations.
+To either generate the access token needed for the Connection Profile (only done
+before first execution) or set any desired customizations:
**Step 1 –** Navigate to the **Jobs** > **Dropbox** > **0.Collection** > **1-Dropbox_Permissions
Scan** > **Configure** node and select **Queries**.
@@ -42,12 +42,12 @@ Data Collector Wizard opens.
-**Step 4 –** T Use the Scan Options page ito generate the access token prior to the first execution
+**Step 4 –** Use the Scan Options page to generate the access token before the first execution
of the job group.
- Remember to copy the access token, either from the textbox or using the **Copy to Clipboard**
- button, and use it in the Connection Profile assigned to the Dropbox Solution. Once the access
- token has been generated and copied, if no customizations are to be made, click **Cancel** to
+ button, and use it in the Connection Profile assigned to the Dropbox Solution. After the access
+ token has been generated and copied, if you don't need to make customizations, click **Cancel** to
close the Dropbox Access Auditor Data Collector wizard.
- See the
[DropboxAccess: Scan Options](/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/scanoptions.md)
@@ -65,4 +65,4 @@ collect permissions at the file level. When finished with this page, click **Nex
**Step 7 –** On the Summary page, click **Finish** to save any setting modifications or click
**Cancel** if no changes were made. Then click **OK** to close the Query Properties window.
-If changes were made, the 1-Dropbox_Permissions Scan job has now been customized.
+If you made changes, the 1-Dropbox_Permissions Scan job is now customized.
diff --git a/docs/accessanalyzer/11.6/solutions/dropbox/collection/1-dropbox_sdd_scan.md b/docs/accessanalyzer/11.6/solutions/dropbox/collection/1-dropbox_sdd_scan.md
index 4c7d34a312..a4c5e8ad24 100644
--- a/docs/accessanalyzer/11.6/solutions/dropbox/collection/1-dropbox_sdd_scan.md
+++ b/docs/accessanalyzer/11.6/solutions/dropbox/collection/1-dropbox_sdd_scan.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# 1-Dropbox_SDD Scan Job
The 1-Dropbox_SDD Scan job collects data from the Dropbox environment on access rights, sharing
-policies, configurations, content and sensitive data.
+policies, configurations, content, and sensitive data.
## Queries for the 1-Dropbox_SDD Scan Job
@@ -22,8 +22,8 @@ The query for the 1-Dropbox_SDD Scan job is:
### Configure the Sensitive Data Scan Query
-Follow the steps to either generate the access token needed for the Connection Profile (only done
-prior to first execution) or to set any desired customizations.
+To either generate the access token needed for the Connection Profile (only done
+before first execution) or set any desired customizations:
**Step 1 –** Navigate to the **Jobs** > **Dropbox** > **0.Collection** > **1-Dropbox_SDD Scan** >
**Configure** node and select **Queries**.
@@ -45,7 +45,7 @@ for additional information.
-**Step 5 –** On theDLP Audit Settings page:
+**Step 5 –** On the DLP Audit Settings page:
- Modify the maximum file size to be scanned
- Modify file types to be scanned
@@ -58,7 +58,7 @@ topic for additional information.
-**Step 6 –** On the Select DLP Criteria for This Scan page , add or remove criteria as desired.
+**Step 6 –** On the Select DLP Criteria for This Scan page, add or remove criteria as desired.
- (Optional) Create custom criteria with the **Edit** option. See the
[Sensitive Data Criteria Editor](/docs/accessanalyzer/11.6/sensitivedatadiscovery/criteriaeditor/overview.md)
@@ -71,4 +71,4 @@ topic for additional information.
**Step 7 –** On the Completion Page, click **Finish** to save any setting modifications or click
**Cancel** if no changes were made. Then click **OK** to close the Query Properties window.
-If changes were made, the 1-Dropbox_SDD Scan job has now been customized.
+If you made changes, the 1-Dropbox_SDD Scan job is now customized.
diff --git a/docs/accessanalyzer/11.6/solutions/dropbox/collection/2-dropbox_permissions_bulk_import.md b/docs/accessanalyzer/11.6/solutions/dropbox/collection/2-dropbox_permissions_bulk_import.md
index 08740d4b40..bd60cbc1e8 100644
--- a/docs/accessanalyzer/11.6/solutions/dropbox/collection/2-dropbox_permissions_bulk_import.md
+++ b/docs/accessanalyzer/11.6/solutions/dropbox/collection/2-dropbox_permissions_bulk_import.md
@@ -6,11 +6,11 @@ sidebar_position: 30
# 2-Dropbox_Permissions Bulk Import Job
-The 2-Dropbox_Permissions Bulk Import job imports the data collected by the 1-Dropbox _Permissions
+The 2-Dropbox_Permissions Bulk Import job imports the data collected by the 1-Dropbox_Permissions
Scan job to the Enterprise Auditor database for use by the analysis tasks.
:::warning
-This job should not be run if running sensitive data scans against the Dropbox Business
+This job shouldn't be run if running sensitive data scans against the Dropbox Business
environment.
:::
@@ -27,6 +27,6 @@ The query for the 2-Dropbox_Permissions Bulk Import job is:
- Dropbox Bulk Import – Imports data collected by the 1-Dropbox_Permissions Scan job to the
Enterprise Auditor database
-There are no customization options available for this job. The Summary page of the Dropbox Access
-Auditor Data Collector wizard can be viewed at the **Jobs** > **Dropbox** > **0.Collection** >
+There are no customization options available for this job. You can view the Summary page of the
+Dropbox Access Auditor Data Collector wizard at the **Jobs** > **Dropbox** > **0.Collection** >
**2-Dropbox_Permissions Bulk Import** > **Configure** > **Queries** node.
diff --git a/docs/accessanalyzer/11.6/solutions/dropbox/collection/2-dropbox_sdd_bulk_import.md b/docs/accessanalyzer/11.6/solutions/dropbox/collection/2-dropbox_sdd_bulk_import.md
index 985f147bd6..2cd11194a6 100644
--- a/docs/accessanalyzer/11.6/solutions/dropbox/collection/2-dropbox_sdd_bulk_import.md
+++ b/docs/accessanalyzer/11.6/solutions/dropbox/collection/2-dropbox_sdd_bulk_import.md
@@ -18,9 +18,9 @@ category of Bulk Import Sensitive Content Scan.
The query for the 2-Dropbox_SDD Bulk Import job is:
-- DropboxSDD Bulk Import – Imports data collected by the Dropbox 1-SDD Scan Job into the Enterprise
+- DropboxSDD Bulk Import – Imports data collected by the 1-Dropbox_SDD Scan Job into the Enterprise
Auditor database
-There are no customization options available for this job. The Summary page of the Dropbox Access
-Auditor Data Collector wizard can be viewed at the **Jobs** > **Dropbox** > **0.Collection** >
+There are no customization options available for this job. You can view the Summary page of the
+Dropbox Access Auditor Data Collector wizard at the **Jobs** > **Dropbox** > **0.Collection** >
**2-Dropbox_SDD Bulk Import** > **Configure** > **Queries** node.
diff --git a/docs/accessanalyzer/11.6/solutions/dropbox/collection/overview.md b/docs/accessanalyzer/11.6/solutions/dropbox/collection/overview.md
index 3d754f5dce..32ed11507e 100644
--- a/docs/accessanalyzer/11.6/solutions/dropbox/collection/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/dropbox/collection/overview.md
@@ -15,31 +15,31 @@ the Access Information Center for analysis.
The 0.Collection job group is comprised of:
- [1-Dropbox_Permissions Scan Job](/docs/accessanalyzer/11.6/solutions/dropbox/collection/1-dropbox_permissions_scan.md)
- – This job is responsible for scanning the target Dropbox site
+ – This job scans the target Dropbox site
- [1-Dropbox_SDD Scan Job](/docs/accessanalyzer/11.6/solutions/dropbox/collection/1-dropbox_sdd_scan.md)
- – This job is responsible for scanning sensitive data in the target Dropbox site. The Sensitive
- Data Discovery Add-On is required to run this job. The Dropbox sensitive data Discovery Reports in
- the Access Information Center are also populated by this data. See the Resource Audits Overview
+ – This job scans sensitive data in the target Dropbox site. The Sensitive
+ Data Discovery Add-On is required to run this job. This data also populates the Dropbox sensitive
+ data Discovery Reports in the Access Information Center. See the Resource Audits Overview
topic in the
[Netwrix Access Information Center Documentation](https://helpcenter.netwrix.com/category/accessinformationcenter)
for additional information.
- [2-Dropbox_Permissions Bulk Import Job](/docs/accessanalyzer/11.6/solutions/dropbox/collection/2-dropbox_permissions_bulk_import.md)
- – This job is responsible for importing the collected data into the Enterprise Auditor database
+ – This job imports the collected data into the Enterprise Auditor database
- [2-Dropbox_SDD Bulk Import Job](/docs/accessanalyzer/11.6/solutions/dropbox/collection/2-dropbox_sdd_bulk_import.md)
- – This job is responsible for importing the collected sensitive data into the Enterprise Auditor
- database. The Sensitive Data Discovery Add-On is required to run this job. The Dropbox sensitive
- data Discovery Reports in the Access Information Center are also populated by this data. See the
+ – This job imports the collected sensitive data into the Enterprise Auditor
+ database. The Sensitive Data Discovery Add-On is required to run this job. This data also populates
+ the Dropbox sensitive data Discovery Reports in the Access Information Center. See the
Resource Audits Overview topic in the
[Netwrix Access Information Center Documentation](https://helpcenter.netwrix.com/category/accessinformationcenter)
for additional information.
The relationship between the scan and bulk import jobs requires the following considerations:
-- A scan job executed from an Enterprise Auditor Console must be followed by the corresponding bulk
+- You must follow a scan job run from an Enterprise Auditor Console with the corresponding bulk
import job from the same Enterprise Auditor Console version
-- Two scan jobs processing the same information, for example two 1-Dropbox_Permissions Scan jobs,
- cannot be executed consecutively against the same target host. The corresponding bulk import job,
- for example 2-Dropbox_Permissions Bulk Import job, must be executed in between.
+- You can't run two scan jobs processing the same information, for example two 1-Dropbox_Permissions
+ Scan jobs, consecutively against the same target host. You must run the corresponding bulk import
+ job, for example the 2-Dropbox_Permissions Bulk Import job, in between.
- For the Dropbox Solution, the bulk import jobs require the same connection profile as used in the
corresponding scan jobs
@@ -50,8 +50,8 @@ versa.
:::tip
-Remember, prior to running the Dropbox Solution for the first time, it is necessary to generate an
-access token to be used in the Connection Profile. This only needs to be done once. See the
+Remember, before running the Dropbox Solution for the first time, generate an
+access token to be used in the Connection Profile. You only need to do this once. See the
[Configure the Dropbox Access Query](/docs/accessanalyzer/11.6/solutions/dropbox/collection/1-dropbox_permissions_scan.md#configure-the-dropbox-access-query)
topic for additional information.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_access.md b/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_access.md
index 1dfc2ac380..6006d034c3 100644
--- a/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_access.md
+++ b/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_access.md
@@ -17,11 +17,11 @@ The Dropbox_Access job is located in the 1.Access job group.
## Analysis Tasks for the Dropbox_Access Job
-View the analysis tasks by navigating to the **Jobs** > **Dropbox** > **1.Access** > **Dro
-pbox_Access** > **Configure** node and select **Analysis**.
+View the analysis tasks by navigating to the **Jobs** > **Dropbox** > **1.Access** >
+**Dropbox_Access** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_content.md b/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_content.md
index 8e28eea15c..de48ca2ce5 100644
--- a/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_content.md
+++ b/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_content.md
@@ -16,7 +16,7 @@ The Dropbox_Content job is located in the 4.Content job group.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+The Configuration section on a Job's overview page lets you modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -35,7 +35,7 @@ View the analysis tasks by navigating to the **Jobs** > **Dropbox** > **4.Conten
**Dropbox_Content** > **Configure** node and select **Analysis**.
:::warning
-Most of the analysis tasks should not be modified or deselected. The analysis tasks are
+Most of the analysis tasks shouldn't be modified or deselected. The analysis tasks are
preconfigured for this job.
:::
@@ -65,15 +65,15 @@ Dropbox_Content job produces the following pre-configured reports.
### Customizable Analysis Tasks for the Dropbox_Content Job
-The time frame used to define stale content is set by default to 365 days. This can be modified
+The time frame used to define stale content is set by default to 365 days. You can modify this
within the **Determines stale data by owner** analysis task. The customizable parameter feature
-enables you to easily set this value.
+lets you set this value.
| Customizable Parameter Name | Default Value | Value Indicates |
| --------------------------- | ------------- | --------------------------------------------------------------------------------------------- |
| @days_since_modified | 365 | How many days since the last modified day in order for a file to be considered stale content. |
-The parameter can be customized and is listed in a section at the bottom of the SQL Script Editor.
+You can customize the parameter. It's listed in a section at the bottom of the SQL Script Editor.
See the
[Configure the Customizable Parameters in an Analysis Task](/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_groupmembership.md b/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_groupmembership.md
index d42aa811e0..5c6e1681c3 100644
--- a/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_groupmembership.md
+++ b/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_groupmembership.md
@@ -20,7 +20,7 @@ View the analysis tasks by navigating to the **Jobs** > **Dropbox** > **3.Group
**Dropbox_GroupMembership** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_sensitivedata.md b/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_sensitivedata.md
index 14a1803ece..66a8f8a8ce 100644
--- a/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_sensitivedata.md
+++ b/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_sensitivedata.md
@@ -22,7 +22,7 @@ View the analysis tasks by navigating to the **Jobs** > **Dropbox** > **5.Sensit
**Dropbox_SensitiveData** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -31,13 +31,13 @@ preconfigured for this job.
- **1. Enterprise Summary** – Creates the SA_Dropbox_SensitiveData_EnterpriseSummary table accessible
under the job’s Results node
-- **2. Folder Details** – Creates the SA*Dropbox* SensitiveData_FolderDetails table accessible under
+- **2. Folder Details** – Creates the SA_Dropbox_SensitiveData_FolderDetails table accessible under
the job’s Results node
-- **3. Folder Summary** – Creates the SA*Dropbox* SensitiveData_FolderSummary table accessible under
+- **3. Folder Summary** – Creates the SA_Dropbox_SensitiveData_FolderSummary table accessible under
the job’s Results node
-- **4. Permission Details** – Creates the SA*Dropbox* SensitiveData_PermissionDetails table accessible
+- **4. Permission Details** – Creates the SA_Dropbox_SensitiveData_PermissionDetails table accessible
under the job’s Results node
-- **5. Permission Summary** – Creates the SA*Dropbox* SensitiveData_PermissionSummary table accessible
+- **5. Permission Summary** – Creates the SA_Dropbox_SensitiveData_PermissionSummary table accessible
under the job’s Results node
In addition to the tables created by the analysis tasks which display effective access to resources,
@@ -46,5 +46,5 @@ the Dropbox_SensitiveData job produces the following pre-configured reports.
| Report | Description | Default Tags | Report Elements |
| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Enterprise Summary | This report identifies the type and amount of sensitive content found on Dropbox. | None | This report is comprised of two elements: - Pie Chart – Displays criteria summary by match count
- Table – Provides criteria summary by match count
|
-| Folder Details | This report identifies the location of sensitive data, and flags whether or not this data is accessible through open access. | None | This report is comprised of three elements: - Bar Chart – Displays top sensitive folders by file count
- Table – Provides top sensitive folders by file count
- Table – Provides top sensitive folder details by match count
|
+| Folder Details | This report identifies the location of sensitive data, and flags whether this data is accessible through open access. | None | This report is comprised of three elements: - Bar Chart – Displays top sensitive folders by file count
- Table – Provides top sensitive folders by file count
- Table – Provides top sensitive folder details by match count
|
| Sensitive Data Permissions | This report identifies the sensitive data locations and associated permissions. | None | This report is comprised of three elements: - Bar Chart – Displays sensitive data permission summary by file count
- Table – Provides sensitive data permission summary by file count
- Table – Provides sensitive data permissions by match count
|
diff --git a/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_sharing.md b/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_sharing.md
index 43ac5a6cf6..f0420a553d 100644
--- a/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_sharing.md
+++ b/docs/accessanalyzer/11.6/solutions/dropbox/dropbox_sharing.md
@@ -9,9 +9,9 @@ sidebar_position: 40
The Dropbox_Sharing job provides insight into the sharing of resources within the targeted Dropbox
environment. It is dependent on data collected by the 0.Collection job group. This job processes
analysis tasks and generates a report on which resources are being shared and under which policy the
-sharing occurs. Best practices often dictate that these resources should be carefully monitored due
-to the amount of access to the data. If these resources contain privileged data, the access should
-be reevaluated or the sensitive resources relocated.
+sharing occurs. Best practices recommend monitoring these resources carefully due
+to the amount of access to the data. If these resources contain privileged data, reevaluate the
+access or relocate the sensitive resources.
@@ -23,7 +23,7 @@ View the analysis tasks by navigating to the **Jobs** > **Dropbox** > **2.Sharin
**Dropbox_Sharing** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/dropbox/overview.md b/docs/accessanalyzer/11.6/solutions/dropbox/overview.md
index fd2c8bb654..e75bbd74c6 100644
--- a/docs/accessanalyzer/11.6/solutions/dropbox/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/dropbox/overview.md
@@ -19,8 +19,8 @@ scanning the targeted Dropbox site. Key information includes:
- Detailed Dropbox group membership
- Breakdown of Dropbox content by size, type, and owner
-Dropbox can scan the contents of over 400 file types to discover which files contain sensitive data
-using the Sensitive Data Discovery Add-on.
+Using the Sensitive Data Discovery Add-on, Dropbox can scan the contents of over 400 file types to
+discover which files contain sensitive data.
**Supported Platforms**
@@ -34,17 +34,17 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
-then an extra 16 GB of RAM are required (8x2=16).
+You must install the Sensitive Data Discovery Add-On on the Enterprise Auditor Console server to
+enable Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans, you must
+increase the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per
+host. For example, if you configure the job to scan 8 hosts at a time, you need an extra 16 GB of
+RAM (8 x 2 = 16).
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
-configuration; it has been preconfigured to work with Enterprise Auditor and should never be
-customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
+configuration; it has been preconfigured to work with Enterprise Auditor. Don't customize it
+through Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
:::
@@ -52,7 +52,7 @@ environment.
**Location**
The Dropbox Solution requires a special Enterprise Auditor license. It can be installed from the
-Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to the solution:
+Instant Job Wizard. After it has been installed into the Jobs tree, navigate to the solution:
**Jobs** > **Dropbox**.
The 0.Collection job group collects the data. The other job groups run analyses on the collected
diff --git a/docs/accessanalyzer/11.6/solutions/dropbox/recommended.md b/docs/accessanalyzer/11.6/solutions/dropbox/recommended.md
index d1dd985914..b13f3ee7d4 100644
--- a/docs/accessanalyzer/11.6/solutions/dropbox/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/dropbox/recommended.md
@@ -7,14 +7,14 @@ sidebar_position: 10
# Recommended Configurations for the Dropbox Solution
The Dropbox Solution requires the host list to be assigned and the Connection Profile configured
-before job execution. Once these are assigned to the job group, it can be run directly or scheduled.
+before job execution. After these are assigned to the job group, it can be run directly or scheduled.
**Targeted Hosts**
The Dropbox solution has been configured to inherit the host list assignment from the collection job
group level.
-The host list assignment should be assigned under the **Dropbox** > **0.Collection** >
+Assign the host list under the **Dropbox** > **0.Collection** >
**Settings** > **Host List Assignment** node. Select the **Local host** option.
**Connection Profile**
@@ -23,20 +23,20 @@ The DropboxAccess Data Collector requires a specific set of permissions to gener
which is used to configure the Connection Profile for Dropbox. The access token is generated in the
Dropbox Access Auditor Data Collector Wizard on the Scan Options page (accessed through the
**1-Dropbox_Permissions Scan** job’s **Queries** node). The access token only needs to be generated
-once, prior to running the job group for the first time. Then it is used as the credential in the
+once, before running the job group for the first time. Then it is used as the credential in the
Connection Profile. See the
[DropboxAccess: Scan Options](/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/scanoptions.md)
topic for additional information.
The Dropbox solution has been configured to inherit the Connection Profile from the collection job
-group level. The Connection Profile should be assigned under the **Dropbox** > **0.Collection** >
+group level. Assign the Connection Profile under the **Dropbox** > **0.Collection** >
**Settings** > **Connection** node. It is set to **Use the Default Profile**, as configured at the
global settings level. However, since this may not be the Connection Profile with the necessary
permissions for Dropbox, select the **Select one of the following user defined profiles** option and
-select the appropriate Connection Profile from the drop-down menu. See the
+select the appropriate Connection Profile from the dropdown menu. See the
[Custom Dropbox Connection Profile & Host List](/docs/accessanalyzer/11.6/admin/datacollector/dropboxaccess/configurejob.md)
topic for additional information on configuring the Dropbox credential. The Dropbox bulk import jobs
-requires the same connection profile as used in the corresponding Dropbox scan jobs
+require the same connection profile as used in the corresponding Dropbox scan jobs.
See the
[Connection](/docs/accessanalyzer/11.6/admin/settings/connection/overview.md)
@@ -66,7 +66,7 @@ versa.
:::
-After running the 0.Collection jobs, the other Dropbox solution job groups can be run in any order.
+After you run the 0.Collection jobs, you can run the other Dropbox solution job groups in any order.
Best practice is to run at the solution level.
**Query Configuration**
@@ -81,12 +81,12 @@ topic for additional information.
This solution should be run with the default analysis configuration.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this solution.
:::
-Though the analysis tasks should not be deselected the time frame used to define staleness can be
+Though the analysis tasks shouldn't be deselected, the time frame used to define staleness can be
modified:
- Stale content set to default of 365 days
@@ -113,10 +113,10 @@ Scan** job).
**Step 2 –** Run the **2-Dropbox_Permissions Bulk Import** job (for sensitive data, run the
**2-Dropbox_SDD Bulk Import** job).
-**Step 3 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 3 –** Run the corresponding analysis and reporting sub-job groups you want.
:::tip
-Remember, prior to running the Dropbox solution for the first time, it is necessary to generate an
+Remember, before running the Dropbox solution for the first time, generate an
access token to be used in the Connection Profile. This only needs to be done once. See the
[Configure the Dropbox Access Query](/docs/accessanalyzer/11.6/solutions/dropbox/collection/1-dropbox_permissions_scan.md#configure-the-dropbox-access-query)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_circularnesting.md b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_circularnesting.md
index 954e4c0ef9..61ec11716d 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_circularnesting.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_circularnesting.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# AAD_CircularNesting Job
-The AAD_CircularNesting Job identifies circularly nested groups within Microsoft Entra ID which can
-pose administrative and operational challenges with identifying effective access to resources.
+The AAD_CircularNesting Job identifies circularly nested groups within Microsoft Entra ID. Circular
+nesting can complicate determining effective access to resources.
## Analysis Tasks for the AAD_CircularNesting Job
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_CircularNesting**
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_duplicategroups.md b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_duplicategroups.md
index d2a75fb3d4..06a946855a 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_duplicategroups.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_duplicategroups.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_DuplicateGroups**
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -32,4 +32,4 @@ following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| ---------------- | ------------------------------------------------------------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Duplicate Groups | This report identifies duplicate groups within the audited domains. | None | This report is comprised of one elements: - Bar Chart – Displays domains by number of groups with duplicates
- Table – Provides duplicate groups details
- Table – Provides details on domains by number of groups with duplicates
|
+| Duplicate Groups | This report identifies duplicate groups within the audited domains. | None | This report is comprised of one element: - Bar Chart – Displays domains by number of groups with duplicates
- Table – Provides duplicate groups details
- Table – Provides details on domains by number of groups with duplicates
|
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_emptygroups.md b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_emptygroups.md
index 746a78d05a..3306af4174 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_emptygroups.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_emptygroups.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_EmptyGroups** > *
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_groupdirsync.md b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_groupdirsync.md
index 206d9ab249..e4bf22e29b 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_groupdirsync.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_groupdirsync.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_GroupDirSync** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_largestgroups.md b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_largestgroups.md
index 9871870c10..db73a9ed54 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_largestgroups.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_largestgroups.md
@@ -6,9 +6,9 @@ sidebar_position: 50
# AAD_LargestGroups Job
-The AAD_LargestGroups Job identifies groups with large effective member counts. These groups may
-cause administrative overhead and burden in being able to easily understand who is getting access to
-resources, or how much access is being granted to resources through these groups.
+The AAD_LargestGroups Job identifies groups with large effective member counts. These groups can
+make it difficult to determine who has access to resources through them, or how much access they
+grant.
## Analysis Tasks for the AAD_LargestGroups Job
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_LargestGroups** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -33,4 +33,4 @@ following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| -------------- | ------------------------------------------------------------------------ | ------------ | -------------------------------------------------------------------------------------------------------------------------------------- |
-| Largest Groups | This report identifies the largest groups within the audited environment | None | This report is comprised of two elements: - Bar Chart – Displays largest groups
- Table – Provides group details
|
+| Largest Groups | This report identifies the largest groups within the audited environment. | None | This report is comprised of two elements: - Bar Chart – Displays largest groups
- Table – Provides group details
|
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_nestedgroups.md b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_nestedgroups.md
index 18651be9c1..68a669b3fc 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_nestedgroups.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_nestedgroups.md
@@ -7,8 +7,8 @@ sidebar_position: 60
# AAD_NestedGroups Job
The AAD_NestedGroups Job identifies nested groups within Microsoft Entra ID and provides details
-such as the levels of nesting. While Microsoft Entra ID provides the ability to nest certain types
-of groups within other groups, Microsoft recommends nesting does not go beyond two levels in order
+such as the levels of nesting. While Microsoft Entra ID lets you nest certain types
+of groups within other groups, Microsoft recommends nesting doesn't go beyond two levels
to avoid difficulties in understanding effective membership and access.
## Analysis Tasks for the AAD_NestedGroups Job
@@ -17,7 +17,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_NestedGroups** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_probableowners.md b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_probableowners.md
index 0ee073217e..73a874bef5 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_probableowners.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_probableowners.md
@@ -6,8 +6,8 @@ sidebar_position: 70
# AAD_ProbableOwners Job
-The AAD_ProbableOwners Job determines potential owners for Microsoft Entra ID Groups which can be
-used to perform automated membership reviews and enable self-service group management and membership
+The AAD_ProbableOwners Job determines potential owners for Microsoft Entra ID Groups, which you can
+use to perform automated membership reviews and enable self-service group management and membership
requests.
## Analysis Tasks for the AAD_ProbableOwners Job
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_ProbableOwners**
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_stalegroups.md b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_stalegroups.md
index e79071f708..942d0b04a1 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_stalegroups.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_stalegroups.md
@@ -17,7 +17,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_StaleGroups** > *
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -38,4 +38,4 @@ following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Stale Effective Membership (Stale Groups) | This report identifies groups with stale effective membership. A stale user is defined as someone who has not logged into the domain in over 30 days or is currently disabled. | None | This report is comprised of three elements: - Chart – Displays group membership
- Table – Provides group membership details
- Tables – Provides stale groups organization summary
|
+| Stale Effective Membership (Stale Groups) | This report identifies groups with stale effective membership. A stale user is defined as someone who has not logged into the domain in over 30 days or is disabled. | None | This report is comprised of three elements: - Chart – Displays group membership
- Table – Provides group membership details
- Tables – Provides stale groups organization summary
|
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/groups/overview.md b/docs/accessanalyzer/11.6/solutions/entraid/groups/overview.md
index 749bbe1ed9..d407b7dc15 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/groups/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/groups/overview.md
@@ -14,8 +14,8 @@ Microsoft Entra ID, such as toxic group conditions or synchronization issues.
The jobs in the 1.Groups Job Group are:
- [AAD_CircularNesting Job](/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_circularnesting.md)
- – Identifies circularly-nested groups within Microsoft Entra ID which can pose administrative and
- operational challenges with identifying effective access to resources
+ – Identifies circularly-nested groups within Microsoft Entra ID. Circular nesting can complicate
+ determining effective access to resources
- [AAD_DuplicateGroups Job](/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_duplicategroups.md)
– Identifies duplicate groups within Microsoft Entra ID. Duplicate groups contain the same group
membership as one another and are suitable candidates for cleanup
@@ -25,18 +25,17 @@ The jobs in the 1.Groups Job Group are:
- [AAD_GroupDirSync Job](/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_groupdirsync.md)
– Summarizes on-premises Active Directory syncing in the audited Microsoft Entra ID environment
- [AAD_LargestGroups Job](/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_largestgroups.md)
- – Identifies groups with large effective member counts. These types of groups may cause
- administrative overhead and burden in being able to easily understand who is getting access to
- resources, or how much access is being granted to resources through these groups.
+ – Identifies groups with large effective member counts. These types of groups can make it
+ difficult to determine who has access to resources through them, or how much access they grant
- [AAD_NestedGroups Job](/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_nestedgroups.md)
– Identifies nested groups within Microsoft Entra ID and provides details such as the levels of
- nesting. While Microsoft Entra ID provides the ability to nest certain types of groups within
- other groups, Microsoft recommends nesting does not go beyond two levels in order to avoid
+ nesting. While Microsoft Entra ID lets you nest certain types of groups within
+ other groups, Microsoft recommends nesting doesn't go beyond two levels to avoid
difficulties in understanding effective membership and access.
- [AAD_ProbableOwners Job](/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_probableowners.md)
- – Determines potential owners for Microsoft Entra ID Groups which can be used to perform automated
+ – Determines potential owners for Microsoft Entra ID Groups, which you can use to perform automated
membership reviews and enable self-service group management and membership requests
-- [AAD_StaleGroups Job](/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_stalegroups.md)–
+- [AAD_StaleGroups Job](/docs/accessanalyzer/11.6/solutions/entraid/groups/aad_stalegroups.md) –
Identifies Microsoft Entra ID groups that contain potentially stale users. Users are considered
stale if they have never logged onto the domain, have not logged onto the domain in the past 30
days, or are disabled. These group memberships should be reviewed and possibly removed.
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/overview.md b/docs/accessanalyzer/11.6/solutions/entraid/overview.md
index f43dd05d9c..e7d8764833 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/overview.md
@@ -24,9 +24,9 @@ topic for additional information.
**Location**
The Entra ID Solution requires a special Enterprise Auditor license. It can be installed from the
-Instant Job Wizard, see the
+Instant Job Wizard. See the
[Instant Job Wizard](/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md)
-topic for additional information. Once it has been installed into the Jobs tree, navigate to the
+topic for additional information. After it has been installed into the Jobs tree, navigate to the
solution: **Jobs** > **Entra ID**.
The .Entra ID Inventory Job Group collects the data. The Entra ID Job Groups run analysis and
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/recommended.md b/docs/accessanalyzer/11.6/solutions/entraid/recommended.md
index 20353edf52..e9d302289b 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/recommended.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Recommended Configurations for Entra ID Job Group
The Entra ID Solution has been configured to inherit down from the job group **Settings** node. The
-host list must be assigned and the Connection Profile configured before job execution. Once these
+host list must be assigned and the Connection Profile configured before job execution. After these
are assigned to the job group, it can be run directly or scheduled.
**Dependencies**
@@ -21,15 +21,15 @@ topic for additional information.
**Targeted Hosts**
-The Entra ID Solution does not require a target host because the jobs use data collected from the
+The Entra ID Solution doesn't require a target host because the jobs use data collected from the
.Entra ID Inventory Job Group and the .Active Directory Inventory Job Group. However, Enterprise
-Auditor jobs do not execute successfully without a host list assigned. Assign the host list under
+Auditor jobs don't execute successfully without a host list assigned. Assign the host list under
the **Entra ID** > **Settings** > **Host Lists Assignment** node. Check the **Local host** box and
click **Save**.
**Connection Profile**
-Since the Entra ID Solution is not collecting any data, a specific connection profile is not
+Since the Entra ID Solution isn't collecting any data, a specific connection profile isn't
necessary. Therefore, the default setting **Use the Default Profile** is sufficient for this
solution.
@@ -52,7 +52,7 @@ topic for additional information.
The following is the recommended workflow:
-**Step 1 –** Assign the Local host at the solution level as described above.
+**Step 1 –** Assign the Local host at the solution level, as described in Targeted Hosts.
**Step 2 –** Run the .Entra ID Inventory Job Group. If on-premises directory syncing information is
desired, run the .Active Directory Inventory Job Group.
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/users/aad_directmembership.md b/docs/accessanalyzer/11.6/solutions/entraid/users/aad_directmembership.md
index 8b8cb38e43..f363306468 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/users/aad_directmembership.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/users/aad_directmembership.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# AAD_DirectMembership Job
-The AAD_DirectMembership Job identifies Microsoft Entra ID users who do not have any group
+The AAD_DirectMembership Job identifies Microsoft Entra ID users who don't have any group
membership. This condition may indicate unnecessary user accounts that are suitable candidates for
review and cleanup.
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Entra ID** > **2.Users** > **AAD_DirectMembership**
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/users/aad_disabledusers.md b/docs/accessanalyzer/11.6/solutions/entraid/users/aad_disabledusers.md
index 3da8d26813..7becbd24d6 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/users/aad_disabledusers.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/users/aad_disabledusers.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# AAD_DisabledUsers Job
The AAD_DisabledUsers Job identifies disabled user accounts within Microsoft Entra ID. These
-accounts should be reviewed and cleaned up in order to increase security and reduce complexity.
+accounts should be reviewed and cleaned up to increase security and reduce complexity.
## Analysis Tasks for the AAD_DisabledUsers Job
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **2.Users** > **AAD_DisabledUsers** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/users/aad_staleusers.md b/docs/accessanalyzer/11.6/solutions/entraid/users/aad_staleusers.md
index 5b2fd6179d..68f8f3e954 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/users/aad_staleusers.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/users/aad_staleusers.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# AAD_StaleUsers Job
The AAD_StaleUsers Job identifies potentially stale users based on a variety of factors. These
-accounts should be reviewed and cleaned up in order to increase security and reduce complexity.
+accounts should be reviewed and cleaned up to increase security and reduce complexity.
## Analysis Tasks for the AAD_StaleUsers Job
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **2.Users** > **AAD_StaleUsers** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -34,4 +34,4 @@ following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Stale Users | This report identifies user accounts which have not logged into the domain for an extended amount of time or are currently disabled. A user account is considered stale if the last logon is over 30 days ago or is currently disabled. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays users by domain
- Table – Provides details on users
- Tables – Provides details on users by domain
|
+| Stale Users | This report identifies user accounts which have not logged into the domain for an extended amount of time or are disabled. A user account is considered stale if the last logon is over 30 days ago or is disabled. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays users by domain
- Table – Provides details on users
- Tables – Provides details on users by domain
|
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/users/aad_userattributecompletion.md b/docs/accessanalyzer/11.6/solutions/entraid/users/aad_userattributecompletion.md
index 444750d458..fd2ea103da 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/users/aad_userattributecompletion.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/users/aad_userattributecompletion.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Entra ID** > **2.Users** > **AAD_UserAttributeCompl
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -35,4 +35,4 @@ produces the following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| User Attribute Completion | This report identifies which attributes are present within User fields in Microsoft Entra ID, and which ones are blank for a majority of User objects. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays completeness by attribute
- Table – Provides details on users with blank attributes
- Tables – Provides details om completeness by attribute
|
+| User Attribute Completion | This report identifies which attributes are present within User fields in Microsoft Entra ID, and which ones are blank for a majority of User objects. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays completeness by attribute
- Table – Provides details on users with blank attributes
- Tables – Provides details on completeness by attribute
|
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/users/aad_userdirsync.md b/docs/accessanalyzer/11.6/solutions/entraid/users/aad_userdirsync.md
index cc2eccee6e..fc038d4c2e 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/users/aad_userdirsync.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/users/aad_userdirsync.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **2.Users** > **AAD_UserDirSync** > **
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/entraid/users/overview.md b/docs/accessanalyzer/11.6/solutions/entraid/users/overview.md
index 29a98f8af4..850c5e026e 100644
--- a/docs/accessanalyzer/11.6/solutions/entraid/users/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/entraid/users/overview.md
@@ -14,15 +14,15 @@ administrative concerns within Microsoft Entra ID such as disabled or stale user
The jobs in the 2.Users Job Group are:
- [AAD_DirectMembership Job](/docs/accessanalyzer/11.6/solutions/entraid/users/aad_directmembership.md)
- – Identifies Microsoft Entra ID users who do not have any group membership. This condition may
+ – Identifies Microsoft Entra ID users who don't have any group membership. This condition may
indicate unnecessary user accounts that are suitable candidates for review and cleanup.
- [AAD_DisabledUsers Job](/docs/accessanalyzer/11.6/solutions/entraid/users/aad_disabledusers.md)
– Identifies disabled user accounts within Microsoft Entra ID. These accounts should be reviewed
- and cleaned up in order to increase security and reduce complexity.
-- [AAD_StaleUsers Job](/docs/accessanalyzer/11.6/solutions/entraid/users/aad_staleusers.md)–
+ and cleaned up to increase security and reduce complexity.
+- [AAD_StaleUsers Job](/docs/accessanalyzer/11.6/solutions/entraid/users/aad_staleusers.md) –
Identifies potentially stale users based on a variety of factors. These accounts should be
- reviewed and cleaned up in order to increase security and reduce complexity.
-- [AAD_UserAttributeCompletion Job](/docs/accessanalyzer/11.6/solutions/entraid/users/aad_userattributecompletion.md)–
+ reviewed and cleaned up to increase security and reduce complexity.
+- [AAD_UserAttributeCompletion Job](/docs/accessanalyzer/11.6/solutions/entraid/users/aad_userattributecompletion.md) –
Identifies which attributes are present within User fields in Microsoft Entra ID, and which ones
are blank for a majority of objects. This may indicate accounts within Microsoft Entra ID which
are lacking appropriate information.
diff --git a/docs/accessanalyzer/11.6/solutions/entraidinventory/1-aad_scan.md b/docs/accessanalyzer/11.6/solutions/entraidinventory/1-aad_scan.md
index ddc228ebbe..1b23b443e7 100644
--- a/docs/accessanalyzer/11.6/solutions/entraidinventory/1-aad_scan.md
+++ b/docs/accessanalyzer/11.6/solutions/entraidinventory/1-aad_scan.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# 1-AAD_Scan Job
-The **1-AAD_Scan** Job is responsible for collecting data from Microsoft Entra ID. This job requires
-no additional customizations before being used, but can be scoped to disable collecting sign-in
-activity with the scan.
+The **1-AAD_Scan** Job collects data from Microsoft Entra ID. It requires no additional
+customization before use, but you can scope it to disable collecting sign-in activity with the
+scan.
## Queries for the 1-AAD_Scan Job
@@ -24,14 +24,14 @@ The 1-AAD_Scan job uses the AzureADInventory Data Collector for the following qu
### Configure the 1-AAD_Scan Query
The 1-AAD_Scan Job is configured to run with the default settings with the category of Scan Entra
-ID. Follow the steps to customize configurations.
+ID. To customize configurations:
**Step 1 –** Navigate to the **.Entra ID Inventory** > **1-AAD_Scan** > **Configure** node and
select **Queries**.
-**Step 2 –** In the Query Selection view, click on **Query Properties** to open the Query Properties
+**Step 2 –** In the Query Selection view, click **Query Properties** to open the Query Properties
window.
@@ -84,7 +84,7 @@ Navigate to the **.Entra ID Inventory** > **1-AAD_Scan** > **Configure** node an
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/entraidinventory/2-aad_exceptions.md b/docs/accessanalyzer/11.6/solutions/entraidinventory/2-aad_exceptions.md
index f0815577ae..c9be8394e1 100644
--- a/docs/accessanalyzer/11.6/solutions/entraidinventory/2-aad_exceptions.md
+++ b/docs/accessanalyzer/11.6/solutions/entraidinventory/2-aad_exceptions.md
@@ -12,13 +12,12 @@ leave environments at risk or add unnecessary administrative overhead.
## Analysis Tasks for the 2-AAD_Exceptions Job
Navigate to the **.Entra ID Inventory** > **2-AAD_Exceptions** > **Configure** node and select
-**Analysis**. Analysis tasks with configuration parameters that define security concerns can be
-modified.
+**Analysis**. You can modify analysis tasks with configuration parameters that define security
+concerns.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified and not be
-deselected. There are a few which are deselected by default, as they are for troubleshooting
-purposes.
+Most of these analysis tasks are preconfigured. Don't modify or deselect them. A few
+are deselected by default because they're for troubleshooting.
:::
@@ -88,9 +87,9 @@ topic for an explanation of Exception Types.
### Configure the Analysis Tasks for the 2-AAD_Exceptions Job
Customizable parameters enable Enterprise Auditor users to set the values used to classify user and
-group objects during this job’s analysis. The parameters can be customized and are listed in a
-section at the bottom of the SQL Script Editor. Follow the steps to customize an analysis task’s
-parameters.
+group objects during this job’s analysis. You can customize the parameters, which are listed in a
+section at the bottom of the SQL Script Editor. To customize an analysis task’s
+parameters:
:::warning
Modifying these parameters affects solutions with .Entra ID Inventory Job Group
@@ -113,7 +112,7 @@ Configuration**. The SQL Script Editor opens.
**Step 4 –** Double-click in a field in the Value column and enter a custom value.
:::warning
-Do not change any parameters where the Value states **Created during execution**.
+Don't change any parameters where the Value states **Created during execution**.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/entraidinventory/overview.md b/docs/accessanalyzer/11.6/solutions/entraidinventory/overview.md
index 0dd2413983..d39d3efda1 100644
--- a/docs/accessanalyzer/11.6/solutions/entraidinventory/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/entraidinventory/overview.md
@@ -30,7 +30,7 @@ The .Entra ID Inventory Solution is a core component of all Enterprise Auditor
be installed from the Enterprise Auditor Instant Job Wizard. See the
[Instant Job Wizard](/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md)
topic for additional information. Navigate to the solution by expanding the Jobs tree and selecting
-the **.Entra ID Inventory** Job Group. This group has been named in such a way to keep it at the top
+the **.Entra ID Inventory** Job Group. This group's name keeps it at the top
of the Jobs tree.
## Jobs
diff --git a/docs/accessanalyzer/11.6/solutions/entraidinventory/recommended.md b/docs/accessanalyzer/11.6/solutions/entraidinventory/recommended.md
index 5d5ad062d9..9f32d4998e 100644
--- a/docs/accessanalyzer/11.6/solutions/entraidinventory/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/entraidinventory/recommended.md
@@ -7,12 +7,12 @@ sidebar_position: 10
# Recommended Configurations for the .Entra ID Inventory Job Group
The .Entra ID Inventory Solution is configured to inherit settings from the Global Settings node.
-The host list and connection profile must be assigned before job execution. Once these are assigned
+The host list and connection profile must be assigned before job execution. After these are assigned
to the job group, it can be run directly or scheduled.
**Dependencies**
-This job group does not have dependencies.
+This job group doesn't have dependencies.
**Targeted Hosts**
@@ -22,7 +22,7 @@ All Microsoft Entra Tenants.
The Connection Profile is assigned under **.Entra ID Inventory** > **Settings** > **Connection**. It
is set to **Use the Default Profile**, as configured at the global **Settings** level. However, if
-this is not the Connection Profile with the necessary permissions for targeting the Microsoft Entra
+this isn't the Connection Profile with the necessary permissions for targeting the Microsoft Entra
tenants, select the **Select one of the following user defined profiles** option and select the
appropriate Connection Profile. See the
[Microsoft Entra ID Connection Profile & Host List](/docs/accessanalyzer/11.6/admin/datacollector/azureadinventory/configurejob.md)
@@ -40,27 +40,27 @@ Not supported.
:::info
Schedule the .Entra ID Inventory job group to run once a day. If there are
-frequent Microsoft Entra ID changes within the target environment, then it can be executed more
+frequent Microsoft Entra ID changes within the target environment, run it more
often. It is best to rerun it anytime Entra ID changes might have occurred.
:::
**Run at the Solution Level**
-The jobs in the .Entra ID Inventory Job Group should be run together and in order by running the
-entire solution, instead of the individual jobs.
+Run the jobs in the .Entra ID Inventory Job Group together and in order by running the
+entire solution, instead of running the individual jobs.
**Query Configuration**
-Run the solution with the default query configuration for best results. While it is recommended to
-make no changes to the
+Run the solution with the default query configuration for best results. Although you typically
+don't need to change the
[1-AAD_Scan Job](/docs/accessanalyzer/11.6/solutions/entraidinventory/1-aad_scan.md),
-a possible modification might be to scope the query to not collect login activity.
+you can scope the query to skip collecting login activity.
**Analysis Configuration**
-Run the solution with the default analysis configuration for best results. However, a possible
-modification might be to customize exception analysis parameters within the
+Run the solution with the default analysis configuration for best results. However, you can
+customize exception analysis parameters in the
[2-AAD_Exceptions Job](/docs/accessanalyzer/11.6/solutions/entraidinventory/2-aad_exceptions.md).
**Workflow**
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_activesync.md b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_activesync.md
index 6fb38e6301..05fd7e53bf 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_activesync.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_activesync.md
@@ -18,7 +18,7 @@ View the analysis tasks by navigating to the **Exchange** > **2. CAS Metrics** >
**EX_ActiveSync** > **Configure** node and select **Analysis**.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified or
+Most of these analysis tasks are preconfigured and shouldn't be modified or
deselected. There are some that are deselected by default, as they are for troubleshooting purposes.
:::
@@ -50,7 +50,7 @@ The following analysis task deletes table data from the analysis jobs. This anal
remain cleared unless specifically needed:
:::warning
-Do not select the **00. Deletes all History** option. This analysis task is for
+Don't select the **00. Deletes all History** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
@@ -61,8 +61,8 @@ troubleshooting and cleanup only. Data will be deleted from the database.
[Troubleshooting Data Collection](/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/ex_metricscollection.md#troubleshooting-data-collection)
topic for additional information
-The following analysis task updates the table to clean the data so that any UserAgent information
-that is returned as NULL is updated based on existing data in the table:
+The following analysis task cleans the table by updating any UserAgent information returned as
+NULL, based on existing data in the table:
- 01a. Clean NULL UserAgent – Updates UserAgent information which was returned as NULL based on
existing data
@@ -72,7 +72,7 @@ the following pre-configured reports:
| Report | Description | Default Tags | Report Elements |
| ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Device Types (Device Population) | This report identifies what device models are currently being used with ActiveSync, and the average load they put on the environment each day. | None | This report is comprised of two elements: - Bar Chart – Displays most popular devices
- Table – Provides details on most popular devices
|
+| Device Types (Device Population) | This report identifies what device models are being used with ActiveSync, and the average load they put on the environment each day. | None | This report is comprised of two elements: - Bar Chart – Displays most popular devices
- Table – Provides details on most popular devices
|
| Server Traffic (Top Servers by Average Daily Traffic) | This report ranks CAS servers by volume of ActiveSync traffic. | None | This report is comprised of two elements: - Bar Chart – Displays top users by average daily traffic
- Table – Provides details on top users by average daily traffic
|
| Top Users (Top Users by Average Daily Traffic) | This report shows the top users of ActiveSync. | None | This report is comprised of two elements: - Bar Chart – Displays top users by average daily traffic
- Table – Provides details on top users by average daily traffic
|
| User Devices (User Phones) | This report identifies all devices which have been associated with a User, and the time frames when they were used. | None | This report is comprised of one element: - Table – Provides details on user devices
|
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_aspolicies.md b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_aspolicies.md
index d4446fb747..20513ae62a 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_aspolicies.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_aspolicies.md
@@ -26,7 +26,7 @@ The following query is included in the EX_ASPolicies Job.
The ExchangePS Data Collector can be scoped if desired.
-Follow the steps to scope the ExchangePS Data Collector:
+To scope the ExchangePS Data Collector:
**Step 1 –** Navigate to job’s **Configure** node and select **Queries**.
@@ -37,29 +37,29 @@ Properties**. The Query Properties window opens.
Wizard opens.
:::warning
-Do not modify other wizard pages. The wizard pages are pre-configured for this job.
+Don't modify other wizard pages. The wizard pages are pre-configured for this job.
:::
-**Step 4 –** Navigate to the Scope page, and select the desired scoping method from those available.
+**Step 4 –** Navigate to the Scope page, and select the scoping method you want from those available.
See the
[ExchangePS: Scope](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scope.md) topic
for additional information.
- Scope by Database – Select the **Scope by Database Target Host: Local Host** option. Then, click
- **Next** and identify the desired databases on the Scope by Databases page. See the
+ **Next** and identify the databases you want on the Scope by Databases page. See the
[ExchangePS: Scope by DB](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopedatabases.md) topic
for additional information.
- Scope by Mailbox – Select the **Scope by Mailbox Target Host: Local Host** option. Then, click
- **Next** and identify the desired mailboxes on the Scope by Mailboxes page. See the
+ **Next** and identify the mailboxes you want on the Scope by Mailboxes page. See the
[ExchangePS: Scope by Mailboxes](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopemailboxes.md) topic
for additional information.
- Scope by Server – Select the **Scope by Server Target Host: Exchange MB Server** option. The job
returns results for specific servers selected in job’s **Configure** > **Hosts** node.
- Scope by Public Folder – Select the **Scope by Public Folder** option. Then, click **Next** and
- identify the desired mailboxes on the Scope by Public Folders page. See the
+ identify the mailboxes you want on the Scope by Public Folders page. See the
[ExchangePS: Scope by Public Folders](/docs/accessanalyzer/11.6/admin/datacollector/exchangeps/scopepublicfolders.md) topic
for additional information.
- _Remember,_ the scoping options available vary based on the pre-defined query configurations.
@@ -74,7 +74,7 @@ View the analysis tasks by navigating to the **Exchange** > **2. CAS Metrics** >
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -90,4 +90,4 @@ following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| User ActiveSync Policies (ActiveSync Settings) | Exchange introduced many ActiveSync policies and settings which can be applied to users. This report identifies which users have these settings enabled. | None | This report is comprised of two elements: - Pie Chart – Displays ActiveSync Policies
- Table – Provides details ActiveSync Policies
|
+| User ActiveSync Policies (ActiveSync Settings) | Exchange introduced many ActiveSync policies and settings which can be applied to users. This report identifies which users have these settings enabled. | None | This report is comprised of two elements: - Pie Chart – Displays ActiveSync Policies
- Table – Provides details on ActiveSync Policies
|
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_iislogs.md b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_iislogs.md
index 16b4215f88..f0bac44d34 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_iislogs.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_iislogs.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# 0.Collection > EX_IISLogs Job
-The 0.Collection > EX_IISLogs Job provides data collection to be utilized in the ActiveSync, Outlook
-Web Access, and Outlook Anywhere Reports. This job goes out to each server that contains the
-IIS Logs and parses the log to return the data to the Enterprise Auditor database.
+The 0.Collection > EX_IISLogs Job collects data for the ActiveSync, Outlook Web Access, and
+Outlook Anywhere reports. This job connects to each server that contains the IIS logs and parses
+the log to return the data to the Enterprise Auditor database.
@@ -36,7 +36,7 @@ modified on the Target Log page of the SMART Log DC Wizard. See the
[SMARTLog Data Collector](/docs/accessanalyzer/11.6/admin/datacollector/smartlog/overview.md)
topic for additional information.
-Follow the steps to modify the query configuration.
+To modify the query configuration:
**Step 1 –** Navigate to the **Exchange** > **2. CAS Metrics** > **0. Collection** >
**EX_IISLogs** > **Configure** node and select **Queries**.
@@ -47,7 +47,7 @@ opens.
**Step 3 –** Select the **Data Source** tab, and click **Configure**. The SMART Log DC Wizard opens.
:::warning
-Do not modify other wizard pages. The other wizard pages are pre-configured for this
+Don't modify other wizard pages. The other wizard pages are pre-configured for this
job.
:::
@@ -59,8 +59,8 @@ job.
topic for additional information.
:::tip
-Remember, if the date range configuration includes data older than the last scan, the **Persist
-Log State** checkbox on the Log State page must be disabled.
+Remember, if the date range configuration includes data older than the last scan, disable the
+**Persist Log State** checkbox on the Log State page.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_owatraffic.md b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_owatraffic.md
index 3a922aa2ed..d50cc61870 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_owatraffic.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_owatraffic.md
@@ -18,7 +18,7 @@ View the analysis tasks by navigating to the **Exchange** > **2. CAS Metrics** >
Access** > **EX_OWATraffic** > **Configure** node and select **Analysis**.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified ordeselected.
+Most of these analysis tasks are preconfigured and shouldn't be modified or deselected.
There is one that is deselected by default, as it is for troubleshooting purposes.
:::
@@ -46,7 +46,7 @@ The following analysis task deletes table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **00. Delete all History** option. This analysis task is for
+Don't select the **00. Delete all History** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_rpctraffic.md b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_rpctraffic.md
index 945b879f15..541f30f009 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_rpctraffic.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_rpctraffic.md
@@ -19,7 +19,7 @@ View the analysis tasks by navigating to the **Exchange** > **2. CAS Metrics** >
Anywhere** > **EX_RPCTraffic** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -43,11 +43,11 @@ The following analysis tasks are selected by default:
[Exchange History Retention](/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/ex_metricscollection.md#exchange-history-retention)
topic for additional information
-The following analysis tasks deletes table data from data collection and analysis jobs. These
+The following analysis tasks delete table data from data collection and analysis jobs. These
analysis tasks should remain cleared unless specifically needed:
:::warning
-Do not select the **00. Delete all History** option. This analysis task is for
+Don't select the **00. Delete all History** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
@@ -63,5 +63,5 @@ the following pre-configured reports:
| Report | Description | Default Tags | Report Elements |
| ---------------------------------------------------------------------- | -------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Top Servers by Average Load ( Top Servers by Average Daily User Count) | This report shows servers with the highest average load. | None | This report is comprised of two elements: - Stacked Bar Chart – Displays top servers by average daily user count
- Table – Provides details on top servers by average daily user count
|
+| Top Servers by Average Load (Top Servers by Average Daily User Count) | This report shows servers with the highest average load. | None | This report is comprised of two elements: - Stacked Bar Chart – Displays top servers by average daily user count
- Table – Provides details on top servers by average daily user count
|
| Top Users (Outlook Anywhere Traffic) | This report identifies top users of Outlook Anywhere. | None | This report is comprised of two elements: - Bar Chart – Displays top users
- Table – Provides details on top users
|
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/overview.md b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/overview.md
index 91bb043de5..9abcef75a3 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# 2.CAS Metrics Job Group
-The 2. CAS Metrics Job Group is comprised of data collection, analysis and reports that focus on
+The 2. CAS Metrics Job Group is comprised of data collection, analysis, and reports that focus on
remote connections (Outlook Web Access, ActiveSync, and Outlook Anywhere Access) occurring within
your organization. This job group goes out to each server that contains the IIS Logs and parses the
logs to return the data to the Enterprise Auditor database.
@@ -16,7 +16,7 @@ logs to return the data to the Enterprise Auditor database.
The jobs in the 2.CAS Metrics Job Group are:
- [0.Collection > EX_IISLogs Job](/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_iislogs.md)
- – Provides data collection to be utilized in the ActiveSync, Outlook Web Access, and Outlook
+ – Provides data collection to be used in the ActiveSync, Outlook Web Access, and Outlook
Anywhere Reports. This job group goes out to each server that contains the IIS Logs and parses the
logs to return the data to the Enterprise Auditor database.
- [ActiveSync > EX_ActiveSync Job](/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/ex_activesync.md)
@@ -31,7 +31,7 @@ The jobs in the 2.CAS Metrics Job Group are:
:::note
An actual CAS name is required for the data collection. When targeting Exchange 2013
- or 2016, it is possible for the **Settings** > **Exchange** node to have been configured with a
+ or 2016, the **Settings** > **Exchange** node might be configured with a
web address instead of an actual server. See the
[ExchangePS Data Collector & Client Access Server](/docs/accessanalyzer/11.6/solutions/exchange/recommended.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/recommended.md b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/recommended.md
index 2ee3077ce0..5767bf70f6 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/recommended.md
@@ -61,7 +61,7 @@ Run this Job Group at 2:00 AM.
**History Retention**
-History retention should not be enabled on this job group. History is kept through analysis tasks.
+History retention shouldn't be enabled on this job group. History is kept through analysis tasks.
Modify the following analysis tasks to customize the amount of history which is kept.
| Job Name | Analysis Task Name | Default History |
@@ -85,12 +85,12 @@ No other queries should be modified.
The 2. CAS Metrics Job Group should be run with the default analysis configurations.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified or
+Most of these analysis tasks are preconfigured and shouldn't be modified or
deselected. There are some that are deselected by default, as they are for troubleshooting purposes.
:::
-The following analysis tasks should not be deselected, but their parameters can be modified:
+The following analysis tasks shouldn't be deselected, but their parameters can be modified:
- **ActiveSync** > **EX_ActiveSync** Job – **07. SET HISTORY RETENTION** Analysis Task
- **Outlook Anywhere** > **EX_RPCTraffic** Job – **05. SET HISTORY RETENTION** Analysis Task
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/ex_dbinfo.md b/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/ex_dbinfo.md
index 1ff643548a..8cf2746a44 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/ex_dbinfo.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/ex_dbinfo.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# 1.Local > EX_DBInfo Job
-The EX_DBInfo job utilizes Exchange PowerShell to gather 2010/2013 Mailbox Size information.
+The EX_DBInfo job uses Exchange PowerShell to gather 2010/2013 Mailbox Size information.
@@ -14,7 +14,7 @@ The EX_DBInfo job is located in the 1.Local job group.
:::note
An actual CAS name is required for the data collection. When targeting Exchange 2013 or
-2016, it is possible for the **Settings** > **Exchange** node to have been configured with a web
+2016, the **Settings** > **Exchange** node might be configured with a web
address instead of an actual server. See the
[ExchangePS Data Collector & Client Access Server](/docs/accessanalyzer/11.6/solutions/exchange/recommended.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/ex_pfinfo.md b/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/ex_pfinfo.md
index cfca53b3ef..025321f022 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/ex_pfinfo.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/ex_pfinfo.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# 2.PF > EX_PFInfo Job
-The EX_PFInfo job utilizes MAPI to gather Public Folder Database Information focusing on database
+The EX_PFInfo job uses MAPI to gather Public Folder Database Information focusing on database
sizing, growth, and trends.
@@ -18,7 +18,7 @@ The EX_PFInfo job is located in the 2.PF job group.
The EX_PFInfo Job uses the Exchange2K Data Collector for the query.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/overview.md b/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/overview.md
index 66517886a3..9ea41d4140 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/overview.md
@@ -14,7 +14,7 @@ database sizing, growth, and trends.
The jobs in the 0.Collection Job Group are:
- [1.Local > EX_DBInfo Job](/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/ex_dbinfo.md)
- – Utilizes Exchange PowerShell to gather 2010/2013 Mailbox Size Information
+ – uses Exchange PowerShell to gather 2010/2013 Mailbox Size Information
- [2.PF > EX_PFInfo Job](/docs/accessanalyzer/11.6/solutions/exchange/databases/collection/ex_pfinfo.md)
- – Utilizes MAPI to gather Public Folder Database Information focusing on database sizing, growth,
+ – uses MAPI to gather Public Folder Database Information focusing on database sizing, growth,
and trends
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/databases/ex_dbsizing.md b/docs/accessanalyzer/11.6/solutions/exchange/databases/ex_dbsizing.md
index bc1f4d95d3..1d878ff9c4 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/databases/ex_dbsizing.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/databases/ex_dbsizing.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **3. Databases** > *
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -44,7 +44,7 @@ The following analysis task deletes table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **00. Deletes all Stored Data** option. This analysis task is for
+Don't select the **00. Deletes all Stored Data** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
@@ -60,7 +60,7 @@ following pre-configured reports:
| Report | Description | Default Tags | Report Elements |
| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Database Details (Storage Group Details) | This report provides the details of Mailbox Stores grouped by Server, then Storage Group. This report helps administrators locate Storage Groups that may be growing out of control. If a storage group with very few users is extremely large, further investigation may be required. | None | This report is comprised of two elements: - Bar Chart – Displays database sizes
- Table – Provides details on database sizes
|
+| Database Details (Storage Group Details) | This report provides the details of Mailbox Stores grouped by Server, then Storage Group. This report helps administrators locate Storage Groups that may be growing out of control. If a storage group with very few users is extremely large, investigate further. | None | This report is comprised of two elements: - Bar Chart – Displays database sizes
- Table – Provides details on database sizes
|
| Database Growth Statistics | This report displays the top 10 Databases that grew over the last 30 days in pure MB. This report is filtered on the Rank Column for Top 10 and may be modified to fit any desired Top outcome. | None | This report is comprised of four elements: - Stacked Bar Chart – Displays store size growth
- Stacked Bar Chart – Displays WhiteSpace growth
- Table – Provides details on store size growth
- Table – Provides details on WhiteSpace growth
|
| Historical Database Information | This report shows the history of the store size, white space, mailbox count, and hard drive space on all targeted servers. | None | This report is comprised of one element: - Table – Displays details on historical store information
|
-| Mailbox Counts by Database | This report graphically displays the number of Mailboxes by Database. It provides an overall picture of the Exchange Mailbox Environment. Having a clear break down of the number of mailboxes per database allows for better planning of architecture in the future. | None | This report is comprised of two elements: - Bar Chart – Displays mailbox counts by database
- Table – Provides details on mailbox counts by database
|
+| Mailbox Counts by Database | This report graphically displays the number of Mailboxes by Database. It provides an overall picture of the Exchange Mailbox Environment. A clear breakdown of the number of mailboxes per database helps you plan future architecture. | None | This report is comprised of two elements: - Bar Chart – Displays mailbox counts by database
- Table – Provides details on mailbox counts by database
|
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/databases/ex_dbtrending.md b/docs/accessanalyzer/11.6/solutions/exchange/databases/ex_dbtrending.md
index 6b10a4cb67..daf3a01e77 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/databases/ex_dbtrending.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/databases/ex_dbtrending.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **3. Databases** > *
**Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -39,4 +39,4 @@ the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Capacity Planning | This report displays the growth rate trend of your private stores and the growth rate trend of your public stores. The trend is projected for two months. These reports help identify bad trends in growth on Exchange servers for hard drive space usage is key in avoiding running out of space. | None | This report is comprised of two elements: - Line Chart – Displays private store trend
- Line Chart – Displays public store trend
|
+| Capacity Planning | This report displays the growth rate trend of your private stores and the growth rate trend of your public stores. The trend is projected for two months. These reports help identify bad trends in growth on Exchange servers for hard drive space usage is key in avoiding running out of space. | None | This report is comprised of two elements: - Line Chart – Displays private store trend
- Line Chart – Displays public store trend
|
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/databases/recommended.md b/docs/accessanalyzer/11.6/solutions/exchange/databases/recommended.md
index acfc42255c..5c76dc98f2 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/databases/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/databases/recommended.md
@@ -57,7 +57,7 @@ Run this Job Group at 3:00 AM.
**History Retention**
-History retention should not be enabled on this job group. History is kept through analysis tasks.
+History retention shouldn't be enabled on this job group. History is kept through analysis tasks.
Modify the following analysis tasks to customize the amount of history which is kept:
| Job Name | Analysis Task Name | Default History |
@@ -83,7 +83,7 @@ deselected. There are some that are deselected by default, as they are for troub
:::
-The following analysis task should not be deselected, but the parameters can be modified:
+The following analysis task shouldn't be deselected, but the parameters can be modified:
- **EX_DBSizing** Job – **SET HISTORY RETENTION** Analysis Task
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/ex_dlcleanup.md b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/ex_dlcleanup.md
index b8edc85f6f..c08287b872 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/ex_dlcleanup.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/ex_dlcleanup.md
@@ -16,7 +16,7 @@ View the analysis task by navigating to the **Exchange** > **6. Distribution Lis
**EX_DLCleanup** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/ex_groupexpansion.md b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/ex_groupexpansion.md
index cf3e7bc3bd..52bd5e617f 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/ex_groupexpansion.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/ex_groupexpansion.md
@@ -18,7 +18,7 @@ View the analysis tasks by navigating to the **Exchange** > **6. Distribution Li
Membership** > **EX_GroupExpansion** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_circularnesting.md b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_circularnesting.md
index 4fb40fc459..38da3c242c 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_circularnesting.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_circularnesting.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **6. Distribution Li
Analysis** > **EX_CircularNesting** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_emptygroups.md b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_emptygroups.md
index 49f15d7dab..eb4379fa8a 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_emptygroups.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_emptygroups.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **6. Distribution Li
Analysis** > **EX_EmptyGroups** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_largestgroups.md b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_largestgroups.md
index 547a38c9fa..5b6f682aff 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_largestgroups.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_largestgroups.md
@@ -14,7 +14,7 @@ View the analysis task by navigating to the **Exchange** > **6. Distribution Lis
Analysis** > **EX_LargestGroups** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_nestedgroups.md b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_nestedgroups.md
index c33b3207b3..30488a7250 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_nestedgroups.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_nestedgroups.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **6. Distribution Li
Analysis** > **EX_NestedGroups** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_stalegroups.md b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_stalegroups.md
index 6f46c6584b..e44b79c110 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_stalegroups.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/ex_stalegroups.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **6. Distribution Li
Analysis** > **EX_StaleGroups** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/overview.md b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/overview.md
index 0883d22948..25da9506e3 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Membership Analysis Job Group
-The Membership Analysis job group provides visibility into toxic conditions contained with the
+The Membership Analysis job group provides visibility into toxic conditions within the
environment, such as circular nesting, large groups, empty groups, nesting, and potentially stale
groups.
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/overview.md b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/overview.md
index 6844dd22ad..64aa5c899e 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/overview.md
@@ -21,7 +21,7 @@ These jobs are compatible with the Office 365 environment.
- [Effective Membership > EX_GroupExpansion Job](/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/ex_groupexpansion.md)
– Expands the direct membership of distribution groups in the environment
- [Membership Analysis Job Group](/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/membershipanalysis/overview.md)
- – Provides visibility into toxic conditions contained with the environment, such as circular
+ – Provides visibility into toxic conditions within the environment, such as circular
nesting, large groups, empty groups, nesting, and potentially stale groups
- [EX_DLCleanup Job](/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/ex_dlcleanup.md)
– Identifies potentially stale distribution groups based on the last domain logon of the members,
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/recommended.md b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/recommended.md
index 899adaf8bf..3602c9cb54 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/distributionlists/recommended.md
@@ -25,7 +25,7 @@ The following job groups need to be successfully run:
**Schedule Frequency**
This job group has been designed to run daily after the .Active Directory Inventory Job Group has
-been run, to analyze distribution list membership. This job group does not collect data. It uses the
+been run, to analyze distribution list membership. This job group doesn't collect data. It uses the
data collection from the .Active Directory Inventory Job Group.
:::info
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/ex_useroverview.md b/docs/accessanalyzer/11.6/solutions/exchange/ex_useroverview.md
index 1af05c8429..3060516d33 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/ex_useroverview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/ex_useroverview.md
@@ -15,7 +15,7 @@ environment.
**Dependencies**
-The following job groups need to be successfully run prior to this job:
+The following job groups need to be successfully run before this job:
- **.Active Directory Inventory** Job Group
- **.Entra ID Inventory** Job Group
@@ -27,8 +27,7 @@ The following job groups need to be successfully run prior to this job:
**Schedule Frequency**
-It is recommended to run this job daily after running its dependencies, but it can be scheduled to
-run as desired.
+Run this job daily after running its dependencies, or schedule it to run as needed.
## Analysis Tasks for the EX_Mailflow_UserOverview Job
@@ -36,7 +35,7 @@ View the analysis task by navigating to the **Exchange** > **EX_UserOverview** >
and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/appletstatuscheck.md b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/appletstatuscheck.md
index 113f897050..050f8ebf71 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/appletstatuscheck.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/appletstatuscheck.md
@@ -14,7 +14,7 @@ Exchange servers.
The .AppletStatusCheck Job uses the Script Data Collector.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/ex_metricscollection.md b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/ex_metricscollection.md
index e9c01667fe..dc2ad0de66 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/ex_metricscollection.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/ex_metricscollection.md
@@ -6,11 +6,11 @@ sidebar_position: 20
# EX_MetricsCollection Job
-The EX_MetricsCollection Job is comprised of multiple queries that utilize the ExchangeMetrics Data
+The EX_MetricsCollection Job is comprised of multiple queries that use the ExchangeMetrics Data
Collector to process and collect the message tracking logs on the Exchange servers in the
environment. These queries collect server, domain, user, and distribution list traffic including but
-not limited to: sent, received, journal, NDRs, and transports messages. These queries are configured
-to process and collect that previous 7 days of Message Tracking Logs the first time this job is run,
+not limited to: sent, received, journal, NDRs, and transport messages. These queries are configured
+to process and collect the previous 7 days of Message Tracking Logs the first time this job is run,
after that it only collects the previous day unless the **Enable Persistent Log State** option has
been enabled in the query.
@@ -45,7 +45,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_MetricsCollection** > **Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -56,7 +56,7 @@ The following analysis tasks are selected by default:
- **1. Delivery Times History** – Creates the SA_ExhangeMetrics_DeliveryTimes table, accessible under
the job’s Results node
-- **2. DL History** – Creates the SA*EX* ExhangeMetrics_DistributionLists table, accessible under the
+- **2. DL History** – Creates the SA_EX_ExhangeMetrics_DistributionLists table, accessible under the
job’s Results node
- **3. Internet Traffic History** – Creates the SA_EX_ExhangeMetrics_InternetTraffic table, accessible
under the job’s Results node
@@ -78,7 +78,7 @@ The following analysis task deletes table data from data collection and analysis
task should remain deselected unless specifically needed:
:::warning
-Do not select the **00. Deletes all Stored Data** option. This analysis task is for
+Don't select the **00. Deletes all Stored Data** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
@@ -92,8 +92,8 @@ troubleshooting and cleanup only. Data will be deleted from the database.
The **08. SET HISTORY RETENTION** analysis task controls the retention period for the job’s data.
This is why the Data Retention Period options at the global, job group, or job Properties settings
-are not supported for the job group. The number of months can be modified. If desired, the parameter
-can be set to a specified number of days. Follow these steps to modify the history retention period.
+aren't supported for the job group. The number of months can be modified. If desired, the parameter
+can be set to a specified number of days. To modify the history retention period:
**Step 1 –** Navigate to the job’s **Configure** node and select **Analysis**.
@@ -132,17 +132,17 @@ The modified history retention period is now applied during future job execution
## Troubleshooting Data Collection
-There might be times when it is necessary to purge the data either through dropping the tables from
-the database or truncating the data within the tables. This option is provided through ananalysis
-task that is not selected by default. Only one analysis task within a job should be enabled when the
-desire is to purge that database.
+There might be times when you need to purge the data either by dropping the tables from
+the database or by truncating the data within the tables. This option is provided through an analysis
+task that isn't selected by default. Enable only one analysis task within a job when you want to
+purge that database.
:::warning
This analysis task deletes information collected or produced by jobs in this solution.
:::
-Follow these steps to troubleshoot data collection:
+To troubleshoot data collection:
**Step 1 –** Navigate to the job’s **Configure** node and select **Analysis**.
@@ -159,9 +159,9 @@ Remember, only one task should be selected.
**Step 3 –** In the Navigation pane, right-click the **Analysis** node and select **Execute
Analyses**.
-**Step 4 –** After the analysis task has been executed, return to the Analysis Selection view.
-Deselect the analysis task which was executed and reselect the default analysis tasks (if any had
-been cleared in Step 2).
+**Step 4 –** After you run the analysis task, return to the Analysis Selection view.
+Deselect the analysis task you ran and reselect the default analysis tasks (if any were
+cleared in Step 2).
-The selected purge of data and tables has taken place, and the analysis tasks have been reset to the
+The selected purge of data and tables is complete, and the analysis tasks are reset to the
default state.
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/ex_metricsdetails.md b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/ex_metricsdetails.md
index 670338892c..ed01e6b115 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/ex_metricsdetails.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/ex_metricsdetails.md
@@ -6,11 +6,11 @@ sidebar_position: 30
# EX_MetricsDetails Job
-The EX_MetricsDetails Job collects daily user-to-user Traffic. Walk through this jobs query to
+The EX_MetricsDetails Job collects daily user-to-user Traffic. Walk through this job's query to
configure the internal domains to collect the sender to recipient traffic from. By default, the
query is configured to collect the previous 1 day of Message Tracking Logs and has @netwrix.com
-configured as the domain. If the domains are not configured in the query, then most likely data
-collection does not return.
+configured as the domain. If the domains aren't configured in the query, then most likely data
+collection doesn't return.
## Queries for the EX_MetricsDetails Job
@@ -31,7 +31,7 @@ The following query is included in the EX_MetricsDetails Job:
The Activity Metrics Query has been preconfigured to run with the ExchangeMetrics Data Collector to
collect user traffic per day. The domains must be configured for data collection to return data.
-Follow the steps to configure the Activity Metrics Query.
+To configure the Activity Metrics Query:
**Step 1 –** Navigate to the **Exchange** > **1. HUB Metrics** > **0. Collection** >
**EX_MetricsDetails** > **Configure** node and select **Queries**.
@@ -43,7 +43,7 @@ Properties**. The Query Properties window opens.
Collector Wizard opens.
:::warning
-Do not modify other wizard pages. The wizard pages are pre-configured for this job.
+Don't modify other wizard pages. The wizard pages are pre-configured for this job.
:::
@@ -65,7 +65,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_MetricsDetails** > **Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -87,7 +87,7 @@ The following analysis task clears table data from data collection and analysis
task should remain deselected unless specifically needed:
:::warning
-Do not select the **00. DROP HISTORY** option. This analysis task is for
+Don't select the **00. DROP HISTORY** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/overview.md b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/overview.md
index ca457492e5..dde56b6b00 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/overview.md
@@ -16,12 +16,12 @@ The jobs in the 0.Collection Job Group are:
- [AppletStatusCheck Job](/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/appletstatuscheck.md)
– Checks the health and status of the applet deployed to the target Exchange servers
- [EX_MetricsCollection Job](/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/ex_metricscollection.md)
- – Comprised of multiple queries that utilize the Exchange Metrics Data Collect to process and
+ – Comprised of multiple queries that use the Exchange Metrics Data Collect to process and
collect the message tracking logs on the Exchange servers in the environment. These queries
collect server, domain, user, and distribution list traffic including but not limited to sent,
- received, journal, NDRs, and transports message. These queries are configured to process and
- collect that previous 7 days of Message Tracking Logs the first time this job is run, after that
- it only collects the previous day assuming persistence has not been disabled inside the query.
+ received, journal, NDRs, and transport messages. These queries are configured to process and
+ collect the previous 7 days of Message Tracking Logs the first time this job is run, after that
+ it only collects the previous day if persistence is enabled in the query.
- [EX_MetricsDetails Job](/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/collection/ex_metricsdetails.md)
– Collects user to user traffic per day
@@ -29,6 +29,6 @@ The jobs in the 0.Collection Job Group are:
This job's query needs to be configured to the internal domains from which to collect
the sender to recipient traffic. By default, the query is configured to collect the previous 1
day of Message Tracking Logs and has @netwrix.com configured as the domain. If the domains are
- not configured in the query, then most likely data collection does not return.
+ not configured in the query, then most likely data collection doesn't return.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_deliverytimes.md b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_deliverytimes.md
index 9caccbecb7..cccfcf5b53 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_deliverytimes.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_deliverytimes.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_DeliveryTimes** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_dlmetrics.md b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_dlmetrics.md
index 0f72cbebd9..f6ffcad9c4 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_dlmetrics.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_dlmetrics.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_domainmetrics.md b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_domainmetrics.md
index 104439f532..b2757f4910 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_domainmetrics.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_domainmetrics.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_DomainMetrics** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -29,7 +29,7 @@ The following analysis tasks are selected by default:
- **2. External Domain Traffic - Volume** – Creates the SA_EX_DomainMetrics_Volume table, accessible
under the job’s Results node
-In addition to the tables and views by the analysis tasks, the EX_DomainMetrics Job produces the
+In addition to the tables and views created by the analysis tasks, the EX_DomainMetrics Job produces the
following pre-configured reports:
| Report | Description | Default Tags | Report Elements |
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_hourlymetrics.md b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_hourlymetrics.md
index 513ac33995..f5f3cb07fe 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_hourlymetrics.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_hourlymetrics.md
@@ -15,13 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_HourlyMetrics** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
-preconfigured for this job.
-:::
-
-
-:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_messagesize.md b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_messagesize.md
index 41c4ee5a2a..3b6c86724c 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_messagesize.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_messagesize.md
@@ -14,7 +14,7 @@ View the analysis task by navigating to the **Exchange** > **1. HUB Metrics** >
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_servermetrics.md b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_servermetrics.md
index f8a8d46351..2cdcbc2bf8 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_servermetrics.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_servermetrics.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_ServerMetrics** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_usermetrics.md b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_usermetrics.md
index 0df99307df..231a11cc35 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_usermetrics.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_usermetrics.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_UserMetrics** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/overview.md b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/overview.md
index dad39da21b..8e79095bb0 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/overview.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# 1.HUB Metrics Job Group
-The 1. HUB Metrics Job Group is comprised of data collection, analysis and reports that focus on
+The 1. HUB Metrics Job Group is comprised of data collection, analysis, and reports that focus on
mail-flow activity occurring within your organization. This job group goes out to each server that
-contains the Message Tracking Logs and parse the log to return the data to the Enterprise Auditor
+contains the Message Tracking Logs and parses the log to return the data to the Enterprise Auditor
database.
@@ -30,6 +30,6 @@ The following job groups and jobs comprise the 1. HUB Metrics Job Group:
– Provides information around size of messages sent and received
- [EX_ServerMetrics Job](/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_servermetrics.md)
– Provides visibility into server mail-flow statistics, such as, sent, received, journaling,
- transport and NDR counts and sizes
+ transport and non-delivery report (NDR) counts and sizes
- [EX_UserMetrics Job](/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/ex_usermetrics.md)
– Provides information around each user’s mail-flow in the organization
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/recommended.md b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/recommended.md
index e67dbdfb35..703a2239ec 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/recommended.md
@@ -56,7 +56,7 @@ Run this job group at 1:00 AM.
**History Retention**
-History retention should not be enabled on this job group. History is kept through analysis tasks.
+History retention shouldn't be enabled on this job group. History is kept through analysis tasks.
Modify the following analysis tasks to customize the amount of history which is kept:
| Job Name | Analysis Task Name | Default History |
@@ -86,13 +86,13 @@ following exceptions:
The 1. HUB Metrics Job Group should be run with the default analysis configurations.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified or
+Most of these analysis tasks are preconfigured and shouldn't be modified or
deselected. There are a few which are deselected by default, as they are for troubleshooting
purposes.
:::
-The following analysis tasks should not be deselected, but their parameters can be modified:
+The following analysis tasks shouldn't be deselected, but their parameters can be modified:
- **0. Collection** > **EX_MetricsCollection** Job – **08. SET HISTORY RETENTION** Analysis Task
- **0. Collection** > **EX_MetricsDetails** Job – **02. SET HISTORY RETENTION** Analysis Task
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/ex_features.md b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/ex_features.md
index 2dd0de6ec0..41bd503cf2 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/ex_features.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/ex_features.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# Features > EX_Features Job
The EX_Features job is comprised of data collection and a report that provides information around
-which features have been enabled or disabled on Mailboxes, such as ActiveSync, IMAP, POP and more.
+which features have been enabled or disabled on Mailboxes, such as ActiveSync, IMAP, POP, and more.
:::info
Schedule the Features Job Group to run weekly on any desired recurrence.
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/logons/ex_mailboxlogons.md b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/logons/ex_mailboxlogons.md
index 060cd0dab2..3c24369244 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/logons/ex_mailboxlogons.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/logons/ex_mailboxlogons.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **4. Mailboxes** > *
**EX_MailboxLogons** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -45,7 +45,7 @@ The following analysis task deletes table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **00. Delete All Historical Data** option. This analysis task is for
+Don't select the **00. Delete All Historical Data** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/overview.md b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/overview.md
index 5375602ec9..132ebc3bf4 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/overview.md
@@ -20,12 +20,12 @@ These jobs are compatible with the Office 365 environment.
- [Features > EX_Features Job](/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/ex_features.md)
– Comprised of data collection and a report that provides information around which features have
- been enabled or disabled on mailboxes, such as ActiveSync, IMAP, POP and more
+ been enabled or disabled on mailboxes, such as ActiveSync, IMAP, POP, and more
- [Logons Job Group](/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/logons/overview.md)
– Provides collection of Native Mailbox Access Auditing logs from Exchange to provide reporting
around mailbox logon activity
- [Permissions Job Group](/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/overview.md)
- – Comprised of data collection, analysis and reports that focus on access granted to each mailbox
+ – Comprised of data collection, analysis, and reports that focus on access granted to each mailbox
in the environment including, Mailbox Rights, Active Directory Permissions, Delegation, and Folder
Permissions
- [Sizing Job Group](/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/sizing/overview.md)
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/collection/ex_sendas.md b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/collection/ex_sendas.md
index f2b25df74c..cd7227da5c 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/collection/ex_sendas.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/collection/ex_sendas.md
@@ -38,7 +38,7 @@ View the analysis task by navigating to the **Exchange** > **4. Mailboxes** > **
**0.Collection** > **EX_SendAs** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/ex_admingroups.md b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/ex_admingroups.md
index bd4d13b80b..5f4fe15901 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/ex_admingroups.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/ex_admingroups.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **4. Mailboxes** > *
**EX_AdminGroups** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/ex_mailboxaccess.md b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/ex_mailboxaccess.md
index 2b821227ac..54fb34c074 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/ex_mailboxaccess.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/ex_mailboxaccess.md
@@ -10,18 +10,18 @@ The EX_MailboxAccess job provides visibility into access granted to each mailbox
taking into consideration Mailbox Rights, Active Directory Permissions, Delegation, and Folder
Permissions.
-## Analysis Tasks for the EX_Mailbox Access Job
+## Analysis Tasks for the EX_MailboxAccess Job
View the analysis tasks by navigating to the **Exchange** > **4. Mailboxes** > **Permissions** >
**EX_MailboxAccess** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
-
+
The following analysis tasks are selected by default:
@@ -52,7 +52,7 @@ The following analysis tasks are selected by default:
- 12.Send As Summary – Creates the SA_EX_MailboxAccess_SendAsSummary table accessible under the
job’s Results node
-The following analysis tasks is selected to export data to the AIC:
+The following analysis task is selected to export data to the AIC:
- 13.AIC Import - Export Exchange Permissions – Exports delegates, Send AS rights, mailbox
permissions, and Active Directory rights to the Access Information Center
@@ -73,5 +73,5 @@ the following pre-configured reports:
| Delegation (Delegates) | This report identifies users where Delegate/Send on Behalf Of rights have been assigned and which objects the users have been given rights to. | None | This report is comprised of two elements: - Bar Chart – Displays top users by number of delegates
- Table – Provides details on top users by number of delegates
|
| Full Control Access (Mailboxes with Full Control) | This report identifies users with the largest amount of Full Control rights assigned to other individuals. | None | This report is comprised of two elements: - Bar Chart – Displays top users with full control granted
- Table – Provides details on top users with full control granted
|
| Incorrect Default And Anon Permissions | This report identifies where Default or Anonymous have any role assignment other than **None** or **Free/Busy time**. | None | This report is comprised of three elements: - Bar Chart – Displays top users with incorrect default/anon permissions
- Table – Provides details on top users with incorrect default/anon permissions
- Table – Provides role details
|
-| Missing Anonymous Permissions | This report identifies folders where Anonymous permissions are not assigned. | None | This report is comprised of one element: - Table – Provides details on missing anonymous permissions
|
+| Missing Anonymous Permissions | This report identifies folders where Anonymous permissions aren't assigned. | None | This report is comprised of one element: - Table – Provides details on missing anonymous permissions
|
| Send As (Send-As Rights) | This report identifies which users have the highest number of users with Send-As rights to their mailbox. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays top users by send as rights granted
- Table – Provides details on top users by send as right granted
- Table – Provides additional details
|
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/overview.md b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/overview.md
index 161ed37e3b..98e0199177 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/permissions/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Permissions Job Group
-The Permissions job group is comprised of data collection, analysis and reports that focus on access
+The Permissions job group is comprised of data collection, analysis, and reports that focus on access
granted to each mailbox in the environment including, Mailbox Rights, Active Directory Permissions,
Delegation, and Folder Permissions.
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/recommended.md b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/recommended.md
index f7276f9a08..472e94ceac 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/recommended.md
@@ -38,7 +38,7 @@ on-premises to run against:
- Local host
This Job Group can target a custom host list for Exchange Online instead of targeting Exchange
-on-premises. However, do not try to target both types of environments.
+on-premises. However, don't try to target both types of environments.
**Connection Profile**
@@ -63,7 +63,7 @@ topic for additional information.
**Schedule Frequency**
-It is not recommended to run these jobs at the 4. Mailboxes job group level. The Logons sub-job
+Don't run these jobs at the 4. Mailboxes job group level. The Logons sub-job
group and Sizing job group have been designed to run daily. The Features sub-job group and
Permissions job group have been designed to run weekly. See the table for recommended times:
@@ -76,7 +76,7 @@ Permissions job group have been designed to run weekly. See the table for recomm
**History Retention**
-History retention should not be enabled on this job group. History is kept through analysis tasks.
+History retention shouldn't be enabled on this job group. History is kept through analysis tasks.
Modify the following analysis tasks to customize the amount of history which is kept:
| Job Name | Analysis Task Name | Default History |
@@ -104,18 +104,18 @@ No other queries should be modified.
The 4. Mailboxes job group should be run with the default analysis configurations.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified or
+Most of these analysis tasks are preconfigured and shouldn't be modified or
deselected. There are some tasks that are deselected by default, as they are for troubleshooting
purposes.
:::
-The following analysis tasks should not be deselected, but their parameters can be modified:
+The following analysis tasks shouldn't be deselected, but their parameters can be modified:
- **Logons** > **EX_MailboxLogons** Job – **03.SET HISTORY RETENTION** Analysis Task
- **Sizing** > **EX_MailboxSizes** Job – **02.SET HISTORY RETENTION** Analysis Task
-The following analysis tasks is enabled to send Exchange mailbox permission data to the
+The following analysis task is enabled to send Exchange mailbox permission data to the
Netwrix Access Information Center:
- **Permissions** > **EX_MailboxAccess** Job – **13.AIC Import - Export Exchange Permissions**
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/sizing/ex_mailboxsizes.md b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/sizing/ex_mailboxsizes.md
index d6b2c94ef8..8f99ed2cc8 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/sizing/ex_mailboxsizes.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/sizing/ex_mailboxsizes.md
@@ -8,18 +8,18 @@ sidebar_position: 20
The EX_MailboxSizes job provides analysis and reporting around mailbox sizing and growth.
-#### Analysis Tasks for the EX_Mailbox Sizes Job
+#### Analysis Tasks for the EX_MailboxSizes Job
View the analysis tasks by navigating to the **Exchange** > **4. Mailboxes** > **Sizing** >
**EX_MailboxSizes** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
-
+
The following analysis tasks are selected by default:
@@ -47,7 +47,7 @@ The following analysis task deletes table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **00.Delete All Data** option. This analysis task is for
+Don't select the **00.Delete All Data** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database:
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/sizing/ex_stalemailboxes.md b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/sizing/ex_stalemailboxes.md
index 069ce34c20..f0d3e1f886 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/sizing/ex_stalemailboxes.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/sizing/ex_stalemailboxes.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **4. Mailboxes** > *
**EX_StaleMailboxes** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -35,5 +35,5 @@ produces the following pre-configured reports:
| Report | Description | Default Tags | Report Elements |
| --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Orphaned Mailboxes | Orphaned Mailboxes do not have an Active Directory account associated with them, and generally can be safely deleted. | None | This report is comprised of three elements: - Bar Chart – Displays orphan mailbox storage
- Table – Provides details on all orphaned mailboxes
- Table – Provides details on orphan mailbox storage
|
+| Orphaned Mailboxes | Orphaned Mailboxes don't have an Active Directory account associated with them, and generally can be safely deleted. | None | This report is comprised of three elements: - Bar Chart – Displays orphan mailbox storage
- Table – Provides details on all orphaned mailboxes
- Table – Provides details on orphan mailbox storage
|
| Stale Users (Mailboxes associated with Stale AD Accounts) | This report shows mailboxes which are tied to stale user accounts. | None | This report is comprised of three elements: - Bar Chart – Displays stale user mailboxes
- Table – Provides details stale user mailboxes
- Table – Provides additional details on stale user mailboxes
|
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/sizing/ex_storesizes.md b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/sizing/ex_storesizes.md
index 4fef0add56..72fe842f7a 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/sizing/ex_storesizes.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/sizing/ex_storesizes.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **4. Mailboxes** >
**Sizing** > **EX_StoreSizes** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow.md b/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow.md
index 98ad94e511..2714a9f408 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow.md
@@ -14,7 +14,7 @@ The EX_Mailflow job is located in the **Mailflow** > **0. Collection** job group
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -44,7 +44,7 @@ The following queries are included in the EX_Mailflow job:
- LocalDomains – Collects domains local to the Office 365 environment
:::warning
- Do not modify this query. The query is preconfigured for this job.
+ Don't modify this query. The query is preconfigured for this job.
:::
@@ -57,7 +57,7 @@ The following queries are included in the EX_Mailflow job:
The ExchangePS Data Collector configured with the Mail Flow Metrics category can be scoped to
specific report dates. By default, the MailFlow Query is set to report on the Last 7 Days.
-Follow the steps to modify the query configuration:
+To modify the query configuration:
**Step 1 –** Navigate to the **Exchange** > **8. Exchange Online** > **0. Collection** >
**EX_Mailflow** > **Configure** node and select **Queries**.
@@ -69,7 +69,7 @@ Properties window opens.
Wizard opens.
:::warning
-Do not modify other wizard pages. The wizard pages are pre-configured for this job.
+Don't modify other wizard pages. The wizard pages are pre-configured for this job.
:::
@@ -95,7 +95,7 @@ View the analysis tasks by navigating to the **Exchange** > **8. Exchange Online
Collection** > **EX_Mailflow** > **Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -121,7 +121,7 @@ The following analysis task deletes table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **00. Deletes all Stored Data** option. This analysis task is for
+Don't select the **00. Deletes all Stored Data** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_dl.md b/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_dl.md
index b806b6e906..49b85d36f7 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_dl.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_dl.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **8. Exchange Online
**EX_Mailflow_DL** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -23,13 +23,13 @@ preconfigured for this job.
The following analysis tasks are selected by default:
-- Azure Groups Direct Member Count – Creates the EX_ MailFlow_DL_AzureMemberCount table, accessible
+- Azure Groups Direct Member Count – Creates the EX_MailFlow_DL_AzureMemberCount table, accessible
under the job’s Results node. Provides a direct member count for distribution lists from Azure
groups.
-- DLs by Count – Creates the EX_ Mailflow_DLsByCount table, accessible under the job’s Results
+- DLs by Count – Creates the EX_Mailflow_DLsByCount table, accessible under the job’s Results
node. Lists of all distribution lists and how much mail-flow they have received.
-In addition to the tables and views created by the analysis tasks, the EX_Mailflow_DL Jjb produces
+In addition to the tables and views created by the analysis tasks, the EX_Mailflow_DL Job produces
the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_domain.md b/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_domain.md
index 75e9dc975c..92d123b1ec 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_domain.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_domain.md
@@ -11,7 +11,7 @@ coming from. This job is set to analyze the last 30 days.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -30,7 +30,7 @@ View the analysis task by navigating to the **Exchange** > **8. Exchange Online*
**EX_Mailflow_Domain** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_mailbox.md b/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_mailbox.md
index a06dffcff2..eca57a6ecc 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_mailbox.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_mailbox.md
@@ -11,7 +11,7 @@ This job is set to analyze the last 30 days.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -31,7 +31,7 @@ View the analysis tasks by navigating to the **Exchange** > **8. Exchange Online
**EX_Mailflow_Mailbox** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_orgoverview.md b/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_orgoverview.md
index 9116db8e88..5a1f725481 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_orgoverview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/ex_mailflow_orgoverview.md
@@ -11,7 +11,7 @@ This job is set to analyze the last 30 days.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/overview.md b/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/overview.md
index 30bbb84c67..8a4614ebe8 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/online/mailflow/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Mailflow Job Group
-The Mailbox job group is comprised of jobs that process and analyze the Message Tracking Logs in the
+The Mailflow job group is comprised of jobs that process and analyze the Message Tracking Logs in the
Office 365 environment. This job group parses message tracking and stores the data for analysis and
reporting in the Enterprise Auditor database.
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/online/recommended.md b/docs/accessanalyzer/11.6/solutions/exchange/online/recommended.md
index fabaa8dfc1..aaa08bd028 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/online/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/online/recommended.md
@@ -68,7 +68,7 @@ The 8. Exchange Online job group should be run with the default analysis configu
these analysis tasks are preconfigured and should never be modified or deselected. There are some
that are deselected by default, as they are for troubleshooting purposes.
-The following analysis tasks should not be deselected, but their parameters can be modified:
+The following analysis tasks shouldn't be deselected, but their parameters can be modified:
- **Mailflow** > **0. Collection** > **EX_Mailflow** Job – **03. SET HISTORY RETENTION** Analysis
Task
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/overview.md b/docs/accessanalyzer/11.6/solutions/exchange/overview.md
index 24c289ad5b..9c02c043a0 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/overview.md
@@ -37,24 +37,23 @@ topics for additional information.
**Sensitive Data Discovery Considerations**
The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans.If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host.For example, if the job is configured to scan 8 hosts at a time , then
-an extra 16 GB of RAM are required (8x2=16).
+which enables Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans,
+increase the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per
+host. For example, if the job is configured to scan 8 hosts at a time, the job needs an extra 16 GB
+of RAM (8x2=16).
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
-configuration; it has been preconfigured to work with Enterprise Auditor and should never be
-customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
-environment.
+(Java) version on the server. This JDK requires no configuration, works with Enterprise Auditor
+by default, and doesn't conflict with other JDKs or Java Runtimes in the same environment. Don't
+customize it through Java.
:::
**Location**
The Exchange Solution requires a special Enterprise Auditor license. It can be installed from the
-Enterprise Auditor Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to
+Enterprise Auditor Instant Job Wizard. After it has been installed into the Jobs tree, navigate to
the solution: **Jobs** > **Exchange**.
Each job group within the solution collects data, analyzes the data, and reports on the target
@@ -71,23 +70,23 @@ The Exchange Solution is divided into categories based upon what is being audite
The following job groups comprise the Exchange Solution:
- [1.HUB Metrics Job Group](/docs/accessanalyzer/11.6/solutions/exchange/hubmetrics/overview.md)
- – Comprised of data collection, analysis and reports that focus on mail-flow activity occurring
+ – Comprised of data collection, analysis, and reports that focus on mail-flow activity occurring
within your organization. This job group goes out to each server that contains the Message
Tracking Logs and parses the log to return the data to the Enterprise Auditor database.
- [2.CAS Metrics Job Group](/docs/accessanalyzer/11.6/solutions/exchange/casmetrics/overview.md)
- – Comprised of data collection, analysis and reports that focus on remote connections (Outlook Web
+ – Comprised of data collection, analysis, and reports that focus on remote connections (Outlook Web
Access, ActiveSync, and Outlook Anywhere Access) occurring within your organization. This job
group goes out to each server that contains the IIS Logs and parses the log to return the data to
the Enterprise Auditor database.
- [3.Databases Job Group](/docs/accessanalyzer/11.6/solutions/exchange/databases/overview.md)
- – Comprised of data collection, analysis and reports that focus on database sizing, growth, and
+ – Comprised of data collection, analysis, and reports that focus on database sizing, growth, and
trends
- [4.Mailboxes Job Group](/docs/accessanalyzer/11.6/solutions/exchange/mailboxes/overview.md)
– Comprised of data collection, analyses, and reports around mailbox features, logons,
permissions, and sizing
:::warning
- It is not recommended to run this job group at this job group level.
+ It isn't recommended to run this job group at this job group level.
:::
@@ -97,7 +96,7 @@ The following job groups comprise the Exchange Solution:
environment.
- [5. Public Folders Job Group](/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/overview.md)
- – Comprised of data collection, analysis and reports that focus on public folder sizing, content
+ – Comprised of data collection, analysis, and reports that focus on public folder sizing, content
aging, entitlement, ownership, and the identification of each public folder’s Most Probable Owner.
The Most Probable Owner is a unique algorithm built into the public folder data collector that is
determined based on folder ownership, content posted, and size of content posted.
@@ -117,7 +116,7 @@ The following job groups comprise the Exchange Solution:
depends upon multiple job groups.
The MAPI-based data collectors require both Enterprise Auditor MAPI CDO and Microsoft Exchange MAPI
-CDO to be installed on the Enterprise Auditor Console server. Once these have been installed,
+CDO to be installed on the Enterprise Auditor Console server. After these are installed,
configure the **Settings** > **Exchange** node for proper connection to the Exchange server. See the
[Exchange](/docs/accessanalyzer/11.6/admin/settings/exchange.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/content/pf_content.md b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/content/pf_content.md
index d3930cc102..7ded08b17f 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/content/pf_content.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/content/pf_content.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **5. Public Folders*
**PF_Content** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/content/pf_contentscans.md b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/content/pf_contentscans.md
index 87777856f2..c86c45a6ea 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/content/pf_contentscans.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/content/pf_contentscans.md
@@ -34,7 +34,7 @@ View the analysis task by navigating to the **Exchange** > **5. Public Folders**
**Collection** > **PF_ContentScans** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/growthsize/pf_folderscans.md b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/growthsize/pf_folderscans.md
index d32f37e594..197ef28ed3 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/growthsize/pf_folderscans.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/growthsize/pf_folderscans.md
@@ -34,7 +34,7 @@ View the analysis task by navigating to the **Exchange** > **5. Public Folders**
Size** > **Collection** > **PF_FolderScans** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/growthsize/pf_foldersize.md b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/growthsize/pf_foldersize.md
index deb289007f..9e3f910580 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/growthsize/pf_foldersize.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/growthsize/pf_foldersize.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **5. Public Folders*
Size** > **PF_FolderSize** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -41,7 +41,7 @@ The following analysis task clears table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **00. Delete all Historical Data** option. This analysis task is for
+Don't select the **00. Delete all Historical Data** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/overview.md b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/overview.md
index 47250e81e5..6a359cfcbb 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/overview.md
@@ -33,8 +33,8 @@ The following comprise the 5. Public Folders job group:
The **5. Public Folders** > **Ownership** job group uses the ExchangePublicFolder, a MAPI-based data
collector. Therefore, it requires both Enterprise Auditor MAPI CDO and Microsoft Exchange MAPI CDO
-to be installed on the Enterprise Auditor Console server. Once these have been installed, the
-**Settings** > **Exchange** node must be configured for proper connection to the Exchange server.
+to be installed on the Enterprise Auditor Console server. After these are installed, configure the
+**Settings** > **Exchange** node for proper connection to the Exchange server.
See the
[Exchange](/docs/accessanalyzer/11.6/admin/settings/exchange.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/ownership/overview.md b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/ownership/overview.md
index e95b507022..93cceb7b7f 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/ownership/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/ownership/overview.md
@@ -13,7 +13,7 @@ based on folder ownership, content posted, and size of content posted.
-The obs in the Ownership job group are:
+The jobs in the Ownership job group are:
- [Collection > PF_FolderOwnership Job](/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/ownership/pf_folderownership.md)
– Focuses on public folder sizing, content aging, entitlement, ownership, and most importantly the
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/ownership/pf_folderownership.md b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/ownership/pf_folderownership.md
index 8c9cb1a32d..9c0d6141f6 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/ownership/pf_folderownership.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/ownership/pf_folderownership.md
@@ -41,8 +41,8 @@ The following queries are included in the PF_FolderOwnership job:
### Scope the ExchangePublicFolder Data Collector for the PF_FolderOwnership Job
-The ExchangePublicFolder Data Collector can be scoped if desired. Follow the steps to modify the
-query configuration.
+The ExchangePublicFolder Data Collector can be scoped if desired. To modify the
+query configuration:
:::note
These instructions include information on modifying the calculation used to determine
@@ -60,7 +60,7 @@ Properties window opens.
Data Collector Wizard opens.
:::warning
-Do not modify other wizard pages. The wizard pages are pre-configured for this job.
+Don't modify other wizard pages. The wizard pages are pre-configured for this job.
:::
@@ -74,7 +74,7 @@ using the following settings:
- Default Public Folders – Select this option to access folders directly with client
applications such as Microsoft Outlook. In its default configuration, Exchange System Manager
displays these folders when a public folder tree is expanded.
- - System Public Folders – Select this option to access folders that cannot be directly accessed.
+ - System Public Folders – Select this option to access folders that can't be directly accessed.
Client applications, such as Microsoft Outlook, use these folders to store information such as
free and busy data, offline address lists, and organizational forms. Other folders hold
configuration information that is used by custom applications or by Exchange itself. The
@@ -123,7 +123,7 @@ View the analysis task by navigating to the **Exchange** > **5. Public Folders**
**Collection** > **PF_FolderOwnership** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/ownership/pf_owners.md b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/ownership/pf_owners.md
index 580506eff9..7bea2430e1 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/ownership/pf_owners.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/ownership/pf_owners.md
@@ -17,7 +17,7 @@ View the analysis tasks by navigating to the **Exchange** > **5. Public Folders*
**PF_Owners** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/permissions/pf_entitlements.md b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/permissions/pf_entitlements.md
index 85231f9306..33f60c4a22 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/permissions/pf_entitlements.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/permissions/pf_entitlements.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **5. Public Folders*
**Permissions** > **PF_Entitlements** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/permissions/pf_entitlementscans.md b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/permissions/pf_entitlementscans.md
index b392d36055..be9ee757f8 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/permissions/pf_entitlementscans.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/permissions/pf_entitlementscans.md
@@ -35,7 +35,7 @@ View the analysis tasks by navigating to the **Exchange** > **5. Public Folders*
**Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/pf_overview.md b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/pf_overview.md
index 3fe1121c81..e1718e79ad 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/pf_overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/pf_overview.md
@@ -16,7 +16,7 @@ View the analysis tasks by navigating to the **Exchange** > **5. Public Folders*
**PF_Overview** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/recommended.md b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/recommended.md
index 84d3b71fc2..19ee6f3040 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/publicfolders/recommended.md
@@ -42,8 +42,8 @@ list:
individual host at the **Configure** > **Hosts** node
:::note
- The target host should be set to an on-premises Exchange server. Exchange Online is
- not support.
+ The target host should be set to an on-premises Exchange server. Exchange Online
+ isn't supported.
:::
@@ -80,7 +80,7 @@ Run this job group on Fridays at 8:00 PM.
**History Retention**
-History retention should not be enabled on this job group. History is kept through analysis tasks.
+History retention shouldn't be enabled on this job group. Analysis tasks keep the history.
Modify the following analysis task to customize the amount of history which is kept:
| Job Name | Analysis Task Name | Default History |
@@ -111,7 +111,7 @@ deselected. There are some that are deselected by default, as they are for troub
:::
-The following analysis tasks should not be deselected, but their parameters can be modified:
+The following analysis tasks shouldn't be deselected, but their parameters can be modified:
- **Growth and Size** > **PF_FolderSize** Job – **02.SET HISTORY RETENTION** Analysis Task
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/recommended.md b/docs/accessanalyzer/11.6/solutions/exchange/recommended.md
index d68f4e8402..8b4f8817ac 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/recommended.md
@@ -20,9 +20,9 @@ relevant topic for specific information on job group settings and recommended sc
## ExchangePS Data Collector & Client Access Server
-A Client Access Server (CAS) name is required for the ExchangePS Data Collector. When targeting
-Exchange 2013 or 2016, it is possible for the **Settings** > **Exchange** node to have been
-configured with a web address instead of a CAS.
+A Client Access Server (CAS) name is required for the ExchangePS Data Collector. When you target
+Exchange 2013 or 2016, the **Settings** > **Exchange** node might be configured with a web address
+instead of a CAS.
- Exchange 2010 Servers – Uses the CAS server set in the global configuration (**Settings** >
**Exchange** node)
@@ -34,7 +34,7 @@ configured with a web address instead of a CAS.
global configuration has a web address instead of an actual server. Therefore, each query
requires the CAS server to be set as the specific server on the Category page.
-Follow the steps to supply a CAS name for data collection.
+To supply a CAS name for data collection:
**Step 1 –** Navigate to the job’s **Configure** node and select **Queries**.
@@ -45,8 +45,8 @@ opens.
Wizard opens.
:::warning
-Unless otherwise indicated within the job group section, do not make changes to other
-wizard pages as they have been pre-configured for the purpose of the job.
+Unless otherwise indicated within the job group section, don't make changes to other
+wizard pages as they have been pre-configured to support the job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/collection/ex_mailbox_sdd.md b/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/collection/ex_mailbox_sdd.md
index 1648923071..1580603df0 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/collection/ex_mailbox_sdd.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/collection/ex_mailbox_sdd.md
@@ -50,19 +50,19 @@ The following query is included in the EX_Mailbox_SDD job:
The Exchange Sensitive Data Discovery query has been preconfigured to run with the EWSMailbox Data
Collector to scan for sensitive data.
-Follow the steps to configure the scope of the EWSMailbox Data Collector:
+To configure the scope of the EWSMailbox Data Collector:
**Step 1 –** Navigate to the **Exchange** > **7. Sensitive Data** > **0. Collection** >
**EX_Mailbox_SDD** > **Configure** node and select **Queries**.
**Step 2 –** In the Query Selection view, select the **Exchange Sensitive Data Discovery** query and
-click**Query Properties**. The Query Properties window opens.
+click **Query Properties**. The Query Properties window opens.
**Step 3 –** Select the **Data Source** tab, and click **Configure**. The EWS Mailbox Data Collector
Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -78,7 +78,7 @@ topic for additional information.
**Step 5 –** To retrieve available mailboxes, click **Retrieve** on the Scope Select page. Select
-the desired mailboxes and click **Add**. See the
+the mailboxes you want and click **Add**. See the
[EWSMailbox: Scope Select](/docs/accessanalyzer/11.6/admin/datacollector/ewsmailbox/scopeselect.md)
topic for additional information.
@@ -90,7 +90,7 @@ Sensitive data matches can be limited to reduce storage space. See the
topic for additional information.
:::note
-By default, discovered sensitive data strings are not stored in the Enterprise Auditor
+By default, discovered sensitive data strings aren't stored in the Enterprise Auditor
database.
:::
@@ -131,7 +131,7 @@ By default, all categories are selected under sensitive data.
**Step 10 –** Navigate to the Summary page, click **Finish** to save any setting modifications or
-click **Cancel** if no changes were made. Then click **OK** to close the Query Properties window
+click **Cancel** if no changes were made. Then click **OK** to close the Query Properties window.
The job now applies the modification to future job executions.
@@ -141,7 +141,7 @@ View the analysis task by navigating to the **Exchange** > **7.Sensitive Data**
**EX_Mailbox_SDD** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/collection/ex_publicfolder_sdd.md b/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/collection/ex_publicfolder_sdd.md
index 1b02265780..e9711d45a0 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/collection/ex_publicfolder_sdd.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/collection/ex_publicfolder_sdd.md
@@ -51,7 +51,7 @@ The Exchange Sensitive Data Discovery query has been preconfigured to run with t
Data Collector to scan for sensitive data.
**Step 1 –** Navigate to the **Exchange** > **7. Sensitive Data** > **0. Collection** >
-**EX_EWSPublicFolder_SDD** > **Configure** node and select **Queries**.
+**EX_PublicFolder_SDD** > **Configure** node and select **Queries**.
**Step 2 –** In the Query Selection view, select **Exchange Sensitive Data Discovery** and click
**Query Properties**. The Query Properties window opens.
@@ -60,7 +60,7 @@ Data Collector to scan for sensitive data.
Collector Wizard opens.
:::warning
-Do not modify other wizard pages. The wizard pages are pre-configured for this job.
+Don't modify other wizard pages. The wizard pages are pre-configured for this job.
:::
@@ -72,7 +72,7 @@ Sensitive data matches can be limited to reduce storage space. See the
for additional information.
:::note
-By default, discovered sensitive data strings are not stored in the Enterprise Auditor
+By default, discovered sensitive data strings aren't stored in the Enterprise Auditor
database.
:::
@@ -103,7 +103,7 @@ for additional information.
**Step 7 –** To select which properties are gathered based on category, navigate to the Results
-page. See the
+page. See the
[EWSPublicFolder: Results](/docs/accessanalyzer/11.6/admin/datacollector/ewspublicfolder/results.md) topic
for additional information.
@@ -113,6 +113,6 @@ By default, all categories are selected under sensitive data.
**Step 8 –** Navigate to the Summary page, click **Finish** to save any setting modifications or
-click **Cancel** if no changes were made. Then click **OK** to close the Query Properties window
+click **Cancel** if no changes were made. Then click **OK** to close the Query Properties window.
The job applies the modification to future job executions.
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/ex_sddresults.md b/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/ex_sddresults.md
index be4ce48778..83c1c1a45b 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/ex_sddresults.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/ex_sddresults.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **7. Sensitive Data*
**EX_SDDResults** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -25,12 +25,12 @@ preconfigured for this job.
The following analysis tasks are selected by default:
- Mailbox Details – Creates the EX_SDDResults_MailboxDetails table, accessible under the job’s
- Results node. Provides details regarding the number of matches that are found per item in each
+ Results node. Provides details regarding the number of matches found per item in each
mailbox.
- Mailbox Summary – Creates the EX_SDDResults_MailboxSummary table, accessible under the job’s
Results node. Summarizes the items found with matches.
- Public Folder Details – Creates the EX_SDDResults_PublicFolderDetails table, accessible under the
- job’s Result node. Provides details regarding the number of matches that are found per item in
+ job’s Result node. Provides details regarding the number of matches found per item in
each public folder.
- Public Folder Mailstore Summary – Creates the EX_SDDResults_PublicFolderSummary table, accessible
under the job’s Results node. Summarizes the items found with matches.
@@ -41,7 +41,7 @@ The following analysis task deletes table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **Deletes all Stored Data** option. This analysis task is for
+Don't select the **Deletes all Stored Data** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/overview.md b/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/overview.md
index 9aa7434664..f323758c5a 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/overview.md
@@ -24,7 +24,7 @@ These jobs are compatible with the Office 365 environment.
– Contains analyses and reports to provide insight into the types of sensitive data that was
located within Exchange mailboxes and public folders within the environment
-The 7. Sensitive Data job group is comprised of jobs that utilize the EWSMailbox and EWSPublicFolder
+The 7. Sensitive Data job group is comprised of jobs that use the EWSMailbox and EWSPublicFolder
Data Collectors to locate sensitive data found in mailboxes and public folders in the Exchange
environment. It also contains analysis and reporting jobs to order and analyze the data returned by
the queries. See the
diff --git a/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/recommended.md b/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/recommended.md
index aac5d5af2d..9093a6bfca 100644
--- a/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/exchange/sensitivedata/recommended.md
@@ -32,8 +32,8 @@ to be set to run against the version-appropriate default dynamic host list:
- Exchange 2019 MB Servers
:::note
-Default dynamic host lists are populated from hosts in the Host Master Table which meet
-the host inventory criteria for the list. Ensure the appropriate host lists have been populated
+Access Analyzer populates default dynamic host lists from hosts in the Host Master Table
+which meet the host inventory criteria for the list. Ensure the appropriate host lists have been populated
through host inventory results.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/forensics/fs_deletions.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/forensics/fs_deletions.md
index c153f384a5..a5a6fdb014 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/forensics/fs_deletions.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/forensics/fs_deletions.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
**FS_Deletions** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -57,15 +57,14 @@ following pre-configured report:
A Notification analysis task sends email notification to recipients when the job is executed. It
requires the global **Notification** settings to be configured (**Settings** > **Notifications**)
for SMTP server information, but it uses the recipient list provided through the analysis task.
-Follow the steps to configure a notification analysis task.
**Step 1 –** Navigate to the job’s **Configure** node and select **Analysis**.
**Step 2 –** In the Analysis Selection view, select the Notification analysis task and click
-**Analysis Configuration** . The Notification Data Analysis Module wizard opens.
+**Analysis Configuration**. The Notification Data Analysis Module wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -92,7 +91,7 @@ provided. You can use the following options:
-**Step 5 –** In the Message section, edit the **Subject**. It is not recommended to remove any
+**Step 5 –** In the Message section, edit the **Subject**. It isn't recommended to remove any
parameters. Then, customize the email content in the textbox to provide an explanation of the
notification to the recipients.
@@ -105,9 +104,9 @@ automatically during the execution of the job.
:::tip
Remember, all of the analysis tasks should remain in the default order indicated by the numbering.
-Do not deselect any of the SQLscripting analysis tasks.
+Don't deselect any of the SQL scripting analysis tasks.
:::
-Once the Notification analysis task is configured and enabled alerts are sent when the trigger has
-been identified by this job.
+After you configure and enable the Notification analysis task, the job sends alerts when it
+identifies the trigger.
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/forensics/fs_permissionchanges.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/forensics/fs_permissionchanges.md
index 8c8ffd3d89..6fa492abbd 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/forensics/fs_permissionchanges.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/forensics/fs_permissionchanges.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
**FS_PermissionChanges** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/fs_leastprivilegedaccess.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/fs_leastprivilegedaccess.md
index c48da84df8..c3d0a25197 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/fs_leastprivilegedaccess.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/fs_leastprivilegedaccess.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# Least Privileged Access > FS_LeastPrivilegedAccess Job
The FS_LeastPrivilegedAccess job is designed to report on activity event information that can assist
-in identifying least privilege from targeted file servers. It identifies where trustees are not
+in identifying least privilege from targeted file servers. It identifies where trustees aren't
leveraging their permissions to resources from targeted file servers. Requires **Access Auditing**
component data collection.
@@ -21,7 +21,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Access** > **FS_LeastPrivilegedAccess** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -55,4 +55,4 @@ produces the following pre-configured reports:
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Overprovisioning Risk by Share | This report identifies shares with the largest amount of unutilized entitlements and assigns a risk rating to each one. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of two elements: - Pie Chart – Displays shares by overprovisioning risk
- Table – Provides details on shares by overprovisioning risk
|
| Overprovisioning Summary | This report shows the percentage of all entitlements which are being used. An entitlement refers to one user's access to one folder. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of two elements: - Pie Chart – entitlements by level of usage
- Table – Provides details on entitlements
|
-| Remediation | If all members of a group are not using their full access, then modification to group permissions on the share will be suggested here. | None | This report is comprised of one element: - Table – Provides details on recommended changes to permissions
|
+| Remediation | If all members of a group aren't using their full access, this report suggests changes to the group's permissions on the share. | None | This report is comprised of one element: - Table – Provides details on recommended changes to permissions
|
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/security/fs_adminactvity.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/security/fs_adminactvity.md
index 7e43687cc6..c180f8d247 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/security/fs_adminactvity.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/security/fs_adminactvity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
**FS_AdminActivity** > **Configure** node and select Analysis.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -45,4 +45,4 @@ the following pre-configured reports:
| Administrator Activity Details | This report shows the details of administrator activity on file shares. | None | This report is comprised of one element: - Table – Provides details on last 30 days of administrator activity
|
| Administrator Activity Overview | This report identifies the types of actions administrators are performing across your network. | None | This report is comprised of two elements: - Pie Chart – Displays last 30 days of administrator activity
- Table – Provides details on types of actions
|
| Most Active Administrators | This report ranks administrators by number of shares they have activity in. | None | This report is comprised of two elements: - Bar Chart – Displays last 30 days of administrator activity
- Table – Provides details on administrator activity
|
-| Suspicious Admin Activity | This report highlights all administrator reads in shares where they do not have access. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of one element: - Table – Provides details on last 30 days of administrator activity
|
+| Suspicious Admin Activity | This report highlights all administrator reads in shares where they don't have access. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of one element: - Table – Provides details on last 30 days of administrator activity
|
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/security/fs_highriskactivity.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/security/fs_highriskactivity.md
index bf1af5aca1..339d489bbd 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/security/fs_highriskactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/security/fs_highriskactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
**FS_HighRiskActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -37,4 +37,4 @@ produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| High Risk Activity | High Risk Activity is any action performed by a user who has access to a particular resource only through a High Risk Trustee (for example, Everyone, Authenticated Users, or Domain Users). Unless action is taken, these users will lose access once the open access is remediated. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of three elements: - Pie Chart – Displays last 30 days of activity
- Table – Provides details on activity by user
- Table – Provides details on activity by share
|
+| High Risk Activity | High Risk Activity is any action performed by a user who has access to a particular resource only through a High Risk Trustee (for example, Everyone, Authenticated Users, or Domain Users). Unless you take action, these users lose access after you remediate the open access. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of three elements: - Pie Chart – Displays last 30 days of activity
- Table – Provides details on activity by user
- Table – Provides details on activity by share
|
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/security/fs_localuseractivity.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/security/fs_localuseractivity.md
index 1124490e92..c83de26135 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/security/fs_localuseractivity.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/security/fs_localuseractivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
**FS_LocalUserActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_deniedactivity.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_deniedactivity.md
index f02f62f7ed..a1b3db1ebf 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_deniedactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_deniedactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_DeniedActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_highesthourlyactivity.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_highesthourlyactivity.md
index 0cf1b4b4fb..fa48cd833f 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_highesthourlyactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_highesthourlyactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_HighestHourlyActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_hourlyshareactivity.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_hourlyshareactivity.md
index 75963d2589..78668d6bb6 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_hourlyshareactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_hourlyshareactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_HourlyShareActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_modifiedbinaries.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_modifiedbinaries.md
index d2470d0913..59ef1304e3 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_modifiedbinaries.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_modifiedbinaries.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_ModifiedBinaries** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_peergroupactivity.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_peergroupactivity.md
index 859714216a..b1a6f2468c 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_peergroupactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_peergroupactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_PeerGroupActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_ransomware.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_ransomware.md
index e67e79b0c9..a81268bce3 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_ransomware.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_ransomware.md
@@ -8,8 +8,8 @@ sidebar_position: 60
The FS_Ransomware job is comprised of analysis and reports which use the data collected by the
**0.Collection** job group to provide information on periods of time in which users are responsible
-for an abnormally high number of updates. This can be indicative of ransomware. Additionally,
-activity involving files which are known as ransomware artifacts is highlighted.
+for an abnormally high number of updates. This can indicate ransomware. Additionally, the job
+highlights activity involving files known as ransomware artifacts.
## Analysis Tasks for the FS_Ransomeware Job
@@ -17,7 +17,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_Ransomware** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -40,4 +40,4 @@ the following pre-configured reports:
| Report | Description | Default Tags | Report Elements |
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Ransomware Activity | This report summarizes Add or Rename activity involving known ransomware artifacts. | None | This report is comprised of three elements: - Bar Chart – Displays top ransomware patterns
- Table – Provides details on ransomware activity
- Table – Provides summary of ransomware by pattern
|
-| Unusual Write Activity (Ransomware) | This report highlights periods of abnormally high update activity involving shared resources. This can be indicative of ransomware attacks. | None | This report is comprised of two elements: - Bar Chart – Displays abnormal update activity
- Table – Provides details on abnormal update activity
|
+| Unusual Write Activity (Ransomware) | This report highlights periods of abnormally high update activity involving shared resources. This can indicate ransomware attacks. | None | This report is comprised of two elements: - Bar Chart – Displays abnormal update activity
- Table – Provides details on abnormal update activity
|
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_sensitivedataactivity.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_sensitivedataactivity.md
index 454b2ac227..d1786696ed 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_sensitivedataactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_sensitivedataactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_SensitiveDataActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_stalefileactivity.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_stalefileactivity.md
index e223501c46..08ef3c2b7d 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_stalefileactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_stalefileactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_StaleFileActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_usershareactivity.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_usershareactivity.md
index 248d566c7c..7dd54a3a1c 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_usershareactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_usershareactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_UserShareActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_weekendactivity.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_weekendactivity.md
index 81b1f2ddea..f3414bb923 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_weekendactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_weekendactivity.md
@@ -17,7 +17,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_WeekendActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/overview.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/overview.md
index e80d6702a6..9ce27e07a8 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/overview.md
@@ -18,9 +18,9 @@ The Suspicious Activity job group is comprised of:
- Requires **Access Auditing** component data collection
- [FS_HighestHourlyActivity Job](/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_highesthourlyactivity.md)
- – Designed to report on the highest hourly activity event information from targeted file servers
- broken down by user
+- [FS_HighestHourlyActivity Job](/docs/accessanalyzer/11.6/solutions/filesystem/activity/suspiciousactivity/fs_highesthourlyactivity.md)
+ – Designed to report on the highest hourly activity event information from targeted file servers
+ broken down by user
- Includes a Notification analysis task option
- Requires **Access Auditing** component data collection
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_groupusage.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_groupusage.md
index 7393f5073d..ff21d7364a 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_groupusage.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_groupusage.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Statistics** > **FS_GroupUsage** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_mostactiveservers.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_mostactiveservers.md
index 5009e0754a..b4e56b7bb3 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_mostactiveservers.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_mostactiveservers.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Statistics** > **FS_MostActiveServers** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_mostactiveusers.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_mostactiveusers.md
index a9178b28f9..f975661f3a 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_mostactiveusers.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_mostactiveusers.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Statistics** > **FS_MostActiveUsers** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_staleshares.md b/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_staleshares.md
index d374eb8283..abbe860392 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_staleshares.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/activity/usagestatistics/fs_staleshares.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Statistics** > **FS_StaleShares** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/adhocaudits/fs_shareaudit.md b/docs/accessanalyzer/11.6/solutions/filesystem/adhocaudits/fs_shareaudit.md
index 14d65b561f..6120cc48b8 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/adhocaudits/fs_shareaudit.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/adhocaudits/fs_shareaudit.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the FileSystem > Ad Hoc Audits > FS_Sha
node and select Analysis.
:::warning
-Do not modify or deselect the last three selected analysis tasks. The analysis tasks
+Don't modify or deselect the last three selected analysis tasks. The analysis tasks
are preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/adhocaudits/fs_trusteepermissions.md b/docs/accessanalyzer/11.6/solutions/filesystem/adhocaudits/fs_trusteepermissions.md
index dfc918d351..82646514de 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/adhocaudits/fs_trusteepermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/adhocaudits/fs_trusteepermissions.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the FileSystem > Ad Hoc Audits > FS_Tru
Configure node and select Analysis.
:::warning
-Do not modify or deselect the second selected analysis task. The analysis task is
+Don't modify or deselect the second selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -38,4 +38,4 @@ produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ------------------------- | ------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Trustee Permissions Audit | This report provides an overview of the access sprawl across the environment for the select trustee(s). | None | This report is comprised of two elements: - Bar Chart – Displays summary of trustees
- Table – Provides details on trustee permissions
|
+| Trustee Permissions Audit | This report provides an overview of the access sprawl across the environment for the selected trustees. | None | This report is comprised of two elements: - Bar Chart – Displays summary of trustees
- Table – Provides details on trustee permissions
|
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/adhocaudits/overview.md b/docs/accessanalyzer/11.6/solutions/filesystem/adhocaudits/overview.md
index c7b5c12191..93214beb92 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/adhocaudits/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/adhocaudits/overview.md
@@ -9,7 +9,7 @@ sidebar_position: 100
The Ad Hoc Audits Job Group is designed to report on resources and trustees that have been provided
by the user from targeted file servers.
-The Ad Hoc Audits Job Group tables and reports are blank if the CSV file is not modified to contain
+The Ad Hoc Audits Job Group tables and reports are blank if the CSV file isn't modified to contain
the required information before job execution.
:::info
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/delete/fs_deletefiles.md b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/delete/fs_deletefiles.md
index 41461ddc7b..c53c5bd8f4 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/delete/fs_deletefiles.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/delete/fs_deletefiles.md
@@ -11,7 +11,7 @@ previously quarantined and can be deleted.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -30,7 +30,7 @@ Navigate to the **FileSystem** > **Cleanup** > **4. Delete** > **FS_DeleteFiles*
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -64,7 +64,7 @@ Navigate to the **FileSystem** > **Cleanup** > **4. Delete** > **FS_DeleteFiles*
node and select **Actions** to view the action tasks.
:::warning
-Do not enable the action unless it is required. Disable the action after execution to
+Don't enable the action unless it is required. Disable the action after execution to
prevent making unintended and potentially harmful changes to Active Directory.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/delete/fs_deletefiles_status.md b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/delete/fs_deletefiles_status.md
index e73938dce4..3f9ba35104 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/delete/fs_deletefiles_status.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/delete/fs_deletefiles_status.md
@@ -17,7 +17,7 @@ Navigate to the **FileSystem** > **Cleanup** > **4. Delete** > **FS_DeleteFiles_
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/fs_cleanupassessment.md b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/fs_cleanupassessment.md
index 8baf27bf45..2f90c40deb 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/fs_cleanupassessment.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/fs_cleanupassessment.md
@@ -35,7 +35,7 @@ have completed.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -58,7 +58,7 @@ Navigate to the **FileSystem** > **Cleanup** > **1. Cleanup Assessment** >
**FS_CleanupAssessment** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -139,7 +139,7 @@ Data Collector Wizard opens.
the **Collect tags/keywords from file metadata properties** option.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -147,5 +147,5 @@ purpose of this job.
**Step 6 –** Navigate to the **Scoping Queries** page of the File System Access Auditor Data
Collector Wizard and click Finish to save the changes and close the wizard.
-Metadata Tag Information will now be included in the SA_FS_CleanupView table the next time the
-FS_CleanupAssessment job is run.
+The SA_FS_CleanupView table now includes metadata tag information the next time you run the
+FS_CleanupAssessment job.
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/fs_cleanupprogress.md b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/fs_cleanupprogress.md
index bedabf0ee3..da237b7629 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/fs_cleanupprogress.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/fs_cleanupprogress.md
@@ -15,7 +15,7 @@ Navigate to the **FileSystem** > **Cleanup** > **FS_CleanupProgress** > **Config
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/notify/fs_notifyowners.md b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/notify/fs_notifyowners.md
index 5f73ddca06..93518b6132 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/notify/fs_notifyowners.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/notify/fs_notifyowners.md
@@ -16,7 +16,7 @@ Navigate to the **FileSystem** > **Cleanup** > **2. Notify** > **FS_NotifyOwners
node and select **Actions** to view the action tasks.
:::warning
-Do not enable the action unless it is required. Disable the action after execution to
+Don't enable the action unless it is required. Disable the action after execution to
prevent making unintended and potentially harmful changes to Active Directory.
:::
@@ -27,7 +27,7 @@ The following action task is deselected by default.
- Notify Owners – Notifies share owners using SendMail module
-Prior to running the FS_NotifyOwners job, it is necessary to select the **Notify Owners** task and
+Before running the FS_NotifyOwners job, select the **Notify Owners** task and
configure the properties for the SendMail action module. See the
[Configure the FS_NotifyOwners Action](#configure-the-fs_notifyowners-action) topic for additional
information.
@@ -35,21 +35,20 @@ information.
### Configure the FS_NotifyOwners Action
The recipients and the text of the email can be customized on the Properties page within the Send
-Mail Action Module Wizard. The
+Mail Action Module Wizard. You must run the
[1. Cleanup Assessment > FS_CleanupAssessment Job](/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/fs_cleanupassessment.md)
-must be run before the Send Mail Action Module Wizard can be opened. Follow these steps to customize
-the Notify Owners action task.
+before you can open the Send Mail Action Module Wizard.
**Step 1 –** Navigate to the job’s **Configure** node and select **Actions**.
-**Step 2 –** In the Action Selection view, select the desired action task and click **Action
+**Step 2 –** In the Action Selection view, select the action task and click **Action
Properties** to view the Action Properties page.
**Step 3 –** Click **Configure Action** to open the Send Mail Action Module Wizard.
:::tip
-Remember, the FS_CleanupAssessment job must be run before the Send Mail Action Module Wizard can
-be opened.
+Remember, you must run the FS_CleanupAssessment job before you can open the Send Mail Action
+Module Wizard.
:::
@@ -76,5 +75,5 @@ be opened.
click **Cancel** if no changes were made. Then click **OK** to close the Send Mail Action Module
Wizard.
-The action task has been customized. It can now be selected and run as part of the FS_NotifyOwners
+You've now customized the action task. You can select and run it as part of the FS_NotifyOwners
job.
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/notify/fs_notifyowners_status.md b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/notify/fs_notifyowners_status.md
index 4fc0ff3f40..c0e69e669f 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/notify/fs_notifyowners_status.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/notify/fs_notifyowners_status.md
@@ -17,7 +17,7 @@ Navigate to the **FileSystem** > **Cleanup** > **2. Notify** > **FS_NotifyOwners
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/overview.md b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/overview.md
index f39b6ca573..a1a5025871 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/overview.md
@@ -38,8 +38,8 @@ The Cleanup job group includes the following job groups and jobs:
Many jobs in this group include one or more pre-built actions designed to apply operations to the
data tables generated by the job’s analysis tasks. These actions perform the cleanup operations. By
-default, the actions do not execute as part of the job group. You must select the actions you want
-to run prior to execution. See the
+default, the actions don't execute as part of the job group. You must select the actions you want
+to run before execution. See the
[Action Modules](/docs/accessanalyzer/11.6/admin/action/overview.md)
topic for additional information.
@@ -51,7 +51,7 @@ The Cleanup job group has the following recommended configuration settings.
The Cleanup job group has the following prerequisites:
-- Successfully execute the **.Active Directory Inventory** job group prior to running this job group
+- Successfully execute the **.Active Directory Inventory** job group before running this job group
- The **File System Actions** license must be installed
- Successfully execute the **FileSystem** > **0.Collection** job group with the following options
enabled:
@@ -68,7 +68,7 @@ dependencies. See the relevant topic for the job or job group for information ab
**Target Host**
-This job group does not collect data. No target host is required.
+This job group doesn't collect data. No target host is required.
**Schedule Frequency**
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_quarantinedata.md b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_quarantinedata.md
index f82984cfdc..c02c99b014 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_quarantinedata.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_quarantinedata.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# FS_QuarantineData Job
-The FS_QuarantineData job is designed to quarantine files subject to be cleaned up.
+The FS_QuarantineData job is designed to quarantine files that are pending cleanup.
## Action Tasks for the FS_QuarantineData Job
@@ -14,13 +14,13 @@ Navigate to the **FileSystem** > **Cleanup** > **3. Quarantine** > **FS_Quaranti
**Configure** node and select **Actions** to view the action tasks.
:::warning
-Do not enable the actions unless they are required. Disable the actions after execution
+Don't enable the actions unless they are required. Disable the actions after execution
to prevent making unintended and potentially harmful changes to Active Directory.
:::
:::warning
-Do not modify the action tasks. The action tasks are preconfigured for this job.
+Don't modify the action tasks. The action tasks are preconfigured for this job.
:::
@@ -31,5 +31,5 @@ The following action tasks are deselected by default:
- Give domain user full control – Gives a specified domain user full control over stale files
- Break inherited permissions – Breaks inherited permissions
-Prior to running the FS_QuarantineData job, it is necessary to select the **Give domain user full
+Before running the FS_QuarantineData job, select the **Give domain user full
control** or **Break inherited permissions** task to perform an action.
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_quarantinedata_status.md b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_quarantinedata_status.md
index ba9e722f80..823e41b27e 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_quarantinedata_status.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_quarantinedata_status.md
@@ -16,7 +16,7 @@ Navigate to the **FileSystem** > **Cleanup** > **3. Quarantine** > **FS_Quaranti
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance.md b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance.md
index 43838f93de..8e10681951 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance.md
@@ -14,7 +14,7 @@ Navigate to the **FileSystem** > **Cleanup** > **3. Quarantine** > **FS_RestoreI
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -32,13 +32,13 @@ Navigate to the **FileSystem** > **Cleanup** > **3. Quarantine** > **FS_RestoreI
**Configure** node and select **Actions** to view the action tasks.
:::warning
-Do not enable the action unless it is required. Disable the action after execution to
+Don't enable the action unless it is required. Disable the action after execution to
prevent making unintended and potentially harmful changes to Active Directory.
:::
:::warning
-Do not modify the action task. The action task is preconfigured for this job.
+Don't modify the action task. The action task is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance_status.md b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance_status.md
index 471d1e4387..0b7d2ac3ad 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance_status.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance_status.md
@@ -12,11 +12,11 @@ previously quarantined files.
## Analysis Tasks for the FS_RestoreInheritance_Status Job
Navigate to the **FileSystem** > **Cleanup** > **3. Quarantine** >
-**FS_RestoredInheritance_Status** > **Configure** node and select **Analysis** to view the analysis
+**FS_RestoreInheritance_Status** > **Configure** node and select **Analysis** to view the analysis
tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/overview.md b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/overview.md
index 52da5e2ee4..9037f7ae09 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/overview.md
@@ -13,7 +13,7 @@ The 3. Quarantine job group is designed to report on and quarantine files that a
This job group includes the following jobs:
- [FS_QuarantineData Job](/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_quarantinedata.md)
- – Designed to quarantine files subject to be cleaned up
+ – Designed to quarantine files that are pending cleanup
- [FS_QuarantineData_Status Job](/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_quarantinedata_status.md)
– Designed to report on the FS_QuarantineData job
- [FS_RestoreInheritance Job](/docs/accessanalyzer/11.6/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance.md)
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/collection/0-create_schema.md b/docs/accessanalyzer/11.6/solutions/filesystem/collection/0-create_schema.md
index c0ed287ddb..1d64e834d9 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/collection/0-create_schema.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/collection/0-create_schema.md
@@ -8,11 +8,11 @@ sidebar_position: 10
The 0-Create Schema job within the 0.Collection job group creates and updates the schema for the
tables, views, and functions used by the rest of the File System Solution. This job needs to run
-prior to the other jobs in the 0.Collection job group for both new installations and upgrades. The
-job can be scheduled with any of the collections. Do not delete the job from the job tree.
+before the other jobs in the 0.Collection job group for both new installations and upgrades. The
+job can be scheduled with any of the collections. Don't delete the job from the job tree.
:::info
-This job does not need to be moved. Leave it to run as part of the 0.Collection
+This job doesn't need to be moved. Leave it to run as part of the 0.Collection
job group.
:::
@@ -23,7 +23,7 @@ View the analysis task by navigating to the **FileSystem** > **0.Collection** >
Schema** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/collection/0-fs_nasuni.md b/docs/accessanalyzer/11.6/solutions/filesystem/collection/0-fs_nasuni.md
index e8f29fec21..6bb11fdff1 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/collection/0-fs_nasuni.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/collection/0-fs_nasuni.md
@@ -6,23 +6,22 @@ sidebar_position: 30
# 0-FS_Nasuni Job
-The 0-FS_Nasuni job is required in order to target Nasuni Edge Appliances. The job can be added from
+You need the 0-FS_Nasuni job to target Nasuni Edge Appliances. The job can be added from
the Enterprise Auditor Instant Job Library. See the
[Instant Job Wizard](/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md)
topic to add this instant job to the 0.Collection job group.
:::warning
-It is necessary to rename the job after it has been added to the 0.Collection job group
-from **FS_Nasuni** to **0-FS_Nasuni**, so that it runs immediately after the 0-Create Schema job.
+After you add the job to the 0.Collection job group, rename it from **FS_Nasuni** to
+**0-FS_Nasuni** so it runs immediately after the 0-Create Schema job.
:::
:::tip
-Remember, the 0-FS_Nasuni job must be assigned a custom host list containing all on-premise Nasuni
-Edge Appliances and cloud filers, and a custom Connection Profile containing the API Access Key and
-Passcode for each on-premise Nasuni Edge Appliance and cloud filer in the target environment. Nasuni
-API key names are case sensitive. When providing them, ensure they are entered in the exact same
-case as generated.
+Assign the 0-FS_Nasuni job a custom host list containing all on-premise Nasuni Edge Appliances and
+cloud filers, and a custom Connection Profile containing the API Access Key and Passcode for each
+on-premise Nasuni Edge Appliance and cloud filer in the target environment. Nasuni API key names are
+case sensitive. When providing them, ensure they are entered in the exact same case as generated.
:::
@@ -32,7 +31,7 @@ The queries for the 0-FS_Nasuni job use the PowerShell Data collector to gather
volume data, and share data from the Nasuni environment.
:::warning
-Do not modify the queries. The queries are preconfigured for this job.
+Don't modify the queries. The queries are preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/collection/0-fsdfs_system_scans.md b/docs/accessanalyzer/11.6/solutions/filesystem/collection/0-fsdfs_system_scans.md
index 47200ae627..845e016149 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/collection/0-fsdfs_system_scans.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/collection/0-fsdfs_system_scans.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# 0-FSDFS System Scans Job
The 0-FSDFS System Scans job enumerates a list of all root and link targets in the distributed file
-system and creating a dynamic host list that will be used by the components.
+system and creates a dynamic host list used by the components.
## Query for the 0-FSDFS System Scans Job
@@ -15,7 +15,7 @@ The DFS System Scan Query uses the FSAA Data Collector and has been preconfigure
Scan Category.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -29,7 +29,7 @@ View the analysis tasks by navigating to the **FileSystem** > **0.Collection** >
Scans** > **Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-fsaa_system_scans.md b/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-fsaa_system_scans.md
index 411ac5c5b1..d0fea6de76 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-fsaa_system_scans.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-fsaa_system_scans.md
@@ -93,7 +93,7 @@ topic for additional information.
-**Step 8 –** On the Default Scoping Options page, configure the following on the Scan Setting tab:
+**Step 8 –** On the Default Scoping Options page, configure the following on the Scan Settings tab:
- Limit subfolder scan depth to – Select this checkbox and use the arrow buttons to modify the
subfolder scan depth
@@ -105,15 +105,15 @@ topic for additional information.
- Action on failure to enable LAT Preservation – Before scanning each file, FSAA attempts to
enable an operating system feature to preserve the LAT when accessing the file. This operation
- may fail for a variety of reasons, which include but aren't limited to: the operating system
- or file system where the file is located doesn't support LAT preservation, or insufficient
- permissions from the service account trying to access the file. The following configuration
- addresses a failure to enable the LAT preservation mode:
-
- - Continue to scan file silently – FSAA scans the file with the possibility that LAT
- preservation isn't possible. No warning appears.
- - Continue to scan file with warning – FSAA scans the file with the possibility that LAT
- will not be preserved. A warning appears for this file.
+ may fail for a variety of reasons, including: the operating system or file system where the
+ file is located doesn't support LAT preservation, or insufficient permissions from the
+ service account trying to access the file. The following configuration addresses a failure
+ to enable the LAT preservation mode:
+
+ - Continue to scan file silently – FSAA scans the file even if LAT preservation isn't
+ possible. No warning appears.
+ - Continue to scan file with warning – FSAA scans the file even if LAT isn't preserved. A
+ warning appears for this file.
- Skip file silently – FSAA will not scan the file. No warning appears.
- Skip file with warning – FSAA will not scan the file. A warning appears indicating
the file was skipped.
@@ -131,7 +131,7 @@ topic for additional information.
updated for the processed file. A warning appears.
- Force-reset file LAT silently – The scan will reset the file's LAT to its original state
before processing. No warning appears. The scan will proceed to the next file.
- - Force-reset file LAT with warning – The scan will Reset the file's LAT to its original
+ - Force-reset file LAT with warning – The scan will reset the file's LAT to its original
state before processing. A warning appears. The scan will proceed to the next file.
- Abort the scan – FSAA will abort the scan. LAT will be updated for the processed file. No
other files will be processed
@@ -145,6 +145,7 @@ topic for additional information.
**Step 9 –** On the File Details tab of the Default Scoping Options page, you can enable file-level
scans. See the
[File Details Tab](/docs/accessanalyzer/11.6/admin/datacollector/fsaa/defaultscopingoptions/filedetails.md)
+topic for additional information.
:::info
Carefully consider configuring the following settings. Applying filters after you enable
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-fsac_system_scans.md b/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-fsac_system_scans.md
index 27ce8c81e5..975422a667 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-fsac_system_scans.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-fsac_system_scans.md
@@ -57,7 +57,7 @@ purpose of this job.
**Step 4 –** The Applet Settings page applies to the applet and proxy mode scans which you select
-on the Scan Server Level Page. If employing proxy servers, see the
+on the Scan Server Selection page. If employing proxy servers, see the
[FSAA: Applet Settings](/docs/accessanalyzer/11.6/admin/datacollector/fsaa/appletsettings/appletsettings.md)
topic for configuration instructions.
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-seek_system_scans.md b/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-seek_system_scans.md
index e866fb5f9c..360928d132 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-seek_system_scans.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-seek_system_scans.md
@@ -77,7 +77,7 @@ purpose of this job.
**Step 4 –** The Applet Settings page applies to the applet and proxy mode scans which you select
-on the Scan Server Level page. If employing proxy servers, see the
+on the Scan Server Selection page. If employing proxy servers, see the
[FSAA: Applet Settings](/docs/accessanalyzer/11.6/admin/datacollector/fsaa/appletsettings/appletsettings.md)
topic for configuration instructions.
@@ -109,7 +109,7 @@ topic for additional information.
-**Step 8 –** On the Default Scoping Options page, configure the following on the Scan Setting tab:
+**Step 8 –** On the Default Scoping Options page, configure the following on the Scan Settings tab:
- Limit subfolder scan depth to – Select this checkbox and use the arrow buttons to modify the
subfolder scan depth
@@ -122,15 +122,15 @@ topic for additional information.
- Action on failure to enable LAT Preservation – Before scanning each file, FSAA attempts to
enable an operating system feature to preserve the LAT when accessing the file. This operation
- may fail for a variety of reasons, which include but aren't limited to: the operating system
- or file system where the file is located doesn't support LAT preservation, or insufficient
- permissions from the service account trying to access the file. The following configuration
- addresses a failure to enable the LAT preservation mode:
-
- - Continue to scan file silently – FSAA scans the file with the possibility that LAT
- preservation isn't possible. No warning appears.
- - Continue to scan file with warning – FSAA scans the file with the possibility that LAT
- will not be preserved. A warning appears for this file.
+ may fail for a variety of reasons, including: the operating system or file system where the
+ file is located doesn't support LAT preservation, or insufficient permissions from the
+ service account trying to access the file. The following configuration addresses a failure
+ to enable the LAT preservation mode:
+
+ - Continue to scan file silently – FSAA scans the file even if LAT preservation isn't
+ possible. No warning appears.
+ - Continue to scan file with warning – FSAA scans the file even if LAT isn't preserved. A
+ warning appears for this file.
- Skip file silently – FSAA will not scan the file. No warning appears.
- Skip file with warning – FSAA will not scan the file. A warning appears indicating
the file was skipped.
@@ -148,7 +148,7 @@ topic for additional information.
updated for the processed file. A warning appears.
- Force-reset file LAT silently – The scan will reset the file's LAT to its original state
before processing. No warning appears. The scan will proceed to the next file.
- - Force-reset file LAT with warning – The scan will Reset the file's LAT to its original
+ - Force-reset file LAT with warning – The scan will reset the file's LAT to its original
state before processing. A warning appears. The scan will proceed to the next file.
- Abort the scan – FSAA will abort the scan. LAT will be updated for the processed file. No
other files will be processed
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-fsaa_bulk_import.md b/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-fsaa_bulk_import.md
index e8192a15c2..45fde280b4 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-fsaa_bulk_import.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-fsaa_bulk_import.md
@@ -18,7 +18,7 @@ access/permission auditing Bulk import category.
- Bulk import – Imports scan data into SQL Server
- - Typically, this query is not modified. See the
+ - Typically, this query isn't modified. See the
[FileSystemAccess Data Collector](/docs/accessanalyzer/11.6/admin/datacollector/fsaa/overview.md)
topic for information on when this query should be modified.
@@ -28,7 +28,7 @@ View the analysis tasks by navigating to the **FileSystem** > **0.Collection** >
Import** > **Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-fsac_bulk_import.md b/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-fsac_bulk_import.md
index db660acdd9..3aa66ced7b 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-fsac_bulk_import.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-fsac_bulk_import.md
@@ -18,6 +18,6 @@ activity Bulk import category.
- Bulk Import – Imports data into SQL Server
- - Typically this query is not modified. See the
+ - Typically this query isn't modified. See the
[FileSystemAccess Data Collector](/docs/accessanalyzer/11.6/admin/datacollector/fsaa/overview.md)
topic for information on when this query should be modified.
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-seek_bulk_import.md b/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-seek_bulk_import.md
index 7ad0e8df14..b37913cfe6 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-seek_bulk_import.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-seek_bulk_import.md
@@ -18,6 +18,6 @@ data Bulk import category.
- Bulk Import – Imports data into SQL server
- - Typically this query is not modified. See the
+ - Typically this query isn't modified. See the
[FileSystemAccess Data Collector](/docs/accessanalyzer/11.6/admin/datacollector/fsaa/overview.md)
topic for information on when this query should be modified.
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/collection/3-fsaa_exceptions.md b/docs/accessanalyzer/11.6/solutions/filesystem/collection/3-fsaa_exceptions.md
index df8b9dd8ef..7a97fe9cd6 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/collection/3-fsaa_exceptions.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/collection/3-fsaa_exceptions.md
@@ -6,19 +6,19 @@ sidebar_position: 100
# 3-FSAA Exceptions Job
-The 3-FSAA Exceptions job does not use the FSAA Data Collector. Instead it runs analysis on the data
+The 3-FSAA Exceptions job doesn't use the FSAA Data Collector. Instead it runs analysis on the data
returned by the Access Auditing collection jobs to identify potential security concerns.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
The 3-FSAA Exceptions job has the following customizable parameter:
-- Well Known high risk SIDS – Add any additional custom SIDS, but do not remove the default SIDS.
+- Well Known high risk SIDS – Add any additional custom SIDS, but don't remove the default SIDS.
See the
[Analysis Tasks for the 3-FSAA Exceptions Job](#analysis-tasks-for-the-3-fsaa-exceptions-job) topic
@@ -30,8 +30,8 @@ View the analysis tasks by navigating to the **FileSystem** > **0.Collection** >
Exceptions** > **Configure** node and select **Analysis**.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified and or
-deselected. While it is possible to deselect particular tasks as specified, it is not recommended.
+Most of these analysis tasks are preconfigured and shouldn't be modified and/or
+deselected. You can deselect particular tasks as specified, but doing so isn't recommended.
:::
@@ -39,22 +39,22 @@ deselected. While it is possible to deselect particular tasks as specified, it i
The following analysis tasks are selected by default:
-- Open resources – Any folders that are openly accessible through file shares. Can be deselected if
- open resource information is not desired.
+- Open resources – Any folders that are openly accessible through file shares. Deselect this task
+ if you don't need open resource information.
- - Well known high risk SIDS have been set in the `#SIDS` parameter. Do not remove these, but
- additional custom SIDS can be added. See the
+ - The `#SIDS` parameter includes well-known, high-risk SIDS by default. Don't remove these,
+ but you can add custom SIDS. See the
[Configure the Customizable Parameters in an Analysis Task](/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md)
topic for additional information.
-- Disabled users – Any folders where disabled users have been granted access
+- Disabled users – Any folders where disabled users have access
- - Can be deselected if disabled user information is not desired
+ - Deselect this task if you don't need disabled user information
-- Stale users – Any folders where stale users have been granted access. Stale users are user who
- have not logged in for more than 120 days.
+- Stale users – Any folders where stale users have access. Stale users are users who haven't
+ logged in for more than 120 days.
- - Can be deselected if stale user information is not desired
+ - Deselect this task if you don't need stale user information
- Reindex Exception IDs – Displays views within the **Results** node of the Enterprise Auditor
Console
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/collection/3-fsac_exceptions.md b/docs/accessanalyzer/11.6/solutions/filesystem/collection/3-fsac_exceptions.md
index 58e7e58927..5f77a12552 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/collection/3-fsac_exceptions.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/collection/3-fsac_exceptions.md
@@ -10,7 +10,7 @@ The 3-FSAC Exceptions job is designed to analyze collected access information fo
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -25,7 +25,7 @@ View the analysis tasks by navigating to the **FileSystem** > **0.Collection** >
Exceptions** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -44,7 +44,7 @@ The following analysis tasks are selected by default:
- Ransomware – Spikes in updates by user
- Unusual user stale data activity – Spikes in stale data activity by user
-While it is possible to deselect particular tasks as specified, it is not recommended. The following
+You can deselect particular tasks as specified, but doing so isn't recommended. The following
analysis tasks are deselected by default:
- Show view – Displays the SA_FSAC_ExceptionsView within the Results node of the Enterprise Auditor
@@ -54,7 +54,7 @@ analysis tasks are deselected by default:
### Customizable Analysis Tasks for the 3-FSAC Exceptions Job
-Customizable parameters enable users to set the values used for classification during the job’s
+Customizable parameters let you set the values used for classification during the job’s
analysis. The 3-FSAC Exceptions job contains the following customizable parameters:
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/collection/overview.md b/docs/accessanalyzer/11.6/solutions/filesystem/collection/overview.md
index 407a3718e4..000a7dfd00 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/collection/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/collection/overview.md
@@ -24,7 +24,7 @@ The 0.Collection job group has the following collection components:
[File System DFS Auditing](#file-system-dfs-auditing) topic for additional information.
- File System Activity Auditing (FSAC) component – Collects event information logged by the Activity
Monitor. This component requires an additional installer package before data collection will
- occur. It should be run in conjunction with the FSAA component and employs the **1-FSAC System
+ occur. It should run in conjunction with the FSAA component and employs the **1-FSAC System
Scans** job, the **2-FSAC Bulk Import** job, and the **3-FSAC Exceptions** job. See the
[File System Activity Auditing](#file-system-activity-auditing) topic for additional information.
- File System Sensitive Data Discovery Auditing (SEEK) component – Searches file content for
@@ -34,7 +34,7 @@ The 0.Collection job group has the following collection components:
[File System Sensitive Data Discovery Auditing (SEEK)](#file-system-sensitive-data-discovery-auditing-seek)
topic for additional information.
-These jobs are numbered to keep them in the necessary run order. Not all jobs need be run. See the
+Job numbers indicate the required run order. You don't need to run every job. See the
appropriate auditing topic for specific job relationships and recommended workflows. The 0-Create
Schema job ensures the database schema is properly configured for the current version of the data
collector. See the
@@ -47,18 +47,18 @@ considerations:
:::
-- A system scans job executed from a Enterprise Auditor Console must be followed by the
- corresponding bulk import job from the same Enterprise Auditor Console with the same version of
- Enterprise Auditor
-- Two system scans processing the same information, for example two 1-FSAA System Scans jobs, cannot
- be executed consecutively against the same target host. The corresponding bulk import job, for
- example 2-FSAA Bulk Import job, must be executed in between.
+- You must follow a system scans job executed from an Enterprise Auditor Console with the
+ corresponding bulk import job from the same Enterprise Auditor Console and version of Enterprise
+ Auditor
+- Don't execute two system scans jobs that process the same information, for example two 1-FSAA
+ System Scans jobs, consecutively against the same target host. Execute the corresponding bulk
+ import job, for example the 2-FSAA Bulk Import job, in between.
The system scans job collects the data and creates a Tier-2 database, or SQLite database, on the
local host, target host, or proxy host (according to the Applet Gathering Settings configured). The
corresponding bulk import job gathers the information from the Tier-2 database, and pulls it into
the Tier-1 database, or Enterprise Auditor SQL backend database, thus completing the collection
-process. The collection does not include a bulk import job, as it streams the collected data
+process. The collection doesn't include a bulk import job, as it streams the collected data
directly into the Tier-1 database.
## File System Access Auditing
@@ -76,7 +76,7 @@ The 0.Collection jobs that comprise this auditing component are:
- [2-FSAA Bulk Import Job](/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-fsaa_bulk_import.md)
– Imports collected access information from the targeted file servers
- - The 2-FSAA Bulk Import job does not need to be run when streaming is enabled
+ - The 2-FSAA Bulk Import job doesn't need to be run when streaming is enabled
- [3-FSAA Exceptions Job](/docs/accessanalyzer/11.6/solutions/filesystem/collection/3-fsaa_exceptions.md)
– Analyzes collected access information for exceptions
@@ -106,7 +106,7 @@ for additional information.
It is more efficient to streamline the collection jobs to those desired. Remember, it is a best
practice to scope the 0.Collection job group to only include the collection components desired by
disabling the undesired collection jobs. Disabling them allows the solution to run more efficiently.
-It is not recommended to delete any jobs. The required collection jobs are listed for the following
+It isn't recommended to delete any jobs. The required collection jobs are listed for the following
workflow.
**Workflow (for Access Auditing only)**
@@ -117,9 +117,9 @@ The recommended workflow for Access Auditing only is as follows:
**Step 2 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -128,10 +128,10 @@ The recommended workflow for Access Auditing only is as follows:
**Step 3 –** Run the **3-FSAA Exceptions** job.
-**Step 4 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 4 –** Run the applicable analysis and reporting sub-job groups.
:::note
-Please see the
+See the
[Recommended Configuration for the File System Solution](/docs/accessanalyzer/11.6/solutions/filesystem/recommended.md)
topic before continuing with this workflow.
:::
@@ -168,8 +168,9 @@ The 0.Collection jobs that comprise the DFS auditing component are:
namespaces
- When run successfully, the 0-FSDFS System Scans job automatically creates a dynamic host list
- called **DFS HOST LIST**. This is added to the Host Management node. You should assign this
- **DFS HOST LIST** to other 0.Collection jobs as outlined in the recommended workflows below.
+ called **DFS HOST LIST** and adds it to the Host Management node. You should assign this
+ **DFS HOST LIST** to other 0.Collection jobs as outlined in the recommended workflows that
+ follow.
The components depend on data collected by these jobs to collect within a file system using DFS
mappings.
@@ -177,17 +178,16 @@ mappings.
It is more efficient to streamline the collection jobs to those desired. Remember, it is a best
practice to scope the 0.Collection job group to only include the collection components desired by
disabling the undesired collection jobs. Disabling them allows the solution to run more efficiently.
-It is not recommended to delete any jobs. The required collection jobs are listed for each of the
+It isn't recommended to delete any jobs. The required collection jobs are listed for each of the
following optional workflows.
:::warning
-The DFS Auditing component must always be run in conjunction with the Access Auditing
-component. Access audits are necessary to resolve the target shares and folders of DFS link
-destinations.
+Always run the DFS Auditing component in conjunction with the Access Auditing component. Access
+audits resolve the target shares and folders of DFS link destinations.
:::
-**Recommended Workflow 1 (for AccessAuditing with DFS Auditing)**
+**Recommended Workflow 1 (for Access Auditing with DFS Auditing)**
**Step 1 –** Run the **0-FSDFS System Scans** job.
@@ -195,9 +195,9 @@ destinations.
**Step 3 –** If necessary, run the **2-FSAA Bulk Import** job (with the **DFS HOST LIST** assigned):
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -207,9 +207,9 @@ destinations.
**Step 4 –** Run the **3-FSAA Exceptions** job (not specifically needed for DFS Auditing, but
recommended for **0.Collection** job group).
-**Step 5 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 5 –** Run the applicable analysis and reporting sub-job groups.
-Recommended Workflow 2 (for AccessAuditing with DFS Auditing and Activity Auditing)
+Recommended Workflow 2 (for Access Auditing with DFS Auditing and Activity Auditing)
**Step 1 –** Install and configure monitoring with the Activity Monitor for targeted hosts (once
only).
@@ -222,9 +222,9 @@ only).
**Step 5 –** If necessary, run the **2-FSAA Bulk Import** job (with the **DFS HOST LIST** assigned):
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -237,10 +237,10 @@ only).
**Step 8 –** Run the **3-FSAC Exceptions** job.
-**Step 9 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 9 –** Run the applicable analysis and reporting sub-job groups.
-Recommended Workflow 3 (for AccessAuditing with DFS Auditing, Activity, and Sensitive Data Discovery
-Auditing)
+Recommended Workflow 3 (for Access Auditing with DFS Auditing, Activity, and Sensitive Data
+Discovery Auditing)
**Step 1 –** Install the Sensitive Data Discovery Add-On on the Enterprise Auditor Console (once
only).
@@ -258,9 +258,9 @@ only).
**Step 7 –** If necessary, run the **2-FSAA Bulk Import** job (with the **DFS HOST LIST** assigned):
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -271,9 +271,9 @@ only).
**Step 9 –** If necessary, run the **2-SEEK Bulk Import** job (with the **DFS HOST LIST** assigned):
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -285,10 +285,10 @@ only).
**Step 11 –** Run the **3-FSAC Exceptions** job.
-**Step 12 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 12 –** Run the applicable analysis and reporting sub-job groups.
:::note
-Please see the
+See the
[Recommended Configuration for the File System Solution](/docs/accessanalyzer/11.6/solutions/filesystem/recommended.md)
topic before continuing with these workflows.
:::
@@ -308,23 +308,23 @@ specifically incorporated into this component are prefixed with `FSAC`. See the
topic for additional information on the data collected.
:::note
-The Activity Auditing component requires the Activity Monitor be deployed, configured, and
-have services running on the target hosts. See the
+The Activity Auditing component requires the Activity Monitor to be deployed and configured, with
+services running on the target hosts. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor)
for additional information.
:::
-Once the Activity Monitor is installed, the monitored host configuration tells it what to monitor
+After the Activity Monitor is installed, the monitored host configuration tells it what to monitor
and how long to retain the activity log files. The monitoring agent writes one log per day of
activity for the host. Then, the FSAA Data Collector gathers the log files to report on file system
activity for the targeted host. While the Activity Monitor can be configured to create multiple
outputs, Enterprise Auditor can only collect one log file per host. Therefore, after the monitored
-host has been configured, it is necessary to identify the log file for Enterprise Auditor. See the
+host has been configured, identify the log file for Enterprise Auditor. See the
[Identify a Log File](#identify-a-log-file) topic for additional information.
-The data retention period needs to be coordinated between the Activity Monitor and Enterprise
-Auditor. The number of days theActivity Monitor is configured to retain log files must be higher
+You need to coordinate the data retention period between the Activity Monitor and Enterprise
+Auditor. The number of days the Activity Monitor is configured to retain log files must be higher
than the number of days between Activity Auditing scans. The FSAA Data Collector can be customized
on the Activity Settings page of the File System Access Auditor Data Collector Wizard. See the
[Configure the Activity Scan Query](/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-fsac_system_scans.md#configure-the-activity-scan-query)
@@ -367,7 +367,7 @@ for additional information.
It is more efficient to streamline the collection jobs to those desired. Remember, it is a best
practice to scope the 0.Collection job group to only include the collection components desired by
disabling the undesired collection jobs. Disabling them allows the solution to run more efficiently.
-It is not recommended to delete any jobs. The required collection jobs are listed for each of the
+It isn't recommended to delete any jobs. The required collection jobs are listed for each of the
following optional workflows.
**Recommended Workflow 1 (for Access and Activity Auditing)**
@@ -381,9 +381,9 @@ only).
**Step 4 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -396,7 +396,7 @@ only).
**Step 7 –** Run the **3-FSAC Exceptions** job.
-**Step 8 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 8 –** Run the applicable analysis and reporting sub-job groups.
Recommended Workflow 2 (for Access, Activity, and Sensitive Data Discovery Auditing)
@@ -414,9 +414,9 @@ only).
**Step 6 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -427,9 +427,9 @@ only).
**Step 8 –** If necessary, run the **2-SEEK Bulk Import** job:
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -441,7 +441,7 @@ only).
**Step 10 –** Run the **3-FSAC Exceptions** job.
-**Step 11 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 11 –** Run the applicable analysis and reporting sub-job groups.
Recommended Workflow 3 (for Access, Activity, DFS, and Sensitive Data Discovery Auditing)
@@ -461,9 +461,9 @@ only).
**Step 7 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -474,9 +474,9 @@ only).
**Step 9 –** If necessary, run the **2-SEEK Bulk Import** job:
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -488,7 +488,7 @@ only).
**Step 11 –** Run the **3-FSAC Exceptions** job.
-**Step 12 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 12 –** Run the applicable analysis and reporting sub-job groups.
Optional Workflow (for Activity Auditing data collection only )
@@ -504,10 +504,10 @@ only).
**Step 4 –** Run the **3-FSAC Exceptions** job.
-**Step 5 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 5 –** Run the applicable analysis and reporting sub-job groups.
:::note
-Please see the
+See the
[Recommended Configuration for the File System Solution](/docs/accessanalyzer/11.6/solutions/filesystem/recommended.md)
topic before continuing with these workflows.
:::
@@ -517,8 +517,7 @@ topic before continuing with these workflows.
While the Activity Monitor can have multiple configurations per host, Enterprise Auditor can only
read one of them. Therefore, after the Activity Monitor has been configured to monitor a host, it is
-necessary to indicate when that configuration is for Enterprise Auditor. Follow these steps to
-identify the Log file to be read by Enterprise Auditor.
+necessary to indicate when that configuration is for Enterprise Auditor.
**Step 1 –** Within the Activity Monitor Console on the **Monitored Hosts** tab, select the desired
configuration and click **Edit**.
@@ -554,7 +553,7 @@ topic for additional information.
:::
-Customized search criteria can be created with the Criteria Editor accessible through the SDD
+You can create customized search criteria with the Criteria Editor accessible through the SDD
Criteria Settings page of the File System Access Auditor Data Collector Wizard. See the
[Configure the (SEEK) File System Scan Query](/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-seek_system_scans.md#configure-the-seek-file-system-scan-query)
topic for additional information.
@@ -569,14 +568,14 @@ topic for additional information.
**Option to Enable Last Access Timestamp**
-The Last Access Timestamp (LAT) is disabled by default in Windows. This means the LAT does not get
-updated by any applications reading the file. As soon as the LAT feature is enabled in Windows, any
+The Last Access Timestamp (LAT) is disabled by default in Windows. This means applications that
+read the file don't update the LAT. As soon as the LAT feature is enabled in Windows, any
attempt to read file contents updates the LAT. It stores the time of the last read operation.
-Since files are read during the Sensitive Data Discovery Auditing scan,when the feature is enabled
-in Windows the scan causes each file's LAT to update each time the file is scanned. Therefore, there
-is a feature within the job XML file which enables the scan to call a special API in order to keep
-each file's LAT from updating when it's scanned. This feature can be enabled by adding
+Since files are read during the Sensitive Data Discovery Auditing scan, when the feature is enabled
+in Windows the scan causes each file's LAT to update each time the file is scanned. Therefore, the
+job XML file includes a feature that lets the scan call a special API to prevent each file's LAT
+from updating when it's scanned. You can enable this feature by adding the
`` tag to the XML. See the
[1-SEEK System Scans Job](/docs/accessanalyzer/11.6/solutions/filesystem/collection/1-seek_system_scans.md)
topic for additional information and instructions.
@@ -597,7 +596,7 @@ The 0.Collection jobs that comprise this auditing component are:
- [2-SEEK Bulk Import Job](/docs/accessanalyzer/11.6/solutions/filesystem/collection/2-seek_bulk_import.md)
– Imports collected sensitive data information from the targeted file servers
- - The 2-SEEK Bulk Import job does not need to be run when streaming is enabled
+ - The 2-SEEK Bulk Import job doesn't need to be run when streaming is enabled
The following job group and jobs in the File System solution depend on data collected by these jobs
to generate reports:
@@ -615,7 +614,7 @@ for additional information.
It is more efficient to streamline the collection jobs to those desired. Remember, it is a best
practice to scope the 0.Collection job group to only include the collection components desired by
disabling the undesired collection jobs. Disabling them allows the solution to run more efficiently.
-It is not recommended to delete any jobs. The required collection jobs are listed for the following
+It isn't recommended to delete any jobs. The required collection jobs are listed for the following
workflows.
Recommended Workflow 1 (for Access and Sensitive Data Discovery Auditing data collection)
@@ -635,9 +634,9 @@ only).
**Step 4 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -646,9 +645,9 @@ only).
**Step 5 –** If necessary, run the **2-SEEK Bulk Import** job:
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -658,7 +657,7 @@ only).
**Step 6 –** Run the **3-FSAA Exceptions** job.
-**Step 7 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 7 –** Run the applicable analysis and reporting sub-job groups.
Recommended Workflow 2 (for Access, Activity, and Sensitive Data Discovery Auditing)
@@ -676,9 +675,9 @@ only).
**Step 6 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -689,9 +688,9 @@ only).
**Step 8 –** If necessary, run the **2-SEEK Bulk Import** job:
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -703,7 +702,7 @@ only).
**Step 10 –** Run the **3-FSAC Exceptions** job.
-**Step 11 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 11 –** Run the applicable analysis and reporting sub-job groups.
Recommended Workflow 3 (for Access, Activity, DFS, and Sensitive Data Discovery Auditing)
@@ -723,9 +722,9 @@ only).
**Step 7 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -736,9 +735,9 @@ only).
**Step 9 –** If necessary, run the **2-SEEK Bulk Import** job:
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -750,7 +749,7 @@ only).
**Step 11 –** Run the **3-FSAC Exceptions** job.
-**Step 12 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 12 –** Run the applicable analysis and reporting sub-job groups.
Optional Workflow (for Sensitive Data Discovery Auditing data collection only)
@@ -761,9 +760,9 @@ Activity Auditing components.
**Step 2 –** If necessary, run the **2-SEEK Bulk Import** job.
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -771,10 +770,10 @@ Activity Auditing components.
:::
-**Step 3 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 3 –** Run the applicable analysis and reporting sub-job groups.
:::note
-Please see the
+See the
[Recommended Configuration for the File System Solution](/docs/accessanalyzer/11.6/solutions/filesystem/recommended.md)
topic before continuing with these workflows.
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/content/fs_filetypes.md b/docs/accessanalyzer/11.6/solutions/filesystem/content/fs_filetypes.md
index 426993ce0e..1085e10f94 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/content/fs_filetypes.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/content/fs_filetypes.md
@@ -18,7 +18,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_FileTypes** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/content/fs_stalecontent.md b/docs/accessanalyzer/11.6/solutions/filesystem/content/fs_stalecontent.md
index 8c406a9cdb..f60c04298f 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/content/fs_stalecontent.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/content/fs_stalecontent.md
@@ -19,7 +19,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_StaleContent** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/content/sizing/fs_emptyresources.md b/docs/accessanalyzer/11.6/solutions/filesystem/content/sizing/fs_emptyresources.md
index efae10c40c..54fa9b44e1 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/content/sizing/fs_emptyresources.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/content/sizing/fs_emptyresources.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_EmptyResources** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/content/sizing/fs_largestresources.md b/docs/accessanalyzer/11.6/solutions/filesystem/content/sizing/fs_largestresources.md
index e8b35ffb07..57cdd27594 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/content/sizing/fs_largestresources.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/content/sizing/fs_largestresources.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_LargestResources** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/content/sizing/fs_smallestresources.md b/docs/accessanalyzer/11.6/solutions/filesystem/content/sizing/fs_smallestresources.md
index 3f4a457961..5cfd7f0345 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/content/sizing/fs_smallestresources.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/content/sizing/fs_smallestresources.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_SmallestResources** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/fs_aiplabels.md b/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/fs_aiplabels.md
index 6bdaaa1443..7b3a3eaaae 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/fs_aiplabels.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/fs_aiplabels.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# FS_AIPLabels Job
-The FS_AIPLabels job is designed to report on resources classified by AIP labels from targeted file
-servers.
+The FS_AIPLabels job is designed to report on resources classified by Azure Information Protection
+(AIP) labels from targeted file servers.
## Analysis Tasks for the FS_AIPLabels Job
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_AIPLabels** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/fs_filetags.md b/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/fs_filetags.md
index 79365610be..88a3762c8b 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/fs_filetags.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/fs_filetags.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_FileTags** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/overview.md b/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/overview.md
index 31890c0624..d9317bbc8d 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/overview.md
@@ -14,6 +14,7 @@ servers.
The Tags job group is comprised of:
- [FS_AIPLabels Job](/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/fs_aiplabels.md)
- – Designed to report on resources classified by AIP labels from targeted file servers
+ – Designed to report on resources classified by Azure Information Protection (AIP) labels from
+ targeted file servers
- [FS_FileTags Job](/docs/accessanalyzer/11.6/solutions/filesystem/content/tags/fs_filetags.md)
– Designed to report on resources classified with metadata file tags from targeted file servers
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_domainuseracls.md b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_domainuseracls.md
index 02bda80bc8..f53b595580 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_domainuseracls.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_domainuseracls.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_DomainUserACLs** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -34,7 +34,7 @@ The following analysis tasks are selected by default:
- **4. Direct Resources** – Creates an interim processing table in the database for use by downstream
analysis and report generation
-In addition to the tables and views created by the analysis tasks which displays all direct user
+In addition to the tables and views created by the analysis tasks which display all direct user
permissions, the FS_DomainUserACLs job produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_highriskacls.md b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_highriskacls.md
index 21cdc34e65..c9a6f1912a 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_highriskacls.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_highriskacls.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_HighRiskACLs** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_localusersandgroups.md b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_localusersandgroups.md
index cee705aeac..624e85b654 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_localusersandgroups.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_localusersandgroups.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_LocalUsersAndGroups** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_missingfullcontrol.md b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_missingfullcontrol.md
index c9fb31d255..20a7191ced 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_missingfullcontrol.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_missingfullcontrol.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# FS_MissingFullControl Job
The FS_MissingFullControl job is designed to report on resources from targeted file servers that
-have no Full Control rights granted to it.
+have no Full Control rights granted to them.
## Analysis Tasks for the FS_MissingFullControl Job
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_MissingFullControl** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -34,4 +34,4 @@ produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Missing Full Control Rights | This report identifies folders within the environment which currently do not have any trustee with Full Control rights, adding to administrative burden. | None | This report is comprised of three elements: - Bar Chart – Displays shares with missing full control rights
- Table – Provides details on folder
- Table – Provides details on shares with missing full control rights
|
+| Missing Full Control Rights | This report identifies folders within the environment which don't have any trustee with Full Control rights, adding to administrative burden. | None | This report is comprised of three elements: - Bar Chart – Displays shares with missing full control rights
- Table – Provides details on folder
- Table – Provides details on shares with missing full control rights
|
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_nestedshares.md b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_nestedshares.md
index 0b07b59192..7aa7b6a50d 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_nestedshares.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_nestedshares.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# FS_NestedShares Job
-The FS_NestedShares job is is designed to report on nested shares that have been granted direct
+The FS_NestedShares job is designed to report on nested shares that have been granted direct
permissions from targeted file servers.
## Analysis Tasks for the FS_NestedShares Job
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_NestedShares** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_sidhistory.md b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_sidhistory.md
index f5135bcc5a..74e90e5673 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_sidhistory.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_sidhistory.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_SIDHistory** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -39,4 +39,4 @@ the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| -------------------- | ------------------------------------------------------------------------------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SID History Overview | This report identifies any applied ACE which utilizes a trustee's SID history. | None | This report is comprised of three elements: - Bar Chart – Displays the top 5 hosts by affected folders
- Table – Provides details on permissions
- Table – Provides details on trustees
|
+| SID History Overview | This report identifies any applied ACE which uses a trustee's SID history. | None | This report is comprised of three elements: - Bar Chart – Displays the top 5 hosts by affected folders
- Table – Provides details on permissions
- Table – Provides details on trustees
|
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_unresolvedsids.md b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_unresolvedsids.md
index ccbf165bff..8e56c470f2 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_unresolvedsids.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/directpermissions/fs_unresolvedsids.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_UnresolvedSIDs** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/filesystemoverview.md b/docs/accessanalyzer/11.6/solutions/filesystem/filesystemoverview.md
index 1b736d789a..422fb950fc 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/filesystemoverview.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/filesystemoverview.md
@@ -11,8 +11,8 @@ collected by the
[File System Access Auditing](/docs/accessanalyzer/11.6/solutions/filesystem/collection/overview.md#file-system-access-auditing)
components and the components of the
[0.Collection Job Group](/docs/accessanalyzer/11.6/solutions/filesystem/collection/overview.md).
-It also depends on the running of the sub-job groups within the solution. If only select sub-job
-groups have been run, there will be blank sections in the overview report.
+It also depends on running the sub-job groups within the solution. If you run only select sub-job
+groups, the overview report has blank sections.
@@ -25,7 +25,7 @@ View the analysis tasks by navigating to the **FileSystem** > **FileSystemOvervi
node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/fs_brokeninheritance.md b/docs/accessanalyzer/11.6/solutions/filesystem/fs_brokeninheritance.md
index e58445d1a3..6680223e9b 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/fs_brokeninheritance.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/fs_brokeninheritance.md
@@ -15,15 +15,15 @@ The FS_BrokenInheritance job is located in the 3.Broken Inheritance job group.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
The FS_BrokenInheritance job has the following configurable parameter:
-- Only analyze folders with changed permissions – Set a value of `1` or `2` to select if only
- folders with modified permissions are analyzed:
+- Only analyze folders with changed permissions – Set a value of `1` or `2` to select if the job
+ analyzes only folders with modified permissions:
- 1 – Only analyze resources with changed permissions from parent
- 2 – Analyze all resources regardless of permission changes between parent and child
@@ -38,7 +38,7 @@ View the analysis tasks by navigating to the **FileSystem** > **3.Broken Inherit
**FS_BrokenInheritance** > **Configure** node and select **Analysis**.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified and or
+Most of these analysis tasks are preconfigured and shouldn't be modified and/or
deselected. There are some that are deselected by default, as they are for troubleshooting purposes.
:::
@@ -63,7 +63,7 @@ The following analysis tasks are selected by default:
- Can be modified to analyze all resources regardless of permission changes between parent and
child. See the [Parameter Configuration](#parameter-configuration) topic for additional
information.
- - Alternatively, this can be set by modifying the `@FILTER_TO_CHANGED_RESOURCES` parameter. See
+ - Alternatively, you can set this by modifying the `@FILTER_TO_CHANGED_RESOURCES` parameter. See
the
[Configure the Customizable Parameters in an Analysis Task](/docs/accessanalyzer/11.6/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/fs_dlpresults.md b/docs/accessanalyzer/11.6/solutions/filesystem/fs_dlpresults.md
index b0e25a98cb..0378f1015d 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/fs_dlpresults.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/fs_dlpresults.md
@@ -21,7 +21,7 @@ View the analysis tasks by navigating to the **FileSystem** > **7.Sensitive Data
**FS_DLPResults** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -54,4 +54,4 @@ the following pre-configured reports:
| File Ownership (Sensitive Data Ownership) | This report identifies the top 3 potential owners of files which have been found to contain sensitive content. | None | This report is comprised of one element: - Table – Provides details on top owners per file
|
| Sensitive Data Access | This report shows who is accessing sensitive data. Emphasis is placed on activity within the last 30 days. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of two elements: - Bar Chart – Displays sensitive data access by top users
- last 30 days
- Table – Provides details on sensitive data access
|
| Sensitive Security Groups | This report identifies groups which are used to provide access to sensitive data. Changes to membership should be closely monitored. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of two elements: - Bar Chart – Top groups by access to sensitive files
- Table – Provides details on group access to sensitive files
|
-| Share Details (Shares with Sensitive Content) | This report identifies the location of sensitive data, and flags whether or not this data is accessible through open access. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of three elements: - Bar chart – Displays top shares by sensitive file count
- Table – Provides details on files
- Table – Provides details on top shares by sensitive file count
|
+| Share Details (Shares with Sensitive Content) | This report identifies the location of sensitive data, and flags whether this data is accessible through open access. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of three elements: - Bar chart – Displays top shares by sensitive file count
- Table – Provides details on files
- Table – Provides details on top shares by sensitive file count
|
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/fs_openaccess.md b/docs/accessanalyzer/11.6/solutions/filesystem/fs_openaccess.md
index 224f6d0e8a..c6822d32ed 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/fs_openaccess.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/fs_openaccess.md
@@ -7,8 +7,8 @@ sidebar_position: 30
# 1.Open Access > FS_OpenAccess Job
The FS_OpenAccess job is designed to report on Open Access information from targeted file servers.
-The definition of Open Access is when a security principal, such as Everyone, Authenticated Users,
-or Domain Users, have permissions on a resource.
+Open Access means a security principal, such as Everyone, Authenticated Users, or Domain Users, has
+permissions on a resource.
@@ -20,7 +20,7 @@ View the analysis tasks by navigating to the **FileSystem** > **1.Open Access**
**FS_OpenAccess** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/fs_probableowner.md b/docs/accessanalyzer/11.6/solutions/filesystem/fs_probableowner.md
index b78e5f31e5..a7b95b2791 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/fs_probableowner.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/fs_probableowner.md
@@ -22,7 +22,7 @@ View the analysis tasks by navigating to the FileSystem > 6.Probable Owner > FS_
Configure node and select Analysis.
:::warning
-Do not modify or deselect the first and third selected analysis tasks. The analysis
+Don't modify or deselect the first and third selected analysis tasks. The analysis
tasks are preconfigured for this job.
:::
@@ -35,9 +35,9 @@ The following analysis tasks are selected by default:
Probable Owners
- Identify Probable Owners – Creates the SA_FS_ProbableOwner_Details table accessible under the
job’s Results node
- - Set to “Start listing ownership at the root share” which is `@minlevel` parameter set to
+ - Set to “Start listing ownership at the root share” which is the `@minlevel` parameter set to
Value0.
- - Set to “List ownership as deep into the folder hierarchy as the root share” which is
+ - Set to “List ownership as deep into the folder hierarchy as the root share” which is the
`@maxlevel` parameter set to Value0.
- Value0 = root share, Value1 = 1 folder deep, Value2 = 2 folders deep, etc.
- Set the variable #FILTERED_TRUSTEES to a CSV file that contains one row for each SID to be
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/fs_securityassessment.md b/docs/accessanalyzer/11.6/solutions/filesystem/fs_securityassessment.md
index 86007f39d9..9895a4c5a8 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/fs_securityassessment.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/fs_securityassessment.md
@@ -26,12 +26,12 @@ information from targeted file servers. It is dependent upon the following jobs:
- [7.Sensitive Data > FS_DLPResults Job](/docs/accessanalyzer/11.6/solutions/filesystem/fs_dlpresults.md)
-If only select sub-job groups have been run, there are blank sections in the overview report.
+If you run only select sub-job groups, the overview report has blank sections.
The FS_SecurityAssessment job is comprised of analysis and reports which use the data collected by
-the 0.Collection job group and analyzed by the jobs listed above.
+the 0.Collection job group and analyzed by the jobs listed previously.
## Analysis Task for the FS_SecurityAssessment Job
@@ -39,7 +39,7 @@ View the analysis tasks by navigating to the **FileSystem** > **FS_SecurityAsses
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/overview.md b/docs/accessanalyzer/11.6/solutions/filesystem/overview.md
index 7ffce8de05..0da0f34153 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/overview.md
@@ -13,9 +13,9 @@ sensitive data discovery and classification, open access remediation, least-priv
transformation, and file activity monitoring.
File systems and NAS devices contain the vast majority of an organization’s data. Each day, more
-data is created and stored in the nooks and crannies of the environment, beyond the sight of the
-people charged with managing it and keeping it safe. The File System Solution is designed to gather
-information from file systems and shared folders in order to answer questions around data access:
+data is created and stored throughout the environment, often unnoticed by the people responsible
+for managing it and keeping it safe. The File System Solution is designed to gather
+information from file systems and shared folders to answer questions around data access:
- Who has access to your data?
- Who is accessing your data?
@@ -50,14 +50,13 @@ There is a limit of 100 file system hosts that can be scanned simultaneously.
**Sensitive Data Discovery Considerations**
The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
-then an extra 16 GB of RAM are required (8x2=16).
+which enables Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of
+RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job is
+configured to scan 8 hosts at a time, then an extra 16 GB of RAM is required (8x2=16).
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
configuration; it has been preconfigured to work with Enterprise Auditor and should never be
customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
@@ -65,16 +64,15 @@ environment.
:::tip
-Remember, if employing either of the File System Proxy Mode as a Service scan mode options, it is
-also necessary for the Sensitive Data Discovery Add-on to be installed on the server where the proxy
-service is installed.
+Remember, if you use either File System Proxy Mode as a Service scan mode option, you must also
+install the Sensitive Data Discovery Add-on on the server where the proxy service runs.
:::
**Location**
The File System Solution requires a special Enterprise Auditor license. It can be installed from the
-Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to the solution:
+Instant Job Wizard. After it has been installed into the Jobs tree, navigate to the solution:
**Jobs** > **FileSystem**.
The
@@ -97,8 +95,8 @@ information.
The File System Solution offers information on multiple aspects of an organization’s file system
infrastructure. This solution is comprised of eleven job groups and an overview job which collect,
-analyze, and report on data as well as run action tasks for environmental remediation. The data
-collection is conducted by the FileSystemAccess (FSAA) Data Collector. See the
+analyze, and report on data as well as run action tasks for environmental remediation. The
+FileSystemAccess (FSAA) Data Collector collects this data. See the
[Standard Reference Tables & Views for the FSAA Data Collector](/docs/accessanalyzer/11.6/admin/datacollector/fsaa/standardtables.md)
section for database table information.
@@ -111,10 +109,10 @@ exception of the Sensitive Data Discovery Auditing component which can be run in
data collection query options for each type are explained within the 0.Collection Job Group section.
Additionally, the corresponding analysis and reporting job groups are listed for each auditing type.
-If intending to run three or all auditing types, see each auditing type section within the
-0.Collection Job Group section for information on query options and requirements. It is recommended
-to first run the 0.Collection Job Group components in the default order for the desired auditing
-types to ensure successful data collection, and then to run the desired sub-groups for reports.
+If you intend to run three or all auditing types, see each auditing type section within the
+0.Collection Job Group section for information on query options and requirements. First run the
+0.Collection Job Group components in the default order for the auditing types you want to run, to
+ensure successful data collection, and then run the sub-groups you need for reports.
See the
[Recommended Configuration for the File System Solution](/docs/accessanalyzer/11.6/solutions/filesystem/recommended.md)
@@ -164,9 +162,9 @@ of the following jobs:
- [FS_SecurityAssessment Job](/docs/accessanalyzer/11.6/solutions/filesystem/fs_securityassessment.md)
– Designed to provide a security assessment of all relevant information from targeted file servers
-When targeting Nasuni Edge Appliances, it is necessary to add a job from the Instant Job Library
+When targeting Nasuni Edge Appliances, add a job from the Instant Job Library
(FS_Nasuni Job) which uses the PowerShell Data collector to gather system information, volume data,
-and share data from the Nasuni environment. This job should be added to the 0.Collection Job Group
-and should be renamed (0-FS_Nasuni) to run immediately after the 0-Create Schema Job. See the
+and share data from the Nasuni environment. Add this job to the 0.Collection Job Group
+and rename it (0-FS_Nasuni) to run immediately after the 0-Create Schema Job. See the
[0-FS_Nasuni Job](/docs/accessanalyzer/11.6/solutions/filesystem/collection/0-fs_nasuni.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/recommended.md b/docs/accessanalyzer/11.6/solutions/filesystem/recommended.md
index 2b3b1f68f3..1a012b2c0e 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/recommended.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Recommended Configuration for the File System Solution
-The File System Solution has been configured to inherit down from the **FileSystem** > **Settings**
+By default, the File System Solution inherits settings from the **FileSystem** > **Settings**
node for most jobs. However, as a best practice, assign the host list and the Connection Profile at the data collection
level. After you assign these to the job, you can run it manually or schedule it.
@@ -32,8 +32,8 @@ topic for additional information.
**Targeted Hosts**
Assign the host list under the **FileSystem** > **0.Collection** >
-**[job]** > **Host** node. The list should be a custom created list for the file system environments
-to be targeted. Check the box for the custom-created host list. The **…System
+**[job]** > **Host** node. Use a custom list of the file system environments you want to target.
+Check the box for the custom-created host list. The **…System
Scans** jobs and the corresponding **…Bulk Import** jobs must use the same host lists.
The 0-FSDFS System Scans Job is an exception and is set to the Default domain controller. For
@@ -43,7 +43,7 @@ want to scan.
If you target Nasuni Edge Appliances, assign the 0-FS_Nasuni Job a custom host list
containing all on-premise Nasuni Edge Appliances and cloud filers.
-If using multiple proxy servers, these should also be configured within a different custom-created
+If you use multiple proxy servers, configure them within a different custom-created
host list. Then assign the proxy servers host list on the
[FSAA: Applet Settings](/docs/accessanalyzer/11.6/admin/datacollector/fsaa/appletsettings/appletsettings.md)
page of the File System Access Auditor Data Collector Wizard within the following jobs in the
@@ -55,8 +55,8 @@ page of the File System Access Auditor Data Collector Wizard within the followin
Windows clusters have special needs for the host list and host inventory data. You must target the
Windows File Server Cluster (name of the cluster) of interest when running a scan against a Windows
-File System Cluster. Within the Enterprise Auditor Master Host Table, there
-should be a host entry for the cluster as well as for each node. Additionally, each of these host
+File System Cluster. The Enterprise Auditor Master Host Table must include a
+host entry for the cluster as well as for each node. Additionally, each of these host
entries must have the name of the cluster in the WinCluster column in the host inventory data. You
may need to update this manually. See the
[Host Inventory](/docs/accessanalyzer/11.6/admin/settings/hostinventory.md)
@@ -105,10 +105,10 @@ permissions for the assigned hosts, click the radio button for the **Select one
user defined profiles** option and select the appropriate Connection Profile dropdown menu.
:::tip
-Remember, if targeting Nasuni Edge Appliances, the 0-FS_Nasuni Job needs to be assigned a custom
+Remember, if you target Nasuni Edge Appliances, assign the 0-FS_Nasuni Job a custom
Connection Profile containing the **API Access Key** and **Passcode** for each on-premise Nasuni
Edge Appliance and cloud filer in the target environment. Nasuni API key names are case sensitive.
-When providing them, enter them in the exact same case as generated.
+Enter them in the exact case in which they were generated.
:::
@@ -123,26 +123,26 @@ dependent on the size of the target environment. The FileSystem Solution can be
weekly or as desired depending on the types of auditing being conducted and the scope of the target
environment.
-For example, it may be desired in large environments to run Activity Auditing collection jobs on a
-daily basis, but to only run Access Auditing and Sensitive Data Discovery Auditing collection jobs
-on a weekly basis followed by the analysis and reporting job groups.
+For example, in large environments, you might run Activity Auditing collection jobs daily, but run
+Access Auditing and Sensitive Data Discovery Auditing collection jobs only weekly, followed by the
+analysis and reporting job groups.
**Run Order**
-Whatever schedule frequency may be configured, it is also recommended to streamline the collection
-jobs to those desired. The jobs in the 0.Collection Job Group must be run in order for the auditing
+Regardless of the schedule frequency you configure, streamline the collection
+jobs to only those you need. Run the jobs in the 0.Collection Job Group in order for the auditing
type. Run …System Scans jobs and then the corresponding …Bulk Import jobs according to the desired
workflow.
The other File System Solution sub-job groups can be run together or individually in any order,
after running the 0.Collection Job Group. The FileSystemOverview Job pulls information from both the
0.Collection Job Group and the other sub-job groups, and the report may contain blank sections if
-only select sub-job groups are run.
+you run only select sub-job groups.
:::info
-If only conducting one or two types of auditing, scope the solution by disabling
-the undesired collection jobs. Disabling them allows the solution to run more efficiently. It isn't
-recommended to delete any jobs. See the
+If you conduct only one or two types of auditing, scope the solution by disabling
+the undesired collection jobs. Disabling them allows the solution to run more efficiently. Don't
+delete any jobs. See the
[Disable or Enable a Job](/docs/accessanalyzer/11.6/admin/jobs/job/disableenable.md)
topic for additional information.
:::
@@ -178,7 +178,7 @@ customizations include:
- Default Scoping Options page > File Details tab, configure the file detail collection
- By default, file detail scans are disabled
- - Select the type of file data to be collected and optionally add filters
+ - Select the type of file data to collect and optionally add filters
- Set on the following **0.Collection** Job Group jobs:
- **1-FSAA System Scans** Job for Access Auditing
@@ -207,26 +207,24 @@ customizations include:
topic and the
[File System Supported Platforms](/docs/accessanalyzer/11.6/requirements/filesystem/filesystems/filesystems.md)
topic for additional information.
- - Local Mode – All of the data collection processing is conducted by the Enterprise Auditor
- Console server across the network
- - Applet Mode – The File System applet is deployed to the target host when the job is executed
- to conduct data collection. The data is collected on the Windows target host where the applet
- is deployed. The final step in data collection is to compress and transfer the data collected
- in the SQLite databases, or Tier 2 databases, back to the Enterprise Auditor Console server.
- If the target host is a NAS device, the File System scans default to local mode for that host.
- - Proxy Mode with Applet – The File System applet is deployed to the Windows proxy server when
- the job is executed to conduct data collection. The data collection processing is initiated by
- the proxy server where the applet is deployed and uses a local mode-type scan to each of
- the target hosts. The final step in data collection is to compress and transfer the data
- collected in the SQLite databases, or Tier 2 databases, back to the Enterprise Auditor Console
- server.
- - Proxy Mode as a Service – The File System Proxy Service must be installed on the Windows proxy
- servers before executing the scans. The data collection processing is conducted by the proxy
- server where the service is running and uses a local mode-type scan to each of the target
- hosts. The final step in data collection is to compress and transfer the data collected in the
- SQLite databases, or Tier 2 databases, back to the Enterprise Auditor Console server. The
- credential granted rights to interact with the service must be included in the assigned
- Connection Profile.
+ - Local Mode – The Enterprise Auditor Console server conducts all data collection processing
+ across the network
+ - Applet Mode – When the job runs, it deploys the File System applet to the target host to
+ collect data. The applet collects data on the Windows target host where it's deployed. The
+ final step compresses and transfers the collected data in the SQLite databases, or Tier 2
+ databases, back to the Enterprise Auditor Console server. If the target host is a NAS device,
+ the File System scans default to local mode for that host.
+ - Proxy Mode with Applet – When the job runs, it deploys the File System applet to the Windows
+ proxy server to collect data. The proxy server where the applet is deployed initiates data
+ collection processing and uses a local mode-type scan against each target host. The final step
+ compresses and transfers the collected data in the SQLite databases, or Tier 2 databases, back
+ to the Enterprise Auditor Console server.
+ - Proxy Mode as a Service – You must install the File System Proxy Service on the Windows proxy
+ servers before running the scans. The proxy server where the service runs conducts data
+ collection processing and uses a local mode-type scan against each target host. The final step
+ compresses and transfers the collected data in the SQLite databases, or Tier 2 databases, back
+ to the Enterprise Auditor Console server. The assigned Connection Profile must include the
+ credential granted rights to interact with the service.
- Set on the following **0.Collection** Job Group jobs:
- **1-FSAA System Scans** Job for Access Auditing
@@ -266,7 +264,7 @@ Though the analysis tasks shouldn't be deselected, the following parameters can
- The .Active Directory Inventory Solution defines large groups, deeply nested groups, stale users,
and users with large tokens. These parameters can be customized and are applicable to any
- solution, including File System, which incorporate this analyzed data into further analysis.
+ solution, including File System, which incorporates this analyzed data into further analysis.
- Customize within **.Active Directory Inventory** > **3-AD_Exceptions** Job analysis tasks
@@ -306,10 +304,10 @@ within an analysis task.
The jobs contained in the group use custom SQL scripts to render views on collected data. SQL views
populate report element tables and graphs. Changing or modifying the group, job, or
-table names result in no data displayed within the reports or the AIC.
+table names results in no data displayed within the reports or the AIC.
:::tip
-Remember, it is recommended to scope the 0.Collection Job Group to only include the collection
-components desired by disabling the undesired collection jobs. Disabling them allows the solution to
-run more efficiently. It isn't recommended to delete any jobs.
+Remember, scope the 0.Collection Job Group to include only the collection
+components you want by disabling the undesired collection jobs. Disabling them allows the solution to
+run more efficiently. Don't delete any jobs.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroupaicimport.md b/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroupaicimport.md
index d338666a41..fd33e9c308 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroupaicimport.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroupaicimport.md
@@ -6,21 +6,20 @@ sidebar_position: 20
# FS_ResourceBasedGroupAICImport Job
-The FS_ResorceBasedGroupsAICImport Job imports resources and access groups from the
-FS_ResoureBasedGroup Job into the Netwrix Access Information Center. This job assigns ownership in
-the Access Information Center and then assigns resource groups. This step is required if it is
-desired to change access through entitlement reviews, self-service, or for publishing resources to
-IAM.
+The FS_ResourceBasedGroupsAICImport Job imports resources and access groups from the
+FS_ResourceBasedGroups Job into the Netwrix Access Information Center. This job assigns ownership in
+the Access Information Center and then assigns resource groups. This step is required if you want to
+change access through entitlement reviews, self-service, or publishing resources to IAM.
## Recommended Configurations for the FS_ResourceBasedGroupsAICImport Job
**Dependencies**
-- The **FS_ResourceBasedGroups** job must be successfully run prior to running this job
-- The **.Active Directory Inventory** > **1-AD_Scan** job must be successfully run prior to running
+- The **FS_ResourceBasedGroups** job must be successfully run before running this job
+- The **.Active Directory Inventory** > **1-AD_Scan** job must be successfully run before running
this job
- The **File System** > **0.Collection** > **1-FSAA System Scans** job must be successfully run
- prior to running this job
+ before running this job
- The **File System** > **0.Collection** > **2-FSAA Bulk Import** job must be successfully run prior
to running this job
@@ -30,8 +29,8 @@ None
**Schedule Frequency**
-This job group can be scheduled to run as desired. Throughout this document reference to executing a
-job refers to either manual execution or scheduled execution, according to the needs of the
+This job group can be scheduled to run as desired. Throughout this document, executing a
+job refers to either manual execution or scheduled execution, based on the needs of the
organization. See the
[Scheduling the Resource Based Groups Job Group](/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/overview.md#scheduling-the-resource-based-groups-job-group)
topic for additional information.
@@ -63,13 +62,12 @@ Not supported
## Run the FS_ResourceBasedGroupsAICImportJob
Now that the target environment follows a Resource Based Groups model, the new resources can be
-imported into the Access Information Center. Follow the steps to import the new resources into the
-AIC Ownership Workflow.
+imported into the Access Information Center.
:::warning
-It is important to run the .Active Directory Inventory Job Group and **File System** >
-**0. Collection** Job Group again so that the AD and permissions changes are captured by Enterprise
-Auditor.
+Run the .Active Directory Inventory Job Group and **File System** >
+**0. Collection** Job Group again so that Enterprise Auditor captures the AD and permissions
+changes.
:::
@@ -78,8 +76,8 @@ Job Group again.
**Step 2 –** Right click the **FS_ResourceBasedGroupsAICImport** job and select **Run Job**.
-The newly created resource based groups are imported to the AIC. The Owner and Access Groups have
-been assigned to the resources by the import process. The AIC can now be used to manage these
+The import process imports the newly created resource based groups to the AIC and assigns the Owner
+and Access Groups to the resources. The AIC can now be used to manage these
resources through Entitlement Reviews, Ad hoc owner changes, and the Self Service access portal.
## Review the New Resource Based Groups in the AIC
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroups.md b/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroups.md
index 5b161cb094..3abe5e8dc7 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroups.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroups.md
@@ -19,7 +19,7 @@ group implementation.
**Step 3 –** (Optional) Configure a Host List for the job at the job level.
:::note
-If a host list is not configured, this job will analyze and commit actions on every File
+If you don't configure a host list, this job analyzes and commits actions on every File
System server known to Enterprise Auditor. To scope the actions to target specific servers,
configure a host list at the job level to target only those servers.
:::
@@ -31,7 +31,7 @@ configure a host list at the job level to target only those servers.
- Verify that all actions are disabled
:::warning
- Do not make configuration changes to the analysis tasks after reviewing and
+ Don't make configuration changes to the analysis tasks after reviewing and
approving the Change Modeling report
:::
@@ -48,7 +48,7 @@ configure a host list at the job level to target only those servers.
**Step 6 –** Execute File System actions:
-- Allow an appropriate grace period for token refresh prior to executing File System action tasks,
+- Allow an appropriate grace period for token refresh before executing File System action tasks,
for example one week
- Disable the Active Directory action tasks
- Enable the File System action tasks
@@ -70,14 +70,14 @@ based groups. See the
[FS_TraverseGroups Job](/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_traversegroups.md)
topic for additional information.
-**Step 9 –** (Optional) Import resources and access groups from the FS_ResoureBasedGroup Job into
+**Step 9 –** (Optional) Import resources and access groups from the FS_ResourceBasedGroups Job into
the Netwrix Access Information Center. See the
[FS_ResourceBasedGroupAICImport Job](/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroupaicimport.md)
topic for additional information.
## Model Intended Changes
-Prior to executing the actions to apply changes, the proposed changes can be modeled and reviewed to
+Before executing the actions to apply changes, model and review the proposed changes to
determine if the parameters are configured as desired.
### Configure the Analyze Group Permissions Analysis Task
@@ -107,12 +107,12 @@ topic for additional information.
| Analyze Group Permissions | @add_admin_groups | 1 | Add full control admin groups. 1=true. 0=false. |
| Analyze Group Permissions | @admin_groups | | ObjectSIDs of admin groups to add to every share if @add_admin_groups = 1 |
| Analyze Group Permissions | #folders | | List of folders to assign RBG to. Overrides @levels_down. |
-| Analyze Group Permissions | @activity_filter | 1000 | Filter out users with last activity older than X days ago. Will filter out users who have not accessed the folder within the specified threshold. If activity records show the user has never accessed the folder, users will still be included in resource based groups. |
+| Analyze Group Permissions | @activity_filter | 1000 | Filter out users with last activity older than X days ago. This filters out users who have not accessed the folder within the specified threshold. If activity records show the user has never accessed the folder, the user is still included in resource based groups. |
### Execute the Analysis Tasks
Execute the analysis tasks to generate the Change Modeling report and review the proposed changed
-prior to executing the actions to apply the changes.
+before executing the actions to apply the changes.
| Report | Description | Default Tags | Report Elements |
| --------------- | ---------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -127,47 +127,45 @@ implementing the changes:
Access changes occur in the following cases:
-- The user is granted full access, but is not a member of the administrator group specified in the
+- The user is granted full access, but isn't a member of the administrator group specified in the
analysis parameters
- The user is granted less access, but is a member of the administrator group specified in the
analysis parameters
- The user has not used access within the timeframe configured in the analysis parameters
-Follow the steps to model the proposed changes.
-
-**Step 1 –** Make sure all of the analysis tasks are enabled.
+**Step 1 –** Ensure all of the analysis tasks are enabled.
:::warning
-Prior to executing the analysis tasks, make sure that all action tasks are disabled.
+Before executing the analysis tasks, ensure that all action tasks are disabled.
The purpose at this point is only to model the intended changes.
:::
-**Step 2 –** In the Configure node, select **Actions** and make sure that all of the action tasks
+**Step 2 –** In the Configure node, select **Actions** and ensure that all of the action tasks
are disabled.
-**Step 3 –** Right click on the **Resource Based Groups** folder and select **Run Group**. This will
+**Step 3 –** Right click the **Resource Based Groups** folder and select **Run Group**. This will
generate the Change Modeling report.
- Wait for the queued jobs to execute.
**Step 4 –** In the **FS_ResourceBasedGroups** node, navigate to **Results** > **Change Modeling**
-to review the proposed changes prior to executing the actions to apply the changes.
+to review the proposed changes before executing the actions to apply the changes.
-The Change Modeling report has been created for review. Ensure the modeled changes are approved
-before continuing with implementing them.
+The Change Modeling report is now available for review. Ensure the modeled changes are approved
+before you implement them.
## Configure & Execute Active Directory Action Tasks
:::warning
-Do not modify the analysis tasks after the Change Modeling report has been reviewed and
+Don't modify the analysis tasks after the Change Modeling report has been reviewed and
approved. The approved modeled changes are implemented through the execution of the action tasks.
:::
-The Active Directory action tasks create and populate resource based groups. The Create Groups and
-Update Members action tasks must be updated to specify a Target OU for group creation prior to
-enabling and executing the actions. It should also be verified that these action tasks are targeting
+The Active Directory action tasks create and populate resource based groups. You must update the
+Create Groups and Update Members action tasks to specify a Target OU for group creation before you
+enable and execute the actions. Also verify that these action tasks target
the same domain controller.
View the action tasks by navigating to the **Jobs** > **FileSystem** > **Resourced Based Groups** >
@@ -175,12 +173,12 @@ View the action tasks by navigating to the **Jobs** > **FileSystem** > **Resourc
-There are the following two Active Directory action tasks:
+Two Active Directory action tasks are available:
- Create Groups – Creates resource based groups
- Update Members – Adds members to the resource based groups based on permissions
-It is recommended to review the tables used by the actions prior to executing the actions. The
+Review the tables used by the actions before you execute the actions. The
actions act upon the data within the following tables:
- FS_ResourceBasedGroups_GroupsToCreate
@@ -191,8 +189,6 @@ job’s Results node. The FS_ResourceBasedGroups Job will run analysis tasks aga
### Configure & Enable the Create Groups Action Task
-Follow the steps to configure the Create Groups action task.
-
**Step 1 –** Select the action and click **Action Properties**.
**Step 2 –** On the Action Properties page, click **Configure Action**.
@@ -215,8 +211,6 @@ The Create Groups action is configured.
### Configure & Enable the Update Members Action Task
-Follow the steps to configure the Create Groups action task.
-
**Step 1 –** Select the action task and click **Action Properties**.
**Step 2 –** On the Action Properties page, click **Configure Action**.
@@ -240,30 +234,28 @@ The Update Members action is configured.
### Execute Active Directory Action Tasks
-Make sure that the File System actions are deselected and execute the Active Directory action tasks.
+Ensure that the File System actions are deselected, and execute the Active Directory action tasks.
The Create Groups action creates the resource based groups. The Update Members action populates
those groups.
Enabled action tasks can be manually executed at the Actions node. Action tasks can be scheduled
only at the job level.
-Follow the steps to execute the AD actions.
-
:::warning
-Do not modify the analysis tasks after the Change Modeling report has been reviewed and
+Don't modify the analysis tasks after the Change Modeling report has been reviewed and
approved. The approved modeled changes are implemented through the execution of the action tasks.
:::
:::info
-Disable the analysis tasks. It is not necessary to collect the data again.
+Disable the analysis tasks. You don't need to collect the data again.
:::
**Step 1 –** On the Action Selection page, enable the **Create Groups** and **Update Members**
actions.
-**Step 2 –** Right-click on the **Resource Based Groups** folder and select **Run Group**.
+**Step 2 –** Right-click the **Resource Based Groups** folder and select **Run Group**.
- Wait for the queued jobs to execute.
@@ -272,25 +264,25 @@ The resource based groups are created and populated.
## Execute File System Action Tasks
:::warning
-Prior to executing the File System action tasks, allow a grace period, for example one
+Before executing the File System action tasks, allow a grace period, for example one
week. This is important for token refresh to occur as users log off and log on again.
:::
The File System actions modify folder permissions and break inheritance. The Modify Permissions and
-Break Inheritance actions modules do not require any configuration.
+Break Inheritance actions modules don't require any configuration.
View the action tasks by navigating to the **Jobs** > **FileSystem** > **Resourced Based Groups** >
**FS_ResourceBasedGroups** > **Configure** node and select **Actions**.
-There are the following two File System action tasks:
+Two File System action tasks are available:
- Modify Permissions – Modifies folder permissions
- Break Inheritance – Breaks inheritance and remove all previous permissions
-It is recommended to review the tables used by the actions prior to executing the actions. The
+Review the tables used by the actions before you execute the actions. The
actions act upon the data within the following table:
- FS_ResourceBasedGroups_GroupsToCreate
@@ -298,10 +290,8 @@ actions act upon the data within the following table:
The actions populate the Modify Permissions and Break Inheritance tables, which can viewed under the
job’s Results node. The FS_ResourceBasedGroups Job will run analysis tasks against these tables.
-Follow the steps to execute the FS actions.
-
:::warning
-Do not modify the analysis tasks after the Change Modeling report has been reviewed and
+Don't modify the analysis tasks after the Change Modeling report has been reviewed and
approved. The approved modeled changes are implemented through the execution of the action tasks.
:::
@@ -311,7 +301,7 @@ actions.
**Step 2 –** Enable the **Modify Permissions** and **Break Inheritance** actions.
-**Step 3 –** Right-click on the **Resource Based Groups** folder and select **Run Group**.
+**Step 3 –** Right-click the **Resource Based Groups** folder and select **Run Group**.
- Wait for the queued jobs to execute.
@@ -328,15 +318,13 @@ purposes.
| Action History | This report shows all actions taken on each share for audit trail purposes. | None | This report is comprised of one element: - Table – This table provides details on the actions taken on each share
|
-Follow the steps to analyze and report on action history.
-
:::warning
-Disable all of the action tasks prior to generating the Action History report.
+Disable all of the action tasks before generating the Action History report.
:::
**Step 1 –** On the Action Selection page, disable the **Modify Permissions** and **Break
-Inheritance** actions. Make sure all of the action tasks are disabled.
+Inheritance** actions. Ensure all of the action tasks are disabled.
**Step 2 –** On the Analysis Selection page, enable the **Create view for action status** and
**Summarize Access Changes** analysis tasks.
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_traversegroups.md b/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_traversegroups.md
index 0566ae4cc6..42dd6e9521 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_traversegroups.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_traversegroups.md
@@ -6,9 +6,9 @@ sidebar_position: 30
# FS_TraverseGroups Job
-The **FS_TraverseGroups** Job can be used to create and apply permissions for traverse groups based
+Use the **FS_TraverseGroups** Job to create and apply permissions for traverse groups based
on previous resource based groups. This job would be used in the case where the folder to which
-resource based groups permissions are applied is not the root share folder, or at the root of the
+resource based groups permissions are applied isn't the root share folder, or at the root of the
share. This job prevents users from losing the ability to navigate through the directory structure
if the folder is nested. The FS_TraverseGroups Job must be installed from the Instant Job library.
See the
@@ -19,7 +19,7 @@ topic for additional information.
**Dependencies**
-- The **FS_ResourceBasedGroups** job must be successfully run prior to running this job
+- The **FS_ResourceBasedGroups** job must be successfully run before running this job
**Targeted Hosts**
@@ -28,8 +28,8 @@ topic for additional information.
**Schedule Frequency**
-This job can be scheduled to run as desired. Throughout this document reference to executing a job
-refers to either manual execution or scheduled execution, according to the needs of the
+This job can be scheduled to run as desired. Throughout this document, executing a job
+refers to either manual execution or scheduled execution, based on the needs of the
organization. See the
[Scheduling the Resource Based Groups Job Group](/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/overview.md#scheduling-the-resource-based-groups-job-group)
topic for additional information.
@@ -45,7 +45,7 @@ Not supported
**Step 2 –** Configure a Host List for the job at the job level.
:::note
-If a host list is not configured, this job will analyze and commit actions on every File
+If a host list isn't configured, this job will analyze and commit actions on every File
System server known to Enterprise Auditor. To scope the actions to target specific servers,
configure a host list at the job level to target only those servers.
:::
@@ -65,7 +65,7 @@ configure a host list at the job level to target only those servers.
**Step 5 –** Execute File System action task.
-- Allow an appropriate grace period for token refresh prior to executing File System action task,
+- Allow an appropriate grace period for token refresh before executing File System action task,
for example one week
- Disable the Active Directory action task
- Enable the Modify Permissions action task
@@ -81,7 +81,7 @@ configure a host list at the job level to target only those servers.
## Configure & Execute Analysis Tasks
-Prior to executing the action tasks, configure and execute the analysis tasks.
+Before executing the action tasks, configure and execute the analysis tasks.
### Configure the Create Groups Analysis Task
@@ -114,21 +114,21 @@ topic.
### Execute Analysis Tasks
-Once the Create Groups analysis task has been configured, execute the analysis tasks. The analysis
-tasks are selected by default. Follow the steps to execute the analysis tasks.
+After the Create Groups analysis task has been configured, execute the analysis tasks. The analysis
+tasks are selected by default.
-**Step 1 –** Make sure all of the analysis tasks are enabled.
+**Step 1 –** Ensure all of the analysis tasks are enabled.
:::warning
-Prior to executing the analysis tasks, make sure that all action tasks are disabled.
+Before executing the analysis tasks, ensure that all action tasks are disabled.
The purpose at this point is only to create the required traversal tables.
:::
-**Step 2 –** In the Configure node, select **Actions** and make sure that all of the action tasks
+**Step 2 –** In the Configure node, select **Actions** and ensure that all of the action tasks
are disabled.
-**Step 3 –** Right click on the **FS_TraverseGroups** job and select **Run Job**. This will generate
+**Step 3 –** Right click the **FS_TraverseGroups** job and select **Run Job**. This will generate
the Change Modeling report.
- Wait for the queued jobs to execute.
@@ -138,7 +138,7 @@ The analysis tasks create the required traversal tables accessible under the job
## Configure & Execute Active Directory Action Task
The Active Directory action tasks create and populate resource based groups. The Create Groups
-action tasks must be updated to specify a Target OU for group creation prior to enabling and
+action tasks must be updated to specify a Target OU for group creation before enabling and
executing the actions. It should also be verified that the action tasks are targeting the same
domain controller. View the actions by navigating to the place in the Jobs tree where the Traverse
Groups job was installed from the Instant Jobs library. Then go to the **FS_TraverseGroups** >
@@ -146,19 +146,19 @@ Groups job was installed from the Instant Jobs library. Then go to the **FS_Trav
specify the OU for group creation.
:::info
-It is recommended to execute the actions one at a time and in order as opposed to
+Execute the actions one at a time and in order instead of
running the entire job group with the actions enabled.
:::
-There are the following action tasks:
+The following action tasks are available:
- Create Groups – Create groups and add resource based groups
- Modify Permissions – Add list groups
-It is recommended to review the tables used by the actions prior to executing the actions. For
+Review the tables used by the actions before you execute the actions. For
instructions on configuring action tables, see the Configure & Enable the Create Groups Action Task
topic. The actions act upon the data within the following tables:
@@ -170,8 +170,6 @@ tasks against these tables.
### Configure & Enable the Create Groups Action Task
-Follow the steps to configure the Create Groups action task.
-
**Step 1 –** Select the action and click **Action Properties**.
**Step 2 –** On the Action Properties page, click **Configure Action**.
@@ -190,12 +188,11 @@ groups is the same domain controller used in the Update Members action task.
### Execute Active Directory Action Task
The Create Groups action creates the resource based groups. Enabled action tasks can be manually
-executed at the Actions node. Action tasks can be scheduled only at the job level. Follow the steps
-to create the resource based groups.
+executed at the Actions node. Action tasks can be scheduled only at the job level.
**Step 1 –** On the Action Selection page, enable the **Create Groups** action task.
-**Step 2 –** Right-click on the **FS_TraverseGroups** job and select **Run Job**.
+**Step 2 –** Right-click the **FS_TraverseGroups** job and select **Run Job**.
- Wait for the queued job to execute
@@ -203,11 +200,10 @@ The resource based groups are created and populated.
## Execute File System Action Task
-Once the Create Groups action has been executed, the Modify Permissions action can be executed.
-Follow the steps to execute the action.
+After the Create Groups action has been executed, the Modify Permissions action can be executed.
:::warning
-Prior to executing the File System action tasks, allow a grace period, for example one
+Before executing the File System action tasks, allow a grace period, for example one
week. This is important for token refresh to occur as users log off and log on again.
:::
@@ -216,7 +212,7 @@ week. This is important for token refresh to occur as users log off and log on a
**Step 2 –** Enable the **Modify Permissions** action task.
-**Step 3 –** Right-click on the **FS_TraverseGroups** job and select Run Job.
+**Step 3 –** Right-click the **FS_TraverseGroups** job and select Run Job.
- Wait for the queued job to execute.
@@ -233,15 +229,13 @@ environment by the action modules.
| List Traverse Group Changes | This report shows a list of changes made in the environment by the action modules. | None | This report is comprised of one elements: - Table – This table provides details on the changes made to the environment by the action modules
|
- Follow the steps to analyze and report on action history.
-
:::warning
-Disable all of the action tasks prior to generating the List Traverse Group Changes
+Disable all of the action tasks before generating the List Traverse Group Changes
report.
:::
-**Step 1 –** On the Action Selection page, disable the **Modify Permissions** action task. Make sure
+**Step 1 –** On the Action Selection page, disable the **Modify Permissions** action task. Ensure
all of the action tasks are disabled.
**Step 2 –** On the Analysis Selection page, enable the **Create Groups** and both **Show Table**
diff --git a/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/overview.md b/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/overview.md
index 5d890f4df9..b4497ffd98 100644
--- a/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/overview.md
@@ -14,7 +14,7 @@ inheritance.
## Prerequisites
-Action modules are available with a special Enterprise Auditor license. In order to use the Resource
+Action modules are available with a special Enterprise Auditor license. To use the Resource
Based Groups workflow, the following Enterprise Auditor licensing components are required:
- File System Feature
@@ -22,7 +22,7 @@ Based Groups workflow, the following Enterprise Auditor licensing components are
- File System Actions Add-on
- Active Directory Actions Add-on
-The following job groups must be successfully run prior to using this workflow:
+The following job groups must be successfully run before using this workflow:
- .Active Directory Inventory Job Group
- FileSystem > 0.Collection Job Group
@@ -35,7 +35,7 @@ but it can be installed from the Instant Job Wizard.
-Once it has been installed into the Jobs tree, navigate to the solution: **Jobs** > **FileSystem** >
+After it has been installed into the Jobs tree, navigate to the solution: **Jobs** > **FileSystem** >
**Resource Based Groups**.
The FS_TraverseGroups Job and the FS_ResourceBasedGroupsAICImport Job must be installed from the
@@ -53,13 +53,13 @@ based groups model.
The following jobs comprise the Resource Based Groups Job Group:
- [FS_ResourceBasedGroups Job](/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroups.md)
- – This job will transform permission on specified folders to a resource based groups model
+ – This job will transform permissions on specified folders to a resource based groups model
- [FS_TraverseGroups Job](/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_traversegroups.md)
- – (Optional) This job can be used to create and apply permissions for traverse groups based on
- previous resource based groups. The FS_TraverseGroupsJob must be added from the Instant Job
- Library in order to be used.
+ – (Optional) Use this job to create and apply permissions for traverse groups based on
+ previous resource based groups. The FS_TraverseGroups Job must be added from the Instant Job
+ Library to be used.
- [FS_ResourceBasedGroupAICImport Job](/docs/accessanalyzer/11.6/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroupaicimport.md)
- – (Optional) This job imports resources and access groups from the FS_ResoureBasedGroup Job into
+ – (Optional) This job imports resources and access groups from the FS_ResourceBasedGroups Job into
the Netwrix Access Information Center. The FS_ResourceBasedGroupsAICImport Job must be added from
the Instant Job Library to be used.
@@ -67,8 +67,8 @@ The following jobs comprise the Resource Based Groups Job Group:
**Dependencies**
-- The **.Active Directory Inventory** Job Group must be successfully run prior to running this job
-- The **FileSystem** > **0.Collection** Job Group must be successfully run prior to running this job
+- The **.Active Directory Inventory** Job Group must be successfully run before running this job
+- The **FileSystem** > **0.Collection** Job Group must be successfully run before running this job
**Targeted Hosts**
@@ -77,8 +77,8 @@ The following jobs comprise the Resource Based Groups Job Group:
**Schedule Frequency**
-This job group can be scheduled to run as desired. Throughout this document reference to executing a
-job refers to either manual execution or scheduled execution, according to the needs of the
+This job group can be scheduled to run as desired. Throughout this document, executing a
+job refers to either manual execution or scheduled execution, based on the needs of the
organization. See the
[Scheduling the Resource Based Groups Job Group](#scheduling-the-resource-based-groups-job-group)
topic for additional information.
@@ -96,5 +96,5 @@ scheduled for discrete one-time runs so that results may be reviewed after each
[Schedule Jobs](/docs/accessanalyzer/11.6/admin/schedule/overview.md#schedule-jobs)
topic for additional information.
-Throughout this document reference to executing a job refers to either manual execution or scheduled
-execution, according to the needs of the organization.
+Throughout this document, executing a job refers to either manual execution or scheduled
+execution, based on the needs of the organization.
diff --git a/docs/accessanalyzer/11.6/solutions/nisinventory/nis_scan.md b/docs/accessanalyzer/11.6/solutions/nisinventory/nis_scan.md
index ede2fadd82..a1ca86981c 100644
--- a/docs/accessanalyzer/11.6/solutions/nisinventory/nis_scan.md
+++ b/docs/accessanalyzer/11.6/solutions/nisinventory/nis_scan.md
@@ -27,7 +27,7 @@ This query must be modified. See the
### Configure the NIS Scan Query
The NIS Scan job has been preconfigured to run with the default settings with the category of **Scan
-NIS Users and Groups**. However, it is necessary to configure the targeted NIS domain. Follow the
+NIS Users and Groups**. However, you must configure the targeted NIS domain. Follow the
steps to set the target NIS domain and any desired customizations.
**Step 1 –** Navigate to the **.NIS Inventory** > **NIS Scan** > **Configure** node and select
@@ -40,7 +40,7 @@ opens.
opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -48,7 +48,7 @@ purpose of this job.
**Step 4 –** On the NIS Settings page, enter the **NIS Domain Name** for the targeted NIS domain.
-This step is required prior to running this query. See the
+This step is required before running this query. See the
[NIS: NIS Settings](/docs/accessanalyzer/11.6/admin/datacollector/nis/settings.md)
topic for additional information.
@@ -71,7 +71,7 @@ View the analysis tasks by navigating to the **.NIS Inventory** > **NIS Scan** >
and select **Analysis**.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified or
+Most of these analysis tasks are preconfigured and shouldn't be modified or
deselected. There is one that is deselected by default, as it is for troubleshooting purposes.
:::
@@ -84,13 +84,13 @@ The following analysis tasks are selected by default:
- Groups – Enables the SA_NIS_Groups table to be accessible under the job’s Results node
- Members – Enables the SA_NIS_GroupMembersView to be accessible under the job’s Results node
-The following analysis task only needs to be selected when there is a need to remove the tables from
+Select the following analysis task only when you need to remove the tables from
the database:
:::warning
-This analysis task is for troubleshooting and cleanup only. Data will be deleted from
-the database. Do not execute this task with the other analysis tasks, as that results in the
-deletion of data that was just collected.
+This analysis task is for troubleshooting and cleanup only. It deletes data from
+the database. Don't execute this task with the other analysis tasks, as doing so deletes
+data you just collected.
:::
@@ -100,7 +100,7 @@ deletion of data that was just collected.
### Remove NIS Tables
-Sometimes when troubleshooting a NIS Data Collector issue, it becomes necessary to clear the
+When troubleshooting a NIS Data Collector issue, you might need to clear the
standard reference tables. Follow these steps.
**Step 1 –** Navigate to the **.NIS Inventory** > **NIS Scan** > **Configure** node and select
@@ -111,13 +111,13 @@ task.
**Step 3 –** Use the right-click menu on the analysis data grid to **Execute Analyses**.
-**Step 4 –** After the analysis task has completed execution, the tables have been cleared from the
+**Step 4 –** After the analysis task finishes running, the job clears the tables from the
SQL database.
:::warning
-Do not forget to clear the Drop NIS Tables analysis task and reselect all of the other
+Don't forget to clear the Drop NIS Tables analysis task and reselect all of the other
analysis tasks.
:::
-The next time the job is run, the standard reference tables are recreated in the database.
+The next time you run the job, it recreates the standard reference tables in the database.
diff --git a/docs/accessanalyzer/11.6/solutions/nisinventory/overview.md b/docs/accessanalyzer/11.6/solutions/nisinventory/overview.md
index 7dff9d541a..cfabe9e173 100644
--- a/docs/accessanalyzer/11.6/solutions/nisinventory/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/nisinventory/overview.md
@@ -28,12 +28,12 @@ when auditing NFS shares. This information can also be used in the Unix Solution
**Location**
The .NIS Inventory Solution is a core component of all Enterprise Auditor installations. It can be
-installed from the Enterprise Auditor Instant Job Wizard..
+installed from the Enterprise Auditor Instant Job Wizard.
-Once it has been installed into the Jobs tree, navigate to the solution: **Jobs** > **.NIS
-Inventory**. This group has been named in such a way to keep it at the top of the Jobs tree.
+After it has been installed into the Jobs tree, navigate to the solution: **Jobs** > **.NIS
+Inventory**. This group's name keeps it at the top of the Jobs tree.
## NIS Scan Job
diff --git a/docs/accessanalyzer/11.6/solutions/nisinventory/recommended.md b/docs/accessanalyzer/11.6/solutions/nisinventory/recommended.md
index 11407fa417..8cbe7bbf35 100644
--- a/docs/accessanalyzer/11.6/solutions/nisinventory/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/nisinventory/recommended.md
@@ -11,11 +11,11 @@ directly or scheduled.
**Dependencies**
-This job group does not have dependencies.
+This job group doesn't have dependencies.
**Targeted Hosts**
-The host list assignment should be assigned under the **.NIS Inventory** > **NIS Scan** > **Hosts**
+Assign the host list under the **.NIS Inventory** > **NIS Scan** > **Hosts**
node. Select the custom host list containing the NIS servers or manually add the host in the
**Individual hosts** section. See the
[Unix Connection Profile & Host List](/docs/accessanalyzer/11.6/admin/datacollector/nis/configurejob.md)
@@ -25,7 +25,7 @@ topic for additional information.
The Connection Profile should be assigned in the **.NIS Inventory** > **NIS Scan** > **Job
Properties** window on the **Connection** tab. It is set to **Use the Default Profile**, as
-configured at the global settings level. However, if this is not the Connection Profile with the
+configured at the global settings level. However, if this isn't the Connection Profile with the
necessary permissions for targeting the NIS servers, select the **Select one of the following user
defined profiles** option and select the appropriate Connection Profile. See the
[Unix Connection Profile & Host List](/docs/accessanalyzer/11.6/admin/datacollector/nis/configurejob.md)
@@ -33,8 +33,8 @@ topic for additional information.
**Schedule Frequency**
-It is recommended to schedule the .NIS Inventory job group to run once a day. If there are frequent
-changes within the target environment, then it can be executed more often. It is best to rerun it
+Schedule the .NIS Inventory job group to run once a day. If the target environment changes
+frequently, you can run it more often. It is best to rerun it
anytime changes might have occurred.
**Run at the Solution Level**
@@ -43,9 +43,9 @@ The job in the .NIS Inventory job group can be run at either the job or job grou
**Query Configuration**
-The solution requires the NIS domain to be configured in the **Inventory Scan** query. Navigate to
-the **NIS Settings** page of the NIS Data Collector Wizard. Optionally, modifications can be made
-for SID mappings within the **NIS Scan** job. See the
+The solution requires you to configure the NIS domain in the **Inventory Scan** query. Navigate to
+the **NIS Settings** page of the NIS Data Collector Wizard. Optionally, modify SID mappings within
+the **NIS Scan** job. See the
[NIS Scan Job](/docs/accessanalyzer/11.6/solutions/nisinventory/nis_scan.md) topic
for additional information.
@@ -56,11 +56,11 @@ analysis task is deselected by default, as it is for troubleshooting purposes on
**History Retention**
-History retention is not supported and should be turned off.
+History retention isn't supported. Turn it off.
**Multi-console Support**
-Multi-console is not supported.
+Multi-console isn't supported.
**Workflow**
diff --git a/docs/accessanalyzer/11.6/solutions/overview.md b/docs/accessanalyzer/11.6/solutions/overview.md
index 41a5e74183..ff63262069 100644
--- a/docs/accessanalyzer/11.6/solutions/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# Solutions
-The predefined job groups and jobs for the various Enterprise Auditor solutions can be found within
-the Enterprise Auditor Instant Job Library, according to the license owned by the organization.
+The Enterprise Auditor Instant Job Library contains the predefined job groups and jobs for the
+various Enterprise Auditor solutions, according to the license owned by the organization.
## Understanding Instant Solutions
@@ -19,16 +19,16 @@ These solutions are broken down by the top-level job group that comprises the so
| .Entra ID Inventory | The .Entra ID Inventory Solution is designed to inventory, analyze, and report on Microsoft Entra ID. It provides essential user and group membership details to the Entra ID Solution. Key information includes managers, email addresses, and direct memberships. Collected data helps an organization identify toxic conditions like nested groups, circular nesting, disabled users, and duplicate groups. The user and group information assists with understanding probable group ownership, group memberships, largest groups, user status, attribute completion, and synchronization status between on-premises Active Directory and Microsoft Entra ID.
**Core Solution** |
| .NIS Inventory | The .NIS Inventory Solution is designed to provide essential user and group membership information from a NIS domain, mapping these principals to Windows-style SIDs. This provides valuable information to the File Systems Solution when auditing NFS shares.
**Core Solution** |
| Active Directory | The Active Directory Solution is designed to provide the information every administrator needs regarding Active Directory configuration, operational management, troubleshooting, analyzing effective permissions, and tracking who is making what changes within your organization.
**Requires Active Directory Licensed Feature** |
-| Active Directory Permissions Analyzer | The Active Directory Permissions Analyzer Solution is designed to easily and automatically determine effective permissions applied to any and all Active Directory objects, at any scope, allowing for the most authoritative view available of who has access to what in Active Directory.
**Requires Active Directory Permissions Analyzer Licensed Feature** |
-| AnyID Connectors | The AnyID Connectors Solution allows you to quickly find where data for identities are stored, reducing the response time to Data Subject Access Requests (DSARs). Integration with third party repositories allows you to perform exact data matching for profiles such as employees, customers, students, or patients across any data repository. |
+| Active Directory Permissions Analyzer | The Active Directory Permissions Analyzer Solution is designed to automatically determine effective permissions applied to any and all Active Directory objects, at any scope, allowing for the most authoritative view available of who has access to what in Active Directory.
**Requires Active Directory Permissions Analyzer Licensed Feature** |
+| AnyID Connectors | Use the AnyID Connectors Solution to quickly find where data for identities is stored, reducing the response time to Data Subject Access Requests (DSARs). Integration with third-party repositories enables exact data matching for profiles such as employees, customers, students, or patients across any data repository. |
| Amazon Web Services | Enterprise Auditor for AWS allows organizations to secure their data residing in Amazon Web Services (AWS) S3 platform, reducing their risk exposure through proactive, automated auditing and reporting of S3 permissions, sensitive data, and ultimately a consolidated view of user access rights across dozens of structured and unstructured data resources both on-premises and in the cloud. |
-| Box | The Box solution set contains jobs to provide visibility into Box access rights, policies, configurations, activities, and more, ensuring you never lose sight or control of your critical assets residing in Box.
**Requires Box Collection Licensed Feature** |
-| Databases | Enterprise Auditor Databases Solution Set is a comprehensive set of pre-configured audit jobs and reports that provide visibility into various aspects of supported databases. - Azure SQL – The Azure SQL Solution Set is a comprehensive set of pre-configured audit jobs and reports that provide visibility into various aspects of Azure SQL : Users and Roles, Sensitive Data Discovery, Object Permissions, Configuration, and User Activity.
- Db2 – The Db2 Solution Set is a comprehensive set of pre-configured audit jobs and reports that provides visibility into various aspects of a Db2 Databases: Sensitive Data Discovery and Object Permissions.
- Instance Discovery – The Instance Discovery Solution discovers instances on supported database servers.
- MongoDB Solution – The MongoDB Solution automates the process of understanding where MongDB databases exist and provides an overview of the MongoDB environment in order to answer questions around data access. With visibility into every corner of MongoDB and the operating system it relies upon, organizations can proactively highlight and prioritize risks to sensitive data. Additionally, organizations can automate manual, time-consuming, and expensive processes associated with compliance, security, and operations to easily adhere to best practices that keep MongoDB Server safe and operational.
- MySQL Solution – The MySQL Solution automates the process of understanding where SQL databases exist and provides an overview of the MySQL environment in order to answer questions around data access. With visibility into every corner of Microsoft SQL Server and the Windows operating system it relies upon, organizations can proactively highlight and prioritize risks to sensitive data. Additionally, organizations can automate manual, time-consuming, and expensive processes associated with compliance, security, and operations to easily adhere to best practices that keep SQL Server safe and operational.
- Oracle Solution – The Oracle Solution delivers comprehensive permissions, activity, and sensitive data auditing and reporting for Oracle databases. Through the power of Enterprise Auditor, users can automate Oracle instance discovery, understand who has access to their Oracle databases, the level of permission they have, and who is leveraging their access privileges, identify the location of sensitive information, measure adherence to best practices, and generate workflows and reports to satisfy security, compliance, and operational requirements.
- PostgreSQL Solution – Enterprise Auditor PostgreSQL Solution Set is a set of pre-configured audit jobs and reports that provides visibility into PostgreSQL Sensitive Data.
- Redshift – Enterprise Auditor Redshift Solution Set is a set of pre-configured audit jobs and reports that provides visibility into Redshift Sensitive Data.
- SQL Solution – The SQL Solution is an auditing, compliance, and governance solution for Microsoft SQL Server database. Key capabilities include effective access calculation, sensitive data discovery, security configuration assessment, and database activity monitoring.
**Requires SQL Licensed Feature** |
+| Box | The Box solution set contains jobs to provide visibility into Box access rights, policies, configurations, activities, and more, so you always have visibility and control over your critical assets in Box.
**Requires Box Collection Licensed Feature** |
+| Databases | Enterprise Auditor Databases Solution Set is a comprehensive set of pre-configured audit jobs and reports that provide visibility into various aspects of supported databases. - Azure SQL – The Azure SQL Solution Set is a comprehensive set of pre-configured audit jobs and reports that provide visibility into various aspects of Azure SQL : Users and Roles, Sensitive Data Discovery, Object Permissions, Configuration, and User Activity.
- Db2 – The Db2 Solution Set is a comprehensive set of pre-configured audit jobs and reports that provides visibility into various aspects of a Db2 Databases: Sensitive Data Discovery and Object Permissions.
- Instance Discovery – The Instance Discovery Solution discovers instances on supported database servers.
- MongoDB Solution – The MongoDB Solution automates the process of understanding where MongDB databases exist and provides an overview of the MongoDB environment to answer questions around data access. With full visibility into MongoDB and the operating system it relies upon, organizations can proactively highlight and prioritize risks to sensitive data. Additionally, organizations can automate manual, time-consuming, and expensive processes associated with compliance, security, and operations to adhere to best practices that keep MongoDB Server safe and operational.
- MySQL Solution – The MySQL Solution automates the process of understanding where MySQL databases exist and provides an overview of the MySQL environment to answer questions around data access. With full visibility into MySQL and the operating system it relies upon, organizations can proactively highlight and prioritize risks to sensitive data. Additionally, organizations can automate manual, time-consuming, and expensive processes associated with compliance, security, and operations to adhere to best practices that keep MySQL safe and operational.
- Oracle Solution – The Oracle Solution delivers comprehensive permissions, activity, and sensitive data auditing and reporting for Oracle databases. Through the power of Enterprise Auditor, users can automate Oracle instance discovery, understand who has access to their Oracle databases, the level of permission they have, and who is leveraging their access privileges, identify the location of sensitive information, measure adherence to best practices, and generate workflows and reports to satisfy security, compliance, and operational requirements.
- PostgreSQL Solution – Enterprise Auditor PostgreSQL Solution Set is a set of pre-configured audit jobs and reports that provides visibility into PostgreSQL Sensitive Data.
- Redshift – Enterprise Auditor Redshift Solution Set is a set of pre-configured audit jobs and reports that provides visibility into Redshift Sensitive Data.
- SQL Solution – The SQL Solution is an auditing, compliance, and governance solution for Microsoft SQL Server database. Key capabilities include effective access calculation, sensitive data discovery, security configuration assessment, and database activity monitoring.
**Requires SQL Licensed Feature** |
| Dropbox | The Dropbox Solution is an auditing, compliance, and governance solution for Dropbox for Business. Key capabilities include effective access calculation, sensitive data discovery, file content inspection, inactive access and stale data identification, and entitlement collection for integration with Identity & Access Management (IAM) processes. \*Requires Dropbox Collection Licensed Feature |
| Entra ID | The Entra ID Solution is a comprehensive set of audit jobs and reports that provide the information regarding Microsoft Entra ID configuration, operational management, and troubleshooting. The jobs within this group help pinpoint potential areas of administrative and security concerns related to Microsoft Entra ID users and groups, including syncing with on-premises Active Directory.
**Requires Entra ID Licensed Feature** |
| Exchange | The Exchange Solution provides auditing and reporting on multiple aspects of the Exchange environment to assist with identifying risk, understanding usage, and decreasing bloat. Areas of focus include Audit and Compliance, Maintenance and Cleanup, Metrics and Capacity, Operations and Health, Public Folders and Configuration Baseline.
**Requires Exchange Licensed Feature** |
| FileSystem | The File Systems Solution is an auditing, compliance, and governance solution for Windows, NAS, Unix, and Linux file systems. Key capabilities include effective access calculation, data owner identification, governance workflows including entitlement reviews and self-service access requests, sensitive data discovery and classification, open access remediation, least-privilege access transformation, and file activity monitoring.
**Requires File System Reports Licensed Feature** |
| SharePoint | The SharePoint Solution is a comprehensive set of audit jobs and reports which provide the information every administrator needs regarding SharePoint on-premises and SharePoint Online infrastructure, configuration, performance, permissions, required ports, and effective rights.
**Requires SharePoint Reports Licensed Feature** |
-| Unix | The Unix Solution reports on areas of administrative concern for Unix and Linux systems. Attention is given to users and group details, privileged access rights, and NFS and Samba sharing configurations.
**Requires Unix Licensed Feature** |
+| Unix | The Unix Solution reports on areas of administrative concern for Unix and Linux systems. The solution focuses on user and group details, privileged access rights, and NFS and Samba sharing configurations.
**Requires Unix Licensed Feature** |
| Windows | The Windows Solution allows organizations to quickly inventory, assess, and secure their Windows desktop and server infrastructure from a central location. Key capabilities include privileged account discovery, security configuration and vulnerability assessment, compliance reporting, and asset inventory. |
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/overview.md b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/overview.md
index a2b497d6f3..da7713583b 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/overview.md
@@ -20,4 +20,4 @@ The jobs in the Forensics Job Group are:
the past 30 days
- [SP_SensitiveDataActivity Job](/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/sp_sensitivedataactivity.md)
– Highlights user activity involving sensitive data and provides details on who is interacting
- with your environments sensitive content
+ with your environment's sensitive content
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/sp_deletions.md b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/sp_deletions.md
index 6b0c1bc857..d46cdcff58 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/sp_deletions.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/sp_deletions.md
@@ -14,7 +14,7 @@ Navigate to the **Jobs** > **SharePoint** > **7.Activity** > **Forensics** > **S
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -26,7 +26,7 @@ The default analysis task is:
- Analyze SPAC Deletion Events – Creates the SA_SPAC_Deletions_Last30Days table accessible under the
job’s Results node
-In addition to the tables and views created by the analysis tasks, the SQL_Deletions Job produces
+In addition to the tables and views created by the analysis tasks, the SP_Deletions Job produces
the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/sp_permissionchanges.md b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/sp_permissionchanges.md
index d5b4d88ac4..7f00b378df 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/sp_permissionchanges.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/sp_permissionchanges.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **7.Activity** > **Forensics** >
**SP_PermissionChanges** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -29,9 +29,9 @@ The default analysis tasks are:
- Permission Changes Counts – Creates the SA_SP_PermissionChanges_Counts table accessible under the
job’s Results node
-In addition to the tables and views created by the analysis tasks, the SQL_PermissionChanges Job
+In addition to the tables and views created by the analysis tasks, the SP_PermissionChanges Job
produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Permission Changes | This report identifies SharePoint permission changes based on activity events and determines whether or not that permission change is considered a high security risk. | None | This report is comprised of two elements: - Bar Chart – Displays permission change activity in the past seven days
- Table – Provides permission change details
|
+| Permission Changes | This report identifies SharePoint permission changes based on activity events and determines whether that permission change is considered a high security risk. | None | This report is comprised of two elements: - Bar Chart – Displays permission change activity in the past seven days
- Table – Provides permission change details
|
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/sp_sensitivedataactivity.md b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/sp_sensitivedataactivity.md
index 8f38c9e434..a89f146d95 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/sp_sensitivedataactivity.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/sp_sensitivedataactivity.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# SP_SensitiveDataActivity Job
This job highlights user activity involving sensitive data and provides details on who is
-interacting with your environments sensitive content.
+interacting with your environment's sensitive content.
## Analysis Tasks for the SP_SensitiveDataActivity Job
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **SharePoint** > **7.Activity** > **Forensics** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -30,9 +30,9 @@ The default analysis tasks are:
- Sensitive Data Activity User Count – Creates an interim processing table in the database for use
by downstream analysis and report generation
-In addition to the tables and views created by the analysis tasks, the SQL_SensitiveDataActivity Job
+In addition to the tables and views created by the analysis tasks, the SP_SensitiveDataActivity Job
produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ----------------------- | -------------------------------------------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Sensitive Data Activity | This Report shows user activity on sensitive data. | None | This report is comprised of two elements: - Bar Chart – Displays sensitive data activity
- Table – Provides details on sensitive data activity
|
+| Sensitive Data Activity | This report shows user activity on sensitive data. | None | This report is comprised of two elements: - Bar Chart – Displays sensitive data activity
- Table – Provides details on sensitive data activity
|
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/overview.md b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/overview.md
index 4d65404b7f..1ce203bc7b 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 90
# 7.Activity Job Group
The 7.Activity job group generates summary and detail reports of SharePoint activity on the
-specified sites. These reports can be used for identifying file, folder, and user related activity
+specified sites. Use these reports to identify file, folder, and user related activity
across your SharePoint environment.
@@ -17,6 +17,6 @@ The job groups in the 7.Activity Job Group are:
- [Forensics Job Group](/docs/accessanalyzer/11.6/solutions/sharepoint/activity/forensics/overview.md)
– Highlights deletions, group membership changes, permission changes, and activity around
sensitive data
-- [Usage Statistics Job Group](/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/overview.md)–
- Identifies long term trends of activity across your SharePoint environment highlighting most
+- [Usage Statistics Job Group](/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/overview.md)
+ – Identifies long term trends of activity across your SharePoint environment highlighting most
active sites and users as well as stale users
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/overview.md b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/overview.md
index d659d0f40c..0e6c140664 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/overview.md
@@ -14,7 +14,7 @@ environment highlighting most active sites and users as well as stale sites.
The jobs in the Usage Statistics Job Group are:
- [SP_InactiveSites Job](/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_inactivesites.md)
- – Highlights your environments least active Sites or Site Collections
+ – Highlights your environment's least active Sites or Site Collections
- [SP_MostActiveSites Job](/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_mostactivesites.md)
– Identifies the top five most active sites monitored by Enterprise Auditor
- [SP_MostActiveUsers Job](/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_mostactiveusers.md)
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_inactivesites.md b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_inactivesites.md
index 0ea8a3d1ed..2c0cd77010 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_inactivesites.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_inactivesites.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# SP_InactiveSites Job
-This job highlights your environments least active Sites or Site Collections.
+This job highlights your environment's least active Sites or Site Collections.
## Analysis Tasks for the SP_InactiveSites Job
@@ -14,7 +14,7 @@ Navigate to the **Jobs** > **SharePoint** > **7.Activity** > **Usage Statistics*
**SP_InactiveSites** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_mostactivesites.md b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_mostactivesites.md
index 9242f51d6e..66767c63ce 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_mostactivesites.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_mostactivesites.md
@@ -14,7 +14,7 @@ Navigate to the **Jobs** > **SharePoint** > **7.Activity** > **Usage Statistics*
**SP_MostActiveSites** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -31,4 +31,4 @@ produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Most Active Sites – Last 30 Days | This report identifies the top five most active sites for the past 30 days. [Reads], [Updates], [Deletes], [Permission Changes] fields reflect the number of unique operations of each type that was performed on the site for this time frame. Unique Resources Accessed, number of active user performing operations on the site, as well as whether or not the active site contains sensitive information. | None | This report is comprised of two elements: - Bar Chart – Displays information on most active sites by event count
- Table – Provides details on most active sites by event count
|
+| Most Active Sites – Last 30 Days | This report identifies the top five most active sites for the past 30 days. [Reads], [Updates], [Deletes], [Permission Changes] fields reflect the number of unique operations of each type that was performed on the site for this time frame. Unique Resources Accessed, number of active user performing operations on the site, as well as whether the active site contains sensitive information. | None | This report is comprised of two elements: - Bar Chart – Displays information on most active sites by event count
- Table – Provides details on most active sites by event count
|
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_mostactiveusers.md b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_mostactiveusers.md
index 7bfaba8334..36047303e1 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_mostactiveusers.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/activity/usagestatistics/sp_mostactiveusers.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **7.Activity** > **Usage Statistics*
**SP_MostActiveUsers** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -24,8 +24,8 @@ preconfigured for this job.
The default analysis task is:
-- Most Active Users Last 30 Days – SA_SPAC_MostActiveUsers_Last30Days table accessible under the
- job’s Results node
+- Most Active Users Last 30 Days – Creates the SA_SPAC_MostActiveUsers_Last30Days table accessible
+ under the job’s Results node
In addition to the tables and views created by the analysis tasks, the SQL_MostActiveUsers Job
produces the following pre-configured report:
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/1-spseek_systemscans.md b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/1-spseek_systemscans.md
index 23a635a9c4..830cdac3e8 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/1-spseek_systemscans.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/1-spseek_systemscans.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# 1-SPSEEK_SystemScans Job
-This job is responsible for building the Tier2 SPDLP database repositories, which contain
-information regarding sensitive content that exists within SharePoint.
+This job builds the Tier2 SPDLP database repositories, which contain information about sensitive
+content in SharePoint.
## Queries for the 1-SPSEEK_SystemScans Job
@@ -22,18 +22,18 @@ The query for the 1-SPSEEK SystemScans Job is:
### Configure the Query for the 1-SPSEEK_SystemScans Job
The 1-SPSEEK_SystemScans Job has been preconfigured to run with the default settings using the SPAA
-Data Collector category of Scan for Sensitive Content, which is not visible within the SharePoint
+Data Collector category of Scan for Sensitive Content, which isn't visible within the SharePoint
Access Auditor Data Collector Wizard when opened from within this job.
:::warning
-Users should not change scans in a way that would result in less data being returned on
+Users shouldn't change scans in a way that would result in less data being returned on
a subsequent scan (i.e. scanning fewer web applications, scanning fewer site collections, or a
shallower depth scan). Those resources not included in a subsequent scan are marked as deleted in
the Tier 2 database and subsequently removed from the Tier 1 database.
:::
-Follow the steps to set any desired customizations.
+To set any desired customizations:
**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** >
**1-SPSEEK_SystemScans** > **Configure** node and select **Queries**.
@@ -95,7 +95,7 @@ All** and **Clear All** buttons. Click **Next**. _(Optional)_ To create custom c
topic for additional information.
:::warning
-Do not configure the options on the Results page.
+Don't configure the options on the Results page.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/2-spaa_systemscans.md b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/2-spaa_systemscans.md
index 28ffcd3dc4..e443ae1f1d 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/2-spaa_systemscans.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/2-spaa_systemscans.md
@@ -22,20 +22,20 @@ The query for the 2-SPAA_SystemScans Job is:
### Configure 2-SPAA_SystemScans Job
The 2-SPAA_SystemScans Job has been preconfigured to run with the default settings using the SPAA
-Data Collector category of Scan SharePoint Access, which is not visible within the SharePoint Access
+Data Collector category of Scan SharePoint Access, which isn't visible within the SharePoint Access
Auditor Data Collector Wizard when opened from within this job.
:::warning
-Users should not change scans in a way that would result in less data being returned on
+Users shouldn't change scans in a way that would result in less data being returned on
a subsequent scan (i.e. scanning fewer web applications, scanning fewer site collections, or a
shallower depth scan). Those resources not included in a subsequent scan are marked as deleted in
the Tier 2 database and subsequently removed from the Tier 1 database.
:::
-Follow the steps to set any desired customizations.
+To set any desired customizations:
-**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **1-SPAA_SystemScans** >
+**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **2-SPAA_SystemScans** >
**Configure** node and select the **Queries** node.
**Step 2 –** In the Query Selection view, click **Query Properties**. The Query Properties window
@@ -70,7 +70,7 @@ setting as desired and click **Next**.
page, use the default settings unless an agent scan mode is desired. Click **Next**.
:::warning
-Do not configure the options on the Results page.
+Don't configure the options on the Results page.
:::
@@ -79,4 +79,4 @@ Do not configure the options on the Results page.
**Step 9 –** On the Summary page, click **Finish** to save any setting modifications or click
**Cancel** if no changes were made. Then click **OK** to close the Query Properties window.
-If changes were made, the 1-SPAA_SystemScans Job has now been customized.
+If changes were made, the 2-SPAA_SystemScans Job has now been customized.
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/3-spac_systemscans.md b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/3-spac_systemscans.md
index 03a34ecde5..d159159cbf 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/3-spac_systemscans.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/3-spac_systemscans.md
@@ -12,11 +12,11 @@ in each structural level in the SharePoint farm.
## Queries for the 3-SPAC_SystemScans Job
The 3-SPAC_SystemScans Job has been preconfigured to run with the default settings using the SPAA
-Data Collector category of Scan SharePoint Activity, which is not visible within the SharePoint
+Data Collector category of Scan SharePoint Activity, which isn't visible within the SharePoint
Access Auditor Data Collector Wizard when opened from within this job.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/4-spseek_bulkimport.md b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/4-spseek_bulkimport.md
index 2eab5bb280..5071d87746 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/4-spseek_bulkimport.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/4-spseek_bulkimport.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# 4-SPSEEK_BulkImport Job
-This job is responsible for retrieving the Tier 2 SPDLP database information and importing it to the
-SQL Server where Enterprise Auditor stores data.
+This job retrieves the Tier 2 SPDLP database information and imports it to the SQL Server where
+Enterprise Auditor stores data.
## Queries for the 4-SPSEEK_BulkImport Job
@@ -22,7 +22,7 @@ The query for the 4-SPSEEK Bulk Import Job is:
### Configure 4-SPSEEK_BulkImport Job
The 4-SPSEEK_BulkImport Job has been preconfigured to run with the default settings with the SPAA
-Data Collector category of **Bulk Import Sensitive Content Scan Results**, which is not visible
+Data Collector category of **Bulk Import Sensitive Content Scan Results**, which isn't visible
within the SharePoint Access Auditor Data Collector Wizard when opened from within this job. Follow
the steps to set any desired customizations.
@@ -38,16 +38,16 @@ displays.
**Step 4 –** On the
[SPAA: Bulk Import Settings](/docs/accessanalyzer/11.6/admin/datacollector/spaa/bulkimportsettings.md)
-page, the **Set Host Identifier** is not configured by default. Click **Next**.
+page, the **Set Host Identifier** isn't configured by default. Click **Next**.
:::note
-Unless SQL Server Replication is used, it should not be necessary to adjust the **Host
+Unless SQL Server Replication is used, it shouldn't be necessary to adjust the **Host
Identifier** seed.
:::
:::warning
-Do not configure the options on the Results page.
+Don't configure the options on the Results page.
:::
@@ -81,6 +81,6 @@ The default analysis tasks are:
- **5. Create DLP views** – Creates the SA_SPDLP_MatchesView
- **6. Create exceptions view** – Creates the SA_SPAA_ExceptionsView
-The following analysis task is not selected by default, but can be enabled:
+The following analysis task isn't selected by default, but can be enabled:
- Display Match Hits – Displays the SA_SPDLP_MatchesHitsView within Enterprise Auditor.
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/5-spaa_bulkimport.md b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/5-spaa_bulkimport.md
index d387d5c3a9..9aee08dcb6 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/5-spaa_bulkimport.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/5-spaa_bulkimport.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# 5-SPAA_BulkImport Job
-This job is responsible for retrieving the SPAA Tier 2 database information and import it to the
-Enterprise Auditor SQL database.
+This job retrieves the SPAA Tier 2 database information and imports it to the Enterprise Auditor SQL
+database.
## Queries for the 5-SPAA_BulkImport Job
@@ -22,11 +22,11 @@ The query for the 5-SPAA_BulkImport Job is:
### Configure 5-SPAA_BulkImport Job
The 5-SPAA_BulkImport Job has been preconfigured to run with the default settings with the SPAA Data
-Collector category of Bulk Import Access Scan Results, which is not visible within the SharePoint
-Access Auditor Data Collector Wizard when opened from within this job. Follow the steps to set any
-desired customizations.
+Collector category of Bulk Import Access Scan Results, which isn't visible within the SharePoint
+Access Auditor Data Collector Wizard when opened from within this job. To set any
+desired customizations:
-**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **2-SPAA_BulkImport** >
+**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **5-SPAA_BulkImport** >
**Configure** node and select the **Queries** node.
**Step 2 –** In the Query Selection view, click **Query Properties**. The Query Properties window
@@ -38,16 +38,16 @@ displays.
**Step 4 –** On the
[SPAA: Bulk Import Settings](/docs/accessanalyzer/11.6/admin/datacollector/spaa/bulkimportsettings.md)
-page, the **Set Host Identifier** is not configured by default. Click **Next**.
+page, the **Set Host Identifier** isn't configured by default. Click **Next**.
:::note
-Unless SQL Server Replication is used, it should not be necessary to adjust the **Host
+Unless SQL Server Replication is used, it shouldn't be necessary to adjust the **Host
Identifier** seed.
:::
:::warning
-Do not configure the options on the Results page.
+Don't configure the options on the Results page.
:::
@@ -60,7 +60,7 @@ If changes were made, the 5-SPAA_BulkImport Job has now been customized.
## Analysis Tasks for 5-SPAA_BulkImport Job
-Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **2-SPAA_BulkImport** > **Configure**
+Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **5-SPAA_BulkImport** > **Configure**
node and select **Analysis** to view the analysis tasks.
:::warning
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/6-spac_bulkimport.md b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/6-spac_bulkimport.md
index 0dc0420578..a9c3d91fe6 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/6-spac_bulkimport.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/6-spac_bulkimport.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# 6-SPAC_BulkImport Job
-This job is responsible for retrieving the SPAC Tier 2 database information and import it to the
-Enterprise Auditor SQL database.
+This job retrieves the SPAC Tier 2 database information and imports it to the Enterprise Auditor SQL
+database.
## Queries for the 6-SPAC_BulkImport Job
@@ -22,11 +22,11 @@ The query for the 6-SPAC_BulkImport Job is:
### Configure the Query for the 6-SPAC_BulkImport Job
The 6-SPAC_BulkImport Job has been preconfigured to run with the default settings with the category
-of Bulk Import SharePoint Activity Scan Results, which is not visible within the SharePoint Access
-Auditor Data Collector Wizard when opened from within this job. Follow the steps to set any desired
-customizations.
+of Bulk Import SharePoint Activity Scan Results, which isn't visible within the SharePoint Access
+Auditor Data Collector Wizard when opened from within this job. To set any desired
+customizations:
-**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **2-SPAC_BulkImport** >
+**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **6-SPAC_BulkImport** >
**Configure** node and select **Queries**.
**Step 2 –** In the Query Selection view, click **Query Properties**. The Query Properties window
@@ -38,16 +38,16 @@ displays.
**Step 4 –** On the
[SPAA: Bulk Import Settings](/docs/accessanalyzer/11.6/admin/datacollector/spaa/bulkimportsettings.md)
-page, the **Set Host Identifier** is not configured by default. Click **Next**.
+page, the **Set Host Identifier** isn't configured by default. Click **Next**.
:::note
-Unless SQL Server Replication is used, it should not be necessary to adjust the **Host
+Unless SQL Server Replication is used, it shouldn't be necessary to adjust the **Host
Identifier** seed.
:::
:::warning
-Do not configure the options on the Results page.
+Don't configure the options on the Results page.
:::
@@ -58,7 +58,7 @@ Do not configure the options on the Results page.
If changes were made, the 6-SPAC_BulkImport Job has now been customized.
-## Analysis Tasks for 2-SPAC_BulkImport Job
+## Analysis Tasks for 6-SPAC_BulkImport Job
Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **6-SPAC_BulkImport** > **Configure**
node and select **Analysis** to view the analysis tasks.
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/7-spaa_exceptions.md b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/7-spaa_exceptions.md
index fc9302fa9e..9ed86e83d8 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/7-spaa_exceptions.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/7-spaa_exceptions.md
@@ -6,12 +6,12 @@ sidebar_position: 70
# 7-SPAA_Exceptions Job
-This job searches scanned data for resources that match high risk conditions and retrieving a
+This job searches scanned data for resources that match high risk conditions and retrieves a
summary of SharePoint exceptions per host.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -32,9 +32,9 @@ for additional information.
## Analysis Tasks 7-SPAA_Exceptions Job
-The 3-SPAA_Exceptions Job does not use the SPAA Data Collector. Instead it runs analysis on the data
-returned by the 2-SPAA_BulkImport Job. View the analysis tasks by navigating to the **Jobs** >
-**SharePoint** > **0.Collection** > **3-SPAA_Exceptions** > **Configure** node and select
+The 7-SPAA_Exceptions Job doesn't use the SPAA Data Collector. Instead it runs analysis on the data
+returned by the 5-SPAA_BulkImport Job. View the analysis tasks by navigating to the **Jobs** >
+**SharePoint** > **0.Collection** > **7-SPAA_Exceptions** > **Configure** node and select
**Analysis**.
:::warning
@@ -48,17 +48,17 @@ selected analysis tasks.
The default analysis tasks are:
- Open resources – Any site collections, sites, libraries, lists, or folders that are openly
- accessible. Can be deselected if open resource information is not desired.
+ accessible. Can be deselected if open resource information isn't desired.
- This analysis task contains a configurable parameter: `#opengroups`
- Disabled users – Any site collections, sites, libraries, lists, or folders where disabled users
- have been granted access. Can be deselected if disabled user information is not desired.
+ have been granted access. Can be deselected if disabled user information isn't desired.
- Stale users – Any site collections, sites, libraries, lists, or folders where stale users have
- been granted access. Stale users are user who have not logged in for more than 120 days. Can be
- deselected if stale user information is not desired.
-- Unresolved SID – Matches SIDs to .Active Directory Inventory Job Group data to resolve for those
- users using legacy SIDS or deleted users.
+ been granted access. Stale users are users who have not logged in for more than 120 days. Can be
+ deselected if stale user information isn't desired.
+- Unresolved SID – Matches SIDs to the Active Directory Inventory Job Group data to resolve for
+ those users using legacy SIDS or deleted users.
- Show view – Displays views within the Results node of the Enterprise Auditor Console.
### Customizable Analysis Tasks for the 7-SPAA_Exceptions Job
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/overview.md b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/overview.md
index 484efcba3a..48bcda562c 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/collection/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/collection/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# 0.Collection Job Group
-The **SharePoint** > **0.Collection** Job Group is designed to collect information from SharePoint
-farms using the SPAA Data Collector. The collected data is then available to other SharePoint
+The **SharePoint** > **0.Collection** Job Group collects information from SharePoint farms using the
+SPAA Data Collector. The collected data is then available to other SharePoint
Solution sub-job groups and the Access Information Center for analysis.
@@ -52,24 +52,24 @@ components:
[SharePoint Activity Auditing](#sharepoint-activity-auditing) topic for additional information.
- SharePoint Sensitive Data Discovery Auditing (SEEK) – The SharePoint Sensitive Data Discovery
Auditing (SEEK) component searches file content for sensitive data. It also collects permission
- information; therefore, it does not need to be run with the SPAA component. This component employs
+ information; therefore, it doesn't need to be run with the SPAA component. This component employs
the 1-SPSEEK_SystemScans Job, the 5-SPAA_BulkImport Job, the 4-SPSEEK_BulkImport Job, and the
7-SPAA_Exceptions Job. This component requires an additional installer package before data
collection will occur. See the
[SharePoint Sensitive Data Discovery Auditing (SEEK)](#sharepoint-sensitive-data-discovery-auditing-seek)
topic for additional information.
-These jobs are numbered to keep them in the necessary run order. Not all jobs need be run. See the
+These jobs are numbered to keep them in the necessary run order. Not all jobs need to run. See the
appropriate auditing section for specific job relationships and recommended workflows.
The relationship between system scans and bulk import jobs requires the following considerations:
-- A system scans job executed from a Enterprise Auditor Console must be followed by the
+- A system scans job executed from an Enterprise Auditor Console must be followed by the
corresponding bulk import job from the same Enterprise Auditor Console with the same version of
Enterprise Auditor
- Two system scans processing the same information, for example two **2-SPAA_SystemScans** jobs,
- cannot be executed consecutively against the same target host. The corresponding bulk import job,
- for example. **5-SPAA_BulkImport**, must be executed in between.
+ can't be executed consecutively against the same target host. The corresponding bulk import job,
+ for example, **5-SPAA_BulkImport**, must be executed in between.
The system scans job collects the data and creates a Tier-2 database, or SQLite database, on the
local host or the host where the SharePoint Agent was installed (according to the scan method
@@ -132,14 +132,14 @@ topic for other Runtime Details.
**Step 4 –** Run desired corresponding analysis and reporting sub-job groups.
-Please see the
+see the
[Recommended Configuration for the SharePoint Solution](/docs/accessanalyzer/11.6/solutions/sharepoint/recommended.md)
topic before continuing with this workflow.
:::info
Scope the 0.Collection Job Group to only include the collection components
desired by disabling the undesired collection jobs. Disabling them allows the solution to run more
-efficiently. It is not recommended to delete any jobs. See the
+efficiently. It isn't recommended to delete any jobs. See the
[Disable or Enable a Job](/docs/accessanalyzer/11.6/admin/jobs/job/disableenable.md)
topic for additional information.
:::
@@ -154,9 +154,9 @@ and tables specifically incorporated into this component are prefaced with SPAC.
[Standard Reference Tables & Views for the SPAA Data Collector](/docs/accessanalyzer/11.6/admin/datacollector/spaa/standardtables.md)
topic for additional information on the data collected.
-The Access Auditing components must be run in order to create the tables in the database for the
-SPAC component to use. Either the SPAA or SEEK Scan job, run to at least a 0-level scan depth (and
-the corresponding Bulk Import job) can be used to create these tables. Once an initial 0-level SPAA
+The Access Auditing components must be run to create the tables in the database for the
+SPAC component to use. Use either the SPAA or SEEK Scan job, run to at least a 0-level scan depth, along
+with the corresponding Bulk Import job, to create these tables. After an initial 0-level SPAA
or SPSEEK scan job and corresponding Bulk Import have been run against a particular SharePoint On
Prem farm or SharePoint Online tenant, SPAA or SPSEEK Scan jobs can be run concurrently with SPAC
Scan and Bulk Import jobs as needed.
@@ -201,8 +201,8 @@ for additional information.
**Step 6 –** Run desired corresponding analysis and reporting sub-job groups.
:::note
-Once an initial 2-SPAA SystemScans job (scoped to at least 0-level depth) and the
-corresponding 5-SPAA Bulk Import job have been run, then the SPAA Scans can be run concurrently with
+After an initial 2-SPAA SystemScans job (scoped to at least 0-level depth) and the
+corresponding 5-SPAA Bulk Import job have been run, the SPAA Scans can be run concurrently with
SPAC Scans and Bulk Import jobs as desired.
:::
@@ -210,9 +210,9 @@ SPAC Scans and Bulk Import jobs as desired.
Recommended Workflow 2 (for Access, Sensitive Data Discovery & Activity Auditing)
:::warning
-The jobs must be run in the order shown. It is not possible to disable the
+The jobs must be run in the order shown. It isn't possible to disable the
1-SPAA_SystemScan and 2-SPAA_BulkImport jobs and run the 0.Collection Job Group because the
-remaining jobs are in the wrong order. Renaming the jobs is not an option.
+remaining jobs are in the wrong order. Renaming the jobs isn't an option.
:::
@@ -237,8 +237,8 @@ only).
**Step 7 –** Run desired corresponding analysis and reporting sub-job groups.
:::note
-Once an initial 1-SPSEEK SystemScans job (scoped to at least 0-level depth) and the
-corresponding 4-SPSEEK Bulk Import job have been run, then the SPSEEK Scans jobs can be run
+After an initial 1-SPSEEK SystemScans job (scoped to at least 0-level depth) and the
+corresponding 4-SPSEEK Bulk Import job have been run, the SPSEEK Scans jobs can be run
concurrently with the SPAC Scans and the Bulk Import jobs as desired.
:::
@@ -254,7 +254,7 @@ concurrently with the SPAC Scans and the Bulk Import jobs as desired.
**Step 3 –** Run desired corresponding analysis and reporting sub-job groups.
:::note
-Please see the
+see the
[Recommended Configuration for the SharePoint Solution](/docs/accessanalyzer/11.6/solutions/sharepoint/recommended.md)
topic before continuing with this workflow.
:::
@@ -263,7 +263,7 @@ topic before continuing with this workflow.
:::info
Scope the 0.Collection Job Group to only include the collection components
desired by disabling the undesired collection jobs. Disabling them allows the solution to run more
-efficiently. It is not recommended to delete any jobs. See the
+efficiently. It isn't recommended to delete any jobs. See the
[Disable or Enable a Job](/docs/accessanalyzer/11.6/admin/jobs/job/disableenable.md)
topic for additional information.
:::
@@ -343,9 +343,9 @@ the SharePoint application server when applicable (once only).
Recommended Workflow 2 (for Access, Sensitive Data Discovery & Activity Auditing)
:::warning
-The jobs must be run in the order shown. It is not possible to disable the
-2-SPAA_SystemScan and 5-SPAA_BulkImport jobs and run the 0.Collection Job Group because the
-remaining jobs are in the wrong order. Renaming the jobs is not an option.
+The jobs must be run in the order shown. It isn't possible to disable the
+2-SPAA_SystemScans and 5-SPAA_BulkImport jobs and run the 0.Collection Job Group because the
+remaining jobs are in the wrong order. Renaming the jobs isn't an option.
:::
@@ -369,14 +369,14 @@ remaining jobs are in the wrong order. Renaming the jobs is not an option.
**Step 7 –** Run desired corresponding analysis and reporting sub-job groups.
:::note
-Once an initial 1-SPSEEK SystemScans job (scoped to at least 0-level depth) and the
-corresponding 4-SPSEEK Bulk Import job have been run, then the SPSEEK Scans can be run concurrently
+After an initial 1-SPSEEK SystemScans job (scoped to at least 0-level depth) and the
+corresponding 4-SPSEEK Bulk Import job have been run, the SPSEEK Scans can be run concurrently
with the SPAC Scans and the Bulk Import jobs as desired.
:::
:::note
-Please see the
+see the
[Recommended Configuration for the SharePoint Solution](/docs/accessanalyzer/11.6/solutions/sharepoint/recommended.md)
topic before continuing with this workflow.
:::
@@ -385,7 +385,7 @@ topic before continuing with this workflow.
:::info
Scope the 0.Collection Job Group to only include the collection components
desired by disabling the undesired collection jobs. Disabling them allows the solution to run more
-efficiently. It is not recommended to delete any jobs. See the
+efficiently. It isn't recommended to delete any jobs. See the
[Disable or Enable a Job](/docs/accessanalyzer/11.6/admin/jobs/job/disableenable.md)
topic for additional information.
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/content/overview.md b/docs/accessanalyzer/11.6/solutions/sharepoint/content/overview.md
index 51f08080dc..f685c832af 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/content/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/content/overview.md
@@ -6,9 +6,9 @@ sidebar_position: 60
# 4.Content Job Group
-This group provides insight into content stored across SharePoint farms in order to help more
+This group provides insight into content stored across SharePoint farms to help more
efficiently manage that content. It will provide information on the content taking up the most
-space, the content that has not been accessed for extended periods of time, and additional data
+space, the content that hasn't been accessed in a long time, and additional data
describing SharePoint content and the configuration of the repositories such as lists and libraries
which store that content.
@@ -25,4 +25,4 @@ The 4.Content Job Group is comprised of:
– Identifies files that have been modified in at least a year across SharePoint farms. This aids
administrators and users in cleaning up or archiving old and unchanged files to help maintain a
clean and healthy SharePoint environment. Report includes files, their last modified time, total
- file size, versions and version size, along with file owner and file editor information.
+ file size, versions, and version size, along with file owner and file editor information.
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/content/sp_largestfiles.md b/docs/accessanalyzer/11.6/solutions/sharepoint/content/sp_largestfiles.md
index 331bb9f4b2..830be2f144 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/content/sp_largestfiles.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/content/sp_largestfiles.md
@@ -17,7 +17,7 @@ Navigate to the **Jobs** > **SharePoint** > **4.Content** > **SP_LargestFiles**
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/content/sp_stalefiles.md b/docs/accessanalyzer/11.6/solutions/sharepoint/content/sp_stalefiles.md
index 83ab91209a..bc7311f7b1 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/content/sp_stalefiles.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/content/sp_stalefiles.md
@@ -9,12 +9,12 @@ sidebar_position: 20
The SP_StaleFiles Job identifies files that have not been modified in at least a year across
SharePoint farms. This aids administrators and users in cleaning up or archiving old and unchanged
files to help maintain a clean and healthy SharePoint environment. Report includes files, their last
-modified time, total file size, versions and version size, along with file owner and file editor
+modified time, total file size, versions, and version size, along with file owner and file editor
information.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -33,7 +33,7 @@ Navigate to the **Jobs** > **SharePoint** > **4.Content** > **SP_StaleFiles** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job. Only the `@stale` parameter can be configured for the analysis task.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_domainusers.md b/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_domainusers.md
index b4352f6dc2..af86c1c794 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_domainusers.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_domainusers.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **1.Direct Permissions** > **SP_Doma
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_emptydomaingroupperms.md b/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_emptydomaingroupperms.md
index 6ce20a5b48..b729f1248f 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_emptydomaingroupperms.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_emptydomaingroupperms.md
@@ -17,7 +17,7 @@ Navigate to the **Jobs** > **SharePoint** > **1.Direct Permissions** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_highriskpermissions.md b/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_highriskpermissions.md
index 1d828643fc..12aaa2c878 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_highriskpermissions.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_highriskpermissions.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# SP_HighRiskPermissions Job
The SP_HighRiskPermissions Job identifies where Authenticated Users, Everyone Except External Users,
-Anonymous Logon, or Domain users have been directly assigned permissions
+Anonymous Logon, or Domain users have been directly assigned permissions.
## Analysis Tasks for the SP_HighRiskPermissions Job
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **1.Direct Permissions** > **SP_High
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_sitecollectionperms.md b/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_sitecollectionperms.md
index 1934277643..e5521c4dd8 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_sitecollectionperms.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_sitecollectionperms.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# SP_SiteCollectionPerms Job
-Most content will inherit the permissions configured at the root of the site collection. Having an
-understanding of how those permissions are assigned is useful for gaining perspective on the overall
+Most content will inherit the permissions configured at the root of the site collection.
+Understanding how those permissions are assigned gives useful perspective on the overall
SharePoint permission configuration.
## Analysis Tasks for the SP_SiteCollectionPerms Job
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **SharePoint** > **1.Direct Permissions** > **SP_Site
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -41,4 +41,4 @@ report:
| Report | Description | Default Tags | Report Elements |
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Direct Site Collection Permissions | Most content will inherit the permissions configured at the root of the site collection. Having an understanding of how those permissions are assigned is useful for gaining perspective on the overall SharePoint permission configuration. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 site collections by direct permissions
- Table – Provides details on site collections by direct permissions breakdown
|
+| Direct Site Collection Permissions | Most content will inherit the permissions configured at the root of the site collection. Understanding how those permissions are assigned gives useful perspective on the overall SharePoint permission configuration. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 site collections by direct permissions
- Table – Provides details on site collections by direct permissions breakdown
|
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_staleusers.md b/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_staleusers.md
index 083981b849..1fb252c13f 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_staleusers.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_staleusers.md
@@ -6,9 +6,8 @@ sidebar_position: 50
# SP_StaleUsers Job
-A stale user is defined as either currently disabled within Active Directory, or has not logged onto
-the domain for over 90 days. This job will identify locations where there are stale users directly
-applied on SharePoint resources. These permissions can be safely removed.
+A stale user is disabled in Active Directory or hasn't logged on to the domain in over 90 days. This
+job will identify locations where there are stale users directly applied on SharePoint resources. These permissions can be safely removed.
## Analysis Tasks for the SP_StaleUsers Job
@@ -16,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **1.Direct Permissions** > **SP_Stal
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -37,4 +36,4 @@ users, the SP_StaleUsers Job produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Stale User Permissions | A stale user is defined as either currently disabled within Active Directory, or has not logged onto the domain for over 90 days. | None | This report is comprised of three elements: - Bar Chart – Displays top 5 users by affected resources
- Table – Provides details on top resource by stale user permissions
- Table – Provides details on top stale users by affected resources
|
+| Stale User Permissions | A stale user is disabled in Active Directory or hasn't logged on to the domain in over 90 days. | None | This report is comprised of three elements: - Bar Chart – Displays top 5 users by affected resources
- Table – Provides details on top resource by stale user permissions
- Table – Provides details on top stale users by affected resources
|
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_unresolvedsids.md b/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_unresolvedsids.md
index 2a91fa22d8..6f43005a44 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_unresolvedsids.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/directpermissions/sp_unresolvedsids.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **1.Direct Permissions** > **SP_Unre
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/overview.md b/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/overview.md
index e737c7b0b3..67264f4249 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/overview.md
@@ -14,10 +14,9 @@ SharePoint environment.
The Effective Access Audits Job Group is comprised of:
- [Scoping > SP_TrusteeAccess Job](/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaccess.md)
- – Scopes a list of users to audit their access across the SharePoint environment. This can also be
- accomplished by looking users up in the Access Information Center. However, it is recommended to
- use this job in scenarios where a report on multiple users’ effective access at once needs to be
- generated.
+ – Scopes a list of users to audit their access across the SharePoint environment. You can also
+ accomplish this by looking users up in the Access Information Center. However, use this job when
+ you want to generate a report on multiple users’ effective access at once.
- [SP_TrusteeAudit Job](/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaudit.md)
– Provides functionality similar to the Access Information Center by allowing scoped audits of
users’ access across the environment
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaccess.md b/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaccess.md
index 338593690f..b2df392e00 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaccess.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaccess.md
@@ -6,10 +6,10 @@ sidebar_position: 10
# Scoping > SP_TrusteeAccess Job
-The SP_TrusteeAccess job allows you to scope a list of users to audit their access across the
+Use the SP_TrusteeAccess job to scope a list of users and audit their access across the
SharePoint environment. You can also accomplish this by looking users up in the Access Information
-Center, however you want to utilize this job in scenarios where you want to generate a report on
-multiple users’ effective access at once.
+Center. However, use this job when you want to generate a report on multiple users’ effective access
+at once.
:::note
Trustees can be specified in the `UserScoping.csv` file for the SP_TrusteeAccess Job. See
@@ -37,10 +37,10 @@ The default query is:
### Configure CSV File for the Query for the SP_TrusteeAccess Job
-Follow the steps to specify trustees in the `UserScoping.csv` file.
+To specify trustees in the `UserScoping.csv` file:
**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **Effective Access Audits** > **Scoping** >
-**SP_TrusteeAccess** Job and right-click on the job. Select **Explore Folder** and the job’s
+**SP_TrusteeAccess** Job and right-click the job. Select **Explore Folder** and the job’s
directory opens.
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaudit.md b/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaudit.md
index 7a9afecb26..391a452be7 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaudit.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaudit.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **SharePoint** > **Effective Access Audits** > **SP_T
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/overview.md b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/overview.md
index f1fc7f1098..3b00934016 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 100
# 8.M365 Job Group
The 8.M365 Job Group generates summary and detail reports of SharePoint Activity on the specified
-Teams sites. These reports can be used for identifying file, folder, and user related activity
+Teams sites. Use these reports to identify file, folder, and user related activity
across your SharePoint environment.
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_externalusers.md b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_externalusers.md
index 1912e770e8..8d8e684cae 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_externalusers.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_externalusers.md
@@ -15,14 +15,14 @@ Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_OneDrives** > **Co
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
-The default analysis task is:
+The default analysis tasks are:
- Analyze External User Activity – Creates the
SA_SPAC_SharePointOnlineMostActiveExternalUsersSummary table accessible under the job's Results
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_onedrives.md b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_onedrives.md
index 2764d4ef80..2ed7f169bc 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_onedrives.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_onedrives.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_OneDrives** > **Co
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_sharedlinks.md b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_sharedlinks.md
index 2c63641c51..351f09dfea 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_sharedlinks.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_sharedlinks.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_SharedLinks** > **
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_staleteamsites.md b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_staleteamsites.md
index df7c9382ef..b23be2f4ab 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_staleteamsites.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_staleteamsites.md
@@ -7,11 +7,11 @@ sidebar_position: 40
# SP_StaleTeamSites Job
The SP_StaleTeamSites Job identifies Teams that have not had activity for a number of days that can
-be set in the analysis (Set as 30 Days by Default).
+be set in the analysis (Set at 30 Days by Default).
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -26,7 +26,7 @@ for additional information.
## Analysis Tasks for the SP_StaleTeamSites Job
-Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_StaleTeamSites** >**Configure** node
+Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_StaleTeamSites** > **Configure** node
and select **Analysis** to view the analysis tasks.
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_teams.md b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_teams.md
index ab4112eece..9b34c8719b 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_teams.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_teams.md
@@ -15,14 +15,14 @@ Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_Teams** > **Config
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
-The default analysis task is:
+The default analysis tasks are:
- Teams Details and Summary – Creates the SA_SP_TeamsSummary table to populate the Teams Activity
and Teams Summary reports
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_teamsexternaluseractivity.md b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_teamsexternaluseractivity.md
index a7797cfac5..209d33b729 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_teamsexternaluseractivity.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_teamsexternaluseractivity.md
@@ -12,11 +12,11 @@ Teams, including details on the date/time, resource, and operation.
## Analysis Tasks for the SP_TeamsExternalUserActivity Job
Navigate to the **Jobs** > **SharePoint** > **8.M365** >
-**SP_TeamsExternalUserActivity** >**Configure** node and select **Analysis** to view the analysis
+**SP_TeamsExternalUserActivity** > **Configure** node and select **Analysis** to view the analysis
tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_teamssensitivedata.md b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_teamssensitivedata.md
index 8a0f2a250f..4f9610e890 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_teamssensitivedata.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/m365/sp_teamssensitivedata.md
@@ -10,11 +10,11 @@ The SP_TeamsSensitiveData Job analyzes sensitive data activity within Teams Site
## Analysis Tasks for the SP_TeamsSensitiveData Job
-Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_TeamsSensitiveData** >**Configure**
+Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_TeamsSensitiveData** > **Configure**
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/overview.md b/docs/accessanalyzer/11.6/solutions/sharepoint/overview.md
index 410b9486b4..7803cbc06d 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/overview.md
@@ -46,14 +46,14 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
The Sensitive Data Discovery Add-On must be installed on the Enterprise Auditor Console server,
-which enables Sensitive Data criteria for scans. If running Sensitive Data Discovery (SDD) scans, it
-will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2
-additional GB of RAM per host. For example, if the job is configured to scan 8 hosts at a time ,
-then an extra 16 GB of RAM are required (8x2=16).
+which enables Sensitive Data criteria for scans. If you run Sensitive Data Discovery (SDD) scans,
+increase the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per
+host. For example, if the job is configured to scan 8 hosts at a time, then an extra 16 GB of RAM
+are required (8x2=16).
:::note
The Sensitive Data Discovery Add-on installation package installs the appropriate JDK
-(Java) version on the server. The JDK deployed is prepackaged and does not require any
+(Java) version on the server. The JDK deployed is prepackaged and doesn't require any
configuration; it has been preconfigured to work with Enterprise Auditor and should never be
customized through Java. It will not conflict with other JDKs or Java Runtimes in the same
environment.
@@ -61,15 +61,15 @@ environment.
:::tip
-Remember, if employing the Enterprise Auditor SharePoint Agent, it is also necessary for the
-Sensitive Data Discovery Add-on to be installed on the server where the agent is installed.
+If you use the Enterprise Auditor SharePoint Agent, also install the Sensitive Data Discovery
+Add-on on the server where the agent is installed.
:::
**Location**
The SharePoint Solution requires a special Enterprise Auditor license. It can be installed from the
-Enterprise Auditor Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to
+Enterprise Auditor Instant Job Wizard. After it has been installed into the Jobs tree, navigate to
the solution: **Jobs** > **SharePoint**.
The 0.Collection Job Group collects the data. The other job groups and the SP_Overview Job run
@@ -95,15 +95,15 @@ The following types of auditing can be conducted with the SharePoint Solution:
Each type of auditing depends on specific jobs within the 0.Collection Job Group to collect the data
and its corresponding analysis/reporting job groups. The Access Auditing components represent the
core of the SharePoint Solution. However, the Sensitive Data Discovery Auditing components also
-collect the Access Auditing data; therefore it is not necessary to run both sets of collection jobs.
+collect the Access Auditing data; therefore it isn't necessary to run both sets of collection jobs.
The data collection query options for each type are explained within the 0.Collection Job Group
section. Additionally, the corresponding analysis/reporting job groups are listed for each auditing
type.
-If intending to run two or all auditing types, see each auditing type section within the
+If you intend to run two or all auditing types, see each auditing type section within the
0.Collection Job Group section for information on query options and requirements. It is recommended
-to first run the 0.Collection Job Group components in the default order for the desired auditing
-types to ensure successful data collection, and then to run the desired sub-groups for reports.
+to first run the 0.Collection Job Group components in the default order for the auditing types you want
+to ensure successful data collection, and then to run the sub-groups you want for reports.
See the
[Recommended Configuration for the SharePoint Solution](/docs/accessanalyzer/11.6/solutions/sharepoint/recommended.md)
@@ -113,7 +113,7 @@ The SharePoint Solution is available with the SharePoint Reports license feature
the following job groups and jobs:
- [0.Collection Job Group](/docs/accessanalyzer/11.6/solutions/sharepoint/collection/overview.md)
- – Designed to collect high level summary information from SharePoint servers. This information is
+ – Collects high level summary information from SharePoint servers. This information is
used to populate the SMP Reports based around the SharePoint and is a requirement for the Access
Information Center – SharePoint reports.
@@ -130,15 +130,14 @@ the following job groups and jobs:
principles such as NT AUTHORITY\Authenticated Users, Everyone, and Everyone Except External Users.
This data must be monitored closely because of its exposure.
- [3.Broken Inheritance > SP_BrokenInheritance Job](/docs/accessanalyzer/11.6/solutions/sharepoint/sp_brokeninheritance.md)
- – Keeping track of directly applied permissions at mass is not realistic, this job is responsible
- for performing data analysis and generating SharePoint broken inheritance reports at the site
- level. This includes looking at site broken inheritance and the trustees who are assigned to those
- sites where inheritance is broken so that you can remove that access in favor of providing access
- via group membership.
+ – Keeping track of directly applied permissions at scale isn't realistic. This job performs data
+ analysis and generates SharePoint broken inheritance reports at the site level. This includes
+ looking at site broken inheritance and the trustees assigned to those sites where inheritance is
+ broken so that you can remove that access in favor of providing access via group membership.
- [4.Content Job Group](/docs/accessanalyzer/11.6/solutions/sharepoint/content/overview.md)
- – Provides insight into content stored across SharePoint farms in order to help more efficiently
+ – Provides insight into content stored across SharePoint farms to help more efficiently
manage that content. It will provide information on the content taking up the most space, the
- content that has not been accessed for extended periods of time, and additional data describing
+ content that hasn't been accessed in a long time, and additional data describing
SharePoint content and the configuration of the repositories such as lists and libraries which
store that content.
- [5.Probable Owner > SP_ProbableOwner Job](/docs/accessanalyzer/11.6/solutions/sharepoint/sp_probableowner.md)
@@ -151,12 +150,12 @@ the following job groups and jobs:
- Requires the Data Governance Sensitive Data Discovery Add-on
- [7.Activity Job Group](/docs/accessanalyzer/11.6/solutions/sharepoint/activity/overview.md)–
- Generates summary and detail reports of SharePoint activity on the specified sites. These reports
- can be used for identifying file, folder, and user related activity across your SharePoint
+ Generates summary and detail reports of SharePoint activity on the specified sites. Use these
+ reports to identify file, folder, and user related activity across your SharePoint
environment.
- [8.M365 Job Group](/docs/accessanalyzer/11.6/solutions/sharepoint/m365/overview.md)
- – Generates summary and detail reports of SharePoint Activity on the specified Teams sites. These
- reports can be used for identifying file, folder, and user related activity across your SharePoint
+ – Generates summary and detail reports of SharePoint Activity on the specified Teams sites. Use
+ these reports to identify file, folder, and user related activity across your SharePoint
environment.
- [Effective Access Audits Job Group](/docs/accessanalyzer/11.6/solutions/sharepoint/effectiveaccessaudits/overview.md)
– Returns reports identifying specific trustees’ effective access across the entire SharePoint
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/recommended.md b/docs/accessanalyzer/11.6/solutions/sharepoint/recommended.md
index 61e49cebe4..caeadaf80d 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/recommended.md
@@ -13,9 +13,9 @@ directly or scheduled.
**Dependencies**
-- The **.Active Directory Inventory** Job Group needs to be executed prior to running the SharePoint
+- The **.Active Directory Inventory** Job Group needs to be executed before running the SharePoint
Solution against a SharePoint on-premises environment
-- The **.Entra ID Inventory** Job Group needs to be executed prior to running the SharePoint
+- The **.Entra ID Inventory** Job Group needs to be executed before running the SharePoint
Solution against a SharePoint Online environment
- For Agent-based scans, the SharePoint Agent must be installed on the application server (for
Access Auditing & Sensitive Data Discovery Auditing only)
@@ -24,7 +24,7 @@ directly or scheduled.
- The Sensitive Data Discovery Add-on must be installed on the SharePoint application server (for
Sensitive Data Discovery Auditing with agent-based scans only)
-**Targeted Host(s)**
+**Targeted Hosts**
For the 0.Collection Job Group:
@@ -43,24 +43,24 @@ topic for additional information.
**Connection Profile**
-The SPAA Data Collector requires a specific set of permissions. See the
+The SharePoint Access Auditor (SPAA) Data Collector requires a specific set of permissions. See the
[SharePoint Scan Options](/docs/accessanalyzer/11.6/requirements/sharepoint/scanoptions/scanoptions.md)
and
[SharePoint Support](/docs/accessanalyzer/11.6/requirements/sharepoint/sharepoint/sharepoint.md)
topics for the necessary permissions for both on-premises and online target environments. Then
create a custom Connection Profile containing the appropriate credentials for the targeted
-environment. If a single Connection Profile contains both on-premises and online credentials, it is
-necessary for the online credentials to be above the on-premises credentialss in the Connection
-Profile credentials list.
+environment. If a single Connection Profile contains both on-premises and online credentials, the
+online credentials must appear above the on-premises credentials in the Connection Profile
+credentials list.
The Connection Profile should be assigned under the **SharePoint** > **0.Collection** >
**Settings** > **Connection** node. It is set to **Use the Default Profile**, as configured at the
global settings level. However, since this may not be the Connection Profile with the necessary
-permissions for the assigned hosts, select the the **Select one of the following user defined
-profiles** option and select the appropriate Connection Profile from the drop-down menu.
+permissions for the assigned hosts, select the **Select one of the following user defined
+profiles** option and select the appropriate Connection Profile from the dropdown menu.
The jobs within the 5.Effective Access Audits Job Group import CSV files from the jobs’ directories
-using the TextSearch Data Collector. Therefore, it is necessary to assign a Connection Profile with
+using the TextSearch Data Collector. Therefore, assign a Connection Profile with
rights on the Enterprise Auditor Console server to access the CSV file saved in the job’s directory.
The Connection Profile can be set at either the **Effective Access Audits** > **Settings** >
**Connection** node (applies to both jobs) or in the job’s Properties window on the Connection tab.
@@ -75,21 +75,21 @@ The jobs in this job group can be scheduled to run as desired.
**Run Order**
-The 0.Collection Jobs must be run first and in order. RunSystem Scans jobs and then the Bulk Import
-jobs according to the desired workflow. The other SharePoint Solution sub-job groups can be run in
+The 0.Collection Jobs must be run first and in order. Run System Scans jobs and then the Bulk Import
+jobs according to your workflow. The other SharePoint Solution sub-job groups can be run in
any order, together or individually, after running the 0.Collection Job Group. It is recommended to
run at the sub-job group level. The SP_Overview Job pulls information from both the 0.Collection Job
Group and the other sub-job groups, and the report may contain blank sections if only select sub-job
groups are run.
-The Access Information Center requires the execution of the 2-SPAA_BulkImport Job default analysis
-tasks in order for permission/access reports to be accessible. For activity reports, the Access
-Information Center requires the execution of both the 2-SPAA Bulk Import Job default analysis tasks
-and the 2-SPAC Bulk Import Job default analysis tasks.
+The Access Information Center requires the 2-SPAA_BulkImport Job default analysis tasks to run
+before permission and access reports become accessible. For activity reports, the Access
+Information Center requires both the 2-SPAA Bulk Import Job default analysis tasks and the 2-SPAC
+Bulk Import Job default analysis tasks to run.
:::info
If only conducting one or two types of auditing, scope the solution by disabling
-the undesired collection jobs. Disabling them allows the solution to run more efficiently. It is not
+the undesired collection jobs. Disabling them allows the solution to run more efficiently. It isn't
recommended to delete any jobs. See the
[Disable or Enable a Job](/docs/accessanalyzer/11.6/admin/jobs/job/disableenable.md)
topic for additional information.
@@ -101,7 +101,7 @@ topic for additional information.
This solution can be run with the default query configuration. However, the most common
customizations include:
-- If using agent-based scanning, it is necessary to enable the agent services on the SharePoint
+- If using agent-based scanning, enable the agent services on the SharePoint
Access Auditor Data Collector Wizard pages:
- Agent Settings page, enable agent service scans:
@@ -163,7 +163,7 @@ This solution should be run with the default analysis configuration. Most of the
are preconfigured. There are a few which are deselected by default, as they are for troubleshooting
purposes.
-Though the analysis tasks should not be deselected, the following parameters can be modified:
+Though the analysis tasks shouldn't be deselected, the following parameters can be modified:
- Stale File is defined by default to 365 days
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/sp_brokeninheritance.md b/docs/accessanalyzer/11.6/solutions/sharepoint/sp_brokeninheritance.md
index 181eeb637b..7537e7ae5d 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/sp_brokeninheritance.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/sp_brokeninheritance.md
@@ -6,11 +6,10 @@ sidebar_position: 50
# 3.Broken Inheritance > SP_BrokenInheritance Job
-Keeping track of directly applied permissions at mass is not realistic, the SP_BrokenInheritance job
-is responsible for performing data analysis and generating SharePoint broken inheritance reports at
-the site level. This includes looking at site broken inheritance and the trustees who are assigned
-to those sites where inheritance is broken so that you can remove that access in favor of providing
-access via group membership.
+Tracking directly applied permissions at scale isn't realistic. The SP_BrokenInheritance job
+analyzes data and generates SharePoint broken inheritance reports at the site level, showing site
+broken inheritance and the trustees assigned to those sites where inheritance is broken. Use this
+report to remove that access and grant access through group membership instead.
@@ -22,7 +21,7 @@ Navigate to the **Jobs** > **SharePoint** > **3.Broken Inheritance** > **SP_Brok
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -45,4 +44,4 @@ inheritance, the SP_BrokenInheritance Job produces the following pre-configured
| Report | Description | Default Tags | Report Elements |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Broken Inheritance | This job is responsible for performing data analysis and generating SharePoint direct permission reports at the site level. This includes looking at site broken inheritance and the trustees who are assigned to those sites where inheritance is broken. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 site collections by resources with permission changes
- Table – Provides a site collection summary
- Table – Provides broken inheritance details
|
+| Broken Inheritance | This job analyzes data and generates SharePoint direct permission reports at the site level. It shows site broken inheritance and the trustees assigned to those sites where inheritance is broken. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 site collections by resources with permission changes
- Table – Provides a site collection summary
- Table – Provides broken inheritance details
|
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/sp_openaccess.md b/docs/accessanalyzer/11.6/solutions/sharepoint/sp_openaccess.md
index dd39f7bc77..b7cc2b8f30 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/sp_openaccess.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/sp_openaccess.md
@@ -7,17 +7,16 @@ sidebar_position: 40
# 2.High Risk Sites > SP_OpenAccess Job
The 2.High Risk Sites Job Group provides insight into any high risk repositories and high risk data
-that may exist within the targeted SharePoint environment. High risk data is effectively open to the
-entire organization through modification of SharePoint permissions to apply well known security
-principals such as NT AUTHORITY\Authenticated Users. The data must be monitored closely because of
-its exposure.
+that may exist within the targeted SharePoint environment. Modifying SharePoint permissions to apply
+broad security principals, such as NT AUTHORITY\Authenticated Users, can leave high risk data
+effectively open to the entire organization. Monitor this data closely because of its exposure.
The job group is comprised of the SP_OpenAccess Job. Minimizing your attack surface is the goal.
Open site collections can potentially provide access to privileged data, greatly increasing your
-vulnerability. The SP_OpenAccess Job will identify places in the environment where data is able to
-be accessed by a very large amount of employees.
+vulnerability. The SP_OpenAccess Job identifies places in the environment where a large number of
+employees can access data.
It is dependent on data collected by the
[SharePoint Access Auditing](/docs/accessanalyzer/11.6/solutions/sharepoint/collection/overview.md#sharepoint-access-auditing)
@@ -32,7 +31,7 @@ Navigate to the **Jobs** > **SharePoint** > **2.High Risk Sites** > **SP_OpenAcc
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/sp_overview.md b/docs/accessanalyzer/11.6/solutions/sharepoint/sp_overview.md
index 10a3f0f314..367d69a612 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/sp_overview.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/sp_overview.md
@@ -6,9 +6,8 @@ sidebar_position: 120
# SP_Overview Job
-The SP_Overview job provides an overview of the SharePoint Environment, providing a high level view
-into what makes up a SharePoint Environment and the types of security risks and toxic permissions
-found during scans.
+The SP_Overview job provides a high-level view of the SharePoint environment, including the types
+of security risks and toxic permissions found during scans.
@@ -19,7 +18,7 @@ and
[SharePoint Activity Auditing](/docs/accessanalyzer/11.6/solutions/sharepoint/collection/overview.md#sharepoint-activity-auditing)
components of the
[0.Collection Job Group](/docs/accessanalyzer/11.6/solutions/sharepoint/collection/overview.md).
-It also depends on the running of the sub-job groups within the solution. If only select sub-job
+It also depends on running the sub-job groups within the solution. If only select sub-job
groups have been run, there will be blank sections of this overview report.
## Analysis Tasks for the SP_Overview Job
@@ -28,14 +27,14 @@ Navigate to the **Jobs** > **SharePoint** > **SP_Overview** > **Configure** node
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
-The default analysis tasks is:
+The default analysis task is:
- Generate Overview – Creates an interim processing table in the database for use by downstream
analysis and report generation
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/sp_probableowner.md b/docs/accessanalyzer/11.6/solutions/sharepoint/sp_probableowner.md
index a1c84e45f1..bd948cb886 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/sp_probableowner.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/sp_probableowner.md
@@ -6,10 +6,10 @@ sidebar_position: 70
# 5.Probable Owner > SP_ProbableOwner Job
-The SP_ProbableOwner Job aids in the identification of probable owners for Site Collections and
-Sites, which can be used for entitlement reviews. Probably Owner calculation is based on file
-ownership, management structure, and file activity. The goal of this report is to help you identify
-who most likely owns the SharePoint resource or at least someone who can tell you who does.
+The SP_ProbableOwner Job identifies probable owners for Site Collections and Sites, which you can
+use for entitlement reviews. Probable Owner calculation is based on file ownership, management
+structure, and file activity. The goal of this report is to help you identify who most likely owns
+the SharePoint resource or at least someone who can tell you who does.
@@ -21,7 +21,7 @@ Navigate to the **Jobs** > **SharePoint** > **5.Probable Owner** >
**SP_ProbableOwner** >**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/sharepoint/sp_sensitivedata.md b/docs/accessanalyzer/11.6/solutions/sharepoint/sp_sensitivedata.md
index 4dfbfc5cba..576b276474 100644
--- a/docs/accessanalyzer/11.6/solutions/sharepoint/sp_sensitivedata.md
+++ b/docs/accessanalyzer/11.6/solutions/sharepoint/sp_sensitivedata.md
@@ -6,8 +6,8 @@ sidebar_position: 80
# 6.Sensitive Data > SP_SensitiveData Job
-The SP_SensitiveData Job identifies where sensitive data is located inside SharePoint farms. Special
-care is paid to access and user activity in these locations.
+The SP_SensitiveData Job identifies where sensitive data is located inside SharePoint farms. Monitor
+access and user activity in these locations closely.
@@ -19,7 +19,7 @@ Navigate to the **Jobs** > **SharePoint** > **6.Sensitive Data** > **SP_Sensitiv
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/unix/overview.md b/docs/accessanalyzer/11.6/solutions/unix/overview.md
index 69cb7c0229..c3cdf4411c 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/overview.md
@@ -29,7 +29,7 @@ topic for additional information.
**Location**
The Unix Solution requires a special Enterprise Auditor license. It can be installed from the
-Enterprise Auditor Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to
+Enterprise Auditor Instant Job Wizard. After it has been installed into the Jobs tree, navigate to
the solution: **Jobs** > **Unix**.
## Job Groups
diff --git a/docs/accessanalyzer/11.6/solutions/unix/privilegedaccess/sudoers/ux_sudoers.md b/docs/accessanalyzer/11.6/solutions/unix/privilegedaccess/sudoers/ux_sudoers.md
index 56db0346c3..e4a1a15983 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/privilegedaccess/sudoers/ux_sudoers.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/privilegedaccess/sudoers/ux_sudoers.md
@@ -15,7 +15,7 @@ Navigate to the **Unix** > **2.Privileged Access** > **Sudoers** > **UX_Sudoers*
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/unix/privilegedaccess/ux_criticalfiles.md b/docs/accessanalyzer/11.6/solutions/unix/privilegedaccess/ux_criticalfiles.md
index 3ebc2a15eb..493f38d9ca 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/privilegedaccess/ux_criticalfiles.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/privilegedaccess/ux_criticalfiles.md
@@ -11,7 +11,7 @@ Linux environments such as passwd, shadow, sudoers, hosts.deny, and more.
## Queries for the UX_CriticalFiles Job
-The UX_CriticalFIles job uses the Unix Data Collector for the following query:
+The UX_CriticalFiles job uses the Unix Data Collector for the following query:
:::warning
The query is preconfigured for this job. Never modify the query.
@@ -30,7 +30,7 @@ Navigate to the **Unix** > **2.Privileged Access** > **UX_CriticalFiles** > **Co
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/unix/recommended.md b/docs/accessanalyzer/11.6/solutions/unix/recommended.md
index 165943d1c0..3d76ecafba 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/recommended.md
@@ -6,15 +6,15 @@ sidebar_position: 10
# Recommended Configurations for the Unix Job Group
-The Unix job group has been configured by default to run with the default settings. It can be run
-directly or scheduled.
+The Unix job group is configured to run with the default settings. It can be run directly or
+scheduled.
**Dependencies**
If applicable, the **.NIS Inventory** job group can be run to enable reporting on users and groups
from NIS environments.
-**Target Host(s)**
+**Target Hosts**
All Unix Servers. Create a custom host list in Host Management that contains all Unix servers that
are in scope to be auditing with the Unix solution.
@@ -37,12 +37,12 @@ Schedule the Unix Solution or individual job groups to run as desired.
**History Retention**
-This is not supported in this job group and should be turned off.
+This isn't supported in this job group and should be turned off.
**Run at the Job Group Level**
-It is a common practice to run the job in the **1.Users and Groups** job group by running the entire
-job group, instead of the individual jobs.
+It's common practice to run the entire **1.Users and Groups** job group instead of running the
+individual jobs.
**Query Configuration**
diff --git a/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/overview.md b/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/overview.md
index 895491928e..176a67e0a1 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/overview.md
@@ -16,6 +16,6 @@ The jobs in the 0.Collection job group are:
- [UX_NFSConfiguration Job](/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/ux_nfsconfiguration.md)
– Collects NFS configuration information which will be further analyzed to identify and categorize
risk within audited Unix and Linux environments
-- [UX_NFSConfiguration Job](/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/ux_nfsconfiguration.md)
+- [UX_SambaConfiguration Job](/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/ux_sambaconfiguration.md)
– Collects Samba configuration information which will be further analyzed to identify and
categorize risk within audited Unix and Linux environments
diff --git a/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/ux_nfsconfiguration.md b/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/ux_nfsconfiguration.md
index 41c79f1ca8..b0914e55b7 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/ux_nfsconfiguration.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/ux_nfsconfiguration.md
@@ -31,7 +31,7 @@ Navigate to the **Unix** > **3.Sharing** > **0.Collection** > **UX_NFSConfigurat
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/ux_sambaconfiguration.md b/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/ux_sambaconfiguration.md
index ef8394a572..53b6aa40cd 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/ux_sambaconfiguration.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/sharing/collection/ux_sambaconfiguration.md
@@ -31,7 +31,7 @@ Navigate to the **Unix** > **3.Sharing** > **0.Collection** > **UX_SambaConfigur
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/unix/sharing/ux_nfs.md b/docs/accessanalyzer/11.6/solutions/unix/sharing/ux_nfs.md
index f26f1b02fe..1ee345894b 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/sharing/ux_nfs.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/sharing/ux_nfs.md
@@ -15,7 +15,7 @@ Navigate to the **Unix** > **3.Sharing** > **UX_NFS** > **Configure** node and s
to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/unix/sharing/ux_samba.md b/docs/accessanalyzer/11.6/solutions/unix/sharing/ux_samba.md
index bfb1e25de0..ef0ccd1f0d 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/sharing/ux_samba.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/sharing/ux_samba.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Unix** > **3.Sharing** > **UX_Sam
node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -29,7 +29,7 @@ The default analysis tasks are:
- Highlights hosts with a large number of risky shares – Creates an interim processing table in the
database for use by downstream analysis and report generation
-In addition to the tables and views created by the analysis task, the UX_NFS job produces the
+In addition to the tables and views created by the analysis task, the UX_Samba job produces the
following pre-configured report:
| Report | Description | Default Tags | Report Elements |
diff --git a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/overview.md b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/overview.md
index 7a86f35964..cbefca252c 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/overview.md
@@ -14,7 +14,7 @@ to pinpoint potential areas of administrative concern.
The jobs in the 1.Users and Groups job group are:
- [0.Collection > UX_UsersAndGroups Job](/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_usersandgroups.md)
- – Collects user and group related information from /etc/shadow and their equivalents in order to
+ – Collects user and group related information from /etc/shadow and their equivalents to
provide details on user and group conditions to help pinpoint areas of administrative concerns
- [UX_DuplicateGroups Job](/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_duplicategroups.md)
– This job identifies duplicate groups within the audited Unix or Linux environment. Duplicate
@@ -23,9 +23,9 @@ The jobs in the 1.Users and Groups job group are:
– This job identifies empty groups found within the audited Unix or Linux environment. These are
suitable candidates for consolidation or cleanup.
- [UX_LargeGroups Job](/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_largegroups.md)
- – This job identifies groups with large member counts. These types of groups may cause
- administrative overhead and burden in being able to easily understand who is getting access to
- resources, or how much access is being granted to resources through these groups.
+ – This job identifies groups with large member counts. Large groups can create administrative
+ overhead, making it difficult to see who has access to resources or how much access these groups
+ grant.
- [UX_LocalGroups Job](/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_localgroups.md)
– This job provides an overview of all local groups within the audited Unix and Linux environments
- [UX_LocalUsers Job](/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_localusers.md)
diff --git a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_duplicategroups.md b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_duplicategroups.md
index 66c97b876a..c79adb7e0b 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_duplicategroups.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_duplicategroups.md
@@ -16,7 +16,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **UX_DuplicateGroups** > **C
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_emptygroups.md b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_emptygroups.md
index 0ce1355412..739aadebdb 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_emptygroups.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_emptygroups.md
@@ -15,7 +15,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **UX_EmptyGroups** > **Confi
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_largegroups.md b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_largegroups.md
index 8202f1efd5..ff32e6a4bc 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_largegroups.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_largegroups.md
@@ -6,13 +6,13 @@ sidebar_position: 40
# UX_LargeGroups Job
-The UX_LargeGroups job identifies groups with large member counts. These types of groups may cause
-administrative overhead and burden in being able to easily understand who is getting access to
-resources, or how much access is being granted to resources through these groups.
+The UX_LargeGroups job identifies groups with large member counts. Large groups can create
+administrative overhead, making it difficult to see who has access to resources or how much access
+these groups grant.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/11.6/admin/jobs/job/overview.md#parameter-configuration)
topic for instructions on how to edit parameters on a job overview page.
@@ -28,7 +28,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **UX_LargeGroups** > **Confi
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_localgroups.md b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_localgroups.md
index 0ece7d31e2..043d721805 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_localgroups.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_localgroups.md
@@ -15,7 +15,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **UX_LocalGroups** > **Confi
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_localusers.md b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_localusers.md
index 94fce9e69e..f88e1a1ba8 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_localusers.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_localusers.md
@@ -15,7 +15,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **UX_LocalUsers** > **Config
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_passwordsettings.md b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_passwordsettings.md
index 6b45a0bd2b..f8919b601c 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_passwordsettings.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_passwordsettings.md
@@ -15,7 +15,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **UX_PasswordSettings** > **
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_usersandgroups.md b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_usersandgroups.md
index ca174a61e5..3dd926987b 100644
--- a/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_usersandgroups.md
+++ b/docs/accessanalyzer/11.6/solutions/unix/usersgroups/ux_usersandgroups.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# 0.Collection > UX_UsersAndGroups Job
The UX_UsersAndGroups job collects user and group information from /etc/passwd, /etc/shadow, and
-their equivalents in order to provide details on user and group conditions to help pinpoint
+their equivalents to provide details on user and group conditions to help pinpoint
potential areas of administrative concern.
@@ -16,7 +16,7 @@ The UX_UsersAndGroups job is located in the 0.Collection job group.
## Queries for the UX_UsersAndGroups Job
-The UX_UsersandGroups job uses the Unix Data Collector for the following queries:
+The UX_UsersAndGroups job uses the Unix Data Collector for the following queries:
:::warning
The queries are preconfigured for this job. Never modify the queries.
@@ -44,7 +44,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **0.Collection** > **UX_User
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/applications/sg_installedapplications.md b/docs/accessanalyzer/11.6/solutions/windows/applications/sg_installedapplications.md
index 09d816de26..fef61736f8 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/applications/sg_installedapplications.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/applications/sg_installedapplications.md
@@ -19,7 +19,7 @@ The query is preconfigured for this job. Never modify the query.
-The query for the SG_InstalledApplications job are:
+The query for the SG_InstalledApplications job is:
- Installed Applications – Targets all Windows servers known to Enterprise Auditor to determine
installed applications
@@ -30,7 +30,7 @@ Navigate to the **Windows** > **Applications** > **SG_InstalledApplications** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/applications/sg_runatboot.md b/docs/accessanalyzer/11.6/solutions/windows/applications/sg_runatboot.md
index c851f854f5..24a31e3b77 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/applications/sg_runatboot.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/applications/sg_runatboot.md
@@ -32,7 +32,7 @@ Navigate to the **Windows** > **Applications** > **SG_RunAtBoot** > **Configure*
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/applications/sg_scheduledtasks.md b/docs/accessanalyzer/11.6/solutions/windows/applications/sg_scheduledtasks.md
index 2ceee29617..874aed6a7e 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/applications/sg_scheduledtasks.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/applications/sg_scheduledtasks.md
@@ -30,7 +30,7 @@ Navigate to the **Windows** > **Applications** > **SG_ScheduledTasks** > **Confi
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/authentication/overview.md b/docs/accessanalyzer/11.6/solutions/windows/authentication/overview.md
index edf9e461f9..883657c646 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/authentication/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/authentication/overview.md
@@ -14,17 +14,17 @@ to help identify potential security vulnerabilities and reduce risk within the e
The jobs in the Authentication job group are:
- [SG_LSASettings Job](/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_lsasettings.md)
- – This job lists LSA settings on all targeted hosts. In particular, the RunAsPPL,
- RestrictAnonymous, and ValidateKdcPacSignature keys are examined. If these keys are not set to 1,
+ – This job lists LSA settings on all targeted hosts. In particular, the job examines the
+ RunAsPPL, RestrictAnonymous, and ValidateKdcPacSignature keys. If these keys aren't set to 1,
a host is vulnerable to mimikatz and other exploitation tools. See the Microsoft
[Configuring Additional LSA Protection](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn408187(v=ws.11))
- article for additional ininformation.
+ article for additional information.
- [SG_SecuritySupportProviders Job](/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_securitysupportproviders.md)
- – This job identifies security support providers on all targeted hosts, highlighting potentially
- malicious SSPs
+ – This job identifies security support providers (SSPs) on all targeted hosts, highlighting
+ potentially malicious SSPs
- [SG_WDigestSettings Job](/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_wdigestsettings.md)
– This job lists WDigest settings on all targeted hosts. In particular, the UseLogonCredentials
- key is examined. If the KB is not installed, and this key is not set properly for a given host,
+ key is examined. If the KB isn't installed, and this key isn't set properly for a given host,
cleartext passwords will be stored in memory. See the
[Microsoft Security Advisory](https://support.microsoft.com/en-us/help/2871997/microsoft-security-advisory-update-to-improve-credentials-protection-a)
article for more information.
diff --git a/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_lsasettings.md b/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_lsasettings.md
index eef0717ac7..a87eeb8a69 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_lsasettings.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_lsasettings.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# SG_LSASettings Job
-The SG_LASettings job lists settings on all targeted hosts. In particular, the RunAsPPL,
-RestrictAnonymous, and ValidateKdcPacSignature keys are examined. If these keys are not set to 1, a
+The SG_LSASettings job lists LSA settings on all targeted hosts. In particular, the job examines
+the RunAsPPL, RestrictAnonymous, and ValidateKdcPacSignature keys. If these keys aren't set to 1, a
host is vulnerable to mimikatz and other exploitation tools. See the Microsoft
[Configuring Additional LSA Protection](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn408187(v=ws.11))
article for additional information.
@@ -34,7 +34,7 @@ Navigate to the **Windows** > **Authentication** > **SG_LSASettings** > **Config
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -62,6 +62,6 @@ following pre-configured reports.
| Report | Description | Default Tags | Report Elements |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Additional LSA Protection | This report summarizes RunAsPPL registry settings on targeted hosts. This key governs whether or not additional LSA protection is enabled. See the Microsoft [Configuring Additional LSA Protection](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn408187(v=ws.11)) article for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays additional LSA protection by host
- Table – Provides additional LSA Protection Details
|
-| PAC Validation | This report indicates whether or not PAC Validation is enabled on all targeted hosts. This is governed by the ValidateKdcPacSignature key. Default behavior in the event of this key's absence depends on the Windows version installed. See the Microsoft [Understanding Microsoft Kerberos PAC Validation](https://learn.microsoft.com/en-gb/archive/blogs/openspecification/understanding-microsoft-kerberos-pac-validation) article for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays PAC validation status
- Table – Provides PAC validation details
|
-| Restrict Anonymous Access | This report summarizes RestrictAnonymous registry settings on targeted hosts. This key governs whether or not access over anonymous connections is enabled. See the Microsoft [Restrict Anonymous check](https://learn.microsoft.com/en-us/previous-versions/tn-archive/bb418944(v=technet.10)) article for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays anonymous access by host
- Table – Provides anonymous access details
|
+| Additional LSA Protection | This report summarizes RunAsPPL registry settings on targeted hosts. This key governs whether additional LSA protection is enabled. See the Microsoft [Configuring Additional LSA Protection](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn408187(v=ws.11)) article for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays additional LSA protection by host
- Table – Provides additional LSA Protection Details
|
+| PAC Validation | This report indicates whether PAC Validation is enabled on all targeted hosts. This is governed by the ValidateKdcPacSignature key. Default behavior if this key is absent depends on the Windows version installed. See the Microsoft [Understanding Microsoft Kerberos PAC Validation](https://learn.microsoft.com/en-gb/archive/blogs/openspecification/understanding-microsoft-kerberos-pac-validation) article for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays PAC validation status
- Table – Provides PAC validation details
|
+| Restrict Anonymous Access | This report summarizes RestrictAnonymous registry settings on targeted hosts. This key governs whether access over anonymous connections is enabled. See the Microsoft [Restrict Anonymous check](https://learn.microsoft.com/en-us/previous-versions/tn-archive/bb418944(v=technet.10)) article for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays anonymous access by host
- Table – Provides anonymous access details
|
diff --git a/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_securitysupportproviders.md b/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_securitysupportproviders.md
index 1c478940c9..827c23e3d9 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_securitysupportproviders.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_securitysupportproviders.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# SG_SecuritySupportProviders Job
-The SG_SecuritySupportProviders job identifies security support providers on all targeted hosts,
-highlighting potentially malicious SSPs.
+The SG_SecuritySupportProviders job identifies security support providers (SSPs) on all targeted
+hosts, highlighting potentially malicious SSPs.
## Queries for the SG_SecuritySupportProviders Job
@@ -31,7 +31,7 @@ Navigate to the **Windows** > **Authentication** > **SG_SecuritySupportProviders
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_wdigestsettings.md b/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_wdigestsettings.md
index 05df3e6b5a..2bb679de04 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_wdigestsettings.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/authentication/sg_wdigestsettings.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# SG_WDigestSettings Job
The SG_WDigestSettings job lists WDigest settings on all targeted hosts. In particular, the
-UseLogonCredentials key is examined. If this key is not set properly for a given host, cleartext
+UseLogonCredentials key is examined. If this key isn't set properly for a given host, cleartext
passwords will be stored in memory. See the
[Microsoft Security Advisory](https://support.microsoft.com/en-us/help/2871997/microsoft-security-advisory-update-to-improve-credentials-protection-a)
article for more information.
@@ -36,7 +36,7 @@ Navigate to the **Windows** > **Authentication** > **SG_WDigestSettings** > **Co
select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/openaccess/recommended.md b/docs/accessanalyzer/11.6/solutions/windows/openaccess/recommended.md
index 43a1433e24..17e17c635e 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/openaccess/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/openaccess/recommended.md
@@ -16,8 +16,8 @@ All Windows Servers
**Connection Profile**
-Configure a Connection Profile that is not part of the Domain Admin group. The report should be run
-with a non-privileged user account.
+Configure a Connection Profile that isn't part of the Domain Admin group. Run the report with a
+non-privileged user account.
**Schedule Frequency**
@@ -25,7 +25,7 @@ This job in this job group should be scheduled to run daily.
**Workflow**
-**Step 1 –** Configure a Connection Profile that is not part of the Domain Admin group.
+**Step 1 –** Configure a Connection Profile that isn't part of the Domain Admin group.
**Step 2 –** Assign All Windows Servers under Hosts List Assignment.
diff --git a/docs/accessanalyzer/11.6/solutions/windows/openaccess/sg_openfolders.md b/docs/accessanalyzer/11.6/solutions/windows/openaccess/sg_openfolders.md
index 86b71032d7..5c260f851f 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/openaccess/sg_openfolders.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/openaccess/sg_openfolders.md
@@ -27,9 +27,9 @@ The query for the SG_OpenFolders job is:
The OpenAccess query has been preconfigured to run with the default settings. However, the subfolder
depth can optionally be increased on the Options page in the System Info Data Collector Wizard.
-Follow the steps to customize the query. See the
+See the
[SystemInfo Data Collector](/docs/accessanalyzer/11.6/admin/datacollector/systeminfo/overview.md)
-topic for additional information.
+topic for additional information. To customize the query:
**Step 1 –** Navigate to the **Jobs** > **Windows** > **Open Access** > **SG_OpenFolders** >
**Configure** node and select **Queries**.
@@ -45,11 +45,11 @@ Wizard opens.
**Step 4 –** Navigate to the Options page and select the **Enumerate subfolders within shared
folder** checkbox and then the **Limit returned subfolders depth to** checkbox.
-**Step 5 –** Select the desired subfolders depth level using the arrows. Click **Next**.
+**Step 5 –** Select the subfolder depth level you want using the arrows. Click **Next**.
**Step 6 –** On the Summary page, click **Finish** to save the changes.
-The subfolders depth is now saved to the configured level.
+The subfolder depth is now saved to the configured level.
## Analysis Tasks for the SG_OpenFolders Job
@@ -57,7 +57,7 @@ Navigate to the **Windows** > **OpenAccess** > **SG_OpenFolders** > **Configure*
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/overview.md b/docs/accessanalyzer/11.6/solutions/windows/overview.md
index 7c2583a8e3..c0feb3e4ea 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 160
# Windows Solution
The Windows Solution is designed to provide both high-level and granular views into any sized
-organization's infrastructure. Systems are a critical business asset. In order to optimally support
-and benefit the business, these systems must be running optimally and be fully secured. The Windows
+organization's infrastructure. Systems are a critical business asset. To optimally support
+and benefit the business, these systems must run optimally and remain fully secured. The Windows
Solution allows organizations to quickly inventory, assess, and secure their Windows desktop and
server infrastructure from a central location. Key capabilities include privileged account
discovery, security configuration and vulnerability assessment, compliance reporting, and asset
@@ -30,13 +30,13 @@ topic for additional information.
The Windows Solution requires a special Enterprise Auditor license. It can be installed from the
Instant Job Wizard. See the
[Instant Job Wizard](/docs/accessanalyzer/11.6/admin/jobs/instantjobs/overview.md)
-topic for additional information. Once it has been installed in the Jobs tree, navigate to the
+topic for additional information. After it has been installed in the Jobs tree, navigate to the
solution: **Jobs** > **Windows**.
Each job group works independently from the other job groups. All of the job groups have their own
-collections that are used to analyze and report on data specific to the groups function. The
+collections that are used to analyze and report on data specific to the group's function. The
SG_SecurityAssessment job summarizes security related results from the Windows solution.
## Job Groups
@@ -64,7 +64,7 @@ The jobs and job groups in the Windows Solution are:
- [Security Utilities Job Group](/docs/accessanalyzer/11.6/solutions/windows/securityutilities/overview.md)
– This group provides a series of security element checks across the audited environment
- [SG_SecurityAssessment Job](/docs/accessanalyzer/11.6/solutions/windows/sg_securityassessment.md)
- – This job performs checks against Windows security best practices in order to proactively
+ – This job performs checks against Windows security best practices to proactively
identify critical security configurations that leave the environment vulnerable to attack. The
result is a report which provides a listing of findings by severity and category with
- corresponding details that can be used to prioritize and remediate security issues.
+ corresponding details you can use to prioritize and remediate security issues.
diff --git a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/overview.md b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/overview.md
index 07e3f6ab1a..22f3e8f48d 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/overview.md
@@ -23,5 +23,5 @@ The jobs in the Local Administrators group are:
article for additional information.
- [SG_Sessions Job](/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/sg_sessions.md)
– This job lists sessions and logged on users from all targeted hosts. These active sessions and
- logged on users may have their hashes stored in memory on the target machine, which could be
- leveraged in a Pass the Hash attack.
+ logged on users may have their hashes stored in memory on the target machine, which an attacker
+ could use in a Pass the Hash attack.
diff --git a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/sg_localadmins.md b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/sg_localadmins.md
index 0709d01d66..68dce05a4a 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/sg_localadmins.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/sg_localadmins.md
@@ -31,7 +31,7 @@ Navigate to the **Windows** > **Privileged Accounts** > **Local Administrators**
**SG_LocalAdmins** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/sg_microsoftlaps.md b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/sg_microsoftlaps.md
index 81738cbbca..c78cad3410 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/sg_microsoftlaps.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/sg_microsoftlaps.md
@@ -34,7 +34,7 @@ Navigate to the **Windows** > **Privileged Accounts** > **Local Administrators**
**SG_MicrosoftLAPS** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/sg_sessions.md b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/sg_sessions.md
index 0b0706402e..ed563b9b85 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/sg_sessions.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/localadministrators/sg_sessions.md
@@ -8,14 +8,14 @@ sidebar_position: 30
The SG_Sessions job lists sessions and logged on users from all targeted hosts. These active
sessions and logged on users may have their hashes stored in memory on the target machine, which
-could be leveraged in a Pass the Hash attack.
+an attacker could use in a Pass the Hash attack.
## Queries for the SG_Sessions Job
The SG_Sessions job uses the SystemInfo Data Collector for the following queries:
:::warning
-The queries) are preconfigured for this job. Never modify the queries.
+The queries are preconfigured for this job. Never modify the queries.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/overview.md b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/overview.md
index f0894dc66d..b3cb44c82f 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/overview.md
@@ -7,17 +7,17 @@ sidebar_position: 10
# Collection Job Group
The Collection job group collects group policy settings, local users, and local group membership
-information from Windows servers which will be further analyzed to provide insight into privileged
-users within the environment.
+information from Windows servers, then analyzes this information to provide insight into
+privileged users within the environment.
The jobs in the Collection job group are:
- [SG_GroupPolicy Job](/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_grouppolicy.md)
- – This job collects policy assignments from all targeted servers. In particular, **Allow log on
- locally**, **Log on as a batch job**, **Allow log on through Remote Desktop Services**, and **Log
- on as a service** are audited.
+ – This job collects policy assignments from all targeted servers. In particular, the job audits
+ **Allow log on locally**, **Log on as a batch job**, **Allow log on through Remote Desktop
+ Services**, and **Log on as a service**.
- [SG_LocalMembership Job](/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_localmembership.md)
– This job collects local group membership details from all targeted servers
- [SG_LocalUsers Job](/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_localusers.md)
diff --git a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_grouppolicy.md b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_grouppolicy.md
index 741ccad71d..204a4af453 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_grouppolicy.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_grouppolicy.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# SG_GroupPolicy Job
-The SG_GroupPolicy job collects policy assignments from all targeted servers. The following policy
-assignments are audited:
+The SG_GroupPolicy job collects policy assignments from all targeted servers. The job audits the
+following policy assignments:
- Allow log on locally
- Log on as a batch job
diff --git a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_localmembership.md b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_localmembership.md
index db86a0f64d..654b92108c 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_localmembership.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_localmembership.md
@@ -29,7 +29,7 @@ Navigate to the **Windows** > **Privileged Accounts** > **Logon Rights** > **Col
**SG_LocalMembership** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_localusers.md b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_localusers.md
index a8e93e159a..bbfe3ae949 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_localusers.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/sg_localusers.md
@@ -29,14 +29,14 @@ Navigate to the **Windows** > **Privileged Accounts** > **Logon Rights** > **Col
**SG_LocalUsers** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
-The default analysis tasks is:
+The default analysis task is:
- Update LocalUsers – Creates an interim processing table in the database for use by downstream
analysis and report generation
diff --git a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/overview.md b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/overview.md
index ea206adbcf..53ecedcfaf 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/overview.md
@@ -14,8 +14,8 @@ The jobs and job groups in the Logon Rights job group are:
- [Collection Job Group](/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/collection/overview.md)
– The jobs within this group collect group policy settings, local users, and local group
- membership from Windows servers which will be further analyzed to provide insight into privileged
- users within the environment
+ membership from Windows servers, then analyze this information to provide insight into
+ privileged users within the environment
- [SG_AccountPrivileges Job](/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/sg_accountprivileges.md)
– This job highlights account privileges across the audited environment, filtering out default
privileges present on Windows servers
diff --git a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/sg_accountprivileges.md b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/sg_accountprivileges.md
index b986243c9b..d26b2161b1 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/sg_accountprivileges.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/sg_accountprivileges.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# SG_AccountPrivileges Job
-The SG_AccountPrivileges job identifies accounts privileges on hosts in the targeted environment.
+The SG_AccountPrivileges job identifies account privileges on hosts in the targeted environment.
**Targeted Hosts**
@@ -33,7 +33,7 @@ Navigate to the **Windows** > **Privileged Accounts** > **Logon Rights** >
**SG_AccountPrivileges** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/sg_localpolicies.md b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/sg_localpolicies.md
index b011375432..499015efaf 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/sg_localpolicies.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/logonrights/sg_localpolicies.md
@@ -14,7 +14,7 @@ Navigate to the **Windows** > **Privileged Accounts** > **Logon Rights** > **SG_
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -39,6 +39,6 @@ following pre-configured reports.
| Report | Description | Default Tags | Report Elements |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Local Account Network Access | This report highlights whether or not the **Local accounts** and **Local account and member of Administrators group** principals can be used to access a given host across the network. | None | This report is comprised of two elements: - Stacked Bar Chart – Displays a local accounts access enterprise summary
- Table – Provides local account network access details
|
-| Local Security Policies | This report identifies effective local security policy assignments. In particular, **Allow log on locally**, **Log on as a batch job**, **Allow log on through Remote Desktop Services**, and **Log on as a service** are considered. Special attention is paid to policies with a large number of trustee assignments. It displays Largest Policies by Number of Domain User Accounts in a graph format, and Trustee Details in a table format. | GDPR, SOX, HIPAA, PCI-DSS, GLBA, ITAR, FERPA, FISMA, ISO27001 | This report is comprised of three elements: - Stacked Bar Chart – Displays largest policies by number of domain user accounts
- Table – Provides details largest policies by number of domain user accounts
- Table – Provides trustee details
|
+| Local Account Network Access | This report highlights whether the **Local accounts** and **Local account and member of Administrators group** principals can access a given host across the network. | None | This report is comprised of two elements: - Stacked Bar Chart – Displays a local accounts access enterprise summary
- Table – Provides local account network access details
|
+| Local Security Policies | This report identifies effective local security policy assignments. In particular, the report considers **Allow log on locally**, **Log on as a batch job**, **Allow log on through Remote Desktop Services**, and **Log on as a service**. Special attention is paid to policies with a large number of trustee assignments. It displays Largest Policies by Number of Domain User Accounts in a graph format, and Trustee Details in a table format. | GDPR, SOX, HIPAA, PCI-DSS, GLBA, ITAR, FERPA, FISMA, ISO27001 | This report is comprised of three elements: - Stacked Bar Chart – Displays largest policies by number of domain user accounts
- Table – Provides details largest policies by number of domain user accounts
- Table – Provides trustee details
|
| Privileged Accounts | This report highlights user accounts with a large number of rights. | None | This report is comprised of two elements: - Stacked Bar Chart – Displays top trustees by logon rights
- Table – Provides details on all trustees
|
diff --git a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/recommended.md b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/recommended.md
index ff4d781aa5..2116421198 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/recommended.md
@@ -9,8 +9,8 @@ sidebar_position: 10
**Dependencies**
- SG_AccountPrivileges – To populate the Local Administrator column, which is hidden by default, the
- SG_LocalAdmins job must be run prior to running this job
-- The **Logon Rights** > **Collection** job group must be run prior to running the SG_LocalPolicies
+ SG_LocalAdmins job must be run before running this job
+- The **Logon Rights** > **Collection** job group must be run before running the SG_LocalPolicies
job
**Targeted Hosts**
@@ -20,7 +20,7 @@ All Windows Servers (No DCs) for:
- Local Administrator job group
- Logon Rights job group
-All Window Hosts for:
+All Windows Hosts for:
- Service Accounts job group
@@ -35,11 +35,11 @@ Domain Admin privileges if targeting domain controllers.
- Assign the appropriate target host list under Hosts List Assignment for each job group
-**Step 2 –** Prerequisite: Ensure that the .Active Directory Inventory job group has successfully
-run prior to running this job group.
+**Step 2 –** Prerequisite: Ensure that the Active Directory Inventory job group has successfully
+run before running this job group.
**Step 3 –** Schedule the Privileged Accounts job group or the individual job groups within the
-Privleged Accounts job group to run as desired.
+Privileged Accounts job group to run as desired.
**Step 4 –** Review the reports generated by the jobs.
diff --git a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/sg_serviceaccounts.md b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/sg_serviceaccounts.md
index 5e82f74756..e8479fd6ef 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/sg_serviceaccounts.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/privilegedaccounts/sg_serviceaccounts.md
@@ -11,7 +11,7 @@ servers, identifying password age and settings.
-The SG_ServiceAccounts job is located in the Service Account job group.
+The SG_ServiceAccounts job is located in the Service Accounts job group.
## Queries for the SG_ServiceAccounts Job
@@ -38,7 +38,7 @@ Navigate to the **Jobs** > **Windows** > **Privileged Accounts** > **Service Acc
**SG_ServiceAccounts** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/recommended.md b/docs/accessanalyzer/11.6/solutions/windows/recommended.md
index ce0faf0913..286a12c792 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/recommended.md
@@ -8,7 +8,7 @@ sidebar_position: 10
**Dependencies**
-The .Active Directory Inventory job group needs to be executed prior to running the Windows
+The Active Directory Inventory job group needs to be executed before running the Windows
Solution.
See individual sub-groups and jobs for the dependencies.
@@ -33,8 +33,8 @@ otherwise.
**Additional Notes**
Some jobs in the Windows Job Group use custom SQL scripts to render views on collected data. SQL
-views are used to populate report element tables and graphs. Changing or modifying the group, job,
-or tables names will result in no data displayed within the reports.
+views are used to populate report element tables and graphs. Changing the group, job,
+or table names will result in no data displayed within the reports.
See the Recommended Configurations topic for each job group for additional information on frequency
and job group settings.
diff --git a/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/overview.md b/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/overview.md
index b44fab30e6..31cb549319 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/overview.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# OpenPortScan Job Group
-The OpenPortScan job group reveals all open ports along with the associated executable on the
-targeted systems leveraging the jobs within this group. This is accomplished through remotely
-executing a netstat command on the target hosts and collecting the results for reporting.
+The OpenPortScan job group reveals all open ports and the associated executable on the targeted
+systems by remotely executing a netstat command on the target hosts and collecting the results for
+reporting.
@@ -22,6 +22,6 @@ The jobs in the OpenPortScan job group are:
- [RemoteOpenPort Job](/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/remoteopenport.md)
– This job remotely executes `netstat -a -b -n` command to gather information about the available
- port on the targeted hosts
+ ports on the targeted hosts
- [RetrieveNetstat Job](/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/retrievenetstat.md)
- – This job reveals all open ports along with the associated executable on targeted systems
+ – This job reveals all open ports along with the associated executable on targeted systems
diff --git a/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/remoteopenport.md b/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/remoteopenport.md
index 76bf2a87fa..e81a6996fc 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/remoteopenport.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/remoteopenport.md
@@ -31,7 +31,7 @@ Navigate to the **Windows** > **Security Utilities** > **OpenPortScan** > **Remo
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/retrievenetstat.md b/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/retrievenetstat.md
index 9819b68ce6..2e4484f6cd 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/retrievenetstat.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/retrievenetstat.md
@@ -11,7 +11,7 @@ systems.
## Queries for the RetrieveNetstat Job
-The RetrieveNetstat job is uses the TextSearch Data Collector for the following query:
+The RetrieveNetstat job uses the TextSearch Data Collector for the following query:
:::warning
The query is preconfigured for this job. Never modify the query.
@@ -31,7 +31,7 @@ Navigate to the **Windows** > **Security Utilities** > **OpenPortScan** > **Retr
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -43,9 +43,9 @@ The default analysis tasks are:
- **1. NETSTAT Result** – Creates the SA_RetrieveNetstat_NETSTAT table accessible under the job’s
Results node
-In addition to the tables and views created by the analysis tasks, the EX_DeliveryTimes job produces
+In addition to the tables and views created by the analysis tasks, the RetrieveNetstat job produces
the following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| --------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------- |
-| Network Ports (Open Ports Report) | This job is designed to report on all available ports on the targeted host. It will bring back the results of a `Netstat -b -a`. | None | This report is comprised of one element: - Table – Provides details on open ports
|
+| Network Ports (Open Ports Report) | This job reports on all available ports on the targeted host, returning the results of a `Netstat -b -a` command. | None | This report is comprised of one element: - Table – Provides details on open ports
|
diff --git a/docs/accessanalyzer/11.6/solutions/windows/securityutilities/overview.md b/docs/accessanalyzer/11.6/solutions/windows/securityutilities/overview.md
index 9a07985b8d..5674810a48 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/securityutilities/overview.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/securityutilities/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# Security Utilities Job Group
-The Security Utilities job group is designed to reveal all open ports along with the associated
+The Security Utilities job group reveals all open ports along with the associated
executable on the targeted systems. The job remotely executes a netstat command on the target hosts
and collects the results for reporting.
@@ -15,9 +15,9 @@ and collects the results for reporting.
The jobs and job groups in the Security Utilities job group are:
- [OpenPortScan Job Group](/docs/accessanalyzer/11.6/solutions/windows/securityutilities/openportscan/overview.md)
- – Reveals all open ports along with the associated executable on the targeted systems leveraging
- the jobs within this group. This is accomplished through remotely executing a netstat command on
- the target hosts and collecting the results for reporting.
+ – Reveals all open ports along with the associated executable on the targeted systems using
+ the jobs within this group. It remotely executes a netstat command on
+ the target hosts and collects the results for reporting.
- [SG_PowerShellCommands Job](/docs/accessanalyzer/11.6/solutions/windows/securityutilities/sg_powershellcommands.md)
- – This job highlights instances where suspicious PowerShell commands have been found in a host’s
+ – This job highlights suspicious PowerShell commands found in a host’s
PowerShell log
diff --git a/docs/accessanalyzer/11.6/solutions/windows/securityutilities/recommended.md b/docs/accessanalyzer/11.6/solutions/windows/securityutilities/recommended.md
index 53cdc89888..7401279cf5 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/securityutilities/recommended.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/securityutilities/recommended.md
@@ -8,12 +8,12 @@ sidebar_position: 10
**Dependencies**
-The RemoteOpenPort job must be must be successfully run prior to running the RetrieveNetstat job.
+The RemoteOpenPort job must be successfully run before running the RetrieveNetstat job.
**Targeted Hosts**
- OpenPortScan Job Group – There is no assigned host list for this job group. Configure a host list
- with any desired systems to be audited prior to running this job group. Both jobs in the
+ with any desired systems to be audited before running this job group. Both jobs in the
OpenPortScan job group need to be assigned the same target host list.
- SG_PowerShellCommands – All Windows Servers (No DCs)
@@ -30,7 +30,7 @@ This job group can be scheduled to run as desired.
**Step 1 –** Ensure that the configured Connection Profile has local administrator privileges and
Domain Admin privileges if targeting domain controllers.
-**Step 2 –** Configure target hosts prior to running this job group.
+**Step 2 –** Configure target hosts before running this job group.
**Step 3 –** Remotely execute a netstat command on the target hosts.
diff --git a/docs/accessanalyzer/11.6/solutions/windows/securityutilities/sg_powershellcommands.md b/docs/accessanalyzer/11.6/solutions/windows/securityutilities/sg_powershellcommands.md
index e684ac2fd6..044366a4d7 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/securityutilities/sg_powershellcommands.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/securityutilities/sg_powershellcommands.md
@@ -33,8 +33,8 @@ The queries for the SG_PowerShellCommands job are:
### Configure the Check PowerShell log Query
-The Check PowerShell log query has been preconfigured to run with the default settings. However, the
-new criteria can optionally be added on the Criteria page in the Smart Log Data Collector Wizard.
+The Check PowerShell log query has been preconfigured to run with the default settings. However, you
+can add new criteria on the Criteria page in the Smart Log Data Collector Wizard.
**Step 1 –** Navigate to the **Jobs** > **Windows** > **Security Utilities** >
**SG_PowerShellCommands** > **Configure** node and select **Queries**. Select the **Check PowerShell
@@ -53,7 +53,7 @@ is accessible.
**Step 5 –** On the Criteria page, click the **press the button to add a new condition** box.
-**Step 6 –** Enter the desired conditions.
+**Step 6 –** Enter the conditions you want.
**Step 7 –** Click **Next** to navigate to the Summary page and click **Finish**.
@@ -65,7 +65,7 @@ View the analysis tasks by navigating to the **Windows** > **Security Utilities*
**SG_PowerShellCommands** > **Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -79,7 +79,7 @@ The default analysis tasks are:
- Summarize PowerShell commands – Creates the SA_PowerShellCommands_HostSummary table accessible
under the job’s Results node
-The optional analysis tasks is:
+The optional analysis task is:
- Notify on suspicious commands – Enable this analysis task and the select Analysis Configuration to
open the Notification Data Analysis Module Wizard to configure it to send notifications on
@@ -87,17 +87,17 @@ The optional analysis tasks is:
[Configure the Notify on Suspicious Commands Analysis Task](#configure-the-notify-on-suspicious-commands-analysis-task)
topic for additional information.
-In addition to the tables and views created by the analysis tasks, the EX_DeliveryTimes job produces
+In addition to the tables and views created by the analysis tasks, the SG_PowerShellCommands job produces
the following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Suspicious PowerShell Commands | This report highlights instances where suspicious PowerShell commands have been found in a host's PowerShell log. | None | This report is comprised of three elements: - Bar Chart – Displays suspicious commands by host
- Table – Provides details on suspicious commands by host
- Table – Provides command details
|
+| Suspicious PowerShell Commands | This report highlights suspicious PowerShell commands found in a host's PowerShell log. | None | This report is comprised of three elements: - Bar Chart – Displays suspicious commands by host
- Table – Provides details on suspicious commands by host
- Table – Provides command details
|
### Configure the Notify on Suspicious Commands Analysis Task
-Follow these steps to configure the notification analysis task.
+To configure the notification analysis task:
**Step 1 –** Navigate to the **Jobs** > **Windows** > **Security Utilities** >
**SG_PowerShellCommands** > **Configure** node and select **Analysis**.
@@ -107,14 +107,14 @@ task and click **Analysis Configuration**. The Notification Data Analysis Module
-**Step 3 –** Use the **Next** button to navigate to the SMTP page. Do not make changes to the
+**Step 3 –** Use the **Next** button to navigate to the SMTP page. Don't make changes to the
preceding pages.
**Step 4 –** In the Recipients section, provide the email addresses or distribution lists (fully
-qualified address) for those who are to receive this notification. Multiple addresses can be
-provided. You can use the following options:
+qualified address) for the people who receive this notification. You can provide multiple
+addresses. You can use the following options:
- Add – Add an email address to the E-mail field
- Remove – Remove an email address from the Recipients list
@@ -123,16 +123,16 @@ provided. You can use the following options:
-**Step 5 –** In the Message section, edit the **Subject**. It is not recommended to remove any
+**Step 5 –** In the Message section, edit the **Subject**. Don't remove any
parameters. Then, customize the email content in the textbox to provide an explanation of the
notification to the recipients.
-**Step 6 –** To save these configuration changes, use the **Next** to navigate to the Summary page.
-Do not make changes to any other pages. Click **Finish**. The Notification Data Analysis Module
+**Step 6 –** To save these configuration changes, use the **Next** button to navigate to the Summary page.
+Don't make changes to any other pages. Click **Finish**. The Notification Data Analysis Module
window closes.
**Step 7 –** This notification analysis task is now configured to send emails. In the Analysis
-Selection view, select this task so that notifications can be sent automatically during the
-execution of the SG_PowerShellCommands job.
+Selection view, select this task so that the SG_PowerShellCommands job sends notifications
+automatically when it runs.
The Notify on suspicious commands analysis task is now configured to send notifications.
diff --git a/docs/accessanalyzer/11.6/solutions/windows/sg_securityassessment.md b/docs/accessanalyzer/11.6/solutions/windows/sg_securityassessment.md
index 9fe42c062e..c8d41d1e5b 100644
--- a/docs/accessanalyzer/11.6/solutions/windows/sg_securityassessment.md
+++ b/docs/accessanalyzer/11.6/solutions/windows/sg_securityassessment.md
@@ -6,10 +6,10 @@ sidebar_position: 70
# SG_SecurityAssessment Job
-The SG_SecurityAssessment job performs checks against Windows security best practices in order to
+The SG_SecurityAssessment job performs checks against Windows security best practices to
proactively identify critical security configurations that leave the environment vulnerable to
attack. The result is a report which provides a listing of findings by severity and category with
-corresponding details that can be used to prioritize and remediate security issues.
+corresponding details you can use to prioritize and remediate security issues.
@@ -64,7 +64,7 @@ Navigate to the **Windows** > **SG_SecurityAssessment** > **Configure** node and
to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -81,4 +81,4 @@ produces the following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| --------------------------- | ------------------------------------------------------------------------------ | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Systems Security Assessment | This report summarizes security related results from the Windows solution set. | GDPR, SOX, PCI, HIPAA | This report is comprised of four elements: - Pie Chart – Displays a findings by severity
- Table – Provides scope of audit details
- Table – Displays details on security assessment results
- Table – Provides details on findings by category
|
+| Systems Security Assessment | This report summarizes security related results from the Windows solution set. | GDPR, SOX, PCI, HIPAA | This report is comprised of four elements: - Pie Chart – Displays findings by severity
- Table – Provides scope of audit details
- Table – Displays details on security assessment results
- Table – Provides details on findings by category
|
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/computerdetails.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/computerdetails.md
index 2996c81406..1e12ebe199 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/computerdetails.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/computerdetails.md
@@ -12,14 +12,14 @@ Use the Computers Details page to select computer attributes to change.
Highlight the attribute to edit:
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then click
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then click
the blue arrow to insert the item into the Value box. The executed action replaces the AD Object
property with the specified value from the source table.
- Add Attribute – Adds a custom attribute to the Computer Details attribute list
- Remove Attribute – Removes a selected attribute Computer Details attribute list
- Edit Attribute – Click this icon to change the name of the selected custom attribute
-- Import Attribute – Opens the Import Custom Attributes Import Wizard where one or more custom
- attributes can be imported. See the
+- Import Attribute – Opens the Import Custom Attributes Import Wizard, where you can import one or
+ more custom attributes. See the
[Custom Attribute Import Wizard](#custom-attribute-import-wizard) topic for additional
information.
- Value – This field contains selections from the Insert field. If the Manager attribute is
@@ -39,7 +39,7 @@ to use the Custom Attributes Import Wizard.
**Step 2 –** On the Credentials page, identify a domain either by entering one manually or selecting
-one from the **Domain Name** drop-down menu which displays a list of domains trusted by the one in
+one from the **Domain Name** dropdown menu which displays a list of domains trusted by the one in
which the Access Analyzer Console server resides. Then set the credentials for reading the
attributes list from the domain:
@@ -52,11 +52,11 @@ attributes list from the domain:
**Step 4 –** The wizard populates available attributes from the domain specified on the Attributes
-page. Expand the desired object class and select the checkboxes for the custom attributes to be
+page. Expand the object class you want and select the checkboxes for the custom attributes to be
imported. Then click **Next**.
**Step 5 –** On the Completion page, click **Finish**.
-The selected attributes have been added to the attribute list on the Computer Details page.
+The wizard adds the selected attributes to the attribute list on the Computer Details page.
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/creategroups.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/creategroups.md
index 13ec1b3eee..5712c06327 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/creategroups.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/creategroups.md
@@ -12,12 +12,12 @@ Use the Create Groups page to configure the action to create groups on the selec
Use the following options to configure the action:
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then,
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then,
click the blue arrow to insert the item into the OU, Group name, or Group name (pre Windows 2000)
boxes.
- OU – The organizational unit that contains the group
- - Create target OU location if it does not already exist – Select this checkbox to create the
+ - Create target OU location if it doesn't already exist – Select this checkbox to create the
target OU
- Group Name – The name of the group that being created. This field is required.
@@ -27,10 +27,10 @@ Use the following options to configure the action:
- Universal
- Global
- DomainLocal
- - SqlField – Enter a value from the drop-down list
+ - SqlField – Enter a value from the dropdown list
- Group type – The type of group being created. Select from the following:
- Security
- Distribution
- - SqlField – Enter a value from the drop-down list
+ - SqlField – Enter a value from the dropdown list
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/createusers.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/createusers.md
index 5a170dfdbb..7ec3ed3806 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/createusers.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/createusers.md
@@ -12,11 +12,11 @@ Use the Create Users page to create users on the selected target.
Use the following options to configure the action:
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then,
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then,
click the blue arrow to insert the item into the selected box.
- OU – The organizational unit in which to create the user
- - Create target OU location if it does not already exist - Select this checkbox to create the
+ - Create target OU location if it doesn't already exist - Select this checkbox to create the
target OU.
- First Name – The first name of the user being created
@@ -31,6 +31,6 @@ Optionally, select from the following checkboxes:
- User must change password at next logon – Require the user to change the password at the next
logon
-- User cannot change password
+- User can't change password
- Password never expires
- Account is disabled
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/disableenablecomputers.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/disableenablecomputers.md
index 97f9dfb7f6..1e3504c4eb 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/disableenablecomputers.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/disableenablecomputers.md
@@ -11,7 +11,7 @@ options on target computers.
-Select the radio button for the desired option:
+Select the radio button for the option you want:
- Enable – Enables users' operation options
- Disable – Disables users' operation options
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/disableenableusers.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/disableenableusers.md
index a0f4b53c81..eb2cb44a7c 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/disableenableusers.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/disableenableusers.md
@@ -10,7 +10,7 @@ Use the Disable/Enable Users page to enable or disable target users.
-Select the radio button for the desired option:
+Select the radio button for the option you want:
- Disable – Select this radio button to disable users' operation options
- Enable – Select this radio button to enable users' operation options
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/groupdetails.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/groupdetails.md
index a1ebd6aff8..4a777f8c92 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/groupdetails.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/groupdetails.md
@@ -18,13 +18,13 @@ The options at the bottom of the page vary based on the highlighted attribute.
:::
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then,
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then,
click the blue arrow to insert the item into the Value box.
- Add Attribute – Adds a custom attribute to the Computer Details attribute list
- Remove Attribute – Removes a selected attribute from the action
- Edit Attribute – Click this icon to change the name of the selected custom attribute
-- Import Attribute – Opens the Import Custom Attributes Import Wizard where current attributes for
- an object is viewed and can be imported for editing. See the
+- Import Attribute – Opens the Import Custom Attributes Import Wizard, where you can view and import
+ current attributes for an object for editing. See the
[Custom Attribute Import Wizard](#custom-attribute-import-wizard) topic for additional
information.
- Value/Name – This field derives its name from selections made on the page. It can contain
@@ -45,7 +45,7 @@ to use the Custom Attributes Import Wizard.
**Step 2 –** On the Credentials page, identify a domain either by entering one manually or selecting
-one from the **Domain Name** drop-down menu which displays a list of domains trusted by the one in
+one from the **Domain Name** dropdown menu which displays a list of domains trusted by the one in
which the Access Analyzer Console server resides. Then set the credentials for reading the
attributes list from the domain:
@@ -58,11 +58,11 @@ attributes list from the domain:
**Step 4 –** The wizard populates available attributes from the domain specified on the Attributes
-page. Expand the desired object class and select the checkboxes for the custom attributes to be
+page. Expand the object class you want and select the checkboxes for the custom attributes to be
imported. Then click **Next**.
**Step 5 –** On the Completion page, click **Finish**. On the Completion page, click **Finish**.
-The selected attributes have been added to the attribute list on the Group Details page.
+The wizard adds the selected attributes to the attribute list on the Group Details page.
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/groupmembership.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/groupmembership.md
index 6751f120cd..c3d38d3cad 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/groupmembership.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/groupmembership.md
@@ -6,14 +6,14 @@ sidebar_position: 80
# Group Membership
-Use the Groups Membership page to add or remove group members. Values from the source table can also
-be used to specify if the object will be added or removed.
+Use the Groups Membership page to add or remove group members. You can also use values from the
+source table to specify whether the action adds or removes the object.
Use the following options to configure the action:
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then,
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then,
click the blue arrow to insert the item into the selected box.
- Select one of the following:
@@ -22,18 +22,18 @@ Use the following options to configure the action:
- OU – The organizational unit that contains the group. This field is required.
- - Create target OU location if it does not already exist – Select this checkbox to create the
+ - Create target OU location if it doesn't already exist – Select this checkbox to create the
target OU.
- Group (CN, not a pre-Windows 2000 name) – The group to create. This field is required.
- - Create target Group if it does not already exist
+ - Create target Group if it doesn't already exist
- Select one of the following:
- Add members
- Remove members
- - Add/Remove members – Enables the ChangeType Column drop down list
+ - Add/Remove members – Enables the ChangeType Column dropdown list
- ChangeType Column – The value to use from the source table to specify if the object is added or
removed. The contents of the ChangeType column should be a 0 for Add or a 1 for Remove.
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/moveobjects.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/moveobjects.md
index 91bd31f911..edf65ad5b0 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/moveobjects.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/moveobjects.md
@@ -13,8 +13,8 @@ Use the Move Objects page to specify the OU in which to move objects.
Use the following options to configure the action:
- Insert Field – Contains available values from populated from the source table
-- OU – Use the drop-down list to select a field (column) from the source table. Then, click the blue
+- OU – Use the dropdown list to select a field (column) from the source table. Then, click the blue
arrow to insert the item into the OU box.
- - Create target OU location if it does not already exist – Select this checkbox to create the
+ - Create target OU location if it doesn't already exist – Select this checkbox to create the
target OU
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/operations.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/operations.md
index dbb7a607b6..711fba3f05 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/operations.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/operations.md
@@ -11,7 +11,7 @@ Active Directory objects. Some operations have wizard pages to specify the confi
-The Operations drop-down menu contains the following operations:
+The Operations dropdown menu contains the following operations:
- [Clear/Set SID History ](/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/sidhistory.md)
- [Computer Details](/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/computerdetails.md)
@@ -28,7 +28,7 @@ The Operations drop-down menu contains the following operations:
- [Unlock Users ](#unlock-users)
- [Users Details ](/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/usersdetails.md)
-Select an operation from the drop-down list and then click **Add**. The selection appears in the
+Select an operation from the dropdown list and then click **Add**. The selection appears in the
Selections pane as well as the navigation pane if there is an associated configuration page. If
performing multiple operations, the action executes the operations in the order in which they appear
here. To change the order, select an operation and use the **Down** and **Up** buttons.
@@ -36,20 +36,20 @@ here. To change the order, select an operation and use the **Down** and **Up** b
## Delete Objects
:::warning
-Once deleted, objects from Active Directory cannot be restored.
+Once deleted, objects from Active Directory can't be restored.
:::
Select this operation to delete objects from Active Directory, such as users, groups, or computers.
The source table determines which objects are deleted from the Active Directory. Therefore, this
-operation does not possess its own wizard window.
+operation doesn't have its own wizard window.
## Groups Remove All Members
-Select this operation to remove all members from groups located in the source table. There is not a
+Select this operation to remove all members from groups located in the source table. There isn't a
wizard window associated with this operation. No configuration is required.
## Unlock Users
-Select this operation to unlock the account of the specified users in the source table. There is not
+Select this operation to unlock the account of the specified users in the source table. There isn't
a wizard window associated with this operation. No configuration is required.
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/setresetpassword.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/setresetpassword.md
index d05f404fab..408104ddd9 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/setresetpassword.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/setresetpassword.md
@@ -12,7 +12,7 @@ Use the Set/Reset Users Password page to set or reset user passwords with the sp
Use the following options to configure the action:
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then,
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then,
click the blue arrow to insert the item into the Password box.
- Password – The field with the passwords to set or reset. This field is required.
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/sidhistory.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/sidhistory.md
index 32f34e201f..a7e7cceea7 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/sidhistory.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/operations/sidhistory.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Clear/Set SID History
Use the Clear/Set SID History page to overwrite or append to the SID history for targeted objects.
-Please review the restrictions for this operation in the Notes box.
+review the restrictions for this operation in the Notes box.
The source table used for this operation must contain a column with the following information:
@@ -20,15 +20,15 @@ Configure the action with the following options:
- Overwrite – Overwrites the SID History
- Append – Adds to the SID History
- Clear – Clears the SID History
-- Insert Field – This drop-down list is enabled when the Overwrite or Append radio buttons are
- selected. Use the drop-down list to select a field (column) from the source table. Then, click the
+- Insert Field – This dropdown list is enabled when the Overwrite or Append radio buttons are
+ selected. Use the dropdown list to select a field (column) from the source table. Then, click the
blue arrow to insert the item into the SID History box. The SID history is overwritten with the
selected fields or appended to with the selected fields depending on the selected radio button.
- SID History – This box is enabled by selecting the Overwrite or Append radio buttons. The SID
history is overwritten or appended to with the inserted fields, depending on the selected radio
button. Populate the SID History box using either of the following methods:
- - Select one or more fields at the Insert Field drop-down menu
+ - Select one or more fields at the Insert Field dropdown menu
- Click the **ellipsis (…)** to access the Select Users or Groups window to populate this field
- Reference link – Accesses a Microsoft web page called Using DsAddSidHistory containing important
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/options.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/options.md
index 1c4930565c..1a94920a3a 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/options.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/options.md
@@ -6,14 +6,13 @@ sidebar_position: 30
# Active Directory Action Options
-The Options page provides the option to select to use the default domain or specific a domain to
-use.
+Use the Options page to select the default domain or specify a domain to use.
Use the following options to configure the action:
-- Insert field – Use the drop-down list to select a field (column) from the source table. Then,
+- Insert field – Use the dropdown list to select a field (column) from the source table. Then,
click the blue arrow to insert the item into the **Specify domain (controller) to use** box.
- Use default domain (controller) – Use the default domain controller for the action
- Specify domain (controller) to use – Click the ellipsis to open the Browse for Domain window and
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/overview.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/overview.md
index 4dd22c7213..70bccb7d26 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/overview.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/overview.md
@@ -11,9 +11,8 @@ Use the Active Directory Action Module to make bulk changes to objects in Micros
Analyzer license.
:::warning
-Be careful when using this action module. Make sure that only the changes required are
-applied and only to those target systems desired. Actions perform their functions on all rows in a
-table.
+Be careful when using this action module. Apply only the required changes, and only to the target
+systems you want to change. Actions perform their functions on all rows in a table.
:::
@@ -27,11 +26,10 @@ requirements for the type of data contained in the columns in the source table.
Active Directory object, group, user, or computer, the source table columns must contain values that
uniquely identify each Active Directory object referenced. Active Directory objects correspond to
rows in a Access Analyzer source table. Active Directory object attributes correspond to columns.
-Once the source table has been scoped, use the Target page to specify the field that identifies the
+After scoping the source table, use the Target page to specify the field that identifies the
target objects along with the field type to indicate the type of data contained in the field.
-The Operations page lists the operations that may be performed by the Active Directory Action
-Module. Each operation may have its own source table column requirements as follows:
+The Operations page lists the operations that the Active Directory Action Module can perform. Each operation may have its own source table column requirements as follows:
| Operation | Requirements |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
@@ -39,7 +37,7 @@ Module. Each operation may have its own source table column requirements as foll
| Computer Details | No specific columns required |
| Disable/Enable Computers | No specific columns required |
| Create Groups | No specific columns required |
-| Create Users | Column containing the user logon name
**_RECOMMENDED:_** It is recommended that the source table has columns containing the following information: - First Name
- Last name
- Initials
- Full name
- Password
- OU in which to create the user (This can also be created on the Create Users page)
|
+| Create Users | Column containing the user logon name
**_RECOMMENDED:_** Include columns containing the following information in the source table: - First Name
- Last name
- Initials
- Full name
- Password
- OU in which to create the user (This can also be created on the Create Users page)
|
| Delete Objects (Users, Groups, Computers, etc.) | No specific columns required |
| Disable/Enable Users | No specific columns required |
| Group Details | No specific columns required |
@@ -68,6 +66,9 @@ introductory and caution information about the Active Directory Action Module.
-The navigation pane contains links to the pages in the wizard. Note that the operations added on the
-Operations page will affect the list of pages in the navigation pane. Several operations have
+The navigation pane contains links to the pages in the wizard. Several operations have
associated configuration pages.
+
+:::note
+Operations added on the Operations page affect the list of pages in the navigation pane.
+:::
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/summary.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/summary.md
index bd7e5c7dc8..3cd4116946 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/summary.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/summary.md
@@ -10,6 +10,6 @@ The Summary page displays a summary of the configured settings for the action.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Active Directory Action Module Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the Active Directory Action Module Wizard instead. This prevents the wizard from saving
+accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/action/activedirectory/target.md b/docs/accessanalyzer/12.0/admin/action/activedirectory/target.md
index 112f1fcfc0..80d39e2b46 100644
--- a/docs/accessanalyzer/12.0/admin/action/activedirectory/target.md
+++ b/docs/accessanalyzer/12.0/admin/action/activedirectory/target.md
@@ -18,12 +18,12 @@ Use the following options to configure the action:
- Add – Adds the selected field and field type to the Selections pane
- Delete – Removes the highlighted operation from the Selection pane
- Field – The name of the column in the Access Analyzer source table. Select the field that uniquely
- identifies the target AD objects (represented by rows in the Access Analyzer table). The drop-down
+ identifies the target AD objects (represented by rows in the Access Analyzer table). The dropdown
list displays the fields from the source data table specified on the Action Properties page. The
- list excludes any default fields such as HOSTSTATUS, on which actions cannot be performed.
+ list excludes any default fields such as HOSTSTATUS, on which you can't perform actions.
- Field Type – The type of data contained in the specified field. Access Analyzer must know the data
- type of the field selected above. Otherwise, errors may appear upon execution of the action and
- report results may be incomplete. The drop-down list contains the following field types:
+ type of the selected field. Otherwise, errors may appear when you run the action, and report
+ results may be incomplete. The dropdown list contains the following field types:
- Distinguished Name or DN
- GUID
@@ -33,7 +33,7 @@ Use the following options to configure the action:
- Employee (employeeID)
:::note
-While one field is usually sufficient to identify AD objects, if specifying multiple
-fields, each field type can only be used once.
+While one field is usually sufficient to identify AD objects, if you specify multiple
+fields, you can use each field type only once.
:::
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/action.md b/docs/accessanalyzer/12.0/admin/action/filesystem/action.md
index b3d2c82e22..5159321643 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/action.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/action.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# File System Action: Action
-On the Action page, select the type of action to be configured, define a new action, and additional
-capabilities.
+On the Action page, select the type of action to configure, define a new action, and configure
+additional capabilities.
@@ -15,10 +15,10 @@ The following options are available:
- Define a new action – Enables the Operation page where operations are selected on which the action
is based
-- Rollback a previously executed action – Enables the Prior Actions page where lists of previously
- executed actions and rollback actions can be selected. Not all operations support rollback. Enable
- the Support Rollback option prior to execution for the action in order to perform a rollback.
+- Rollback a previously executed action – Enables the Prior Actions page, where you can select from
+ lists of previously executed actions and rollback actions. Not all operations support rollback. Enable
+ the Support Rollback option before execution for the action to perform a rollback.
- Remove the applet service from a host – If an executed action installs an applet service on a host
- from a Access Analyzer Console, it remains installed after the action is completed for other
- Access Analyzer consoles to perform actions using the same applet service. This setting removes
+ from a Access Analyzer Console, it remains installed after the action completes, so other
+ Access Analyzer consoles can use the same applet service to perform actions. This setting removes
the action’s applet service from that host.
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/appletsettings.md b/docs/accessanalyzer/12.0/admin/action/filesystem/appletsettings.md
index 9b5a53128a..4a8b194297 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/appletsettings.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/appletsettings.md
@@ -16,21 +16,21 @@ Specify how the operations will be executed:
- Local Access Analyzer server
- Specific remote server:
- - Fields – Use the drop-down list to select a field (column) from the source table, then click
+ - Fields – Use the dropdown list to select a field (column) from the source table, then click
the blue arrow to insert the item into the **Remote server** field
- - Environment Variables – Select an item from the drop-down list, then click the blue arrow to
+ - Environment Variables – Select an item from the dropdown list, then click the blue arrow to
insert the item into the **Remote Server** field
- Remote Server – Enter the path to the server
- Click the **ellipsis (…)** to browse for server
- Click the **tick** icon to show a preview of the path
- Click the **Help** icon for additional information
-- Preview – Shows what the compound path specified will be resolved in to. The text here is used to
- initialize the path specification selection dialog.
+- Preview – Shows what the specified compound path resolves to. The text here initializes the path
+ specification selection dialog.
- Specific remote servers – Click the **ellipsis (…)** to browse for servers
- Click **Add** to add the server
- Click **Remove** to remove the server
-- Fall back to the local Access Analyzer server if an applet cannot start – Check to enable this
+- Fall back to the local Access Analyzer server if an applet can't start – Check to enable this
option
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/destination.md b/docs/accessanalyzer/12.0/admin/action/filesystem/destination.md
index 3410b7fe1a..6e5ff4f87b 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/destination.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/destination.md
@@ -12,18 +12,18 @@ The Destination page is available only if the following operations are selected:
- Move
- Rename
-Define the destination location of the files that will be copied, moved, or renamed by building the
+Define the destination location for the files you want to copy, move, or rename by building the
destination path using the Fields and Environment Variables options as needed.
-Use the fields provided to select destination items and hosts from the drop-down lists and populate
+Use the fields provided to select destination items and hosts from the dropdown lists and populate
the Destination field, or edit the field manually. The Preview field updates based on the contents
of the Destination field.
-- Fields – Use the drop-down list to select a field (column) from the source table, then click the
+- Fields – Use the dropdown list to select a field (column) from the source table, then click the
blue arrow to insert the item into the **Destination** field
-- Environment Variables – Select an item from the drop-down list, then click the blue arrow to
+- Environment Variables – Select an item from the dropdown list, then click the blue arrow to
insert the item into the **Destination** field
- Target Items – Enter the path to the target file or folder
@@ -31,11 +31,11 @@ of the Destination field.
- Click the **tick** icon to show a preview of the specified path
- Click the **Help** icon for additional information
-- Host – Select the field that identifies the systems or manually type the host destination
+- Host – Select the field that identifies the systems or manually enter the host destination
- Use path type – Choose from the following options:
- Local – Uses the local path
- UNC – Uses the UNC path
-- Preview – Shows what the compound path specified will be resolved in to. The text here is used to
- initialize the file specification selection dialog.
+- Preview – Shows what the specified compound path resolves to. The text here initializes the file
+ specification selection dialog.
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/environment.md b/docs/accessanalyzer/12.0/admin/action/filesystem/environment.md
index d77506f094..d6f66c5136 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/environment.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/environment.md
@@ -7,10 +7,10 @@ sidebar_position: 40
# File System Action: Environment
The Environment (Environment Variables) page is available only if the selected operation requires
-the selection of a sample host.
+selecting a sample host.
-Use this page to select and connect to a sample host, via which a set of remote environment
-variables for use in scoping the action are loaded. Then, on the Target page, use the environment
+Use this page to select and connect to a sample host, which loads a set of remote environment
+variables for scoping the action. Then, on the Target page, use the environment
variables to build dynamic file path locations for the selected operation.
:::note
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/operation.md b/docs/accessanalyzer/12.0/admin/action/filesystem/operation.md
index d4a7935eee..1662a58b6d 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/operation.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/operation.md
@@ -7,11 +7,11 @@ sidebar_position: 20
# File System Action: Operation
The Operation page is available when **Define a new action** is selected on the Action page. On the
-Operation page, define the action by selecting an operation from the drop-down list.
+Operation page, define the action by selecting an operation from the dropdown list.
-At the Available Operations drop-down selection list, choose the operation for the action to
+At the Available Operations dropdown selection list, choose the operation for the action to
perform. The selection determines which pages are available in the wizard. The following operations
are available:
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/options.md b/docs/accessanalyzer/12.0/admin/action/filesystem/options.md
index 0a73471726..8c56301244 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/options.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/options.md
@@ -14,50 +14,48 @@ available.
Select from the following additional operations:
-- Delete locked files on reboot – Files that are locked can be queued to be deleted at the next
- system start up
-- Overwrite existing files – Files in the destination location are overwritten. This action cannot
+- Delete locked files on reboot – Queues locked files for deletion at the next system startup
+- Overwrite existing files – Overwrites files in the destination location. This action can't
be undone.
-- Terminate associated process – Files that are locked cannot be actively moved, renamed or deleted
- without stopping the associated process. If selected, this may cause an interruption to any users
- of that target system and service.
-- Create shortcuts to the moved files in the source directory – A shortcut will be created in the
+- Terminate associated process – You can't move, rename, or delete locked files without stopping
+ the associated process. If you select this option, it may interrupt users of the target system
+ and service.
+- Create shortcuts to the moved files in the source directory – Creates a shortcut in the
source directory that points to the new location of a moved file
- Preserve file access – Copy the file ACL from the source directory to the destination to preserve
file access. Child objects, with inherited permissions or broken inheritance, targeted by copy or
- move actions retain their permissions. Parent folders with inherited permissions are changed to
- explicit.
-- Enable SACL modification – Request system security access when opening files in order to make SACL
+ move actions retain their permissions. Parent folders with inherited permissions change to
+ explicit permissions.
+- Enable SACL modification – Request system security access when opening files to make SACL
changes
- Retry failed rows – Enter the following information:
- Number of times to retry
- - Do not retry error codes – Rows of data with error codes listed within this textbox are
- excluded from the action performed. Common errors are included for certain actions, and may be
- customized to add or remove error codes. See the Microsoft
+ - Don't retry error codes – Excludes rows of data with error codes listed in this textbox from
+ the action performed. Certain actions include common errors by default, and you can customize
+ the list to add or remove error codes. See the Microsoft
[System Error Codes](https://docs.microsoft.com/en-us/windows/desktop/Debug/system-error-codes)
article for additional information.
- Delay between retries
- Enable batching – (For big data sets) Enabling batching breaks the data set into batches so the
- action does not attempt to execute all lines at once. Actions performed on tables with a large
- number of input rows may fail due to network failure, and it is difficult to determine the actions
- that were executed before the failure.
+ action doesn't attempt to execute all lines at once. Actions performed on tables with a large
+ number of input rows may fail due to a network failure, making it difficult to determine which
+ actions ran before the failure.
- Batch size – Specify the batch size.
**Start Process**
-Select the desired start process.
+Select the process you want to start.
:::warning
-Due to system security limitations, some applications and programs cannot be restarted
-or run remotely using this option. Additionally, starting interactive processes (such as Word,
-Excel, and so on) will load them into memory, but may not make them available for interaction by the
-end user.
+Due to system security limitations, this option can't restart or run some applications and programs
+remotely. Additionally, starting interactive processes (such as Word or Excel) loads them into
+memory but may not make them available to the end user for interaction.
:::
-Use the fields provided to select target items and hosts from the drop-down lists and populate the
+Use the fields provided to select target items and hosts from the dropdown lists and populate the
Set working directory field, or edit the field manually. The Preview field updates based on the
contents of the Set working directory field.
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/overview.md b/docs/accessanalyzer/12.0/admin/action/filesystem/overview.md
index ca208a4974..627fe0e0d3 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/overview.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/overview.md
@@ -6,15 +6,14 @@ sidebar_position: 30
# File System Action Module
-The File System Action Module allows Access Analyzer Administrators to automate the process of
-remediating and modifying Windows file system attributes and properties. The File System Action
+The File System Action Module lets Access Analyzer administrators automate remediating and
+modifying Windows file system attributes and properties. The File System Action
Module provides options for changing attributes and permissions, as well as copying, deleting,
moving, and renaming file system contents. It is available with a special Access Analyzer license.
:::warning
-Be careful when using this Action Module. Make sure that only the changes required are
-applied and only to those target systems desired. Actions perform their functions on all rows in a
-table.
+Be careful when using this Action Module. Apply only the required changes, and only to the target
+systems you want to change. Actions perform their functions on all rows in a table.
:::
@@ -24,7 +23,7 @@ its function on a single object per row from the source table defined in the act
## Permissions
The File System Action Module requires a Access Analyzer connection profile and privileged access to
-file system devices. The Access Analyzer connection profile may be configured to have a Task account
+file system devices. You can configure the Access Analyzer connection profile to use a Task account
type. The following are the least privileged access model required for Share Permission Changes:
- Windows – User credential must be member of Power Users group
@@ -50,21 +49,22 @@ type. The following are the least privileged access model required for Share Per
## Applet Deployment
-The File System Action Module deploys an applet the first time an action is executed. Applets are
-installed within the Access Analyzer Installation Directory if the `%SAInstallDir%` environment is
-present. Otherwise, applets are deployed to `C:\Program Files (x86)\STEALTHbits\StealthAUDIT`.
+The File System Action Module deploys an applet the first time you run an action. The module
+installs applets within the Access Analyzer Installation Directory if the `%SAInstallDir%`
+environment variable is present. Otherwise, it deploys applets to
+`C:\Program Files (x86)\STEALTHbits\StealthAUDIT`.
## Source Table Configuration
Individual action modules, including File System Action Module, may have their own column
requirements. To take action on a file system resource, the source table must contain a column with
values to uniquely identify it. File System resources correspond to rows in a Access Analyzer table.
-File System attributes correspond to columns. Once the source table has been scoped, use the Target
+File System attributes correspond to columns. After scoping the source table, use the Target
page to specify the field that identifies the target attribute along with any environmental
variables.
-These columns are required to use the File System Action Module. Otherwise, errors may occur upon
-execution of the action and with analysis and reports downstream.
+The File System Action Module requires these columns. Otherwise, errors may occur when you run the
+action, affecting analysis and reports downstream.
| Required Columns | Description |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------------- |
@@ -72,12 +72,12 @@ execution of the action and with analysis and reports downstream.
| RowKey | Identifies each data row as unique. Sometimes the value is a GUID, but the datatype in the table is a varchar (text string). |
:::tip
-Remember, the individual File System actions may have their own column requirements in addition to
-the above. These columns are made available through the File System Action Module wizard.
+Remember, individual File System actions may have their own column requirements in addition to the
+columns listed here. The File System Action Module wizard makes these columns available.
:::
-The Operations page lists the operations that may be performed by the File System Action Module.
+The Operations page lists the operations that the File System Action Module can perform.
Each operation has its own source table column requirements as follows:
| Operation | Column requirements |
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/addtags.md b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/addtags.md
index 9abded38d6..31aa827f3a 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/addtags.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/addtags.md
@@ -10,7 +10,7 @@ Use the Parameters page to specify the file tags the action adds.
-Use the fields provided to select tags from the drop-down lists and populate the Tag field, or edit
+Use the fields provided to select tags from the dropdown lists and populate the Tag field, or edit
the field manually. The Preview field updates based on the contents of the Tag field.
- Add Mode:
@@ -19,18 +19,18 @@ the field manually. The Preview field updates based on the contents of the Tag f
- Overwrite existing tags - Removes all existing tags before adding newly configured tags
:::note
-If choosing the option to overwrite tags, the action module will clear out both normal
-tags and Boldon James tags and then proceed to apply the tags configured for overwrite. If choosing
-the option to remove all tags, the action module will clear out both normal tags and Boldon James
+If you choose the option to overwrite tags, the action module clears out both normal
+tags and Boldon James tags, then applies the tags configured for overwrite. If you choose
+the option to remove all tags, the action module clears out both normal tags and Boldon James
tags.
:::
-- Fields – Use the drop-down list to select a field (column) from the source table, then click the
+- Fields – Use the dropdown list to select a field (column) from the source table, then click the
blue arrow to insert the item into the **Tag** field
-- Environment Variables – Select an item from the drop-down list, then click the blue arrow to
+- Environment Variables – Select an item from the dropdown list, then click the blue arrow to
insert the item into the **Tag** field
-- Preview – Shows what the compound path specified will be resolved in to
+- Preview – Shows what the specified compound path resolves to
- Click **Add** to add the tag field to the list
- Click **Remove** to remove the tag field from the list
@@ -43,8 +43,8 @@ tags.
:::note
The Boldon James column indicates whether a file tag is a regular tag or a Boldon
- James tag. Regular tags will be identified with **0**. Boldon James tags will be identified
- with **1**.
+ James tag. The system identifies regular tags with **0** and Boldon James tags with
+ **1**.
:::
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changeowner.md b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changeowner.md
index 203cc100ab..8a80510dbf 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changeowner.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changeowner.md
@@ -12,7 +12,7 @@ Use the Change Owner Parameters page to select a trustee to be the new owner.
Use the options to enter the trustees:
-- Insert field – Use the drop-down list to select a field (column) from the source table, then click
+- Insert field – Use the dropdown list to select a field (column) from the source table, then click
the blue arrow
- Alternatively click **Select** to select a user or group object
- Replace owner on all child objects – Check to enable
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changepermissioninheritance.md b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changepermissioninheritance.md
index c11c5c2b11..a5145550ed 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changepermissioninheritance.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changepermissioninheritance.md
@@ -11,4 +11,4 @@ permissions.
-Select the desired options for adding or removing inheritance.
+Select the options you want for adding or removing inheritance.
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changepermissionsauditing.md b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changepermissionsauditing.md
index d3a2b312ce..1bdfd9301a 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changepermissionsauditing.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changepermissionsauditing.md
@@ -13,7 +13,7 @@ settings the action changes.
Use the following options to enter the Permissions:
-- Insert field – Use the drop-down list to select a field (column) from the source table, then click
+- Insert field – Use the dropdown list to select a field (column) from the source table, then click
the blue arrow
- Group or user names:
@@ -29,7 +29,7 @@ In the table, select from the following options:
- Audit – Report the status of the change to the attribute
- Audit Apply To - Select the files or folders to report the status on
-Select from the following options (Multiple options can be selected):
+Select from the following options (you can select multiple options):
- Overwrite existing file explicit permissions (target object only)
- Replace permission entries on all child objects
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changesharepermissions.md b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changesharepermissions.md
index 120be8f12f..5ab8f99e9d 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changesharepermissions.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changesharepermissions.md
@@ -6,9 +6,9 @@ sidebar_position: 40
# Change Share Permissions
-Use the Change Share Permissions Parameters page to specify the permission status for what group or
-users are to be changed.
+Use the Change Share Permissions Parameters page to specify the permission status to change for the
+selected group or users.
-Select the desired options for changing the permissions control of the selected group or users.
+Select the options you want for changing the permissions control of the selected group or users.
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/parameters.md b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/parameters.md
index 0855814df5..563bd1a575 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/parameters.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/parameters.md
@@ -6,9 +6,9 @@ sidebar_position: 60
# File System Action: Parameters
-The Parameters page is available for some of the selections on the Operation page. The list of
-operations below provides access to the operation-specific versions of the Parameters page for this
-wizard. Click on an operation to view its associated Parameters page.
+The Parameters page is available for some of the selections on the Operation page. The following
+list of operations provides access to the operation-specific versions of the Parameters page for
+this wizard. Click an operation to view its associated Parameters page.
- [Change Attributes](/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changeattributes.md)
- [Change Permissions and Auditing](/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/changepermissionsauditing.md)
@@ -22,5 +22,5 @@ wizard. Click on an operation to view its associated Parameters page.
-The Navigation pane will list this as the Parameters page, but the title for each version indicates
-the type of parameter to be configured.
+The Navigation pane lists this as the Parameters page, but each version's title indicates the type
+of parameter to configure.
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/removefilepermissions.md b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/removefilepermissions.md
index 565ed4419f..747320ee5a 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/removefilepermissions.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/removefilepermissions.md
@@ -13,7 +13,7 @@ removes.
Use the options to enter the Permissions:
-- Insert field – Use the drop-down list to select a field (column) from the source table, then click
+- Insert field – Use the dropdown list to select a field (column) from the source table, then click
the blue arrow
- Group or user names:
- Click **Add** to select a user or group object
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/removesharepermissions.md b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/removesharepermissions.md
index 73a8d7be88..9842e2365d 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/removesharepermissions.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/removesharepermissions.md
@@ -13,7 +13,7 @@ removes.
Use the options to enter the Permissions:
-- Insert field – Use the drop-down list to select a field (column) from the source table, then click
+- Insert field – Use the dropdown list to select a field (column) from the source table, then click
the blue arrow
- Group or user names:
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/removetags.md b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/removetags.md
index 43b54e81fe..e1a96d3e08 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/removetags.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/parameters/removetags.md
@@ -10,7 +10,7 @@ Use the Parameter page to specify the file tags the action removes.
-Use the fields provided to select tags from the drop-down lists and populate the Tag field, or edit
+Use the fields provided to select tags from the dropdown lists and populate the Tag field, or edit
the field manually. The Preview field updates based on the contents of the Tag field.
- Remove Mode:
@@ -19,18 +19,18 @@ the field manually. The Preview field updates based on the contents of the Tag f
- Remove all tags - Remove all existing tags
:::note
-If choosing the option to overwrite tags, the action module will clear out both normal
-tags and Boldon James tags and then proceed to apply the tags configured for overwrite. If choosing
-the option to remove all tags, the action module will clear out both normal tags and Boldon James
+If you choose the option to overwrite tags, the action module clears out both normal
+tags and Boldon James tags, then applies the tags configured for overwrite. If you choose
+the option to remove all tags, the action module clears out both normal tags and Boldon James
tags.
:::
-- Fields – Use the drop-down list to select a field (column) from the source table, then click the
+- Fields – Use the dropdown list to select a field (column) from the source table, then click the
blue arrow to insert the item into the **Tag** field
-- Environment Variables – Select an item from the drop-down list, then click the blue arrow to
+- Environment Variables – Select an item from the dropdown list, then click the blue arrow to
insert the item into the **Tag** field
-- Preview – Shows what the compound path specified will be resolved in to
+- Preview – Shows what the specified compound path resolves to
- Click **Add** to add the tag field to the list for removal
- Click **Remove** to remove the tag field from the list for removal
@@ -43,8 +43,8 @@ tags.
:::note
The Boldon James column indicates whether a file tag is a regular tag or a Boldon
- James tag. Regular tags will be identified with **0**. Boldon James tags will be identified
- with **1**.
+ James tag. The system identifies regular tags with **0** and Boldon James tags with
+ **1**.
:::
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/rollback.md b/docs/accessanalyzer/12.0/admin/action/filesystem/rollback.md
index 43a9b4c0d2..f8e8366100 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/rollback.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/rollback.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# File System Action: Rollback
-Use the Rollback page to apply rollback support to the action. This option provides the ability to
+Use the Rollback page to apply rollback support to the action. This option lets you
undo failed actions and reapply the original action settings when the action continues from where it
left off.
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/summary.md b/docs/accessanalyzer/12.0/admin/action/filesystem/summary.md
index 81538d8fbe..53ea5e7b15 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/summary.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/summary.md
@@ -10,6 +10,6 @@ The Summary page displays a summary of the configured action.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the File System Action Module Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the File System Action Module Wizard instead. This prevents the wizard from saving accidental
+clicks.
diff --git a/docs/accessanalyzer/12.0/admin/action/filesystem/target.md b/docs/accessanalyzer/12.0/admin/action/filesystem/target.md
index b42ed3e0f0..4dbec1b7c4 100644
--- a/docs/accessanalyzer/12.0/admin/action/filesystem/target.md
+++ b/docs/accessanalyzer/12.0/admin/action/filesystem/target.md
@@ -7,19 +7,19 @@ sidebar_position: 50
# File System Action: Target
Use the Target page to point the action module towards a file path on the specified host.
-Environmental variables (for example, Program Files, SystemRoot, SAInstallDir, and so on) can be
-used when creating a path as well as fields in the raw table output to populate the **Target items**
-field.
+You can use environmental variables (for example, Program Files, SystemRoot, SAInstallDir, and so
+on) when creating a path, as well as fields in the raw table output, to populate the
+**Target items** field.
-Use the fields provided to select target items and hosts from the drop-down lists and populate the
+Use the fields provided to select target items and hosts from the dropdown lists and populate the
Target items field, or edit the field manually. The Preview field updates based on the contents of
the Target items field.
-- Fields – Use the drop-down list to select a field (column) from the source table, then click the
+- Fields – Use the dropdown list to select a field (column) from the source table, then click the
blue arrow to insert the item into the **Target items** field
-- Environment Variables – Select an item from the drop-down list, then click the blue arrow to
+- Environment Variables – Select an item from the dropdown list, then click the blue arrow to
insert the item into the Target items field
- Target items – Enter the path to the target file or folder
@@ -27,12 +27,12 @@ the Target items field.
- Click the **tick** icon to show a preview of the specified path
- Click the **Help** icon for additional information
-- Host – Select the field that identifies the systems or manually type the host to take action
+- Host – Select the field that identifies the systems or manually enter the host to take action
against
- Use path type – Choose from the following options:
- Local – Uses the local path
- UNC – Uses the UNC path
-- Preview – Shows what the compound path specified will be resolved in to. The text here is used to
- initialize the file specification selection dialog.
+- Preview – Shows what the specified compound path resolves to. The text here initializes the file
+ specification selection dialog.
diff --git a/docs/accessanalyzer/12.0/admin/action/libraries.md b/docs/accessanalyzer/12.0/admin/action/libraries.md
index e86f94958b..34eadf979c 100644
--- a/docs/accessanalyzer/12.0/admin/action/libraries.md
+++ b/docs/accessanalyzer/12.0/admin/action/libraries.md
@@ -6,10 +6,10 @@ sidebar_position: 10
# Action Libraries
-When creating a new action on a job, you have the ability to load action tasks that have been
-preconfigured with table input, script body, and parameters. This helps you:
+When creating a new action on a job, you can load action tasks preconfigured with table input,
+script body, and parameters. This helps you:
-- Perform operations that are not available in one of the out of the box action modules
+- Perform operations that aren't available in one of the built-in action modules
- Build custom action workflows to satisfy common use cases
- Build custom remediation workflows, such as:
@@ -22,15 +22,15 @@ window with the available Action Libraries and operations:
-When a specific operation within a library is chosen, the action is added in the disabled state to
-the job. The Action Properties page opens, which has a description, action module, and source table
+When you choose a specific operation within a library, the action module adds the action to the job
+in a disabled state. The Action Properties page opens, which has a description, action module, and source table
with relevant filters applied.
When you click the **Configure Action** link, the action module's wizard opens.
-The following Action Libraries and Templates leverage the PowerShell Action module for running
+The following Action Libraries and Templates use the PowerShell Action module for running
actions within the specific environment:
- Active Directory
@@ -39,14 +39,13 @@ actions within the specific environment:
- SharePoint Online
- Windows
-Prerequisite information for each of the PowerShell scripts is included as part of the script
-comments. Typically, a script requires necessary cmdlets available and installed, as well as
+Each PowerShell script's comments include prerequisite information for that script. Typically, a script requires necessary cmdlets available and installed, as well as
parameter inputs configured.
## Create a Custom Action Library
-You can also create and maintain custom libraries of action tasks for easy reference and use. Once
-you configure an action task as desired, follow the steps to add it to an Action Library.
+You can also create and maintain custom libraries of action tasks for easy reference and use. After
+you configure an action task, add it to an Action Library:
**Step 1 –** From within the Action Selections view where the custom action tasks exists,
right-click and copy the task.
diff --git a/docs/accessanalyzer/12.0/admin/action/mailbox/affectedmailboxes.md b/docs/accessanalyzer/12.0/admin/action/mailbox/affectedmailboxes.md
index 5287dfcf33..b35420db3d 100644
--- a/docs/accessanalyzer/12.0/admin/action/mailbox/affectedmailboxes.md
+++ b/docs/accessanalyzer/12.0/admin/action/mailbox/affectedmailboxes.md
@@ -20,7 +20,7 @@ Select mailboxes to process using the following options:
- Users found in the following column – Select this option to identify users via a data table column
- - Use the drop-down menu to select a data table column containing either the Mailbox display
+ - Use the dropdown menu to select a data table column containing either the Mailbox display
name or email address
- Select a data type for the selected field using the following options:
diff --git a/docs/accessanalyzer/12.0/admin/action/mailbox/delegaterights.md b/docs/accessanalyzer/12.0/admin/action/mailbox/delegaterights.md
index 3e8926f9a0..0febb64318 100644
--- a/docs/accessanalyzer/12.0/admin/action/mailbox/delegaterights.md
+++ b/docs/accessanalyzer/12.0/admin/action/mailbox/delegaterights.md
@@ -6,15 +6,15 @@ sidebar_position: 120
# Mailbox: Delegate Rights
-Use the Delegate Rights page to specify folder permissions for the selected delegates. A permission
-level can be specified for each folder on the page. It is a wizard page for the Add Delegates
+Use the Delegate Rights page to specify folder permissions for the selected delegates. You can
+specify a permission level for each folder on the page. It is a wizard page for the Add Delegates
operation.
Set delegate rights using the following options:
-- The following delegate rights can be chosen to access each mailbox folder:
+- Choose from the following delegate rights to access each mailbox folder:
- None
- Reviewer
@@ -26,13 +26,13 @@ Set delegate rights using the following options:
- Publishing Editor
- Owner
-- Select a right from the drop-down menu of any desired mailbox folder, including:
+- Select a right from the dropdown menu of any desired mailbox folder, including:
- Calendar
:::note
- If Editor or a higher rights level is selected, the **Delegate receives copies of
- meeting-related messages sent to me** option is enabled for selection.
+ If you select Editor or a higher rights level, the wizard enables the **Delegate receives
+ copies of meeting-related messages sent to me** option for selection.
:::
diff --git a/docs/accessanalyzer/12.0/admin/action/mailbox/folderconditions.md b/docs/accessanalyzer/12.0/admin/action/mailbox/folderconditions.md
index 9eaedc1921..53a7d88ef1 100644
--- a/docs/accessanalyzer/12.0/admin/action/mailbox/folderconditions.md
+++ b/docs/accessanalyzer/12.0/admin/action/mailbox/folderconditions.md
@@ -7,7 +7,7 @@ sidebar_position: 60
# Mailbox: Folder Conditions
Use the Folder Conditions page to customize folder search filter conditions. It is a wizard page for
-the **No, the query results do not contain a mailbox identification** column option on the Folder
+the **No, the query results don't contain a mailbox identification** column option on the Folder
Identification page.
@@ -19,7 +19,7 @@ Customize folder search conditions using the following options:
- With specific folder type
- With search terms in the folder name
- - With specific folder(s) to include/exclude
+ - With specific folders to include/exclude
- Edit conditions – Any selected conditions populate here. To modify filter conditions, click the
underlined portion of the condition, which opens a corresponding window.
@@ -27,8 +27,8 @@ Customize folder search conditions using the following options:
## Folder Type Window
Use the Folder Type window to select which folder types to run the action against. The Folder Type
-window opens if **specific** in **with specific folder type** is selected in the Edit Conditions
-box. .
+window opens if you select **specific** in **with specific folder type** in the Edit Conditions
+box.
@@ -45,14 +45,14 @@ Select the checkbox next to any desired folder type to include it in the search
## Search Terms Window
-Use the Search Terms window to select terms contained in folder names to run the action against.The
-Search Terms window opens if **search terms** is selected in the Edit Conditions box.
+Use the Search Terms window to select terms contained in folder names to run the action against. The
+Search Terms window opens if you select **search terms** in the Edit Conditions box.
Edit the search terms using the following options:
-- To add a term to the search, enter the desired term into the upper text box and click **Add**
+- To add a term to the search, enter the term you want into the upper text box and click **Add**
- To remove a term from the search, select a term in the lower text box and click **Remove**
- Click **Clear** to clear all terms from the lower box
- Select a qualifier option:
@@ -67,8 +67,8 @@ Edit the search terms using the following options:
## Folder Inclusion/Exclusion Window
Use the Folder Inclusion/Exclusion window to select individual folders to add to or remove from the
-action. The Folder Inclusion/Exclusion window opens if **specific** in **with specific folder(s) to
-include/exclude** is selected in the Edit Conditions box.
+action. The Folder Inclusion/Exclusion window opens if you select **specific** in **with specific
+folders to include/exclude** in the Edit Conditions box.
@@ -78,13 +78,13 @@ Include/Exclude folders using the following options:
-- Click the ellipsis (**…**) or enter the path to the desired folder in the text box
-- Scope auto-populates with **This folder**. Click **This folder** to reveal a drop-down menu to
+- Click the ellipsis (**…**) or enter the path to the folder you want in the text box
+- Scope auto-populates with **This folder**. Click **This folder** to reveal a dropdown menu to
select from the following scope options:
- This folder
- This folder and subfolders
- Subfolders only
-- The Remove button becomes enabled once a folder is added to either section. To remove a folder
+- The Remove button becomes enabled after you add a folder to either section. To remove a folder
from the scope, select it and click **Remove**.
diff --git a/docs/accessanalyzer/12.0/admin/action/mailbox/folderidentification.md b/docs/accessanalyzer/12.0/admin/action/mailbox/folderidentification.md
index 7d7c0d21ef..124562296a 100644
--- a/docs/accessanalyzer/12.0/admin/action/mailbox/folderidentification.md
+++ b/docs/accessanalyzer/12.0/admin/action/mailbox/folderidentification.md
@@ -16,7 +16,7 @@ options:
- Yes, the query results contain a mailbox folder identification column
- - Select the mailbox identification column using the drop-down menu
+ - Select the mailbox identification column using the dropdown menu
- Folder Identifier Type – Choose which mailbox identifier the selected column uses:
- Folder Path and Name – Select this option if the specified field contains a fully
@@ -24,6 +24,6 @@ options:
- Entry ID – Select this option if the selected field is an EntryID that is a unique
identifier for a folder
-- No, the query results do not contain a mailbox folder identification column – Selecting this
+- No, the query results don't contain a mailbox folder identification column – Selecting this
enables the Folder Conditions page, used to identify specific folders to target. See the
[Mailbox: Folder Conditions](/docs/accessanalyzer/12.0/admin/action/mailbox/folderconditions.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/action/mailbox/identification.md b/docs/accessanalyzer/12.0/admin/action/mailbox/identification.md
index 8639d8ca7d..ab1a19b05a 100644
--- a/docs/accessanalyzer/12.0/admin/action/mailbox/identification.md
+++ b/docs/accessanalyzer/12.0/admin/action/mailbox/identification.md
@@ -18,7 +18,7 @@ Select which mailboxes to target using the following options:
- Users found in the following column – Select this option to identify users via a data table column
- - Use the drop-down menu to select a data table column containing either the Mailbox display
+ - Use the dropdown menu to select a data table column containing either the Mailbox display
name or email address
- Select a data type for the selected field using the following options:
diff --git a/docs/accessanalyzer/12.0/admin/action/mailbox/messageactions.md b/docs/accessanalyzer/12.0/admin/action/mailbox/messageactions.md
index 6096c6c905..5e0cf17cb0 100644
--- a/docs/accessanalyzer/12.0/admin/action/mailbox/messageactions.md
+++ b/docs/accessanalyzer/12.0/admin/action/mailbox/messageactions.md
@@ -16,8 +16,8 @@ To select a message action, use the following options:
- Select an action – Select the checkbox next to a message action to apply it to the search. The
selected action displays in the Edit Actions box. Possible actions include:
- - Delete – Items can be recovered via the Deleted Contents table (folder dumpster)
- - Permanent Delete – Items are not recoverable
+ - Delete – You can recover deleted items via the Deleted Contents table (folder dumpster)
+ - Permanent Delete – Items aren't recoverable
- Move to Deleted Items folder
- Delete Attachment (Append Text Options) – Deletes attachment and adds **Append Text Options**
to the Edit Conditions box
@@ -31,8 +31,8 @@ To select a message action, use the following options:
## Options Window
-Use the Options window to add an appended text. The Options window opens if **Append Text Options**
-is selected in the Edit Conditions box.
+Use the Options window to add an appended text. The Options window opens if you select
+**Append Text Options** in the Edit Conditions box.
diff --git a/docs/accessanalyzer/12.0/admin/action/mailbox/messageconditions.md b/docs/accessanalyzer/12.0/admin/action/mailbox/messageconditions.md
index b98e8fbd7c..c59355c176 100644
--- a/docs/accessanalyzer/12.0/admin/action/mailbox/messageconditions.md
+++ b/docs/accessanalyzer/12.0/admin/action/mailbox/messageconditions.md
@@ -13,7 +13,7 @@ for the Delete Mailbox Contents operation.
Customize the folder search conditions using the following options:
-- Message Category – Use the drop-down menu to select a message category
+- Message Category – Use the dropdown menu to select a message category
:::note
Each selection may populate various conditions in the Select Conditions section.
@@ -39,14 +39,14 @@ Customize the folder search conditions using the following options:
- Edit conditions – Any selected conditions populate here
- To edit filter conditions, click the underlined portion of the condition. This opens a
- corresponding window to configure the condition, with the exception of **has attachment(s)**.
+ corresponding window to configure the condition, with the exception of **has attachments**.
- - Clicking **has attachment(s)** changes it to **has no attachment(s** and vice versa
+ - Clicking **has attachments** changes it to **has no attachment(s** and vice versa
## MessageClasses Window
Use the MessageClasses window to select a message class to apply to the scope of the action. The
-MessageClasses window opens if **specific** in **with specific message classes** is selected in the
+MessageClasses window opens if you select **specific** in **with specific message classes** in the
Edit Conditions box.
@@ -57,8 +57,8 @@ Modify message classes using the following options:
-- Click the ellipsis (**…**) or enter the path to the desired folder in the text box
-- Matching Strategy auto-populates with **Exact Match**. Click **Exact Match** to reveal a drop-down
+- Click the ellipsis (**…**) or enter the path to the folder you want in the text box
+- Matching Strategy auto-populates with **Exact Match**. Click **Exact Match** to reveal a dropdown
menu to select from the following scope options:
- Exact Match
@@ -71,8 +71,8 @@ Modify message classes using the following options:
## Data Range Selection Window
Use the Date Range Selection window to determine a time period to scope. The Date Range Selection
-window opens if **in specific date** in either the **that is created in specific date** or **that is
-received in specific date** conditions is selected in the Edit condition box.
+window opens if you select **in specific date** in either the **that is created in specific date**
+or **that is received in specific date** conditions in the Edit condition box.
@@ -86,18 +86,18 @@ To specify a date range, use the following options:
- After
- Between
-- Configure the date range using the textbox or drop-down menus for the selected option
+- Configure the date range using the textbox or dropdown menus for the selected option
## Search Terms Window
Use the Search Terms window to select terms in messages to run the action against. The Search Terms
-window opens if **search terms** in any condition is selected in the Edit Conditions box.
+window opens if you select **search terms** in any condition in the Edit Conditions box.
Edit the search terms using the following options:
-- To add a term to the search, enter the desired term into the upper text box and click **Add**
+- To add a term to the search, enter the term you want into the upper text box and click **Add**
- To remove a term from the search, select a term in the lower text box and click **Remove**
- Click **Clear** to clear all terms from the lower box
- Specify a qualifier option:
@@ -110,11 +110,11 @@ Edit the search terms using the following options:
## Values Window
Use the Values window to add or remove values to or from the search. The Values window opens if
-**specific** in **with specific Message ID** is selected in the Edit Conditions box.
+you select **specific** in **with specific Message ID** in the Edit Conditions box.
-- To add a term to the search, enter the desired term into the upper text box and click **Add**
+- To add a term to the search, enter the term you want into the upper text box and click **Add**
- To remove a term from the search, select a term in the lower text box and click **Remove**
- Click **Clear** to clear all terms from the lower box
- Click **Import CSV** to open a file explorer and select a CSV file to import
diff --git a/docs/accessanalyzer/12.0/admin/action/mailbox/operations.md b/docs/accessanalyzer/12.0/admin/action/mailbox/operations.md
index c87043bd76..1bcc7dbc38 100644
--- a/docs/accessanalyzer/12.0/admin/action/mailbox/operations.md
+++ b/docs/accessanalyzer/12.0/admin/action/mailbox/operations.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Mailbox: Operations
-Use the Operations page to specify the operation to be performed as part of the action.
+Use the Operations page to specify the operation to perform as part of the action.
diff --git a/docs/accessanalyzer/12.0/admin/action/mailbox/overview.md b/docs/accessanalyzer/12.0/admin/action/mailbox/overview.md
index 02755f24e6..15d3696975 100644
--- a/docs/accessanalyzer/12.0/admin/action/mailbox/overview.md
+++ b/docs/accessanalyzer/12.0/admin/action/mailbox/overview.md
@@ -6,18 +6,18 @@ sidebar_position: 40
# Mailbox Action Module
-The Mailbox action module allows you to perform bulk operations on Microsoft Exchange mailboxes, for
+Use the Mailbox action module to perform bulk operations on Microsoft Exchange mailboxes, for
example deleting mailbox content and modifying permissions and delegates.
:::warning
This action module can add, change, or remove permissions and delegates from an
-environment. Always verify the data and target mailboxes prior to executing any action.
+environment. Always verify the data and target mailboxes before executing any action.
:::
## Mailbox Action Source Table Configuration
-All data tables used in Access Analyzer action modules require the presence of certain data columns.
+All data tables used in Access Analyzer action modules require certain data columns.
In addition, individual action modules including Mailbox may have their own column requirements. The
Mailbox action module requires a column containing mailbox names.
diff --git a/docs/accessanalyzer/12.0/admin/action/mailbox/permissions.md b/docs/accessanalyzer/12.0/admin/action/mailbox/permissions.md
index dacf092f8c..a13143b7ea 100644
--- a/docs/accessanalyzer/12.0/admin/action/mailbox/permissions.md
+++ b/docs/accessanalyzer/12.0/admin/action/mailbox/permissions.md
@@ -11,7 +11,7 @@ Use the Permissions page to determine which permissions to remove. It is a wizar
-Use the following options to add, change or remove Permissions:
+Use the following options to add, change, or remove Permissions:
- User – Specifies user permissions to add or change. To select different users, click the
down-arrow to display the User window. See the [User Window](#user-window) topic for additional
@@ -22,13 +22,12 @@ Use the following options to add, change or remove Permissions:
window. See the [Permission Window](#permission-window) topic for additional information.
- Propagate permissions to child folders – Propagates permissions to the child folders of the
selected folders
-- Once User, Folder, and Permission are selected, click **Add** to add them to the summary of the
- action to be taken
+- After you select User, Folder, and Permission, click **Add** to add them to the action summary
- To remove an added Permission, select it in the panel and click **Remove**
## User Window
-Use the User window to select a user. The User window opens when the **User** down-arrow is selected
+Use the User window to select a user. The User window opens when you select the **User** down-arrow
on the Permissions page.
@@ -37,7 +36,7 @@ Select a user using the following options:
- Users found in the following column – Select this option to identify users via a data table column
- - Use the drop-down menu to select a data table column containing either the Mailbox display
+ - Use the dropdown menu to select a data table column containing either the Mailbox display
name or email address
- Select a data type for the selected field using the following options:
@@ -64,8 +63,8 @@ Select a user using the following options:
## Folder Window
-Use the Folder window to select folders. The Folder window opens when the **Folder** down-arrow is
-selected on the Permissions page.
+Use the Folder window to select folders. The Folder window opens when you select the **Folder**
+down-arrow on the Permissions page.
@@ -81,20 +80,20 @@ Select a folder using the following options:
- The list of folders – Select one of the default folders
- - Select a folder from the drop-down menu and click **Add**
+ - Select a folder from the dropdown menu and click **Add**
- To remove a folder, select it and click **Remove**
## Permission Window
-Use the Permission window to specify permissions. The Permission window opens when the
-**Permission** down-arrow is selected on the Permissions page.
+Use the Permission window to specify permissions. The Permission window opens when you select the
+**Permission** down-arrow on the Permissions page.
Specify permissions using the following options:
-- Permissions Level – Each permission level has a set of default selections. If a setting is
- changed, the Permissions Level field changes to **Custom**. Permission levels are associated with
+- Permissions Level – Each permission level has a set of default selections. If you change a
+ setting, the Permissions Level field changes to **Custom**. Permission levels are associated with
the different permissions available for assignment through Outlook. Options include:
- None
@@ -131,7 +130,7 @@ Specify permissions using the following options:
- Folder Contact – User receives automated messages about the folder such as replication
conflict messages, requests from users for additional permissions, and other changes to folder
status
- - Folder visible – User can see the folder but cannot read or edit the items within
+ - Folder visible – User can see the folder but can't read or edit the items within
- To add anonymous permissions, choose **None**
diff --git a/docs/accessanalyzer/12.0/admin/action/mailbox/samplinghost.md b/docs/accessanalyzer/12.0/admin/action/mailbox/samplinghost.md
index 38eada6b59..e424b0d640 100644
--- a/docs/accessanalyzer/12.0/admin/action/mailbox/samplinghost.md
+++ b/docs/accessanalyzer/12.0/admin/action/mailbox/samplinghost.md
@@ -19,12 +19,12 @@ Select an Exchange server to target using the following options:
- Use the mailbox associated with the Windows account that Access Analyzer is run with – Uses either
the account logged into the Access Analyzer Console server or the account set to run the Access
Analyzer application to access the Exchange mailbox
-- Exchange Mailbox (2010 and newer) – Allows Exhange Mailbox Alias to be specified for MAPI
+- Exchange Mailbox (2010 and newer) – Lets you specify an Exchange Mailbox Alias for MAPI
connections
- - When Exchange Mailbox (2010 and newer) is selected, the textbox is enabled. Enter the Alias
+ - When you select Exchange Mailbox (2010 and newer), the wizard enables the textbox. Enter the Alias
name in the textbox. The Alias needs to be an Exchange 2010 or newer mailbox, not a
- mail-enabled service account. However, this mailbox does not need rights on the Exchange
+ mail-enabled service account. However, this mailbox doesn't need rights on the Exchange
Organization; it only needs to reside within it.
- Client Access Server – Enter the name of the physical CAS in the textbox. This server can be
part of an array, but do enter the name of a CAS Array. This should also be the Exchange CAS
diff --git a/docs/accessanalyzer/12.0/admin/action/mailbox/trustedusers.md b/docs/accessanalyzer/12.0/admin/action/mailbox/trustedusers.md
index b2f260eac0..a3583f0a59 100644
--- a/docs/accessanalyzer/12.0/admin/action/mailbox/trustedusers.md
+++ b/docs/accessanalyzer/12.0/admin/action/mailbox/trustedusers.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# Mailbox: Trusted Users
-Use the Trusted Users page to select delegates to add. Users can be added individually or from a
+Use the Trusted Users page to select delegates to add. You can add users individually or from a
server with a mailbox environment. It is a wizard page for the following operations:
- Add Delegates
@@ -18,7 +18,7 @@ Select Trusted User delegates using the following options:
- Users found in the following column – Select this option to identify users via a data table column
- - Use the drop-down menu to select a data table column containing either the Mailbox display
+ - Use the dropdown menu to select a data table column containing either the Mailbox display
name or email address
- Select a data type for the selected field using the following options:
@@ -50,7 +50,6 @@ The following additional options are available for the Remove Delegates operatio
- Remove Permissions from Child Folders – Removes permissions from child folders
:::note
- This option is only enabled if the **Remove Permissions for Delegate** option is
- selected.
+ This option is enabled only if you select the **Remove Permissions for Delegate** option.
:::
diff --git a/docs/accessanalyzer/12.0/admin/action/overview.md b/docs/accessanalyzer/12.0/admin/action/overview.md
index bdc4022731..73e721eea7 100644
--- a/docs/accessanalyzer/12.0/admin/action/overview.md
+++ b/docs/accessanalyzer/12.0/admin/action/overview.md
@@ -11,7 +11,7 @@ Analyzer. This overview topic describes the basic procedure for creating and exe
module as well the initial steps to take when configuring an action. Each action module is described
in detail in the relevant topics.
-The Access Analyzer actions are capable of changing users, permissions, files, and objects from a
+Access Analyzer actions can change users, permissions, files, and objects from a
variety of environments. Action modules are assigned to a job at the **Configure** > **Actions**
node. See the [Actions Node](/docs/accessanalyzer/12.0/admin/jobs/job/configure/actions.md) topic for additional information on
the Action Selection view.
@@ -21,7 +21,7 @@ the Action Selection view.
Configure the action through the Action Properties page. Navigate to the job’s **Configure** >
**Actions** node. Select **Create Action** to add a new action task to a job. Select an existing
action and click **Action Properties** to modify its configuration. The Action Properties page opens
-for either option. Pre-configured action tasks can be added from the Action Library. See the
+for either option. You can add pre-configured action tasks from the Action Library. See the
[Action Libraries](/docs/accessanalyzer/12.0/admin/action/libraries.md) topic for additional information.
Most action modules are available with a special Access Analyzer License. The following table
@@ -62,8 +62,8 @@ Target the selected objects and apply selected operations to the data.
### Executing Actions
-Actions with the checkbox next to their name selected in the Action Selection view are executed
-automatically as part of the job’s execution. The actions are executed in the order in which they
+Actions with the checkbox next to their name selected in the Action Selection view run
+automatically when the job runs. The actions run in the order in which they
appear in the Selection table. You can also manually execute selected actions without running the
job by clicking on the **Action Execute** link on the Action Selection view.
@@ -72,14 +72,14 @@ job by clicking on the **Action Execute** link on the Action Selection view.
:::warning
Access Analyzer action modules apply bulk changes to targeted objects within the target
environment. Actions perform operations on selected objects listed in each row of the source table.
-Exercise caution to ensure the action applies only the desired changes and only to the desired
-target objects.
+Exercise caution to ensure the action applies only the changes you want and only to the
+objects you want to target.
:::
:::info
-Prior to configuring the action module, scope the source data table to include
-only the desired data. It is also recommended to run the action in a test environment before making
+Before configuring the action module, scope the source data table to include
+only the data you want. Also run the action in a test environment before making
changes to a production environment.
:::
@@ -99,7 +99,7 @@ created action tasks.
- Name – Action task name. For new actions, an editable default name displays.
- Description – Action task description. For new actions, this editable field is blank.
-- Action Module – Drop-down menu of available action modules
+- Action Module – dropdown menu of available action modules
- Configure Action – Opens the configuration wizard for the selected action module
@@ -111,14 +111,14 @@ created action tasks.
- ID – Unique identifier, or GUID, of the action task generated by the application. With this ID,
the database can distinguish actions, even those with identical configurations.
- Data Grid – Displays a sample of the selected Source table. This data grid functions the same as
- all data grids within Access Analyzer. Data can be filtered, and columns can be regrouped. See the
+ all data grids within Access Analyzer. You can filter data and regroup columns. See the
[Data Grid Functionality](/docs/accessanalyzer/12.0/admin/navigate/datagrid.md) topic for additional information.
### Source Table Configuration
All Access Analyzer actions require a source data table. The source table must contain, at a
minimum, the following columns. Include these columns in addition to any other columns required by
-the action module being used. Otherwise, errors may occur upon execution of the action and with
+the action module being used. Otherwise, errors may occur when you run the action, affecting
analysis and reports downstream.
| Required Columns | Description |
@@ -130,20 +130,20 @@ analysis and reports downstream.
| RowKey | Identifies each data row as unique. Sometimes the value is a GUID, but the datatype in the table is a varchar (text string). |
:::tip
-Remember, the individual action modules may have their own column requirements in addition to the
-above.
+Remember, individual action modules may have their own column requirements in addition to the
+columns listed here.
:::
#### Data Tables
-Access Analyzer native data tables generally contain all of the above columns. However, if all
-required columns are not present by default, add them manually.
+Access Analyzer native data tables generally contain all the columns listed here. However, if all
+required columns aren't present by default, add them manually.
:::warning
-Do not use native data tables in action modules. Source data tables in actions should
+Don't use native data tables in action modules. Source data tables in actions should
include only the data desired for the operation. Scope the data tables to include only the required
-columns prior to configuring the action.
+columns before configuring the action.
:::
diff --git a/docs/accessanalyzer/12.0/admin/action/powershell/executionoptions.md b/docs/accessanalyzer/12.0/admin/action/powershell/executionoptions.md
index d2db889a68..30fade58a2 100644
--- a/docs/accessanalyzer/12.0/admin/action/powershell/executionoptions.md
+++ b/docs/accessanalyzer/12.0/admin/action/powershell/executionoptions.md
@@ -21,8 +21,8 @@ The options on the Execution Options page are:
- Execute script remotely on a target server – Enable this to execute the PowerShell script on a
remote target server
- - Use the **Remote host** dropdown to select the database column that will be used as the target
- server name or type in a network host name
+ - Use the **Remote host** dropdown to select the database column to use as the target
+ server name, or type in a network host name
- Select the **Fall back to the local Access Analyzer server if the remote execution fails**
option to use the Access Analyzer server if remote execution fails
diff --git a/docs/accessanalyzer/12.0/admin/action/powershell/overview.md b/docs/accessanalyzer/12.0/admin/action/powershell/overview.md
index 51156d20c0..cb5165b3ba 100644
--- a/docs/accessanalyzer/12.0/admin/action/powershell/overview.md
+++ b/docs/accessanalyzer/12.0/admin/action/powershell/overview.md
@@ -10,8 +10,7 @@ The PowerShell action module provides methods of running PowerShell scripts on t
on remote hosts. Define PowerShell scripting actions using the PowerShell Action Module Wizard.
:::warning
-Ensure that only the changes required are applied and only to those target systems
-desired.
+Apply only the required changes, and only to the target systems you want to change.
:::
diff --git a/docs/accessanalyzer/12.0/admin/action/powershell/script.md b/docs/accessanalyzer/12.0/admin/action/powershell/script.md
index eefa4e7112..3355913373 100644
--- a/docs/accessanalyzer/12.0/admin/action/powershell/script.md
+++ b/docs/accessanalyzer/12.0/admin/action/powershell/script.md
@@ -6,15 +6,15 @@ sidebar_position: 10
# PowerShell Action: Script
-The Script page enables you to input the PowerShell script that will be used to perform the
+Use the Script page to input the PowerShell script used to perform the
requested action. Built-in variables are available for use in the script.
-The PowerShell script can be entered manually into the Script window at the top of the Script page.
+You can enter the PowerShell script manually into the Script window at the top of the Script page.
To open a pre-existing PowerShell script from a file, click **Open** to select the script file.
-At the bottom of the page are three tabs that can be used to configure the PowerShell action module
+At the bottom of the page are three tabs to configure the PowerShell action module
further. The tabs are:
- [Columns](#columns)
@@ -27,8 +27,8 @@ Use the Columns tab to select the available columns.
-The table in the Columns tab displays the Columns that can be used for the PowerShell script. To use
-a Column, select the checkbox under the **Use** column.
+The table in the Columns tab displays the columns available for the PowerShell script. To use
+a column, select the checkbox under the **Use** column.
@@ -53,7 +53,7 @@ The options are:
- Delete – Delete a selected parameter
:::note
-The built-in default parameters cannot be edited or deleted.
+You can't edit or delete the built-in default parameters.
:::
@@ -84,5 +84,5 @@ Preview how the input data will look in the Input Data tab.
-Information in the Input Data tab varies depending on which source table the PowerShell action
-module is configured to pull data from.
+Information in the Input Data tab varies depending on which source table you configure the
+PowerShell action module to pull data from.
diff --git a/docs/accessanalyzer/12.0/admin/action/publicfolder/action.md b/docs/accessanalyzer/12.0/admin/action/publicfolder/action.md
index 3580aaebb7..8c4dad3d50 100644
--- a/docs/accessanalyzer/12.0/admin/action/publicfolder/action.md
+++ b/docs/accessanalyzer/12.0/admin/action/publicfolder/action.md
@@ -10,8 +10,8 @@ The Action page specifies the basic action to perform on public folders. The pag
selection in the Steps pane adjust based on this selection.
:::note
-Once an action is selected and saved, and the wizard is closed, this page is no longer
-available and the selection cannot be altered.
+After you select and save an action and close the wizard, this page is no longer
+available, and you can't alter the selection.
:::
@@ -19,9 +19,8 @@ available and the selection cannot be altered.
Choose from the following actions:
-- Define a new action – Enables the Operation page where the operation on which the action is based
- is selected
-- Rollback a previously executed action – Enables the Prior Actions page where a list of previously
- executed actions is displayed and a selected action may be rolled back. Not all operations support
- rollback, and the Support Rollback option must be enabled prior to execution for the action to be
- eligible for rollback.
+- Define a new action – Enables the Operation page, where you select the operation on which to base
+ the action
+- Rollback a previously executed action – Enables the Prior Actions page, which displays a list of
+ previously executed actions that you can roll back. Not all operations support rollback. Enable
+ the Support Rollback option before execution to make the action eligible for rollback.
diff --git a/docs/accessanalyzer/12.0/admin/action/publicfolder/folders.md b/docs/accessanalyzer/12.0/admin/action/publicfolder/folders.md
index 95714dd88a..520841160e 100644
--- a/docs/accessanalyzer/12.0/admin/action/publicfolder/folders.md
+++ b/docs/accessanalyzer/12.0/admin/action/publicfolder/folders.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Public Folder: Folders
-The Folders page identifies which public folders are targeted by this action.
+The Folders page identifies which public folders this action targets.
@@ -17,8 +17,8 @@ The options on this page are:
- Field – Column names
:::note
- The displayed fields vary depending on the Source Table selected during the
- creation of the new action
+ The displayed fields vary depending on the Source Table you selected when you created
+ the new action
:::
diff --git a/docs/accessanalyzer/12.0/admin/action/publicfolder/mapisettings.md b/docs/accessanalyzer/12.0/admin/action/publicfolder/mapisettings.md
index 73d3dbb87d..590d15bfe4 100644
--- a/docs/accessanalyzer/12.0/admin/action/publicfolder/mapisettings.md
+++ b/docs/accessanalyzer/12.0/admin/action/publicfolder/mapisettings.md
@@ -16,6 +16,6 @@ Use the following options to configure the action:
- System Attendant (2003 & 2007)
- Use the mailbox associated with the Windows account on which Access Analyzer is run
- Exchange Mailbox (2010 and newer) – If targeting a 2010 Exchange Server, specify the CAS server.
- This is also where the MAPI setting is selected.
+ This is also where you select the MAPI setting.
- Client Access Server – Enter the Domain Name in this field
diff --git a/docs/accessanalyzer/12.0/admin/action/publicfolder/operations.md b/docs/accessanalyzer/12.0/admin/action/publicfolder/operations.md
index d42017ba4a..8892f41d58 100644
--- a/docs/accessanalyzer/12.0/admin/action/publicfolder/operations.md
+++ b/docs/accessanalyzer/12.0/admin/action/publicfolder/operations.md
@@ -10,7 +10,7 @@ Use the Operations page to specify the operations to perform as part of the acti
-The **Add operation** drop-down menu lists the operations that can be performed. Each operation
+The **Add operation** dropdown menu lists the operations you can perform. Each operation
opens a corresponding window. Operations include:
- Rename – See the [Rename Folder Window](#rename-folder-window) topic for additional information
@@ -22,9 +22,9 @@ opens a corresponding window. Operations include:
- Limits – See the [Limits Window](#limits-window) topic for additional information
- Delete – See the [Delete Folder Window](#delete-folder-window) topic for additional information
-The buttons to the right of the drop-down control the operations in the field:
+The buttons to the right of the dropdown control the operations in the field:
-- Edit – Allows you to alter operation settings
+- Edit – Alters operation settings
- Add – Places selected operation one step above its current position
- Down – Places selected operation one step below its current position
- Delete – Removes a selected operation
@@ -66,7 +66,7 @@ Change permissions using the following options:
- Mode – Select whether to change or remove permissions
- Permissions – Determine Permission level and assign permissions to the user
- - Permission level – Use the drop-down menu to select a permission level from the following:
+ - Permission level – Use the dropdown menu to select a permission level from the following:
- Reviewer
- Contributor
@@ -84,20 +84,20 @@ Change permissions using the following options:
- Read items – User can read items
- Create Subfolders – User can create subfolders
- Folder owner – User can view and move the public folder, create subfolders, and set
- permissions for the folder, but cannot read, edit, delete, or create items
+ permissions for the folder, but can't read, edit, delete, or create items
- Folder contact – Set user as the contact for the specified public folder
- - Folder visible – User can view the specified public folder but cannot read or edit the
+ - Folder visible – User can view the specified public folder but can't read or edit the
items within
:::note
- Different permissions become automatically selected based on which permission
- level is selected. To override this default, select the checkbox of the unwanted permission
- to deselect it. If a desired checkbox is blocked by a black square, click the square to
- unblock the checkbox. The checkbox can then be selected or unselected.
+ Selecting a permission level automatically selects the corresponding permissions. To
+ override this default, select the checkbox of the unwanted permission to deselect it. If a
+ desired checkbox is blocked by a black square, click the square to unblock the checkbox. You
+ can then select or unselect the checkbox.
:::
- - Edit items – Use the drop-down menu to determine user editing permissions from the following:
+ - Edit items – Use the dropdown menu to determine user editing permissions from the following:
- No change
- None
@@ -106,7 +106,7 @@ Change permissions using the following options:
- Own only
- All
- - Delete items – Use the drop-down menu to determine user deletion permissions from the
+ - Delete items – Use the dropdown menu to determine user deletion permissions from the
following:
- No change
@@ -132,8 +132,8 @@ Select attributes using the following options:
- Select a Field from the dropdown list and click **Add** to add the field to the custom attribute
:::note
- Multiple fields may be added to a custom attribute. Fields added to a custom attribute
- can be modified or deleted manually.
+ You can add multiple fields to a custom attribute. You can also modify or delete added
+ fields manually.
:::
@@ -145,7 +145,7 @@ Use the Replicas window to replicate servers. It is a wizard page for the Replic
Replicate servers using the following options:
-- Select a server from the dropdown menu and click **Add**. The servers listed will be replicated.
+- Select a server from the dropdown menu and click **Add**. The action replicates the listed servers.
- Select a server from the list and click **Delete** to remove it from the list of replicated
servers
- Select the **Remove last replica** option to delete the replica created when the action was last
@@ -182,5 +182,5 @@ Select deletion settings using the following options:
- Optionally, select a checkbox to apply any exception
- - Do not delete folders with subfolders
- - Do not delete folders with content
+ - Don't delete folders with subfolders
+ - Don't delete folders with content
diff --git a/docs/accessanalyzer/12.0/admin/action/publicfolder/overview.md b/docs/accessanalyzer/12.0/admin/action/publicfolder/overview.md
index 3a3c04a227..dd09173ef6 100644
--- a/docs/accessanalyzer/12.0/admin/action/publicfolder/overview.md
+++ b/docs/accessanalyzer/12.0/admin/action/publicfolder/overview.md
@@ -6,24 +6,22 @@ sidebar_position: 60
# PublicFolder Action Module
-The Public Folder action module allows users to make bulk changes to selected Microsoft Exchange
+Use the Public Folder action module to make bulk changes to selected Microsoft Exchange
public folders by adding, changing, or removing folders and permissions from the environment. Use
the Pubic Folder Action Module Wizard to choose the data table column that identifies the folders
and to configure the operations performed against the selected folders.
-Prior to configuring the Pubic Folder Action Module Wizard, scope the source data table to ensure
-the actions apply only to the desired folders.
+Before configuring the Pubic Folder Action Module Wizard, scope the source data table to ensure
+the actions apply only to the folders you want to change.
:::warning
-Be careful when using this action module. Make sure that only the changes required are
-applied and only to those target folders desired. Always verify the data prior to execution of any
-action.
+Be careful when using this action module. Apply only the required changes, and only to the target
+folders you want to change. Always verify the data before executing any action.
:::
:::info
-Although rollbacks for some actions are available, having to use one should be
-avoided
+Although rollbacks for some actions are available, avoid using one when possible
:::
diff --git a/docs/accessanalyzer/12.0/admin/action/publicfolder/prioractions.md b/docs/accessanalyzer/12.0/admin/action/publicfolder/prioractions.md
index c68eb8618d..7916368ae5 100644
--- a/docs/accessanalyzer/12.0/admin/action/publicfolder/prioractions.md
+++ b/docs/accessanalyzer/12.0/admin/action/publicfolder/prioractions.md
@@ -10,8 +10,8 @@ The Prior Actions page selects previously executed actions for rollback. It is a
**Rollback a previously executed action** is selected on the Action page.
:::note
-Once an action is selected and saved, and the wizard is closed, this page is no longer
-available and the selection cannot be altered.
+After you select and save an action and close the wizard, this page is no longer
+available, and you can't alter the selection.
:::
diff --git a/docs/accessanalyzer/12.0/admin/action/publicfolder/rollback.md b/docs/accessanalyzer/12.0/admin/action/publicfolder/rollback.md
index e7bae823e6..68729b9b25 100644
--- a/docs/accessanalyzer/12.0/admin/action/publicfolder/rollback.md
+++ b/docs/accessanalyzer/12.0/admin/action/publicfolder/rollback.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# Public Folder: Rollback
-Use the Rollback page to enable rollback capabilities for the action. If rollback isn’t selected at
-this step, the applied operations cannot be rolled back after execution of the action module.
+Use the Rollback page to enable rollback capabilities for the action. If you don't select rollback
+at this step, you can't roll back the applied operations after the action module runs.
diff --git a/docs/accessanalyzer/12.0/admin/action/publicfolder/summary.md b/docs/accessanalyzer/12.0/admin/action/publicfolder/summary.md
index 3cc7cf182c..bb821b7b02 100644
--- a/docs/accessanalyzer/12.0/admin/action/publicfolder/summary.md
+++ b/docs/accessanalyzer/12.0/admin/action/publicfolder/summary.md
@@ -10,6 +10,6 @@ The Summary page summarizes the configuration of the action.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Public Folder Action Module Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the Public Folder Action Module Wizard instead. This prevents the wizard from saving
+accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/action/registry/operations.md b/docs/accessanalyzer/12.0/admin/action/registry/operations.md
index 7e819f87c2..2e438a6ce3 100644
--- a/docs/accessanalyzer/12.0/admin/action/registry/operations.md
+++ b/docs/accessanalyzer/12.0/admin/action/registry/operations.md
@@ -13,11 +13,11 @@ Use the Operations page to select the operations to apply to the target hosts. S
Select and configure the operations using the following options:
-- Add operation – Use the drop-down menu to select an operation to perform on the target host. This
+- Add operation – Use the dropdown menu to select an operation to perform on the target host. This
opens a corresponding window for configuration. Operations include:
:::note
- Window options vary based on the operation selected from the drop-down menu.
+ Window options vary based on the operation selected from the dropdown menu.
:::
@@ -44,12 +44,12 @@ Select a key using the following options:
- Computer name – By default, the Registry browser connects to the local machine
- - If the desired registry item is on the local machine, browse the registry, and select the item
+ - If the registry item you want is on the local machine, browse the registry, and select it
- To connect to the registry of another machine:
- Enter the hostname in the **Computer name** textbox
- Click **Connect**, then browse the registry of that machine
- - Select the desired registry item
+ - Select the registry item you want
- Connect – Attempts to connect to the registry of the machine specified in the **Computer name**
field
@@ -64,14 +64,14 @@ Use the Select Users or Groups window to select a user, group, or built-in secur
The options are:
-- Select this object type – Displays types that are queried against
+- Select this object type – Displays the object types you can query
- Click **Object Types** to open the Object Types window and select the types to query against.
See the [Object Types Window](#object-types-window) topic for additional information.
-- From this location – Displays the location the intended objects are found
+- From this location – Displays the location to search for the intended objects
- - Click **Locations** to open the Locations window and set the location to be queried. See the
+ - Click **Locations** to open the Locations window and set the location to query. See the
[Locations Window](#locations-window) topic for additional information.
- Enter the object names to select – Select names of objects to query
@@ -126,8 +126,8 @@ following additional options:
- Columns – Click **Columns** to open the Choose Columns window. See the
[Choose Columns Window](#choose-columns-window) topic for additional information.
- Find now – Click **Find Now** to search for objects matching the selected criteria
-- Stop – While a search is running , the **Stop** button is available. Click **Stop** to halt the
- search before it is completed.
+- Stop – While a search is running, the **Stop** button is available. Click **Stop** to halt the
+ search before it completes.
- Search Results – Displays results from a search
#### Choose Columns Window
diff --git a/docs/accessanalyzer/12.0/admin/action/registry/overview.md b/docs/accessanalyzer/12.0/admin/action/registry/overview.md
index 19c2672e0f..6bc8ca8d4b 100644
--- a/docs/accessanalyzer/12.0/admin/action/registry/overview.md
+++ b/docs/accessanalyzer/12.0/admin/action/registry/overview.md
@@ -6,13 +6,13 @@ sidebar_position: 70
# Registry Action Module
-The Registry action module allows users to make bulk changes to the Microsoft Windows Registry. Use
+Use the Registry action module to make bulk changes to the Microsoft Windows Registry. Use
the Registry Action Module Wizard to choose the data table column that identifies the folders and to
configure the operations performed against the selected folders. The Registry action module requires
-a column containing the hosts to be targeted.
+a column containing the hosts to target.
-Prior to configuring the Registry Action Module Wizard, scope the source data table to ensure the
-actions apply only to the desired hosts.
+Before configuring the Registry Action Module Wizard, scope the source data table to ensure the
+actions apply only to the hosts you want to target.
:::warning
Unexpected values in the registry can cause major system failures when deleting or
@@ -28,9 +28,9 @@ module.
## Registry Action Source Table Configuration
-All data tables used in Access Analyzer action modules require the presence of certain data columns.
+All data tables used in Access Analyzer action modules require certain data columns.
In addition, individual action modules including Registry may have their own column requirements.
-The Registry action module requires a column containing the hosts that are going to be targeted.
+The Registry action module requires a column containing the hosts you want to target.
## Configuration
diff --git a/docs/accessanalyzer/12.0/admin/action/registry/summary.md b/docs/accessanalyzer/12.0/admin/action/registry/summary.md
index b18106e7cc..b7b7acdb15 100644
--- a/docs/accessanalyzer/12.0/admin/action/registry/summary.md
+++ b/docs/accessanalyzer/12.0/admin/action/registry/summary.md
@@ -10,6 +10,6 @@ The Summary page summarizes the configuration of the action.
-When done configuring the action, click **Finish**. If no changes were made, it is a best practice
-to click **Cancel** to close the Registry Action Module Wizard to ensure that no accidental clicks
-are saved.
+When done configuring the action, click **Finish**. If you didn't make any changes, click **Cancel**
+to close the Registry Action Module Wizard instead. This prevents the wizard from saving accidental
+clicks.
diff --git a/docs/accessanalyzer/12.0/admin/action/registry/targethosts.md b/docs/accessanalyzer/12.0/admin/action/registry/targethosts.md
index e9ed4cb068..5d2f750df4 100644
--- a/docs/accessanalyzer/12.0/admin/action/registry/targethosts.md
+++ b/docs/accessanalyzer/12.0/admin/action/registry/targethosts.md
@@ -11,6 +11,6 @@ alters.
-Use the drop-down menu to select the field that identifies the systems to be targeted. The list
+Use the dropdown menu to select the field that identifies the systems to target. The list
displays columns from the specified source table. The action applies the specified operations to all
systems in the field.
diff --git a/docs/accessanalyzer/12.0/admin/action/sendmail/message.md b/docs/accessanalyzer/12.0/admin/action/sendmail/message.md
index d056604729..9d08e364c8 100644
--- a/docs/accessanalyzer/12.0/admin/action/sendmail/message.md
+++ b/docs/accessanalyzer/12.0/admin/action/sendmail/message.md
@@ -15,8 +15,8 @@ Use the following fields to specify the text of the email:
- Subject – Specify a subject for the email. The contents of this field displays as the subject line
of the delivered email. Enter text directly and optionally use the Insert field to insert one or
more data fields. This is a required field.
-- Insert Field – Inserts a data field into the subject or body of the email. The drop-down menu
- displays a list of available fields. Once a selection displays in the field, click on the blue Up
+- Insert Field – Inserts a data field into the subject or body of the email. The dropdown menu
+ displays a list of available fields. Once a selection displays in the field, click the blue Up
and Down arrows to insert the field into the body or the subject, respectively. This field is
optional.
- Show sample input source data – To display a table of sample source data, click the icon next to
@@ -25,7 +25,7 @@ Use the following fields to specify the text of the email:
blue arrows to display the SMTP Options dialog box
- Preview – Displays the Message Preview window containing a preview of the current SendMail. Click
**Send** to send a single message to the addresses in the Recipient field in the Message Preview
- window. The Preview button is active only if the Recipients field is populated on the Properties
+ window. The Preview button is active only if you populate the Recipients field on the Properties
page of the Send Mail Action Module Wizard. See the
[Messages Preview Window](#messages-preview-window) topic for additional information.
- Clear Template – Clears any content from the Subject and Text Entry box
@@ -54,7 +54,7 @@ Use the following fields to specify the text of the email:
## Text Entry Box
-The Text Entry box allows you to compose a message. A Microsoft Word-style editor provides
+Use the Text Entry box to compose a message. A Microsoft Word-style editor provides
formatting options including the ability to insert dynamic text from the specified table (such as a
username) through the Insert field option. Use the editor to personalize the content and appearance
of each message.
@@ -62,13 +62,13 @@ of each message.
Example:
Assume the source table includes a column containing the names of intended recipients. Place the
-cursor in the greeting section of the email. Next, select that field from the Insert field drop-down
+cursor in the greeting section of the email. Next, select that field from the Insert field dropdown
list and click the down arrow to insert a dynamic field. The column name appears in the Text Entry
box, enclosed by brackets:
Dear [ProbableOwner];
-You are approaching your Mailbox storage quota. Please clean up any unneeded items.
+You are approaching your Mailbox storage quota. clean up any unneeded items.
**Thank you,**
diff --git a/docs/accessanalyzer/12.0/admin/action/sendmail/overview.md b/docs/accessanalyzer/12.0/admin/action/sendmail/overview.md
index ef77f5d01a..4479dd6575 100644
--- a/docs/accessanalyzer/12.0/admin/action/sendmail/overview.md
+++ b/docs/accessanalyzer/12.0/admin/action/sendmail/overview.md
@@ -16,14 +16,14 @@ The SendMail Action Module has multiple uses, for example:
workflow to contact clients and solicit feedback for use in the decision-making process
:::warning
-This module sends one or more electronic messages to a selected audience. Prior to
-executing the action, ensure the audience consists of only the desired members.
+This module sends one or more electronic messages to a selected audience. Before
+executing the action, ensure the audience consists of only the members you want to include.
:::
## Source Table Configuration
-All data tables used in Access Analyzer action modules require the presence of certain data columns.
+All data tables used in Access Analyzer action modules require certain data columns.
In addition, individual action modules including SendMail may have their own column requirements.
The SendMail Action Module requires a column containing well-formatted email addresses (for example,
`hfinn@netwrix.com`) for your recipients.
diff --git a/docs/accessanalyzer/12.0/admin/action/sendmail/properties.md b/docs/accessanalyzer/12.0/admin/action/sendmail/properties.md
index b8c26b0ad1..aa8438aeb0 100644
--- a/docs/accessanalyzer/12.0/admin/action/sendmail/properties.md
+++ b/docs/accessanalyzer/12.0/admin/action/sendmail/properties.md
@@ -12,16 +12,16 @@ Use the Properties page to specify the recipients of the email.
Use the following fields to specify the recipient information:
-- Recipient column – Use the drop-down menu to specify the column from the data table containing
+- Recipient column – Use the dropdown menu to specify the column from the data table containing
intended recipients, for example a column containing email addresses
-- Recipient type – Use the drop-down menu to specify the data type of the Recipient column, for
+- Recipient type – Use the dropdown menu to specify the data type of the Recipient column, for
example SMTP mail address
- Carbon copy (CC) – Optionally, specify one or more additional email addresses to receive a
carbon-copy of the SendMail message, for example an address not included in the source table.
- Use the following email address – Enter one or more additional email addresses. Separate
multiple addresses with a semi-colon and a space.
- - Use a column from the table – Use the drop-down menu to specify a column from the data table
+ - Use a column from the table – Use the dropdown menu to specify a column from the data table
- Combine multiple messages into a single message when all recipients are the same – Select this
checkbox to send only one message to each recipient as a result of this action (even recipients
diff --git a/docs/accessanalyzer/12.0/admin/action/sendmail/summary.md b/docs/accessanalyzer/12.0/admin/action/sendmail/summary.md
index 5db91af97a..8a855fbed6 100644
--- a/docs/accessanalyzer/12.0/admin/action/sendmail/summary.md
+++ b/docs/accessanalyzer/12.0/admin/action/sendmail/summary.md
@@ -10,9 +10,9 @@ The Summary page displays the SendMail configuration.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Send Mail Action Module Wizard to ensure that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the Send Mail Action Module Wizard instead. This prevents the wizard from saving accidental
+clicks.
To view the status of executed SendMail actions, see the
[Viewing the Status of SendMail Actions](/docs/accessanalyzer/12.0/admin/action/sendmail/viewstatus.md) for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/action/sendmail/viewstatus.md b/docs/accessanalyzer/12.0/admin/action/sendmail/viewstatus.md
index 69f0431f9d..c6f9d9ccda 100644
--- a/docs/accessanalyzer/12.0/admin/action/sendmail/viewstatus.md
+++ b/docs/accessanalyzer/12.0/admin/action/sendmail/viewstatus.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Viewing the Status of SendMail Actions
-Follow the steps to view the status of an executed SendMail action:
+To view the status of an executed SendMail action, complete the following steps:
diff --git a/docs/accessanalyzer/12.0/admin/action/servicenow/authentication.md b/docs/accessanalyzer/12.0/admin/action/servicenow/authentication.md
index 8de9ff381a..8f2668540d 100644
--- a/docs/accessanalyzer/12.0/admin/action/servicenow/authentication.md
+++ b/docs/accessanalyzer/12.0/admin/action/servicenow/authentication.md
@@ -8,7 +8,7 @@ sidebar_position: 10
The Authentication page implements signing into a ServiceNow account.
-A ServiceNow account must be set up and configured to determine which incidents will be visible on
+You must set up and configure a ServiceNow account to determine which incidents appear on
the Incident Creation page.
diff --git a/docs/accessanalyzer/12.0/admin/action/servicenow/description.md b/docs/accessanalyzer/12.0/admin/action/servicenow/description.md
index 6ede97877d..5894f801bc 100644
--- a/docs/accessanalyzer/12.0/admin/action/servicenow/description.md
+++ b/docs/accessanalyzer/12.0/admin/action/servicenow/description.md
@@ -7,15 +7,15 @@ sidebar_position: 30
# ServiceNow Action: Description
The Description page provides details on the incidents entered into a field on the Incident Creation
-page. A description of the incident and related comments are included with the incident’s report to
-provide additional feedback to the system administrator, and may be saved to a template.
+page. The incident's report includes a description of the incident and related comments to provide
+additional feedback to the system administrator. You can also save these to a template.
Create a report using the following options:
- Short Description – Displays entered words or phrases used to summarize the incident
-- Insert Field – Use the drop-down menu to select a field (column) from the source table
+- Insert Field – Use the dropdown menu to select a field (column) from the source table
- Click the **blue down arrow** to insert the item into the Short Description section
- Click the **blue up arrow** to insert the item in to the Comments section
diff --git a/docs/accessanalyzer/12.0/admin/action/servicenow/incidentcreation.md b/docs/accessanalyzer/12.0/admin/action/servicenow/incidentcreation.md
index 4693c95aae..2eddbfae5a 100644
--- a/docs/accessanalyzer/12.0/admin/action/servicenow/incidentcreation.md
+++ b/docs/accessanalyzer/12.0/admin/action/servicenow/incidentcreation.md
@@ -6,17 +6,17 @@ sidebar_position: 20
# ServiceNow Action: Incident Creation
-The Incident Creation page is available once the ServiceNow credentials are approved. Incidents on
-this page belong to two fields: Mandatory and Optional. The type of field and its incidents are
-chosen within ServiceNow’s configuration page. Selecting a field and entering a value will include
+The Incident Creation page is available after ServiceNow approves the credentials. Incidents on
+this page belong to two fields: Mandatory and Optional. You configure the type of field and its
+incidents within ServiceNow’s configuration page. Selecting a field and entering a value will include
the incident within ServiceNow’s incident report.
At the New Incident field list section, enter the fields for which incident to include on
ServiceNow’s incident report. The ServiceNow account entered on the Authentication page determines
-which incidents are available within the fields on the Incidents Creation page and are adjusted in
-ServiceNow.
+which incidents are available within the fields on the Incidents Creation page. You adjust these
+incidents in ServiceNow.
-Fields with a drop-down menu have a set of preconfigured options to select. Fields with ellipsis
+Fields with a dropdown menu have a set of preconfigured options to select. Fields with ellipsis
choose members from a preconfigured list.
diff --git a/docs/accessanalyzer/12.0/admin/action/servicenow/overview.md b/docs/accessanalyzer/12.0/admin/action/servicenow/overview.md
index 9ce3a4a849..9b70768c87 100644
--- a/docs/accessanalyzer/12.0/admin/action/servicenow/overview.md
+++ b/docs/accessanalyzer/12.0/admin/action/servicenow/overview.md
@@ -6,18 +6,18 @@ sidebar_position: 90
# ServiceNow Action Module
-The ServiceNow Action Module is primarily intended to allow for the automated creation of ServiceNow
-incidents from data collected by the Netwrix suite of data security tools. By facilitating
-communication between tools like Access Analyzer and ServiceNow’s incident management capability,
-security risks in an organization’s environment can not only be identified, but presented to admins,
-managers, and other stakeholders in a familiar way, with respect to chains of command and approval
-as dictated by employee relationships and business workflows implemented in ServiceNow.
+The ServiceNow Action Module automates the creation of ServiceNow incidents from data collected by
+the Netwrix suite of data security tools. By facilitating communication between tools like Access
+Analyzer and ServiceNow’s incident management capability, the module doesn't just identify security
+risks in an organization’s environment — it presents them to admins, managers, and other
+stakeholders in a familiar way, following the chains of command and approval that employee
+relationships and business workflows define in ServiceNow.
When account lockouts occur, the Active Directory Inventory Data Collector makes that information
available. From the Access Analyzer console, the ServiceNow Action Module transmits customized
information regarding the locked out accounts directly to those responsible for account management,
-alerting them of the issue and requesting that appropriate action is taken to re-enable user
-accounts before effected users are aware of the problem.
+alerting them of the issue and requesting that they take appropriate action to re-enable user
+accounts before affected users become aware of the problem.
This section describes the following pages in the configuration wizard.
@@ -32,16 +32,16 @@ The ServiceNow Action Module requires an active ServiceNow account with:
## Permissions
-The following permissions are required to utilize Access Analyzer’s ServiceNow Action Module:
+The following permissions are required to use Access Analyzer’s ServiceNow Action Module:
- ServiceNow admin account – An Administrator Role by an organization’s ServiceNow administrator
-- The **Settings** > **ServiceNow** node at the global level can be configured with a credential
+- You can configure the **Settings** > **ServiceNow** node at the global level with a credential
provisioned to create incidents as Callers in the **Assigned to** field, and any other ServiceNow
incident field that references the sys_user table.
## Connecting ServiceNow
-The following instructions can only be performed with a ServiceNow admin account and access to the
+You can perform the following instructions only with a ServiceNow admin account and access to the
ServiceNow Action Module XML file.
@@ -50,23 +50,23 @@ ServiceNow Action Module XML file.
`STEALTHbits SN Action Module v1.0_merged_rev2.0` file to use on ServiceNow’s website.
**Step 2 –** Visit servicenow.com, sign into the administrator account, expand **System Update
-Sets**, and click on **Retrieved Update Sets**.
+Sets**, and click **Retrieved Update Sets**.
-**Step 3 –** Under **Related Links**, click on **Import Update Set from XML**.
+**Step 3 –** Under **Related Links**, click **Import Update Set from XML**.
**Step 4 –** Attach the `STEALTHbits SN Action Module v1.0_merged_rev2.0` file, and then click
**Upload**.
-**Step 5 –** After the file is uploaded, click on the **STEALTHbits SN Action Module** within the
+**Step 5 –** After you upload the file, click the **STEALTHbits SN Action Module** within the
list of updated sets.
-**Step 6 –** Click on the **Preview Update Set** button. Wait until the update set preview is
-finished and then click **Commit Update Set**. Then, close the Update Set Commit window.
+**Step 6 –** Click the **Preview Update Set** button. Wait until the update set preview
+completes, then click **Commit Update Set**. Then, close the Update Set Commit window.
**Step 7 –** On the navigation page, expand **System Definitions** and click **Plugins**. Then click
on the **Insert Multiple Web Service plugin**
-**Step 8 –** Under **Related Links**, click on **Activate/Upgrade** and click **Activate** on the
+**Step 8 –** Under **Related Links**, click **Activate/Upgrade** and click **Activate** on the
Activate Plugin window. When the Activation is complete, click **Close** to close the window.
**Step 9 –** Click **Reload** on the System Plugin page and confirm the Status is Active.
diff --git a/docs/accessanalyzer/12.0/admin/action/servicenow/summary.md b/docs/accessanalyzer/12.0/admin/action/servicenow/summary.md
index 0ff331c99d..332c408023 100644
--- a/docs/accessanalyzer/12.0/admin/action/servicenow/summary.md
+++ b/docs/accessanalyzer/12.0/admin/action/servicenow/summary.md
@@ -10,6 +10,6 @@ The Summary page displays a summary of the configured query.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the ServiceNow Action Module Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the ServiceNow Action Module Wizard instead. This prevents the wizard from saving accidental
+clicks.
diff --git a/docs/accessanalyzer/12.0/admin/action/survey/introduction.md b/docs/accessanalyzer/12.0/admin/action/survey/introduction.md
index a42dbea445..5f7ad9f72c 100644
--- a/docs/accessanalyzer/12.0/admin/action/survey/introduction.md
+++ b/docs/accessanalyzer/12.0/admin/action/survey/introduction.md
@@ -8,7 +8,7 @@ sidebar_position: 20
Use this page to specify web page introductory text (if any) for the web page specified on the Web
Server page. See the [Survey: Web Server](/docs/accessanalyzer/12.0/admin/action/survey/webserver.md) topic for additional information. The
-introductory text appears on the landing page when recipients click on the survey link in the email.
+introductory text appears on the landing page when recipients click the survey link in the email.
@@ -19,7 +19,7 @@ The configurable options are:
are limited to data from the SQL table specified at the Source Table field on the Action
Properties page.
- Place the cursor in the text where a field should appear. Next, click on the drop-down and
+ Place the cursor in the text where a field should appear. Next, click the dropdown and
select a field from the list. When a selection appears in the field, click the blue down arrow.
The field appears in the text.
diff --git a/docs/accessanalyzer/12.0/admin/action/survey/mailmessage.md b/docs/accessanalyzer/12.0/admin/action/survey/mailmessage.md
index 8f164fc03b..6f60ada0e4 100644
--- a/docs/accessanalyzer/12.0/admin/action/survey/mailmessage.md
+++ b/docs/accessanalyzer/12.0/admin/action/survey/mailmessage.md
@@ -13,7 +13,7 @@ not using them.
Placeholder text displays in the Message box. This text includes a hyperlink to the web page hosting
-the survey. Placeholder text can be modified but the link cannot be removed. The link does not
+the survey. You can modify the placeholder text, but you can't remove the link. The link doesn't
activate until the message is sent.
Use the following fields to specify the text of the email:
@@ -21,8 +21,8 @@ Use the following fields to specify the text of the email:
- Subject – Specify subject text for the email. The contents of this field displays as the Subject
line of the delivered email. Enter text directly and use the **Insert field** to insert one or
more data fields. This is a required field.
-- Insert Field – Inserts a data field into the subject or body of the email. The drop-down menu
- displays a list of available fields. Once a selection displays in the field, click on the blue
+- Insert Field – Inserts a data field into the subject or body of the email. The dropdown menu
+ displays a list of available fields. Once a selection displays in the field, click the blue
Down and Up arrows to insert the field into the body or the subject, respectively. This field is
optional.
- The following are buttons appearing on a bar below the Subject field:
@@ -33,18 +33,18 @@ Use the following fields to specify the text of the email:
the blue arrows to display the SMTP Options dialog box
- Preview – Displays the Messages Preview window containing a preview of the current email
message. Click **Send** to send a single message to the addresses in the Recipient field in
- the Message Preview window. The Preview button is active only if the Recipients field is
- populated. See the [Messages Preview Window](#messages-preview-window) topic for additional
+ the Message Preview window. The Preview button is active only if you populate the Recipients
+ field. See the [Messages Preview Window](#messages-preview-window) topic for additional
information.
- Clear Template – Clears any content from the Subject and Text Entry box
-- Load from template – Survey templates are a legacy feature. It is strongly recommended not use
+- Load from template – Survey templates are a legacy feature. Netwrix strongly recommends not using
templates when creating surveys.
- Save to template – Saves the current email subject and content to a template. If an existing
template name appears in the **Load from template** field, clicking this button updates that
template. If the **Load from template** field is empty or contains a name other than one of the
- existing templates, clicking this button accesses the Save SendMail Template window and changes
- can be saved to a new template. Templates reside locally on the host computer as XML files, in the
+ existing templates, clicking this button accesses the Save SendMail Template window, and you can save changes
+ to a new template. Templates reside locally on the host computer as XML files, in the
`Actions/SM_Templates` folder.
## Messages Preview Window
diff --git a/docs/accessanalyzer/12.0/admin/action/survey/mailproperties.md b/docs/accessanalyzer/12.0/admin/action/survey/mailproperties.md
index 3f3121f879..21a38a63b9 100644
--- a/docs/accessanalyzer/12.0/admin/action/survey/mailproperties.md
+++ b/docs/accessanalyzer/12.0/admin/action/survey/mailproperties.md
@@ -14,10 +14,10 @@ Use the following fields to specify the recipient information:
- Recipient column – Specify the data table columns containing intended recipient information
- - For example, a column containing email addresses. The drop-down menu displays a list of
+ - For example, a column containing email addresses. The dropdown menu displays a list of
possible column types.
-- Recipient type – Specify the data type of the Recipient column. The drop-down menu displays a list
+- Recipient type – Specify the data type of the Recipient column. The dropdown menu displays a list
of recipient types, for example **SMTP email address**.
- Carbon copy (CC) – (Optional) Specify one or more additional email addresses to receive a
carbon-copy of the SendMail message, for example an address not included in the source table.
diff --git a/docs/accessanalyzer/12.0/admin/action/survey/overview.md b/docs/accessanalyzer/12.0/admin/action/survey/overview.md
index f05c07b702..ab97c6fe40 100644
--- a/docs/accessanalyzer/12.0/admin/action/survey/overview.md
+++ b/docs/accessanalyzer/12.0/admin/action/survey/overview.md
@@ -10,20 +10,20 @@ Use this action module to create surveys and make them available to targeted rec
For example, a survey can solicit feedback from clients or poll employees on company issues.
The Survey Action Module Wizard builds customizable, web-based surveys containing questions created
-by the user. Once the survey is defined, a list of recipients can then be specified. When executing
+by the user. After you define the survey, specify a list of recipients. When executing
the action, the process simultaneously sends an email to the recipients containing a link to the
survey and creates a web page to host the survey.
:::warning
-This module sends one or more electronic messages to a selected audience. Prior to
-executing the action, ensure the audience consists of only the desired members. Netwrix recommends
+This module sends one or more electronic messages to a selected audience. Before
+executing the action, ensure the audience consists of only the members you want to include. Netwrix recommends
using this and all other Access Analyzer actions with caution.
:::
## Survey Action Source Table Configuration
-All data tables used in Access Analyzer action modules require the presence of certain data columns.
+All data tables used in Access Analyzer action modules require certain data columns.
In addition, individual action modules including Survey may have their own column requirements. The
Survey action module requires a column containing well-formatted email addresses (for example,
`hfinn@netwrix.com`) for your recipients.
diff --git a/docs/accessanalyzer/12.0/admin/action/survey/questions.md b/docs/accessanalyzer/12.0/admin/action/survey/questions.md
index a71e051d66..8baa0c24d5 100644
--- a/docs/accessanalyzer/12.0/admin/action/survey/questions.md
+++ b/docs/accessanalyzer/12.0/admin/action/survey/questions.md
@@ -39,7 +39,7 @@ The configurable options are:
available:
- Text – Specify the survey question
- - Subjects – Click on the ellipses (**…**) to open the Select subjects window. Specify the
+ - Subjects – Click the ellipses (**…**) to open the Select subjects window. Specify the
object to which a question is directed. The selected subjects show in the Subjects field. See
the [Select Subjects Window](#select-subjects-window) topic for additional information.
- Answer Column Name – The Survey action module inserts the results of the survey directly into
@@ -49,11 +49,11 @@ The configurable options are:
- Yes/No
- Text
- - Multiple Choice – If this option is selected, the **Answers** button activates. Click this
+ - Multiple Choice – If you select this option, the **Answers** button activates. Click this
button to open the Answers window and specify the response options to the multiple choice
question via the **Add** button.
- - Answers – This button activates if Multiple Choice in the Question Type field is selected.
+ - Answers – This button activates if you select Multiple Choice in the Question Type field.
Click to access the Answers window.
- Description – Specify any additional explanation of the survey question. The text appears on
the survey below the associated question.
diff --git a/docs/accessanalyzer/12.0/admin/action/survey/testsurvey.md b/docs/accessanalyzer/12.0/admin/action/survey/testsurvey.md
index cf71673b13..b87d52f52c 100644
--- a/docs/accessanalyzer/12.0/admin/action/survey/testsurvey.md
+++ b/docs/accessanalyzer/12.0/admin/action/survey/testsurvey.md
@@ -13,6 +13,5 @@ Use this page to test a survey and verify proper configuration.
The configurable options are:
- Start test – Click to test your survey configuration
-- Survey full test – Once the survey configuration test passes inspection, a full survey can be
- tested against a single user (for example, your own email account) to verify a survey matches
- design criteria
+- Survey full test – After the survey configuration test passes inspection, test a full survey
+ against a single user (for example, your own email account) to verify it matches design criteria
diff --git a/docs/accessanalyzer/12.0/admin/action/webrequest/destination.md b/docs/accessanalyzer/12.0/admin/action/webrequest/destination.md
index 05a768d563..4d4af99851 100644
--- a/docs/accessanalyzer/12.0/admin/action/webrequest/destination.md
+++ b/docs/accessanalyzer/12.0/admin/action/webrequest/destination.md
@@ -12,7 +12,7 @@ Use the Destination page to specify all settings for the destination of the web
Use the following categories to establish the location of the web request:
-- Insert field – Select a field using the drop-down menu
+- Insert field – Select a field using the dropdown menu
:::note
The fields available varies based on the source table columns.
@@ -41,12 +41,12 @@ Use the following categories to establish the location of the web request:
- Resource – URL destination to send the data via the web request
- - Select a field using the drop-down menu, place the cursor in the Resource textbox, and click
+ - Select a field using the dropdown menu, place the cursor in the Resource textbox, and click
the blue down-arrow to add it to the Resource box
- Manually enter a resource in the textbox
:::note
- A red circle with an x indicates that the Resource field cannot be empty.
+ A red circle with an x indicates that the Resource field can't be empty.
:::
@@ -56,17 +56,17 @@ Use the following categories to establish the location of the web request:
- Basic – Basic authentication
- JWT – JSON Web Token, a URL-safe authentication method
- Basic and JWT authentications are pulled from the credential profile set in the job. It inserts
- that data into the authentication header of the web request with the proper format expected (for
+ The wizard pulls Basic and JWT authentication from the credential profile set in the job. It
+ inserts that data into the authentication header of the web request with the proper format expected (for
example, Basic [Base64 encoded credentials] or Bearer [JWT token] for Basic and JWT
authentication respectively).
**Test Connection**
-- Drop-down menu – Select a method to test. Currently locked to GET.
+- dropdown menu – Select a method to test. locked to GET.
- URI textbox – Input the resource to receive the test message
- - Select a field using the drop-down menu, place the cursor in text area, and click the blue
+ - Select a field using the dropdown menu, place the cursor in text area, and click the blue
down-arrow to add it to the URI textbox
- Manually enter a resource in the field
diff --git a/docs/accessanalyzer/12.0/admin/action/webrequest/header.md b/docs/accessanalyzer/12.0/admin/action/webrequest/header.md
index 0f5bea2e15..b998333561 100644
--- a/docs/accessanalyzer/12.0/admin/action/webrequest/header.md
+++ b/docs/accessanalyzer/12.0/admin/action/webrequest/header.md
@@ -12,7 +12,7 @@ Use the Header page to enter the header values for the request.
Use the following options to enter header values:
-- Insert field – Select a field to include in the request using the drop-down menu
+- Insert field – Select a field to include in the request using the dropdown menu
:::note
The fields available varies based on the source table columns.
@@ -26,6 +26,6 @@ Use the following options to enter header values:
- Key / Value fields – The name or value of the attribute
- - Select a field using the drop-down menu, place the cursor in the cell of the desired Key or
- Value, and click the blue down-arrow to add it to the selected cell
+ - Select a field using the dropdown menu, place the cursor in the cell of the Key or Value
+ field you want, and click the blue down-arrow to add it to the selected cell
- Manually enter a field in the cell
diff --git a/docs/accessanalyzer/12.0/admin/action/webrequest/overview.md b/docs/accessanalyzer/12.0/admin/action/webrequest/overview.md
index 5c1b95a8e4..cd35a01ae1 100644
--- a/docs/accessanalyzer/12.0/admin/action/webrequest/overview.md
+++ b/docs/accessanalyzer/12.0/admin/action/webrequest/overview.md
@@ -7,12 +7,12 @@ sidebar_position: 110
# WebRequest Action Module
The Web Request action module provides methods of applying bulk changes to REST endpoints. At this
-stage, target endpoints should be identified to invoke web requests against. This wizard allows the
-definition of requests to perform.
+stage, identify the target endpoints to invoke web requests against. This wizard lets you define
+requests to perform.
:::warning
-Ensure that only the changes required are applied and only those target systems desired
-when using this action module.
+When using this action module, apply only the required changes, and only to the target
+systems you want.
:::
diff --git a/docs/accessanalyzer/12.0/admin/action/webrequest/parameters.md b/docs/accessanalyzer/12.0/admin/action/webrequest/parameters.md
index 32268af111..12e1828821 100644
--- a/docs/accessanalyzer/12.0/admin/action/webrequest/parameters.md
+++ b/docs/accessanalyzer/12.0/admin/action/webrequest/parameters.md
@@ -12,7 +12,7 @@ Use the Parameters page to enter the parameter values.
Enter parameter values using the following options:
-- Insert Field – Select a field to include in the request from the drop-down menu.
+- Insert Field – Select a field to include in the request from the dropdown menu.
:::note
The fields available varies based on the source table.
@@ -36,8 +36,8 @@ Enter parameter values using the following options:
- Key / Value Fields – The name or value of the attribute
- - Select a field using the drop-down menu, place the cursor in the cell of the desired Key or
- Value, and click the blue down-arrow to add it to the selected cell
+ - Select a field using the dropdown menu, place the cursor in the cell of the Key or Value
+ field you want, and click the blue down-arrow to add it to the selected cell
- Select a cell and click the green circle with plus sign to open the Custom Attribute Editor
window and add the attribute to the cell
- Manually enter a field in the cell
@@ -51,16 +51,16 @@ and advanced functions.
Create custom attributes using the following options:
-- Insert field – Select a field to insert using the drop-down menu
-- Unique name – Name of the custom attribute that will be created
+- Insert field – Select a field to insert using the dropdown menu
+- Unique name – Name for the custom attribute to create
- - Select a field using the drop-down menu, place the cursor in the Unique name textbox, and
+ - Select a field using the dropdown menu, place the cursor in the Unique name textbox, and
click the blue down-arrow to add it to the Unique name textbox
- Manually enter the name
- Data – The actual value of the custom attribute (can be database value or manually specified)
- - Select a field using the drop-down menu, place the cursor in the Data textbox, and click the
+ - Select a field using the dropdown menu, place the cursor in the Data textbox, and click the
blue down-arrow to add it to the Data textbox
- Manually enter the data
diff --git a/docs/accessanalyzer/12.0/admin/action/webrequest/summary.md b/docs/accessanalyzer/12.0/admin/action/webrequest/summary.md
index 7a99244f4b..511044faec 100644
--- a/docs/accessanalyzer/12.0/admin/action/webrequest/summary.md
+++ b/docs/accessanalyzer/12.0/admin/action/webrequest/summary.md
@@ -10,6 +10,6 @@ The Summary page displays a summary of the configured action.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Web Request Action Module Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the Web Request Action Module Wizard instead. This prevents the wizard from saving accidental
+clicks.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/autoaction.md b/docs/accessanalyzer/12.0/admin/analysis/autoaction.md
index d18a7d4ade..e12b3b2484 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/autoaction.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/autoaction.md
@@ -18,13 +18,13 @@ The Actions node can also automatically execute actions. See the
## Select Action Window
-The Select Action window lists the actions that currently exist within the Job that can be selected
-to automatically run upon job execution.
+The Select Action window lists the actions that exist within the Job and that you can select
+to run automatically upon job execution.
Select an action from the list. Click **OK** to exit the window, and then click **Save** to preserve
-the changes made to the analysis module. The action now executes as part of the analysis task. If no
-actions were selected, it is best practice to click **Cancel** to close the Select Action window to
-ensure no accidental selections are saved. Actions only display if they exist within the Actions
+the changes made to the analysis module. The action now executes as part of the analysis task. If you didn't select any actions, click
+**Cancel** to close the Select Action window instead. This prevents the wizard from saving
+accidental selections. Actions only display if they exist within the Actions
node of the current Job.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/businessrules/appliesto.md b/docs/accessanalyzer/12.0/admin/analysis/businessrules/appliesto.md
index a8b0e9d897..4629d7785e 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/businessrules/appliesto.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/businessrules/appliesto.md
@@ -20,14 +20,14 @@ The Applies To tab provides the following options:
- All Source Data – Select this option to run the action using all data
- Source Data from this Console only – Select this option to run the action specifically using
data from only this Access Analyzer console
- - Time Window for source table – Use the drop-down menu to specify a time window from the
+ - Time Window for source table – Use the dropdown menu to specify a time window from the
following options:
- Most recent data – Use only the most recently collected data
- Cumulative data for offline hosts – Use data collected from offline hosts
- Most recent data filtering duplicate and offline hosts – Use most recent data excluding
duplicate and offline hosts
- - Do not filter data – Use unfiltered data
+ - Don't filter data – Use unfiltered data
- Hosts Filtering – Specify source hosts
diff --git a/docs/accessanalyzer/12.0/admin/analysis/businessrules/logic.md b/docs/accessanalyzer/12.0/admin/analysis/businessrules/logic.md
index 177d8bafa9..5b7868ab21 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/businessrules/logic.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/businessrules/logic.md
@@ -16,7 +16,7 @@ The Logic tab contains the following sections and options:
- Rule Name – The field defaults with the name on the Analysis Properties page and is manually
editable
- - Table – Select a table from the drop-down menu containing the baseline values to evaluate
+ - Table – Select a table from the dropdown menu containing the baseline values to evaluate
- To view data from a selected table, click the ellipsis (**…**) to open the Sample Data
Viewer window, or select a table within the viewer. See the
@@ -48,20 +48,20 @@ Use the Sample Data Viewer window to examine data in a selected table.
The Sample Data Viewer window provides the following options:
-- Use the drop-down menu to select a table to view the table’s data. The field defaults with the
+- Use the dropdown menu to select a table to view the table’s data. The field defaults with the
table selected in the Logic tab if previously selected.
- Show First [Number] rows – Adjusts the presentation of the number of rows of the selected table.
The default value is 50. It can be manually adjusted with values between 0 and all.
## EditConditionsForm Window
-Use the EditConditionsForm to configure conditions to be applied to the table.
+Use the EditConditionsForm to configure conditions to apply to the table.
The EditConditionsForm contains the following options:
-- Column – Use the drop-down menu to select a column from the table selected in the Logic tab
+- Column – Use the dropdown menu to select a column from the table selected in the Logic tab
- Operator – Use the dropdown to select an operator:
- `<` – Search for items in the selected column with values less than a selected value
@@ -101,14 +101,14 @@ The Configure Scorecard Options window provides the following options:
- Action Name – Enter a name for the action
- Description – Enter a description for the action
-- Action Classification – This section allows you to group scorecard action results for reporting
+- Action Classification – Use this section to group scorecard action results for reporting
purposes
- Category – Enter a desired category name in the field or use the dropdown to select from
previously titled categories
- Index – Enter a desired index value for the scorecard action
-- Action Score – This section allows you to rank the action’s importance relative to other scorecard
+- Action Score – Use this section to rank the action’s importance relative to other scorecard
actions
- Score – Enter a desired score value for the scorecard action
@@ -119,9 +119,9 @@ The Configure Scorecard Options window provides the following options:
- Knowledge – Enter information to assist issue resolution, for example a website URL
-- Captured Values – This section allows you to select up to five optional properties whose values
- will be captured and stored with the scorecard entry. For each property selected, a name column
+- Captured Values – Use this section to select up to five optional properties. The system captures
+ and stores their values with the scorecard entry. For each property selected, a name column
and value column appear in the scorecard.
- - Property [1-5] – Select a property from the selected table using the drop-down menu to capture
+ - Property [1-5] – Select a property from the selected table using the dropdown menu to capture
and store its values with the scorecard
diff --git a/docs/accessanalyzer/12.0/admin/analysis/businessrules/overview.md b/docs/accessanalyzer/12.0/admin/analysis/businessrules/overview.md
index 309a0f2204..c9c50776e1 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/businessrules/overview.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/businessrules/overview.md
@@ -8,19 +8,19 @@ sidebar_position: 20
The Business Rules analysis module measures and evaluates a configured value from an object (the
baseline value) and compares it against a stated value (the business rule) to find an exception or
-deviation. Any deviations or differences found the execution of a business rule appear in a
+deviation. Any deviations or differences found when a business rule runs appear in a
resultant table called a scorecard.
-Create one or more jobs to collect the data to be analyzed. Then configure one or business rules to
+Create one or more jobs to collect the data to analyze. Then configure one or business rules to
analyze the data. Examine the scoreboard to determine how an object is performing with regard to its
original baseline expectations.
## Scorecard
-Business Rules analysis module results are displayed in a table called a scorecard. The scorecard
-determines which of the rules are applied, and in what order. A scorecard table contains only
+The Business Rules analysis module displays results in a table called a scorecard. The scorecard
+determines which rules apply, and in what order. A scorecard table contains only
exceptions and deviations from the business rule criteria when compared to a baseline value. The
-table does not include matches to the criteria. All scorecard table names are suffixed with
+table doesn't include matches to the criteria. All scorecard table names end with
`_SCORECARD` for easy identification.
## Edit Rules Window
diff --git a/docs/accessanalyzer/12.0/admin/analysis/changedetection/additionalfields.md b/docs/accessanalyzer/12.0/admin/analysis/changedetection/additionalfields.md
index fb649b3d70..2d8c7960ad 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/changedetection/additionalfields.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/changedetection/additionalfields.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# Change Detection: Additional Fields
Use the Additional Fields page to choose any additional fields to include with the change analysis.
-These fields do not detect change, but may provide additional information to help diagnose and
+These fields don't detect change, but may provide additional information to help diagnose and
analyze the changes reported.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/changedetection/input.md b/docs/accessanalyzer/12.0/admin/analysis/changedetection/input.md
index 22c9d922f9..1affc57da6 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/changedetection/input.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/changedetection/input.md
@@ -12,10 +12,10 @@ Use the Input Data Source page to choose a data source to analyze for changes.
The configurable option is:
-- Please select a data source – Select a data source table from the list
+- select a data source – Select a data source table from the list
:::note
- The selectable data sources change based on which option is selected on the Input
+ The selectable data sources change based on the option you select on the Input
Scope page.
:::
diff --git a/docs/accessanalyzer/12.0/admin/analysis/changedetection/inputscope.md b/docs/accessanalyzer/12.0/admin/analysis/changedetection/inputscope.md
index b9e5b52290..632d15a5b9 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/changedetection/inputscope.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/changedetection/inputscope.md
@@ -12,11 +12,11 @@ Use the Input Scope page to specify the input scope of the data source.
Identify the scope of the data source from the following options:
-- Tables from Current Job – Select tables from only the currently selected job
+- Tables from Current Job – Select tables from only the selected job
- All Access Analyzer Tables – Select from all Access Analyzer tables within the SQL Server database
- All tables in the database – Select all tables within the SQL Server database
:::note
-This selection affects the tables that are available for selection on the Input page.
+This selection affects the tables available to select on the Input page.
:::
diff --git a/docs/accessanalyzer/12.0/admin/analysis/changedetection/options.md b/docs/accessanalyzer/12.0/admin/analysis/changedetection/options.md
index f55b2216e6..7e6c7c5641 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/changedetection/options.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/changedetection/options.md
@@ -13,7 +13,7 @@ made within a certain time period, or only changes between the last two runs of
Configure the additional options using the following:
-- Save change detection results for xx days – Modify the number of days that results for the Change
- Detection task are saved for
+- Save change detection results for xx days – Modify the number of days the Change
+ Detection task saves results
- Only save most recent change (per unique key) – Select the checkbox to only save changes between
the last two runs of the source set
diff --git a/docs/accessanalyzer/12.0/admin/analysis/changedetection/overview.md b/docs/accessanalyzer/12.0/admin/analysis/changedetection/overview.md
index 48e33398ad..0f834fee8a 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/changedetection/overview.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/changedetection/overview.md
@@ -13,7 +13,7 @@ most recent collection.
This module compares values collected for two different query instances. Therefore, as change
detection depends on the existence of a **JobRunTimeKey**, history must be enabled and data
-collected at least twice to produce the desired results. Configure History settings under the job’s
+collected at least twice to produce comparison results. Configure History settings under the job’s
**Settings** > **History** node. See the [History](/docs/accessanalyzer/12.0/admin/settings/history.md) topic for additional
information.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/changedetection/summary.md b/docs/accessanalyzer/12.0/admin/analysis/changedetection/summary.md
index 91db12469d..36d426c6f7 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/changedetection/summary.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/changedetection/summary.md
@@ -10,5 +10,6 @@ The Summary page summarizes the configuration of the action.
-Click **Finish** to save configuration changes. If no changes were made, click **Cancel** to close
-the Change Detection Data Analysis Module wizard to ensure no accidental configurations are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the Change Detection Data Analysis Module wizard instead. This prevents the wizard from
+saving accidental configurations.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/notification/changetype.md b/docs/accessanalyzer/12.0/admin/analysis/notification/changetype.md
index 4baad190e1..30bec89d5e 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/notification/changetype.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/notification/changetype.md
@@ -7,8 +7,8 @@ sidebar_position: 30
# Notification: Change Type
Use the Select Change Type page to choose the types of changes for which to trigger a notification.
-The selections on this page are optional. This page is only active if Change Detection Table is
-selected on the Table Type page.
+The selections on this page are optional. This page is only active if you select Change Detection Table
+on the Table Type page.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/notification/commandline.md b/docs/accessanalyzer/12.0/admin/analysis/notification/commandline.md
index 83980daada..ead18ae046 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/notification/commandline.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/notification/commandline.md
@@ -6,8 +6,8 @@ sidebar_position: 80
# Notification: Command Line
-The Command Line properties page is available when the Command-line Executable notification type is
-selected on the Type page.
+The Command Line properties page is available when you select the Command-line Executable
+notification type on the Type page.
@@ -17,7 +17,7 @@ The following options are available:
view and select from a list of executable files.
- Arguments – If required, specify command line inputs for the application in the text box. If the
argument must come from a value in the database (for example, a timeout value), insert it here via
- the Fields drop-down menu above.
+ the Fields dropdown menu above.
- - Fields – To pass one or more fields into the command line arguments, click the drop-down menu,
+ - Fields – To pass one or more fields into the command line arguments, click the dropdown menu,
select a field from the lists, and click **Add**
diff --git a/docs/accessanalyzer/12.0/admin/analysis/notification/criteria.md b/docs/accessanalyzer/12.0/admin/analysis/notification/criteria.md
index c98530d5e5..d3e7a9ea76 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/notification/criteria.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/notification/criteria.md
@@ -12,8 +12,8 @@ Use the Notification Criteria page to specify criteria to trigger a notification
The following options are available:
-- No Criteria – Set no criteria to trigger a notification if any property changes. If selected, any
- row will trigger the notification.
+- No Criteria – Set no criteria to trigger a notification if any property changes. If you select
+ this option, any row triggers the notification.
- Simple Criteria – Select criteria to send a notification based on the value of a specific property
or column in the database. The trigger can be if the property or column value is greater than,
equal to, or less than the value provided.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/notification/eventlog.md b/docs/accessanalyzer/12.0/admin/analysis/notification/eventlog.md
index 9163c72b9c..0cd53efc46 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/notification/eventlog.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/notification/eventlog.md
@@ -6,7 +6,7 @@ sidebar_position: 90
# Notification: Event Log
-The Event Log properties page is available when the Event log notification type is selected on the
+The Event Log properties page is available when you select the Event log notification type on the
Type page. Use this page to specify the type of event, the event ID, and the description for the
event.
@@ -15,7 +15,7 @@ event.
The following options are available:
- Log – The event log name is Access Analyzer
-- Type – Specify the log type. The drop-down menu displays the following options:
+- Type – Specify the log type. The dropdown menu displays the following options:
- Information
- Warning
@@ -26,5 +26,5 @@ The following options are available:
- Event ID – Specify the event ID
- Description – Enter a description of the event
- - Fields – To pass fields into the description, click on the drop-down list, select a field from
+ - Fields – To pass fields into the description, click the dropdown list, select a field from
the list, then click **Add**
diff --git a/docs/accessanalyzer/12.0/admin/analysis/notification/hosts.md b/docs/accessanalyzer/12.0/admin/analysis/notification/hosts.md
index f06a5c4661..38056cb961 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/notification/hosts.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/notification/hosts.md
@@ -16,11 +16,11 @@ The following options are available:
- I want notifications sent only for the hosts listed below
- I want notifications sent for all hosts except the ones listed below
-If the first option is selected, the host list selection window is not enabled. If either the second
-or third option is selected, the following options are enabled:
+If you select the first option, the host list selection window isn't enabled. If you select either
+the second or third option, the wizard enables the following options:
-- Show me all host lists – Activates the host list selection window, from which individual host
- lists can be selected
-- Enter hosts manually – Manually enter specific host names. Once the name is entered, click the add
- (**+**) button to add it to the selection box. Ensure the checkbox next to the host name is
- selected to include it in the list of hosts.
+- Show me all host lists – Activates the host list selection window, from which you can select
+ individual host lists
+- Enter hosts manually – Manually enter specific host names. After entering the name, click the add
+ (**+**) button to add it to the selection box. Ensure you select the checkbox next to the host
+ name to include it in the list of hosts.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/notification/overview.md b/docs/accessanalyzer/12.0/admin/analysis/notification/overview.md
index 92b8cf2fd3..d895ff567e 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/notification/overview.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/notification/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Notification Analysis Module
-The Notification Data analysis module provides the ability to send an email or command-line
+The Notification Data analysis module lets you send an email or command-line
notification to selected targets based on the values contains in any table.
The Notification Data Analysis Module has the following prerequisites:
diff --git a/docs/accessanalyzer/12.0/admin/analysis/notification/smtp.md b/docs/accessanalyzer/12.0/admin/analysis/notification/smtp.md
index ce1660c5bb..d7cc5595a7 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/notification/smtp.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/notification/smtp.md
@@ -24,13 +24,13 @@ The following options are available:
- Subject – Specify a subject for the email. The subject can include field variables.
:::info
- If configuring a Notification analysis module for a pre-configured job, it is
- recommended not to change the existing field variables.
+ If you configure a Notification analysis module for a pre-configured job, avoid changing the
+ existing field variables.
:::
- Insert Field – Select a source data column to add to the message body or subject line. Click the
- drop-down to see a list of columns. Once the column displays in the field, click an arrow to
+ dropdown to see a list of columns. After the column displays in the field, click an arrow to
insert the field.
- Down arrow – Adds the selected source column to the message text
@@ -39,9 +39,9 @@ The following options are available:
- Embed HTML Report – Embed a HTML report in the notification email. Click the Embed HTML Report
button to navigate to the HTML file.
- Show sample input source data – Opens the Sample Source Data window, containing sample input
- source data as it currently exists in the database
-- Show dialog to set SMTP options – Opens the SMTP Options window, where SMTP global settings can be
- overwritten through manual configuration
+ source data as it exists in the database
+- Show dialog to set SMTP options – Opens the SMTP Options window, where you can overwrite SMTP
+ global settings through manual configuration
- Preview – Displays a preview of the email.
:::note
@@ -49,9 +49,9 @@ The following options are available:
:::
-- Clear Template – Clears all data from the subject and message boxes. Does not clear e-mail
+- Clear Template – Clears all data from the subject and message boxes. Doesn't clear e-mail
addresses.
- Text Box – Specify the text of the email message. The toolbar above the text box contains various
icons providing access to text editing and formatting tools. To insert fields from Access
- Analyzer, choose a field from the drop-down menu and click the Down arrow. Block tag formatting is
+ Analyzer, choose a field from the dropdown menu and click the Down arrow. Block tag formatting is
supported.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/notification/summary.md b/docs/accessanalyzer/12.0/admin/analysis/notification/summary.md
index 0d1daf77db..62cbaa5687 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/notification/summary.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/notification/summary.md
@@ -11,6 +11,6 @@ previous pages of the wizard.
-Click **Finish** to save configuration changes. If no changes were made, it is best practice to
-click **Cancel** to close the Notification Data Analysis Module wizard to ensure no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the Notification Data Analysis Module wizard instead. This prevents the wizard from saving
+accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/notification/tabletype.md b/docs/accessanalyzer/12.0/admin/analysis/notification/tabletype.md
index 2bd6cfc6f9..225bb8d67c 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/notification/tabletype.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/notification/tabletype.md
@@ -13,19 +13,19 @@ notifications.
The following options are available:
-- Change Detection Table – Sends notifications when changes are detected in the data. When selected,
- the option of **Show only tables for this job** becomes the default selection on the Select Table
+- Change Detection Table – Sends notifications when the data changes. When you select this option,
+ **Show only tables for this job** becomes the default selection on the Select Table
page. This option targets only change detection tables within the current job. Possible tables (if
any) display on the Select Table page. See the [Notification: Select Table](/docs/accessanalyzer/12.0/admin/analysis/notification/selecttable.md) topic
for additional information.
:::note
- Change Detection Table also locks selections to tables on the Select Table page that
- are selected through Other. To select tables outside of **Show only tables for this job**,
+ Change Detection Table also locks selections to tables that you select through Other on
+ the Select Table page. To select tables outside of **Show only tables for this job**,
select Other on the Table Type page, then select either **Show All Tables** or **Show All SA
Tables**, then click back to return to the Table Type page. Now selecting Change Detection Table
- and proceeding defaults the selection on the Select Table page to whichever was previously
- selected through Other.
+ and proceeding defaults the selection on the Select Table page to whichever option you
+ previously selected through Other.
:::
diff --git a/docs/accessanalyzer/12.0/admin/analysis/notification/timewindow.md b/docs/accessanalyzer/12.0/admin/analysis/notification/timewindow.md
index 7c05ec132f..b7b067ae37 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/notification/timewindow.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/notification/timewindow.md
@@ -16,7 +16,7 @@ The following option is available:
to the most recent data
:::note
- The checkbox is only enabled if the table selected on the Select Table page has a
- Access Analyzer **JobRunTimeKey** property. Otherwise, the checkbox is cleared by default.
+ Access Analyzer only enables the checkbox if the table selected on the Select Table page has an
+ Access Analyzer **JobRunTimeKey** property. Otherwise, it clears the checkbox by default.
:::
diff --git a/docs/accessanalyzer/12.0/admin/analysis/overview.md b/docs/accessanalyzer/12.0/admin/analysis/overview.md
index 8bdb6b81be..d55be594a9 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/overview.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/overview.md
@@ -6,16 +6,16 @@ sidebar_position: 90
# Analysis Modules
-The Access Analyzer analysis modules are capable of finding unique data and notifying users of its
-location from a variety of environments. Analysis modules are assigned to a job at the
+The Access Analyzer analysis modules find unique data and notify users of its
+location across a variety of environments. You assign analysis modules to a job at the
**Configure** > **Analysis** node. See the [Analysis Node](/docs/accessanalyzer/12.0/admin/jobs/job/configure/analysis/analysis.md) topic
for information on the Analysis Selection view.
-Analysis tasks are configured through the Analysis Properties page. Navigate to the job’s
-**Configure** > Analysis node. The Analysis Properties page is opened from the Analysis Selection
-page by either of the following options:
+Configure analysis tasks through the Analysis Properties page. Navigate to the job’s
+**Configure** > Analysis node. Open the Analysis Properties page from the Analysis Selection
+page using either of the following options:
- Select **Create Analysis** to add a new analysis task to a job
- Select an existing analysis and click **Analysis Properties** to modify its configuration
@@ -29,7 +29,7 @@ Analyzer.
| Analysis Module | Description |
| --------------------------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| [AutoAction Analysis Module](/docs/accessanalyzer/12.0/admin/analysis/autoaction.md) | Performs a specified action at the conclusion of an analysis task’s execution |
-| [Business Rules Analysis Module](/docs/accessanalyzer/12.0/admin/analysis/businessrules/overview.md) | Finds data that does not match user expectations for the target environment |
+| [Business Rules Analysis Module](/docs/accessanalyzer/12.0/admin/analysis/businessrules/overview.md) | Finds data that doesn't match user expectations for the target environment |
| [Change Detection Analysis Module](/docs/accessanalyzer/12.0/admin/analysis/changedetection/overview.md) | Notifies when a change occurs in the results of a job and identifies the location of the change |
| [Notification Analysis Module](/docs/accessanalyzer/12.0/admin/analysis/notification/overview.md) | Sends notifications to specified recipients when a specified event occurs |
| [SQLscripting Analysis Module](/docs/accessanalyzer/12.0/admin/analysis/sqlscripting.md) | Executes free-form SQL scripts |
@@ -39,17 +39,17 @@ Analyzer.
## Executing Analyses
-Analysis tasks execute automatically if enabled through the Analysis Selection page for jobs with
-analysis modules configured. Analysis tasks can be enabled or disabled by selecting the checkbox
-next to the analysis tasks. Analysis tasks execute in the order shown in the Analysis Selection
-window. Tasks can be manually executed without running the job by right-clicking on the task and
+Analysis tasks execute automatically if you enable them through the Analysis Selection page for jobs with
+analysis modules configured. Enable or disable analysis tasks by selecting the checkbox
+next to them. Analysis tasks execute in the order shown in the Analysis Selection
+window. Manually execute tasks without running the job by right-clicking on the task and
selecting **Execute Analyses** from the dropdown menu.
## Analysis Selection Page
-Analysis tasks can be created, deleted, and configured through the Analysis Selection page. For jobs
-with existing analysis tasks, the Analysis Selection page is used to change the order in which tasks
-are run, as well as enabling or disabling tasks.
+Create, delete, and configure analysis tasks through the Analysis Selection page. For jobs
+with existing analysis tasks, use the Analysis Selection page to change the order in which tasks
+run and to enable or disable them.
@@ -61,8 +61,8 @@ The Analysis Selection page has the following options:
- Analysis Configuration – Opens the configuration wizard for the analysis task
- Select the checkbox next to an analysis task to enable it, or clear the checkbox to disable it
- Move Up/Move Down – Moves the selected analysis tasks up or down the Analysis Selection task list.
- Moving tasks up or down the list changes the order in which the task is run when the job is
- executed.
+ Moving tasks up or down the list changes the order in which the task runs when the job
+ executes.
:::note
Tasks can be drag-and-dropped to change position in the list.
@@ -76,8 +76,8 @@ The Analysis Selection page has the following options:
## Analysis Properties Page
-Configure task properties through the Analysis Properties page. The Analysis Properties page is
-accessed through the Analysis Selection page.
+Configure task properties through the Analysis Properties page. Access the Analysis Properties page
+through the Analysis Selection page.
@@ -86,7 +86,7 @@ The Analysis Properties page has the following options:
- Name – Name of the analysis task. Default names can be changed.
- Description – Description of the analysis task. Analysis tasks for default solutions reference
associate data tables. Descriptions for new tasks are blank by default.
-- Analysis Module – Click the drop-down to select an analysis module for the task
+- Analysis Module – Click the dropdown to select an analysis module for the task
- Configure Analysis – Click to access the configuration wizard for the selected analysis module
- ID – Unique identifying number of the analysis task. The database uses distinct IDs to distinguish
between analysis tasks, even those with identical configurations.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/sqlscripting.md b/docs/accessanalyzer/12.0/admin/analysis/sqlscripting.md
index 02772992a0..1db46a6067 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/sqlscripting.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/sqlscripting.md
@@ -12,7 +12,7 @@ Use the SQLscripting analysis module to apply SQL scripting to the selected job.
The SQLscripting analysis module evaluates the Access Analyzer user’s permission level to determine
whether to allow the connected user to run the scripted command. Since this evaluation is based on
-specific SQL database permissions and is not always under Access Analyzer’s control, some scripts
+specific SQL database permissions and isn't always under Access Analyzer’s control, some scripts
with correct syntax may fail due to insufficient permissions.
The SQL Script Editor window has the following options:
@@ -25,13 +25,13 @@ The SQL Script Editor window has the following options:
- Syntax Check – Checks SQL script syntax
- - Syntax Check does not identify logic errors, only instances where syntax is incorrect. Click
+ - Syntax Check doesn't identify logic errors, only instances where syntax is incorrect. Click
**Syntax Check** to open the Script Errors window which identifies syntax errors.
- - Syntax Check reports back syntax errors starting from the beginning of the script to the end.
- Syntax Check does not return a list of errors.
+ - Syntax Check reports syntax errors starting from the beginning of the script to the end.
+ Syntax Check doesn't return a list of errors.
-- Load file – Opens a File Explorer which can be used to navigate to a SQL file
-- Save to File – Saves the currently configured script into a SQL file
+- Load file – Opens a File Explorer to navigate to a SQL file
+- Save to File – Saves the configured script into a SQL file
- Undo – Undo the previous changes made to script (Ctrl+Z)
- Redo – Redo the previous changes made to script (Ctrl+Y)
- Cut – Cuts the highlighted script from the SQL script editor (Ctrl+X)
@@ -41,9 +41,8 @@ The SQL Script Editor window has the following options:
[Transact-SQL Reference](https://learn.microsoft.com/en-us/previous-versions/sql/sql-server-2005/ms189826(v=sql.90))
article
-Click **Save and Close** to return to the Analysis Properties page. If no changes were made or
-intended, it is best practice to click **Cancel** to close the SQL Script Editor wizard to ensure no
-accidental changes are saved.
+Click **Save and Close** to return to the Analysis Properties page. If you didn't make or intend any
+changes, click **Cancel** to close the SQL Script Editor wizard so you don't save accidental changes.
## Parameters
@@ -75,8 +74,8 @@ The parameters have the following properties:
- Name – Name of the variable or table
- Type – Type of variable or table
- - String variables utilize a text string input
- - Integers and floats are able to handle invalid inputs
+ - String variables use a text string input
+ - Integers and floats can handle invalid inputs
- Boolean variables only take True/False input, in SQL they are 1/0
- Percentages only take whole numbers 0-100, converted to 0.0 to 1.0 in SQL
- Temporary and Variable Tables
@@ -98,9 +97,9 @@ The Edit table window has the following options:
- If the name begins with a `#` it is a temporary table
- If the name begins with a `@` it is a table variable
- - In SQLCommand, these can be passed in as structured table parameters
+ - In SQLCommand, you can pass these in as structured table parameters
- - If neither is specified, Access Analyzer assumes it is a temporary table
+ - If the name doesn't begin with either character, Access Analyzer assumes it's a temporary table
- Description – Use the Parameters window to edit the description
- Values – Add, edit, and remove values from the table
@@ -110,8 +109,8 @@ The Edit table window has the following options:
- Delete – Deletes the selected value
- Up/Down – Changes the value position higher or lower
-A CSV file is created under the job’s directory when a parameter table is added to the analysis. A
-pre-existing CSV file can also be uploaded to populate the table.
+Access Analyzer creates a CSV file under the job’s directory when you add a parameter table to the
+analysis. You can also upload a pre-existing CSV file to populate the table.
-Click **OK** to confirm changes to the table. If no changes were made or intended, click **Cancel**
-to close the Edit Table window to ensure no accidental changes are saved.
+Click **OK** to confirm changes to the table. If you didn't make or intend any changes, click
+**Cancel** to close the Edit Table window so you don't save accidental changes.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/columns.md b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/columns.md
index 2fb10a44e0..7628522e25 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/columns.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/columns.md
@@ -11,7 +11,7 @@ The Result Columns page lists the tables selected on the Input Select page.
Expand the table to show its columns. Then, select the checkbox next to the column to include it in
-the resulting table or view. If two data tables are being joined, the resulting table displays at
+the resulting table or view. If you join two data tables, the resulting table displays at
the bottom of the grid. Use the scroll bar to view any hidden tables or data points.
The grid provides the following options for formatting the resulting table or view:
@@ -21,14 +21,14 @@ The grid provides the following options for formatting the resulting table or vi
- Add Column – Opens the New Trend Column window, where columns can be added to the table
- Delete – Deletes a selected column
- - Original columns cannot be deleted. Only columns that have been added by users can be deleted.
+ - You can't delete original columns. You can only delete columns that you added.
-- Show All Columns/Hide Unchecked Columns – Hides rows that are not currently selected ,or if
- columns are currently hidden, displays all columns in the table
+- Show All Columns/Hide Unchecked Columns – Hides rows that aren't selected, or if
+ columns are hidden, displays all columns in the table
- Checked – Selects data columns for inclusion in the resulting table or view
- Column Name – Displays the data column name
- Group Operation – Accesses the available group operations that can be applied to individual data
- points. Click on a cell in this column to display the drop-down arrow. The following operations
+ points. Click a cell in this column to display the dropdown arrow. The following operations
are available:
- (none)
@@ -43,7 +43,7 @@ The grid provides the following options for formatting the resulting table or vi
column name on the materialized table or view. If applying a group operation, a default data label
shows. To apply a custom label, click in the cell and enter the label.
- Order By Operation – Accesses the available order-by operations that can be applied to individual
- data points. Click on a cell in this column to display the drop-down arrow. The following
+ data points. Click a cell in this column to display the dropdown arrow. The following
operations are available:
- None
@@ -51,7 +51,7 @@ The grid provides the following options for formatting the resulting table or vi
- Descending
:::note
-If at least one columns is sorted by value, the **With ties** option is enabled on the
+If you sort at least one column by value, Access Analyzer enables the **With ties** option on the
Result Constraints page. See the [SQLViewCreation: Result Constraints](/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/resultconstraints.md) topic
for additional information.
:::
diff --git a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/export.md b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/export.md
index afa63fe6a6..abe7142b63 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/export.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/export.md
@@ -13,10 +13,10 @@ Use the Export settings page to specify data export settings.
Select the **Export results data** checkbox to enable the settings. The following options control
the file type and destination of the exported data:
-- Format – Use the drop-down menu to select the file format of the exported data
+- Format – Use the dropdown menu to select the file format of the exported data
- - MS Excel file – Converts file to Microsoft Excel format. If Excel is not installed on the
- console, a warning message shows and another export file format needs to be selected.
+ - MS Excel file – Converts file to Microsoft Excel format. If Excel isn't installed on the
+ console, a warning message shows, and you need to select another export file format.
- CSV file – Converts file to Comma-Separated Values format. Includes the option to compress the
file to a zip file.
- ML file – Converts file to Extensible Markup Language format. Includes the option to compress
@@ -29,4 +29,4 @@ the file type and destination of the exported data:
**Location** field. To specify a different location, clear the checkbox and edit the **Location**
field.
-Once the options are selected, click **Next**.
+After selecting the options, click **Next**.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/filter.md b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/filter.md
index 09023bbcf7..05983e09ba 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/filter.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/filter.md
@@ -11,7 +11,7 @@ Use this page to add custom filters to the table using the Filter Builder.
Filters reduce the amount of data visible in a column imported to the resulting table or view. By
-default, when the filter page is blank, all the data within each column is included. Use the
+default, when the filter page is blank, Access Analyzer includes all the data within each column. Use the
following options to add and remove filters:
- Edit – Opens the Filter window
diff --git a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/input.md b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/input.md
index 5e296077a0..d7358e12b4 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/input.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/input.md
@@ -11,16 +11,16 @@ aggregate into a resulting table or view.
-At the first drop-down, select a table. The drop-down lists on this page are determined by the
-selection made on the Input Scope page. To join or aggregate data from two tables, select a second
-table at the second drop-down menu. To remove the second table from the field, click the **X**
+At the first dropdown, select a table. The selection you make on the Input Scope page determines
+the dropdown lists on this page. To join or aggregate data from two tables, select a second
+table at the second dropdown menu. To remove the second table from the field, click the **X**
button.
:::note
-It is important to choose tables that are compatible with one another or share similar
+Choose tables that are compatible with one another or share similar
columns.
:::
-When the two sources of data are selected, click **Next** to create a joint column within the
+After you select the two sources of data, click **Next** to create a joint column within the
resulting table or view.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/inputscope.md b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/inputscope.md
index c7fdc0086e..664b19ff89 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/inputscope.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/inputscope.md
@@ -11,7 +11,7 @@ available for selection on the subsequent pages.
-Select the source data to be used from the following options:
+Select the source data to use from the following options:
- Tables from Current Job – Targets all tables generated by the current job within the SQL Server
database
diff --git a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/joincolumns.md b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/joincolumns.md
index d8932af576..b8c387759c 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/joincolumns.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/joincolumns.md
@@ -7,8 +7,8 @@ sidebar_position: 30
# SQLViewCreations: Join Columns
Use the Join Columns page to select a column from each source table to join together on the
-resulting table or view. The options on this page are only enabled if two tables are selected on the
-Input Source page.
+resulting table or view. Access Analyzer only enables the options on this page if you select two
+tables on the Input Source page.
:::note
The SQLViewCreation analysis module can join two tables, using a simple equi-join
@@ -21,17 +21,18 @@ predicates, use the SQLscripting analysis module. See the
Use the **Table 1 join property** and **Table 2 join property** fields to select join predicates
-from both tables. Join predicates are columns containing analogous values that are used to match
+from both tables. Join predicates are columns containing analogous values that match
records in referenced tables.
Next, specify how to join these tables. To automatically select the appropriate join type, select
one or more of the checkboxes. The selection in the **Join Type** field updates based on user
selections.
-To manually select, use the **Join Type** field. The selection here may update the above checkboxes.
+To manually select, use the **Join Type** field. The selection here may update the checkboxes you
+selected to automatically choose the join type.
The following options are available:
-- Join Type – Select a join type from the drop-down:
+- Join Type – Select a join type from the dropdown:
:::note
Left is the first table referenced, right is the second table.
@@ -48,7 +49,7 @@ The following options are available:
:::note
The join property is the column found within both tables. The two columns can have
different names. However, in the results set, everywhere a value in the first column matches the
-value in the second column, rows from the respective tables are joined together.
+value in the second column, Access Analyzer joins rows from the respective tables together.
:::
diff --git a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/overview.md b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/overview.md
index 3e65e4c10e..ce101904b3 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/overview.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/overview.md
@@ -6,8 +6,9 @@ sidebar_position: 60
# SQLViewCreation Analysis Module
-The SQLViewCreation analysis module provides the ability to create new views or tables that are used
-in Access Analyzer actions and reports. These views or tables are re-created during job execution.
+The SQLViewCreation analysis module lets you create new views or tables for use
+in Access Analyzer actions and reports. Access Analyzer re-creates these views or tables during job
+execution.
:::warning
Consider the impact on storage and performance when choosing to create views versus
@@ -18,7 +19,7 @@ tables. Tables require more storage space in the database.
## Configuration
This analysis module provides the View and Table Creation Analysis Module wizard to assist in
-configuring the module. Before the wizard, collect the desired data for manipulation.
+configuring the module. Before the wizard, collect the data you want to manipulate.
The wizard contains the following pages:
diff --git a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/result.md b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/result.md
index 24fd2c6cf3..51cfd97a6c 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/result.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/result.md
@@ -16,9 +16,9 @@ two sourced tables. Select from the following two options:
- Create Table – Creates a table output for the resulting dataset
- Create View – Creates a view output for the resulting dataset
-A default name of `SA_[job name]_Result` is provided in the name field. You can customize this name
-for the resulting table or view.
+Access Analyzer provides a default name of `SA_[job name]_Result` in the name field. You can
+customize this name for the resulting table or view.
-The name must start with `SA` to be recognized as a Access Analyzer table or view.
+The name must start with `SA` for Access Analyzer to recognize it as a table or view.
After selecting the resulting table or view’s visual representation and name, click **Next**.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/resultconstraints.md b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/resultconstraints.md
index 1ea52a92dd..7bcfcb2323 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/resultconstraints.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/resultconstraints.md
@@ -10,7 +10,7 @@ Use the Result Constraints page to impose restraints on the dataset.
-Select one of the following options to choose if and how much data should be returned:
+Select one of the following options to choose whether and how much data to return:
- Duplicate rows can appear in the result set
- Only unique rows can appear in the result set
@@ -18,11 +18,11 @@ Select one of the following options to choose if and how much data should be ret
of measurement to return for the rows that appear in the resulting table or view
- With ties – Include all instances of identical values in the sorted columns with the results.
- To include only one instance of identical values, do not select this option.. See the
+ To include only one instance of identical values, don't select this option.. See the
[With Ties Example](#with-ties-example) topic for additional information.
:::note
- This field is enabled by sorting at least one column in the table by value (for
+ You enable this field by sorting at least one column in the table by value (for
SQL, only a sorted column can contain ties). To sort columns, use the **Order By Operation**
field on the Columns page. See the [SQLViewCreations: Columns](/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/columns.md) topic for
additional information.
@@ -39,8 +39,8 @@ Consider a table that has ten rows with one repeating entry under the value colu
-If the table is sorted by the value column in ascending order and the **Return only** option is set
-to **40 percent**, then there should be four rows visible in the resulting table or view output.
+If you sort the table by the value column in ascending order and set the **Return only** option to
+**40 percent**, four rows are visible in the resulting table or view output.
@@ -49,7 +49,7 @@ fifth, selecting the **With ties** option returns the first three rows as well a
and fifth rows for a total of five rows.
:::note
-If sorting multiple columns, **With ties** evaluates all sorted columns to determine ties
+If you sort multiple columns, **With ties** evaluates all sorted columns to determine ties
between columns with the same inputs.
:::
diff --git a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/resultsample.md b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/resultsample.md
index 49afeec34c..7e5ac6fb21 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/resultsample.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/resultsample.md
@@ -11,10 +11,10 @@ Use this page to preview a sampling of the completed data manipulation.
Click **Show Preview** to populate the window with the selections from the previous pages. If the
-window does not populate, check the configurations for errors and try again.
+window doesn't populate, check the configurations for errors and try again.
:::note
-The **Show Preview** option does not always apply the filter conditions specified within
+The **Show Preview** option doesn't always apply the filter conditions specified within
the wizard, but the resulting table or view applies all filters.
:::
diff --git a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/summary.md b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/summary.md
index 91fb91144e..77315a1f31 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/summary.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/summary.md
@@ -10,6 +10,5 @@ This page provides an overview of all the settings configured in the wizard.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the View and Table Creation Analysis Module wizard to ensure that no
-accidental clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the View and Table Creation Analysis Module wizard so you don't save accidental changes.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/timewindow.md b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/timewindow.md
index ba464f53aa..44b6c02cfb 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/timewindow.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/sqlviewcreation/timewindow.md
@@ -18,8 +18,8 @@ data was collected:
two separate Access Analyzer Consoles using tables generated by the same job.
:::note
- This section is enabled after selecting **All Access Analyzer Tables** or **All tables
- in the database** on the Input Scope page.
+ Access Analyzer enables this section after you select **All Access Analyzer Tables** or **All
+ tables in the database** on the Input Scope page.
:::
@@ -28,5 +28,5 @@ data was collected:
- Data from this Access Analyzer Console only – Uses only data from the Access Analyzer Console
generating the current analysis module
-- Time Window – Select a time window for each table in the analysis. The drop-down menu selections
+- Time Window – Select a time window for each table in the analysis. The dropdown menu selections
vary based on each table's history settings.
diff --git a/docs/accessanalyzer/12.0/admin/analysis/vbscripting.md b/docs/accessanalyzer/12.0/admin/analysis/vbscripting.md
index ab5326ac60..2359c697f7 100644
--- a/docs/accessanalyzer/12.0/admin/analysis/vbscripting.md
+++ b/docs/accessanalyzer/12.0/admin/analysis/vbscripting.md
@@ -16,13 +16,13 @@ The VBScript Editor has the following options:
- Save and Close – Saves the script and closes the window
- Syntax Check – Checks VB script syntax
- - Syntax Check does not identify logic errors, only instances where syntax is incorrect. Click
+ - Syntax Check doesn't identify logic errors, only instances where syntax is incorrect. Click
**Syntax Check** to open the Script Errors window which identifies syntax errors.
- - Syntax Check reports back syntax errors starting from the beginning of the script to the end.
- Syntax Check does not return a list of errors.
+ - Syntax Check reports syntax errors starting from the beginning of the script to the end.
+ Syntax Check doesn't return a list of errors.
-- Load file – Opens a File Explorer which can be used to navigate to a VBS file
-- Save to File – Saves the currently configured script into a VBS file
+- Load file – Opens a File Explorer to navigate to a VBS file
+- Save to File – Saves the configured script into a VBS file
- Undo – Undo the previous changes made to script (Ctrl+Z)
- Redo – Redo the previous changes made to script (Ctrl+Y)
- Cut – Cuts the highlighted script from the VB script editor (Ctrl+X)
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/directoryscope.md b/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/directoryscope.md
index e11eb5a4be..01982c2c22 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/directoryscope.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/directoryscope.md
@@ -21,5 +21,5 @@ The Directory Scope page has the following options:
- Connect – Connects to the target domain to provide a list of directories
- Add – Add an OU to the query scope
- Remove – Removes an OU from the query scope
-- Scope – List of OUs to be scanned
+- Scope – List of OUs to scan
- Sub tree – Sub-OUs included in the scan if checked
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/options.md b/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/options.md
index c0fc49e665..0aa47d1a18 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/options.md
@@ -15,11 +15,11 @@ The Options page provides format options for returned data. It is a wizard page
- Return data as collected
- Return data in a separate row for each property set in the following group
- - Select the group from the drop-down menu
+ - Select the group from the dropdown menu
- Return each value of the following property in a separate row
- - Select the property from the drop-down menu
+ - Select the property from the dropdown menu
- How to return multi-valued properties in one cell – Select from the following options:
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/overview.md
index 3cd85c6e0e..d4797ab36f 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/overview.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# ActiveDirectory Data Collector
-The ActiveDirectory Data Collector audits objects published in Active Directory. It has been
-preconfigured within the Active Directory Solution. Both this data collector and the solution are
-available with a special Access Analyzer license. See the
+The ActiveDirectory Data Collector audits objects published in Active Directory. The Active
+Directory Solution includes this data collector preconfigured. Both this data collector and the
+solution are available with a special Access Analyzer license. See the
[Active Directory Solution](/docs/accessanalyzer/12.0/solutions/activedirectory/overview.md) topic for additional
information.
@@ -42,5 +42,5 @@ which contains the following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open, then save the configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/results.md b/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/results.md
index 6ed7755745..bae1ea9869 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/results.md
@@ -6,11 +6,11 @@ sidebar_position: 30
# ActiveDirectory: Results
-The Results page is where Active Directory object properties to be gathered are selected. It is a
-wizard page for all categories.
+Use the Results page to select the Active Directory object properties to gather. This wizard page
+appears for all categories.
-Properties can be selected individually or the **Check all**, **Uncheck all**, and **Reset to
-defaults** buttons can be used. All selected properties are gathered. Available properties vary
-based on the category selected.
+Select properties individually, or use the **Check all**, **Uncheck all**, and **Reset to
+defaults** buttons. The data collector gathers all selected properties. Available properties vary
+based on the category you select.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/summary.md
index 1081baeb09..a839161c42 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/activedirectory/summary.md
@@ -6,10 +6,10 @@ sidebar_position: 50
# ActiveDirectory: Summary
-The Summary page displays a summary of the configured query. It wizard page for all categories.
+The Summary page displays a summary of the configured query. It is a wizard page for all categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Active Directory Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Active Directory Data Collector Wizard instead. This ensures the wizard doesn't save any
+accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/category.md b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/category.md
index 19fa9b97c2..a2d9c16f0c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/category.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# ADActivity: Category
-Use the Category page to identify how activity data is retrieved or removed.
+Use the Category page to identify how the data collector retrieves or removes activity data.
@@ -14,6 +14,6 @@ The ADActivity Data Collector Category page contains three query categories:
- Import From SAM – Import activity from a Netwrix Activity Monitor archive
- Import From Share – Import activity from a network share
-- Remove Tables – Removes all tables and views from SQL Server database. This option is designed for
- troubleshooting. When this option is selected, the next wizard page is the Summary page. See the
+- Remove Tables – Removes all tables and views from SQL Server database. Use this option for
+ troubleshooting. When you select this option, the next wizard page is the Summary page. See the
[Clear ADActivity Tables](/docs/accessanalyzer/12.0/admin/datacollector/adactivity/cleartables.md) topic for more information.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/cleartables.md b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/cleartables.md
index bb51cd0edb..a2499f883b 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/cleartables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/cleartables.md
@@ -6,8 +6,8 @@ sidebar_position: 80
# Clear ADActivity Tables
-Sometimes when troubleshooting an ADActivity issue, it becomes necessary to clear the standard
-reference tables. Follow the steps.
+When troubleshooting an ADActivity issue, you sometimes need to clear the standard reference
+tables. Follow these steps.
**Step 1 –** Create a new job and assign a query using the ADActivity Data Collector.
@@ -19,13 +19,13 @@ Tables** category task.
**Step 3 –** Click **Next** to go to the Results page. Optionally, select the **Success** checkbox
-to display a confirmation of successful removal in the results after the job is run.
+to display a confirmation of successful removal in the results after the job runs.
**Step 4 –** Click **Next** and then Click **Finish** to close the Active Directory Activity DC
Wizard. Click **OK** to close the Query Properties window.
:::warning
-When the job is run, all of the ADActivity standard reference tables are removed from
+When you run the job, it removes all ADActivity standard reference tables from
the database.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/connection.md b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/connection.md
index 1986f5964e..7584abdeba 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/connection.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/connection.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# ADActivity: SAM Connection
-The SAM connection page is where the port number is configured to send Active Directory data from
+Use the SAM connection page to configure the port number for sending Active Directory data from
Netwrix Activity Monitor. It is a wizard page for the category of:
- Import from SAM
@@ -24,14 +24,13 @@ archive via an API Server:
scan to continue
- Test SAM host – Enter the Activity Monitor API server name in a qualified domain name format.
- Click Connect to test the connection. A successful result populates the section underneath with a
- Refresh token.
-- Exclude – Select archives to be ignored by the Active Directory Activity DC scan
+ Click Connect to test the connection. A successful connection displays a Refresh token.
+- Exclude – Select archives for the Active Directory Activity DC scan to ignore
:::warning
Save the Refresh token to a Text Editor for later use. The Refresh token resets
- each time the Test SAM host option is connected to. It must be replaced in the Connection
- profile if it is regenerated.
+ each time you use the Test SAM host option to connect. If it regenerates, replace it in the
+ Connection profile.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/overview.md
index decca5386b..55fc6850c8 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/overview.md
@@ -7,8 +7,9 @@ sidebar_position: 30
# ADActivity Data Collector
The ADActivity Data Collector integrates with the Netwrix Activity Monitor by reading the Active
-Directory activity log files. It has been preconfigured within the Active Directory Solution. Both
-this data collector and the solution are available with a special Access Analyzer license. See the
+Directory activity log files. The Active Directory Solution includes this data collector
+preconfigured. Both this data collector and the solution are available with a special Access
+Analyzer license. See the
[Active Directory Solution](/docs/accessanalyzer/12.0/solutions/activedirectory/overview.md) topic for additional
information.
@@ -29,8 +30,8 @@ information.
## ADActivity Query Configuration
-The ADActivity Data Collector is configured through the Active Directory Activity DC wizard, which
-contains the following wizard pages, which change based up on the query category selected:
+The ADActivity Data Collector is configured through the Active Directory Activity DC wizard. The
+wizard pages it contains change based on the query category you select:
- [ADActivity: Category](/docs/accessanalyzer/12.0/admin/datacollector/adactivity/category.md)
- [ADActivity: SAM Connection](/docs/accessanalyzer/12.0/admin/datacollector/adactivity/connection.md)
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/results.md b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/results.md
index 88e2f74072..1be6560d5a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/results.md
@@ -6,10 +6,11 @@ sidebar_position: 60
# ADActivity: Results
-The Results page is where the properties to be gathered are selected. It is a wizard page for all of
-the categories.
+Use the Results page to select the properties to gather. This wizard page appears for all
+categories.
-Properties can be selected individually or the **Select All** and **Clear All** buttons can be used.
-All selected properties are gathered. Available properties vary based on the category selected.
+Select properties individually, or use the **Select All** and **Clear All** buttons. The data
+collector gathers all selected properties. Available properties vary based on the category you
+select.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/scope.md b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/scope.md
index b316f2ffa2..1972a1951f 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/scope.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/scope.md
@@ -14,21 +14,21 @@ the categories of:
-The Timespan is defined according to the following two elements:
+Two elements define the Timespan:
-- Relative Timespan – Number of days AD Activity is collected when the scan is run
+- Relative Timespan – Number of days the scan collects AD Activity when it runs
- Absolute Timespan – Set the date range for the scan to collect AD Activity
:::info
- The threshold should be set for after the Netwrix Activity Monitor collects
- and archives its data but before they are deleted after a set retention period.
+ Set the threshold to a point after the Netwrix Activity Monitor collects
+ and archives its data but before the set retention period deletes it.
:::
-The Retention section sets what event type is collected and how many days Access Analyzer keeps the
+The Retention section sets which event types Access Analyzer collects and how many days it keeps the
collected data in its SQL database. The table has the following columns:
-- Event Type – The event type that may be enabled for the scan. The event types are:
+- Event Type – The event type you can enable for the scan. The event types are:
- AD Change
- AD Replication
@@ -37,4 +37,4 @@ collected data in its SQL database. The table has the following columns:
- Process Injection
- Days to Store – Specify the number of days to store the collected data for the event type
-- Enable Collection – When selected, the corresponding event type is collected
+- Enable Collection – When you select this checkbox, the scan collects the corresponding event type
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/share.md b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/share.md
index 239917e88e..325c3c29be 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/share.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/share.md
@@ -13,14 +13,14 @@ of:
-The following connection setting can be configured to connect to the AD activity archives that must
-be located on a Domain Controller share:
+Configure the following connection setting to connect to the AD activity archives, which must
+reside on a Domain Controller share:
-- UNC Path – Enter the path of the share that stores AD Activity from the AD Agent(s). The ellipsis
- (**…**) opens a file explorer where the path can be navigated to and selected.
+- UNC Path – Enter the path of the share that stores AD Activity from the AD Agents. The ellipsis
+ (**…**) opens a file explorer where you can navigate to and select the path.
- - _Remember,_ all AD Agent logs must be archived to this location or the AD Activity data is not
- queried by Access Analyzer
+ - _Remember,_ you must archive all AD Agent logs to this location, or Access Analyzer won't
+ query the AD Activity data
- Include Sub-Directories – Select to include sub-directories on the targeted share. Use this option
if there are multiple archives in the same location.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/standardtables.md b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/standardtables.md
index 383c229130..07b9cbcf0c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/standardtables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/standardtables.md
@@ -10,7 +10,7 @@ The ADActivity Data Collector gathers essential user and group activity informat
reference tables. Unlike other Access Analyzer data collectors, the ADActivity Data Collector writes
data to these tables regardless of the job executing the query.
-These tables and their associated views are outlined below:
+The following table describes these tables and their associated views:
| Table | Details |
| -------------------------------- | --------------------------------------------------------------------- |
@@ -35,10 +35,9 @@ These tables and their associated views are outlined below:
| SA_ADActivity_Sources | Contains lists of sources of activity events |
| SA_ADActivity_SPNs | Contains a unique identifier for each logon account |
-Views are the recommended way for Access Analyzer users to obtain the information gathered by the
-ADActivity Data Collector. They contain additional information for building queries easily. The
-following is an explanation of the corresponding views created for some of the tables generated by
-the ADActivity Data Collector:
+Views are the recommended way for Access Analyzer users to obtain the information the ADActivity
+Data Collector gathers. They contain additional information for building queries. The following
+table explains the views the ADActivity Data Collector creates for some of its tables:
| Views | Details |
| -------------------------------------------- | ------------------------------------------------------------------------ |
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/summary.md
index 5b0a36fb1b..bd11c849ff 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adactivity/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adactivity/summary.md
@@ -6,11 +6,11 @@ sidebar_position: 70
# ADActivity: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for all of the
+The Summary page summarizes the configuration settings. This wizard page appears for all
categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Active Directory Activity DC wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Active Directory Activity DC wizard instead. This ensures the wizard doesn't save any
+accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/category.md b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/category.md
index 0489456a4e..006e6339e6 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/category.md
@@ -16,15 +16,15 @@ The categories include the following tasks:
database, creating the standard reference tables. This task is also responsible for maintaining
the schema for tables and views. This is the standard option for this data collector.
- Update SQL Indexes – Reorganizes or rebuilds indexes in the Access Analyzer SQL storage database.
- When this option is selected, the next wizard page is the Results page.
-- Remove Tables – Removes all tables and views from SQL Server database. This option is designed for
- troubleshooting. When this option is selected, the next wizard page is the Summary page. See the
+ When you select this option, the next wizard page is the Results page.
+- Remove Tables – Removes all tables and views from SQL Server database. Use this option for
+ troubleshooting. When you select this option, the next wizard page is the Summary page. See the
[Clear ADInventory Tables](/docs/accessanalyzer/12.0/admin/datacollector/adinventory/cleartables.md) topic for more information.
- Drop Domain – Remove host domain related data from SQL server
:::note
The Scan Active Directory category is the pre-configured setting for the .Active Directory
Inventory Job Group. Therefore, accessing the Active Directory Inventory DC Wizard from the query
-within that job group does not display the Category wizard page.
+within that job group doesn't display the Category wizard page.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/cleartables.md b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/cleartables.md
index 57ce3005e5..7a8a62b49c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/cleartables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/cleartables.md
@@ -10,8 +10,7 @@ Sometimes when troubleshooting an ADInventory issue, it becomes necessary to cle
reference tables. Follow the steps.
:::warning
-Be careful when using this query task. It will result in the deletion of collected
-data.
+Be careful when using this query task. It deletes collected data.
:::
@@ -25,7 +24,7 @@ Tables** category task.
**Step 3 –** Click **Next** and then **Finish** to close the Active Directory Inventory DC Wizard.
Click **OK** to close the Query Properties window.
-When the job is run, all of the ADInventory standard reference tables are removed from the database.
+When you run the job, it removes all ADInventory standard reference tables from the database.
:::warning
Never leave the query task selected after job execution. Accidental data loss can
@@ -34,6 +33,6 @@ occur.
:::tip
-Remember, this job deletes data from the Access Analyzer database. Check the job has been
-configured correctly prior to job execution.
+Remember, this job deletes data from the Access Analyzer database. Check that you configured the
+job correctly before running it.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/customattributes.md b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/customattributes.md
index bab5916b69..df589ff665 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/customattributes.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/customattributes.md
@@ -6,9 +6,9 @@ sidebar_position: 70
# ADInventory: Custom Attributes
-The Custom Attributes page provides ability to add Active Directory attributes that are unique to
-the environment or not collected by default to be gathered. It is a wizard page for the category of
-Scan Active Directory.
+Use the Custom Attributes page to add Active Directory attributes that are unique to your
+environment or that Access Analyzer doesn't collect by default. This wizard page appears for the
+Scan Active Directory category.
The [Standard Reference Tables & Views for the ADInventory Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/adinventory/standardtables.md) topic
provides information on what is collected by default. Custom attributes added on this page are
@@ -23,44 +23,43 @@ The Custom Attribute is defined according to the following three elements:
- Attribute Name – As listed within Active Directory
Use the **Add**, **Edit**, and **Remove** buttons at the bottom of the window to configure the
-custom attributes to be gathered by the scan. See the
+custom attributes for the scan to gather. See the
[Manually Add Custom Attributes](#manually-add-custom-attributes) topic for additional information.
The **Import** button opens the Custom Attributes Import Wizard. See the
[Custom Attributes Import Wizard](#custom-attributes-import-wizard) topic for additional
information.
-Microsoft Active Directory Schema is detailed in the Microsoft
+For details on the Microsoft Active Directory Schema, see the Microsoft
[Active Directory Schema](https://learn.microsoft.com/en-gb/windows/win32/adschema/active-directory-schema)
article.
#### Manually Add Custom Attributes
The **Add** and **Edit** buttons on the Custom Attributes page open the Custom Attribute window.
-Follow the steps to manually add custom attributes.
+To manually add custom attributes:
**Step 1 –** On the Custom Attributes page of the Active Directory Inventory DC Wizard, click
**Add**. The Custom Attribute window opens.
-**Step 2 –** Enter the **Domain Filter**. This can be entered either as the short domain name or the
-fully qualified domain name.
+**Step 2 –** Enter the **Domain Filter** as either the short domain name or the fully qualified
+domain name.
-**Step 3 –** Select the checkbox for the desired **Object Class**.
+**Step 3 –** Select the checkbox for the **Object Class** you want.
**Step 4 –** Enter the **Attribute Name** as it appears in Active Directory.
-**Step 5 –** Click **OK**. The Custom Attribute window closes and the specified attribute is added
-in the Custom Attributes page.
+**Step 5 –** Click **OK**. The Custom Attribute window closes and adds the specified attribute to
+the Custom Attributes page.
-Repeat this process until all desired Custom Attributes have been included.
+Repeat this process until you've added all the custom attributes you want.
#### Custom Attributes Import Wizard
-The Custom Attributes Import Wizard is used to import a list of custom attributes into the
-ADInventory Data Collector configurations. Follow the steps to use the Custom Attributes Import
-Wizard.
+The Custom Attributes Import Wizard imports a list of custom attributes into the ADInventory Data
+Collector configurations. To use the Custom Attributes Import Wizard:
**Step 1 –** On the Custom Attributes page of the Active Directory Inventory DC Wizard, click
**Import**. The Custom Attribute Import Wizard opens.
@@ -68,25 +67,25 @@ Wizard.
**Step 2 –** On the Credentials page, identify a domain either by entering one manually or selecting
-one from the **Domain Name** drop-down menu which displays a list of domains trusted by the one in
-which the Access Analyzer Console server resides. Then set the credentials for reading the
+one from the **Domain Name** dropdown menu, which displays a list of domains that the domain
+hosting the Access Analyzer Console server trusts. Then set the credentials for reading the
attributes list from the domain:
- Authenticate as the logged in user – Applies the user account running Access Analyzer
-- Use the following credentials to authenticate – Applies the account supplied in the **User Name**
- and **Password** fields
+- Use the following credentials to authenticate – Applies the account you supply in the **User
+ Name** and **Password** fields
Click **Next** to continue.
-**Step 3 –** The wizard populates available attributes from the domain specified on the Attributes
-page. Expand the desired object class and select the checkboxes for the custom attributes to be
-imported. Then click **Next**.
+**Step 3 –** The wizard populates available attributes from the domain you specify on the Attributes
+page. Expand the object class you want and select the checkboxes for the custom attributes to
+import. Then click **Next**.
**Step 4 –** On the Summary page, click **Finish**.
-The selected attributes are added on the Custom Attributes page of the Active Directory Inventory DC
-Wizard.
+The wizard adds the selected attributes to the Custom Attributes page of the Active Directory
+Inventory DC Wizard.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/domains.md b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/domains.md
index f4d4b63004..4d58a73e28 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/domains.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/domains.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# ADInventory: Domains
-The Domains page removes host domain-related data from the SQL server for the selected domains.
+The Domains page removes host domain-related data from the SQL server for the domains you select.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/indexupdateoptions.md b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/indexupdateoptions.md
index 3f16807f46..e41f0a905e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/indexupdateoptions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/indexupdateoptions.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# ADInventory: Index Update Options
-Configure options for maintaining SQL Server indexes while running queries using the Index Update
-Options page.
+Use the Index Update Options page to configure options for maintaining SQL Server indexes
+while running queries.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/options.md b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/options.md
index e2b92a053d..24a69c802a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/options.md
@@ -19,18 +19,18 @@ The Options page has the following configuration options:
- Ignore certificate errors? (For testing only) – Ignores untrusted certificate authority errors
and allows the scan to continue. This option is for testing purposes only.
-- Collect SID History from domain migrations – During a domain migration, the new infrastructure is
- created alongside the old infrastructure. The old account SID is typically added to the SID
- history attribute for the new account. The option to collect SID history is made available within
- the ADInventory Data Collector to assist resolving SIDs for domain migrations.
+- Collect SID History from domain migrations – During a domain migration, administrators create new
+ infrastructure alongside the old infrastructure. The migration process typically adds the old
+ account SID to the SID history attribute for the new account. The ADInventory Data Collector
+ provides an option to collect SID history to help resolve SIDs for domain migrations.
- Collect only updates since the last scan (recommended) – Default setting for differential
- scanning. The updates collected are any changes to: group membership, attributes on user objects,
- attributes on group objects, and so on.
+ scanning. The updates the scan collects include any changes to: group membership, attributes on
+ user objects, attributes on group objects, and so on.
- Track changes into Change tracking tables – Records all changes since the last scan in
separate tables
- - Limit Last Logon TimeStamp Changes – When selected, changes to the Last Logon TimeStamp
- Attribute are not recorded
+ - Limit Last Logon TimeStamp Changes – When you select this option, the scan doesn't record
+ changes to the Last Logon TimeStamp attribute
:::info
If tracking changes, use the Limit Last Logon TimeStamp Changes option.
@@ -40,16 +40,15 @@ The Options page has the following configuration options:
- Number of days you want to keep changes in the database – Use the arrow buttons or manually
enter a number to set the number of days to keep changes
- Target previously scanned domain controller – Collects updated information from the last
- domain controller targeted to reduce the scan time. Below are some considerations:
+ domain controller the scan targeted, to reduce scan time. Consider the following:
- If the last domain controller is unavailable, the targeted domain controller is the
specified domain controller from the host list. If using the domain name, it attempts to
find the last scanned domain controller.
- - If that domain controller is determined to be unavailable, then it runs a full scan on the
+ - If the scan determines that domain controller is unavailable, it runs a full scan on the
next domain controller that responds. Then, it will scan the new domain controller for
- changes going forward.
+ changes.
Selecting the **Track changes into Change tracking tables** option enables the **Number of days
- you want to keep changes in the database** box. This allows for changes in Active Directory to
- be tracked. When change tracking is enabled, notification analysis tasks can be used to send
- alerts.
+ you want to keep changes in the database** box. This tracks changes in Active Directory. When
+ you enable change tracking, use notification analysis tasks to send alerts.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/overview.md
index ff79a3ac50..251b5b935a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/overview.md
@@ -8,13 +8,12 @@ sidebar_position: 40
The extraction and correlation of user, group, and computer attributes drastically transforms the
meaning of data collected across the many systems and applications that are linked to Active
-Directory. The ADInventory Data Collector is designed as a highly scalable and useful data
-collection mechanism to catalogue user, group, and computer object information that can be used by
-other solutions within Access Analyzer.
+Directory. The ADInventory Data Collector is a highly scalable data collection mechanism that catalogues user,
+group, and computer object information for other solutions within Access Analyzer to use.
-The ADInventory Data Collector is a core component of Access Analyzer and has been preconfigured to
-be used within the .Active Directory Inventory Solution. Both this data collector and the solution
-are available with all Access Analyzer license options. See the
+The ADInventory Data Collector is a core component of Access Analyzer. The .Active Directory
+Inventory Solution includes this data collector preconfigured. Both this data collector and the
+solution are available with all Access Analyzer license options. See the
[.Active Directory Inventory Solution](/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/overview.md)
topic for additional information.
@@ -44,9 +43,9 @@ topic for additional information.
## Functional Design of the ADInventory Data Collector
-The ADInventory Data Collector has been designed to update incrementally. Once it has run against a
-domain controller, additional collections gather changes made since the last scan. This enables the
-ADInventory Data Collector to function efficiently within large environments. Each time it is run
+The ADInventory Data Collector updates incrementally. After it has run against a domain controller,
+additional collections gather the changes that occurred since the last scan. This enables the
+ADInventory Data Collector to function efficiently within large environments. Each time you run it
against different domain controllers, it restarts the cycle.
## ADInventory Query Configuration
@@ -64,5 +63,5 @@ contains the following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open, then save the configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/results.md b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/results.md
index b1a88d0d0e..ac580d297b 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/results.md
@@ -6,14 +6,13 @@ sidebar_position: 30
# ADInventory: Results
-The Results page is where properties from Active Directory to be gathered are selected. It is a
-wizard page for the category of Scan Active Directory.
+Use the Results page to select which Active Directory properties to gather. It is a wizard page for
+the category of Scan Active Directory.
-Properties can be selected individually or the **Select All** or **Clear All** buttons can be used.
-All selected properties are gathered.
+You can select properties individually, or use the **Select All** or **Clear All** buttons. The
+wizard gathers all selected properties.
-This information is not available within the standard reference tables and views. Instead, this
-information can be viewed in the SA_ADInventory_DEFAULT table, which is created when any of these
-properties are selected.
+The standard reference tables and views don't include this information. Instead, you can view it in
+the SA_ADInventory_DEFAULT table, which the wizard creates when you select any of these properties.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/standardtables.md b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/standardtables.md
index 802665ab5f..eff88da752 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/standardtables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/standardtables.md
@@ -10,7 +10,7 @@ The ADInventory Data Collector gathers essential user and group inventory inform
reference tables. Unlike other Access Analyzer data collectors, the ADInventory Data Collector
writes data to these tables regardless of the job executing the query.
-These tables and their associated views are outlined below:
+The following table lists these tables and their associated views:
| Table | Details | AD Object Reference Article |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -33,7 +33,7 @@ These tables and their associated views are outlined below:
Views are the recommended way for you to obtain the information gathered by the ADInventory Data
-Collector. They contain additional information for building queries easily.
+Collector. They contain additional information for building queries.
The following is an explanation of the corresponding views created for some of the tables generated
by the ADInventory Data Collector:
@@ -52,7 +52,7 @@ by the ADInventory Data Collector:
### AD Exception Types Translated
-The following table translates the Type of Exceptions that can found.
+The following table translates the types of exceptions the ADInventory Data Collector can identify.
| Type | Exception | Description |
| ---- | -------------------- | ------------------------------------------------------------------------- |
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/summary.md
index e53677a5ea..d7275b0f8a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adinventory/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adinventory/summary.md
@@ -6,11 +6,11 @@ sidebar_position: 80
# ADInventory: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for all of the
+The Summary page summarizes the configuration settings. It is a wizard page for all of the
categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Active Directory Inventory DC Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the Active Directory Inventory DC Wizard. This best practice ensures the wizard doesn't save
+accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/category.md b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/category.md
index 65a648f9e8..6cbb361339 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/category.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# ADPermissions: Category
-The ADPermissions Data Collector Category page identifies what kind of information to retrieve using
-the Category wizard page.
+Use the Category page to identify what kind of information the ADPermissions Data Collector
+retrieves.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/customfilter.md b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/customfilter.md
index 0221948302..81ff672e5c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/customfilter.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/customfilter.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# ADPermissions: Custom Filter
The Custom Filter page provides options to configure settings for object permission collection. It
-is only available if the Custom Filter option is checked on the Scope page. It is a wizard page for
+is only available if you check the Custom Filter option on the Scope page. It is a wizard page for
the categories of:
- Scan Active Directory Permissions
@@ -19,16 +19,15 @@ The configurable options are:
- Root Path – Enter the AD root path
- - Select the distinguished name from the drop-down menu to the right of the Root Path
+ - Select the distinguished name from the dropdown menu to the right of the Root Path
- Click **Preview** to show an example of the complete path
- LDAP Filter – Enter a custom filter string
-- Scope – Select an option from the drop-down menu:
+- Scope – Select an option from the dropdown menu:
- Base – Limits the scope to the base object. The maximum number of objects returned is always
one.
- - One Level – Restricted to the immediate children of a base object, but excludes the base
- object itself
+ - One Level – Includes only the immediate children of a base object, not the base object itself
- Sub tree – (or a deep scope) includes all child objects as well as the base object
-- Click **Add** to add the filter criteria to the list. Multiple filters can be used.
+- Click **Add** to add the filter criteria to the list. You can use multiple filters.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/options.md b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/options.md
index 94a73ef065..104a465b59 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/options.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# ADPermissions: Options
-The Options page is provides additional options for collecting the Active Directory information. It
+The Options page provides additional options for collecting Active Directory information. It
is a wizard page for the categories of:
- Scan Active Directory Permissions
@@ -25,5 +25,5 @@ The configurable options are:
- Target previously scanned domain controller – Select to use the same domain controller as the
previous scan
- Track changes into change tracking tables – Enable to track changes
- - Number of days you want to keep changes in the database – Set the number of days to keep
- changes in the database
+ - Number of days you want to keep changes in the database – Set how many days to keep changes in
+ the database
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/overview.md
index 7a4da2b78c..3295d18f92 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/overview.md
@@ -6,9 +6,9 @@ sidebar_position: 50
# ADPermissions Data Collector
-The ADPermissions Data Collector collects the advanced security permissions of objects in AD. It is
-preconfigured within the Active Directory Permissions Analyzer Solution. Both this data collector
-and the solution are available with a special Access Analyzer license. See the
+The ADPermissions Data Collector collects the advanced security permissions of objects in AD. It
+comes preconfigured within the Active Directory Permissions Analyzer Solution. Both this data
+collector and the solution are available with a special Access Analyzer license. See the
[Active Directory Permissions Analyzer Solution](/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/overview.md)
topic for additional information.
@@ -32,9 +32,9 @@ topic for additional information.
## ADPermissions Query Configuration
-The ADPermissions Data Collector is configured through the Active Directory Permissions Data
-Collector Wizard. The wizard contains the following pages, which change based upon the query
-category selected:
+You configure the ADPermissions Data Collector through the Active Directory Permissions Data
+Collector Wizard. The wizard contains the following pages, which change based on the query category
+you select:
- [ADPermissions: Category](/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/category.md)
- [ADPermissions: Scope](/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/scope.md)
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/removetables.md b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/removetables.md
index ec4aee94b6..5710a1045a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/removetables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/removetables.md
@@ -8,11 +8,11 @@ sidebar_position: 80
If it becomes necessary to clear the ADPermissions Data Collector tables and views to resolve an
issue, create a new job using it as the query source and select the Remove Tables category. The
-Connection Profile applied should be the same as the one used for the associated **Active Directory
+Connection Profile should be the same one that you used for the associated **Active Directory
Permissions Analyzer** > **0.Collection** Job. Follow the steps.
:::warning
-Using this query task results in the deletion of collected data.
+This query task deletes collected data.
:::
@@ -21,23 +21,22 @@ Using this query task results in the deletion of collected data.
**Step 2 –** In the Active Directory Permissions Data Collector Wizard, on the Category page select
the **Remove Tables** category and click **Next**.
-**Step 3 –** On the Results page, make sure all the Available Properties are selected and click
-**Next**.
+**Step 3 –** On the Results page, select all the Available Properties and click **Next**.
**Step 4 –** Click **Finish** to close the Active Directory Permissions Data Collector Wizard. Click
**OK** to close the Query Properties window.
-When the job is run, all of the ADPermissions standard reference tables are removed from the
+Running the job removes all of the ADPermissions standard reference tables from the
database.
:::tip
-Remember, this job deletes data from the Access Analyzer database. Ensure the job has been
-configured correctly prior to executing the job.
+Remember, this job deletes data from the Access Analyzer database. Ensure you configure the job
+correctly before you run it.
:::
:::warning
-Never leave the query task selected after the job has been executed. Accidental data
+Never leave the query task selected after you run the job. Accidental data
loss can occur.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/results.md b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/results.md
index 2eb12cdb0e..bd65b22c36 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/results.md
@@ -6,10 +6,10 @@ sidebar_position: 60
# ADPermissions: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for all
-of the categories.
+Use the Results page to select the properties to gather. It is a wizard page for all of the
+categories.
-Available properties vary based on the category selected. Properties can be selected individually or
-the **Select All** and **Clear All** buttons can be used. All selected properties are gathered.
+Available properties vary based on the category selected. You can select properties individually, or
+use the **Select All** and **Clear All** buttons. The wizard gathers all selected properties.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/scope.md b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/scope.md
index 716945ea02..072829a934 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/scope.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/scope.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# ADPermissions: Scope
-The Scope page is where the scope for the Active Directory permissions scan is configured. It is a
+Use the Scope page to configure the scope for the Active Directory permissions scan. It is a
wizard page for the categories of:
- Scan Active Directory Permissions
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/standardtables.md b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/standardtables.md
index 8941eb7c6d..fc7c44351b 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/standardtables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/standardtables.md
@@ -10,7 +10,7 @@ The ADPermissions Data Collector gathers essential user and group inventory info
standard reference tables. Unlike other Access Analyzer data collectors, the ADPermissions Data
Collector writes data to these tables regardless of the job executing the query.
-These tables and their associated views are outlined below:
+The following table lists these tables and their associated views:
| Table | Details |
| -------------------------------------- | ------------------------------------------------- |
@@ -27,7 +27,7 @@ These tables and their associated views are outlined below:
| SA_ADPerms_Sets | Junction table to associate permissions with ACLs |
Views are the recommended way for Access Analyzer users to obtain the information gathered by the
-ADPermissions Data Collector. They contain additional information for building queries easily. The
+ADPermissions Data Collector. They contain additional information for building queries. The
following is an explanation of the corresponding views created for some of the tables generated by
the ADPermissions Data Collector:
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/summary.md
index f3da8cc348..b6b277fe74 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/adpermissions/summary.md
@@ -6,11 +6,11 @@ sidebar_position: 70
# ADPermissions: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for all of the
+The Summary page summarizes the configuration settings. It is a wizard page for all of the
categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Active Directory Permissions Data Collector Wizard ensuring that no
-accidental clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the Active Directory Permissions Data Collector Wizard. This ensures the wizard doesn't save
+accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/aws/criteria.md b/docs/accessanalyzer/12.0/admin/datacollector/aws/criteria.md
index 22419c2819..3bae8b241b 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/aws/criteria.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/aws/criteria.md
@@ -6,24 +6,23 @@ sidebar_position: 50
# AWS: Criteria
-The Criteria (Select DLP criteria for this scan) page is where criteria to be used for discovering
-sensitive data during a scan is configured. It is a wizard page for the category of Collect SDD
-Data.
+Use the Criteria (Select DLP criteria for this scan) page to configure the criteria for discovering
+sensitive data during a scan. It is a wizard page for the category of Collect SDD Data.
-Default criteria is set at the **Global Settings** > **Sensitive Data** node. Choose between the
+Configure default criteria at the **Global Settings** > **Sensitive Data** node. Choose between the
**Use Global Criteria** Selection and the **Use the Following Selected Criteria** radio buttons.
-For custom criteria, select the checkbox for the criteria to be used to search for sensitive data.
-There are **Select All** and **Clear All** buttons that can be used.
+For custom criteria, select the checkbox for each criterion you want to use to search for sensitive
+data. Use the **Select All** and **Clear All** buttons as needed.
The table contains the following types of criteria:
- System Criteria – Lists pre-defined criteria
- User Criteria – Lists user-defined criteria
-User-defined criteria is created in the Criteria Editor, accessed through the **Global Settings** >
+You create user-defined criteria in the Criteria Editor, accessed through the **Global Settings** >
**Sensitive Data** node. See the
[Sensitive Data Discovery](/docs/accessanalyzer/12.0/sensitivedatadiscovery/overview.md) topic for additional
information.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/aws/droptables.md b/docs/accessanalyzer/12.0/admin/datacollector/aws/droptables.md
index 5bb915d5d8..cbf6da594f 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/aws/droptables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/aws/droptables.md
@@ -6,8 +6,8 @@ sidebar_position: 80
# Drop AWS Tables
-Sometimes when troubleshooting an AWS issue, it becomes necessary to clear the AWS DC data and
-tables from the Access Analyzer database. Follow the steps to configure a job to remove tables.
+Sometimes, when you troubleshoot an AWS issue, you need to clear the AWS DC data and
+tables from the Access Analyzer database. To configure a job to remove tables:
**Step 1 –** Create a new job.
@@ -24,13 +24,13 @@ tables from the Access Analyzer database. Follow the steps to configure a job to
Collector Wizard. Click **OK** to close the Query Properties window.
:::warning
-When the job is run, all of the AWS DC data and tables are removed from the database.
+Running the job removes all of the AWS DC data and tables from the database.
:::
-The job is now configured and ready to run.
+You've now configured the job, and it's ready to run.
:::note
-An AWS connection profile is not required for the Drop AWS DC Tables task.
+An AWS connection profile isn't required for the Drop AWS DC Tables task.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/aws/filters3objects.md b/docs/accessanalyzer/12.0/admin/datacollector/aws/filters3objects.md
index e36d0e1dec..495c8aabf5 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/aws/filters3objects.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/aws/filters3objects.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# AWS: Filter S3 Objects
-The Filter S3 Objects page provides the options to filter which objects stored in S3 should be
-queried for permissions and sensitive data. It is a wizard page for the categories of:
+The Filter S3 Objects page provides options to filter which objects stored in S3 the AWS Data
+Collector queries for permissions and sensitive data. It is a wizard page for the categories of:
- Collect S3
- Collect SDD Data
@@ -32,7 +32,7 @@ Select from the available buckets and click **OK** to add them to the Filter S3
## Add Custom Filter
-The Add Custom Filter window allows a custom filter to be configured.
+Use the Add Custom Filter window to configure a custom filter.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/aws/loginroles.md b/docs/accessanalyzer/12.0/admin/datacollector/aws/loginroles.md
index e9167d8870..d332abe4e8 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/aws/loginroles.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/aws/loginroles.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# AWS: Login Roles
-The Login Roles page is where the previously created AWS Roles are added. It is a wizard page for
+Use the Login Roles page to add the AWS roles you previously created. It is a wizard page for
the categories of:
- Collect Org data
@@ -15,7 +15,7 @@ the categories of:
-Add the login roles that will allow Access Analyzer to scan the AWS accounts. See the
+Add the login roles that allow Access Analyzer to scan the AWS accounts. See the
[Configure AWS for Scans](/docs/accessanalyzer/12.0/requirements/aws/configurescans.md) topic for additional
information. The page has the following options:
@@ -24,6 +24,6 @@ information. The page has the following options:
- Add – Add the role from the Role Name textbox to the list
- Remove – Remove the selected role from the list
- Clear – Remove all roles from the list
-- Max Session Duration (hours) – Specify the maximum time the account can be logged in for. This
- value should not exceed the SessionDuration configured for the role in AWS. The default value is 1
- and the maximum value is 12.
+- Max Session Duration (hours) – Specify the maximum number of hours the account can stay logged in.
+ This value shouldn't exceed the SessionDuration configured for the role in AWS. The default value
+ is 1 and the maximum value is 12.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/aws/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/aws/overview.md
index bc0c50a8ad..8980aa88fb 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/aws/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/aws/overview.md
@@ -8,7 +8,7 @@ sidebar_position: 60
The AWS Data Collector collects IAM users, groups, roles, and policies, as well as S3 permissions,
content, and sensitive data from the target Amazon Web Services (AWS) accounts. The AWS Data
-Collector has been preconfigured for the AWS Solution. Both this data collector and the solution are
+Collector comes preconfigured for the AWS Solution. Both this data collector and the solution are
available with a special Access Analyzer license. See the
[AWS Solution](/docs/accessanalyzer/12.0/solutions/aws/overview.md) topic for additional information.
@@ -22,11 +22,11 @@ available with a special Access Analyzer license. See the
**Permissions**
-- To collect details about the AWS Organization, the following permission is required:
+- To collect details about the AWS Organization, grant the following permission:
- organizations:DescribeOrganization
-- To collect details regarding IAM, the following permissions are required:
+- To collect details regarding IAM, grant the following permissions:
- iam:GenerateCredentialReport
- iam:GenerateServiceLastAccessedDetails
@@ -35,7 +35,7 @@ available with a special Access Analyzer license. See the
- iam:Simulate\*
- sts:GetAccessKeyInfo
-- To collect details related to S3 buckets and objects, the following permissions are required:
+- To collect details related to S3 buckets and objects, grant the following permissions:
- s3:Describe\*
- s3:Get\*
@@ -44,14 +44,14 @@ available with a special Access Analyzer license. See the
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if you configure the job to scan
+8 hosts at a time, it requires an extra 16 GB of RAM (8 x 2 = 16).
## AWS Query Configuration
-The AWS Data Collector is configured through the Amazon Web Services Data Collector Wizard. The
-wizard contains the following pages, which change based up on the query category selected:
+You configure the AWS Data Collector through the Amazon Web Services Data Collector Wizard. The
+wizard contains the following pages, which change based on the query category you select:
- [AWS: Category](/docs/accessanalyzer/12.0/admin/datacollector/aws/category.md)
- [AWS: Login Roles](/docs/accessanalyzer/12.0/admin/datacollector/aws/loginroles.md)
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/aws/results.md b/docs/accessanalyzer/12.0/admin/datacollector/aws/results.md
index b686048ca0..d247bb51b9 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/aws/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/aws/results.md
@@ -6,10 +6,10 @@ sidebar_position: 60
# AWS: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for all
-of the categories.
+Use the Results page to select the properties to gather. It is a wizard page for all of the
+categories.
-Properties can be checked individually or the **Select All** or **Clear All** buttons can be used.
-All checked properties are gathered. Available properties vary based on the category selected.
+You can check properties individually, or use the **Select All** or **Clear All** buttons. The
+wizard gathers all checked properties. Available properties vary based on the category selected.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/aws/sensitivedata.md b/docs/accessanalyzer/12.0/admin/datacollector/aws/sensitivedata.md
index 1e138e6849..cc08bec972 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/aws/sensitivedata.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/aws/sensitivedata.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# AWS: Sensitive Data Settings
-The Sensitive Data Settings page is where sensitive data discovery settings are configured. It is a
+Use the Sensitive Data Settings page to configure sensitive data discovery settings. It is a
wizard page for the category of Collect SDD Data.
@@ -18,7 +18,8 @@ Configure the following options:
- Include offline files (this may significantly increase scan times) – Includes offline files in the
scan
- Perform Optical Character Recognition for image files – Enables the data collector to scan for
- sensitive data within digital images of physical documents
+ sensitive data within digital images of physical documents using optical character recognition
+ (OCR)
:::note
The OCR option is intended to work for clear scanned physical documents or documents
@@ -46,13 +47,13 @@ Configure the following options:
- Spreadsheets
- Text/Markup files
-- Perform differential scan of – Enables you to choose whether to employ incremental scanning:
+- Perform differential scan of – Choose whether to employ incremental scanning:
- Files modified since last scan – Scans only files modified since the last scan
- Files modified since [date] – Only scans files modified after the specified date
- Files modified since the last [number] days – Scans files modified within the specified number
of days
-- Number of SDD scan processes [number] – Increases the number of SDD scanner processes that spawn
- as part of a scan, increasing parallel scanning. The value should not exceed 2x the number of CPU
- threads available.
+- Number of SDD scan processes [number] – Increases the number of Sensitive Data Discovery (SDD)
+ scanner processes that spawn as part of a scan, increasing parallel scanning. The value shouldn't
+ exceed 2x the number of CPU threads available.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/aws/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/aws/summary.md
index 4e2127d47e..b12167111d 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/aws/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/aws/summary.md
@@ -10,6 +10,6 @@ The Summary page displays a summary of the configured query. It is a wizard page
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Amazon Web Services Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, it is a best practice to
+click **Cancel** to close the Amazon Web Services Data Collector Wizard instead. This ensures the
+wizard doesn't save any accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/category.md b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/category.md
index a7e1edcd76..eb2344469f 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/category.md
@@ -15,10 +15,10 @@ The two categories are:
- Scan Entra ID – Scans Microsoft Entra ID objects and imports the information into the SQL Server
database, creating the standard reference tables. This task also maintains the schema for tables
and views. This is the standard option for this data collector.
-- Remove Tables – Removes all tables and views from SQL Server database. This option is designed for
- troubleshooting. When this option is selected, the next wizard page is the Summary page. See the
+- Remove Tables – Removes all tables and views from SQL Server database. Use this option for
+ troubleshooting. When you select this option, the wizard displays the Summary page next. See the
[Troubleshooting AzureADInventory Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/troubleshooting.md) topic for more information.
The Scan Entra ID category is the pre-configured setting for the .Entra ID Inventory Job Group.
-Therefore, accessing the Entra ID Inventory DC Wizard from the query within that job group does not
+Therefore, accessing the Entra ID Inventory DC Wizard from the query within that job group doesn't
display the Category wizard page.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/configurejob.md b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/configurejob.md
index 045b4a9acf..934820349d 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/configurejob.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/configurejob.md
@@ -6,14 +6,14 @@ sidebar_position: 20
# Microsoft Entra ID Connection Profile & Host List
-The AzureADInventory Data Collector requires a custom Connection Profile and host list to be created
-and assigned to the job or job group conducting the data collection. The host inventory option
-during host list creation makes it necessary to configure the Connection Profile first.
+The AzureADInventory Data Collector requires you to create a custom Connection Profile and host
+list, and assign them to the job or job group conducting the data collection. The host inventory
+option during host list creation requires you to configure the Connection Profile first.
## Connection Profile
-Creating the Connection Profile requires having the Client ID and Key that was generated when Access
-Analyzer was registered as a web application with Microsoft Entra ID. See the
+To create the Connection Profile, you need the Client ID and Key generated when you registered
+Access Analyzer as a web application with Microsoft Entra ID. See the
[Microsoft Entra ID Auditing Configuration](/docs/accessanalyzer/12.0/requirements/entraid/entraid/access.md) for additional
information.
@@ -32,7 +32,7 @@ Create a Connection Profile and set the following information on the User Creden
[Generate the Client Secret Key](/docs/accessanalyzer/12.0/requirements/entraid/entraid/access.md#generate-the-client-secret-key)
topic for additional information.
-Once the Connection Profile is created, it is time to create the custom host list. See the
+After you create the Connection Profile, create the custom host list. See the
[Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) topic for additional information.
## Custom Host List
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/customattributes.md b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/customattributes.md
index 212f8a36a8..933d5e924e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/customattributes.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/customattributes.md
@@ -6,8 +6,7 @@ sidebar_position: 50
# AzureADInventory: Custom Attributes
-Use the Custom Attributes wizard page to define custom attributes that will be used in the Microsoft
-Entra ID scan.
+Use the Custom Attributes wizard page to define custom attributes for the Microsoft Entra ID scan.
@@ -16,26 +15,26 @@ Configuration options for Custom Attributes include:
- Collect Open Extensions – If enabled, data collector will perform a full scan and collect all
extension attributes for Microsoft Entra ID objects
- - Enabling this option will increase the time it takes for the data collector to complete the
- scan. Disabling this option will configure the data collector run a differential scan, which
- will only scan changes since the last scan was performed.
+ - Enabling this option increases the time it takes for the data collector to complete the
+ scan. Disabling this option configures the data collector to run a differential scan instead,
+ which scans only changes since the last scan ran.
:::warning
- A full scan is required when new attributes are added or removed.
+ Adding or removing attributes requires a full scan.
:::
-- Add – Adds a manually entered attribute that is included in the scan. This option opens the Custom
+- Add – Adds a manually entered attribute to the scan. This option opens the Custom
Attribute window.
- Edit – Make changes to a previously added attribute. This option opens the Custom Attribute
window.
- Remove – Deletes the attribute from the table and therefore the scan
- Import – Use the Azure Connection Profile credentials or manually inputted credentials to import
- custom attributes for the scan using a valid tenant name. This option opens up the Custom
+ custom attributes for the scan using a valid tenant name. This option opens the Custom
Attributes Import Wizard.
Use the **Add**, **Edit**, and **Remove** buttons at the bottom of the window to configure the
-custom attributes to be gathered by the scan. Use the **Add** button to open the
+custom attributes the scan gathers. Use the **Add** button to open the
[Custom Attribute Window](#custom-attribute-window). The **Import** button opens the
[Custom Attributes Import Wizard](#custom-attributes-import-wizard).
@@ -48,17 +47,17 @@ window.
The options on the Custom Attributes window are:
-- Tenant Filter – Use a Tenant Name or wildcard to target the desired environment. Wildcards (\*)
- can be used.
-- Object Class – One or more object class for the attribute can be selected:
+- Tenant Filter – Use a Tenant Name or wildcard to target the environment you want. You can use
+ wildcards (\*).
+- Object Class – Select one or more object classes for the attribute:
- User
- Group
- Contact
- Attribute Name – Microsoft Entra ID attribute name
-- Collect all sub-attributes – Allows the collection of sub-attributes
- - Sub-Attribute Name – Define the sub-attribute name. Wildcards (\*) can be used.
+- Collect all sub-attributes – Lets you collect sub-attributes
+ - Sub-Attribute Name – Define the sub-attribute name. You can use wildcards (\*).
-Repeat this process until all desired Custom Attributes have been included. Click **OK** to save the
+Repeat this process until you've added all desired custom attributes. Click **OK** to save the
attribute.
#### Custom Attributes Import Wizard
@@ -73,7 +72,7 @@ Custom Attributes Import Wizard opens.
**Step 2 –** On the Connection page, enter the Tenant Name of the instance of Microsoft Entra ID to
-be targeted, and then select the method of supplying credentials for the specified tenant instance:
+target, and then select how to supply credentials for the specified tenant instance:
- Use the following connection profile entry – Select an Azure Connection Profile from the dropdown
list
@@ -92,7 +91,7 @@ See the [Microsoft Entra ID Auditing Configuration](/docs/accessanalyzer/12.0/re
[Microsoft Entra ID Connection Profile & Host List](/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/configurejob.md) topics for additional
information.
-**Step 3 –** Click **Test Connection** in order to connect to the tenant with the supplied
+**Step 3 –** Click **Test Connection** to connect to the tenant with the supplied
credentials. If they are correct, the Schema Attributes and Application Attributes pages become
available. Click **Next** to navigate to them.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/overview.md
index 3b3c7a79b6..318b75a602 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/overview.md
@@ -49,7 +49,7 @@ additional information.
## AzureADInventory Query Configuration
-The AzureADInventory Data Collector is configured through the Entra ID Inventory DC Wizard, which
+You configure the AzureADInventory Data Collector through the Entra ID Inventory DC Wizard, which
contains the following wizard pages:
- Welcome
@@ -61,5 +61,5 @@ contains the following wizard pages:
-Hide the Welcome page the next time this data collected is accessed by selecting the **Do not
+To hide the Welcome page the next time you access this data collector, select the **Don't
display this page the next time** checkbox.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/results.md b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/results.md
index 2df29a43cf..71e6aeca8e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/results.md
@@ -6,12 +6,12 @@ sidebar_position: 60
# AzureADInventory: Results
-The Results page is where the properties from Microsoft Entra ID to be gathered are selected. It is
-a wizard page for the category of Scan Entra ID.
+Use the Results page to select the Microsoft Entra ID properties to gather. It is
+a wizard page for the Scan Entra ID category.
-Properties can be checked individually or the **Select All** and **Clear All** buttons can be used.
-All checked properties are collected. This information is not available within the standard
-reference tables and views. Instead, this information can be viewed in the
-**SA_AzureADInventory_DEFAULT** table, which is created when any of these properties are selected.
+You can check properties individually, or use the **Select All** and **Clear All** buttons.
+The data collector collects all checked properties. This information isn't available within the standard
+reference tables and views. Instead, view this information in the
+**SA_AzureADInventory_DEFAULT** table, which the data collector creates when you select any of these properties.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/standardtables.md b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/standardtables.md
index bb3f3468c1..84bcce7e72 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/standardtables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/standardtables.md
@@ -10,7 +10,7 @@ The AzureADInventory Data Collector collects essential user and group inventory
standard reference tables. Unlike other Access Analyzer data collectors, the AzureADInventory Data
Collector writes data to these tables regardless of the job executing the query.
-These tables and their associated views are outlined below:
+The following table describes these tables and their associated views:
| Table | Details |
| ----------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -26,10 +26,9 @@ These tables and their associated views are outlined below:
| SA_AzureADInventory_Principals | Contains common attributes for users, groups, and computers as well as references to their primary display name and mail addresses |
| SA_AzureADInventory_Users | Contains extended information about users, department, title, and so on |
-Views are the recommended way for you to obtain the information gathered by the AzureADInventory
-Data Collector. They contain additional information for building queries easily. The following is an
-explanation of the corresponding views created for some of the tables generated by the
-AzureADInventory Data Collector:
+Views are the recommended way for you to obtain the information the AzureADInventory
+Data Collector gathers. They contain additional information for building queries. The following table
+explains the views the AzureADInventory Data Collector creates for some of its tables:
| Views | Details |
| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
@@ -43,7 +42,7 @@ AzureADInventory Data Collector:
### AzureADInventory Exception Types Translated
-The following table translates the Type of Exceptions that can found.
+The following table explains the exception types.
| Type | Exception | Description |
| ---- | -------------------- | ------------------------------------------------------------------------- |
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/summary.md
index 80d3c80469..0c0e86ddae 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 70
# AzureADInventory: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for both of the
-categories.
+The Summary page summarizes your configuration settings. It is a wizard page for both categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Entra ID Inventory DC Wizard to ensure that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you made no changes, it is a best practice to
+click **Cancel** to close the Entra ID Inventory DC Wizard instead. This ensures the wizard doesn't
+save any accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/troubleshooting.md b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/troubleshooting.md
index 3b44d36f88..99c03162bc 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/troubleshooting.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/troubleshooting.md
@@ -8,7 +8,7 @@ sidebar_position: 80
## Clear AzureADInventory Tables
-Sometimes when troubleshooting an AzureADInventory issue, it becomes necessary to clear the standard
+Sometimes when troubleshooting an AzureADInventory issue, you need to clear the standard
reference tables. Follow the steps.
**Step 1 –** Create a new job and assign a query using the **AZUREADINVENTORY** Data Collector.
@@ -19,7 +19,7 @@ category task.
**Step 3 –** Click **Next** and then **Finish** to close the Entra ID Inventory DC Wizard. Click
**OK** to close the Query Properties window.
-When the job is run, all of the AzureADInventory standard reference tables are removed from the
+Running the job removes all AzureADInventory standard reference tables from the
database.
## Troubleshooting Error Messages
@@ -28,11 +28,11 @@ Change the XML parameters to address the following errors:
Error: Microsoft.Graph.ServiceException: Code: timeout Message: The request timed out
-Update the `` parameter to update the number of retries to run the query.
+Update the `` parameter to change the number of retries for the query.
The default is 3.
Error: An existing connection was forcible closed by the remote host
-Update the `` parameter to update the max delta token age. The default is 6.
+Update the `` parameter to change the max delta token age. The default is 6.
See the [View Job XML File](/docs/accessanalyzer/12.0/admin/jobs/job/properties/viewxml.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/box/activityoperationscope.md b/docs/accessanalyzer/12.0/admin/datacollector/box/activityoperationscope.md
index 1cc19e03fd..f595bc5e71 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/box/activityoperationscope.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/box/activityoperationscope.md
@@ -6,13 +6,13 @@ sidebar_position: 70
# Box: Activity Operation Scope
-The Activity Operation Scope page (ActivityOperationScope) is where Box Enterprise events can be
-selected or unselected for scans. It is a wizard page for the Scan Box Activity category.
+Use the Activity Operation Scope page (ActivityOperationScope) to select or unselect Box Enterprise
+events for scans. It is a wizard page for the Scan Box Activity category.
-Event filters can be selected by group or the group may be expanded and the filters selected
-individually. All selected filters are gathered from the Box environment.
+You can select event filters by group, or expand the group and select filters individually. The
+data collector gathers all selected filters from the Box environment.
Event filters include:
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/box/activitytimeframescope.md b/docs/accessanalyzer/12.0/admin/datacollector/box/activitytimeframescope.md
index c17987c5cd..a87bd40e25 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/box/activitytimeframescope.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/box/activitytimeframescope.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# Box: Activity Timeframe Scope
-The Activity Timespan Scope page (ActivityTimeframeScope) is where Box activity data collection is
-configured. It is a wizard page for the Scan Box Activity category.
+Use the Activity Timespan Scope page (ActivityTimeframeScope) to configure Box activity data
+collection. It is a wizard page for the Scan Box Activity category.
@@ -15,14 +15,14 @@ Select one of the following options to configure the timeframe for Box data coll
- Relative Timespan – Collects activity from a set number of days relative to the present
- - Collect activity from the last [number] Days – Enter the number of days for which activity
- data collection is required. The default is 180. The maximum timespan is 365 days.
+ - Collect activity from the last [number] Days – Enter the number of days to collect activity
+ data for. The default is 180. The maximum timespan is 365 days.
- Data retention settings – Select a preferred retention setting
- Within timespan – Deletes all data outside of the selected timespan
- Retain all data – Retains all data collected inside or outside of the selected timespan
-- Absolute Timespan – Enter the interval of days for which activity data collection is required. The
+- Absolute Timespan – Enter the interval of days to collect activity data for. The
default End Date is the current day.
:::note
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/box/additionalscoping.md b/docs/accessanalyzer/12.0/admin/datacollector/box/additionalscoping.md
index 842fc10edf..215fbcaee6 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/box/additionalscoping.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/box/additionalscoping.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Box: Additional Scoping
-The Additional Scoping page is where the scan can be limited by depth of the scan. It is a wizard
+Use the Additional Scoping page to limit the scan by depth. It is a wizard
page for the Scan Box Permissions category.
@@ -14,7 +14,7 @@ page for the Scan Box Permissions category.
Configure the scan depth level:
- Limit scanned depth to: [number] level – Select the checkbox and set the scan depth level to the
- desired depth. If this checkbox is not selected, then the entire Box environment will be scanned,
- according to the [Box: Exclusions Page](/docs/accessanalyzer/12.0/admin/datacollector/box/exclusions.md) settings. If the scoping depth is set to
- **0** then only root will be scanned. Each increment will add another level of depth from root
+ desired depth. If you don't select this checkbox, the data collector scans the entire Box
+ environment according to the [Box: Exclusions Page](/docs/accessanalyzer/12.0/admin/datacollector/box/exclusions.md) settings. If you set the scoping depth to
+ **0**, the data collector scans only the root. Each increment will add another level of depth from root
level.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/box/authenticate.md b/docs/accessanalyzer/12.0/admin/datacollector/box/authenticate.md
index 7cc0096182..75f147fed2 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/box/authenticate.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/box/authenticate.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# Box: Authenticate
-The Authenticate page is where connection to the Box environment is configured. It is a wizard page
+Use the Authenticate page to configure the connection to the Box environment. It is a wizard page
for all categories.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/box/exclusions.md b/docs/accessanalyzer/12.0/admin/datacollector/box/exclusions.md
index cc41a60e07..8fdae4b735 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/box/exclusions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/box/exclusions.md
@@ -6,21 +6,21 @@ sidebar_position: 30
# Box: Exclusions Page
-The Exclude or Include folders page (ExclusionsPage) is where the scan can be limited to include or
-to exclude folders within the Box Enterprise. It is a wizard page for of Scan Box Permissions
+Use the Exclude or Include folders page (ExclusionsPage) to limit the scan to include or
+exclude folders within the Box Enterprise. It is a wizard page for the Scan Box Permissions
category.
The options on the Exclusions Page are:
-- Add as inclusion – Type the path of a folder in the text box to include in the scan. The folder
+- Add as inclusion – Enter the path of a folder in the text box to include in the scan. The folder
path must not include a slash at the end.
- Example format: `/All Files/Folder/SubFolder`
- Incorrect format: `/All Files/Folder/SubFolder/`
-- Add as exclusion – Type the path of a folder in the text box to exclude from the scan
+- Add as exclusion – Enter the path of a folder in the text box to exclude from the scan
The **Remove** option will delete a selected folder from the list. The **Clear List** option will
remove all folders from the list.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/box/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/box/overview.md
index 720392a04b..c6c98fd3f0 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/box/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/box/overview.md
@@ -9,9 +9,9 @@ sidebar_position: 80
The Box Data Collector audits access, group membership, and content within a Box enterprise.
:::note
-If the Box Data Collector is used in a new job, outside of the Box Solution, it is
-necessary to deselect the **Skip Hosts that do not respond to PING** option on the job’s
-**Properties** > **Performance** tab.
+If you use the Box Data Collector in a new job outside of the Box Solution, deselect the
+**Skip Hosts that don't respond to PING** option on the job's **Properties** > **Performance**
+tab.
:::
@@ -35,8 +35,8 @@ the solution are available with a special Access Analyzer license. See the
## Box Query Configuration
-The Box Data Collector is configured through the Box Data Collector Wizard. The wizard contains the
-following pages, which change based up on the query category selected:
+Configure the Box Data Collector through the Box Data Collector Wizard. The wizard contains the
+following pages, which change based on the query category selected:
- Welcome
- [Box: Category](/docs/accessanalyzer/12.0/admin/datacollector/box/category.md)
@@ -55,5 +55,5 @@ introductory and caution information about the Box Data Collector before proceed
-The Welcome page can be hidden by checking the **Do not display this page the next time** box when
-the wizard is open and configuration settings are saved.
+To hide the Welcome page, check the **Don't display this page the next time** box while the wizard
+is open. This saves your configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/box/results.md b/docs/accessanalyzer/12.0/admin/datacollector/box/results.md
index ff56500b08..a5d7726961 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/box/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/box/results.md
@@ -6,10 +6,10 @@ sidebar_position: 90
# Box: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for all
+Use the Results page to select the properties to gather. It is a wizard page for all
categories.
-Properties can be selected individually or the **Select All** or **Clear All** buttons can be used.
-All selected properties will be gathered. Available properties vary based on the category selected.
+You can select properties individually, or use the **Select All** or **Clear All** buttons.
+The data collector gathers all selected properties. Available properties vary based on the category selected.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/box/scopebyuser.md b/docs/accessanalyzer/12.0/admin/datacollector/box/scopebyuser.md
index 37c92ef7d1..2f69617e8a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/box/scopebyuser.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/box/scopebyuser.md
@@ -6,20 +6,20 @@ sidebar_position: 40
# Box: Scope by User Page
-The User Scope Settings page (ScopeByUserPage) is where the scope of the scan can be limited to
-specified users and the resulting scan will only scan for the specified users. It is a wizard page
+Use the User Scope Settings page (ScopeByUserPage) to limit the scope of the scan to specified
+users. The resulting scan only includes the specified users. It is a wizard page
for the Scan Box Permissions category.
Select whether to scan **All Users** or **Limited Users**. If scanning for **Limited Users**, click
-**Browse** and navigate to the path of the CSV file that contains the email addresses of users to be
-included in the scan. The CSV file should have one email address per row.
+**Browse** and navigate to the path of the CSV file that contains the email addresses of users to
+include in the scan. The CSV file should have one email address per row.
:::note
The query will collect information related to User names and Group membership for all
-users in a target environment. However, if the query is scoped to specific users, no additional
-information is collected for users outside out of the scope. User names and group membership for the
-target environment is necessary to generate the Box Solution reports.
+users in a target environment. However, if you scope the query to specific users, the query doesn't
+collect additional information for users outside the scope. The Box Solution reports require user
+names and group membership for the target environment.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/box/standardtables.md b/docs/accessanalyzer/12.0/admin/datacollector/box/standardtables.md
index 0cd058264c..b617928398 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/box/standardtables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/box/standardtables.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Standard Reference Tables & Views For the Box Data Collector
The Box Data Collector gathers essential user and group inventory information into standard
-reference tables. These tables and their associated views are outlined below:
+reference tables. The following table describes these tables and their associated views:
| Table | Details |
| -------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
@@ -27,10 +27,10 @@ reference tables. These tables and their associated views are outlined below:
| SA_Box_UnusualUserActivity | Contains information about suspicious activity on user accounts |
| SA_Box_Users | Contains one row per user and displays information on users of any teams present |
-Views are the recommended way for Access Analyzer users to obtain the information gathered by the
-Box Data Collector. They contain additional information for building queries easily. The following
-is an explanation of the corresponding views created for some of the tables generated by the Box
-Data Collector:
+Views are the recommended way for Access Analyzer users to obtain the information the
+Box Data Collector gathers. They contain additional information for building queries. The following
+table explains the views the Box Data Collector creates for some of its
+tables:
| Views | Details |
| ------------------------- | ------------------------------------------------------------------------------------------------------------ |
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/box/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/box/summary.md
index 71a3f19857..3ed0fa5ae6 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/box/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/box/summary.md
@@ -6,11 +6,9 @@ sidebar_position: 100
# Box: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for all of the
-categories.
+The Summary page summarizes the configuration settings. It's a wizard page for all categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Box Data Collector Wizard ensuring that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the Box Data Collector Wizard instead, so accidental clicks don't get saved.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/definefields.md b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/definefields.md
index 1e6e18ea2c..c81163220a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/definefields.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/definefields.md
@@ -12,7 +12,7 @@ output. It is a wizard page for the **Edit Profile** and **Create a New Profile*
:::warning
-Do not modify this page without guidance from Netwrix or the data may not be processed
-by Access Analyzer.
+Don't modify this page without guidance from Netwrix. Otherwise, Access Analyzer might not process
+the data correctly.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/overview.md
index 02a2bae772..d59a4c2618 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 90
# CommandLineUtility Data Collector
-The CommandLineUtility Data Collector provides the ability to remotely spawn, execute, and extract
-data provided by a Microsoft native or third-party command line utility. It allows users to easily
+The CommandLineUtility Data Collector lets you remotely spawn, execute, and extract
+data provided by a Microsoft native or third-party command line utility. Use it to
execute a command line utility and capture its output as Access Analyzer data. This data collector
is a core component of Access Analyzer and is available with all Access Analyzer licenses.
@@ -27,8 +27,8 @@ is a core component of Access Analyzer and is available with all Access Analyzer
## CommandLineUtility Query Configuration
-The CommandLineUtility Data Collector executes a command line utility and captures the output. It is
-configured through the Command Line Utility Data Collector Wizard, which contains the following
+The CommandLineUtility Data Collector executes a command line utility and captures the output. You
+configure it through the Command Line Utility Data Collector Wizard, which contains the following
pages:
- Welcome
@@ -42,5 +42,5 @@ pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open, then save the configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/profileparameters.md b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/profileparameters.md
index d1ddd5a2aa..75598ebec4 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/profileparameters.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/profileparameters.md
@@ -14,17 +14,17 @@ page.
Profile parameters include:
-- Profile Name – Name of the profile. If **Edit Profile** was selected on the Profile Type page,
- then this is the name of an existing profile to be edited. If **Create a New Profile** was
- selected, then this is the name of a new profile.
+- Profile Name – Name of the profile. If you selected **Edit Profile** on the Profile Type page,
+ this is the name of the existing profile you want to edit. If you selected **Create a New
+ Profile**, this is the name of the new profile.
- Path – Path of the utility (.exe) from the local or remote machine. If stored on the local
- machine, give the local path. If the utility is located on multiple paths in the same machine,
- each can be entered on a new line in this field. If the .exe file is present in the installed CLU
- directory, then enter the utility name rather than the full path.
+ machine, give the local path. If the utility exists in multiple paths on the same machine, enter
+ each path on a new line in this field. If the .exe file is present in the installed Command Line
+ Utility (CLU) directory, then enter the utility name rather than the full path.
- Start in path for task (Optional) – Working directory for the command line that executes the
program or script. This should be either the path to the program or script file, or the path to
- the files that are used by the executable file.
-- Command Line – Command that the utility executes. If the utility is self-executable and does not
+ the files that the executable file uses.
+- Command Line – Command that the utility executes. If the utility is self-executable and doesn't
need a command, leave this field blank.
-- Output File Name – Enter the desired name for the output file. By default, the output file name
+- Output File Name – Enter the name you want for the output file. By default, the output file name
matches the profile name.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/profiletype.md b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/profiletype.md
index e529f60d3d..e65d474fac 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/profiletype.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/profiletype.md
@@ -12,10 +12,10 @@ The Profile Type page contains options to select a new or existing profile.
The options on the Profile Type page are:
-- Select Profile – Allows you to change the properties of a profile from the results page
-- Edit Profile – Allows you to edit a profile's execution options and properties. Enables the Define
+- Select Profile – Change the properties of a profile from the results page
+- Edit Profile – Edit a profile's execution options and properties. Enables the Define
Fields and Script Editor pages.
-- Create a New Profile – Allows you to create a new profile. Enables the Define Fields and Script
+- Create a New Profile – Create a new profile. Enables the Define Fields and Script
Editor pages.
-The profile type selected may alter the availability of the subsequent wizard steps.
+The profile type you select may affect the availability of the subsequent wizard steps.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/results.md b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/results.md
index 0e03ec015a..2b525e12da 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/results.md
@@ -6,11 +6,11 @@ sidebar_position: 60
# CLU: Results
-The Results page is where the properties to be returned as columns in the results table are
-selected. It is a wizard page for all profile types.
+The Results page is where you select the properties to return as columns in the results table.
+It's a wizard page for all profile types.
-Select one or more properties to be returned as columns in the results table. Click **Select All**
-to select all of the properties, or click **Clear All** to clear all the currently selected
+Select one or more properties to return as columns in the results table. Click **Select All**
+to select all the properties, or click **Clear All** to clear all the selected
properties. The available properties vary based on the selections on previous wizard pages.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/scripteditor.md b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/scripteditor.md
index 1b7b4c5ec8..5e632d2a4e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/scripteditor.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/scripteditor.md
@@ -14,7 +14,7 @@ page is disabled when the **Select Profile** option is selected on the Profile T
:::warning
-Do not modify this page without guidance from Netwrix or the data may not be processed
-by Access Analyzer.
+Don't modify this page without guidance from Netwrix. Otherwise, Access Analyzer might not process
+the data correctly.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/summary.md
index 4f4c8c6751..f341d0619c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/commandlineutility/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 70
# CLU: Summary
-The Summary page provides a summary of the query that has been created or edited. It is a wizard
-page for all profile types.
+The Summary page summarizes the query you created or edited. It's a wizard page for all profile
+types.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Command Line Utility Data Collector Wizard to ensure that no
-accidental clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the Command Line Utility Data Collector Wizard instead, so accidental clicks don't get saved.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/overview.md
index 49f4875e42..19b0047875 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 100
# DiskInfo Data Collector
-The DiskInfo Data Collector provides enumeration of disks and their associated properties. When
-targeting the local host for a DiskInfo query, it is necessary to select the **Systems Default**
+The DiskInfo Data Collector enumerates disks and their associated properties. When
+targeting the local host for a DiskInfo query, select the **Systems Default**
option as the connection profile. This data collector is a core component of Access Analyzer and is
available with all Access Analyzer licenses.
@@ -27,7 +27,7 @@ available with all Access Analyzer licenses.
## DiskInfo Query Configuration
-The DiskInfo Data Collector is configured through the Disk Info wizard, which contains the following
+You configure the DiskInfo Data Collector through the Disk Info wizard, which contains the following
wizard pages:
- Welcome
@@ -37,5 +37,5 @@ wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open, then save the configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/results.md b/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/results.md
index c787516b08..50fb71882e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/results.md
@@ -6,14 +6,13 @@ sidebar_position: 20
# DiskInfo: Results
-The Results page provides a checklist of the data that is available for return by the query. Any
-number of options can be selected at once, but at least one must be selected in order to complete
-the wizard.
+The Results page provides a checklist of the data the query can return. You can select any number
+of options at once, but you must select at least one to complete the wizard.
-Properties can be selected individually, or you can use the **Select all** and **Clear all**
-buttons. The table below describes the available options.
+You can select properties individually, or use the **Select all** and **Clear all**
+buttons. The following table describes the available options.
| Checklist Result | Description |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------- |
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/summary.md
index f90909d017..8783f405b4 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/summary.md
@@ -6,10 +6,9 @@ sidebar_position: 30
# DiskInfo: Summary
-The Summary page displays a summary of the configured query.
+The Summary page summarizes the configured query.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Disk Info Data Collector Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the Disk Info Data Collector Wizard instead, so accidental clicks don't get saved.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/targetdisks.md b/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/targetdisks.md
index b3937a48a2..b4c3149636 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/targetdisks.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/diskinfo/targetdisks.md
@@ -6,27 +6,27 @@ sidebar_position: 10
# DiskInfo: Target Disks
-The Target Disks page provides a selection of storage devices from which to return data from the
-target host after a query.
+The Target Disks page lists the storage devices you can select to return data from the target host
+after a query.
-Use the options to select the desired target disk.
+Use the options to select the target disk you want.
-- The Enumerate all storage devices – Allows all internal drives to be scanned. In order to expand
- the scan, two sub-options can be included together, separately, or not at all.
+- Enumerate all storage devices – Scans all internal drives. To expand the scan, include either or
+ both of the following sub-options, or neither.
- Include removable storage devices – Scans removable devices that are plugged into the target
host
- Include network storage devices – Scans mapped drives that exist through a connected network
-- Single drive letter – Allows information to be collected from a single drive (`A:` through `Z:`)
+- Single drive letter – Collects information from a single drive (`A:` through `Z:`)
during a single query. This option includes both operating system drives and removable disks.
- Enumerate all mount points (available for Windows 2003+ systems) – Targets any drive letter on the
target host that points to a mapped share drive
- Registry lookup – Provides the path of connection to gather information from the Access Analyzer
- Registry Browser. By default, the local host will be targeted unless modified. The Registry value
- are instructions for the data found within the subfolders of the registry.
+ Registry Browser. By default, Access Analyzer targets the local host unless you change it. The
+ Registry value are instructions for the data found within the subfolders of the registry.
- The browse button **(…)** under the Registry lookup option opens the Access Analyzer Registry
Browser window. Use the registry browser to find registry keys and values that are on a target
@@ -43,8 +43,8 @@ environment.
The configurable options on the Registry Browser are:
-- Sample from Host – Host for which the Registry will be browsed. If this box is left blank, the
- Registry on the local host is used.
+- Sample from Host – Host that Access Analyzer browses for registry information. If you leave this
+ box blank, Access Analyzer uses the Registry on the local host.
- 64-bit view – Default view is 32-bit. Select the 64-bit checkbox to switch to a 64-bit view.
- Connect – Click **Connect** to browse the Registry
- Table Columns – Select the Registry from the navigation pane to view keys in the table
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/dns/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/dns/overview.md
index d9eefe5289..61801d383e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/dns/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/dns/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# DNS Data Collector
-The DNS Data Collector provides information regarding DNS configuration and records. It is available
+The DNS Data Collector provides information about DNS configuration and records. It is available
with the Active Directory Solution. Both this data collector and the solution are available with a
special Access Analyzer license.
@@ -25,7 +25,7 @@ special Access Analyzer license.
## DNS Query Configuration
-The DNS Data Collector is configured through the Domain Name System Data Collector Wizard, which
+You configure the DNS Data Collector through the Domain Name System Data Collector Wizard, which
contains the following wizard pages:
- Welcome
@@ -35,5 +35,5 @@ contains the following wizard pages:
-The Welcome page can be hidden by selecting the Do not display this page the next time checkbox when
-the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the Don't display this page the next time checkbox while the
+wizard is open, then save the configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/dns/results.md b/docs/accessanalyzer/12.0/admin/datacollector/dns/results.md
index 87e3b77b9a..81b84234fa 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/dns/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/dns/results.md
@@ -6,11 +6,11 @@ sidebar_position: 20
# DNS: Results
-The Results page is where DNS properties to be gathered are selected. It is a wizard page for all
+The Results page is where you select the DNS properties to gather. It's a wizard page for all
categories.
-Available properties can be selected individually, or the **Select All**, **Clear All**, and **Reset
-to defaults** buttons can be used. All selected properties are gathered. Available properties vary
-based on the category selected.
+You can select available properties individually, or use the **Select All**, **Clear All**, and
+**Reset to defaults** buttons. Access Analyzer gathers all selected properties. Available properties
+vary based on the category selected.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/dns/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/dns/summary.md
index 17b7207531..3d6a02d8c4 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/dns/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/dns/summary.md
@@ -6,10 +6,9 @@ sidebar_position: 30
# DNS: Summary
-The Summary page displays a summary of the configured query. It is a wizard page for all categories.
+The Summary page summarizes the configured query. It's a wizard page for all categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Domain Name System Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the Domain Name System Data Collector Wizard instead, so accidental clicks don't get saved.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/completion.md b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/completion.md
index 93cd66709f..5a04a6158b 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/completion.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/completion.md
@@ -6,17 +6,17 @@ sidebar_position: 80
# DropboxAccess: Summary (Completion)
-The Completion page, is where configuration settings are summarized. This page is a wizard page for
+The Completion page summarizes the configuration settings. This page is a wizard page for
all categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Dropbox Access Auditor Data Collector Wizard ensuring that no
-accidental clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the Dropbox Access Auditor Data Collector Wizard instead, so accidental clicks don't get
+saved.
:::tip
-Remember, if an Access Token was generated, use it as the credential within the Connection
+Remember, if you generated an Access Token, use it as the credential within the Connection
Profile. Then assign it to the job group or job which will be scanning the targeted Dropbox
environment. See the [Custom Dropbox Connection Profile & Host List](/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/configurejob.md) topic for
additional information.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/configurejob.md b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/configurejob.md
index c9968698eb..69a49f04da 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/configurejob.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/configurejob.md
@@ -6,21 +6,21 @@ sidebar_position: 20
# Custom Dropbox Connection Profile & Host List
-The DropboxAccess Data Collector requires a custom Connection Profile to be created and assigned to
-the job or job group conducting the data collection.
+The DropboxAccess Data Collector requires a custom Connection Profile that you create and assign to
+the job or job group that collects the data.
## Connection Profile
-Creating the Connection Profile requires an access token. The access token is generated on the Scan
+Creating the Connection Profile requires an access token. You generate the access token on the Scan
Options page of the Dropbox Access Auditor Data Collector Wizard.
Create a Connection Profile and set the following information on the User Credentials window:
- Select Account Type – Dropbox
-- Password Storage – Application (Uses the configured Profile Security setting as selected at the
+- Password Storage – Application (Uses the configured Profile Security setting as you selected it at the
**Settings** > **Application** node. See the [Application](/docs/accessanalyzer/12.0/admin/settings/application/overview.md)
topic for additional information.)
-- Access Token – Copy and paste the Access Token after it has been generated from the Scan Options
+- Access Token – Copy and paste the access token after you generate it on the Scan Options
page of the Dropbox Access Auditor Data Collector Wizard. See the
[DropboxAccess: Scan Options](/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/scanoptions.md) topic for additional information.
@@ -28,6 +28,6 @@ See the [Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overvie
## Host List
-The host list should be set to:
+Set the host list to:
- Local host
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/dlpauditsettings.md b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/dlpauditsettings.md
index da7ab3e38c..b331e3323d 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/dlpauditsettings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/dlpauditsettings.md
@@ -15,8 +15,8 @@ Configure the DLP audit settings:
- Scan Performance:
- - Don’t process files larger than – Limits the files to be scanned for sensitive content to
- files smaller than the specified size
+ - Don’t process files larger than – Limits scanning for sensitive content to files smaller
+ than the specified size
- File types to scan:
@@ -27,13 +27,13 @@ Configure the DLP audit settings:
the scan:
- Store discovered sensitive data – Stores a copy of any potentially sensitive data that matches
- the selected criteria in the Access Analyzer database. This copy can be used to check for
- false positives, data that matches the selected criteria but is not actually sensitive.
+ the selected criteria in the Access Analyzer database. Use this copy to check for
+ false positives, data that matches the selected criteria but isn't actually sensitive.
- Limit stored matches per criteria to [number] – Identifies the number of potentially sensitive
- data matches that are copied to the database. The default is 5 matches. This option is
- available only if the **Store discovered sensitive data** option is selected.
+ data matches copied to the database. The default is 5 matches. This option is available
+ only if you select the **Store discovered sensitive data** option.
-- Perform differential scan of – Enables users to choose whether to employ incremental scanning:
+- Perform differential scan of – Choose whether to employ incremental scanning:
- Files modified since last scan – Scans only files modified since the last scan
- Files modified since [date] – Only scans files modified after the specified date
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/overview.md
index 147801ab0b..79165f1f9d 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/overview.md
@@ -7,10 +7,10 @@ sidebar_position: 120
# DropboxAccess Data Collector
The DropboxAccess Data Collector audits access, group membership, and content within a Dropbox
-environment. Dropbox can scan the contents of over 400 file types to discover which files contain
-sensitive data using Sensitive Data Discovery. The DropboxAccess Data Collector has been
-preconfigured within the Dropbox Solution. Both this data collector and the solution are available
-with a special Access Analyzer license. See the
+environment. Using Sensitive Data Discovery, Dropbox can scan the contents of over 400 file types
+to discover which files contain sensitive data. The Dropbox Solution includes the preconfigured
+DropboxAccess Data Collector. Both this data collector and the solution are available with a
+special Access Analyzer license. See the
[Dropbox Solution](/docs/accessanalyzer/12.0/solutions/dropbox/overview.md) topic for additional information.
**Protocols**
@@ -29,13 +29,13 @@ with a special Access Analyzer license. See the
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if you configure the job to
+scan 8 hosts at a time, it requires an extra 16 GB of RAM (8 x 2 = 16).
## Query Configuration
-The DropboxAccess Data Collector is configured through the Dropbox Access Auditor Data Collector
+You configure the DropboxAccess Data Collector through the Dropbox Access Auditor Data Collector
Wizard. The wizard contains the following pages, which change based upon the query category
selected:
@@ -49,5 +49,5 @@ selected:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open, then save the configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/scanoptions.md b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/scanoptions.md
index 7f54ec3143..6c80ba2611 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/scanoptions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/scanoptions.md
@@ -7,12 +7,12 @@ sidebar_position: 40
# DropboxAccess: Scan Options
Use the Scan Options page to authorize Access Analyzer to generate an Access Token allowing the
-DropboxAccess Data Collector to access and scan an organization’s Dropbox environment. The Access
-Token is used as the credential in the Connection Profile.
+DropboxAccess Data Collector to access and scan an organization’s Dropbox environment. The
+Connection Profile uses the Access Token as its credential.
:::note
-The Access Token needs to be generated only once, prior to the first execution of any job
-in which the DropboxAccess Data Collector is used in a query.
+You only need to generate the Access Token once, before the first job that uses the DropboxAccess
+Data Collector in a query.
:::
@@ -21,7 +21,7 @@ The Scan Options page is a wizard page for the following categories:
- Scan Dropbox Access
- Scan for Sensitive Content
-Follow the steps to create the Access Token:
+To create the Access Token:
@@ -33,7 +33,7 @@ Follow the steps to create the Access Token:
-**Step 3 –** Once the Access Token has been generated, click **Copy to Clipboard**. Click **Next**
+**Step 3 –** After Dropbox generates the Access Token, click **Copy to Clipboard**. Click **Next**
to finish choosing the configuration options or click **Cancel** to close the Dropbox Access Auditor
Data Collector Wizard.
@@ -42,6 +42,5 @@ Create a Connection Profile using this access token as the credential. See the
configuring the Dropbox credential.
:::tip
-Remember, assign this Connection Profile to the job group or job where the host assignment for the
-Dropbox environment to be targeted has been assigned.
+Assign this Connection Profile to the job group or job that targets the Dropbox environment.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/selectdlpcriteria.md b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/selectdlpcriteria.md
index 73c8d1e390..99c3a92ee7 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/selectdlpcriteria.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/selectdlpcriteria.md
@@ -11,7 +11,7 @@ sensitive data. It is a wizard page for the Scan for Sensitive Content category.
-Select the checkbox next to each criteria to be included in the search for sensitive data. You can
+Select the checkbox next to each criteria to include in the search for sensitive data. You can
also use the **Select All** and **Clear All** buttons.
The table contains the following types of criteria:
@@ -19,7 +19,7 @@ The table contains the following types of criteria:
- System Criteria – Lists pre-defined criteria
- User Criteria – Lists user-defined criteria
-Use the **Edit** button to access the Criteria Editor where user-defined criteria can be created or
-customized. See the
+Use the **Edit** button to access the Criteria Editor, where you can create or customize
+user-defined criteria. See the
[Sensitive Data Criteria Editor](/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/overview.md) topic
for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/standardtables.md b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/standardtables.md
index 50a7d8d6e7..66b95e3ed8 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/standardtables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/standardtables.md
@@ -12,7 +12,7 @@ DropboxAccess Data Collector writes data to these tables regardless of the job e
## Dropbox Access Auditing Tables & Views
-These tables and their associated views are outlined below:
+The following table lists these tables and their associated views:
| Table | Details |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------- |
@@ -27,7 +27,7 @@ These tables and their associated views are outlined below:
| SA_Dropbox_Trustees | Contains information about any trustee, group, or team that has been assigned permissions |
Views are the recommended way for you to obtain the information gathered by the DropboxAccess Data
-Collector. They contain additional information for building queries easily. The following is an
+Collector. They contain additional information for building queries. The following is an
explanation of the corresponding views created for some of the tables generated by the DropboxAccess
Data Collector:
@@ -40,16 +40,16 @@ Data Collector:
## Dropbox Sensitive Data Discovery Auditing (SEEK) Tables & Views
-These tables and their associated views are outlined below:
+The following table lists these tables and their associated views:
| Table | Details |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------ |
-| SA_Dropbox_Criteria | Contains the sensitive data criteria which are selected for collection by the scan engine (data collector configuration) |
+| SA_Dropbox_Criteria | Contains the sensitive data criteria the scan engine selects for collection (data collector configuration) |
| SA_Dropbox_Matches | Contains rolled up aggregate counts of the sensitive data criteria matches found during the scan |
| SA_Dropbox_MatchHits | Contains the actual sensitive data discovered within files which matched selected criteria |
Views are the recommended way for you to obtain the information gathered by the DropboxAccess Data
-Collector. They contain additional information for building queries easily. The following is an
+Collector. They contain additional information for building queries. The following is an
explanation of the corresponding views created for some of the tables generated by the DropboxAccess
Data Collector:
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/entra/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/entra/overview.md
index bd9a768ef6..2a3ae5eb08 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/entra/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/entra/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 130
# Entra Data Collector
The Entra data collector collects Microsoft Entra roles information from the target Microsoft Entra
-tenant. This data collector is preconfigured in the .Entra ID Inventory solution.
+tenant. The .Entra ID Inventory solution includes this preconfigured data collector.
Both this data collector and the .Entra Inventory solution are available with all Access Analyzer
license options. See the
@@ -43,7 +43,7 @@ information.
## Query Configuration
-The Entra data collector is configured through the Entra Data Collector Wizard, which contains the
+You configure the Entra data collector through the Entra Data Collector Wizard, which contains the
following wizard pages:
- [Entra: Scan options](/docs/accessanalyzer/12.0/admin/datacollector/entra/options.md)
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/entra/results.md b/docs/accessanalyzer/12.0/admin/datacollector/entra/results.md
index 6136cd82e3..169a1572f3 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/entra/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/entra/results.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# Entra: Results
-The Results page is where the properties from Microsoft Entra ID to be gathered are selected.
+Use the Results page to select the properties to gather from Microsoft Entra ID.
-Properties can be selected individually or the **Select All** and **Clear All** buttons can be used.
-All selected properties are collected.
+Select properties individually, or use the **Select All** and **Clear All** buttons. The Entra data
+collector collects all selected properties.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/entra/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/entra/summary.md
index 6b1e47622c..3dc52bf830 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/entra/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/entra/summary.md
@@ -6,10 +6,9 @@ sidebar_position: 30
# Entra: Summary
-The Summary page is where configuration settings are summarized.
+The Summary page summarizes your configuration settings.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Entra Data Collector Wizard to ensure that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you didn't make changes, click **Cancel** to
+close the Entra Data Collector Wizard instead, so it doesn't save accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/eventlog.md b/docs/accessanalyzer/12.0/admin/datacollector/eventlog.md
index d6d0d1796a..a320f3bf19 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/eventlog.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/eventlog.md
@@ -27,7 +27,7 @@ Analyzer licenses.
## EventLog Query Configuration
-The EventLog Data Collector is configured through the Event Log Browser window.
+You configure the EventLog Data Collector through the Event Log Browser window.
@@ -39,8 +39,8 @@ In the Sample section, select from the following options:
- Host – Enter a sample host that contains a log with the type of events desired for the query.
Click **Connect** to generate a list of logs available for extraction.
- - Log name – Select a log from the drop-down list. Events from the selected log are populated in
- the table.
+ - Log name – Select a log from the dropdown list. Events from the selected log populate the
+ table.
- From file
@@ -51,7 +51,7 @@ In the Sample section, select from the following options:
File path box
:::note
- A preview displays automatically if the folder icons is used to navigate to the log.
+ A preview displays automatically if you use the folder icon to navigate to the log.
:::
@@ -62,11 +62,11 @@ In the Sample section, select from the following options:
In the Search Criteria section, add a search filter to the table by configuring the following
criteria:
-- Event Source – Select the event source from the drop-down list. Typically, select **Any Source**.
-- Even Type – Select the event type from the drop-down list. Typically, select **Any Type**.
+- Event Source – Select the event source from the dropdown list. Typically, select **Any Source**.
+- Even Type – Select the event type from the dropdown list. Typically, select **Any Type**.
- Event ID – Enter the event ID for the type of event to search
-Once the information above has been entered, click **Add** to add the configured event to the query.
+After you enter the preceding information, click **Add** to add the configured event to the query.
Add as many events as desired.
- Latest event only – Select this checkbox to only search the latest event
@@ -74,8 +74,8 @@ Add as many events as desired.
Click the **Add** button to add the search filters to the table. Click the **Remove** button to
remove search criteria from the filters.
-- Event Date/Time – Enter the last number of hours the event time must be in. A value of `0` can be
- used to specify any time.
+- Event Date/Time – Enter the last number of hours the event time must be in. A value of `0`
+ specifies any time.
- Retrieve oldest event – Select this checkbox to retrieve the oldest event
- Retrieve latest event – Select this checkbox to retrieve the latest event
@@ -83,24 +83,24 @@ Click **Apply Filter** to filter the list of sample events to the search criteri
**Options**
-In the Options section, select the desired processing options:
+In the Options section, select the processing options you want:
- Process offline logs only – Select this checkbox to process only offline logs
- Process offline logs if required – Select this checkbox to process offline logs if needed
-- Specify explicit path\mask for archives – Enabled if the **Process offline logs only** or
- **Process offline logs if required** checkboxes are selected. Specify the path and name of the
+- Specify explicit path\mask for archives – Available if you select the **Process offline logs
+ only** or **Process offline logs if required** checkbox. Specify the path and name of the
archive.
**Available Properties**
-In the Available Properties section, select which properties will be collected by the browser.
+In the Available Properties section, select which properties the browser collects.
-- Add Icon – Add properties from those available in the list to add the properties to the search
+- Add Icon – Add properties from the available list to the search
- - The Description properties provide the ability to extract the bracketed pieces of information
+ - The Description properties let you extract the bracketed pieces of information
found within the description and display each bracketed piece of information in its own column
- Remove Icon – Use to remove properties from the search
-Once all options have been configured, click **OK** to save changes and exit the browser. Click
+After you configure all options, click **OK** to save changes and exit the browser. Click
**Cancel** to exit without saving.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/category.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/category.md
index 99148d9179..539d0b622c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/category.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# EWSMailbox: Category
-The Category page identifies which type of EWSMailbox information is retrieved during the scan.
+The Category page identifies which type of EWSMailbox information the scan retrieves.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/criteria.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/criteria.md
index 7e2c3e87d7..192ad4378a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/criteria.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/criteria.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# EWSMailbox: Criteria
-The Select DLP criteria for this scan page is where to select the criteria to use for the sensitive
-data scan are selected. It is a wizard page for the Sensitive Data category.
+Use the Select DLP criteria for this scan page to select the criteria for the sensitive data scan.
+It is a wizard page for the Sensitive Data category.
@@ -20,8 +20,8 @@ The options on the Criteria page are:
sensitive data criteria to scan for
- Select All - Click **Select All** to enable all sensitive data criteria for scanning
- Clear All - Click **Clear All** to remove all selections from the table
-- Select the checkboxes next to the sensitive data criteria options to enable it to be scanned for
- during job execution
+- Select the checkboxes next to the sensitive data criteria options you want to scan during job
+ execution
The table contains the following types of criteria:
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/filter.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/filter.md
index 426ba14c79..d666852cb5 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/filter.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/filter.md
@@ -15,13 +15,13 @@ the categories of:
-All folders and attachments are scanned by default. Scope the scan for specific folders and
+By default, the scan includes all folders and attachments. Scope the scan for specific folders and
attachments:
-- Include Folders – Type the folder paths to filter the scan to specific mailbox folders
-- Include Attachments – Type the attachment file names to filter to specific attachments
-- Exclude Folders – Type the folder paths to exclude mailbox folders from the scan
-- Exclude Attachments – Type the file names for the attachments to exclude attachments from the scan
+- Include Folders – Enter the folder paths to filter the scan to specific mailbox folders
+- Include Attachments – Enter the attachment file names to filter to specific attachments
+- Exclude Folders – Enter the folder paths to exclude mailbox folders from the scan
+- Exclude Attachments – Enter the file names for the attachments to exclude attachments from the scan
Use `*` and `?` for matching wildcard and single characters.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/options.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/options.md
index b62c9147d5..fdd6f9b897 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/options.md
@@ -27,7 +27,7 @@ Select the checkboxes to apply any desired scan options:
- Scan archives – Scans for archived mailbox data
- Scan recoverable items – Scans for recoverable items
-- Authentication – Select an Authentication type from the drop down:
+- Authentication – Select an Authentication type from the dropdown:
- Negotiate
- Basic
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/overview.md
index 895eb4a482..31b1db01f2 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 150
# EWSMailbox Data Collector
The EWSMailbox Data Collector provides configuration options to scan mailbox contents, permissions,
-and sensitive data, and is preconfigured within the Exchange Solution. Both this data collector and
-the solution are available with a special Access Analyzer license. See the
+and sensitive data. The Exchange Solution includes this preconfigured data collector. Both this
+data collector and the solution are available with a special Access Analyzer license. See the
[Exchange Solution](/docs/accessanalyzer/12.0/solutions/exchange/overview.md) topic for additional information.
**Protocols**
@@ -31,13 +31,13 @@ the solution are available with a special Access Analyzer license. See the
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if you configure the job to
+scan 8 hosts at a time, it requires an extra 16 GB of RAM (8 x 2 = 16).
## EWSMailbox Query Configuration
-The EWSMailbox Data Collector is configured through the Exchange Mailbox Data Collector Wizard,
+You configure the EWSMailbox Data Collector through the Exchange Mailbox Data Collector Wizard,
which contains the following wizard pages:
:::note
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/results.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/results.md
index 7323da3876..5a1c12bf66 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/results.md
@@ -6,15 +6,15 @@ sidebar_position: 90
# EWSMailbox: Results
-Use the Results page to select which properties are gathered out of those available for the
-category. It is a wizard page for all of the categories.
+Use the Results page to select which properties to gather from those available for the category.
+It is a wizard page for all of the categories.
Select criteria using the following options:
-- Select the checkbox of any property to include it in the summary. All selected properties will be
- gathered.
+- Select the checkbox of any property to include it in the summary. The data collector gathers all
+ selected properties.
:::note
Available properties vary based on the category selected.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/scope.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/scope.md
index 7724a84759..a64cd456ca 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/scope.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/scope.md
@@ -6,12 +6,12 @@ sidebar_position: 30
# EWSMailbox: Scope
-The Mailbox scope settings page is used to select which mailboxes are searched by the scan. It is a
-wizard page for all categories.
+Use the Mailbox scope settings page to select which mailboxes the scan searches. It is a wizard
+page for all categories.
-Select an option to specify which mailboxes are searched:
+Select an option to specify which mailboxes to search:
- All mailboxes – Search all mailboxes
- Select mailboxes from list – Search only specific selected mailboxes. This option enables the
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/scopeselect.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/scopeselect.md
index 2c2bfa0ec7..66f4d41a6f 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/scopeselect.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/scopeselect.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# EWSMailbox: Scope Select
-The Scope select page is used to select specific mailboxes to scan. It is a wizard page for all
-categories when the **Select mailboxes from list** option is selected on the
+Use the Scope select page to select specific mailboxes to scan. This page is part of the wizard
+for all categories when you select the **Select mailboxes from list** option on the
[EWSMailbox: Scope](/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/scope.md) page.
@@ -15,8 +15,8 @@ categories when the **Select mailboxes from list** option is selected on the
Use the following options to scope the scan to specific mailboxes:
- Retrieve – Loads the list of mailboxes available for scanning in the Available box
-- Add – Select mailboxes from the Available list and click to add them to the Selected box to be
- scanned
+- Add – Select mailboxes from the Available list and click to add them to the Selected box for
+ scanning
- Select All – Selects all mailboxes in the list
- Deselect All – Deselects all selected mailboxes from the list
- Remove – Select mailboxes from the Selected box and click to remove them from the list
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/sddoptions.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/sddoptions.md
index bcb47b8fa0..a94239d5ca 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/sddoptions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/sddoptions.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# EWSMailbox: SDD Options
-The Sensitive data scan options page is where options to be used for discovering sensitive data are
-configured. It is a wizard page for the Sensitive Data category.
+Use the Sensitive data scan options page to configure options for discovering sensitive data. It
+is a wizard page for the Sensitive Data category.
@@ -18,6 +18,6 @@ Select the applicable Sensitive data scan options:
for discovered sensitive data
:::note
- This option is only available if **Store discovered sensitive data** is selected.
+ This option is only available if you select **Store discovered sensitive data**.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/bodyoptions.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/bodyoptions.md
index a7bd77fafd..fddac5843e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/bodyoptions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/bodyoptions.md
@@ -10,7 +10,7 @@ Use the BodyOptions page to select the size unit of messages.
-Select the desired message size unit:
+Select the message size unit you want:
- KB
- MB
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/filterwizard.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/filterwizard.md
index 0810de8304..83657b512a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/filterwizard.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/filterwizard.md
@@ -22,7 +22,7 @@ Customize folder search conditions using the following options:
of the template conditions
:::note
- The values present depends on the selections made in the Select conditions box.
+ The available values depend on the selections in the Select conditions box.
:::
@@ -31,7 +31,7 @@ Customize folder search conditions using the following options:
[MessageClasses Window ](#messageclasses-window) topic for additional information.
- Click **over 90 Day ago** to open the Date Range Selection Window. See the
[Date Range Selection Window](#date-range-selection-window) topic for additional information.
- - Click **has attachment(s)** to convert the condition to **has no attachment(s)** and vice
+ - Click **has attachments** to convert the condition to **has no attachments** and vice
versa
## MessageClasses Window
@@ -45,7 +45,7 @@ Filter page.
Determine MessageClass-related criteria using the following options:
- To add a class, click **Add**
-- Enter the desired Message Class in the corresponding textbox
+- Enter the Message Class in the corresponding textbox
- Click **Exact Match** to reveal a dropdown menu of other search criteria under Matching Strategy
and select the preferred option:
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/folderconditions.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/folderconditions.md
index 871f4c71eb..e86c9ab460 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/folderconditions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/folderconditions.md
@@ -21,7 +21,7 @@ Customize folder search conditions using the following options:
of the template conditions
:::note
- The values present depends on the selections made in the Select conditions box.
+ The available values depend on the selections in the Select conditions box.
:::
@@ -48,11 +48,11 @@ Use the Search Terms window to determine terms for the search. The Search Terms
Determine terms for the search using the following options:
-- Type the desired term into the upper text box and click **Add** to add the term to the lower text
+- Enter the term into the upper text box and click **Add** to add the term to the lower text
box, which adds the term to the search
- Select a term in the lower text box, and click **Remove** to remove the term from the search
- Click **Clear** to clear all terms from the lower box
-- Select the desired qualifier option:
+- Select the qualifier option you want:
- Contains ALL of the following search terms (And) – Search only returns results containing all
of the search terms
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/messageconditions.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/messageconditions.md
index 16d0068b81..2727f39bcb 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/messageconditions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/searchfilter/messageconditions.md
@@ -29,7 +29,7 @@ Customize message search filter conditions using the following options:
- Select conditions – To add it to the search, select any of the following conditions:
:::note
- The conditions that are available in the Select Conditions box depends on the selected
+ The available conditions in the Select Conditions box depend on the selected
**Message category**.
:::
@@ -63,7 +63,7 @@ Customize message search filter conditions using the following options:
- Click **search terms** to open the Search Terms Window. See the
[Search Terms Window (Message Conditions)](#search-terms-window-message-conditions) topic for
additional information.
- - Click **has attachment(s)** to convert the condition to **has no attachment(s)** and vice
+ - Click **has attachments** to convert the condition to **has no attachments** and vice
versa
## MessageClasses Window (Message Conditions)
@@ -76,7 +76,7 @@ opens if **specific** is clicked in the Edit Conditions box on the Message Condi
Determine MessageClass-related criteria using the following options:
- To add a class, click **Add**
-- Enter the desired Message Class in the corresponding textbox
+- Enter the Message Class in the corresponding textbox
- Click **Exact Match** to reveal a dropdown menu of other search criteria under Matching Strategy
and select the preferred option:
@@ -113,11 +113,11 @@ Use the Search Terms window to determine terms for the search. The Search Terms
Determine terms for the search using the following options:
-- Type the desired term into the upper text box and click **Add** to add the term to the lower text
+- Enter the term into the upper text box and click **Add** to add the term to the lower text
box, which adds the term to the search
- Select a term in the lower text box, and click **Remove** to remove the term from the search
- Click **Clear** to clear all terms from the lower box
-- Select the desired qualifier option:
+- Select the qualifier option you want:
- Contains ALL of the following search terms (And) – Search only returns results containing all
of the search terms
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/summary.md
index 312154109e..ec551741b4 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query. It wizard page for
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the EWS Mailbox Data Collector Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you didn't make changes, click **Cancel** to close
+the EWS Mailbox Data Collector Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/critieria.md b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/critieria.md
index 9d6df7d0d6..be70ad078a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/critieria.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/critieria.md
@@ -20,8 +20,8 @@ The options on the Criteria page are:
sensitive data criteria to scan for
- Select All - Click **Select All** to enable all sensitive data criteria for scanning
- Clear All - Click **Clear All** to remove all selections from the table
-- Select the checkboxes next to the sensitive data criteria options to enable it to be scanned for
- during job execution
+- Select the checkboxes next to the sensitive data criteria options you want to scan for during job
+ execution
The table contains the following types of criteria:
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/filter.md b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/filter.md
index 6cb99fbc05..14a7d09f54 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/filter.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/filter.md
@@ -15,13 +15,13 @@ the categories of:
-All folders and attachments are scanned by default. Scope the scan for specific folders and
+By default, the scan includes all folders and attachments. Scope the scan for specific folders and
attachments:
-- Include Folders – Type the folder paths to filter the scan to specific mailbox folders
-- Include Attachments – Type the attachment file names to filter to specific attachments
-- Exclude Folders – Type the folder paths to exclude mailbox folders from the scan
-- Exclude Attachments – Type the file names for the attachments to exclude attachments from the scan
+- Include Folders – Enter the folder paths to filter the scan to specific mailbox folders
+- Include Attachments – Enter the attachment file names to filter to specific attachments
+- Exclude Folders – Enter the folder paths to exclude mailbox folders from the scan
+- Exclude Attachments – Enter the file names for the attachments to exclude attachments from the scan
Use `*` and `?` for matching wildcard and single characters.
@@ -30,19 +30,19 @@ Use `*` and `?` for matching wildcard and single characters.
- Limit attachments size to [numerical value] – Select to limit attachment size and define a
threshold for maximum size of an attachment returned in the scan. The default value is 20000 KB.
-Public folders can also be included or excluded from the scan by retrieving a list of public folders
-and selecting the desired folders.
+You can also include or exclude public folders from the scan by retrieving a list of public folders
+and selecting the folders you want.
-Follow the steps to filter the scan by selecting public folders from a list.
+To filter the scan by selecting public folders from a list:
**Step 1 –** Click the **+** button to the right of the Include Folders or Exclude Folders box to
open the Choose folders to include or Choose folders to exclude window.
-**Step 2 –** Click **Retrieve** to load the list of public folders that can be selected.
+**Step 2 –** Click **Retrieve** to load the list of available public folders.
-**Step 3 –** Select the desired public folders and click **Add** to add the folders to the Include
+**Step 3 –** Select the public folders you want and click **Add** to add the folders to the Include
Folders or Exclude Folders list.
-After the configuration changes are saved, scans are filtered by the selected public folders.
+After you save the configuration changes, the scan uses the selected public folders as filters.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/options.md b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/options.md
index 6528ee4dcf..72666d9f56 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/options.md
@@ -18,11 +18,11 @@ Select any desired scan options:
:::info
Use this option when scanning multiple Exchange environments with a single
- job and the Connection Profile has multiple credentials in it.
+ job and the Connection Profile has multiple credentials.
:::
-- Authentication – Select an Authentication type from the drop down:
+- Authentication – Select an Authentication type from the dropdown:
- Negotiate
- Basic
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/overview.md
index e84363696b..a89659e016 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/overview.md
@@ -31,9 +31,9 @@ collector and the solution are available with a special Access Analyzer license.
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if you configure the job to scan
+8 hosts at a time, the job requires an extra 16 GB of RAM (8x2=16).
## EWSPublicFolder Query Configuration
@@ -41,7 +41,7 @@ The EWSPublicFolder Data Collector is configured through the Exchange Public Fol
Wizard. The wizard contains the following pages:
:::note
-The Category selected may alter the subsequent steps displayed by the wizard.
+The category you select may alter the steps the wizard displays next.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/results.md b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/results.md
index 1175ee1ce1..12eb41e2ee 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/results.md
@@ -6,15 +6,15 @@ sidebar_position: 70
# EWSPublicFolder: Results
-The Results page is used to select which properties will be gathered out of those available for the
-category. It is a wizard page for all of the categories.
+Use the Results page to select which properties to gather from those available for the category. It
+is a wizard page for all of the categories.
Select criteria using the following options:
-- Select the checkbox of any property to include it in the summary. All selected properties will be
- gathered.
+- Select the checkbox of any property to include it in the summary. The scan gathers all selected
+ properties.
:::note
Available properties vary based on the category selected.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/sddoptions.md b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/sddoptions.md
index b582e8bcfd..397fb95dee 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/sddoptions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/sddoptions.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# EWSPublicFolder: SDD Options
-Use the Sensitive data scan options page to configure options to for discovering sensitive data. It
-is a wizard page for the Sensitive Data category.
+Use the Sensitive data scan options page to configure sensitive data discovery options. It is a
+wizard page for the Sensitive Data category.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/bodyoptions.md b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/bodyoptions.md
index 053f6655d5..1d114d9017 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/bodyoptions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/bodyoptions.md
@@ -6,11 +6,11 @@ sidebar_position: 40
# EWSPublicFolder FW: BodyOptions
-The BodyOptions page is where the size of messages is selected.
+Use the BodyOptions page to select the message size unit.
-Select the desired message size unit:
+Select the message size unit:
- KB
- MB
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/filterwizard.md b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/filterwizard.md
index 894b76e3d2..c44acbd1de 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/filterwizard.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/filterwizard.md
@@ -22,7 +22,7 @@ Customize folder search conditions using the following options:
of the template conditions
:::note
- The values present depends on the selections made in the Select conditions box.
+ The available values depend on the selections in the Select conditions box.
:::
@@ -31,7 +31,7 @@ Customize folder search conditions using the following options:
[MessageClasses Window](#messageclasses-window) topic for additional information.
- Click **over 90 Day ago** to open the Date Range Selection Window. See the
[Date Range Selection Window](#date-range-selection-window)
- - Click **has attachment(s)** to convert the condition to **has no attachment(s)** and vice
+ - Click **has attachments** to convert the condition to **has no attachments** and vice
versa
## MessageClasses Window
@@ -45,7 +45,7 @@ Filter page.
Determine MessageClass-related criteria using the following options:
- To add a class, click **Add**
-- Enter the desired Message Class in the corresponding textbox
+- Enter the Message Class in the corresponding textbox
- Click **Exact Match** to reveal a dropdown menu of other search criteria under Matching Strategy
and select the preferred option:
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/folderconditions.md b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/folderconditions.md
index e449849ce0..03ee77d16e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/folderconditions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/folderconditions.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# EWSPublicFolder FW: Folder Conditions
-The Folder Conditions page is where folder-related filter criteria can be applied to the search.
+Use the Folder Conditions page to apply folder-related filter criteria to the search.
@@ -21,7 +21,7 @@ Customize folder search conditions using the following options:
of the template conditions
:::note
- The values present depends on the selections made in the Select conditions box.
+ The available values depend on the selections in the Select conditions box.
:::
@@ -48,11 +48,11 @@ Use the Search Terms window to determine terms for the search. The Search Terms
Determine terms for the search using the following options:
-- Type the desired term into the upper text box and click **Add** to add the term to the lower text
+- Enter the term into the upper text box and click **Add** to add the term to the lower text
box, which adds the term to the search
- Select a term in the lower text box, and click **Remove** to remove the term from the search
- Click **Clear** to clear all terms from the lower box
-- Select the desired qualifier option:
+- Select a qualifier option:
- Contains ALL of the following search terms (And) – Search only returns results containing all
of the search terms
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/messageconditions.md b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/messageconditions.md
index 3311ddb860..b7bb83f926 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/messageconditions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/searchfilter/messageconditions.md
@@ -29,7 +29,7 @@ Customize message search filter conditions using the following options:
- Select conditions – To add it to the search, select any of the following conditions:
:::note
- The conditions that are available in the Select Conditions box depends on the selected
+ The available conditions in the Select Conditions box depend on the selected
**Message category**.
:::
@@ -51,7 +51,7 @@ Customize message search filter conditions using the following options:
of the template conditions
:::note
- The values present depends on the selections made in the Select conditions box.
+ The available values depend on the selections in the Select conditions box.
:::
@@ -61,7 +61,7 @@ Customize message search filter conditions using the following options:
[Date Range Selection Window](#date-range-selection-window) topic for additional information.
- Click **search terms** to open the Search Terms Window. See the
[Search Terms Window](#search-terms-window) topic for additional information.
- - Click **has attachment(s)** to convert the condition to **has no attachment(s)** and vice
+ - Click **has attachments** to convert the condition to **has no attachments** and vice
versa
## MessageClasses Window
@@ -74,7 +74,7 @@ opens if **specific** is clicked in the Edit Conditions box on the Message Condi
Determine MessageClass-related criteria using the following options:
- To add a class, click **Add**
-- Enter the desired Message Class in the corresponding textbox
+- Enter the Message Class in the corresponding textbox
- Click **Exact Match** to reveal a dropdown menu of other search criteria under Matching Strategy
and select the preferred option:
@@ -111,11 +111,11 @@ Use the Search Terms window to determine terms for the search. The Search Terms
Determine terms for the search using the following options:
-- Type the desired term into the upper text box and click **Add** to add the term to the lower text
+- Enter the term into the upper text box and click **Add** to add the term to the lower text
box, which adds the term to the search
- Select a term in the lower text box, and click **Remove** to remove the term from the search
- Click **Clear** to clear all terms from the lower box
-- Select the desired qualifier option:
+- Select a qualifier option:
- Contains ALL of the following search terms (And) – Search only returns results containing all
of the search terms
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/summary.md
index cb142c9d42..1bff0b6a9c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/summary.md
@@ -10,6 +10,6 @@ The Summary page displays a summary of the configured query. It wizard page for
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the EWS Public Folder Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the EWS Public Folder Data Collector Wizard. This is a best practice to avoid saving accidental
+clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/category.md b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/category.md
index 5d34190909..0ecf589928 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/category.md
@@ -28,7 +28,7 @@ focus:
- Recipient Update Services
- Message Delivery – System-wide message settings
- Instant Messaging – Instant messaging settings
- - Exchange Mailbox Store Logons – The users currently logged on to Microsoft Exchange 2007 and
+ - Exchange Mailbox Store Logons – The users logged on to Microsoft Exchange 2007 and
2010
- Exchange 2007/2010 Hub Transport Configuration
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/mapisettings.md b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/mapisettings.md
index 656c38cea8..5f15806097 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/mapisettings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/mapisettings.md
@@ -6,11 +6,11 @@ sidebar_position: 40
# Exchange2K: MAPI Settings
-The MAPI Settings page is used to enter configurations to connect to target Exchange servers. By
-default, Access Analyzer connects to Exchange using System Attendant. For Exchange 2010 and 2013, a
-mailbox and a client access server need to be entered in order to make a MAPI connection. These
-settings only need to be configured if not configured at the Global Settings level. It is a wizard
-page for the categories of:
+Use the MAPI Settings page to enter configurations to connect to target Exchange servers. By
+default, Access Analyzer connects to Exchange using System Attendant. For Exchange 2010 and 2013,
+enter a mailbox and a client access server to make a MAPI connection. Configure these settings only
+if you haven't configured them at the Global Settings level. It is a wizard page for the categories
+of:
- Exchange Organization > Users
- Mailbox Stores
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/options.md b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/options.md
index 7d5826b45b..a46d6101ad 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/options.md
@@ -26,7 +26,7 @@ Configure the Options step using the following options:
- Concatenated – Return the data in a continuous string without gaps
- - Delimiter – Enter the desired delimiter to be used between values
+ - Delimiter – Enter the delimiter to use between values
- First-value only – Only display the first value
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/overview.md
index fbedbdf3b1..4c7026620c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/overview.md
@@ -7,12 +7,12 @@ sidebar_position: 170
# Exchange2K Data Collector
The Exchange2K Data Collector extracts configuration details from Exchange organizations for
-versions 2003 and later. This is a MAPI-based data collector which requires the **Settings** >
-**Exchange** node to be enabled and configured. See the [Exchange](/docs/accessanalyzer/12.0/admin/settings/exchange.md) topic
+versions 2003 and later. This is a MAPI-based data collector which requires you to enable and
+configure the **Settings** > **Exchange** node. See the [Exchange](/docs/accessanalyzer/12.0/admin/settings/exchange.md) topic
for additional information.
-The Exchange2K Data Collector has been preconfigured within the Exchange Solution. Both this data
-collector and the solution are available with a special Access Analyzer license. See the
+Access Analyzer preconfigures the Exchange2K Data Collector within the Exchange Solution. Both this
+data collector and the solution are available with a special Access Analyzer license. See the
[Exchange Solution](/docs/accessanalyzer/12.0/solutions/exchange/overview.md) topic for additional information.
**Protocols**
@@ -38,7 +38,7 @@ collector and the solution are available with a special Access Analyzer license.
## Exchange2K Query Configuration
-The Exchange2K Data Collector is configured through the Exchange 2K+ Data Collector Wizard, which
+Configure the Exchange2K Data Collector through the Exchange 2K+ Data Collector Wizard, which
contains the following wizard pages:
- Welcome
@@ -51,5 +51,5 @@ contains the following wizard pages:
-The Welcome page can be hidden by selecting the **Do not show this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't show this page the next time** checkbox when the
+wizard is open and configuration settings are saved.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/results.md b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/results.md
index 39dbffcdd4..e39546b265 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/results.md
@@ -6,12 +6,12 @@ sidebar_position: 30
# Exchange2K: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for
+Use the Results page to select the properties to gather. It is a wizard page for
all.
-Properties can be selected individually or the **Check All**, **Uncheck All**, or **Reset Defaults**
-buttons can be used. All Selected properties will be gathered. Click **Expand All** to expand all
+Select properties individually, or use the **Check All**, **Uncheck All**, or **Reset Defaults**
+buttons. Access Analyzer gathers all selected properties. Click **Expand All** to expand all
properties, or **Collapse All** to collapse all properties. Available properties vary based on the
category selected.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/scope.md b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/scope.md
index f5b3529185..b9982a96f3 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/scope.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/scope.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Exchange2K: Scope
-The Scope page is used to define where to search. It is a wizard page for the categories of:
+Use the Scope page to define where to search. It is a wizard page for the categories of:
- Exchange Organization > Users
- Exchange Organization > Groups
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/summary.md
index 4f1206c542..260070412a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchange2k/summary.md
@@ -11,6 +11,5 @@ categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Exchange 2K+ Data Collector Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Exchange 2K+ Data Collector Wizard. This is a best practice to avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/options.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/options.md
index 1ea28ce66c..6d6b5154d7 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/options.md
@@ -16,7 +16,7 @@ the following categories:
-The following options can be configured:
+Configure the following options:
:::note
Options available vary based upon the category selected.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/overview.md
index 6a74d6033a..1c12f8b6f2 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/overview.md
@@ -8,7 +8,7 @@ sidebar_position: 180
The ExchangeMailbox Data Collector extracts configuration details from the Exchange Store to provide
statistical, content, permission, and sensitive data reporting on mailboxes. This is a MAPI-based
-data collector which requires the **Settings** > **Exchange** node to be enabled and configured. See
+data collector which requires you to enable and configure the **Settings** > **Exchange** node. See
the [Exchange](/docs/accessanalyzer/12.0/admin/settings/exchange.md) topic for additional information.
The ExchangeMailbox Data Collector is available with a special Access Analyzer license. See the
@@ -32,13 +32,13 @@ The ExchangeMailbox Data Collector is available with a special Access Analyzer l
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if you configure the job to scan
+8 hosts at a time, the job requires an extra 16 GB of RAM (8x2=16).
## ExchangeMailbox Query Configuration
-The ExchangeMailbox Data Collector is configured through the Exchange Mailbox Data Collector Wizard,
+Configure the ExchangeMailbox Data Collector through the Exchange Mailbox Data Collector Wizard,
which contains the following wizard pages:
- Welcome
@@ -60,12 +60,12 @@ Select one of the following options for the connection setting:
- Use Global setting – The configured Global Setting is displayed next to this checkbox. Select the
checkbox to use the global setting.
-- System Attendant (2003 & 2007) – Enabled when the **Use Global Setting** checkbox is not selected.
+- System Attendant (2003 & 2007) – Enabled when the **Use Global Setting** checkbox isn't selected.
Select this option to use System Attendant (2003 & 2007) for the connection.
- Use the mailbox associated with the Windows account that Access Analyzer is run with – Enabled
- when the **Use Global Setting** checkbox is not selected. Select this option to use the mailbox
+ when the **Use Global Setting** checkbox isn't selected. Select this option to use the mailbox
associated with the Windows account that Access Analyzer is run with for the connection.
-- Exchange Mailbox (2010 and newer) – Enabled when the **Use Global Setting** checkbox is not
+- Exchange Mailbox (2010 and newer) – Enabled when the **Use Global Setting** checkbox isn't
selected. Select this option to use an Exchange Mailbox (2010 and newer) for the connection. The
Client Access Server must be entered unless specified in the Global Settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/properties.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/properties.md
index 8af6c3c019..8c36019d8e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/properties.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/properties.md
@@ -6,13 +6,13 @@ sidebar_position: 30
# ExchangeMailbox: Properties
-The Properties page is where properties that will be gathered are selected. The available properties
+Use the Properties page to select the properties to gather. The available properties
depend on the category selected. It is a wizard page for all of the categories.
-Properties can be selected individually or you can use the Select All, Clear All, and Reset All
-buttons. All selected properties will be gathered. Click **Message Classes** to open the Message
+Select properties individually, or use the **Select All**, **Clear All**, and **Reset All**
+buttons. Access Analyzer gathers all selected properties. Click **Message Classes** to open the Message
classes filters window.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/scope.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/scope.md
index 0c1e9ac973..f3350c3a8c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/scope.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/scope.md
@@ -6,13 +6,13 @@ sidebar_position: 20
# ExchangeMailbox: Scope
-The Scope page is used to define which mailboxes are to be queried. It is a wizard page for all of
+Use the Scope page to define which mailboxes to query. It is a wizard page for all of
the categories.
-At the top, configure the mailboxes to be queried. The selected option changes how the mailboxes are
-identified for scoping.
+At the top, configure which mailboxes to query. The selected option determines how Access Analyzer
+identifies mailboxes for scoping.
- All mailboxes – Searches all mailboxes
- Selected mailboxes from server – Retrieves all mailboxes in the Exchange organization, making them
@@ -23,7 +23,7 @@ identified for scoping.
- Retrieve – Enter the server and select Retrieve to display the list of mailboxes on that
server
- - Add – Select the desired mailboxes to add to the query. The added mailboxes display in the
+ - Add – Select the mailboxes to add to the query. The added mailboxes display in the
**Selected mailboxes** list.
- Remove – Deletes selected mailboxes from the list
- Select All – Click the Select All icon to select all mailboxes in the list
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/sddcriteria.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/sddcriteria.md
index 88607ab0b8..64ab7a2997 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/sddcriteria.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/sddcriteria.md
@@ -6,13 +6,13 @@ sidebar_position: 40
# ExchangeMailbox: SDD Criteria
-The SDD Criteria page is where criteria to be used for discovering sensitive data are configured. It
+Use the SDD Criteria page to configure the criteria for discovering sensitive data. It
is a wizard page for the Mailbox sensitive data discovery category.
-Select the checkbox for the criteria to be used to search for sensitive data. Criteria can also be
-selected using the **Select All** and **Select None** buttons.
+Select the checkbox for the criteria to use to search for sensitive data. You can also select
+criteria using the **Select All** and **Select None** buttons.
The table contains the following types of criteria:
@@ -24,8 +24,8 @@ The table contains the following types of criteria:
for additional information.
- Store discovered sensitive data – Stores the potentially sensitive data that matches the selected
criteria in the Access Analyzer database. Select this checkbox to store a copy of the criteria
- match data. This copy can be used to check for false positives, data that matches the selected
- criteria but is not actually sensitive.
+ match data. Use this copy to check for false positives, data that matches the selected
+ criteria but isn't actually sensitive.
- Limit stored matches per criteria to [number] – Identifies the number of potentially sensitive
data matches that are copied to the database. The default is 5 matches. This option is only
available if the **Store discovered sensitive data** option is selected.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/summary.md
index 7fce091d37..670f438dfd 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemailbox/summary.md
@@ -10,6 +10,6 @@ The Summary page displays a summary of the configured query. It wizard page for
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Exchange Mailbox Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Exchange Mailbox Data Collector Wizard. This is a best practice to avoid saving accidental
+clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/category.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/category.md
index 8ff3538ed8..ab7cb5ce8b 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/category.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# ExchangeMetrics: Category
-The Category page is used to identify the type of Exchange Metrics information to retrieve.
+Use the Category page to identify the type of Exchange Metrics information to retrieve.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/collectmode.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/collectmode.md
index 814a053cc3..8bff99cd4a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/collectmode.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/collectmode.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# ExchangeMetrics: Collect Mode
-The Collect Mode page is where to set the collection mode. It is a wizard page for the categories
+Use the Collect Mode page to set the collection mode. It is a wizard page for the categories
of:
- Server Volume
@@ -24,10 +24,10 @@ of:
-There are two types of collection modes:
+Two types of collection modes are available:
- Query Summary Data Only – In this mode, the applet gathers only existing summary data and returns
- it to the Access Analyzer Console. In order to process Exchange tracking log files, another
+ it to the Access Analyzer Console. to process Exchange tracking log files, another
instance of the applet must be configured.
- Process Exchange Tracking Logs and Query Summary Data – In this mode, the applet processes missing
summary data and returns it to the Access Analyzer Console. This mode includes an additional
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/messageactivityfilter.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/messageactivityfilter.md
index 366826697f..ce24f9ee83 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/messageactivityfilter.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/messageactivityfilter.md
@@ -7,8 +7,8 @@ sidebar_position: 80
# ExchangeMetrics: Message Activity Filter
The Message Activity Filter page configures which domains the data collector should return mail flow
-from specific senders and to specific recipients. For example, if `@netwrix.com` is entered in the
-Senders list and `@netwrix.com` in the Recipients list, message activity will be returned only for
+from specific senders and to specific recipients. For example, if you enter `@netwrix.com` in the
+Senders list and `@netwrix.com` in the Recipients list, the filter returns message activity only for
mail sent to and received from an `@netwrix.com` address. It is a wizard page for the categories of:
- User’s Message Activity
@@ -18,9 +18,8 @@ mail sent to and received from an `@netwrix.com` address. It is a wizard page fo
Configure the Message Activity Filter using the following options:
-- Add – To add a filter to the desired category, click **Add** in the desired category to add an
- entry to that category
-- Select **Exact Match** in the added filter to reveal a drop-down list with the following condition
+- Add – To add a filter to a category, click **Add** in that category to add an entry to it
+- Select **Exact Match** in the added filter to reveal a dropdown list with the following condition
options:
- Exact matches
@@ -30,7 +29,7 @@ Configure the Message Activity Filter using the following options:
- Kind – Select **(Custom…)** to open the Custom Filter menu. The Custom Filter menu provides
options to create and configure other filters.
-- Value – Type the filter to be applied
+- Value – Enter the filter to apply
-The columns in the entry tables can be sorted and or filtered, using the same sorting and filtering
-methods of Access Analyzer data grids. The **Remove** option will delete a selected filter.
+You can sort and filter the columns in the entry tables using the same methods as Access Analyzer
+data grids. The **Remove** option will delete a selected filter.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/messagesizes.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/messagesizes.md
index 2b634d0a75..5d0f2c4b40 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/messagesizes.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/messagesizes.md
@@ -6,14 +6,14 @@ sidebar_position: 60
# ExchangeMetrics: Message Sizes
-The Message Sizes page is used to configure message size frames for which to return summary metrics
+Use the Message Sizes page to configure message size frames for which to return summary metrics
by server. It is a wizard page for the category of:
- Message Size Statistics Custom.
-Configure the desired message size frames using the following options:
+Configure the message size frames using the following options:
- Frame name – Name the configured message size parameters. Can either be entered manually or a
default will populate when query limits are set.
@@ -27,6 +27,6 @@ For example, a **Start** value of **1** and an **End** value of **2** returns me
value of **5** with the **Infinite** checkbox selected retrieves all messages which are 5
megabytes or larger.
-Once the frame is configured, click **Add**. The configured message size frame will appear in the
-list. Multiple frames can be configured. Select a frame and click **Replace** to modify an existing
+After you configure the frame, click **Add**. The configured message size frame will appear in the
+list. You can configure multiple frames. Select a frame and click **Replace** to modify an existing
frame. Use **Remove** to delete an existing frame.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/options.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/options.md
index aa25e70e56..726f42f26c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/options.md
@@ -43,7 +43,7 @@ Available options vary depending on Category selected.
- Applet Logging
- Enable Logging – Enables the applet to log
- - Applet log level – Select the desired log level using the dropdown list:
+ - Applet log level – Select the log level using the dropdown list:
- None
- Debug
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/overview.md
index 50cdf07ec4..8568edf7f3 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/overview.md
@@ -29,7 +29,7 @@ data collector and the solution are available with a special Access Analyzer lic
**Permissions**
-- Member of the local Administrator group on the targeted Exchange server(s)
+- Member of the local Administrator group on the targeted Exchange servers
See the [Exchange Mail-Flow Permissions](/docs/accessanalyzer/12.0/requirements/exchange/support/mailflow.md) topic
for additional information.
@@ -57,5 +57,5 @@ which contains the following wizard pages:
-The Welcome page can be hidden by checking the **Do not display this page the next time** box when
+To hide the Welcome page, check the **Don't display this page the next time** box when
the wizard is open and configuration settings are saved.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/results.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/results.md
index 96c1759133..5746f2799e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/results.md
@@ -6,11 +6,10 @@ sidebar_position: 30
# ExchangeMetrics: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for all
+The Results page is where you select the properties to gather. It is a wizard page for all
of the categories.
-Properties can be selected individually or the **Check All**, **Uncheck All**, or **Reset Defaults**
-buttons can be used. Click **Expand All** to expand all property categories. All selected properties
-will be gathered. Available properties vary based on the category selected.
+You can select properties individually, or use the **Check All**, **Uncheck All**, or **Reset Defaults**
+buttons. Click **Expand All** to expand all property categories. The data collector gathers all selected properties. Available properties vary based on the category selected.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/scope.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/scope.md
index 23eefa02f6..ca3312f919 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/scope.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/scope.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# ExchangeMetrics: Scope
-The Scope page is used to define where to search. It is a wizard page for the categories of:
+Use the Scope page to define where to search. It is a wizard page for the categories of:
- Server Volume
- Internal Traffic Summary
@@ -26,8 +26,8 @@ The Scope page is used to define where to search. It is a wizard page for the ca
Define the scope of the query using the following options:
-- Return data for section – Select the time period for which data will be collected. GMT time is
- used by Exchange Metrics to calculate the result.
+- Return data for section – Select the time period for which to collect data. Exchange Metrics
+ uses GMT time to calculate the result.
- Today
- Yesterday
@@ -37,11 +37,11 @@ Define the scope of the query using the following options:
- Last Month
- Last [number] days
- Within time frame:
- - From [calendar date] to [calendar date] – Use the drop-down arrows to select calendar dates.
+ - From [calendar date] to [calendar date] – Use the dropdown arrows to select calendar dates.
- Return results section – Select the table design for the collected data
- - One row for – Use the drop-down list to select one of the following options:
+ - One row for – Use the dropdown list to select one of the following options:
- All period
- Day
@@ -49,4 +49,4 @@ Define the scope of the query using the following options:
- Month
- Add summary values as last row – Select this checkbox to add summary values as the last row.
- This option is enabled when **Day**, **Week**, or **Month** are selected.
+ This option is enabled when you select **Day**, **Week**, or **Month**.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/summary.md
index b0d9dd37b2..7da436dd6d 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/summary.md
@@ -11,6 +11,5 @@ categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Exchange Metrics Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel**
+to close the Exchange Metrics Data Collector Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/timeframes.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/timeframes.md
index 72a36f6ef4..92943900ba 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/timeframes.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/timeframes.md
@@ -6,14 +6,14 @@ sidebar_position: 50
# ExchangeMetrics: Time Frames
-The Time Frames page is used to configure message delivery time frames for which to return summary
+Use the Time Frames page to configure message delivery time frames for which to return summary
metrics by server. It is a wizard page for the category of:
- Delivery Time Custom.
-Configure the desired time frames using the following options:
+Configure the time frames using the following options:
- Frame name – Name the configured time frame. Can either be entered manually or a default will
populate when frame limits are set.
@@ -32,6 +32,6 @@ selected returns messages delivered in 1 to 2 minutes.
**Start** value of **2** with the **Infinite** checkbox selected retrieves all messages that took
2 seconds/minutes/hours or longer to deliver.
-Once the frame is configured, click **Add**. The configured message time frame will appear in the
-list. Multiple time frames can be configured. Select a frame and click **Replace** to modify an
+After you configure the frame, click **Add**. The configured message time frame will appear in the
+list. You can configure multiple time frames. Select a frame and click **Replace** to modify an
existing frame. Use **Remove** to delete an existing frame.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/category.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/category.md
index 70bb491516..587932996c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/category.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# ExchangePS: Category
-The Category page contains a connection section where connection options are defined. It is also
-where the query category is selected. The available query categories are sub-divided by auditing
+The Category page contains a connection section where you define connection options. It's also
+where you select the query category. The available query categories are sub-divided by auditing
focus.
@@ -53,7 +53,7 @@ focus:
- Mailbox Databases – Collects information on mailbox databases
:::note
- This option is not available for Office 365 target environments
+ This option isn't available for Office 365 target environments
:::
@@ -110,7 +110,7 @@ Get-MailboxStatistics
Get-MailboxDatabase
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md)
@@ -131,7 +131,7 @@ Get-MailboxStatistics
Get-MailboxDatabase
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md)
@@ -149,7 +149,7 @@ PowerShell query this category runs is as follows:
Get-MailboxDatabase
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md)
@@ -167,7 +167,7 @@ PowerShell query this category runs is as follows:
Get-MailboxDatabase
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md)
@@ -185,7 +185,7 @@ PowerShell query this category runs is as follows:
Get-MailboxDatabase
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md)
@@ -205,7 +205,7 @@ Get-Mailbox
Get-MailboxDatabase
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md)
@@ -217,8 +217,8 @@ for configuration:
**Mailbox Access Logons**
-This category returns the Mailbox Access Auditing log details. Mailbox Access Auditing does need to
-be enabled on the Mailboxes in order for this job to return any information. The PowerShell queries
+This category returns the Mailbox Access Auditing log details. You must enable Mailbox Access
+Auditing on the mailboxes for this job to return any information. The PowerShell queries
this category runs are as follows:
```
@@ -226,7 +226,7 @@ Search-MailboxAuditLog
Get-Mailbox
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md)
@@ -252,7 +252,7 @@ Get-Mailbox
Get-ThrottlingPolicyAssociation
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md)
@@ -275,7 +275,7 @@ Get-ActiveSyncDeviceStatistics
Get-Mailbox
```
-When this category is selected, the following ExchangePS Data Collector Wizard pages are available
+When you select this category, the following ExchangePS Data Collector Wizard pages are available
for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md)
@@ -290,8 +290,8 @@ Public Folder Information audit focus contains the following categories:
**Public Folder Content**
-This category returns general statistics and sizing for the public folder environment. When it is
-selected, the following ExchangePS Data Collector Wizard pages are available for configuration:
+This category returns general statistics and sizing for the public folder environment. When you
+select it, the following ExchangePS Data Collector Wizard pages are available for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md)
- [ExchangePS: Results](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/results.md)
@@ -301,8 +301,8 @@ selected, the following ExchangePS Data Collector Wizard pages are available for
**Public Folder Permissions**
-This category returns permissions information for the public folder environment. When it is
-selected, the following ExchangePS Data Collector Wizard pages are available for configuration:
+This category returns permissions information for the public folder environment. When you
+select it, the following ExchangePS Data Collector Wizard pages are available for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md)
- [ExchangePS: Results](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/results.md)
@@ -316,8 +316,8 @@ Office 365 audit focus contains the following category:
**Mail Flow Metrics**
-This category returns information about mail flow in the target Exchange Online environment. When it
-is selected, the following ExchangePS Data Collector Wizard pages are available for configuration:
+This category returns information about mail flow in the target Exchange Online environment. When
+you select it, the following ExchangePS Data Collector Wizard pages are available for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md)
- [ExchangePS: Mail Flow](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/mailflow.md)
@@ -332,7 +332,7 @@ Domain Information audit focus contains the following category:
**Domains**
-This category returns information about domains in the Exchange environment. When it is selected,
+This category returns information about domains in the Exchange environment. When you select it,
the following ExchangePS Data Collector Wizard pages are available for configuration:
- [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md)
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/configurejob.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/configurejob.md
index 2dd3c15cd8..d1ab89356c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/configurejob.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/configurejob.md
@@ -6,12 +6,12 @@ sidebar_position: 10
# Exchange Custom Connection Profile & Host List
-The ExchangePS Data Collector requires a custom Connection Profile and host list to be created and
-assigned to the job conducting the data collection. The host inventory option during host list
+The ExchangePS Data Collector requires a custom Connection Profile and host list, which you create
+and assign to the job that collects the data. The host inventory option during host list
creation makes it necessary to configure the Connection Profile first.
:::note
-It is not possible to target both Exchange Online and on-premises Exchange environments
+You can't target both Exchange Online and on-premises Exchange environments
from the same job. Therefore, the Connection Profile should only contain the credentials for one
type of environment.
:::
@@ -28,17 +28,17 @@ The provisioned credential used should be an Active Directory account. Create a
and set the following information on the User Credentials window:
- Select Account Type – Active Directory Account
-- Domain – Drop-down menu with available trusted domains will appear. Either type the short domain
+- Domain – dropdown menu with available trusted domains will appear. Either enter the short domain
name in the textbox or select a domain from the menu.
-- User name – Type the user name
+- User name – Enter the user name
- Password Storage – Choose the for credential password storage:
- Application – Uses the configured Profile Security setting as selected at the **Settings** >
**Application** node
- CyberArk – Uses the CyberArk Enterprise Password Vault
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
### Exchange On-Premise Host List
@@ -53,18 +53,18 @@ Exchange Online.
### Exchange Online Credential for a Connection Profile
-The provisioned credential must be created with the Exchange Modern Authentication account type.
+Create the provisioned credential with the Exchange Modern Authentication account type.
Create a Connection Profile and set the following information on the User Credentials window:
- Select Account Type – Exchange Modern Authentication
- Password Storage – Application (Uses the configured Profile Security setting as selected at the
**Settings** > **Application** node. See the [Application](/docs/accessanalyzer/12.0/admin/settings/application/overview.md)
topic for additional information.)
-- Organization – The primary domain name of the Microsoft Entra tenant being leveraged to make the
+- Organization – The primary domain name of the Microsoft Entra tenant used to make the
connection. See the
[Identify the Tenant's Name](/docs/accessanalyzer/12.0/requirements/exchange/exchangeonline/access.md#identify-the-tenants-name)
topic for additional information.
-- Email Address – The email address for the mailbox to be leveraged in Exchange Online environment
+- Email Address – The email address for the mailbox used in Exchange Online environment
scans. The mailbox must belong to the primary domain used in the Organization field.
- AppID – Application (client) ID of the Access Analyzer application registered with Microsoft Entra
ID. See the
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/errorlogging.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/errorlogging.md
index 327c568e85..b54d37907d 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/errorlogging.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/errorlogging.md
@@ -6,7 +6,7 @@ sidebar_position: 120
# ExchangePS: Error Logging
-The Error Logging page is used to configure how long to keep the PowerShell logs. It is a wizard
+Use the Error Logging page to configure how long to keep the PowerShell logs. It is a wizard
page for all of the categories.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/filtermessage.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/filtermessage.md
index 54f4f28d16..969aa427d8 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/filtermessage.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/filtermessage.md
@@ -6,7 +6,7 @@ sidebar_position: 70
# ExchangePS: Filter by Message
-The Filter by Message page is used to define the filter conditions of the search. It is a wizard
+Use the Filter by Message page to define the filter conditions of the search. It is a wizard
page for the category of:
- Mailbox Search
@@ -36,16 +36,16 @@ Available conditions to select from include:
See the [Date Range Selection Window](#date-range-selection-window) and
[Words Window](#words-window) topics for additional information.
-In the Select Search Mailbox Parameters section, select the desired filter parameters:
+In the Select Search Mailbox Parameters section, select the filter parameters:
-- Do not Include Archive
+- Don't Include Archive
- Include Unsearchable Items
- Search Dumpster
- Search Dumpster Only
#### Date Range Selection Window
-The Date Range Selection window is opened by the **Specify Date Range...** option for a date related
+The **Specify Date Range...** option opens the Date Range Selection window for a date related
filter on the Filter by Message page.
@@ -56,19 +56,19 @@ Select the range category on the left and configure the range setting in the ena
**Years**.
- Last – Select the number and time units. The available time units are: **Days**, **Months**, or
**Years**.
-- Before – Drop-down menu opens a calendar selection view, choose the end date
-- After – Drop-down menu opens a calendar selection view, choose the start date
-- Between (Date) – Drop-down menus open calendar selection view, choose the start and end dates
-- Between – Select the numbers for the lower and upper range boundary, and the desired time units.
+- Before – dropdown menu opens a calendar selection view, choose the end date
+- After – dropdown menu opens a calendar selection view, choose the start date
+- Between (Date) – dropdown menus open calendar selection view, choose the start and end dates
+- Between – Select the numbers for the lower and upper range boundary, and the time units.
The available time units are: **Days**, **Months**, or **Years**.
-When the date range is specified, click **OK**. The selected date range shows as a filter on the
+After you specify the date range, click **OK**. The selected date range shows as a filter on the
Filter by Message page. Click the filter to open the Date Range Selection window to modify the date
range.
#### Words Window
-The Words window is opened by the **Specify words...** option for a word related filter on the
+The **Specify words...** option opens the Words window for a word related filter on the
Filter by Message page.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/mailboxlogons.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/mailboxlogons.md
index 70c75af4f2..b524f9cb80 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/mailboxlogons.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/mailboxlogons.md
@@ -6,13 +6,13 @@ sidebar_position: 80
# ExchangePS: Mailbox Logons
-The Mailbox Logons page is used to define the type of mailbox logon events to return, as well as the
-date range to be returned. It is a wizard page for the category of Mailbox Information > Mailbox
+Use the Mailbox Logons page to define the type of mailbox logon events to return, as well as the
+date range to return. It is a wizard page for the category of Mailbox Information > Mailbox
Access Logons.
-Select the desired checkboxes to indicate which logons to audit:
+Select the checkboxes to indicate which logons to audit:
- Delegate
- Admin
@@ -27,4 +27,4 @@ Specify the date range for the logons:
:::
-- Between (Date) – Use the drop-down menus to open calendars to select the start and end dates
+- Between (Date) – Use the dropdown menus to open calendars to select the start and end dates
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/mailflow.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/mailflow.md
index 3c6dfdd82f..13cf877cba 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/mailflow.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/mailflow.md
@@ -21,5 +21,5 @@ Date range must be 7 days or less.
- Last – Select the number of days
-- Between (Date) – Use the drop-down menus to open the calendar selection view to choose the start
+- Between (Date) – Use the dropdown menus to open the calendar selection view to choose the start
and end dates
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/options.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/options.md
index a2202ecf18..c4ee5f3b10 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/options.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# ExchangePS: Options
-The Options page is used to configure additional options. It is a wizard page for all of the
+Use the Options page to configure additional options. It is a wizard page for all of the
categories.
@@ -32,6 +32,6 @@ The following options can be configured:
- Concatenated
- - Delimiter – Enter the desired delimiter to be used between values
+ - Delimiter – Enter the delimiter to use between values
- First-value only
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/overview.md
index 9aa2ff7b16..9fc6975d5d 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 200
# ExchangePS Data Collector
-The ExchangePS Data Collector utilizes the Exchange CMDlets to return information about the Exchange
-environment utilizing PowerShell. This data collector has been designed to work with Exchange 2010
+The ExchangePS Data Collector uses the Exchange CMDlets to return information about the Exchange
+environment using PowerShell. This data collector has been designed to work with Exchange 2010
and newer. The ExchangePS Data Collector has been preconfigured within the Exchange Solution. Both
this data collector and the solution are available with a special Access Analyzer license. See the
[Exchange Solution](/docs/accessanalyzer/12.0/solutions/exchange/overview.md) topic for additional information.
@@ -39,9 +39,9 @@ topic for additional information.
## Remote PowerShell
-The ExchangePS Data Collector will utilize Remote PowerShell when connecting to Exchange 2010 or
-newer. This behavior simulates what the Exchange Management Shell does when loading. The below
-PowerShell syntax is an example of how the connection is loaded through PowerShell.
+The ExchangePS Data Collector will use Remote PowerShell when connecting to Exchange 2010 or
+newer. This behavior simulates what the Exchange Management Shell does when loading. The following
+PowerShell syntax is an example of how PowerShell loads the connection.
```
$JobUserName = '{insert domain\username}'
@@ -58,14 +58,14 @@ topic for instructions on enabling Remote PowerShell.
## The Exchange Applet
-The Exchange Applet will run on the Exchange server by the ExchangePS Data Collector in the
+The ExchangePS Data Collector runs the Exchange Applet on the Exchange server in the
following circumstances:
-- An actual Client Access Server (CAS) server is not specified either in the global configuration
+- An actual Client Access Server (CAS) server isn't specified either in the global configuration
(**Settings** > **Exchange** node) or on the Category page of the ExchangePS Data Collector Wizard
- Remote PowerShell has not been enabled for targeting Exchange 2010
-The following Exchange Snap-in is used when the applet is utilized:
+The following Exchange Snap-in is used when the applet is used:
- Add-pssnapin Microsoft.Exchange.Management.Powershell.E2010
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/results.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/results.md
index c0560e386a..a2dab4e5b0 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/results.md
@@ -6,10 +6,10 @@ sidebar_position: 100
# ExchangePS: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for all
+The Results page is where you select the properties to gather. It is a wizard page for all
of the categories.
-Properties can be selected individually or the **Select All** and **Clear All** buttons can be used.
-All selected properties will be gathered. Available properties vary based on the category selected.
+You can select properties individually, or use the **Select All** and **Clear All** buttons.
+The data collector gathers all selected properties. Available properties vary based on the category selected.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md
index 6c798250f5..c4a6479391 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md
@@ -19,7 +19,7 @@ Available scoping options vary based on the category selected. Scoping options i
on the Summary page. See the [ExchangePS: Summary](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/summary.md) topic for additional
information.
- When using the applet, the data collector gathers information about the Exchange Forest in
- which the Access Analyzer Console currently resides
+ which the Access Analyzer Console resides
- For Remote PowerShell, the data collector gathers information about the Exchange Organization
to which the Remote PowerShell connection was made. This refers to the server entered in the
Client Access Server (CAS) field of the global configuration from the **Settings** >
@@ -36,7 +36,7 @@ Available scoping options vary based on the category selected. Scoping options i
- When using the applet, the data collector deploys a process to the targeted host to run the
PowerShell on that server
- - For Remote PowerShell, the data collector does not deploy anapplet and utilizes the WinRM
+ - For Remote PowerShell, the data collector doesn't deploy anapplet and uses the WinRM
protocol to gather information about the objects on that server. See the
[Remote PowerShell](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/overview.md#remote-powershell) and
[The Exchange Applet](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/overview.md#the-exchange-applet) topics for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopedatabases.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopedatabases.md
index e69568302c..636bb3f50e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopedatabases.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopedatabases.md
@@ -6,19 +6,19 @@ sidebar_position: 40
# ExchangePS: Scope by DB
-The Scope by Databases page is used to define specific databases to search. This page is enabled
-when **Scope by Database Target Host: Local Host** option is selected on the Scope page. See the
+Use the Scope by Databases page to define specific databases to search. This page is enabled
+when you select the **Scope by Database Target Host: Local Host** option on the Scope page. See the
[ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md) topic for additional information.
When using the applet, the data collector returns databases for the Exchange Organization in which
-the Access Analyzer Console currently resides, and only returns information about those databases.
+the Access Analyzer Console resides, and only returns information about those databases.
For Remote PowerShell, the data collector returns databases for the Exchange Forest and only returns
information about those databases.
Click **Retrieve** to return all databases in the Exchange Organization and populate them in the
-Available Databases list. Select the desired databases from Available Databases and click **Add**.
-The selected databases are added in the Selected Databases list. To remove undesired databases from
-Selected Databases, select them and click **Remove**. The Select All and Clear All buttons can be
-used for quick selection.
+Available Databases list. Select the databases from Available Databases and click **Add** to add
+them to the Selected Databases list. To remove undesired databases from
+Selected Databases, select them and click **Remove**. Use the Select All and Clear All buttons for
+quick selection.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopemailboxes.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopemailboxes.md
index 812956a4a6..c7cbdccfbe 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopemailboxes.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopemailboxes.md
@@ -6,12 +6,12 @@ sidebar_position: 50
# ExchangePS: Scope by Mailboxes
-The Scope by Mailboxes page is used to define specific mailboxes to search. This page is enabled
-when the **Scope by Mailbox Target Host: Local Host** option is selected on the Scope page. See the
+Use the Scope by Mailboxes page to define specific mailboxes to search. This page is enabled
+when you select the **Scope by Mailbox Target Host: Local Host** option on the Scope page. See the
[ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md) topic for additional information.
When using the applet, the data collector will return mailboxes for the Exchange Forest in which the
-Access Analyzer Console currently resides, and only return information about those mailboxes. For
+Access Analyzer Console resides, and only return information about those mailboxes. For
Remote PowerShell, the data collector will return mailboxes for the Exchange Forest as well as
return information about those mailboxes.
@@ -19,6 +19,6 @@ return information about those mailboxes.
Click **Retrieve** to return all mailboxes in the Exchange Organization and populate them in the
Available Mailboxes list. Select desired mailboxes from the Available Mailboxes list and click
-**Add**. The selected mailboxes are added in the Selected Mailboxes list. To remove undesired
-mailboxes from Selected Mailboxes, select them and click **Remove**. The Select All and Clear All
-buttons can be used for quick selection.
+**Add** to add them to the Selected Mailboxes list. To remove undesired
+mailboxes from Selected Mailboxes, select them and click **Remove**. Use the Select All and Clear All
+buttons for quick selection.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopepublicfolders.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopepublicfolders.md
index 09c47e1874..8ac6e30ab0 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopepublicfolders.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopepublicfolders.md
@@ -6,11 +6,11 @@ sidebar_position: 60
# ExchangePS: Scope by Public Folders
-The Scope by Public Folders page is used to define specific public folders to search. This page is
-enabled when the **Scope by Public Folder** option is selected on the Scope page. See the
+Use the Scope by Public Folders page to define specific public folders to search. This page is
+enabled when you select the **Scope by Public Folder** option on the Scope page. See the
[ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md) topic for additional information.
-Configure the **Scope** option using the drop-down. The available options are:
+Configure the **Scope** option using the dropdown. The available options are:
- Selected Public Folder
- Selected Table
@@ -24,9 +24,9 @@ organization, populating them in the Available list.
-The **Search** feature filters this list. Select the desired public folders and click **Add**. The
-selected public folders are added to the Selected list. Use the **Remove** option to delete selected
-public folders from the list. The Select All or Deselect All buttons can be used for quick
+The **Search** feature filters this list. Select the public folders and click **Add** to add
+them to the Selected list. Use the **Remove** option to delete selected
+public folders from the list. Use the Select All or Deselect All buttons for quick
selection. Additional scoping options include:
- Return only these folders – Audits only the selected public folders
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/summary.md
index 6ad06d6b75..d66fd5dea6 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 130
# ExchangePS: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for all of the
+The Summary page summarizes the configuration settings. It is a wizard page for all of the
categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the ExchangePS Data Collector Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel**
+to close the ExchangePS Data Collector Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/category.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/category.md
index 9248547412..e9d57a71fe 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/category.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# ExchangePublicFolder: Category
-The Category page is used to select the objects to search.
+Use the Category page to select the objects to search.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/options.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/options.md
index 71e99fe77a..644dca50cb 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/options.md
@@ -13,11 +13,11 @@ all of the categories. Available options vary based on the category selected.
The Options page contains the following options:
-- Process folders that physically reside on the target server only – This option will limit
- extraction to only the subset of public folders which reside on this server when selected. Clear
- this option if targeting the Exchange 2010 Public Folder Server. The ability to scope to the
- targeted server is not available for Exchange 2010. The entire public folder hierarchy is
- returned.
+- Process folders that physically reside on the target server only – When selected, this option
+ limits extraction to only the subset of public folders that reside on this server. Clear this
+ option if targeting the Exchange 2010 Public Folder Server. The ability to scope to the targeted
+ server isn't available for Exchange 2010, so the query returns the entire public folder
+ hierarchy.
- Message size units:
- KB
@@ -27,7 +27,7 @@ The Options page contains the following options:
When this option is selected, it will include subfolders in message counters, according to the
Scope page settings. See the [ExchangeMetrics: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangemetrics/scope.md) topic for
additional information.
-- Large attachment threshold (Kb) – Configure the desired size limit for attachments. The default
+- Large attachment threshold (Kb) – Configure the size limit for attachments. The default
value is 500.
In the Attachment types section, configure attachment count types.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/overview.md
index 749da4bfbc..057d3fed72 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/overview.md
@@ -8,11 +8,11 @@ sidebar_position: 210
The ExchangePublicFolder Data Collector audits an Exchange Public Folder, including contents,
permissions, ownership, and replicas. This is a MAPI-based data collector which requires the
-**Settings > Exchange** node to be enabled and configured. See the
+**Settings > Exchange** node, which you must enable and configure. See the
[Exchange](/docs/accessanalyzer/12.0/admin/settings/exchange.md) topic for additional information.
-The ExchangePublicFolder Data Collector has been preconfigured within the Exchange Solution. Both
-this data collector and the solution are available with a special Access Analyzer license. See the
+The Exchange Solution preconfigures the ExchangePublicFolder Data Collector. Both this data
+collector and the solution are available with a special Access Analyzer license. See the
[Exchange Solution](/docs/accessanalyzer/12.0/solutions/exchange/overview.md) topic for additional information.
**Protocols**
@@ -32,13 +32,13 @@ this data collector and the solution are available with a special Access Analyze
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, you must increase the minimum amount of RAM. Each
+thread requires a minimum of 2 additional GB of RAM per host. For example, a job configured to scan
+8 hosts at a time requires an extra 16 GB of RAM (8x2=16).
## ExchangePublicFolder Query Configuration
-The ExchangePublicFolder Data Collector is configured through the Exchange Public Folder Data
+You configure the ExchangePublicFolder Data Collector through the Exchange Public Folder Data
Collector Wizard, which contains the following wizard pages:
- Welcome
@@ -57,7 +57,7 @@ permissions on the Welcome page.
In the Connection Setting section, choose to either maintain the global inheritance, or configure
query specific settings.
-The **Use Global setting** option specifies what setting is being inherited. Clear this option to
+The **Use Global setting** option specifies which setting the query inherits. Clear this option to
break inheritance, and then select one of the following options:
- System Attendant (2003 & 2007)
@@ -67,6 +67,6 @@ break inheritance, and then select one of the following options:
See the [Exchange](/docs/accessanalyzer/12.0/admin/settings/exchange.md) topic for additional information.
-In the Sampling server section, enter the Exchange server in the textbox to be used to test the
+In the Sampling server section, enter the Exchange server that Access Analyzer will use to test the
connection settings. Click **Test sampling server** to ensure there is access to the server. The box
at the bottom of the page displays information regarding the test connection in progress.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/probableowner.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/probableowner.md
index ab15b6665b..638c6e553a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/probableowner.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/probableowner.md
@@ -6,13 +6,13 @@ sidebar_position: 50
# ExchangePublicFolder: Probable Owner
-The Probable Owner Settings page provides configuration options to determine an owner. It is enabled
-when the Probable Owner property is selected on the Properties page. See the
+The Probable Owner Settings page provides configuration options to determine an owner. Selecting
+the Probable Owner property on the Properties page enables it. See the
[ExchangePublicFolder: Properties](/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/properties.md) topic for additional information.
-In the Determine owner section, select the desired option to specify what setting to use to
+In the Determine owner section, select an option to specify what setting to use to
determine an owner:
- Determine owner from folder hierarchy – Select to determine the probable owner with a weight of
@@ -47,15 +47,15 @@ In the Exclusions section, select one or more of the following checkboxes to spe
- Remove selected – Select a user or users to remove from the Exclude users list and click
**Remove selected** to remove the users
-In the Output Options section, select the desired output option:
+In the Output Options section, select an output option:
- Get one most probable owner – Return one probable owner
- Get probable owners with relative deviation to the most probable owner – Return probable owners
based on the deviation from percentage from the most probable owner
- - Maximum deviation [number] percents – Use the arrow buttonss to enter the desired percent of
+ - Maximum deviation [number] percents – Use the arrow buttons to enter the percent of
deviation from the most probable owner from which to return probable owners
- Get multiple probable owners – Return multiple probable owners
- - Count – Use the arrow buttons to enter the desired number of probable owners to return
+ - Count – Use the arrow buttons to enter the number of probable owners to return
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/properties.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/properties.md
index 57d32739e6..0c4e888b91 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/properties.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/properties.md
@@ -6,13 +6,13 @@ sidebar_position: 30
# ExchangePublicFolder: Properties
-The Properties page is where properties that will be gathered are selected. It is a wizard page for
-all of the categories.
+Use the Properties page to select the properties to gather. It is a wizard page for all of the
+categories.
-Properties can be selected individually or you can use the **Select All**, **Clear All**, or **Reset
-All** buttons. All selected properties will be gathered. The **Message Classes** button opens the
+You can select properties individually or use the **Select All**, **Clear All**, or **Reset
+All** buttons. Access Analyzer gathers all selected properties. The **Message Classes** button opens the
Message classes filters window.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/scope.md b/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/scope.md
index bf4e076e4e..ca7e1a68f8 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/scope.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/exchangepublicfolder/scope.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# ExchangePublicFolder: Scope
-The Scope page is used to define which folders will be included will be searched by this query. It
-is a wizard page for all of the categories.
+Use the Scope page to define which folders this query searches. It is a wizard page for all of the
+categories.
@@ -16,11 +16,11 @@ In the Choose Type of Public Folders to be queried section, select either:
- Default Public Folders – User can access these folders directly with client applications such as
Microsoft Outlook. In its default configuration, Exchange System Manager displays these folders
when a public folder tree is expanded.
-- System Public Folders – Users cannot access these folders directly. Client applications, such as
+- System Public Folders – Users can't access these folders directly. Client applications, such as
Microsoft Outlook, use these folders to store information such as free and busy data, offline
address lists, and organizational forms. Other folders hold configuration information that is used
by custom applications or by Exchange itself. The Public Folders tree contains extra system
- folders, such as the EFORMS REGISTRY folder, that do not exist in general-purpose public folder
+ folders, such as the EFORMS REGISTRY folder, that don't exist in general-purpose public folder
trees.
In the Choose Scope of Public Folders to be queried section, select one of the following options:
@@ -39,14 +39,14 @@ In the Choose Scope of Public Folders to be queried section, select one of the f
## Scope to the Selected Public Folders
-When Scope to **Selected Public Folders** is selected on the Scope page, the options to specify the
-desired folders are enabled.
+Selecting **Selected Public Folders** on the Scope page enables the options to specify the desired
+folders.
Configure the scope of the selected public folders to be queried:
-- Select public folders from – Enter the name of the server hosting the desired public folders and
+- Select public folders from – Enter the name of the server hosting the public folders and
click **Retrieve**. The box will populate with available public folders.
- Add – Adds the selected folders
- Add Recursive – Adds the selected folders and all child folders. Not adding recursive folders will
@@ -55,7 +55,7 @@ Configure the scope of the selected public folders to be queried:
selected host. If enabled, physically housed folders show in bold text in the list that is
returned after clicking **Retrieve**.
-The selected public folders are added in the table at the bottom. Click **Remove** to delete a
+The table at the bottom lists the selected public folders. Click **Remove** to delete a
selected word from the filter list.
## Scope to Selected Table
@@ -70,7 +70,7 @@ Configure the selected tables to be queried:
- Table Name – retrieves the list of selected public folders from a Access Analyzer database table.
Click **Retrieve** to populate the Table name box with all available tables within the database.
- - The Table name box can be filtered by entering a name in the textbox and clicking **Retrieve**
+ - Filter the Table name box by entering a name in the textbox and clicking **Retrieve**
-- Field name – Select the desired table and the available fields will populate the Field names box.
+- Field name – Select the table and the available fields will populate the Field names box.
Select the field containing the public folder names.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/file/category.md b/docs/accessanalyzer/12.0/admin/datacollector/file/category.md
index 0e456c3042..f8d9df685f 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/file/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/file/category.md
@@ -14,7 +14,7 @@ The categories are:
- Calculate Group Size (Files Only) – Scans of disk space for the amount used by files in each
folder location. This option scopes the query to files so that any information involving the
- folders that hold the files is not retrieved.
+ folders that hold the files isn't retrieved.
- File or Folder Properties – Scans the target host for specific attributes and properties
associated with certain files and folders in the environment. This option is selected by default.
- File or Folder Permissions – Scans files or folders for permission settings and effective
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/file/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/file/overview.md
index ea4d1d8dcc..a7f335ca17 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/file/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/file/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 220
# File Data Collector
-The File Data Collector provides file and folder enumeration, properties, and permissions. It is
-used to find files and folders on a target host. The File Data Collector finds one or more files on
+The File Data Collector provides file and folder enumeration, properties, and permissions. Use it to
+find files and folders on a target host. The File Data Collector finds one or more files on
the target hosts. It can target any file extension. This data collector is a core component of
Access Analyzer and is available with all Access Analyzer licenses.
@@ -40,7 +40,7 @@ full list of supported platforms.
## File Query Configuration
-The **File** Data Collector is configured through the File Search Wizard, which contains the
+You configure the **File** Data Collector through the File Search Wizard, which contains the
following wizard pages:
- Welcome
@@ -51,5 +51,5 @@ following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+Select the **Don't display this page the next time** checkbox to hide the Welcome page when the
+wizard is open and configuration settings are saved.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/file/results.md b/docs/accessanalyzer/12.0/admin/datacollector/file/results.md
index 47d4b6a3f5..169122395d 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/file/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/file/results.md
@@ -6,18 +6,18 @@ sidebar_position: 30
# File: Results
-The Results page provides a list of available properties to be searched for and returned by the job
-execution. The properties selected display as table columns in the results of the query. It is a
+The Results page provides a list of available properties that the job execution searches for and
+returns. The properties selected display as table columns in the results of the query. It is a
wizard page for all of the categories.
-Properties can be selected individually or in groups with the **Select All** or **Clear All**
+You can select properties individually or in groups with the **Select All** or **Clear All**
buttons. The properties available vary based on the category selected.
:::note
-When the **Calculate Group Size (Files Only)** category is selected, the properties and
-options on the Results page are grayed out.
+Selecting the **Calculate Group Size (Files Only)** category grays out the properties and
+options on the Results page.
:::
@@ -26,12 +26,12 @@ options on the Results page are grayed out.
- This option is available for the **File or Folder Properties** category
-- Only return permissions for the following user(s) – Defines users for the query. Enter the desired
+- Only return permissions for the following users – Defines users for the query. Enter the desired
users in the textbox.
- This option is available for the **File or Folder Permissions** category
-- Only return permissions for the following group(s) – Defines groups for the query. Enter the
+- Only return permissions for the following groups – Defines groups for the query. Enter the
desired users in the textbox.
- This option is available for the **File or Folder Permissions** category
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/file/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/file/summary.md
index 4413ff4300..94ecb43d5c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/file/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/file/summary.md
@@ -6,11 +6,11 @@ sidebar_position: 40
# File: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for all of the
+The Summary page summarizes the configuration settings. It is a wizard page for all of the
categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the File Data Collector Wizard ensuring that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you didn't make any changes, click **Cancel** to
+close the File Data Collector Wizard. This ensures Access Analyzer doesn't save any accidental
+clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/file/targetfiles.md b/docs/accessanalyzer/12.0/admin/datacollector/file/targetfiles.md
index 739d152b85..f05e1b1ab3 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/file/targetfiles.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/file/targetfiles.md
@@ -11,7 +11,7 @@ results for the specific folder or file. It is a wizard page for all of the cate
-Within the Target files configuration page, select the desired method to refine the query.
+Within the Target files configuration page, select the method you want to use to refine the query.
:::note
Some options are grayed out depending on the option selected.
@@ -21,7 +21,7 @@ Some options are grayed out depending on the option selected.
**Where is the file or folder?**
This section supplies options for using a fixed path (wildcards and system variables) or registry
-lookup values that are supported by the data collector. This header is available for all Category
+lookup values that the data collector supports. This header is available for all Category
selections.
For either option, enter the path in the text box or click the browse button (**…**) to select from
@@ -33,19 +33,18 @@ network neighborhoods which begin with `\\`.
:::
-- Fixed path – Specify a specific path to the target files. Use the following format:
+- Fixed path – Specify a path to the target files. Use the following format:
`drive\filepath` (for example, `C:\WINNT\System32`). The browse button (**…**) opens the Remote
Folder Explorer window.
:::note
- Further information for the Fixed path option is provided by clicking the tooltip
- button (**?**).
+ Click the tooltip button (**?**) for more information about the Fixed path option.
:::
- System environment variables – Supply a traditional system root or previously defined variable
- that maps to a physical path within the file system. This is typically used when the system root
- is installed on a secondary volume. The following are variables that can be entered at the
+ that maps to a physical path within the file system. You typically use this option when the
+ system root is installed on a secondary volume. You can enter the following variables at the
beginning of the file path:
- `%SYSTEMROOT%\Temp` – Expands to `C:\WINNT\Temp` on some target hosts
@@ -55,24 +54,24 @@ network neighborhoods which begin with `\\`.
- Registry Lookup – Find registry keys and values that exist on a target host in the environment.
Click the browse button (**…**) to open the Access Analyzer Registry Browser window.
- - Access Analyzer Registry – Connect to a host, then select a registry key and path to be used
- for the lookup by the query
+ - Access Analyzer Registry – Connect to a host, then select a registry key and path for the
+ query to use in the lookup
- Registry Value – This value is automatically populated from the registry key
- - Levels – After a registry path has been selected, the Levels slider can be used to
+ - Levels – After you select a registry path, use the Levels slider to
truncate the path for the key value in the Adjust Path dialog box
- Current Value – Displays the type of data each registry value contains
- Query 32-bit View – Select this checkbox to query a 32-bit view
- Query 64-bit View – Select this checkbox to query a 64-bit view
- When a **Fixed path** or **Registry Lookup** is mapped, select options to better refine
+ When you map a **Fixed path** or **Registry Lookup**, select options to better refine
the search. Select one, none, or both.
- Include network drives – Includes all mapped shared drives in the network in the query
:::warning
- Including subfolders may result in hundreds of thousands of files being returned
- depending on the environment being targeted.
+ Including subfolders may return hundreds of thousands of files, depending on the
+ targeted environment.
:::
@@ -81,12 +80,12 @@ network neighborhoods which begin with `\\`.
**What is the file or folder name?**
The options in this section limit the search to folders or files with a specified name against the
-targeted host. When the **I am looking for folders** option is selected, more options become
-available for further refinement.
+targeted host. Selecting the **I am looking for folders** option makes more options available for
+further refinement.
:::note
-The **I am looking for folders** option and it's associated options are unavailable
-(grayed out) when the **Calculate Group Size (Files Only)** category is selected.
+Selecting the **Calculate Group Size (Files Only)** category makes the **I am looking for
+folders** option and its associated options unavailable (grayed out).
:::
@@ -96,10 +95,10 @@ The **I am looking for folders** option and it's associated options are unavaila
property information on these folders
- Include root folder in results – Returns all information within the root folder
- - Only include root folder – Returns information only for the root folder. This checkbox is
- enabled when the **Include root folder in results** checkbox is selected.
+ - Only include root folder – Returns information only for the root folder. Selecting the
+ **Include root folder in results** checkbox enables this checkbox.
-- With this name – Specific name of a file or folder. A wildcard is used to match any file or folder
+- With this name – Specific name of a file or folder. Use a wildcard to match any file or folder
to a specific naming convention. When searching for multiple objects, use a semicolon (`;`) to
separate the objects in the list.
@@ -121,8 +120,8 @@ a specific time frames. The following options are available:
File Size Filter
-The File Size Filter option is only available when the **Calculate Group Size (Files Only)**
-category is selected. Select an option to activate the filter and narrow the query.
+Selecting the **Calculate Group Size (Files Only)** category makes the File Size Filter option
+available. Select an option to activate the filter and narrow the query.
- None – No file size filter is applied. This option is selected by default.
- Below – Filter to files smaller than the specified values
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/activitysettings.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/activitysettings.md
index 67c999958f..e0b36c6652 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/activitysettings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/activitysettings.md
@@ -6,17 +6,17 @@ sidebar_position: 50
# FSAA: Activity Settings
-The File System Activity Auditor Scan Filter Settings page is where activity scan filter settings
-are configured. It is a wizard page for the category of File System Activity Scan.
+Use the File System Activity Auditor Scan Filter Settings page to configure activity scan filter
+settings. It is a wizard page for the category of File System Activity Scan.
In the Scan Filters section, choose from the following options:
- Set Scan Filter for Detailed Activity – Enables the **Days** number box. Select the number of past
- days for activity details to be collected.
+ days to collect activity details.
- Set Filter for Statistics of Activity – Enables the **Days** number box. Select the number of past
- days for activity statistics to be collected.
+ days to collect activity statistics.
In the Log Parsing Limits section, choose from the following option:
@@ -28,16 +28,16 @@ In the Scan Limit section, configure the following:
- Set Log Processing Limit – Stops the scan after the set number of MB or GB of log files are
processed and the threshold number is reached
-These filters affect what data is collected from the activity logs. However, enabling these filters
+These filters affect what data the scan collects from the activity logs. However, enabling these filters
also causes the corresponding bulk import query to purge the database of selected activity
information older than the time filter specified here.
-If either is left deselected, all available log files are collected and stored. This has a direct
-impact on both scan time and database size.
+If you leave either deselected, the scan collects and stores all available log files, which directly
+affects both scan time and database size.
:::tip
-Remember, the file activity options require the Activity Monitor to be deployed, configured, and
-services running.
+Remember, the file activity options require you to deploy and configure the Activity Monitor and run
+its services.
:::
@@ -55,7 +55,7 @@ Query window.
-When the Enable host mapping checkbox is selected, the query textbox is enabled. The SQL query
+Selecting the Enable host mapping checkbox enables the query textbox. The SQL query
provided by a user should return a set of log locations, target hosts, and host names of the
Monitored Hosts in the Activity Monitor. The target tables must reside within the Access Analyzer
database and contain at least the following columns:
@@ -72,20 +72,19 @@ database and contain at least the following columns:
will be mapped to
Enter the SQL query by clicking Sample Query then replacing the sample text in the textbox, as shown
-above. The SQL query must target tables that have the required columns populated with the host
+in the Host Mapping Query window. The SQL query must target tables that have the required columns populated with the host
mapping.
(Optional) Enter a host in the **Host parameter value (@host)** textbox to test the query to
retrieve the data for that host.
-Select **Test Query** to open a preview of the results in the Query Results window. Ensure that the
-data being retrieved by the query is expected. When this option is selected, the data collector runs
-against the target table.
+Select **Test Query** to open a preview of the results in the Query Results window. Ensure the query
+retrieves the expected data. Selecting this option runs the data collector against the target table.
### Host-Agent Mapping
-Access Analyzer can be configured via the Host Mapping feature to support the use of Multiple
-Activity Monitor Agents for a single targeted Host. See the examples below:
+You can configure Access Analyzer via the Host Mapping feature to support the use of Multiple
+Activity Monitor Agents for a single targeted Host. See the following examples:
Single-Host Single-Agent Example:
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/appletsettings/appletsettings.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/appletsettings/appletsettings.md
index 51f6b88ffb..5e827d1435 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/appletsettings/appletsettings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/appletsettings/appletsettings.md
@@ -86,23 +86,23 @@ In the Applet Settings section, configure the following options:
while the proxy server is busy, before it enters the job engine queue
- Applet communication timeout: [number] minutes – This option determines the length of time (in
minutes) the Access Analyzer Console attempts to reach the proxy before giving up. Depending on
- the job configuration, the data collector behaves in one of three ways after the timeout value has
- been exceeded:
- - If a communication timeout is reached and the **Stop scan on applet communication timeout**
+ the job configuration, the data collector behaves in one of three ways after the timeout value
+ expires:
+ - If a communication timeout occurs and the **Stop scan on applet communication timeout**
option is unchecked, the scan continues running. When the proxy is available again, the data
collector gets the database files on the next scan of that host. It will either bring the
database files back, if the scan has finished, or display the current state of the scan in a
**Running Job** node if it is still running.
- - If the communication timeout is reached and the **Stop scan on applet communication timeout**
+ - If the communication timeout occurs and the **Stop scan on applet communication timeout**
option is checked, Access Analyzer automatically suspends or cancels the remote scan. If the
**Restart incomplete scans after (0 always restarts) [number] days** option or the **Rescan
unimported hosts after (0 always rescans) [number] days** option on the Applet Gathering
Settings page are both set to zero or unchecked, the scan cancels.
- If either of these options on the Applet Gathering Settings page are checked with values
- higher than zero, the scan is suspended after the communication timeout value has been
- exceeded
+ higher than zero, Access Analyzer suspends the scan after the communication timeout value
+ expires
- Scan cancellation timeout: [number] minutes – When checked, this option will timeout the applet
- if there is an attempt to pause the scan and the applet doesn't respond
+ if you attempt to pause the scan and the applet doesn't respond
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/appletsettings/spnmapping.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/appletsettings/spnmapping.md
index 90e4e04e6a..d4c7889b93 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/appletsettings/spnmapping.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/appletsettings/spnmapping.md
@@ -40,7 +40,7 @@ Use custom SPN mapping to specify which SPN Access Analyzer should present when
## Query requirements
- The query must return columns named `Host` and `SPN` (you can use aliases, e.g. `SELECT ServerName AS Host, …`).
-- The `@host` parameter - supplied automatically by Access Analyzer as the proxy server - is available if you want to filter by applet host, but it's optional — if your query doesn't reference it, Access Analyzer will use every row returned.
+- The `@host` parameter — which Access Analyzer supplies automatically as the proxy server — is available if you want to filter by applet host, but it's optional — if your query doesn't reference it, Access Analyzer will use every row returned.
- Host matching is case-insensitive.
- Host name format must be consistent. The format you use in the table (FQDN, short name, or IP address) must exactly match the format you use for the applet host. For example, if the applet host uses a fully qualified domain name (FQDN), use the FQDN in the table as well. Don't mix formats — for example, don't store a short hostname while the applet host uses an FQDN.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/azuretenantmapping.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/azuretenantmapping.md
index b27176e2a2..460990ffaf 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/azuretenantmapping.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/azuretenantmapping.md
@@ -6,24 +6,24 @@ sidebar_position: 70
# FSAA: Azure Tenant Mapping
-The Azure Tenant Mapping page is where the target domain or Tenant ID are configured for Azure
-Information Protection (AIP) scanning. It is a wizard page for the categories of:
+Use the Azure Tenant Mapping page to configure the target domain or Tenant ID for Azure Information
+Protection (AIP) scanning. It is a wizard page for the categories of:
- File System Access/Permission Auditing Scan
- File System SDD Scan
Remember, select the **Enable scanning of files protected by Azure Information Protection** checkbox
on the [FSAA: Scan Settings](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scansettings.md) page to enable this page in the data collector wizard.
-In order for FSAA to scan files protected by AIP, ensure that the prerequisites are met and an Azure
-Connection Profile is successfully created. See the
+For FSAA to scan files protected by AIP, meet the prerequisites and successfully create an Azure
+Connection Profile. See the
[Azure Information Protection Target Requirements](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md)
topic for additional information on configuring the File System solution to scan for AIP labels.
Populate this page with the App ID (created during prerequisites) and a domain name or Tenant ID for
-an Azure environment. These values must be associated with each application ID in the Azure
+an Azure environment. You must associate these values with each application ID in the Azure
Connection Profile.
-Use the **Add** and **Remove** buttons and manually enter or **Paste** into the textbox the required
-information.
+Use the **Add** and **Remove** buttons, and manually enter or paste the required information into
+the textbox.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/bulkimport.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/bulkimport.md
index c04e40aa56..93bde09d12 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/bulkimport.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/bulkimport.md
@@ -6,8 +6,8 @@ sidebar_position: 130
# FSAA: Bulk Import Settings
-The Bulk Import Settings page is where the bulk import process settings are configured. It is a
-wizard page for the categories of:
+Use the Bulk Import Settings page to configure the bulk import process settings. It is a wizard page
+for the categories of:
- Bulk Import File System Access/Permission Auditing
- Bulk Import File System Activity
@@ -16,5 +16,5 @@ wizard page for the categories of:
Select the **Import incomplete scan data** checkbox to enable imports of partial scan data. If the
-scan is stopped before successful completion, this option must be checked in order to bulk import
-the data from a partially scanned host.
+scan stops before successful completion, select this option to bulk import the data from a
+partially scanned host.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/certificateauthority.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/certificateauthority.md
index 120490c4eb..08b38aaa3d 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/certificateauthority.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/certificateauthority.md
@@ -19,11 +19,11 @@ custom CA to generate and sign client certificates dynamically.
## How Provide Certificate Authority Works
-When **Provide Certificate Authority** is selected:
+When you select **Provide Certificate Authority**:
1. FSAA loads the provided CA certificate from a `.pfx` file.
2. FSAA generates client certificates and signs them using the supplied CA.
-3. Generated certificates are stored securely by FSAA.
+3. FSAA stores generated certificates securely.
4. The FSAA applet presents its client certificate during HTTPS communication.
5. The data collector validates the certificate and establishes a secure connection.
@@ -36,10 +36,10 @@ The CA certificate must meet the following requirements:
- **Basic Constraints:** `CA=TRUE`
- **Key Usage:** certificate signing (`CertSign`)
- Certificate is within its valid date range
-- PFX file is not password-protected
+- PFX file isn't password-protected
:::note
-FSAA cannot load password-protected PFX files.
+FSAA can't load password-protected PFX files.
:::
## Creating the CA Certificate
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/certificatemanagement.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/certificatemanagement.md
index 2cf802d7cf..1f4c0b1e08 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/certificatemanagement.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/certificatemanagement.md
@@ -7,7 +7,7 @@ sidebar_position: 160
# FSAA Applet Certificate Management Overview
Communication between the FSAA Data Collector and the FSAA Applet is secure by default using HTTPS.
-For authentication, at least three certificates are required and need to be stored in the correct
+For authentication, FSAA requires at least three certificates. You store them in the correct
certificate store managed by the FSAA Data Collector. These three certificates are:
- The certificate authority (stored in the FSAA Certificate Authority Store)
@@ -16,32 +16,30 @@ certificate store managed by the FSAA Data Collector. These three certificates a
:::note
The FSAA Data Collector and Applet server support certificates in both the user’s
-certificate store and the computer’s certificate store. It is recommended to store certificates in
-the user's certificate store that is running the FSAA Data Collector or Applet server because
-administrative access is required for the computer's certificate store. When certificates are
-generated using the Automatic option below, they are stored in the user’s certificate store.
+certificate store and the computer’s certificate store. Netwrix recommends storing certificates in
+the user’s certificate store that is running the FSAA Data Collector or Applet server, because the
+computer’s certificate store requires administrative access. When you generate certificates using
+the **Automatic** option, FSAA stores them in the user’s certificate store.
:::
-There are three Certificate Exchange Options provided by the FSAA Data collector:
+The FSAA Data Collector provides three Certificate Exchange Options:
-- Automatic (Default Option) – The creation of a self-signed certificate and certificate exchange
- between the FSAA Data Collector and Applet are handled entirely by the FSAA Data Collector and
- Applet server
+- Automatic (Default Option) – The FSAA Data Collector and Applet server entirely handle the
+ creation of a self-signed certificate and certificate exchange between them
- The self-signed CA generated will be valid for two years and the FSAA Data Collector and
Applet server will also manage expired certificates and remove certificates that are no longer
valid from the FSAA stores
- Manual – The FSAA Data Collector will expect all certificates to be valid and in their respective
- certificate stores prior to running a scan
+ certificate stores before running a scan
- - To create and store certificates, the `FSAACertificateManager.exe` tool can be used. This
- application was created to simplify the process of creating certificates and will store the
- certificates in the location that the FSAA Data Collector and Applet server expect them to be
- stored. See the [FSAA Manual Certificate Configuration](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/manualcertificate.md) topic for
+ - To create and store certificates, use the `FSAACertificateManager.exe` tool. This
+ application simplifies the process of creating certificates and stores them in the location
+ that the FSAA Data Collector and Applet server expect. See the [FSAA Manual Certificate Configuration](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/manualcertificate.md) topic for
additional information.
The `FSAACertificateManager.exe` tool is located in the
@@ -50,30 +48,30 @@ There are three Certificate Exchange Options provided by the FSAA Data collector
with the `-help` command.
:::note
- If the FSAA Data Collector and Applet are on separate domains without a trust, this
- option must be used.
+ If the FSAA Data Collector and Applet are on separate domains without a trust, you must use
+ this option.
:::
- Provide Certificate Authority – The certificate exchange process is the same as with the Automatic
option. However, instead of creating a self-signed certificate, the FSAA Data Collector uses a
- certificate you provide through the FSAA Data Collector Wizard. The provided certificate is stored
- in the FSAA Certificate Authority Store.
+ certificate you provide through the FSAA Data Collector Wizard. FSAA stores the provided
+ certificate in the FSAA Certificate Authority Store.
:::note
- If the provided certificate is not self-signed as the Certificate Authority, the root
- certificate and the Certificate Authority’s certificate chain must also be stored in the FSAA
+ If the provided certificate isn’t self-signed as the Certificate Authority, you must also
+ store the root certificate and the Certificate Authority’s certificate chain in the FSAA
Certificate Authority Store on both the client and server hosts.
:::
:::warning
- The FSAA Applet does not support password-protected certificates. Certificates
- generated when the Automatic option is selected have no password. When manually creating a
- certificate for use with the FSAA Applet the password parameter should be omitted.
+ The FSAA Applet doesn't support password-protected certificates. Certificates
+ generated when you select the Automatic option have no password. When you manually create a
+ certificate for use with the FSAA Applet, omit the password parameter.
:::
-Additionally, the port used for secure certificate exchange can be configured by selecting the
+Additionally, you can configure the port used for secure certificate exchange by selecting the
Specify certificate exchange port checkbox on the Applet Settings page of the FSAA Data Collector
Wizard. The default port is 8767.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/manualcertificate.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/manualcertificate.md
index 6e8fdb1894..3fc7f891c2 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/manualcertificate.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/manualcertificate.md
@@ -14,15 +14,15 @@ case-sensitive.
## Create and store the required certificates
:::note
-In these steps, some commands need to be run on the Access Analyzer console and some on
+In these steps, you need to run some commands on the Access Analyzer console and some on
the Proxy host. In the provided example commands:
:::
-- All files that are generated by the Certificate Manager or copied to the Access Analyzer console
- are placed in the `%SAInstallDir%\PrivateAssemblies\FILESYSTEMACCESS\Applet\My Certificates`
+- The Certificate Manager places all files it generates, or that you copy to the Access Analyzer
+ console, in the `%SAInstallDir%\PrivateAssemblies\FILESYSTEMACCESS\Applet\My Certificates`
directory. The tool creates this folder if it doesn't already exist.
-- When operating on the proxy host, files are placed into the root of the **FSAA** folder
+- When you operate on the proxy host, the tool places files into the root of the **FSAA** folder
:::tip
Remember, all commands in the `FSAACertificateManager.exe` tool are case-sensitive.
@@ -121,8 +121,8 @@ You will delete these copied files from the destination directory later in Step
**Step 7 –** Generate the server certificate signing request and key on the Proxy host. On the proxy
-host, run the following command out of the FSAA folder where the `FSAACertificateManager.exe` was
-copied to:
+host, run the following command out of the FSAA folder where you copied
+`FSAACertificateManager.exe`:
```
.\FSAACertificateManager.exe -createCertificateSigningRequest -subjectDN CN=proxy01.my.domain.com -subjectAlternativeNames Proxy01 -outputPath . -name Proxy01
@@ -184,12 +184,12 @@ Successfully added FSAA_Server_Auth to Server
**Step 11 –** Repeat Steps 6-10 for each proxy host.
-**Step 12 –** Delete all the PFX, CER, and Key files that were generated or copied in the earlier
-steps from the output locations.
+**Step 12 –** Delete all the PFX, CER, and Key files you generated or copied in the earlier
+steps, from the output locations.
-You have now stored all the required FSAA certificates in the FSAA managed certificate stores. The
-FSAA queries need to be configured to use the **Manual** certificate exchange option. This option
-can be found under Applet Settings in the FSAA Data Collector Wizard. See the
+You have now stored all the required FSAA certificates in the FSAA managed certificate stores. You
+need to configure the FSAA queries to use the **Manual** certificate exchange option. You can find
+this option under Applet Settings in the FSAA Data Collector Wizard. See the
[FSAA: Applet Settings](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/appletsettings/appletsettings.md) topic for additional information.
For additional information on how to use the `FSAACertificateManager.exe` tool, run the
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/defaultscopingoptions.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/defaultscopingoptions.md
index 82eaf8d30a..9ba71f3b2c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/defaultscopingoptions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/defaultscopingoptions.md
@@ -6,9 +6,9 @@ sidebar_position: 80
# FSAA: Default Scoping Options
-The Default Scoping Options page is where scan settings, file details, and file properties settings
-can be configured for every resource in the targeted environment by the data collector. The settings
-assigned on this page are used by all resources involved in the scan. It is a wizard page for the
+Use the Default Scoping Options page to configure scan settings, file details, and file properties
+settings that the data collector applies to every resource in the targeted environment. All
+resources involved in the scan use the settings assigned on this page. It is a wizard page for the
categories of:
- File System Access/Permission Auditing Scan
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/filedetails.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/filedetails.md
index 59907c12d1..dcef17ff0b 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/filedetails.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/filedetails.md
@@ -6,11 +6,11 @@ sidebar_position: 20
# File Details Tab
-The File Details tab allows configuration of settings for file detail collection.
+Use the File Details tab to configure settings for file detail collection.
-Select the desired settings for additional scoping:
+Select the settings you want for additional scoping:
- Scan file-level details – Turns on file-level scanning and collects a full list of files, file
size, last modified, and last accessed
@@ -19,10 +19,10 @@ Select the desired settings for additional scoping:
**File tag metadata collection**
-- Collect tags/keywords from file metadata properties – Enables the collection of file Microsoft
- Office metadata tags and stores the tags into the tables when the **Scan file-level details**
- checkbox and the **Collect File Metadata Tags** checkbox are selected on the page. It only scans
- the files that satisfy the scan filter settings.
+- Collect tags/keywords from file metadata properties – Collects file Microsoft Office metadata
+ tags and stores them in the tables when you select the **Scan file-level details** checkbox
+ and the **Collect File Metadata Tags** checkbox on the page. It only scans the files that
+ satisfy the scan filter settings.
- Include offline files – Include offline files in the scan
- Only collect tags/keywords with the following comma-separated values (case-insensitive) – Collects
tags from the files and stores the tags into the tables. Filters results to only collect from
@@ -39,7 +39,7 @@ The Scan filter settings options are enabled if the **Scan file-level details**
selected.
- Only files larger than [number] [size unit] – Filters the results to only collect file data on
- files larger than the set value. If this option is not set, all file sizes are collected.
+ files larger than the set value. If this option isn't set, all file sizes are collected.
- Only files last modified more than [number] [time period] ago – Filters results to only collect
file data on files modified older than the set value
- Only files last modified less than [number] [time period] ago – Filters results to only collect
@@ -49,7 +49,7 @@ selected.
not set, all file types are collected.
:::warning
-Be careful when configuring these settings. If no filters are applied when file detail
-scanning has been enabled, it can result in returning large amounts of data to the database.
+Be careful when configuring these settings. If you don't apply filters while file detail
+scanning is enabled, the scan can return large amounts of data to the database.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/fileproperties.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/fileproperties.md
index ccbab1d904..542d2ed202 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/fileproperties.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/fileproperties.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# File Properties (Folder Summary) Tab
-The File Properties (Folder Summary) tab is where file property collection settings for the scan is
-configured.
+Use the File Properties (Folder Summary) tab to configure file property collection settings for
+the scan.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/scansettings.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/scansettings.md
index 54cf9a01a5..3c8c50faa2 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/scansettings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/scansettings.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Scan Settings Tab
-The Scan Settings tab allows configuration of data collection settings.
+Use the Scan Settings tab to configure data collection settings.
@@ -24,10 +24,10 @@ The Scan Settings tab has the following configurable options:
- Last Access Time (LAT) preservation – Preserves Data Access timestamp attribute on files that are
scanned for Metadata tags and sensitive data
- - Warn if unable to preserve Last Access Time – Scan throws a warning if the LAT cannot be
+ - Warn if unable to preserve Last Access Time – Scan throws a warning if the LAT can't be
preserved. The file is still scanned unless the Skip file if unable to preserve Last Access
Time checkbox is also selected.
- - Skip file if unable to preserve Last Access Time – Scan skips the file if the LAT cannot be
+ - Skip file if unable to preserve Last Access Time – Scan skips the file if the LAT can't be
preserved
Selecting the **Last Access Time (LAT) preservation** checkbox enables the **Action on failure to
@@ -37,13 +37,13 @@ enable LAT preservation** and **Action on changed LAT after scan** dropdown me
- Action on failure to enable LAT Preservation – Before scanning each file, FSAA attempts to enable
an operating system feature to preserve the LAT when accessing the file. This operation may fail
- for a variety of reasons, which include but are not limited to: the operating system or file
- system where the file is located does not support LAT preservation, or insufficient permissions
+ for a variety of reasons, which include but aren't limited to: the operating system or file
+ system where the file is located doesn't support LAT preservation, or insufficient permissions
from the service account trying to access the file. The following configuration addresses a
failure to enable the LAT preservation mode:
- Continue to scan file silently – FSAA scans the file with the possibility that LAT
- preservation is not possible. No warning will be shown.
+ preservation isn't possible. No warning will be shown.
- Continue to scan file with warning – FSAA scans the file with the possibility that LAT will
not be preserved. A warning will be shown for this file.
- Skip file silently – FSAA will not scan the file. No warning will be shown.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/overview.md
index b31a5abdf0..fee03cadcf 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/overview.md
@@ -32,13 +32,13 @@ available with a special Access Analyzer license. See the
**Sensitive Data Discovery Considerations**
If running Sensitive Data Discovery (SDD) scans, you must increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By default, SDD scans are
-configured to run two concurrent threads. For example, if the job is configured to scan 8 hosts at a
-time with two concurrent SDD threads, then an extra 32 GB of RAM are required (8x2x2=32).
+of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By default, SDD scans run two
+concurrent threads. For example, if a job scans 8 hosts at a time with two concurrent SDD threads, it
+requires an extra 32 GB of RAM (8x2x2=32).
## FSAA Query Configuration
-The FSAA Data Collector is configured through the File System Access Auditor Data Collector Wizard.
+Configure the FSAA Data Collector through the File System Access Auditor Data Collector Wizard.
The wizard contains the following pages, which change based up on the query category selected:
- [FSAA: Query Selection](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/queryselection.md)
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/queryselection.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/queryselection.md
index a5c9f1660d..7cfaf56cc3 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/queryselection.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/queryselection.md
@@ -34,7 +34,7 @@ auditing focus:
- Scan and import – Collects Distributed File System information
:::note
- Starting with v8.1, DFS Audits are completed with a streaming method and do not
+ Starting with v8.1, DFS Audits are completed with a streaming method and don't
require a bulk import query following the scan query.
:::
@@ -69,46 +69,46 @@ installed on the Access Analyzer Console before the FSAA Data Collector can coll
:::
-Once a query scan using the FSAA DC has been executed, the **Maintenance** button is enabled to
-allow troubleshooting of scan errors that may have occurred.
+After you run a query scan using the FSAA DC, the **Maintenance** button becomes available so you
+can troubleshoot scan errors that occurred.
:::warning
-Do not use the Maintenance button unless instructed by
-[Netwrix Support](https://www.netwrix.com/support.html). It is possible to cause corruption of the
-database and loss of data to occur.
+Don't use the Maintenance button unless instructed by
+[Netwrix Support](https://www.netwrix.com/support.html). Using it can corrupt the database and
+cause data loss.
:::
## Maintenance Wizard
-The Maintenance Wizard is opened by clicking the **Maintenance** button on the Query Selection page
-of the FSAA Data Collector Wizard. You can use the wizard to reset hosts or repair file system data
+Click the **Maintenance** button on the Query Selection page of the FSAA Data Collector Wizard to
+open the Maintenance Wizard. You can use the wizard to reset hosts or repair file system data
errors.
-The Maintenance Selection page allows you to select the type of maintenance to be performed:
+Use the Maintenance Selection page to select the type of maintenance to perform:
- Reset Hosts – Resets the Access GUID column value in the SA_FSAA_Hosts table for the Hosts
selected. Allows data to be bulk imported when there is a GUID mismatch.
- Repair – Resets the MinResourceID and MinTrusteeID column values to 0. Removes duplicate and data
consistency issues, including resources with nonexistent parents. Deletes StrucMap database.
-Select the required option and click **Next**. The subsequent wizard page is determined by the
-selection made.
+Select the required option and click **Next**. Your selection determines which wizard page displays
+next.
-- If Reset Hosts was selected, the Reset Hosts page displays:
+- If you select Reset Hosts, the Reset Hosts page displays:
- Select the desired hosts to reset the SQL data for, and click **Reset Hosts** to perform the
+ Select the hosts you want to reset the SQL data for, and click **Reset Hosts** to perform the
maintenance.
-- If Repair was selected, the Repair Tool page displays:
+- If you select Repair, the Repair Tool page displays:
- Select the desired hosts to repair the SQL data for, and click **Run** to perform the
+ Select the hosts you want to repair the SQL data for, and click **Run** to perform the
maintenance.
Click **Finish** to close the wizard when you have completed the required maintenance.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scanserverselection.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scanserverselection.md
index bbb31ff98c..c607a2be6e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scanserverselection.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scanserverselection.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# FSAA: Scan Server Selection
-The Scan Server Selection page is where the server that executes the scan is configured. It is a
+Use the Scan Server Selection page to configure the server that executes the scan. It is a
wizard page for the categories of:
- File System Access/Permission Auditing Scan
@@ -15,7 +15,7 @@ wizard page for the categories of:
-Using the radio buttons, select where the execution of the applet will take place:
+Using the radio buttons, select where the applet runs:
- Automatic (Local for NAS device hosts, Remote for Windows hosts) – Applet is deployed to all
targeted Windows servers. Other targeted devices, for example NAS, are scanned locally by the
@@ -44,16 +44,16 @@ Using the radio buttons, select where the execution of the applet will take plac
choose from. If more than one list is selected, scanning is distributed across each host.
:::info
-It is best practice in global implementations to utilize a specific remote server or proxy scanner
+It is best practice in global implementations to use a specific remote server or proxy scanner
that is located in the same data center as the target hosts. This is particularly beneficial if the
Access Analyzer Console server is in a different data center. See the
[Proxy Scanning Architecture](/docs/accessanalyzer/12.0/install/filesystemproxy/overview.md#proxy-scanning-architecture)
topic for additional information.
:::
-In the bottom section, the checkbox options affect the execution of the applet:
+In the bottom section, the checkbox options affect how the applet runs:
-- Fallback to local mode if applet can't start – If the applet cannot be deployed on the target
+- Fallback to local mode if applet can't start – If the applet can't be deployed on the target
host, it is deployed locally on the same server as the Access Analyzer Console and the scan
collects data across the network
- Run remote applet with normal priority (non-proxy applet server uses background priority by
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scansettings.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scansettings.md
index 8a9d25a5a3..3bc137cada 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scansettings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scansettings.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# FSAA: Scan Settings
-The Scan Settings page is where additional scan protocols and settings are configured. It is a
+Use the Scan Settings page to configure additional scan protocols and settings. It is a
wizard page for the categories of:
- System Access/Permission Auditing Scan
@@ -14,16 +14,16 @@ wizard page for the categories of:
-In the Scan Protocols section, select the desired checkboxes for including certain types of shared
+In the Scan Protocols section, select the checkboxes you want for including certain types of shared
folders:
- Scan Windows (SMB/CIFS) shares – Includes types of Windows and NAS shares
- Scan NFS exports (shares) – Includes this type of UNIX and NAS shares
-In the middle section, select the desired checkboxes for additional settings:
+In the middle section, select the checkboxes you want for additional settings:
- Enable file system scan streaming – Sends the streamed data directly to the Access Analyzer
- database. A bulk import query is not required when this option is selected
+ database. A bulk import query isn't required when this option is selected
- Enable scanning of files protected by Azure Information Protection – Adds additional options to
this wizard to scan for protection labels and encrypted files for sensitive data
@@ -37,7 +37,7 @@ In the middle section, select the desired checkboxes for additional settings:
permissions. Click **Configure Query** to open the Manual Shares Query window. See the
[Enable the Use SQL Query to Manually Specify Shares](#enable-the-use-sql-query-to-manually-specify-shares)
topic for additional information.
-- NetApp communication security – This option provides the ability to choose levels of encryption
+- NetApp communication security – This option lets you choose levels of encryption
and authentication applied during Access Auditing scans of NetApp devices
@@ -84,7 +84,7 @@ columns for all shares in the target environment:
- Host – Name of host where the share resides matching the Host Master table Name field value
:::info
- Use this column but it is not required.
+ Use this column but it isn't required.
:::
@@ -95,8 +95,8 @@ columns for all shares in the target environment:
- 0 = CIFS share
- 1 = NFS share
-For example, if the share has a path of `\\cec-fs01\Documentation`, then the columns are populated
-in this way:
+For example, if the share has a path of `\\cec-fs01\Documentation`, the query populates the columns
+as follows:
- Host – `cec-fs01`
- Share – `Documentation`
@@ -104,8 +104,8 @@ in this way:
- ShareType – `0`
:::warning
-If the FSAA Data Collector has identified a share in a previous scan, but that share is
-not in a table targeted by this query, then it is marked as a deleted share.
+If the FSAA Data Collector identified a share in a previous scan, but that share isn't
+in a table targeted by this query, the data collector marks it as a deleted share.
:::
@@ -118,11 +118,11 @@ the data for that host.
Select **Test Query** to open a preview of the results in the Query Results window. Ensure that the
data being retrieved by the query is expected.
-When this option is selected, the data collector runs against the target table to enumerate shares
+When you select this option, the data collector runs against the target table to enumerate shares
in the environment.
:::tip
-Remember, if a share is not in the target table, the data collector assumes that the share does
+Remember, if a share isn't in the target table, the data collector assumes that the share does
not exist and marks it as deleted.
:::
@@ -131,7 +131,7 @@ not exist and marks it as deleted.
The HTTPS encryption options for the NetApp communication security setting of the global Remote Data
Collection Configuration page in the File System Access Auditor Data Collector Wizard requires a
-certificate. If the organization uses a self-signed certificate, it is necessary to add this
+certificate. If the organization uses a self-signed certificate, add this
certificate to enable HTTPS encryption of Access Analyzer communications.
The certificate (`cacert.pem`) which is shipped with Access Analyzer is in the DC folder of the
@@ -139,16 +139,16 @@ installation directory. The default location is:
**…\STEALTHbits\StealthAUDIT\DC**
-If employing remote applet mode or proxy servers, then the certificate (`cacert.pem`) must exist in
+If you use remote applet mode or proxy servers, the certificate (`cacert.pem`) must exist in
the FSAA folder where the `FSAAAppletServer.exe` process is running (applet/proxy host). Therefore,
-it is necessary to also copy it to the FSAA folder on the target hosts andr proxy servers. This is
-done at runtime when using remote applet mode, but any updates or custom certificates must be copied
-manually. The default location is:
+also copy it to the FSAA folder on the target hosts and proxy servers. The system copies it
+automatically at runtime when you use remote applet mode, but you must copy any updates or custom
+certificates manually. The default location is:
**…\STEALTHbits\StealthAUDIT\FSAA**
:::info
-Do not overwrite this certificate. It is fully trusted by Netwrix. Instead, add
+Don't overwrite this certificate. Netwrix fully trusts it. Instead, add
an underscore (\_) character to the start of the file name. Then copy the organization’s self-signed
certificate to this location with the name `cacert.pem`.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scopingoptions.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scopingoptions.md
index e617329afd..f63d319037 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scopingoptions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scopingoptions.md
@@ -6,8 +6,8 @@ sidebar_position: 90
# FSAA: Scoping Options
-The Scoping Options page is where scan settings, file details, and file properties settings can be
-configured for a specified resource in the targeted environment. It is a wizard page for the
+Use the Scoping Options page to configure scan settings, file details, and file properties settings
+for a specified resource in the targeted environment. It is a wizard page for the
following categories:
- File System Access/Permission Auditing Scan
@@ -27,15 +27,15 @@ The Scoping Options buttons have the following:
conflicting settings occur with one resource
- Import – Import scoping options from a `.fsaascope` file.
- - If a conflict arises between an existing configured scoping option and an option that is being
- imported, the user will be prompted to resolve the conflict by either keeping the existing
- configuration or importing the new one, which will overwrite the scoping option.
+ - If a conflict arises between an existing configured scoping option and the option being
+ imported, the system prompts you to resolve the conflict by keeping the existing
+ configuration or importing the new one, which overwrites the scoping option.
-- Export – Take the currently configured scoping options in the job and export it to a `.fsaascope`
+- Export – Take the configured scoping options in the job and export it to a `.fsaascope`
file
-By default, priority is assigned in the order it is added to the table. Priority can also be
-manually assigned with the Increase Priority and Decrease Priority buttons or in the
+By default, priority follows the order in which you add items to the table. You can also manually
+assign priority with the Increase Priority and Decrease Priority buttons or in the
[Scoping Configuration Window](#scoping-configuration-window). If there is a conflict between an
inclusion scoping option and an exclusion scoping option with the same priority, the inclusion takes
precedence.
@@ -45,8 +45,8 @@ scoping options and the expected results.
## Scoping Configuration Window
-The Scoping Configuration Window allows a specific share or folder to be included or excluded from
-the scan. Only included resources require additional scoping. Remember, these settings override the
+Use the Scoping Configuration Window to include or exclude a specific share or folder from the
+scan. Only included resources require additional scoping. Remember, these settings override the
default scoping settings for the selected resource.
@@ -54,7 +54,7 @@ default scoping settings for the selected resource.
Set the Resource Name and Host Name:
- Resource Name – Specify a local path or individual share to the target folder or the share name
-- Host Name – Apply scoping options to a specific target host. If a host name is not supplied, all
+- Host Name – Apply scoping options to a specific target host. If a host name isn't supplied, all
hosts targeted by the job have the scoping options applied.
Both the Resource Name and Host Name textboxes support regular expressions and pattern matching.
@@ -94,15 +94,15 @@ Then set Scoping Type and Priority:
:::note
Any included files or folders inherit all options previously checked in the
[FSAA: Default Scoping Options](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/defaultscopingoptions/defaultscopingoptions.md) page. Manually apply new options if
- the default ones are not desired in this scan.
+ the default ones aren't desired in this scan.
:::
- Priority – Numerical value that determines which options are used in the case of more than one
scoping option overlaps for a particular resource. Lower numerical values have a higher priority
for this scan. When multiple scoping options are added to a single resource, and there is no
- conflict, the scoping options are merged. However, in some instances, the settings conflict. Below
- are some known conflicts and their results:
+ conflict, the scoping options are merged. However, in some instances, the settings conflict. The
+ following are some known conflicts and their results:
- Conflict between two options for a single resource – Higher priority takes precedence
- Folder scoping option conflicts with a share scoping option – Folder takes precedence
- Conflict between two scoping options with the same priority – Path determines which option is
@@ -176,11 +176,13 @@ All other folder paths are excluded.
**Additional Considerations**
-The scoping options listed above can be used to scope for SMB shares and NFS exports but NFS exports
-are enumerated differently. The include/exclude logic outlined above should be the same for both,
-but when scoping for NFS exports the Resource Name should be the full path to the export.
+Use the scoping options described in
+[Scoping Configuration Window](#scoping-configuration-window) to scope for SMB shares and NFS
+exports, but NFS exports are enumerated differently. The include/exclude logic described earlier
+in this section should be the same for both, but when scoping for NFS exports the Resource Name
+should be the full path to the export.
-For example, in the scenario below, the NFS export named NFS_Export is included. All other exports
+For example, in the following scenario, the NFS export named NFS_Export is included. All other exports
are excluded. Within the NFS_Export export, folder path \ifs\NFS_Export\Test_Folder is included. All
other folder paths are excluded.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scopingqueries.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scopingqueries.md
index 1661d19d49..4ae51f993d 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scopingqueries.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/scopingqueries.md
@@ -48,17 +48,17 @@ The Scoping Queries buttons have the following functionality:
:::note
These two Scan Resource Filters are both Share Include queries by default. To restrict the
-scan to only Open Shares or only DFS Shares it is necessary to also configure the Scoping Options on
+scan to only Open Shares or only DFS Shares, also configure the Scoping Options on
the previous page of the wizard to exclude all other shares.
:::
-For example, to restrict the scan to only Open Shares and exclude all other shares, the Scoping
-Options page should be configured as shown:
+For example, to restrict the scan to only Open Shares and exclude all other shares, configure the
+Scoping Options page as shown:
-The Scoping Queries page should be configured as shown:
+Configure the Scoping Queries page as shown:
@@ -67,8 +67,8 @@ scoping scenarios.
## Scoping Query Configuration Window
-The Scoping Query Configuration window allows you to create a custom Scoping Query to specify shares
-and folders to be included in or excluded from the scan.
+Use the Scoping Query Configuration window to create a custom Scoping Query that specifies shares
+and folders to include in or exclude from the scan.
@@ -93,8 +93,6 @@ Scoping Options Query Configuration window.
-Follow the steps to configure a query.
-
**Step 1 –** Enter a SQL Query that will return a list of resources to be included in or excluded
from the scan.
@@ -115,5 +113,5 @@ Ensure that the data being retrieved by the query is expected.
**Step 4 –** Click **OK**.
-When a query configuration is enabled, the data collector runs against the target table to configure
+When you enable a query configuration, the data collector runs against the target table to configure
scoping for shares or folders in the environment.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/sddcriteria.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/sddcriteria.md
index 165b34989f..5f83b30948 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/sddcriteria.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/sddcriteria.md
@@ -6,8 +6,8 @@ sidebar_position: 120
# FSAA: SDD Criteria Settings
-The SDD Criteria Settings page is where criteria to be used for discovering sensitive data during a
-scan is configured. It is a wizard page for the category of Sensitive Data Scan.
+Use the SDD Criteria Settings page to configure criteria for discovering sensitive data during a
+scan. It is a wizard page for the category of Sensitive Data Scan.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/sensitivedatasettings.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/sensitivedatasettings.md
index 97dbafa8f1..59835126d3 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/sensitivedatasettings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/sensitivedatasettings.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# FSAA: Sensitive Data Settings
-The Sensitive Data Settings page is where sensitive data discovery settings are configured. It is a
+Use the Sensitive Data Settings page to configure sensitive data discovery settings. It is a
wizard page for the category of Sensitive Data Scan.
@@ -19,10 +19,9 @@ wizard page for the category of Sensitive Data Scan.
sensitive data within digital images of physical documents
:::note
- The OCR option is intended to work for clear scanned physical documents or documents
- directly converted to images, with standard fonts. It will not work for scanning photos of
- documents and may not be able to recognize text on images of credit cards, driver's licenses, or
- other identity cards.
+ The OCR option works for clear scanned physical documents or documents directly converted to
+ images, with standard fonts. It doesn't work for scanning photos of documents and may not
+ recognize text on images of credit cards, driver's licenses, or other identity cards.
:::
@@ -45,7 +44,7 @@ Use the radio buttons to select the File types to scan:
- Spreadsheets
- Text/Markup files
-- Perform differential scan of – Enables users to choose whether to employ incremental scanning:
+- Perform differential scan of – Choose whether to employ incremental scanning:
- Files modified or newly discovered since last scan – Scans newly discovered files and files
with a modified date after the previous scan date
@@ -53,10 +52,10 @@ Use the radio buttons to select the File types to scan:
- Files modified within the last [number] days – Only scans files with a modified date within
the specified date range
-The Performance Options section allows the user to modulate the efficiency of SDD scans.
+Use the Performance Options section to adjust the efficiency of SDD scans.
- Number of SDD scan processes [number] – Increases the number of SDD scanner processes that spawn
- as part of a scan, increasing parallel scanning. The value should not exceed 2x the number of CPU
+ as part of a scan, increasing parallel scanning. The value shouldn't exceed 2x the number of CPU
threads available.
:::info
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/standardtables.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/standardtables.md
index b45d6f6103..cdcd903dd0 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/standardtables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/standardtables.md
@@ -12,7 +12,7 @@ these tables regardless of the job executing the query.
## File System Access Auditing Tables & Views
-The tables and their associated views are grouped by types.
+The following sections group the tables and their views by type.
**Structure Tables**
@@ -26,9 +26,9 @@ The tables and their associated views are grouped by types.
| Tables | Details |
| -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SA_FSAA_Trustees | Contains information about any domain user, group, or security principal that has been assigned permissions. This table does not contain local users and groups since none of the trustees in this table are specific to any one host. |
-| SA_FSAA_LocalTrustees | Contains information about any trustees that do not belong to a domain, primarily local users and local groups |
-| SA_FSAA_TrusteeEquivalence | Contains information about Local Group membership. The trustees described can be found in the SA_FSAA_LocalTrustees table. |
+| SA_FSAA_Trustees | Contains information about any domain user, group, or security principal that has been assigned permissions. This table doesn't contain local users and groups since none of the trustees in this table are specific to any one host. |
+| SA_FSAA_LocalTrustees | Contains information about any trustees that don't belong to a domain, primarily local users and local groups |
+| SA_FSAA_TrusteeEquivalence | Contains information about Local Group membership. The SA_FSAA_LocalTrustees table contains the trustees described. |
**Access Calculation Tables**
@@ -68,8 +68,8 @@ The tables and their associated views are grouped by types.
| SA_FSAA_SchemaVer | Tracks the schema version of the tables for upgrading purposes |
Views are the recommended way for Access Analyzer users to obtain the information gathered by the
-FSAA Data Collector. They contain additional information for building queries easily. The following
-is an explanation of the corresponding views created for some of the tables generated by the FSAA
+FSAA Data Collector. They contain additional information for building queries. The following
+describes the corresponding views created for some of the tables generated by the FSAA
Data Collector:
**Permission Views**
@@ -99,7 +99,7 @@ Data Collector:
## File System Activity Auditing Tables & Views
-The tables and their associated views are grouped by types.
+The following sections group the tables and their views by type.
**Activity Changes Tables (FSAC)**
@@ -117,8 +117,8 @@ The tables and their associated views are grouped by types.
| SA_FSAC_UserExceptionTypes | Identifies how many instances of user exceptions exist on the audited hosts |
Views are the recommended way for Access Analyzer users to obtain the information gathered by the
-FSAA Data Collector. They contain additional information for building queries easily. The following
-is an explanation of the corresponding views created for some of the tables generated by the FSAA
+FSAA Data Collector. They contain additional information for building queries. The following
+describes the corresponding views created for some of the tables generated by the FSAA
Data Collector:
**Activity Change Views (FSAC)**
@@ -135,7 +135,7 @@ Data Collector:
## File System DFS Auditing Tables & Views
-The tables and their associated views are grouped by types.
+The following sections group the tables and their views by type.
**FSDFS Tables**
@@ -145,8 +145,8 @@ The tables and their associated views are grouped by types.
| SA_FSDFS_Namespaces | Contains a list of all of the domain and server namespaces with corresponding links to the SA_FSAA_Hosts table |
Views are the recommended way for Access Analyzer users to obtain the information gathered by the
-FSAA Data Collector. They contain additional information for building queries easily. The following
-is an explanation of the corresponding views created for some of the tables generated by the FSAA
+FSAA Data Collector. They contain additional information for building queries. The following
+describes the corresponding views created for some of the tables generated by the FSAA
Data Collector:
**FSDFS Views**
@@ -157,7 +157,7 @@ Data Collector:
## File System Sensitive Data Discovery Auditing (SEEK) Tables & Views
-The tables and their associated views are grouped by types.
+The following sections group the tables and their views by type.
**FSDLP Tables**
@@ -170,8 +170,8 @@ The tables and their associated views are grouped by types.
| SA_FSDLP_MatchHits_SubjectProfile | Contains the actual sensitive data within files that matched selected criteria for subject profiles |
Views are the recommended way for Access Analyzer users to obtain the information gathered by the
-FSAA Data Collector. They contain additional information for building queries easily. The following
-is an explanation of the corresponding views created for some of the tables generated by the FSAA
+FSAA Data Collector. They contain additional information for building queries. The following
+describes the corresponding views created for some of the tables generated by the FSAA
Data Collector:
**FSDLP Views**
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/workflows.md b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/workflows.md
index d6a70ac09d..4d88448650 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/fsaa/workflows.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/fsaa/workflows.md
@@ -26,19 +26,19 @@ Additional workflows include:
- Drop Tables & Views – Drops the standard reference tables and views
:::tip
-Remember, the FSAA Data Collector always records data in Standard Reference Tables, no matter what
-job it is applied to.
+Remember, the FSAA Data Collector always records data in Standard Reference Tables, no matter which
+job runs it.
:::
## Remove File System Access Scan Category
-The FSAA Data Collector can be used to clean-up or troubleshoot the applet and proxy scanning
-servers. This would need to be done through a new job’s query. Set the host list and Connection
-Profile to target the desired applet and proxy servers.
+Use the FSAA Data Collector to clean up or troubleshoot the applet and proxy scanning
+servers. Do this through a new job’s query. Set the host list and Connection
+Profile to target the applet and proxy servers you want.
-Follow these steps to build a new query using the FSAA Data Collector with the Remove scan
-executables and data category.
+To build a new query using the FSAA Data Collector with the Remove scan
+executables and data category:
**Step 1 –** Navigate to the **Configure** node of a new or chosen job and select the **Queries**
node.
@@ -46,7 +46,7 @@ node.
**Step 2 –** In the Query Selection view, click the **Create Query** link. The Query Properties
window displays.
-**Step 3 –** Select the **Data Source** tab. From the **Data Collector** drop-down menu, select
+**Step 3 –** Select the **Data Source** tab. From the **Data Collector** dropdown menu, select
**FILESYSTEMACCESS** and then click the **Configure** button. The File System Access Auditor Data
Collector Wizard opens.
@@ -57,25 +57,25 @@ Collector Wizard opens.
**Step 5 –** Click **Finish** to save the selection and close the wizard. Then click **OK** to close
the Query Properties window.
-This job has now been configured to run the FSAA Data Collector to remove the file system access
+You've now configured this job to run the FSAA Data Collector and remove the file system access
audit scan applet and data from the target server. Run the job to clean-up the targeted hosts.
## Update Proxy Service Category
-The FSAA Data Collector can be used to upgrade the File System Proxy Service already installed on
+Use the FSAA Data Collector to upgrade the File System Proxy Service already installed on
proxy servers. The FS_UpdateProxy Job is preconfigured to run with the default settings with the
category of Update proxy service. It is available through the Instant Job Library under the File
System library.
-The Update Proxy Service category option enables users with the ability to update v8.0+ File System
-Proxy Service installations to newer versions. When this query is employed, the job compresses the
-updated binaries and deploy them to the proxy server. Once the proxy server has no active sessions,
-the Netwrix Access Analyzer (formerly Enterprise Auditor) FSAA Proxy Scanner service shuts down and
-the components are updated. Finally, the service restarts itself.
+The Update Proxy Service category option lets users update v8.0+ File System Proxy Service
+installations to newer versions. When you use this query, the job compresses the updated binaries
+and deploys them to the proxy server. When the proxy server has no active sessions, the Netwrix
+Access Analyzer (formerly Enterprise Auditor) FSAA Proxy Scanner service shuts down and updates the
+components. Finally, the service restarts itself.
:::note
-This option is not for updating v7.x File System Proxy installations. Those must be
-manually updated to at least v8.0 on the proxy server before this query can be used to automate the
+This option isn't for updating v7.x File System Proxy installations. You must manually update
+those to at least v8.0 on the proxy server before you can use this query to automate the
process.
:::
@@ -85,14 +85,14 @@ the FS_UpdateProxy Job.
## Remove Host Category
-The FSAA Data Collector can be used to clean-up the Standard Reference Tables by removing data for
-particular hosts. This would need to be done through a new job’s query. The host to be removed is
-set as the host list for the new job. The Connection Profile applied should be the same as the one
+Use the FSAA Data Collector to clean up the Standard Reference Tables by removing data for
+particular hosts. Do this through a new job’s query. Set the host to remove as the host list for
+the new job. The Connection Profile applied should be the same as the one
used for the associated **FileSystem** > **0.Collection** > … **Bulk Import** Job.
:::warning
-Be careful when applying this query task, as it results in the deletion of collected
-data. Ensure proper configuration prior to job execution.
+Be careful when applying this query task, as it deletes collected
+data. Ensure proper configuration before job execution.
:::
@@ -101,8 +101,8 @@ Manually enter individual hosts into the host list executing this query.
:::
-Follow the steps to build a new query using the FSAA Data Collector with the Remove host data
-category.
+To build a new query using the FSAA Data Collector with the Remove host data
+category:
**Step 1 –** Navigate to the **Configure** node of a new or chosen job and select the **Queries**
node.
@@ -110,7 +110,7 @@ node.
**Step 2 –** In the Query Selection view, click the **Create Query** link. The Query Properties
window displays.
-**Step 3 –** Select the **Data Source** tab. From the **Data Collector** drop-down menu, select
+**Step 3 –** Select the **Data Source** tab. From the **Data Collector** dropdown menu, select
**FILESYSTEMACCESS** and then click **Configure**. The File System Access Auditor Data Collector
Wizard opens.
@@ -121,25 +121,25 @@ Wizard opens.
**Step 5 –** Click **Finish** to save the selection and close the wizard. Then click **OK** to close
the Query Properties window.
-This job has now been configured to run the FSAA Data Collector to remove the host identified in the
+You've now configured this job to run the FSAA Data Collector and remove the host identified in the
job’s **Configure** > **Hosts** node. Run the job to clean-up the targeted hosts.
:::tip
Remember, this job deletes data from the Access Analyzer database. Use caution and ensure proper
-configuration prior to job execution.
+configuration before job execution.
:::
## Remove Host and Criteria SDD Data
The FS_SDD_DELETE job removes host and criteria sensitive data matches from the Tier 1 database. It
-is preconfigured to run analysis tasks with temporary tables that requires modification prior to job
+is preconfigured to run analysis tasks with temporary tables that requires modification before job
execution. It is available through the Instant Job Library under the File System library. See the
[Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md) topic for additional information.
-The 0.Collection Job Group must be run before executing the FS_SDD_DELETE Job.
+Run the 0.Collection Job Group before executing the FS_SDD_DELETE Job.
### Analysis Tasks for the FS_SDD_DELETE Job
@@ -147,7 +147,7 @@ The analysis tasks are deselected by default. View the analysis tasks by navigat
**Jobs** > **FS_SDD_DELETE** > **Configure** node and select **Analysis**.
:::warning
-Applying these analysis tasks result in the deletion of collected data.
+Applying these analysis tasks deletes collected data.
:::
@@ -159,9 +159,9 @@ Applying these analysis tasks result in the deletion of collected data.
### Configure the FS_SDD_DELETE Analysis Tasks
-Follow the steps to configure and run the analysis tasks.
+Configure and run the analysis tasks:
-**Step 1 –** Prior to job execution, modify the desired analysis tasks using the
+**Step 1 –** Before job execution, modify the analysis tasks you want using the
[Customizable Analysis Parameters for FS_SDD_DELETE Job](#customizable-analysis-parameters-for-fs_sdd_delete-job)
instructions.
@@ -174,17 +174,17 @@ status is visible from the **Running Instances** node.
analysis tasks.
:::warning
-Do not leave these analysis tasks checked in order to avoid accidental data loss.
+Don't leave these analysis tasks checked to avoid accidental data loss.
:::
-All of these tables have been dropped from the SQL Server database and the data is no longer
+The job has dropped all of these tables from the SQL Server database, and the data is no longer
available.
### Customizable Analysis Parameters for FS_SDD_DELETE Job
-A customizable parameter enables Access Analyzer users to set the sensitive data values that will be
-deleted during this job’s analysis.
+A customizable parameter lets Access Analyzer users set the sensitive data values that this job
+deletes during its analysis.
| Analysis Task | Customizable Parameter Name | Value Indicates |
| ---------------------- | --------------------------- | --------------------------------------------- |
@@ -192,12 +192,11 @@ deleted during this job’s analysis.
| Delete Criteria | #Criteria | List of Criteria to be removed |
| Remove Host & Criteria | #Criteria #hosts | List of Criteria and Host Names to be removed |
-The parameters that can be customized are listed in a section at the bottom of the SQL Script
-Editor. Follow the steps to customize analysis task parameters.
+You can customize these parameters in a section at the bottom of the SQL Script Editor. To customize analysis task parameters:
**Step 1 –** Navigate to the **FS_SDD_DELETE** > **Configure** node and select **Analysis**.
-**Step 2 –** In the Analysis Selection view, select the desired analysis task and click on
+**Step 2 –** In the Analysis Selection view, select the analysis task you want and click
**Analysis Configuration**. The SQL Script Editor opens.
@@ -207,7 +206,7 @@ or **#hosts** row, depending on the analysis task chosen, and then **Edit Table*
window opens.
:::warning
-Do not change any parameters where the Value states `Created during execution`.
+Don't change any parameters where the Value states `Created during execution`.
:::
@@ -224,7 +223,7 @@ to save any changes. Other Edit Table buttons include:
**Step 5 –** Click Save and Close to finalize the customization and close the SQL Script Editor.
-The job is now ready to be executed.
+The job is now ready to run.
## Drop Tables & Views
@@ -246,7 +245,7 @@ The analysis tasks are deselected by default. View the analysis tasks by navigat
**Jobs** > **FS_DropTables** > **Configure** node and select **Analysis**.
:::warning
-Applying these analysis tasks result in the deletion of collected data.
+Applying these analysis tasks deletes collected data.
:::
@@ -261,7 +260,7 @@ Applying these analysis tasks result in the deletion of collected data.
- **4. Drop FSDFS Tables** – Drops the File System DFS Auditing tables imported from the previous runs
- **5. Drop FSAA Tables** – Drops File System Access Auditing tables imported from the previous runs
-Do not try to run these tasks separately, as they are designed to work together. Follow these steps
+Don't try to run these tasks separately, as they are designed to work together. Follow these steps
to run the analysis tasks:
**Step 1 –** In the Analysis Selection Pane, click **Select All**. All tasks will be checked.
@@ -273,9 +272,9 @@ status is visible from the **Running Job** node.
All** to deselect these analysis tasks.
:::warning
-Do not leave these analysis tasks checked in order to avoid accidental data loss.
+Don't leave these analysis tasks checked to avoid accidental data loss.
:::
-All of these tables have been dropped from the SQL Server database and the data is no longer
+The job has dropped all of these tables from the SQL Server database, and the data is no longer
available.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/category.md b/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/category.md
index 09b98f598c..54c65db4b9 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/category.md
@@ -6,23 +6,23 @@ sidebar_position: 10
# GroupPolicy: Category
-On the GroupPolicy Data Collector Category page, select the required query category to be executed.
+On the GroupPolicy Data Collector Category page, select the required query category to run.
The available categories are:
- Group Policy Objects – Retrieves the GPO’s list in the domain and where each is linked
-- Policies State – Provides the ability to return information on configured policies and policy
+- Policies State – lets you return information on configured policies and policy
parts from the individual policies which have been selected
- - For example, selecting **Account Policies** > **Policy Password** will result in **Account
- Policies** > **Policy Password** being returned for the targeted domains
+ - For example, if you select **Account Policies** > **Policy Password**, the results include
+ **Account Policies** > **Policy Password** for the targeted domains
-- Policies State for all GPOs – Provides the ability to return information on selected policy parts
+- Policies State for all GPOs – lets you return information on selected policy parts
from all policies within the domain
- - For example, selecting **Account Policies** > **Password Policy** will result in **Password
- Policy** being returned for all policies in the targeted domains
+ - For example, if you select **Account Policies** > **Password Policy**, the results include
+ **Password Policy** for all policies in the targeted domains
- Local policies – Returns effective security policies in effect at the individual workstation
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/options.md b/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/options.md
index e100cffcaa..2c64653e2c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/options.md
@@ -6,14 +6,14 @@ sidebar_position: 40
# GroupPolicy: Options
-The Options page is used to configure how to return multi-valued properties and how policy results
-are presented. It is a wizard page for all categories.
+Use the Options page to configure how to return multi-valued properties and how to present policy
+results. It is a wizard page for all categories.
The configurable options are:
-- Result Presentation – Select one of the following options. This section is not available for the
+- Result Presentation – Select one of the following options. This section isn't available for the
Group Policy Objects category.
- Each part of each policy on a new row
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/overview.md
index 125793c892..a6cf34f161 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/overview.md
@@ -6,13 +6,13 @@ sidebar_position: 240
# GroupPolicy Data Collector
-The GroupPolicy Data Collector provides the ability to retrieve the GPO’s list in the domain and
+The GroupPolicy Data Collector lets you retrieve the GPO’s list in the domain and
where they are linked, return information on configured policies and policy parts from the
-individual policies that have been selected, return information on selected policy parts from all
+individual policies you select, return information on selected policy parts from all
policies within the domain, and return effective security policies in effect at the individual
workstation.
-The GroupPolicy Data Collector is a core component of Access Analyzer, but it has been preconfigured
+The GroupPolicy Data Collector is a core component of Access Analyzer, but it comes preconfigured
within the Active Directory Solution and the Windows Solution. While the data collector is available
with all Access Analyzer license options, the Windows Solution is only available with a special
Access Analyzer licenses. See the following topics for additional information:
@@ -38,7 +38,7 @@ Access Analyzer licenses. See the following topics for additional information:
## GroupPolicy Query Configuration
-The GroupPolicy Data Collector is configured through the Group Policy Data Collector Wizard. The
+Configure the GroupPolicy Data Collector through the Group Policy Data Collector Wizard. The
available pages change based upon the query category selected. It contains the following wizard
pages:
@@ -51,5 +51,5 @@ pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+To hide the Welcome page, select the **Don't display this page the next time** checkbox while the
+wizard is open; the wizard saves your configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/policieslist.md b/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/policieslist.md
index f063e5361a..df3bb1bf34 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/policieslist.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/policieslist.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# GroupPolicy: Policies List
-The Policies List page is where the policies from the desired GPOs to be queried are selected. It is
+Use the Policies List page to select the policies from the GPOs you want to query. It is
a wizard page for the categories of:
- Policies State
@@ -15,10 +15,10 @@ a wizard page for the categories of:
-Select the policies or policy parts to be audited. The category dictates how this selection is
-applied across the domain or local host.
+Select the policies or policy parts you want to audit. The category dictates how this selection
+applies across the domain or local host.
-To search parts of a policy, drill into the policy and select the desired policy parts. Click
+To search parts of a policy, drill into the policy and select the policy parts you want. Click
**Check all** to select all properties, and click **Uncheck all** to deselect all properties. Search
for a policy by entering a policy name in the Search box and clicking **Search**.
@@ -27,4 +27,4 @@ The policy parts returned may have multiple values.
:::
-At least one policy or policy part must be selected in order to proceed to the next wizard page.
+You must select at least one policy or policy part to proceed to the next wizard page.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/summary.md
index 61f1da8d45..02e385e3b3 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/summary.md
@@ -10,6 +10,6 @@ The Summary page displays a summary of the configured query. It is a wizard page
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Group Policy Data Collector Wizard to ensure that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** to close
+the Group Policy Data Collector Wizard as a best practice, ensuring the wizard doesn't save any
+accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/target.md b/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/target.md
index 42b2f688f3..fa959c71c7 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/target.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/grouppolicy/target.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# GroupPolicy: Target
-The Target page is where a host from which to get data (in wizard only) and .admx source are
-identified. It is a wizard page for the categories of:
+Use the Target page to identify the host to get data from (wizard only) and the .admx source. It is
+a wizard page for the categories of:
- Policies State
- Policies State for all GPOs
@@ -19,14 +19,14 @@ In the Connect to section of the page, select from the following options:
- Default domain – Select this option to connect to the default domain
- This domain – Select this option and click the ellipsis to open the Browse for Domain window. Then
- select the desired domain. Click **OK**.
+ select the domain you want. Click **OK**.
-In the Use these job credentials to browse section of the page, if multiple credentials are set up,
-select the credentials to use for the query from the dropdown menu.
+In the Use these job credentials to browse section of the page, if you've set up multiple
+credentials, select the credentials to use for the query from the dropdown menu.
:::note
-If the Default Connection profile has only one set of credentials, the dropdown will be
-grayed out and will only display the default credentials for that profile.
+If the Default Connection profile has only one set of credentials, the dropdown grays out and
+displays only the default credentials for that profile.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/inifile/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/inifile/overview.md
index af012e4220..8c1d79387a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/inifile/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/inifile/overview.md
@@ -36,5 +36,5 @@ following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** box when
-the wizard is open and configuration settings are saved.
+Select the **Don't display this page the next time** box to hide the Welcome page when the wizard is
+open and configuration settings are saved.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/inifile/properties.md b/docs/accessanalyzer/12.0/admin/datacollector/inifile/properties.md
index c6fa84776c..ccc8ee72b4 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/inifile/properties.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/inifile/properties.md
@@ -15,7 +15,7 @@ Use the following options to determine which data to adult:
- All contents – Collect all contents from the INI file
:::note
- `*` can be used for matching wildcard or single characters.
+ Use `*` to match a wildcard or single character.
:::
@@ -27,7 +27,7 @@ Use the following options to determine which data to adult:
- Click the ellipses (**…**) to open a file explorer window
- Select an appropriate .INI file
-- Properties – Select a checkbox next to any desired properties. **Select All** or **Clear All** can
- also be used.
+- Properties – Select a checkbox next to any desired properties, or use **Select All** or **Clear
+ All**.
- If **Differences from standard** is selected, all properties are selected and cannot be altered.
+ If **Differences from standard** is selected, all properties are selected and can't be altered.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/inifile/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/inifile/summary.md
index b7146a1112..d1faefee09 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/inifile/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/inifile/summary.md
@@ -6,10 +6,9 @@ sidebar_position: 30
# INIFile: Summary
-The Summary page is where the selected configuration settings are listed.
+The Summary page lists the selected configuration settings.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the INIFile Data Collector Wizard ensuring that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you didn't make changes, click **Cancel** to close
+the INIFile Data Collector Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/inifile/targetfiles.md b/docs/accessanalyzer/12.0/admin/datacollector/inifile/targetfiles.md
index dfaaa7850b..9a74b5b121 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/inifile/targetfiles.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/inifile/targetfiles.md
@@ -20,7 +20,7 @@ Configure the Target Files options:
Browser and connect to a host to select a registry key and path to be used for the lookup.
- Registry Value – This value is automatically populated from the registry key
- - Levels – The Levels slider can be used to truncate the path for the key value in the Adjust
+ - Levels – Use the Levels slider to truncate the path for the key value in the Adjust
Path dialog box
- Current value – Displays the current value for the registry key
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/ldap.md b/docs/accessanalyzer/12.0/admin/datacollector/ldap.md
index 2f4f4d1743..00bb6c34e4 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/ldap.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/ldap.md
@@ -6,10 +6,10 @@ sidebar_position: 260
# LDAP Data Collector
-The LDAP Data Collector uses LDAP to query Active Directory returning the specified objects and
-attributes. For example, a query can be configured to return all user objects at the selected level.
-Another query can be configured to return a master list of all user objects found within the target
-domain. Wildcards and LDAP filters can be applied to the query configurations.
+The LDAP Data Collector uses LDAP to query Active Directory and return the specified objects and
+attributes. For example, you can configure a query to return all user objects at the selected level.
+You can configure another query to return a master list of all user objects found within the target
+domain. You can apply wildcards and LDAP filters to the query configurations.
The LDAP Data Collector is a core component of Access Analyzer, but it has been preconfigured within
the Active Directory Solution. While the data collector is available with all Access Analyzer
@@ -38,7 +38,7 @@ following configuration options:
- Connect to the server – Use the default domain controller entered in the box, or enter an
alternate server
-- Naming context – Select a directory partition from the drop-down list: **Default Context**,
+- Naming context – Select a directory partition from the dropdown list: **Default Context**,
**Configuration Context**, or **Schema Context**
- Connect – Connects to the domain specified. The root folder of the domain is displayed in the left
pane of the window.
@@ -77,7 +77,7 @@ The Options window contains configure connection options and multi-value results
- Server Port
- If the Connect Securely with TLS/SSL option is selected, use Server Port `686`
- - If the Connect Securely with TLS/SSL option is not selected, use Server Port `389`
+ - If the Connect Securely with TLS/SSL option isn't selected, use Server Port `389`
- Authentication Type
@@ -119,7 +119,7 @@ The Custom Filter window provides options for creating a complex filter.
-Select a **Field** and **Condition** from the drop-down lists. Enter a **Value** for the condition.
+Select a **Field** and **Condition** from the dropdown lists. Enter a **Value** for the condition.
Click **Add** to add the filter to the Filter Lines table.
- Filter Lines will be combined with a logical – Select the **AND** or **OR** option. **AND** is
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nis/category.md b/docs/accessanalyzer/12.0/admin/datacollector/nis/category.md
index 6aaad7933e..89f61bd95d 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nis/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nis/category.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# NIS: Category
-The Category page is used to identify which type of NIS information to retrieve.
+Use the Category page to identify which type of NIS information to retrieve.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nis/configurejob.md b/docs/accessanalyzer/12.0/admin/datacollector/nis/configurejob.md
index eb11058b3c..94cf3396af 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nis/configurejob.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nis/configurejob.md
@@ -6,13 +6,13 @@ sidebar_position: 20
# Unix Connection Profile & Host List
-The NIS Data Collector requires a custom Connection Profile and host list be created and assigned to
-the job or job group conducting the data collection. The host inventory option during host list
-creation makes it necessary to configure the Connection Profile first.
+The NIS Data Collector requires you to create a custom Connection Profile and host list and assign
+them to the job or job group conducting the data collection. The host inventory option during host
+list creation requires you to configure the Connection Profile first.
## Connection Profile
-Creating the Connection Profile requires having an account with access to the targeted NIS server.
+Creating the Connection Profile requires an account with access to the targeted NIS server.
Create a Connection Profile and set the following information on the User Credentials window:
@@ -24,17 +24,17 @@ Create a Connection Profile and set the following information on the User Creden
- Password/Confirm
- If not using a private key, enter the **Password** and re-type in the **Confirm** field
- - If using a private key, then the password is not needed. Provide the private key information
+ - If using a private key, then the password isn't needed. Provide the private key information
in the **Use the following private key when connecting** field.
- Use the following port/ports(CSV) for SSH
- - The SSH port needs to be opened in software and hardware firewalls
+ - Open the SSH port in software and hardware firewalls
- If desired, select this option and provide the port value
- Use the following private key when connecting
- - This option uses the authentication method of an SSH Private Key
+ - This option uses SSH private key authentication
- Supported Key types:
- Open SSH
@@ -42,7 +42,7 @@ Create a Connection Profile and set the following information on the User Creden
- If desired, select this option and provide the key value
-Once the Connection Profile is created, it is time to create the custom host list. See the
+After you create the Connection Profile, create the custom host list. See the
[Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) topic for additional information.
## Custom Host List
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nis/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/nis/overview.md
index e8313bbcf2..6436ddd976 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nis/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nis/overview.md
@@ -24,7 +24,7 @@ information.
**Permissions**
-- No special permissions are needed aside from access to a NIS server
+- This data collector needs no special permissions aside from access to a NIS server
## NIS Query Configuration
@@ -41,5 +41,5 @@ following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+Select the **Don't display this page the next time** checkbox to hide the Welcome page when the
+wizard is open and configuration settings are saved.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nis/query.md b/docs/accessanalyzer/12.0/admin/datacollector/nis/query.md
index 0a8332d717..59826c83a6 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nis/query.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nis/query.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# NIS: NIS Query
-The NIS Query page is where the NIS query regular expressions are configured and tested. It is a
-wizard page for the category of:
+Use the NIS Query page to configure and test the NIS query regular expressions. It is a wizard page
+for the category of:
- Custom NIS Scan
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nis/results.md b/docs/accessanalyzer/12.0/admin/datacollector/nis/results.md
index c0b88759e4..3b3f5db625 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nis/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nis/results.md
@@ -6,15 +6,15 @@ sidebar_position: 70
# NIS: Results
-The Results page is where properties from Unix to be gathered are selected. It is a wizard page for
-both categories.
+Use the Results page to select properties from Unix to gather. It is a wizard page for both
+categories.
-Available properties have checkboxes that can be selected individually, or you can use the **Select
-All**, **Clear All**, and **Reset to defaults** buttons. All selected properties are gathered.
-Available properties vary based on the category selected.
+Select available properties' checkboxes individually, or use the **Select All**, **Clear All**, and
+**Reset to defaults** buttons. Access Analyzer gathers all selected properties. Available properties
+vary based on the category selected.
-This information is not available within the standard reference tables and views. Instead, this
-information can be viewed in the `SA_[Job Name]_DEFAULT` table, which is created when any of these
-properties are selected.
+This information isn't available within the standard reference tables and views. Instead, you can
+view this information in the `SA_[Job Name]_DEFAULT` table, which is created when you select any of
+these properties.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nis/settings.md b/docs/accessanalyzer/12.0/admin/datacollector/nis/settings.md
index 9cba17c616..1300937ab5 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nis/settings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nis/settings.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# NIS: NIS Settings
-The NIS Settings page is where the NIS domain and a NIS server are configured for testing. It is a
-wizard page for both categories.
+Use the NIS Settings page to configure the NIS domain and a NIS server for testing. It is a wizard
+page for both categories.
@@ -15,8 +15,8 @@ Configure the NIS domain and sample NIS server:
- NIS Domain Name – Enter the case-sensitive name of the NIS domain to scan. This is the value
returned by `/bin/domainname` on UNIX systems.
-- (Optional) Sample NIS Server – Enter the host name or IP address of a NIS server for the above
- domain to use for testing. This system should be running the `ypserv` process and be accessible
+- (Optional) Sample NIS Server – Enter the host name or IP address of a NIS server for the NIS domain
+ to use for testing. This system should be running the `ypserv` process and be accessible
from the Access Analyzer Console. Then, click **Test**.
- Test – The data collector attempts to connect to the specified server and access information from
the specified domain. It returns a message indicating success or failure.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nis/sidmappings.md b/docs/accessanalyzer/12.0/admin/datacollector/nis/sidmappings.md
index 09a5960437..1bca286e37 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nis/sidmappings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nis/sidmappings.md
@@ -6,13 +6,14 @@ sidebar_position: 50
# NIS: SID Mappings
-The SID Mappings page is where the Windows-style SID mappings for the Unix User ID and Group ID are
-specified. It is a wizard page for the category of:
+Use the SID Mappings page to specify the Windows-style SID mappings for the Unix User ID and Group
+ID. It is a wizard page for the category of:
- Scan NIS User and Groups
The default settings work for most environments. Use this page to **Add**, **Edit**, or **Remove**
-ID Mappings. Multiple entries are allowed. For each range of User ID or Group ID entered, the offset
-is added to the ID and the resulting SID is the format with `%d` replaced by the ID.
+ID Mappings. You can add multiple entries. For each range of User ID or Group ID entered, Access
+Analyzer adds the offset to the ID, and the resulting SID uses the format with `%d` replaced by the
+ID.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nis/standardtables.md b/docs/accessanalyzer/12.0/admin/datacollector/nis/standardtables.md
index 50c7956833..115b6cca4a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nis/standardtables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nis/standardtables.md
@@ -10,7 +10,7 @@ The NIS Data Collector gathers essential user and group inventory information in
reference tables. Unlike other Access Analyzer data collectors, the NIS Data Collector writes data
to these tables regardless of the job executing the query.
-These tables and their associated views are outlined below:
+These tables and their associated views appear in the following table:
| Table | Details |
| ------------------- | -------------------------------------------------------------------------------------- |
@@ -19,9 +19,8 @@ These tables and their associated views are outlined below:
| SA_NIS_Users | Contains extended information about users, department, title, and so on |
Views are the recommended way for Access Analyzer users to obtain the information gathered by the
-NIS Data Collector. They contain additional information for building queries easily. The following
-is an explanation of the corresponding view created for some of the tables generated by the NIS Data
-Collector:
+NIS Data Collector. They contain additional information for building queries. The following table
+explains the corresponding view created for some of the tables generated by the NIS Data Collector:
| Views | Details |
| ----------------------- | ------------------------------------- |
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nis/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/nis/summary.md
index 1a2be70801..7efc385254 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nis/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nis/summary.md
@@ -6,11 +6,9 @@ sidebar_position: 80
# NIS: Summary
-The Summary page is where configuration settings are summarized. It is a wizard page for both
-categories.
+The Summary page summarizes the configuration settings. It is a wizard page for both categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the NIS Data Collector Wizard to ensure that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you didn't make changes, click **Cancel** to close
+the NIS Data Collector Wizard and avoid saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nosql/category.md b/docs/accessanalyzer/12.0/admin/datacollector/nosql/category.md
index 2c6a615906..7566b39efe 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nosql/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nosql/category.md
@@ -31,5 +31,5 @@ The query categories are:
- NoSQL Utilities
- - Remove NoSQL Storage Tables — All connection related and filter data will be removed for
+ - Remove NoSQL Storage Tables — Removes all connection-related and filter data for
NoSQL databases
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nosql/configurejob.md b/docs/accessanalyzer/12.0/admin/datacollector/nosql/configurejob.md
index bbb862cb73..5ef373f9e5 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nosql/configurejob.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nosql/configurejob.md
@@ -19,9 +19,9 @@ window.
For an Active Directory account, set the following on the User Credentials window:
- Select Account Type – Active Directory Account
-- Domain – Drop-down menu with available trusted domains will appear. Either type the short domain
+- Domain – dropdown menu with available trusted domains will appear. Either enter the short domain
name in the textbox or select a domain from the menu.
-- User name – Type the user name
+- User name – Enter the user name
- Password Storage – Choose the option for credential password storage:
- Application – Uses the configured Profile Security setting as selected at the **Settings** >
@@ -29,10 +29,10 @@ For an Active Directory account, set the following on the User Credentials windo
additional information.
- CyberArk – Uses the CyberArk Enterprise Password Vault. See the
[CyberArk Integration](/docs/accessanalyzer/12.0/admin/settings/connection/cyberarkintegration.md) topic for additional
- information. The password fields do not apply for CyberArk password storage.
+ information. The password fields don't apply for CyberArk password storage.
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
**SQL**
@@ -43,8 +43,8 @@ For a SQL account, set the following on the User Credentials window:
- Password Storage – Application (Uses the configured Profile Security setting as selected at the
**Settings** > **Application** node. See the [Application](/docs/accessanalyzer/12.0/admin/settings/application/overview.md)
topic for additional information.)
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
See the [Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) and
[Application](/docs/accessanalyzer/12.0/admin/settings/application/overview.md) topics for additional information.
@@ -52,10 +52,9 @@ See the [Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overvie
## Host List
Jobs using the NoSQL Data Collector must create a host list with the servers containing the target
-databases. Setup the list of MongoDB hosts that needs to be monitored. Be sure to use a specific
+databases. Set up the list of MongoDB hosts to monitor. Be sure to use a specific
host name (if forcing the connection to a secondary host) or just the cluster name if connecting to
the cluster. See the [Host Management](/docs/accessanalyzer/12.0/admin/hostmanagement/overview.md) topic for additional
information.
-Additionally, the database clusters / instances must be added to the Filter page in the query
-configuration. See the [NoSQL: Filter](/docs/accessanalyzer/12.0/admin/datacollector/nosql/filter.md) topic for additional information.
+Additionally, add the database clusters/instances to the Filter page in the query configuration. See the [NoSQL: Filter](/docs/accessanalyzer/12.0/admin/datacollector/nosql/filter.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nosql/criteria.md b/docs/accessanalyzer/12.0/admin/datacollector/nosql/criteria.md
index 6ac48d8e8a..904f39ddad 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nosql/criteria.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nosql/criteria.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# NoSQL: Criteria
-The Criteria page is where the criteria to be used for discovering sensitive data is configured. It
-is a wizard page for the category of Sensitive Data Collection.
+Use the Criteria page to configure the criteria for discovering sensitive data. It is a wizard page
+for the category of Sensitive Data Collection.
@@ -21,8 +21,8 @@ The options on the Criteria page are:
- Select All – Click **Select All** to enable all sensitive data criteria for scanning
- Clear All – Click **Clear All** to remove all selections from the table
- - Select the checkboxes next to the sensitive data criteria options to enable it to be scanned
- for during job execution
+ - Select the checkboxes next to the sensitive data criteria options to scan for them during job
+ execution
The table contains the following types of criteria:
@@ -36,7 +36,7 @@ The table contains the following types of criteria:
:::note
Adding unnecessary criteria can adversely impact the scanner performance and can cause the
-scanning job to take a long time. If performance is adversely affected, revisit the sensitive data
-scanning criteria and remove criteria that is not required.
+scanning job to take a long time. If performance suffers, revisit the sensitive data scanning
+criteria and remove criteria that isn't required.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nosql/filter.md b/docs/accessanalyzer/12.0/admin/datacollector/nosql/filter.md
index 84c26d9910..5f0dc44832 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nosql/filter.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nosql/filter.md
@@ -6,10 +6,10 @@ sidebar_position: 50
# NoSQL: Filter
-The Filter page is where the query can be scoped to target specific databases or instances. It is a
-wizard page for the Sensitive Data Collection category.
+Use the Filter page to scope the query to target specific databases or instances. It is a wizard
+page for the Sensitive Data Collection category.
-It is necessary to populate the available Mongo databases/instances before the query can be scoped.
+Populate the available Mongo databases/instances before you can scope the query.
See the [Manage Connections Window](#manage-connections-window) topic for additional information.
@@ -40,7 +40,7 @@ The configurable filter options are:
- Selections — Displays selected database objects for which the query has been scoped. Right click
to open context menu:
- - Remove Pattern — Selected database/instance will be removed from the query
+ - Remove Pattern — Removes the selected database/instance from the query
- Edit Pattern — Opens the Edit Pattern dialogue with the following options (See the
[Build or Edit Pattern](#build-or-edit-pattern) topic for additional information):
@@ -50,7 +50,7 @@ The configurable filter options are:
## Manage Connections Window
-The Manage Connections window enables users to add MongoDB database instances to search for
+Use the Manage Connections window to add MongoDB database instances to search for
sensitive data. Click **Connections** to open the window.
@@ -64,8 +64,8 @@ additional information on how to connect to a MongoDB database, see the MongoDB
- Is Active — Select the checkbox to include the database on the Servers Pane on the Filter page
- Server Label — The name of the server
- Host — Name or IP address of the host where the database is located
-- Port Number — Port number for the database. The default port is 27017. If a non-default port is
- being used, it should be specified in the Port Number section.
+- Port Number — Port number for the database. The default port is 27017. If you use a non-default
+ port, specify it in the Port Number section.
- Auth Database — The database used for authorization. Typically it is the **admin** database.
- Read Preference — Read preference describes how MongoDB clients route read operations to the
members of a replica set by default, an application directs its read operations to the primary
@@ -80,7 +80,7 @@ In the Manage Connections table, the following information is also listed:
information has been validated. **N** indicates the information has not been validated.
- Last Inspected — Indicates the date and time of when the connection information was last
inspected. If blank, the connection information has not yet been validated.
-- Enable Impersonation – Impersonation does not apply to MongoDB and this column will be blank.
+- Enable Impersonation – Impersonation doesn't apply to MongoDB and this column will be blank.
The Manage Connections window has the following buttons:
@@ -92,7 +92,7 @@ The Manage Connections window has the following buttons:
#### Build or Edit Pattern
-The Build / Edit Pattern window enables users to apply a custom scoping filter to the query.
+Use the Build / Edit Pattern window to apply a custom scoping filter to the query.
@@ -104,7 +104,7 @@ The Build / Edit Pattern window has the following features:
- Pattern — Build a custom filter to be applied to the selected database objects
:::note
- Color-coding indicating Excluded and Included objects does not display until after a
- selection is validated using the **Validate Selections** button on the Filter page.
+ Color-coding indicating Excluded and Included objects doesn't display until you validate a
+ selection using the **Validate Selections** button on the Filter page.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nosql/options.md b/docs/accessanalyzer/12.0/admin/datacollector/nosql/options.md
index 1c92f81c3e..a4d6b31355 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nosql/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nosql/options.md
@@ -21,13 +21,13 @@ The sensitive data scan settings are:
database or cluster
- Limit of documents to scan — Scan limited number of documents in each database or cluster.
This option is ideal when discovering sensitive data and has minimal impact on the MongoDB
- cluster performance. However, if the Subject Profile Request feature is being leveraged, then
- all the documents in all the database or cluster need to be scanned.
+ cluster performance. However, if you use the Subject Profile Request feature, Access Analyzer
+ must scan all the documents in the database or cluster.
- Scan documents randomly — Access Analyzer requests a set of documents from each database when
- scanning for sensitive data. The database engine does not return random data from a
- collection. Instead, Access Analyzer returns sequential documents in a collection. In order to
- ensure a statistical discrete uniform distribution of data being scanned, this option can be
- selected. When selected, the Access Analyzer sensitive data scanner requests randomized
+ scanning for sensitive data. The database engine doesn't return random data from a
+ collection. Instead, Access Analyzer returns sequential documents in a collection. To
+ ensure a statistical discrete uniform distribution of the scanned data, select this option.
+ When selected, the Access Analyzer sensitive data scanner requests randomized
documents from each collection in all the targeted databases.
- Scan database names for sensitive data – Scans database names for sensitive data if the database
@@ -40,10 +40,10 @@ The sensitive data scan settings are:
- Store discovered sensitive data – Stores potentially sensitive data in the Access Analyzer
database. Any sampled sensitive data discovered based on the matched criteria is stored in the
- Access Analyzer database. This functionality can be disabled by clearing this checkbox.
+ Access Analyzer database. Clear this checkbox to disable this functionality.
:::note
- The **Store discovered sensitive data** option is required to view Content Audit
+ You must select the **Store discovered sensitive data** option to view Content Audit
reports in the Access Information Center for MongoDB data.
:::
@@ -54,10 +54,10 @@ The sensitive data scan settings are:
:::
-- Resume scan from last point on error — Resumes scan from where the previous scan left off when the
- scan was stopped as a result of an error
+- Resume scan from last point on error — Resumes scan from where the previous scan left off when an
+ error stops the scan
:::tip
-Remember, the Sensitive Data Discovery Add-on is required to use the sensitive data collection
+Remember, you need the Sensitive Data Discovery Add-on to use the sensitive data collection
option.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nosql/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/nosql/overview.md
index c85cd11d07..de634200d5 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nosql/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nosql/overview.md
@@ -8,7 +8,7 @@ sidebar_position: 280
The NoSQL Data Collector for MongoDB provides information on MongoDB Cluster configuration, limited
user permissions, scans collections for sensitive data, and identifies who has access to sensitive
-data. It also supports the execution of custom queries against all targeted MongoDB cluster nodes.
+data. It also supports executing custom queries against all targeted MongoDB cluster nodes.
The NoSQL Data Collector has been preconfigured within the MongoDB Solution. Both this data
collector and the solution are available with a special Access Analyzer license. See the
@@ -22,7 +22,7 @@ information.
**Ports**
- MongoDB Cluster
-- Default port is 27017 (A custom port can be configured)
+- Default port is 27017 (you can configure a custom port)
**Permissions**
@@ -35,15 +35,15 @@ information.
- Read Only access to any user databases is required for sensitive data discovery
- Read access to NOSQL instance
- Read access to MongoDB instance
-- Requires NOSQL Full-Text and Semantic Extractions for Search feature to be installed on the target
+- Requires installing the NOSQL Full-Text and Semantic Extractions for Search feature on the target
NOSQL instances when using the Scans full rows for sensitive data option on the Options wizard
page
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if you configure the job to scan
+8 hosts at a time, you need an extra 16 GB of RAM (8x2=16).
## NoSQL Query Configuration
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nosql/results.md b/docs/accessanalyzer/12.0/admin/datacollector/nosql/results.md
index 9c4d776c0d..16e36f5d79 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nosql/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nosql/results.md
@@ -6,11 +6,10 @@ sidebar_position: 60
# NoSQL: Results
-The Results page is where the properties that will be gathered are selected. It is a wizard page for
-all of the categories.
+Select the properties to gather on the Results page. This wizard page applies to all categories.
-Properties can be selected individually, or the **Select All**, **Clear All**, and **Reset to
-Defaults** buttons can be used. All selected properties are gathered. Available properties vary
-based on the category selected.
+Select properties individually, or use the **Select All**, **Clear All**, and **Reset to
+Defaults** buttons. The data collector gathers all selected properties. Available properties vary
+based on the selected category.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/nosql/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/nosql/summary.md
index fec35f9e22..4926de6fe4 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/nosql/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/nosql/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 70
# NoSQL: Summary
-The Summary page is where the configuration settings are summarized. It is a wizard page for all of
-the categories.
+The Summary page summarizes the configuration settings. This wizard page applies to all
+categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the NoSQL Data Collector Wizard ensuring that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead
+to close the NoSQL Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/overview.md
index 7299bd1d59..49bed7a6ae 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/overview.md
@@ -11,57 +11,55 @@ This topic covers the configuration wizards that are unique to each data collect
## Query Selection
-The Access Analyzer data collectors can collect information from a wide range of environments. Data
-collection tasks are assigned to jobs at the **Configure** > **Queries** node level. See the
+The Access Analyzer data collectors can collect information from a wide range of environments. You
+assign data collection tasks to jobs at the **Configure** > **Queries** node level. See the
[Queries Node](/docs/accessanalyzer/12.0/admin/jobs/job/configure/queries.md) topic for additional information.
-The Query Selection page is split into the Tables and Queries sections. The Tables section has the
+The Query Selection page has two sections: Tables and Queries. The Tables section has the
following options:
- Table – Select a pre-configured table or select DEFAULT to create a new one
- Add Table – Add a new table to the Table dropdown list
-- Rename Table – Rename the current table selected
-- Delete Table – Delete the current table selected
+- Rename Table – Rename the selected table
+- Delete Table – Delete the selected table
-The Queries section is where the Data Collectors are configured. The Queries section has the
-following options:
+Configure the Data Collectors in the Queries section, which has the following options:
- Add from Library – Opens the Libraries window. Add a pre-built query from the Access Analyzer
library. See the [Add Query from Library](#add-query-from-library) topic for additional
information.
- Create Query – Click **Create Query** to add a new query task to a job. See the
[Create or Modify a Query](#create-or-modify-a-query) topic for additional information.
-- Delete Query – Delete the currently selected query
+- Delete Query – Delete the selected query
- Query Properties – Select an existing query and click **Query Properties** to modify its
configuration
### Add Query from Library
-Pre-built queries can be added to the Data Collector job through the Libraries window.
+Add pre-built queries to the Data Collector job through the Libraries window.
The Libraries window toolbar has the following options:
-- Create New Library – Create a new library entry. The new Library will be added to the Library
- dropdown menu.
-- Delete Library – Deletes the currently selected library
+- Create New Library – Create a new library entry. Access Analyzer adds the new library to the
+ Library dropdown menu.
+- Delete Library – Deletes the selected library
- Cut – Cut the selected task in the library to the clipboard
- Copy – Copy the selected task in the library to the clipboard
-- Paste – Paste cut or copied item from the clipboard into the currently selected library
-- Delete Selected Task – Deletes the currently selected task
+- Paste – Paste cut or copied item from the clipboard into the selected library
+- Delete Selected Task – Deletes the selected task
Click **Add** to confirm the query selection and add it to the Queries list on the Query Selection
-page. If no selection is needed or intended, click **Cancel** to close the Libraries window without
+page. If you don't want to make a selection, click **Cancel** to close the Libraries window without
adding a pre-built query into the Queries list.
### Create or Modify a Query
To open the Query Properties window, click **Create Query** for a new query or **Query Properties**
-for an existing query. There are three tabs in the Query Properties window where queries can be
-configured. These tabs are:.
+for an existing query. The Query Properties window has three tabs for configuring queries:
- [General Tab](#general-tab)
- [Data Source Tab](#data-source-tab)
@@ -81,15 +79,15 @@ The General tab displays:
- Name – Name of the query supplied by the creator of the query
- Description – Description of the query supplied by the creator of the query
- Table – Name of the native data table for this query
- - The table name is supplied by the creator in the Query Selection view
- - Tables are named DEFAULT, unless modified
- - Within the SQL database, the table name will be prefaced with `SA_[Job Name]_`
+ - The creator supplies the table name in the Query Selection view
+ - Access Analyzer names tables DEFAULT, unless the creator modifies the name
+ - Within the SQL database, Access Analyzer prefaces the table name with `SA_[Job Name]_`
- ID – Query GUID generated by Access Analyzer for this query task.
- - The query GUID is referenced by the **SMARTLog** Data Collector, **ExchangeMetrics** Data
- Collector, and the **PowerShell** Data Collector.
+ - The **SMARTLog** Data Collector, **ExchangeMetrics** Data Collector, and **PowerShell** Data
+ Collector reference the query GUID.
- When using the **SMARTLog** Data Collector or the **ExchangeMetrics** Data Collector, the
- `state` file for the query’s Persist log state feature can be found in the SA_CommonData
+ `state` file for the query’s Persist log state feature is in the SA_CommonData
folder in the Access Analyzer installation directory:
…/STEALTHbits/StealthAUDIT/Jobs/SA_CommonData/[Data Collector]/[Query GUID]/[Target
@@ -109,15 +107,15 @@ Use the Data Source tab to configure the data collector and query.
The Data Source tab displays:
-- Data Collector – Data collector selected from the drop-down menu.
+- Data Collector – Data collector selected from the dropdown menu.
- Query – Query configuration string.
- Configure – Opens the wizard for the selected data collector. Each Data Collector task has its own
Configuration Wizard.
- Properties – Configured query properties.
-When creating a new query, expand the **Data Collector** drop-down menu, which provides a list of
-all licensed data collectors in alphabetical order. The **Query** and **Property** sections are
-auto-filled according to the configuration. The buttons at the bottom of the Property section are
+When creating a new query, expand the **Data Collector** dropdown menu, which provides a list of
+all licensed data collectors in alphabetical order. The configuration automatically fills the
+**Query** and **Property** sections. The buttons at the bottom of the Property section are
for advanced features to manipulate the query. The **+** and **–** buttons manually add or remove
individual properties from the query. The script button opens the VBScript Editor window for query
manipulation scripts.
@@ -144,15 +142,14 @@ The Filter tab has the following items:
- Use the **+** and **–** buttons to add and remove filters from the query
- Key – Labels identifying the configurable value in the filter
- Value – When applicable, add a new value to the filter using the dropdown menu. Otherwise, create
- a new one by typing in the desired value.
+ a new one by typing in the value you want.
:::info
-Use the default settings for filters. Filters can be used to substitute or delete
+Use the default settings for filters. Use filters to substitute or delete
data values during data collection. For more information on the impacts of adding filters to
queries, contact [Netwrix Support](https://www.netwrix.com/support.html).
:::
-Click **OK** to save changes and exist the Query Properties window. If no changes were made or
-intended, it is best practice to click **Cancel** to exit the Query Properties window to ensure
-unintended changes are not saved.
+Click **OK** to save changes and exist the Query Properties window. If you made no changes, click
+**Cancel** to exit the Query Properties window and avoid saving unintended changes.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/dictionaries.md b/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/dictionaries.md
index 883f3cc830..fd4e1c551f 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/dictionaries.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/dictionaries.md
@@ -6,21 +6,21 @@ sidebar_position: 30
# PasswordSecurity: Dictionaries
-The Dictionaries page provides configuration settings for storing passwords to be used as a
-reference for the scan.
+The Dictionaries page provides configuration settings for storing passwords that the scan uses as a
+reference.
The configurable dictionary options are:
- Use Stealthbits dictionary (> 100,000 passwords) – If enabled, compares passwords against
- out-of-the-box dictionary comprised of commonly used password hashes
+ a built-in dictionary comprised of commonly used password hashes
- Automatically update the Stealthbits dictionary – Checks for the latest version of the Netwrix
- weak password dictionary file when the job is executed, and downloads the latest version from the
+ weak password dictionary file when the job runs, and downloads the latest version from the
[Netwrix website](https://www.netwrix.com/)
- - If the Access Analyzer server does not have an internet connection, the weak password
- dictionary can be downloaded directly from the
+ - If the Access Analyzer server doesn't have an internet connection, you can download the weak
+ password dictionary directly from the
[My Products](https://www.netwrix.com/my_products.html) page of the Netwrix website. See the
[Download the Netwrix Weak Password Dictionary](#download-the-netwrix-weak-password-dictionary)
topic for additional information.
@@ -29,8 +29,8 @@ The configurable dictionary options are:
- Add – Add a custom dictionary file in one of the following formats:
- Plaintext – Line separated in a text file
- - NLTM Hashes – Can be added with hashes or sorted hashes. The haveibeenpwned dictionary can be
- used. See the
+ - NLTM Hashes – Provide hashes or sorted hashes. You can use the haveibeenpwned
+ dictionary. See the
[Download and Configure the Have I Been Pwnd (HIBP) Hash List](#download-and-configure-the-have-i-been-pwnd-hibp-hash-list)
topic for additional information.
@@ -43,8 +43,8 @@ The configurable dictionary options are:
## Download the Netwrix Weak Password Dictionary
-**Step 1 –** If the Access Analyzer server does not have an internet connection, the weak passwords
-dictionary can be downloaded directly from the
+**Step 1 –** If the Access Analyzer server doesn't have an internet connection, download the weak
+passwords dictionary directly from the
[My Products](https://www.netwrix.com/my_products.html) page of the Netwrix website.
**Step 2 –** After downloading the dictionary file manually do one the following:
@@ -67,18 +67,18 @@ dictionary can be downloaded directly from the
## Download and Configure the Have I Been Pwnd (HIBP) Hash List
If you don't have internet access on the Netwrix Access Analyzer (formerly Enterprise Auditor)
-server or want to download the files from another location that has internet access, you can do so
-by using the Pwnd Passwords Downloader.
+server, or you want to download the files from another location with internet access, use the Pwnd
+Passwords Downloader.
-The Pwnd Passwords Downloader is a Dotnet tool used to download all Pwned Passwords hash ranges and
-save them offline so they can be used without a dependency on the k-anonymity API. Use this tool to
-get the latest breached hashes from the Have I Been Pwnd (HIBP) database.
+The Pwnd Passwords Downloader is a Dotnet tool that downloads all Pwned Passwords hash ranges and
+saves them offline for use without a dependency on the k-anonymity API. Use this tool to get the
+latest breached hashes from the Have I Been Pwnd (HIBP) database.
:::note
The
[](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader)[Pwnd Passwords Downloader](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader)
-is a third party, open source tool, created by the HaveIBeenPwned team and distributed under a BSD
-3-Clause License. You might experience issues during the hash download process, depending on your
+is a third-party, open source tool that the HaveIBeenPwned team created and distributes under a
+BSD 3-Clause License. You might experience issues during the hash download process, depending on your
threading settings or the load on the CloudFlare backend. The Pwnd Passwords Downloader tool will
automatically retry to continue downloading the hashes until it fully completes the download
process.
@@ -94,14 +94,14 @@ The Pwnd Passwords Downloader has the following prerequisite:
can download .NET 6 from Microsoft:
[https://dotnet.microsoft.com/en-us/download/dotnet/6.0](https://dotnet.microsoft.com/en-us/download/dotnet/6.0)
-The HIBP database takes up additional space on the machine where it is copied (approximately 13 GB,
-but subject to change). The Have I Been Pwnd database (HIBP) hashes can take up to 30 GB. Make sure
+The HIBP database takes up additional space on the machine where you copy it (approximately 13 GB,
+but subject to change). The Have I Been Pwnd database (HIBP) hashes can take up to 30 GB. ensure
that you have enough free space on your disk in your Netwrix Access Analyzer (formerly Enterprise
Auditor) install directory (`%sainstalldir%`).
### Install the Pwnd Passwords Downloader
-Follow the steps to install the Pwnd Passwords Downloader.
+To install the Pwnd Passwords Downloader:
**Step 3 –** Open command prompt, and navigate to your .NET install folder (for example,
`C:\Program Files (x86)\dotnet`).
@@ -118,7 +118,7 @@ dotnet tool install --global haveibeenpwned-downloader
### Update an Installed Pwnd Passwords Downloader
-Follow the steps to update an installed Pwnd Passwords Downloader.
+To update an installed Pwnd Passwords Downloader:
**Step 1 –** Open the command prompt.
@@ -132,7 +132,7 @@ dotnet tool update --global haveibeenpwned-downloader
### Download NTML Hashes with the Pwnd Passwords Downloader
-Follow the steps to download NTLM hashes.
+To download NTLM hashes:
**Step 1 –** Navigate to the folder where you want to download the hashes.
@@ -155,5 +155,5 @@ This screenshot shows the completed download.
haveibeenpwned-downloader.exe -n pwnedpasswords_ntlm -o
```
-For a complete list of available parameters, please check the
+For a complete list of available parameters, check the
[Pwnd Passwords Downloader GitHub page](https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader).
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/options.md b/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/options.md
index 1f6dc601cd..bc046abd80 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/options.md
@@ -14,11 +14,11 @@ The configurable scan options are:
- Encrypt communications with Active Directory (SSL) – Enables communication to the domain
controller over SSL
-- Analyze historical passwords – Scans historical passwords that have been stored in Active
+- Analyze historical passwords – Scans historical passwords stored in Active
Directory
:::warning
- Enabling the following option will return clear text passwords to be stored in the
+ Enabling the following option returns clear text passwords and stores them in the
Access Analyzer database for the following exceptions: **Clear Text Password**, **Potential
Keytab Password**, and **Weak Password** (when leveraging a plaintext password dictionary).
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/overview.md
index 04a2672334..91b2c54e31 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/overview.md
@@ -10,8 +10,8 @@ The PasswordSecurity Data Collector compares passwords stored in Active Director
passwords in the Netwrix weak password dictionary or custom dictionaries. The PasswordSecurity Data
Collector also checks for common misconfigurations with passwords in Active Directory.
-The PasswordSecurity Data Collector is a core component of Access Analyzer, but it has been
-preconfigured within the Active Directory Solution. While the data collector is available with all
+The PasswordSecurity Data Collector is a core component of Access Analyzer, but Access Analyzer
+preconfigures it within the Active Directory Solution. While the data collector is available with all
Access Analyzer license options, the Active Directory Solution is only available with a special
Access Analyzer license. See the
[Active Directory Solution](/docs/accessanalyzer/12.0/solutions/activedirectory/overview.md) topic for additional
@@ -37,7 +37,7 @@ information.
## PasswordSecurity Query Configuration
-The PasswordSecurity Data Collector is configured through the Password Security Data Collector
+Configure the PasswordSecurity Data Collector through the Password Security Data Collector
Wizard, which contains the following wizard pages:
- [PasswordSecurity: Category](/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/category.md)
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/results.md b/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/results.md
index 4aa9746f26..3964f199d3 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/results.md
@@ -6,9 +6,9 @@ sidebar_position: 40
# PasswordSecurity: Results
-The Results page is where Active Directory properties to be gathered are selected.
+Select the Active Directory properties to gather on the Results page.
-Properties can be selected individually or by using the **Select All** or **Clear All** buttons. All
-selected properties are gathered.
+Select properties individually or use the **Select All** or **Clear All** buttons. The data
+collector gathers all selected properties.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/summary.md
index 4920001c4f..a56069fd31 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/passwordsecurity/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Active Directory Data Collector Wizard to ensure that no accidental
-clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the Active Directory Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/permissionmatrix.md b/docs/accessanalyzer/12.0/admin/datacollector/permissionmatrix.md
index 41d3ccb41c..acbe30ea28 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/permissionmatrix.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/permissionmatrix.md
@@ -6,9 +6,8 @@ sidebar_position: 10
# Permissions by Data Collector (Matrix)
-The Access Analyzer data collectors are capable of collecting information from a variety of sources.
-Each data collector requires specific protocols, ports, and permissions for the collection of data
-to occur.
+The Access Analyzer data collectors can collect information from a variety of sources.
+Each data collector requires specific protocols, ports, and permissions to collect data.
Many data collectors are included as core components. However, some data collectors require specific
license features. The following table provides a quick reference for each data collector.
@@ -22,7 +21,7 @@ license features. The following table provides a quick reference for each data c
| AWS | The AWS Data Collector collects IAM users, groups, roles, and policies, as well as S3 permissions, content, and sensitive data from the target Amazon Web Services (AWS) accounts. | | | To collect details about the AWS Organization, the following permission is required:- organizations:DescribeOrganization
To collect details regarding IAM, the following permissions are required:- iam:GenerateCredentialReport
- iam:GenerateServiceLastAccessedDetails
- iam:Get\*
- iam:List\*
- iam:Simulate\*
- sts:GetAccessKeyInfo
To collect details related to S3 buckets and objects, the following permissions are required:- s3:Describe\*
- s3:Get\*
- s3:HeadBucket
- s3:List\*
|
| AzureADInventory | The AzureADInventory Data Collector catalogs user and group object information from Microsoft Entra ID, formerly Azure Active Directory. This data collector is a core component of Access Analyzer and is preconfigured in the .Entra ID Inventory Solution. | | | **Microsoft Graph API**
Application Permissions:- AuditLog.Read.All – Read all audit log data
- Directory.Read.All – Read directory data
Delegated Permissions:- Group.Read.All – Read all groups
- User.Read.All – Read all users' full profiles
**Access URLs**- https://login.windows.net
- https://graph.windows.net
- https://login.microsoftonline.com
- https://graph.microsoft.com
- All sub-directories of the access URLs listed
|
| Box _\*requires license_ | The Box Data Collector audits access, group membership, and content within a Box enterprise. | | | - Box Enterprise Administrator
|
-| CommandLineUtility | The CommandLineUtility Data Collector provides the ability to remotely spawn, execute, and extract data provided by a Microsoft native or third-party command line utility. | | - TCP 135-139
- Randomly allocated high TCP ports
| - Member of the local Administrators group
|
+| CommandLineUtility | The CommandLineUtility Data Collector lets you remotely spawn, execute, and extract data provided by a Microsoft native or third-party command line utility. | | - TCP 135-139
- Randomly allocated high TCP ports
| - Member of the local Administrators group
|
| DiskInfo | The DiskInfo Data Collector provides enumeration of disks and their associated properties. | | - TCP 135
- Randomly allocated high TCP ports
| - Member of the local Administrators group
|
| DNS _\*requires license_ | The DNS Data Collector provides information regarding DNS configuration and records. | | - TCP 135
- Randomly allocated high TCP ports
| - Member of the Domain Administrators group
|
| DropboxAccess _\*requires license_ | The DropboxAccess Data Collector audits access, group membership, and content within a Dropbox environment. | | | - Dropbox Team Administrator
|
@@ -32,12 +31,12 @@ license features. The following table provides a quick reference for each data c
| EWSPublicFolder _\*requires license_ | The EWSPublicFolder Data Collector provides configuration options to extract public folder contents, permissions, and sensitive data, and is preconfigured within the Exchange Solution. | | | For Exchange servers: - Exchange Admin Role
- Discovery Management Role
- Application Impersonation Role
- Exchange Online License with a mailbox
For Exchange Online:- Exchange Admin Role
- Discovery Management Role
- Exchange Online License with a mailbox
|
| Exchange2K _\*requires license_ | The Exchange2K Data Collector extracts configuration details from Exchange organizations for versions 2003 and later. | | - TCP 135-139
- Randomly allocated high TCP ports
- TCP 389
- Optional TCP 445
| - Member of the Exchange Administrator group
- Domain Admin for AD property collection
- Public Folder Management
|
| ExchangeMailbox _\*requires license_ | The ExchangeMailbox Data Collector extracts configuration details from the Exchange Store to provide statistical, content, permission, and sensitive data reporting on mailboxes. | | - TCP 135
- Randomly allocated high TCP ports
| - Member of the Exchange Administrator group
- Organization Management
- Discovery Management
|
-| ExchangeMetrics _\*requires license_ | The ExchangeMetrics Data Collector collects Mail-Flow metrics from the Exchange Message Tracking Logs on the Exchange servers. Some examples of this include server volume and message size statistics. | | - TCP 135
- Randomly allocated high TCP ports
| - Member of the local Administrator group on the targeted Exchange server(s)
|
-| ExchangePS _\*requires license_ | The ExchangePS Data Collector utilizes the Exchange CMDlets to return information about the Exchange environment utilizing PowerShell. This data collector has been designed to work with Exchange 2010 and newer. | | - TCP 135
- Randomly allocated high TCP ports
| For Exchange servers: - Remote PowerShell enabled on a single Exchange server
- Windows Authentication enabled for the PowerShell Virtual Directory on the same Exchange server where Remote PowerShell has been enabled
- View-Only Organization Management Role Group
- Discovery Search Management Role Group
- Public Folder Management Role Group
- Mailbox Search Role
For Exchange Online:- Discovery Management Role
- Organization Management Role
|
+| ExchangeMetrics _\*requires license_ | The ExchangeMetrics Data Collector collects Mail-Flow metrics from the Exchange Message Tracking Logs on the Exchange servers. Some examples of this include server volume and message size statistics. | | - TCP 135
- Randomly allocated high TCP ports
| - Member of the local Administrator group on the targeted Exchange servers
|
+| ExchangePS _\*requires license_ | The ExchangePS Data Collector uses the Exchange CMDlets to return information about the Exchange environment using PowerShell. This data collector has been designed to work with Exchange 2010 and newer. | | - TCP 135
- Randomly allocated high TCP ports
| For Exchange servers: - Remote PowerShell enabled on a single Exchange server
- Windows Authentication enabled for the PowerShell Virtual Directory on the same Exchange server where Remote PowerShell has been enabled
- View-Only Organization Management Role Group
- Discovery Search Management Role Group
- Public Folder Management Role Group
- Mailbox Search Role
For Exchange Online:- Discovery Management Role
- Organization Management Role
|
| ExchangePublicFolder _\*requires license_ | The ExchangePublicFolder Data Collector audits an Exchange Public Folder, including contents, permissions, ownership, and replicas. | | - TCP 135
- Randomly allocated high TCP ports
| - Member of the Exchange Administrator group
- Organization Management
|
| File | The File Data Collector provides file and folder enumeration, properties, and permissions. | | - TCP 135-139
- Randomly allocated high TCP ports
- Optional TCP 445
| - Member of the Local Administrators group
|
| FileSystemAccess (FSAA) _\*requires license_ | The FileSystemAccess (FSAA) Data Collector collects permissions, content, and activity, and sensitive data information for Windows and NAS file systems. | | - Ports vary based on the Scan Mode Option selected. See the [File System Scan Options](/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/scanoptions.md) topic for additional information.
| - Permissions vary based on the Scan Mode Option selected. See the [File System Supported Platforms](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/filesystems.md) topic for additional information.
|
-| GroupPolicy | The GroupPolicy Data Collector provides the ability to retrieve the GPO’s list in the domain and where they are linked, return information on configured policies and policy parts from the individual policies that have been selected, return information on selected policy parts from all policies within the domain, and return effective security policies in effect at the individual workstation. | | - TCP 389
- TCP 135-139
- Randomly allocated high TCP ports
| - Member of the Domain Administrators group (if targeting domain controllers)
- Member of the Local Administrators group
|
+| GroupPolicy | The GroupPolicy Data Collector lets you retrieve the GPO’s list in the domain and where they are linked, return information on configured policies and policy parts from the individual policies that have been selected, return information on selected policy parts from all policies within the domain, and return effective security policies in effect at the individual workstation. | | - TCP 389
- TCP 135-139
- Randomly allocated high TCP ports
| - Member of the Domain Administrators group (if targeting domain controllers)
- Member of the Local Administrators group
|
| INIFile | The INIFile Data Collector provides options to configure a task to collect information about log entries on target hosts. | | - TCP 135-139
- Randomly allocated high TCP ports
- Optional TCP 445
| - Member of the Local Administrators group
|
| LDAP | The LDAP Data Collector uses LDAP to query Active Directory returning the specified objects and attributes. | | | - Member of the Domain Administrators group
|
| NIS | The NIS Data Collector inventories a NIS domain for user and group information, mapping to Windows-style SIDs. | | - TCP 111 or UDP 111
- Randomly allocated high TCP ports
| - No special permissions are needed aside from access to a NIS server
|
@@ -52,7 +51,7 @@ license features. The following table provides a quick reference for each data c
| Services | The Services Data Collector enumerates status and settings from remote services. | | - TCP 135-139
- Randomly allocated high TCP ports
| - Member of the Local Administrators group
|
| SharePointAccess (SPAA) _\*requires license_ | The SharePointAccess (SPAA) Data Collector audits access, group membership, and content within a SharePoint on-premises and SharePoint Online environment. The SPAA Data Collector has been preconfigured within the SharePoint Solution. | - MS SQL
- Remote Registry
- SP CSOM (Web Services via HTTP & HTTPS)
- SP Server API
- WCF AUTH via TCP (configurable)
| - Ports vary based on the Scan Mode selected and target environment. See the [SharePoint Scan Options](/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/scanoptions.md) topic for additional information.
| - Permissions vary based on the Scan Mode selected and target environment. See the [SharePoint Support](/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint.md) topic for additional information.
|
| SMARTLog | The SMARTLog Data Collector provides search and extraction of details from Windows Event Logs (online or offline) and Microsoft Exchange Internet Information Server (IIS) logs. | | - TCP 135
- TCP 445
- Randomly allocated high TCP ports
| - Member of the Domain Administrators group (if targeting domain controllers)
- Member of the local Administrators group
|
-| SQL _\*requires license_ | The SQL Data Collector provides information on database configuration, permissions, data extraction, application name of the application responsible for activity events, an IP Address or Host name of the client server, and sensitive data reports. This data collector also provides information on Oracle databases including infrastructure and operations. | TCP | For Db2 Target: - Specified by Instances table (default is 5000)
For MySQL Target:- Specified by Instances table (default is 3306)
For Oracle Target:- Specified by Instances table (default is 1521)
For PostgreSQL Target:- Specified by Instances table (default is 5432)
For SQL Target:- Specified by Instances table (default is 1433)
| **For MySQL Target:** - Read access to MySQL instance to include all databases contained within each instance
- Windows Only — Domain Admin or Local Admin privilege
**For Oracle Target:**- User with SYSDBA role
- Local Administrator on the target servers – Only applies to Windows Servers and not on Linux or Unix operating systems
**For PostgreSQL Target:**- Read access to all the databases in PostgreSQL cluster or instance
- Windows Only — Domain Admin or Local Admin privilege
**For Redshift Target:**- Read-access to the following tables:
- pg_tables
- pg_user
**For SQL Target:**
For Instance Discovery, local rights on the target SQL Servers:- Local group membership to Remote Management Users
- Permissions on the following WMI NameSpaces: `root\Microsoft\SQLServer, root\interop`
For permissions for data collection:- Read access to SQL instance
- Requires SQL Full-Text and Semantic Extractions for Search feature to be installed on the target SQL instance(s) when using the **Scan full rows for sensitive data** option on the Options wizard page
- Grant Authenticate Server to [DOMAIN\USER]
- Grant Connect SQL to [DOMAIN\USER]
- Grant View any database to [DOMAIN\USER]
- Grant View any definition to [DOMAIN\USER]
- Grant View server state to [DOMAIN\USER]
- Grant Control Server to [DOMAIN\USER] (specifically required for the Weak Passwords Job)
|
+| SQL _\*requires license_ | The SQL Data Collector provides information on database configuration, permissions, data extraction, application name of the application responsible for activity events, an IP Address or Host name of the client server, and sensitive data reports. This data collector also provides information on Oracle databases including infrastructure and operations. | TCP | For Db2 Target: - Specified by Instances table (default is 5000)
For MySQL Target:- Specified by Instances table (default is 3306)
For Oracle Target:- Specified by Instances table (default is 1521)
For PostgreSQL Target:- Specified by Instances table (default is 5432)
For SQL Target:- Specified by Instances table (default is 1433)
| **For MySQL Target:** - Read access to MySQL instance to include all databases contained within each instance
- Windows Only — Domain Admin or Local Admin privilege
**For Oracle Target:**- User with SYSDBA role
- Local Administrator on the target servers – Only applies to Windows Servers and not on Linux or Unix operating systems
**For PostgreSQL Target:**- Read access to all the databases in PostgreSQL cluster or instance
- Windows Only — Domain Admin or Local Admin privilege
**For Redshift Target:**- Read-access to the following tables:
- pg_tables
- pg_user
**For SQL Target:**
For Instance Discovery, local rights on the target SQL Servers:- Local group membership to Remote Management Users
- Permissions on the following WMI NameSpaces: `root\Microsoft\SQLServer, root\interop`
For permissions for data collection:- Read access to SQL instance
- Requires SQL Full-Text and Semantic Extractions for Search feature to be installed on the target SQL instances when using the **Scan full rows for sensitive data** option on the Options wizard page
- Grant Authenticate Server to [DOMAIN\USER]
- Grant Connect SQL to [DOMAIN\USER]
- Grant View any database to [DOMAIN\USER]
- Grant View any definition to [DOMAIN\USER]
- Grant View server state to [DOMAIN\USER]
- Grant Control Server to [DOMAIN\USER] (specifically required for the Weak Passwords Job)
|
| SystemInfo | The SystemInfo Data Collector extracts information from the target system based on the selected category. | | - TCP 135-139
- Randomly allocated high TCP ports
| - Member of the Local Administrators group
|
| TextSearch | The TextSearch Data Collector enables searches through text based log files. | | - TCP 135-139
- Randomly allocated high TCP ports
| - Member of the Local Administrators group
|
| Unix _\*requires license_ | The Unix Data collector provides host inventory, software inventory, and logical volume inventory on UNIX & Linux platforms. | | | - Root permissions in Unix/Linux
|
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/powershell/editquery.md b/docs/accessanalyzer/12.0/admin/datacollector/powershell/editquery.md
index 67d932ee21..e13dbcebee 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/powershell/editquery.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/powershell/editquery.md
@@ -15,10 +15,10 @@ The options on the Edit Query page are:
- Open – Click to import and open a PowerShell script
- Script Editor – Input PowerShell script to use for the configured job
-- Parameters – The Parameters tab located on the right-hand side of the Edit Query page is used to
- bring up the Parameters window. See the [Parameters](#parameters) topic for additional
+- Parameters – Use the Parameters tab, located on the right-hand side of the Edit Query page, to
+ open the Parameters window. See the [Parameters](#parameters) topic for additional
information.
-- Use table input for PowerShell script – select the checkbox to bring up the Input options for the
+- Use table input for PowerShell script – select the checkbox to display the Input options for the
PowerShell script. See the [Input Options](#input-options) topic for additional information.
## Parameters
@@ -36,8 +36,8 @@ The options in the Parameters Window are:
- Delete – Delete a parameter
:::note
-Only user created parameters can be edited or deleted. Pre-configured parameters cannot be
-edited or deleted.
+You can edit or delete only user-created parameters. You can't edit or delete preconfigured
+parameters.
:::
@@ -64,22 +64,22 @@ The options in the Add/Edit Variable window are:
## Input Options
-When the Use table input for PowerShell script option is selected on the Edit Query page, additional
+When you select the Use table input for PowerShell script option on the Edit Query page, additional
options display to define the source for input data.
The input options are:
-- Please select name – Select the input table to be used from the drop-down menu
+- select name – Select the input table to use from the dropdown menu
- Filter nulls – Excludes values that are null from input
- Filter duplicates – Excludes any values that are duplicate from input
-- Text Box – Displays an example of how the input can be used in a PowerShell script
+- Text Box – Displays an example of how to use the input in a PowerShell script
- Columns – Displays the columns in the selected input table. If applicable, select the checkbox to
include the column in the input.
- Input Data – Preview how the input data will look in the Input Data tab
-Selecting an input table in the **Please select name** dropdown populates the Text Box and the
+Selecting an input table in the **select name** dropdown populates the Text Box and the
Columns tab with information.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/powershell/options.md b/docs/accessanalyzer/12.0/admin/datacollector/powershell/options.md
index fc07764cbe..26f662804d 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/powershell/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/powershell/options.md
@@ -12,11 +12,11 @@ The Options page provides the option to execute the script remotely on the targe
The configurable options are:
-- Execute remotely – Remotely executes the script on the target host. If this checkbox is not
- selected, the script will be executed from the Access Analyzer Console server.
+- Execute remotely – Remotely executes the script on the target host. If you don't select this
+ checkbox, Access Analyzer executes the script from the Access Analyzer Console server.
- Use impersonation within server executable – Executes the script with the job credentials
-For cmdlets requiring explicit credentials, a single credential set from the job's Connection
-Profile can be referenced using `Get-Credential` or the `$JobCredential` variable, a `PSCredential`
-type object. All credentials from the job’s Connection Profile may be accessed via the
+For cmdlets that require explicit credentials, you can reference a single credential set from the
+job's Connection Profile using `Get-Credential` or the `$JobCredential` variable, a `PSCredential`
+type object. You can access all credentials from the job's Connection Profile via the
`$JobCredentials` array.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/powershell/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/powershell/overview.md
index d90b57b9be..cd8f3d10c6 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/powershell/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/powershell/overview.md
@@ -25,7 +25,7 @@ component of Access Analyzer and is available with all Access Analyzer licenses.
## PowerShell Query Configuration
-The PowerShell Data Collector is configured through the PowerShell Data Collector Wizard, which
+Configure the PowerShell Data Collector through the PowerShell Data Collector Wizard, which
contains the following pages:
- Welcome
@@ -37,5 +37,5 @@ contains the following pages:
-The Welcome page can be hidden by checking the **Do not display this page the next time** box when
-the wizard is open and configuration settings are saved.
+You can hide the Welcome page by checking the **Don't display this page the next time** box while
+the wizard is open and saving configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/powershell/results.md b/docs/accessanalyzer/12.0/admin/datacollector/powershell/results.md
index 473a23b5d9..3744a66d6f 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/powershell/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/powershell/results.md
@@ -13,5 +13,5 @@ components.
The Results page options are:
-- Properties to return – List of available properties which can be gathered for the PowerShell query
-- ROWKEY's components – List of available properties based on which ROWKEY will be built
+- Properties to return – List of available properties to gather for the PowerShell query
+- ROWKEY's components – List of available properties that Access Analyzer uses to build ROWKEY
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/powershell/sampleserver.md b/docs/accessanalyzer/12.0/admin/datacollector/powershell/sampleserver.md
index cedd069bd9..9c7948eb33 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/powershell/sampleserver.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/powershell/sampleserver.md
@@ -12,11 +12,11 @@ The Sample Server page provides a box to select a server to generate the result
The Select Server page options are:
-- Server name – Server to be used during configuration
-- Validate – Validates the script results and retrieves result columns. Validation must be run in
- order to populate and enable the Results page.
+- Server name – Server to use during configuration
+- Validate – Validates the script results and retrieves result columns. Run validation to populate
+ and enable the Results page.
The server selected here replaces any `[SAHOSTNAME]` tokens in the PowerShell script. During
-execution, the `[SAHOSTNAME]` tokens are replaced in turn by each host in the host list. If no
+execution, each host in the host list replaces the `[SAHOSTNAME]` tokens in turn. If no
`[SAHOSTHAME]` tokens exist in the PowerShell script, then the server name and the hosts in the host
list have no effect.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/powershell/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/powershell/summary.md
index 7686a3a503..84fc78b70a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/powershell/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/powershell/summary.md
@@ -11,6 +11,5 @@ Data Collector Wizard.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the PowerShell Data Collector Wizard ensuring that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the PowerShell Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/registry.md b/docs/accessanalyzer/12.0/admin/datacollector/registry.md
index 416e1e2359..d2965e741c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/registry.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/registry.md
@@ -8,12 +8,12 @@ sidebar_position: 310
The Registry Data Collector queries the registry and returns keys, key values, and permissions on
the keys. The data in the native tables returned by the Registry Data Collector is dependent upon
-the query configuration. For example, a query could be configured to only show permissions on
-registry keys in a 32-bit view. Another query could be configured to show a listing of all keys and
-key values in a 64-bit view. Wildcards can also be used in query configurations.
+the query configuration. For example, you can configure a query to show permissions only on
+registry keys in a 32-bit view. You can configure another query to show a listing of all keys and
+key values in a 64-bit view. You can also use wildcards in query configurations.
-The Registry Data Collector is a core component of Access Analyzer, but it has been preconfigured
-within both the Active Directory Solution and the Windows Solution. While the data collector is
+The Registry Data Collector is a core component of Access Analyzer, but Access Analyzer
+preconfigures it within both the Active Directory Solution and the Windows Solution. While the data collector is
available with all Access Analyzer license options, these solutions are only available with a
special Access Analyzer licenses. See the following topics for additional information:
@@ -36,23 +36,22 @@ special Access Analyzer licenses. See the following topics for additional inform
## Registry Query Configuration
-The Registry Data Collector is configured through the Registry Browser window.
+Configure the Registry Data Collector through the Registry Browser window.
The configurable options are:
-- Sample Host – The host to connect to. If this box is left blank, the connection is to the local
+- Sample Host – The host to connect to. If you leave this box blank, the connection is to the local
host.
- 64-bit view – The default view is 32-bit. Select the **64-bit view** checkbox to switch to a
64-bit view.
-- Connect – Connect to host’s registry. If no host is specified in the Sample Host box, the
+- Connect – Connect to host’s registry. If you don't specify a host in the Sample Host box, the
connection is to the local host’s registry.
- Query 32-bit view – Select this checkbox to query the 32-bit view of the registry
- Query 64-bit view – Select this checkbox to query the 64-bit view of the registry
-- Name – The key value. Key values can be added to the Selected Properties list by pressing the
- **ctrl** key, selecting the keys to add, and then clicking the **Add currently selected value**
- button.
+- Name – The key value. To add key values to the Selected Properties list, press the **ctrl** key,
+ select the keys to add, and click the **Add selected value** button.
- Type – The key value type
- Data – The key value path
- Root Path – The path to the selected key
@@ -71,11 +70,11 @@ to do the following:
| Icon | Name |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
|  | Select all peer keys for this node |
-|  | Add name of currently selected key |
-|  | Add full path of the currently selected key |
-|  | Add last write date/time of currently selected key |
+|  | Add name of selected key |
+|  | Add full path of the selected key |
+|  | Add last write date/time of selected key |
|  | Add security properties for selected key |
|  | Enumerate all values for this key |
-|  | Add currently selected value |
+|  | Add selected value |
|  | Delete properties from selection |
|  | Go to selected key |
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/script/add.md b/docs/accessanalyzer/12.0/admin/datacollector/script/add.md
index 7307e07660..2f2fc386ff 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/script/add.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/script/add.md
@@ -6,17 +6,17 @@ sidebar_position: 20
# Add a Script to an Existing Query
-The Query Properties window provides the ability to add a script to an existing query. Typically, a
-script is used to augment a query providing services such as conversion of returned data.
+The Query Properties window lets you add a script to an existing query. Typically, you use a
+script to augment a query, providing services such as converting returned data.
-Follow the steps to add a script.
+To add a script:
**Step 1 –** Navigate to the job's **Configure** node and select **Queries**.
**Step 2 –** Click **Create Query** to open the Query Properties window.
-**Step 3 –** Select the **Data Source** tab and select the desired data collector in the Data
-Collector drop-down menu.
+**Step 3 –** Select the **Data Source** tab and select the data collector you want in the Data
+Collector dropdown menu.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/script/editor.md b/docs/accessanalyzer/12.0/admin/datacollector/script/editor.md
index da9ee8b3d8..6968b73531 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/script/editor.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/script/editor.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# VBScript Editor
-The VBScript Editor window provides the means to add a script. The window is ideal for editing small
+The VBScript Editor window lets you add a script. The window is ideal for editing small
scripts and for pasting larger scripts from external scripting tools.
@@ -14,10 +14,10 @@ scripts and for pasting larger scripts from external scripting tools.
The options in the VBScript Editor are:
- Save and Close – Use this option to save the script and close the window
-- Syntax Check – Use this option to check the syntax of your script. This does not identify logic
+- Syntax Check – Use this option to check the syntax of your script. This doesn't identify logic
errors, only cases where the script syntax is incorrect. It helps reduce the overhead of debugging
- a script. When selected, a Script Errors window opens and a syntax check is performed. Any
- syntactical errors are displayed within the window.
+ a script. When you select this option, a Script Errors window opens and performs a syntax check,
+ displaying any syntax errors within the window.
- Load from file – Use this option to load a VB script from a .vbs file
- Save to file – Use this option to save the current script in the Editor
- Undo – Undo previous changes made to the script (Shortcut is Ctrl+Z)
@@ -25,8 +25,8 @@ The options in the VBScript Editor are:
- Cut – Cut the highlighted text
- Copy – Copy the highlighted text
- Paste – Paste cut or copied text into the VB Script Editor
-- Online VBScript Language Reference – Opens internet browser to the Microsoft Technical
- Documentation website from where documentation for Visual Basic Script can be navigated to
+- Online VBScript Language Reference – Opens a web browser to the Microsoft Technical
+ Documentation website, where you can find documentation for Visual Basic Script
After adding or modifying a script, click **Save and close**.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/script/example1.md b/docs/accessanalyzer/12.0/admin/datacollector/script/example1.md
index ce0a66a03e..60f019a663 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/script/example1.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/script/example1.md
@@ -7,26 +7,26 @@ sidebar_position: 70
# Script Example 1: Conversion of Data
This script example demonstrates how to perform a query and modify returned data. The script
-provides the data collector with the information that would have been provided if the user interface
-had been used to design the query. However, in this case it is all done through script. The data
-collector returns a value that is then converted and stored by Access Analyzer.
+provides the data collector with the same information you would provide by using the user
+interface to design the query. However, in this case, the script does all of this instead. The
+data collector returns a value that Access Analyzer then converts and stores.
-This script starts by defining a query using the Perfmon Data Collector. Notice that the
-**WorkingQuery** object is used, not the Query object. This is done to preserve the Query object,
-since the Query object will be used to store the results that are different from what the data
-collector is providing.
+This script starts by defining a query using the Perfmon Data Collector. Notice that the script
+uses the **WorkingQuery** object, not the Query object. The script preserves the Query object this
+way, because it later uses the Query object to store results that differ from what the data
+collector provides.
-The script then issues the query by calling `WorkingQuery.Execute`. When the query completes,
-**WorkingQuery** is set to view the first row of results by setting the **ResultRow** property. The
-value within the **System Up Time** property is then transferred into the `REMAINDER` variable so
-that it can be more easily manipulated.
+The script then issues the query by calling `WorkingQuery.Execute`. When the query completes, the
+script sets **WorkingQuery** to view the first row of results by setting the **ResultRow**
+property. The script then transfers the value within the **System Up Time** property into the
+`REMAINDER` variable for easier manipulation.
The script then takes the value of `REMAINDER`, which is in seconds, and converts it to days, hours,
-minutes, and seconds. These values are then recorded in the Query object so that Access Analyzer can
-store this data.
+minutes, and seconds. The script then records these values in the Query object so that Access
+Analyzer can store this data.
:::note
-In this task, the hours, minutes, and seconds properties were specified manually using the
+In this task, you specified the hours, minutes, and seconds properties manually using the
task dialog. See the [Script Properties](/docs/accessanalyzer/12.0/admin/datacollector/script/properties.md) topic for additional information.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/script/example2.md b/docs/accessanalyzer/12.0/admin/datacollector/script/example2.md
index aa4ec0cc63..245afe1854 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/script/example2.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/script/example2.md
@@ -11,25 +11,26 @@ database list from SQL Server and then proceeds to the File System Data Collecto
the database file, essentially inventorying the installed databases, their paths, and sizes.
:::note
-Because the object instances are not thread-safe, scripts like these that use objects
-external to Access Analyzer should be run with only one thread.
+Because the object instances aren't thread-safe, run scripts like these that use objects
+external to Access Analyzer with only a single thread.
:::
-In this example, a connection is opened with a SQL server. The SQL server name is provided by Access
-Analyzer during the query. Access Analyzer provides the active host to the script using the
+In this example, the script opens a connection with a SQL server. Access Analyzer provides the SQL
+server name during the query. Access Analyzer provides the active host to the script using the
**Query.Host** property.
The script then queries the Master database, requesting a **recordset** containing all databases and
-proceeds to get the row count. Setting the **Query.ResultRows** property creates a row of storage
-for each record in the recordset. It then proceeds to read data from each row by looping row by row.
-For each row, the database name, filename, and ID are captured. The script then calls a function to
-get the size of the file. The **FileSize** function uses the database filename to construct a query
-to the File System Data Collector, which ultimately returns the size of the file.
+gets the row count. Setting the **Query.ResultRows** property creates a row of storage
+for each record in the recordset. It then reads data from each row, looping row by row.
+For each row, the script captures the database name, filename, and ID. The script then calls a
+function to get the size of the file. The **FileSize** function uses the database filename to
+construct a query to the File System Data Collector, which ultimately returns the size of the
+file.
-The data for each database is stored in the Query object.
+The script stores the data for each database in the Query object.
-Finally, the SQL objects are freed.
+Finally, the script frees the SQL objects.
## Example of Compound Query Script
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/script/methodsproperties.md b/docs/accessanalyzer/12.0/admin/datacollector/script/methodsproperties.md
index 72509af3da..776e87170b 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/script/methodsproperties.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/script/methodsproperties.md
@@ -13,7 +13,7 @@ The Query and Working Query objects support the following methods and properties
| Methods | Description |
| -------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Execute | Executes the object query. Use this to perform the query after setting the source, path, and properties. |
-| Reset | Resets the object’s properties to their original values. Use this if the source, path, or properties have been modified, but the original values are desired. |
+| Reset | Resets the object’s properties to their original values. Use this if you modified the source, path, or properties, but want the original values. |
| AddProperty (attributes : string) | Adds a property to the query. Using the following format: NAME=``;COLUMN=``;VALUE=``;DATATYPE=``;SIZE=``;KEY=`` |
| DeleteProperty (propertyname : string) | Removes a property from a query. |
@@ -26,7 +26,7 @@ The Query and Working Query objects support the following methods and properties
| Path : sting | Sets or retrieves the path |
| Paths : integer | Sets or retrieves the current path for multi-path tasks |
| ResultData (Property : string) : Variant | Sets or retrieves the value for the property specified |
-| ResultData (PropertyIndex : integer) : Variant | Sets ResultRow to the desired row before accessing this property |
+| ResultData (PropertyIndex : integer) : Variant | Sets ResultRow to the row you want before accessing this property |
| ResultRow : integer | Sets or retrieves the current row. For non-enumerated tasks, ResultRow will always be 0. |
-| ResultRows : integer | Sets or returns the count of rows. Use this to determine the number of rows returned after an enumerated task is executed. Set this property to create a multi-row return value. |
+| ResultRows : integer | Sets or returns the count of rows. Use this to determine the number of rows returned after an enumerated task runs. Set this property to create a multi-row return value. |
| Message (index : integer, type : string) | Sets or returns a message in the indicated position. Use MessageCount to determine the number of messages. These messages appear in the job MessageLog. |
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/script/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/script/overview.md
index 3ab6edc2b1..27cbc8932e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/script/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/script/overview.md
@@ -7,22 +7,22 @@ sidebar_position: 320
# Script Data Collector
The Script Data Collector provides VB Script exit from Access Analyzer. Static queries are sometimes
-inadequate for demanding auditing tasks. The Script Data Collector provides a means to add a custom
+inadequate for demanding auditing tasks. The Script Data Collector lets you add a custom
script to a query. Access Analyzer implements Microsoft Visual Basic Script (VB Script) with
-extensions that provide script writers the ability to interface directly with Access Analyzer.
+extensions that let script writers interface directly with Access Analyzer.
The following examples describe situations where using a script may be useful:
- Conversions – One of the most frequent uses of a scriptis for converting a value from one thing to
another, for example `build1230` to `at risk`. See the
[Script Example 1: Conversion of Data](/docs/accessanalyzer/12.0/admin/datacollector/script/example1.md) topic for additional information.
-- Compound Queries – This is a query that cannot be performed using a single query. See the
+- Compound Queries – A query you can't perform using a single query. See the
[Script Example 2: Command Query](/docs/accessanalyzer/12.0/admin/datacollector/script/example2.md) topic for additional information.
- Interfacing with External Systems – This is a query that requires access to external data. For
example, the query needs to access a corporate database to obtain a location code.
-The Script Data Collector is a core component of Access Analyzer, but it has been preconfigured
-within the Windows Solution. While the data collector is available with all Access Analyzer license
+The Script Data Collector is a core component of Access Analyzer, but Access Analyzer
+preconfigures it within the Windows Solution. While the data collector is available with all Access Analyzer license
options, the Windows Solution is only available with a special Access Analyzer license. See the
[Windows Solution](/docs/accessanalyzer/12.0/solutions/windows/overview.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/script/properties.md b/docs/accessanalyzer/12.0/admin/datacollector/script/properties.md
index 3afff6df1a..c61dfa267c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/script/properties.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/script/properties.md
@@ -6,31 +6,31 @@ sidebar_position: 60
# Script Properties
-The Data Source tab is used to select the data collector to be used. The configurable options are:
+Use the Data Source tab to select the data collector. The configurable options are:
- Source – Used to select data collector
- Path – Displays the returned path from the data collector
:::warning
- Editing the path is considered an advanced operation. Entering an incorrect value
+ Editing the path is an advanced operation. Entering an incorrect value
may render the query inoperable.
:::
- - The path is used to identify the selection from within the data collector. The path
+ - The path identifies the selection from within the data collector. The path
essentially tells the data collector where the data is and depending on the data collector,
may define selected options. It is sometimes convenient to edit the path manually.
- - For example: If defining a file system query using the File System Data Collector, the path
- would automatically be filled in with the selected details. A minor change like changing the
- file location can be done manually by editing the path.
+ - For example, if you define a file system query using the File System Data Collector, the
+ data collector automatically fills in the path with the selected details. You can manually
+ make minor changes, like changing the file location, by editing the path.
-- Properties – As the Path is used to define where the target data is, the properties are used to
- define what data is desired. Each property has a series of attributes including:
+- Properties – As the Path defines where the target data is, the properties define what data you
+ want. Each property has a series of attributes including:
- Name – Identifies the target data. Modifying this affects what data the data collector
returns.
- Column – Specifies the column name within the result data. Use this to specify the column name
- that will be used within the report output. This is set by default to match the **Name**
+ for the report output. Access Analyzer sets this by default to match the **Name**
attribute.
- DataType – Used to determine the format of the data for reporting purposes. It affects sorting
order and the ability to graph content. In some cases, the data collector is unable to
@@ -43,24 +43,24 @@ The Data Source tab is used to select the data collector to be used. The configu
- For example: Querying the registry for a value stored as **REG_SZ** returns a string, as
- **REG_SZ** is a string type in the registry. However, sometimes numbers are recorded in
- **REG_SZ** entries. If you determine that the content returned could always be interpreted as
- numeric, you could override the default `STRING` value and set it to `NUMERIC`. This provides
+ **REG_SZ** is a string type in the registry. However, sometimes **REG_SZ** entries contain
+ numbers. If you determine that the returned content is always numeric, you can override the
+ default `STRING` value and set it to `NUMERIC`. This provides
proper sorting and charting ability.
- Size – Used to determine the width of the field used to hold String data. Setting the size smaller
than the actual returned data will cause Access Analyzer to truncate the data in the view.
However, the actual stored data in the result table will contain the full result.
- Value – Reserved for internal use
-- Key – Used to identify a key property. A key property is used to identify the property that
- contains a unique value for enumerated tasks. A Key value is required for Change Detection and
- Conformance Management on enumerated tasks. To identify a property that uniquely identifies each
+- Key – Used to identify a key property. A key property identifies the property that
+ contains a unique value for enumerated tasks. Change Detection and Conformance Management on
+ enumerated tasks require a Key value. To identify a property that uniquely identifies each
row, set the Key attribute to `YES`.
## Adding and Removing Properties Manually
-Although the property list is automatically populated by the data collectors, additional properties
-may be added manually. Doing so allocates storage within Access Analyzer during data collection and
+Although the data collectors automatically populate the property list, you can add additional
+properties manually. Doing so allocates storage within Access Analyzer during data collection and
creates corresponding columns in the output table. Use a script to reference and populate these
properties.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/script/reference.md b/docs/accessanalyzer/12.0/admin/datacollector/script/reference.md
index 730b1062d7..3907ca3057 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/script/reference.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/script/reference.md
@@ -6,21 +6,21 @@ sidebar_position: 50
# Script Reference
-Access Analyzer provides extensions to standard Visual Basic Script. These extensions allow access
-to and manipulation of task data, in addition to invoking queries. They are implemented through two
-objects.
+Access Analyzer provides extensions to standard Visual Basic Script. These extensions let you
+access and manipulate task data, in addition to invoking queries. Access Analyzer implements them
+through two objects.
**Query Object**
The Query object provides access to the current query configuration and data. Use this to examine
-the results of a query or to manipulate the query before it is executed. Changing properties of this
-object will change the way the task is executed by Access Analyzer.
+the results of a query or to manipulate the query before Access Analyzer executes it. Changing
+properties of this object changes the way Access Analyzer executes the task.
**Working Query Object**
The Working Query object is identical to the Query object. This object supports the same methods and
-properties as the Query object but its properties and methods do not access the current query. Think
-of this object as allowing the ability to create a task on the fly. Use this object to perform
-queries, while leaving the original task undisturbed. This is valuable when performing compound
-queries isneeded. See the [Script Example 2: Command Query](/docs/accessanalyzer/12.0/admin/datacollector/script/example2.md) topic for additional
+properties as the Query object but its properties and methods don't access the current query. Think
+of this object as letting you create a task dynamically at runtime. Use this object to perform
+queries, while leaving the original task undisturbed. This is valuable when you need to perform
+compound queries. See the [Script Example 2: Command Query](/docs/accessanalyzer/12.0/admin/datacollector/script/example2.md) topic for additional
information.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/script/run.md b/docs/accessanalyzer/12.0/admin/datacollector/script/run.md
index 473121d8a0..1ed45cbeb3 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/script/run.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/script/run.md
@@ -6,16 +6,16 @@ sidebar_position: 10
# Run a Stand-Alone Script
-Some situations require a script to be used exclusively without defining a data source. The Query
-Properties window provides the ability to add and run a script.
+Some situations require you to use a script exclusively without defining a data source. The Query
+Properties window lets you add and run a script.
-Follow the steps to add a script.
+To add a script:
**Step 1 –** Go to the job's **Configure** node and select **Queries**.
**Step 2 –** Click **Create Query** to open the Query Properties window.
-**Step 3 –** Select the **Data Source** tab, and select **SCRIPT** in the Data Collector drop-down
+**Step 3 –** Select the **Data Source** tab, and select **SCRIPT** in the Data Collector dropdown
menu.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/services.md b/docs/accessanalyzer/12.0/admin/datacollector/services.md
index 484851de5a..b00fc9fca0 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/services.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/services.md
@@ -7,8 +7,8 @@ sidebar_position: 330
# Services Data Collector
The Services Data Collector enumerates status and settings from remote services. The Services Data
-Collector is a core component of Access Analyzer, but it has been preconfigured within the Windows
-Solution. While the data collector is available with all Access Analyzer license options, the
+Collector is a core component of Access Analyzer, but Access Analyzer preconfigures it within the
+Windows Solution. While the data collector is available with all Access Analyzer license options, the
Windows Solution is only available with a special Access Analyzer license. See the
[Windows Solution](/docs/accessanalyzer/12.0/solutions/windows/overview.md) topic for additional information.
@@ -28,7 +28,7 @@ Windows Solution is only available with a special Access Analyzer license. See t
## Services Query Configuration
-The Services Data Collector is configured through the Service Browser window.
+Configure the Services Data Collector through the Service Browser window.
@@ -36,14 +36,15 @@ The Services Data Collector is configured through the Service Browser window.
- All Services – Select this option to build the query to extract information from all services on
the target host
- Specific Services – Select this option to build the query to extract information from specific
- services on the target host. Select the checkboxes next to the desired services for the query
+ services on the target host. Select the checkboxes next to the services you want for the query
after clicking **Connect**.
- Connect – Click **Connect** to connect to the host and display a list of all services found
-- Available Properties – Select the properties to be returned
+- Available Properties – Select the properties to return
:::note
-In cases where the query does not find the selected services on the target host, the
-`InternalName` column that is returned reflects the `DisplayName` column and no other values are
-retrieved. If the services are found on the host, the `DisplayName` value in the table is resolved.
+In cases where the query doesn't find the selected services on the target host, the
+returned `InternalName` column reflects the `DisplayName` column, and the query retrieves no other
+values. If the query finds the services on the host, it resolves the `DisplayName` value in the
+table.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/collectionmethod.md b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/collectionmethod.md
index e2f7f09b89..534f4a5a60 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/collectionmethod.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/collectionmethod.md
@@ -6,13 +6,13 @@ sidebar_position: 60
# SMARTLog: Collection Method
-The Collection Method page is used to select the collection method employed by the data collector.
-It is a wizard page for all log types.
+Use the Collection Method page to select the collection method the data collector uses. This
+wizard page applies to all log types.
-Select the collection method from the following options to set how the collection routine is
-executed to collect the data from the target.
+Select the collection method from the following options to set how the collection routine collects
+data from the target.
- Using network query – Connects to the target log over the network via RPC and reads events
- Using server side applet – Deploys a remote executable to the target host and then runs as a
@@ -20,17 +20,17 @@ executed to collect the data from the target.
Access Analyzer Console.
:::note
- The applet cannot be used to target the local host.
+ You can't use the applet to target the local host.
:::
- Copy the log locally and process (Not available for all query scenarios) – Extract events from an
- offline log by moving the log to the Access Analyzer Console and having it processed on the local
- host instead of the target host. In order to use this option, the log type selected for the query
+ offline log by moving the log to the Access Analyzer Console and processing it on the local
+ host instead of the target host. To use this option, the log type selected for the query
must be **Windows Event Log (Archived)**.
-The Applet Options section is only visible when the **Using server side applet** collection method
-is selected.
+The Applet Options section is only visible when you select the **Using server side applet**
+collection method.
- Connection retries count – The number of times to retry a failed connection. The default is 15.
- Retry delay (ms) – The time between retries of a failed connection. The default is 5000
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/criteria.md b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/criteria.md
index 39da93264d..34811f6ffb 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/criteria.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/criteria.md
@@ -6,15 +6,15 @@ sidebar_position: 50
# SMARTLog: Criteria
-The Criteria page is used to specify the search criteria. A test query can be run with the sample
-host entered on the Sample Host page to confirm the results that will be returned by the query. It
-is a wizard page for all log types.
+Use the Criteria page to specify the search criteria. You can run a test query with the sample
+host you entered on the Sample Host page to confirm the results the query will return. This
+wizard page applies to all log types.
The **Limit number of records to** setting has a default of `1000`.
-Follow the steps to configure the search criteria.
+To configure the search criteria:
@@ -36,12 +36,11 @@ that level. The available options are **AND**, **OR**, **NOT AND**, and **NOT O
- To remove a row (condition or group), click the ellipsis (**…**) on the row and select **Remove
Row**
-- To remove all currently configured criteria, click **Filter** and select **Clear All**
+- To remove all configured criteria, click **Filter** and select **Clear All**
-**Step 6 –** Click **Show data** to run a test query and sample the data that will be returned that
-is connected to a target log based upon the configured criteria. The data is displayed in the
-Records found table.
+**Step 6 –** Click **Show data** to run a test query and sample the data that the query returns
+from the target log based on the configured criteria. The Records found table displays the data.
-The search criteria has now been configured and the results it returns tested. Configure the
-criteria further if the returned results are not as expected, or click **Next** to continue to the
+You have now configured the search criteria and tested the results it returns. Configure the
+criteria further if the returned results aren't as expected, or click **Next** to continue to the
next wizard page.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/eventlogoptions.md b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/eventlogoptions.md
index 9e9e54d4f5..b2d11969e0 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/eventlogoptions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/eventlogoptions.md
@@ -6,12 +6,12 @@ sidebar_position: 80
# SMARTLog: Event Log Options
-The Event Log Options page is used to configure additional options. It is a wizard page for all log
-types.
+Use the Event Log Options page to configure additional options. This wizard page applies to all
+log types.
-The following additional options can be selected:
+You can select the following additional options:
- Lookup user name – Resolves SIDs found in the event descriptions to friendly display name values
- Resolve GUIDs – Resolves GUIDs found in the event descriptions to friendly display name values
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/logstate.md b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/logstate.md
index 36e1a5c091..9d00369c7f 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/logstate.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/logstate.md
@@ -6,12 +6,12 @@ sidebar_position: 70
# SMARTLog: Log State
-The Log State page is used to configure how to search the log. It is a wizard page for all log
+Use the Log State page to configure how to search the log. It's a wizard page for all log
types.
-Select the **Persist log state** checkbox to search the log from where the search last left off. A
-state file is created for each host configured in the query. State files can be viewed within Access
-Analyzer and are named by the query GUID. State files display the record the search last left off
-on, the event log, and the date of the last entry.
+Select the **Persist log state** checkbox to search the log from where the search last left off.
+Access Analyzer creates a state file for each host configured in the query. You can view state
+files, named by the query GUID, within Access Analyzer. State files display the record the search
+last left off on, the event log, and the date of the last entry.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/logtype.md b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/logtype.md
index 8da04a8a2e..b72864139e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/logtype.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/logtype.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# SMARTLog: Log Type
-The Log Type page is used to select the log type to be processed.
+Use the Log Type page to select the log type to process.
@@ -15,16 +15,16 @@ The log types are:
- Windows Event Log – Connects to and extract information from any Windows event log made available
on the target host
- Windows Event Log (Archived) – Extract events from an offline log by moving the log to the Access
- Analyzer Console and having it processed on the local host instead of the target host
+ Analyzer Console and processing it on the local host instead of the target host
- Internet Information Server Log – An Exchange query that returns information from Outlook Web
Access IIS logs found on CAS servers
- - The IIS log must be configured to generate specific columns in order for the SMARTLog Data
+ - You must configure the IIS log to generate specific columns for the SMARTLog Data
Collector to audit them. See the
[IIS Log Auditing Requirements](#iis-log-auditing-requirements) topic for additional
information.
-- File Change Detection Log – This is a legacy option. It should not be selected.
+- File Change Detection Log – This is a legacy option. Don't select it.
## IIS Log Auditing Requirements
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/overview.md
index 52235e1601..ffbf797e7f 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/overview.md
@@ -9,8 +9,8 @@ sidebar_position: 350
The SMARTLog Data Collector provides search and extraction of details from Windows Event Logs
(online or offline) and Microsoft Exchange Internet Information Server (IIS) logs.
-The SMARTLog Data Collector is a core component of Access Analyzer, but it has been preconfigured
-within the Active Directory Solution, Exchange Solution, SQL Solution, and the Windows Solution.
+The SMARTLog Data Collector is a core component of Access Analyzer, but the Active Directory
+Solution, Exchange Solution, SQL Solution, and Windows Solution preconfigure it.
While the data collector is available with all Access Analyzer license options, these solutions are
only available with a special Access Analyzer licenses. See following sections for additional
information:
@@ -43,7 +43,7 @@ topic for additional information related to permissions required for targeting E
## SMARTLog Query Configuration
-The SMARTLog Data Collector is configured through the SMART Log DC Wizard, which contains the
+You configure the SMARTLog Data Collector through the SMART Log DC Wizard, which contains the
following wizard pages:
- Welcome
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/results.md b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/results.md
index cb0d24107d..c73e85eccc 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/results.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# SMARTLog: Results
-The Results page is where the events to be returned by the query are selected. It is a wizard page
-for all log types. The description strings within the log records can also be selected for the
+Use the Results page to select the events that the query returns. It's a wizard page
+for all log types. You can also select the description strings within the log records for the
query.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/samplehost.md b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/samplehost.md
index 9a9fa6cc22..ef44c61ae0 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/samplehost.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/samplehost.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# SMARTLog: Sample Host
-The Sample Host page is used to configure the host. It is a wizard page for all log types.
+Use the Sample Host page to configure the host. It's a wizard page for all log types.
@@ -38,16 +38,16 @@ and select a computer. The options in the Select Computer window are:
-The Common Queries section is included on the advanced Select Computer window in addition to object
-type and location in the original Select Computer window.
+The advanced Select Computer window includes the Common Queries section in addition to object
+type and location from the original Select Computer window.
-- Name – Select a qualifier from the drop-down menu and enter a name of an object in the associated
+- Name – Select a qualifier from the dropdown menu and enter a name of an object in the associated
text box
-- Description – Select a qualifier from the drop-down menu and enter a description in the associated
+- Description – Select a qualifier from the dropdown menu and enter a description in the associated
text box
- Select the **Disabled accounts** checkbox to include disabled accounts in the search
- Select the **Non-expiring password** checkbox to include non-expiring passwords in the search
-- Select the number of **Days since last logon** from the drop-down menu
+- Select the number of **Days since last logon** from the dropdown menu
- Click the **Columns** button to open the Choose Columns window
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/summary.md
index fabf9bd49e..b27a82cabf 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/summary.md
@@ -10,5 +10,5 @@ The Summary page displays a summary of the configured query. It is a wizard page
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the SMART Log DC Wizard to ensure that no accidental clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the SMART Log DC Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/targetlog/filedetectionlog.md b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/targetlog/filedetectionlog.md
index 625deb733c..47ac072a1e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/targetlog/filedetectionlog.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/targetlog/filedetectionlog.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# SMARTLog: Target Log for File Detection Log Type
-The Target Log page is where logs are selected to be collected. This version is a wizard page for
+Use the Target Log page to select logs to collect. This version is a wizard page for
the File Change Detection log type.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/targetlog/targetlog.md b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/targetlog/targetlog.md
index 74d723f8d6..680cbec1fb 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/targetlog/targetlog.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/targetlog/targetlog.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# SMARTLog: Target Log
-The Target Log page is where logs are selected to be collected. There are three versions of this
+Use the Target Log page to select logs to collect. There are three versions of this
wizard page that change based on log type. This version is a wizard page for the log types of:
- Windows Event Log (Archived)
@@ -21,9 +21,9 @@ information on the other versions of this wizard page.
The configurable options are:
- Path – Enter or browse to the path to the log
-- File mask – Enter file names to limit the file names to return from the path entered. Asterisks
- can be used for wildcards. For example, `u_ex*.log` would match **u_ex170530.log**. When no mask
- is set, all files from the listed path are returned.
+- File mask – Enter file names to limit the file names to return from the path entered. Use asterisks
+ for wildcards. For example, `u_ex*.log` would match **u_ex170530.log**. If you don't set
+ a mask, Access Analyzer returns all files from the listed path.
- Log files to be processed – Select from the following options:
- All
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/targetlog/windowseventlog.md b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/targetlog/windowseventlog.md
index 8f22e62c05..ac719082c7 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/smartlog/targetlog/windowseventlog.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/smartlog/targetlog/windowseventlog.md
@@ -6,10 +6,10 @@ sidebar_position: 10
# SMARTLog: Target Log for Windows Event Log Type
-The Target Log page is where logs are selected to be collected. This version is a wizard page for
+Use the Target Log page to select logs to collect. This version is a wizard page for
the log type of Windows Event Log.
-Only one log can be targeted per query task. The selected log is displayed at the bottom of the
-wizard page.
+You can target only one log per query task. Access Analyzer displays the selected log at the
+bottom of the wizard page.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/activitydatescope.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/activitydatescope.md
index d08aa3550b..5165450144 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/activitydatescope.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/activitydatescope.md
@@ -6,17 +6,17 @@ sidebar_position: 110
# SPAA: Activity Date Scope
-The Activity Date Scope page is where the range of dates for which the SharePoint activity scan will
-collect data is configured. It is a wizard page for the category of Scan SharePoint Activity.
+Use the Activity Date Scope page to configure the range of dates for which the SharePoint activity
+scan collects data. It's a wizard page for the category of Scan SharePoint Activity.
Use the radio buttons to select the **Scan Filters**.
- Relative Timespan
- - Collect Activity from the last 180 days – The number of days to collect activity can be
- configured with the up and down arrows
- - Retain data – The timespan for data retention. Select from the drop-down list:
+ - Collect Activity from the last 180 days – Configure the number of days to collect activity
+ with the up and down arrows
+ - Retain data – The timespan for data retention. Select from the dropdown list:
- within timespan
- forever
- Absolute Timespan
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/activityloglocations.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/activityloglocations.md
index 2dcdfbad4c..3312846a13 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/activityloglocations.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/activityloglocations.md
@@ -6,8 +6,8 @@ sidebar_position: 120
# SPAA: Activity Log Locations
-The Activity Log Locations page is where to manually configure log locations to avoid requiring
-remote registry access to locate the activity event log files. It is a wizard page for the category
+Use the Activity Log Locations page to manually configure log locations, to avoid requiring remote
+registry access to locate the activity event log files. It's a wizard page for the category
of Scan SharePoint Activity.
@@ -16,7 +16,7 @@ The options in the Activity Log Locations page are:
- Add – Opens the Customize Activity Log UNC Paths location window to add a new host
- Add Default – Opens the Customize Activity Log UNC Paths location window for the default host
-- Edit – Opens the Customize Activity Log UNC Paths window for the selected host. If edits are made,
+- Edit – Opens the Customize Activity Log UNC Paths window for the selected host. If you make edits,
click **OK** to save the changes.
- Remove – Removes the selected host
@@ -31,17 +31,17 @@ The options in the Customize Activity Log UNC Paths Window are:
Activity Logs (as configured in **Activity Monitor** > **Monitored Hosts**)
:::note
- For On-Premises environments you do not need to specify an Activity Log UNC path as
+ For On-Premises environments you don't need to specify an Activity Log UNC path as
the Data Collector will default to finding the log locations via the registry.
:::
- Activity archive UNC path – UNC path to the archive location of Activity Logs (as configured in
- **Activity Monitor** > **Agents**). If archiving is not enabled in Activity Monitor this can be
- left blank.
+ **Activity Monitor** > **Agents**). If you haven't enabled archiving in Activity Monitor, you can
+ leave this blank.
:::note
-In any UNC paths, `%HOST%` will be replaced with the host name.
+In any UNC paths, Access Analyzer replaces `%HOST%` with the host name.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/additionalscoping.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/additionalscoping.md
index a61e6ecc99..5593ae520a 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/additionalscoping.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/additionalscoping.md
@@ -6,33 +6,33 @@ sidebar_position: 60
# SPAA: Additional Scoping
-The Additional Scoping page is where the scan can be limited by depth of the scan. It is a wizard
+Use the Additional Scoping page to limit the scan by depth. It's a wizard
page for the categories of:
- Scan SharePoint Access
- Scan For Sensitive Content
:::warning
-Users should not change scans in a way that would result in less data being returned on
-a subsequent scan (i.e. scanning fewer web applications, scanning fewer site collections, or a
-shallower depth scan). Those resources not included in a subsequent scan are marked as deleted in
-the Tier 2 database and subsequently removed from the Tier 1 database.
+Don't change scans in a way that results in returning less data on a subsequent scan (i.e.
+scanning fewer web applications, scanning fewer site collections, or a shallower depth scan).
+Access Analyzer marks resources not included in a subsequent scan as deleted in the Tier 2
+database and later removes them from the Tier 1 database.
:::
-If checked, set the **Limit scanned depth to: [number] level(s)** option to the desired depth. If
-this option is not checked then the entire farm is scanned. If the scoping depth is set to **0**
-then only root site collections are scanned. Each increment to the depth adds an additional level of
-depth from that point.
+If checked, set the **Limit scanned depth to: [number] levels** option to the depth you want. If
+you don't check this option, Access Analyzer scans the entire farm. If you set the scoping depth to
+**0**, Access Analyzer scans only root site collections. Each increment to the depth adds an
+additional level of depth from that point.
Check the **Perform differential scan** box to enable the job to run a differential scan.
-Differential scanning is enabled by default. When this option is enabled, SPAA scan will only parse
-files for content/SDD if it has been modified since the last scan.
+Access Analyzer enables differential scanning by default. When you enable this option, the SPAA
+scan will only parse files for content/SDD if they changed since the last scan.
:::note
-This option only applies to Tag collection and Sensitive data collection. Files will be
-still be scanned for permissions regardless of whether this option is checked or not.
+This option only applies to Tag collection and Sensitive data collection. Access Analyzer will
+still scan files for permissions regardless of whether you check this option.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/agentsettings.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/agentsettings.md
index 7038dc3f79..ccdf7d05e3 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/agentsettings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/agentsettings.md
@@ -6,20 +6,20 @@ sidebar_position: 70
# SPAA: Agent Settings
-The Agent Settings page is where the SharePoint Agent Service is configured. It is a wizard page for
+Use the Agent Settings page to configure the SharePoint Agent Service. It's a wizard page for
the category of Scan SharePoint Access.
The **Enable Agent Service Scans** checkbox enables collecting SharePoint data through the agent
-services instead of directly from SharePoint. This option requires a **Network Port** to be entered.
+services instead of directly from SharePoint. This option requires you to enter a **Network Port**.
Agent Service Identity radio buttons are:
- Use Job Credentials when job has same credentials as agent services
- Use Custom Identity for other agent service credential scenarios
- Specify identity in the format `spn:name` or `upn:name`
- - The token `%HOST%` may be substituted for the host name
+ - You can substitute the token `%HOST%` for the host name
-This option requires the SharePoint Agent to be installed on the application server. See the
+This option requires you to install the SharePoint Agent on the application server. See the
[SharePoint Agent Installation](/docs/accessanalyzer/12.0/install/sharepointagent/overview.md) topic for additional
information.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/bulkimportsettings.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/bulkimportsettings.md
index c51e8f0ac3..1904ce3948 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/bulkimportsettings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/bulkimportsettings.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# SPAA: Bulk Import Settings
-The Bulk Import Settings page is where the bulk import process settings are configured. It is a
+Use the Bulk Import Settings page to configure the bulk import process settings. It's a
wizard page for the categories of:
- Bulk Import Access Scan Results
@@ -14,7 +14,7 @@ wizard page for the categories of:
-Subsequent hosts in job lists will get host IDs incremented by 1. The Host Identifier may require an
-offset to avoid overlapping IDs in collected data. If the **Set Host ID** checkbox is left
-unchecked, then Access Analyzer assigns values starting from 1 to every host. This feature is
-intended only for SQL Server Replication.
+Access Analyzer increments host IDs by 1 for subsequent hosts in job lists. The Host Identifier may require an
+offset to avoid overlapping IDs in collected data. If you leave the **Set Host ID** checkbox
+unchecked, Access Analyzer assigns values starting from 1 to every host. Use this feature only for
+SQL Server Replication.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/category.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/category.md
index 901fdf3bd2..b2474a7d2b 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/category.md
@@ -30,7 +30,7 @@ The options on the Category page are:
Analyzer database
:::tip
-Remember, the sensitive data discovery options require the Sensitive Data Discovery Add-On to be
-installed on the Access Analyzer Console. If the SharePoint Agent is used, then it must also be
-installed on the application server that hosts the Central Administration component.
+Remember, the sensitive data discovery options require you to install the Sensitive Data Discovery
+Add-On on the Access Analyzer Console. If you use the SharePoint Agent, you must also install it on
+the application server that hosts the Central Administration component.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/configurejob.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/configurejob.md
index 04a0d6839f..136c7efdd7 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/configurejob.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/configurejob.md
@@ -6,12 +6,12 @@ sidebar_position: 20
# SharePoint Custom Connection Profile & Host List
-The SPAA Data Collector requires a custom Connection Profile and a custom host list to be created
-and assigned to the job conducting the data collection. The host inventory option during host list
-creation makes it necessary to configure the Connection Profile first. While SharePoint on-premises
-uses the Active Directory account type for the credential within a Connection Profile, it is
-necessary for online credentials to be listed first in the credentials list within a Connection
-Profile housing credentials to both environments.
+The SPAA Data Collector requires you to create a custom Connection Profile and a custom host list
+and assign them to the job conducting the data collection. The host inventory option during host
+list creation requires you to configure the Connection Profile first. While SharePoint on-premises
+uses the Active Directory account type for the credential within a Connection Profile, you must
+list online credentials first in the credentials list within a Connection Profile housing
+credentials to both environments.
## SharePoint Farm
@@ -25,17 +25,17 @@ The provisioned credential used should be an Active Directory account.
Create a Connection Profile and set the following information on the User Credentials window:
- Select Account Type – Active Directory Account
-- Domain – Drop-down menu with available trusted domains displays. Either type the short domain name
+- Domain – dropdown menu with available trusted domains displays. Either enter the short domain name
in the textbox or select a domain from the menu.
-- User name – Type the user name
+- User name – Enter the user name
- Password Storage – Choose the for credential password storage:
- Application – Uses Access Analyzer’s configured Profile Security setting as selected at the
**Settings** > **Application** node
- CyberArk – Uses the CyberArk Enterprise Password Vault
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
-Once the Connection Profile is created, it is time to create the custom host list. See the
+After you create the Connection Profile, create the custom host list. See the
[Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) topic for additional information.
### SharePoint Farm Host in a Custom Host List
@@ -43,7 +43,7 @@ Once the Connection Profile is created, it is time to create the custom host lis
The custom host list should include:
- One application server per farm
-- Host name without a domain suffix, this means the host name should not contain a period character
+- Host name without a domain suffix, this means the host name shouldn't contain a period character
See the [Add Hosts](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/add.md) section for instruction on creating a
custom static host list.
@@ -82,31 +82,31 @@ Create a Connection Profile and set the following information on the User Creden
- 5 – US Government-High
- 6 – US Government-DoD
- An example string matching the configuration from above is:
+ An example string that matches this configuration is:
C:\Program Files
(x86)\STEALTHbits\StealthAUDIT\PrivateAssemblies\spaa_cert_myorg.pfx,PasswordGoesHere,0
:::note
- `PasswordGoesHere` should be replaced with the password used when generating the
- self-signed X.509 certificate if the Microsoft Entra ID Application was Registered and
- Provisioned manually or the $appPassword parameter used in the SP_RegisterAzureAppAuth Instant
- Job if that method was used.
+ Replace `PasswordGoesHere` with the password used when generating the self-signed X.509
+ certificate if you registered and provisioned the Microsoft Entra ID Application manually, or
+ with the $appPassword parameter used in the SP_RegisterAzureAppAuth Instant Job if you used
+ that method.
:::
-Once the Connection Profile is created, it is time to create the custom host list. See the
+After you create the Connection Profile, create the custom host list. See the
[Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) topic for additional information.
### SharePoint Online Host in a Custom Host List
The custom host list should include:
-- Web or cloud hosts should be specified using the full web DNS part of the site URL, for example an
- Office 365 site with the URL http://TestSite.sharepoint.com should be added as a host with name
+- Specify web or cloud hosts using the full web DNS part of the site URL. For example, add an
+ Office 365 site with the URL http://TestSite.sharepoint.com as a host named
TestSite.sharepoint.com
-- Do not use the admin site, for example TestSite-admin.sharepoint.com
-- Do not use IP Addresses
+- Don't use the admin site, for example TestSite-admin.sharepoint.com
+- Don't use IP Addresses
- Host name must be in DNS format
See the [Add Hosts](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/add.md) topic for instructions on creating a custom
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/dlpauditsettings.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/dlpauditsettings.md
index 1d10e1f465..2f57e52b05 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/dlpauditsettings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/dlpauditsettings.md
@@ -6,14 +6,14 @@ sidebar_position: 90
# SPAA: DLP Audit Settings
-The DLP Audit Settings page is where sensitive data discovery settings are configured. It is a
+Use the DLP Audit Settings page to configure sensitive data discovery settings. It's a
wizard page for the category of Scan For Sensitive Content.
:::warning
-Users should not change scans in a way that would result in less data being returned on
-a subsequent scan (i.e. scanning fewer web applications, scanning fewer site collections, or a
-shallower depth scan). Those resources not included in a subsequent scan are marked as deleted in
-the Tier 2 database and subsequently removed from the Tier 1 database.
+Don't change scans in a way that results in returning less data on a subsequent scan (i.e.
+scanning fewer web applications, scanning fewer site collections, or a shallower depth scan).
+Access Analyzer marks resources not included in a subsequent scan as deleted in the Tier 2
+database and later removes them from the Tier 1 database.
:::
@@ -21,11 +21,11 @@ the Tier 2 database and subsequently removed from the Tier 1 database.
Configure the **Scan Performance** options:
-- Don’t process files larger than: Size Limit [number] MB – Limits the files to be scanned for
- sensitive content to only files smaller than the specified size. The checkbox is selected by
+- Don’t process files larger than: Size Limit [number] MB – Limits sensitive content scanning to
+ files smaller than the specified size. The checkbox is selected by
default. The default size is 2 MB.
- Number of SDD scan processes [number] – Increases the number of SDD scanner processes that spawn
- as part of a scan, increasing parallel scanning. The value should not exceed 2x the number of CPU
+ as part of a scan, increasing parallel scanning. The value shouldn't exceed 2x the number of CPU
threads available.
Use the radio buttons to select the **File types to scan**:
@@ -36,17 +36,16 @@ Use the radio buttons to select the **File types to scan**:
sensitive data content
:::note
- The OCR option is intended to work for clear scanned physical documents or documents
- directly converted to images, with standard fonts. It will not work for scanning photos of
- documents and may not be able to recognize text on images of credit cards, driver's licenses, or
- other identity cards.
+ Use the OCR option for clear scanned physical documents or documents directly converted to
+ images, with standard fonts. It won't work for scanning photos of documents and may not
+ recognize text on images of credit cards, driver's licenses, or other identity cards.
:::
Use the checkboxes to select to **Store Match Hits**:
- Store discovered sensitive data – Stores match hits for sensitive data in the SPAA Tier 2
- database. If this option is not selected, then the match hits for sensitive data are still
- reported but the data columns are masked in the database.
-- Limit stored matches per criteria to [number] – Enabled when the Store discovered sensitive data
- checkbox is selected. Limits the number of stored matches per criteria to the specified number.
+ database. If you don't select this option, Access Analyzer still reports the match hits for
+ sensitive data but masks the data columns in the database.
+- Limit stored matches per criteria to [number] – Active only when you select the Store discovered
+ sensitive data checkbox. Limits the number of stored matches per criteria to the specified number.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/droptables.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/droptables.md
index 7207b0a59b..9f9bb18050 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/droptables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/droptables.md
@@ -6,11 +6,11 @@ sidebar_position: 160
# SPAA Drop Tables & Views Workflow
-If it becomes necessary to clear the SPAA Data Collector tables and views to resolve an issue, the
-SP_DropTables Job is preconfigured to run analysis tasks that drop functions and views for the
-SharePoint Solution as well as the standard tables and views generated by the **SPAA** Data
+If you need to clear the SPAA Data Collector tables and views to resolve an issue, use the
+preconfigured SP_DropTables Job to run analysis tasks that drop functions and views for the
+SharePoint Solution, as well as the standard tables and views generated by the **SPAA** Data
Collector. It is available through the Instant Job Library under the SharePoint library. Since this
-job does not require a host to target, select **Local host** on the Hosts page of the Access
+job doesn't require a host to target, select **Local host** on the Hosts page of the Access
Analyzer Instant Job Wizard. See the [Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md) topic
for additional information.
@@ -20,7 +20,7 @@ Navigate to the **Jobs** > **SP_DropTables** > **Configure** node and select **A
the analysis tasks.
:::warning
-Applying these analysis tasks will result in the deletion of collected data.
+Applying these analysis tasks will delete collected data.
:::
@@ -37,10 +37,10 @@ The default analysis tasks are:
- **4. Drop SPAA Tables** – Drops the SharePoint Access Auditing tables imported from the previous
runs
-Do not try to run these tasks separately, as they are designed to work together. Follow these steps
-to run the analysis tasks:
+Don't try to run these tasks separately, since Netwrix designed them to work together. Follow
+these steps to run the analysis tasks:
-**Step 1 –** In the Analysis Selection Pane, click **Select All**. All tasks will be checked.
+**Step 1 –** In the Analysis Selection Pane, click **Select All**, which checks all tasks.
**Step 2 –** Right-click the **SP_DropTables** Job and select **Run Job**. The analysis execution
status will be visible from the **Running Jobs** node.
@@ -49,9 +49,9 @@ status will be visible from the **Running Jobs** node.
All** to deselect these analysis tasks.
:::info
-Do not leave these analysis tasks checked in order to avoid accidental data loss.
+Don't leave these analysis tasks checked to avoid accidental data loss.
:::
-All of these tables have been dropped from the SQL Server database and the data is no longer
-available.
+The SP_DropTables Job drops all of these tables from the SQL Server database, and the data is no
+longer available.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/overview.md
index 8f1e0824c0..0b526f5083 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 340
# SharePointAccess Data Collector
The SharePointAccess (SPAA) Data Collector audits access, group membership, and content within a
-SharePoint on-premises and SharePoint Online environment. The SPAA Data Collector has been
-preconfigured within the SharePoint Solution. Both this data collector and the solution are
+SharePoint on-premises and SharePoint Online environment. The SharePoint Solution
+preconfigures the SPAA Data Collector. Both this data collector and the solution are
available with a special Access Analyzer license. See the
[SharePoint Solution](/docs/accessanalyzer/12.0/solutions/sharepoint/overview.md) topic for additional information.
The SPAA Data Collector has the following requirements:
@@ -34,13 +34,13 @@ The SPAA Data Collector has the following requirements:
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, you must increase the minimum amount
+of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if you
+configure the job to scan 8 hosts at a time, it requires an extra 16 GB of RAM (8x2=16).
## SPAA Query Configuration
-The SharePointAccess Data Collector is configured through the SharePoint Access Auditor Data
+You configure the SharePointAccess Data Collector through the SharePoint Access Auditor Data
Collector Wizard. The wizard contains the following pages, which change based up on the query
Category selected:
@@ -61,5 +61,5 @@ Category selected:
-The Welcome page can be hidden by checking the **Do not display this page the next time** box when
-the wizard is open and configuration settings are saved.
+You can hide the Welcome page by checking the **Don't display this page the next time** box when
+the wizard is open and you save configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/results.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/results.md
index 507a348002..9344719bd5 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/results.md
@@ -6,12 +6,13 @@ sidebar_position: 140
# SPAA: Results
-The Results page is where properties that will be gathered are selected. It is a wizard page for all
+Use the Results page to select properties to gather. It's a wizard page for all
of the categories.
-Properties can be checked individually, or the **Select All**and **Clear All** buttons can be used.
-All checked properties are gathered. Available properties vary based on the category selected. This
-information is not available within the standard reference tables. Instead, this information can be
-viewed in the table created by the query task, for example SA_1-SPAA_SystemScans_Access table.
+You can check properties individually, or use the **Select All** and **Clear All** buttons.
+Access Analyzer gathers all checked properties. Available properties vary based on the category
+selected. This information isn't available within the standard reference tables. Instead, you can
+view this information in the table created by the query task, for example the
+SA_1-SPAA_SystemScans_Access table.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/scanscopingoptions.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/scanscopingoptions.md
index 1510625f2c..5084f350e8 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/scanscopingoptions.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/scanscopingoptions.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# SPAA: Scan Scoping Options
-The Scan Scoping Options page provides scoping options to specify the list of URLs to be scanned. It
+The Scan Scoping Options page provides scoping options to specify the list of URLs to scan. It
is a wizard page for the categories of:
- Scan SharePoint Access
@@ -16,7 +16,7 @@ is a wizard page for the categories of:
The options on the Scan Scoping Options page are:
-- Add – When a URL is entered in the text box, adds the URL to the Scope box
+- Add – Entering a URL in the text box adds it to the Scope box
- To scope for a SharePoint Host Named Site Collections, use the text box to enter the URL for
both the Web App and the HNSC with custom non-existent URL extensions added. See the
@@ -24,19 +24,19 @@ The options on the Scan Scoping Options page are:
topic for additional information.
:::note
- If sites are included in the Scope box, all other sites are excluded from the scan.
+ If you include sites in the Scope box, Access Analyzer excludes all other sites from the scan.
:::
- Import CSV – Opens a file explorer to browse for a CSV file
- Scope box – Lists all added URLs
-- Scope drop-down list – Select include to include a URL in the scan. Select exclude to exclude a
+- Scope dropdown list – Select include to include a URL in the scan. Select exclude to exclude a
URL from the scan.
- Remove – Removes the selected URL from the Scope box
## Scoping to SharePoint Host Named Site Collections
-In order to scope to objects within host named site collections, add a scope line which includes the
+to scope to objects within host named site collections, add a scope line which includes the
URL of the web application containing the host named site collection. To scope the host named site
collection URL `http://sample.com/documents/` for a host named site collection that exists under the
web application URL `http://example.com`, follow the steps:
@@ -56,24 +56,24 @@ the HNSCs. Click **Add**.
-**Step 4 –** The Web App URL must appear above the HNSC URL, as depicted in the example above.
+**Step 4 –** The Web App URL must appear above the HNSC URL, as depicted in the preceding example.
-**Step 5 –** The SharePoint Access Auditor Data Collector Wizard is now configured to filter for the
-URL inside the SharePoint Host Named Site Collections.
+**Step 5 –** You have now configured the SharePoint Access Auditor Data Collector Wizard to filter
+for the URL inside the SharePoint Host Named Site Collections.
## Virtual Hosts
-In order to decrease the scan time in large SharePoint Online environments, it is possible to break
-Site Collections for a single host down into subsets, or **Virtual Hosts**, that are treated as
-separate hosts by Access Analyzer. This allows multiple scans of a single host to be run
-concurrently. Follow the steps to configure this.
+To decrease the scan time in large SharePoint Online environments, break
+Site Collections for a single host down into subsets, or **Virtual Hosts**, that Access Analyzer
+treats as separate hosts. With virtual hosts, you can run multiple scans of a single host
+concurrently. To configure this:
-**Step 1 –** Create a new CSV file. Add into rows the information for the host and site collection
-URLs you want to scan in the format `HOSTNAME#DESIGNATOR;URL`.
+**Step 1 –** Create a new CSV file. Add rows containing the host and site collection URL
+information you want to scan, using the format `HOSTNAME#DESIGNATOR;URL`.
-- Each unique `DESIGNATOR` is treated as a separate host comprised of the specified URLs.
+- Access Analyzer treats each unique `DESIGNATOR` as a separate host comprised of the specified URLs.
@@ -88,15 +88,16 @@ Wizard, use the **Import CSV** button to import the information from the CSV fil
**Step 4 –** Click **Next** to continue through the other pages of the SharePoint Access Auditor
Data Collector Wizard. Then click **Finish** on the Summary Page.
-Access Analyzer is now configured to scan multiple site collections for the same host concurrently.
+You have now configured Access Analyzer to scan multiple site collections for the same host
+concurrently.
-A new host folder is created for each Virtual Host in `Jobs/SA_CommonData/SHAREPOINTACCESS`. You
-will also see a separate line on the Running Instances tab for each Virtual Host included in the
-scan.
+Access Analyzer creates a new host folder for each Virtual Host in
+`Jobs/SA_CommonData/SHAREPOINTACCESS`. You will also see a separate line on the Running Instances
+tab for each Virtual Host included in the scan.
:::note
-The Host List for Bulk Import should be configured to contain each Virtual Host included
-in the above scan using the `HOSTNAME#DESIGNATOR` format. After Bulk Import, the data contained in
+You should configure the Host List for Bulk Import to contain each Virtual Host included in the
+preceding scan, using the `HOSTNAME#DESIGNATOR` format. After Bulk Import, the data contained in
Tier 1 Database tables and views will resemble a scan run against multiple hosts.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/selectdlpcriteria.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/selectdlpcriteria.md
index f871e54ec7..0632ec48da 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/selectdlpcriteria.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/selectdlpcriteria.md
@@ -6,14 +6,14 @@ sidebar_position: 100
# SPAA: Select DLP Criteria
-The Select Criteria page is where criteria to be used for discovering sensitive data are configured.
-It is a wizard page for the category of Scan For Sensitive Content.
+Use the Select Criteria page to configure criteria for discovering sensitive data. It's a wizard
+page for the category of Scan For Sensitive Content.
:::warning
-Users should not change scans in a way that would result in less data being returned on
-a subsequent scan (i.e. scanning fewer web applications, scanning fewer site collections, or a
-shallower depth scan). Those resources not included in a subsequent scan are marked as deleted in
-the Tier 2 database and subsequently removed from the Tier 1 database.
+Don't change scans in a way that results in returning less data on a subsequent scan (i.e.
+scanning fewer web applications, scanning fewer site collections, or a shallower depth scan).
+Access Analyzer marks resources not included in a subsequent scan as deleted in the Tier 2
+database and later removes them from the Tier 1 database.
:::
@@ -28,8 +28,8 @@ The options on the Select DLP Criteria page are:
sensitive data criteria to scan for
- Select All – Click **Select All** to enable all sensitive data criteria for scanning
- Clear All – Click **Clear All** to remove all selections from the table
-- Select the checkboxes next to the sensitive data criteria options to enable it to be scanned for
- during job execution
+- Select the checkboxes next to the sensitive data criteria options to include them in job
+ execution scans
The table contains the following types of criteria:
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/settings.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/settings.md
index 4af1a7ebfc..63b3321325 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/settings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/settings.md
@@ -6,51 +6,49 @@ sidebar_position: 40
# SPAA: SharePoint Data Collection Settings
-The SharePoint data collection settings page is where additional scan settings are configured. It is
-a wizard page for the categories of:
+Use the SharePoint data collection settings page to configure additional scan settings. It's a
+wizard page for the categories of:
- Scan SharePoint Access
- Scan For Sensitive Content
:::warning
-Users should not change scans in a way that would result in less data being returned on
-a subsequent scan (i.e. scanning fewer web applications, scanning fewer site collections, or a
-shallower depth scan). Those resources not included in a subsequent scan are marked as deleted in
-the Tier 2 database and subsequently removed from the Tier 1 database.
+Don't change scans in a way that results in returning less data on a subsequent scan (i.e.
+scanning fewer web applications, scanning fewer site collections, or a shallower depth scan).
+Access Analyzer marks resources not included in a subsequent scan as deleted in the Tier 2
+database and later removes them from the Tier 1 database.
:::
-The Probable Owners section provides options for how probable ownership will be calculated:
+The Probable Owners section provides options for how Access Analyzer calculates probable ownership:
- Limit maximum number of Probable Owners per resource: [number] – Return the maximum user supplied
number of probable owners per resource
The Collect Personal Sites checkbox enables or disables collection during the scan of personal site
collections of individual users. Personal site collections are a SharePoint feature which gives
-every user their own site collection, and which are used by Office 365 to store a user’s OneDrive
-files. Personal sites are configured by default to only be accessible by the user to whom they
-belong, and so it is likely that the Connection Profile that the data collector is assigned may not
-have access to some users’ personal sites. There are three radio buttons for identifying how the
-query treats personal sites to which it does not have access:
+every user their own site collection, and that Office 365 uses to store a user’s OneDrive
+files. By default, only the user who owns a personal site can access it, so the Connection Profile
+assigned to the data collector might not have access to some users’ personal sites. Three radio
+buttons identify how the query treats personal sites it doesn't have access to:
-- Skip inaccessible personal sites – Inaccessible personal sites are not scanned
+- Skip inaccessible personal sites – Access Analyzer doesn't scan inaccessible personal sites
- Force scan account as admin of inaccessible personal sites – Make the Connection Profile
- credentials a Site Collection Administrator of any personal sites to which it does not have
+ credentials a Site Collection Administrator of any personal sites to which it doesn't have
access:
- - The personal sites will be scanned
- - When the scan is complete, the permissions are restored to what they were prior to the scan,
- referring to those credentials made a Site Collection Administrator of personal sites in order
- to conduct the scan.
+ - Access Analyzer scans the personal sites
+ - When the scan is complete, Access Analyzer restores the original permissions for any
+ credentials it temporarily made a Site Collection Administrator to conduct the scan.
- Requires the account used in the Connection Profile credentials to have the Global
Administrator role for SharePoint Online or be a Farm Administrator for SharePoint on premise.
- This permission is required to facilitate altering the administrators of site collections.
+ This permission lets Access Analyzer alter the administrators of site collections.
:::note
The Microsoft SharePoint API employed to remove personal Site Collection
- Administrator is unreliable, and occasionally the scanning account is left as a Site
+ Administrator is unreliable and occasionally leaves the scanning account as a Site
Collection Administrator of personal sites. This may leave the scanning account visible to
SharePoint users on the permissions of the files in their personal sites.
:::
@@ -58,20 +56,20 @@ query treats personal sites to which it does not have access:
:::info
Only use this option if that account is clearly identifiable as an
- administrative account, and users are advised of the possibility that the account could
+ administrative account, and you advise users that the account could
appear on the permissions of their personal site collection documents.
:::
- Force Company Administrator as admin of inaccessible personal sites – Make the special Company
- Administrator account an administrator of any personal sites to which it does not have access
+ Administrator account an administrator of any personal sites to which it doesn't have access
- - The personal sites will be scanned
- - When the scan is complete, the Company Administrator account is left as an administrator of
- the users’ personal site collections
+ - Access Analyzer scans the personal sites
+ - When the scan is complete, Access Analyzer leaves the Company Administrator account as an
+ administrator of the users’ personal site collections
- Requires the account used in the Connection Profile credentials to have the Global
Administrator role for SharePoint Online or be a Farm Administrator for SharePoint on premise.
- This permission is required to facilitate altering the administrators of site collections.
+ This permission lets Access Analyzer alter the administrators of site collections.
:::note
The Company Administrator account is a special SharePoint Online and SharePoint
@@ -79,12 +77,12 @@ query treats personal sites to which it does not have access:
:::
-The **Extract Document Tags** option enables the collection of metadata tags from Microsoft Office
-files in SharePoint. Since this option requires the retrieval and scanning of each document, it
-results in a noticeable increase in scan time.
+The **Extract Document Tags** option enables collecting metadata tags from Microsoft Office
+files in SharePoint. Since this option requires retrieving and scanning each document, it
+noticeably increases scan time.
-- Select a preferred zone – Use the drop-down list to select a preferred zone within the web
- application to target the scan. If a targeted web application does not have the selected preferred
+- Select a preferred zone – Use the dropdown list to select a preferred zone within the web
+ application to target the scan. If a targeted web application doesn't have the selected preferred
zone, the scan targets the default zone for that web application. Options include:
- Default
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/standardtables.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/standardtables.md
index 678e74c8f9..df455da325 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/standardtables.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/standardtables.md
@@ -12,17 +12,17 @@ Data Collector writes data to these tables regardless of the job executing the q
## SharePoint Access Auditing Tables & Views
-The tables and their associated views are grouped by types.
+This section groups the tables and their associated views by type.
**Structure Tables**
| Tables | Details |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SA_SPAA_Hosts | Contains the names and ID of all SharePoint hosts that have been scanned for permissions. |
+| SA_SPAA_Hosts | Contains the names and ID of all SharePoint hosts that Access Analyzer scanned for permissions. |
| SA_SPAA_Resources | Contains information about all audited resources, which can be site collections, sites, libraries, lists, or folders. This provides information on the hierarchy relationship, as well as references to the name and rights applied to that folder. |
| SA_SPAA_Sharing | Contains the view and edit links for anonymously shared resources, indicates if a resource is shared directly with trustees, and indicates whether a resource has a pending sharing request. |
| SA_SPAA_SharingUsers | Contains information about the users to whom resources are shared with such as their email, login name, title, department, and describes whether the sharing grants is view only or edit permissions. |
-| SA_SPAA_SiteCollections | Contains a list of site collections that were audited and references the SA_SPAA_Resources and SA_SPAA_Trustees tables for the administrators of each site collection. |
+| SA_SPAA_SiteCollections | Contains a list of audited site collections and references the SA_SPAA_Resources and SA_SPAA_Trustees tables for the administrators of each site collection. |
| SA_SPAA_WebApplications | Contains a list of web applications audited. |
| SA_SPAA_WebAppURls | Contains a list of URLs for each web application audited. |
@@ -30,14 +30,14 @@ The tables and their associated views are grouped by types.
| Tables | Details |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SA_SPAA_Trustees | Contains information about any domain user, group, or security principal that has been assigned permissions. This table does not contain local user and groups, as none of the trustees in this table are specific to any one host. |
+| SA_SPAA_Trustees | Contains information about any domain user, group, or security principal with assigned permissions. This table doesn't contain local user and groups, as none of the trustees in this table are specific to any one host. |
| SA_SPAA_TrusteeGroupMembers | Table contains information on SharePoint group membership. |
**Access Calculation Tables**
| Tables | Details |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SA_SPAA_Permissions | Contains information on the actual permissions that have been granted to resources. Each entry summarizes the rights assigned to every trustee that would appear on the permissions of a SharePoint resource. |
+| SA_SPAA_Permissions | Contains information on the actual permissions granted to resources. Each entry summarizes the rights assigned to every trustee that would appear on the permissions of a SharePoint resource. |
| SA_SPAA_Roles | Contains information about all of the roles on all of the site collections. |
| SA_SPAA_RolesProxy | Contains a mapping of role sets to individually assigned role definitions. A role set is a distinct set of roles that are applied to one or more resources. |
| SA_SPAA_WebAppPolicies | Contains summarized rights for every trustee in a web application policy. Each policy refers to a specific URL within that web application. |
@@ -46,7 +46,7 @@ The tables and their associated views are grouped by types.
| Tables | Details |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SA_SPAA_Exceptions | Contains information about security issues and concerns. One out-of-the-box exception stored inside this table is the Open Resource exception, which identifies where resources are open to Everyone, Authenticated Users, or Domain Users. |
+| SA_SPAA_Exceptions | Contains information about security issues and concerns. One built-in exception stored inside this table is the Open Resource exception, which identifies where resources are open to Everyone, Authenticated Users, or Domain Users. |
| SA_SPAA_ExceptionTypes | Contains summary information about exceptions. It details how many exceptions are found on each host scanned and breaks them down by exception type. |
**Content Tables**
@@ -59,7 +59,7 @@ The tables and their associated views are grouped by types.
| SA_SPAA_Tags | Contains the individual tags which were found in documents. |
Views are the recommended way for Access Analyzer users to obtain the information gathered by the
-SPAA Data Collector. They contain additional information for building queries easily. The following
+SPAA Data Collector. They contain additional information for building queries. The following
is an explanation of the corresponding views created for some of the tables generated by the SPAA
Data Collector:
@@ -67,8 +67,8 @@ Data Collector:
| Views | Details |
| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SA_SPAA_PermissionsView | Provides any object permission, regardless of whether they have been made directly to folders or are inherited. An object includes site, site collection, list, library, folder, and so on. |
-| SA_SPAA_DirectPermissionsView | Provides permissions that are directly applied to resources. |
+| SA_SPAA_PermissionsView | Provides any object permission, regardless of whether Access Analyzer made them directly to folders or inherited them. An object includes site, site collection, list, library, folder, and so on. |
+| SA_SPAA_DirectPermissionsView | Provides permissions directly applied to resources. |
| SA_SPAA_EffectiveAccessView | Provides information on every trustee with access to a resource and the trustee’s level of access. This will do complete group expansion, but also take into account security principals such as Authenticated Users. Also, this view will not just expand permissions; it will calculate access by making sure every user has access to the web application. |
| SA_SPAA_WebAppPoliciesView | Provides details around the web application policies that are applied to the audited SharePoint environment. These policies allow or deny access to the entire web application for the specified trustees. |
@@ -83,7 +83,7 @@ Data Collector:
| Views | Details |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SA_SPAA_ExceptionsView | Provides information on instances of exceptions that exist on the audited hosts. This view will contain a row for each exception type for each host. Exceptions are specific conditions set forth by Access Analyzer that are considered to be issues, such as folders with open access. |
+| SA_SPAA_ExceptionsView | Provides information on instances of exceptions that exist on the audited hosts. This view will contain a row for each exception type for each host. Exceptions are specific conditions that Access Analyzer flags as issues, such as folders with open access. |
**Additional Views**
@@ -95,7 +95,7 @@ Data Collector:
| Views | Details |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SA_SPAA_PermissionScopeResources | Provides information on the actual permissions that have been granted to resources. Each entry summarizes the rights assigned to every trustee that would appear on the permissions of a SharePoint resource. |
+| SA_SPAA_PermissionScopeResources | Provides information on the actual permissions granted to resources. Each entry summarizes the rights assigned to every trustee that would appear on the permissions of a SharePoint resource. |
## SharePoint Activity Auditing Tables & Views
@@ -111,7 +111,7 @@ The tables and their associated views are:
| SA_SPAC_EventNames | Contains a list of SharePoint event names, their IDs, and a description of each event. |
Views are the recommended way for Access Analyzer users to obtain the information gathered by the
-SPAA Data Collector. They contain additional information for building queries easily. The following
+SPAA Data Collector. They contain additional information for building queries. The following
is an explanation of the corresponding views created for some of the tables generated by the SPAA
Data Collector:
@@ -126,7 +126,7 @@ Data Collector:
The tables and their associated views are:
:::note
-Lists and libraries are excluded from Sensitive Data Discovery Auditing.
+Access Analyzer excludes lists and libraries from Sensitive Data Discovery Auditing.
:::
@@ -134,12 +134,12 @@ Lists and libraries are excluded from Sensitive Data Discovery Auditing.
| Tables | Details |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SA_SPDLP_Criteria | Contains the sensitive data criteria which are selected for collection by the scan engine (data collector configuration). |
+| SA_SPDLP_Criteria | Contains the sensitive data criteria selected for collection by the scan engine (data collector configuration). |
| SA_SPDLP_Matches | Contains rolled up aggregate counts of the sensitive data criteria matches found during the scan. |
| SA_SPDLP_MatchHits | Contains the actual sensitive data within files that matched selected criteria. For example, if the credit card criteria is used, this table will contain the potential credit card numbers identified within each files with hits. |
Views are the recommended way for Access Analyzer users to obtain the information gathered by the
-SPAA Data Collector. They contain additional information for building queries easily. The following
+SPAA Data Collector. They contain additional information for building queries. The following
is an explanation of the corresponding views created for some of the tables generated by the SPAA
Data Collector:
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/summary.md
index e8a4fa7568..318d261984 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 150
# SPAA: Summary Page
-The Summary page is where configuration settings are summarized. It is a wizard page for all of the
+The Summary page summarizes the configuration settings. It's a wizard page for all of the
categories.
**-**
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the SharePoint Access Auditor Data Collector Wizard ensuring that no
-accidental clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the SharePoint Access Auditor Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/spaa/testaccess.md b/docs/accessanalyzer/12.0/admin/datacollector/spaa/testaccess.md
index a48f5d29c3..6fbc98cd32 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/spaa/testaccess.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/spaa/testaccess.md
@@ -22,11 +22,11 @@ The options and sections on the Test Access page are:
Server text box. Click **Check Access** to test access to the SharePoint environment.
- For example – `sbnjqasp30` or `sbnjqasp3.qa.com`
- - Do not include `http[s]://` or use a URL for the server name. The Test Access function cannot
- be scoped to individual Web applications.
+ - Don't include `http[s]://` or use a URL for the server name. You can't scope the Test Access
+ function to individual Web applications.
-- Access Test Results – Displays information on test results. Test criteria are listed in the
- **Description** column. Test results will be returned as either **Pass** or **Fail** in the
+- Access Test Results – Displays information on test results. Access Analyzer lists test criteria
+ in the **Description** column and returns test results as either **Pass** or **Fail** in the
Results column.
- Save Report – Click **Save Report** to export and save a text version of the test results
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/sql/category.md b/docs/accessanalyzer/12.0/admin/datacollector/sql/category.md
index f7676daf5c..688ae35c17 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/sql/category.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/sql/category.md
@@ -91,7 +91,7 @@ The query categories are:
- Latest Week Backup – Information about the latest week backup
- Oldest and Newest Backup – Information about the oldest and the most recent backups
- - Database File Without Backup – Indicates file names of the files that are not present in
+ - Database File Without Backup – Indicates file names of the files that aren't present in
the RMAN backup
- Utilities
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/sql/configurejob.md b/docs/accessanalyzer/12.0/admin/datacollector/sql/configurejob.md
index 8c6ca83224..7ac3de67b7 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/sql/configurejob.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/sql/configurejob.md
@@ -6,9 +6,9 @@ sidebar_position: 10
# SQL Custom Connection Profile & Default Dynamic Host List
-The SQL Data Collector requires a custom Connection Profile and Host List. The **SQL SERVERS**
-default host list can be used with this data collector for the SQL Solution. The host inventory
-option during host list creation makes it necessary to configure the Connection Profile first.
+The SQL Data Collector requires a custom Connection Profile and Host List. You can use the
+**SQL SERVERS** default host list with this data collector for the SQL Solution. The host
+inventory option during host list creation requires you to configure the Connection Profile first.
## Connection Profile
@@ -17,20 +17,20 @@ Create a Connection Profile and set the following information on the User Creden
- For an Active Directory account:
- Select Account Type – Active Directory Account
- - Domain – Drop-down menu with available trusted domains will appear. Either type the short
+ - Domain – dropdown menu with available trusted domains will appear. Either enter the short
domain name in the textbox or select a domain from the menu.
- - User name – Type the user name
- - Password Storage – Choose the desired option for credential password storage:
+ - User name – Enter the user name
+ - Password Storage – Choose the option you want for credential password storage:
- Application – Uses the configured Profile Security setting as selected at the
**Settings** > **Application** node. See the
[Application](/docs/accessanalyzer/12.0/admin/settings/application/overview.md) topic for additional information.
- CyberArk – Uses the CyberArk Enterprise Password Vault. See the
[CyberArk Integration](/docs/accessanalyzer/12.0/admin/settings/connection/cyberarkintegration.md) topic for
- additional information. The password fields do not apply for CyberArk password storage.
+ additional information. The password fields don't apply for CyberArk password storage.
- - Password – Type the password
- - Confirm – Re-type the password
+ - Password – Enter the password
+ - Confirm – Re-enter the password
- For a SQL account:
@@ -39,30 +39,30 @@ Create a Connection Profile and set the following information on the User Creden
- Password Storage – Application (Uses the configured Profile Security setting as selected at
the **Settings** > **Application** node. See the
[Application](/docs/accessanalyzer/12.0/admin/settings/application/overview.md) topic for additional information.)
- - Password – Type the password
- - Confirm – Re-type the password
+ - Password – Enter the password
+ - Confirm – Re-enter the password
See the [Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) topic for additional information.
## Host List
-The required host list depends on the database that the SQL data collector is being used for.
+The required host list depends on the database for which you use the SQL data collector.
### Default Dynamic Host List (SQL)
Jobs using the SQL Data Collector can use the SQL Servers default host list. This is a dynamic host
-list that is populated from hosts in the Host Master Table which meet the host inventory criteria
-for the list, `IsSQLServer = True`. Since the SQL Servers host list is default, it is available to
-jobs and job groups for host assignment. See the [Host Management](/docs/accessanalyzer/12.0/admin/hostmanagement/overview.md)
+list that Access Analyzer populates from hosts in the Host Master Table which meet the host
+inventory criteria for the list, `IsSQLServer = True`. Since the SQL Servers host list is default,
+it is available to jobs and job groups for host assignment. See the [Host Management](/docs/accessanalyzer/12.0/admin/hostmanagement/overview.md)
topic for additional information.
### Oracle / MySQL / PostgreSQL / Db2
-Jobs in the Oracle, MySQL, Postgre SQL, or Db2 solution using the SQL Data Collector must be
-configured to query a host list with the servers containing the target databases. Setup the list of
-hosts that needs to be monitored. Be sure to use a specific host name (if forcing the connection to
+You must configure jobs in the Oracle, MySQL, PostgreSQL, or Db2 solution that use the SQL Data
+Collector to query a host list with the servers containing the target databases. Set up the list of
+hosts that you need to monitor. Be sure to use a specific host name (if forcing the connection to
a secondary host) or just the server name if connecting to the server. See the
[Host Management](/docs/accessanalyzer/12.0/admin/hostmanagement/overview.md) topic for additional information.
-Additionally, the database instances must be added to the Filter page in the query configuration.
+Additionally, you must add the database instances to the Filter page in the query configuration.
See the [SQL: Filter](/docs/accessanalyzer/12.0/admin/datacollector/sql/filter.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/sql/criteria.md b/docs/accessanalyzer/12.0/admin/datacollector/sql/criteria.md
index 904c7514d6..d1f19e9e9d 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/sql/criteria.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/sql/criteria.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# SQL: Criteria
-The Criteria page is where criteria to be used for discovering sensitive data are configured. It is
-a wizard page for the Sensitive Data Collection category.
+Use the Criteria page to configure criteria for discovering sensitive data. It's a wizard page for
+the Sensitive Data Collection category.
@@ -21,8 +21,8 @@ The options on the Criteria page are:
- Select All– Click **Select All** to enable all sensitive data criteria for scanning
- Clear All – Click **Clear All** to remove all selections from the table
- - Select the checkboxes next to the sensitive data criteria options to enable it to be scanned
- for during job execution
+ - Select the checkboxes next to the sensitive data criteria options to include them in job
+ execution scans
The table contains the following types of criteria:
@@ -36,7 +36,7 @@ The table contains the following types of criteria:
:::note
Adding unnecessary criteria can adversely impact the scanner performance and can cause the
-scanning job to take a long time. If performance is adversely affected, revisit the sensitive data
-scanning criteria and remove criteria that is not required.
+scanning job to take a long time. If performance suffers, revisit the sensitive data
+scanning criteria and remove criteria that isn't required.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/sql/customqueryoracle.md b/docs/accessanalyzer/12.0/admin/datacollector/sql/customqueryoracle.md
index 2a15d5c932..8eb13c3c8e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/sql/customqueryoracle.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/sql/customqueryoracle.md
@@ -16,11 +16,11 @@ The configurable options are:
- Test Database:
- - Data Source – Select the host\instance from the drop-down menu
- - Database – Select the database from the drop-down menu
+ - Data Source – Select the host\instance from the dropdown menu
+ - Database – Select the database from the dropdown menu
- Convert CDB to DBA on non-container databases
- SQL Query textbox – Enter the custom SQL script
- Validate Query – Click to test the query, results display in the box
-- Row limit – Enter a number to limit the rows the query is tested on
+- Row limit – Enter a number to limit the rows used to test the query
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/sql/customquerysql.md b/docs/accessanalyzer/12.0/admin/datacollector/sql/customquerysql.md
index 600150e4fd..2ad32dc973 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/sql/customquerysql.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/sql/customquerysql.md
@@ -20,9 +20,9 @@ The configurable options are:
- Test Database:
- - Data Source – Select the host\instance from the drop-down menu
- - Database – Select the database from the drop-down menu
+ - Data Source – Select the host\instance from the dropdown menu
+ - Database – Select the database from the dropdown menu
- SQL Query textbox – Enter the custom SQL script
- Validate Query – Click to test the query, results display in the box
-- Row limit – Enter a number to limit the rows the query is tested on
+- Row limit – Enter a number to limit the rows used to test the query
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/sql/filter.md b/docs/accessanalyzer/12.0/admin/datacollector/sql/filter.md
index 6917351844..7f90cd9c22 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/sql/filter.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/sql/filter.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# SQL: Filter
-The Filter page is where the query can be scoped to target specific databases or instances. It is a
+Use the Filter page to scope the query to target specific databases or instances. It is a
wizard page for the categories of:
- Permissions > Permissions Collection
@@ -46,14 +46,14 @@ wizard page for the categories of:
- Utilities – Remove Storage Data
-It is necessary for the SA_SQL_Instances table to be populated before available databases/instances
-can populate the Available Server audits list. For Oracle and SQL, the SA_SQL_Instances table is
-populated through an instance discovery query. See the
+You must populate the SA_SQL_Instances table before available databases/instances
+can populate the Available Server audits list. For Oracle and SQL, Access Analyzer populates the SA_SQL_Instances table
+through an instance discovery query. See the
[0-SQL_InstanceDiscovery Job](/docs/accessanalyzer/12.0/solutions/databases/sql/collection/0-sql_instancediscovery.md)
-topic for additional information. For PostgreSQL and MySQL Scans, the SA_SQL_Instances table is
-populated manually in the Manage Connections window. See the
-[Manage Connections Window](#manage-connections-window) topic for additional information. Once the
-table has been populated, a query can be scoped.
+topic for additional information. For PostgreSQL and MySQL Scans, you populate the SA_SQL_Instances table
+manually in the Manage Connections window. See the
+[Manage Connections Window](#manage-connections-window) topic for additional information. After you
+populate the table, you can scope a query.
@@ -72,13 +72,13 @@ The configurable filter options are:
- Select from the available list and click **Add**
-- Selected databases or instances — Displays selected database objects for which the query has been
- scoped. Additional options include:
+- Selected databases or instances — Displays selected database objects scoped for the query.
+ Additional options include:
- Remove — Removes the selected database/instance from the query
- Include — Reverts an exclusion. By default, all sub tables are included.
- Exclude — Excludes selected databases/instances and displays them in red
- - Add Custom Filter — Opens the Add custom filter window to build a custom filter to be applied
+ - Add Custom Filter — Opens the Add custom filter window to build a custom filter to apply
to the selected databases/instances. See the
[Add Custom Filter Window](#add-custom-filter-window) topic for additional information.
- Import CSV — Import a list of databases/instances from a CSV file
@@ -86,7 +86,7 @@ The configurable filter options are:
## Manage Connections Window
-The Manage Connections window enables you to add database instances to search. Click the
+Use the Manage Connections window to add database instances to search. Click the
**Connections** button to open it.
@@ -99,18 +99,18 @@ Select a row in the table to edit that instance, or create a new instance to add
- Database System — Select from a list of available databases
- Service Name — Name of the service
- Host — Name or IP address of the host where the database is located
-- Port Number — Port number for the database. If a non-default port is being used, it should be
- specified in the Port Number section.
+- Port Number — Port number for the database. If you use a non-default port, specify it in the
+ Port Number section.
- Default Database — Account used to access the database. Admin is recommended.
- Enable impersonation — Select to enable impersonation
- Service Type— If applicable, select whether the service type is **Service** or **SID**
In the Manage Connections Table, the following information is also listed:
-- Was Inspected — Indicates whether information for a connection was validated. **Y** indicates the
- information has been validated. **N** indicates the information has not been validated.
-- Last Inspected — Indicates the date and time of when the connection information was last
- inspected. If blank, the connection information has not yet been validated.
+- Was Inspected — Indicates whether Access Analyzer validated the connection information. **Y**
+ indicates Access Analyzer validated the information. **N** indicates it hasn't.
+- Last Inspected — Indicates the date and time Access Analyzer last inspected the connection
+ information. If blank, Access Analyzer hasn't validated the information yet.
The Manage Connections window has the following buttons:
@@ -127,7 +127,7 @@ you to apply a custom scoping filter to the query.
-Type the filter in the window and click Save. The following characters can be used in the filter:
+Enter the filter in the window and click Save. You can use the following characters in the filter:
- Forward slash (/) – Path separator
- Asterisk (\*) – Wild card for any combination of characters
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/sql/options.md b/docs/accessanalyzer/12.0/admin/datacollector/sql/options.md
index 18b0618d10..4e9ae86995 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/sql/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/sql/options.md
@@ -76,11 +76,11 @@ The sensitive data scan settings are:
**SDD Options**
- Store discovered sensitive data – Stores potentially sensitive data in the Access Analyzer
- database. Any sampled sensitive data discovered based on the matched criteria is stored in the
- Access Analyzer database. This functionality can be disabled by clearing this option.
+ database, including any sampled sensitive data discovered based on the matched criteria. Clear
+ this option to disable this functionality.
:::note
- The **Store discovered sensitive data** option is required to view Content Audit
+ You must select the **Store discovered sensitive data** option to view Content Audit
reports in the Access Information Center for SQL data.
:::
@@ -91,9 +91,9 @@ The sensitive data scan settings are:
:::
-- Resume scan from last point on error – Resumes scan from where the previous scan left off when the
- previous scan was stopped as a result of an error
+- Resume scan from last point on error – Resumes scan from where the previous scan left off if an
+ error stopped the previous scan
:::tip
-Remember, Sensitive Data Discovery is required to use the sensitive data collection option.
+Remember, using the sensitive data collection option requires Sensitive Data Discovery.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/sql/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/sql/overview.md
index bff74a7012..ad89fa80d8 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/sql/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/sql/overview.md
@@ -107,12 +107,12 @@ thread requires a minimum of 2 additional GB of RAM per host. For example, a job
## SQL Query Configuration
-The SQL Data Collector is configured through the SQL Data Collector Wizard. The wizard contains the
+You configure the SQL Data Collector through the SQL Data Collector Wizard. The wizard contains the
following pages, which change based upon the query category selected:
:::note
-The SQL Data Collector is used in multiple Access Analyzer Solutions, and the query
-categories used are dependent on the solution.
+Multiple Access Analyzer Solutions use the SQL Data Collector, and the query
+categories depend on the solution.
:::
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/sql/results.md b/docs/accessanalyzer/12.0/admin/datacollector/sql/results.md
index 5ff24b083c..7e254b69e0 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/sql/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/sql/results.md
@@ -6,11 +6,11 @@ sidebar_position: 90
# SQL: Results
-The Results page is where the properties that will be gathered are selected. It is a wizard page for
+Use the Results page to select the properties to gather. It is a wizard page for
all of the categories.
-Properties can be selected individually, or the **Select All** and **Clear All** buttons can be
-used. All selected properties are gathered. Available properties vary based on the category
+You can select properties individually, or use the **Select All** and **Clear All** buttons.
+Access Analyzer gathers all selected properties. Available properties vary based on the category
selected.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/sql/rowkey.md b/docs/accessanalyzer/12.0/admin/datacollector/sql/rowkey.md
index 7111bec544..371ecead33 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/sql/rowkey.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/sql/rowkey.md
@@ -11,6 +11,6 @@ categories.
-Properties selected on the Results page are listed. Select the property or properties to act as the
-Rowkey. Properties can be selected individually, or the **Select All** and **Clear All** buttons can
-be used.
+The Rowkey page lists properties selected on the Results page. Select the property or properties to
+act as the Rowkey. You can select properties individually, or use the **Select All** and **Clear
+All** buttons.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/sql/settings.md b/docs/accessanalyzer/12.0/admin/datacollector/sql/settings.md
index 6ab1cb2033..771c8a07f8 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/sql/settings.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/sql/settings.md
@@ -11,7 +11,7 @@ instances. It is a wizard page for the category of Utilities.
-Data from the selected categories will be removed from the Access Analyzer database:
+Access Analyzer removes data from the selected categories from the Access Analyzer database:
- Permissions
- Audits
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/sql/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/sql/summary.md
index 0808b9785a..45b2a5cc78 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/sql/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/sql/summary.md
@@ -6,11 +6,10 @@ sidebar_position: 110
# SQL: Summary
-The Summary page is where the configuration settings are summarized. It is a wizard page for all of
+The Summary page summarizes the configuration settings. It is a wizard page for all of
the categories.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the SQL Data Collector Wizard ensuring that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the SQL Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/filetypes.md b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/filetypes.md
index 98b511f721..88ed381ff7 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/filetypes.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/filetypes.md
@@ -6,9 +6,9 @@ sidebar_position: 70
# SystemInfo: File Types
-The File Types page is where to enable count file types and specify filename masks if it is desired
-to count files of given types. Two properties are generated for every mask provided, one for size
-and one for count. It is a wizard page for the category of File Shares.
+Use the File Types page to enable file type counting and specify filename masks if you want to
+count files of specific types. Access Analyzer generates two properties for every mask provided,
+one for size and one for count. It is a wizard page for the category of File Shares.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/jobscope.md b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/jobscope.md
index e68b538c32..b0ef981ff5 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/jobscope.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/jobscope.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# SystemInfo: Job Scope
-The Job Scope page is where to select whether or not scoping should be used during execution. It is
+Use the Job Scope page to select whether to use scoping during execution. It is
a wizard page for the category of File Shares.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/options.md b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/options.md
index 55ef317f4a..dd9e3b4b26 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/options.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/options.md
@@ -26,11 +26,11 @@ For the File Shares and Open File Shares categories:
Select from the following options to control the depth of processing and the amount of information
-to be returned by the query:
+the query returns:
- Include file level permissions
- - Do not collect inherited file permissions
+ - Don't collect inherited file permissions
- Return All Folders
@@ -38,7 +38,7 @@ to be returned by the query:
- Limit returned subfolders depth to – Specify the number of levels
-- Size units for corresponding properties – Select the desired size unit:
+- Size units for corresponding properties – Select the size unit you want:
- Bytes
- KBytes
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/overview.md
index be58c65ca8..f1af863e62 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 370
# SystemInfo Data Collector
The SystemInfo Data Collector extracts information from the target system based on the selected
-category. The SystemInfo Data Collector is a core component of Access Analyzer, but it has been
-preconfigured within the Windows Solution. While the data collector is available with all Access
+category. The SystemInfo Data Collector is a core component of Access Analyzer, but Access Analyzer
+preconfigures it within the Windows Solution. While the data collector is available with all Access
Analyzer license options, the Windows Solution is only available with a special Access Analyzer
license. See the [Windows Solution](/docs/accessanalyzer/12.0/solutions/windows/overview.md) topic for additional
information.
@@ -30,7 +30,7 @@ information.
## SystemInfo Query Configuration
-The SystemInfo Data Collector is configured through the System Info Data Collector Wizard, which
+You configure the SystemInfo Data Collector through the System Info Data Collector Wizard, which
contains the following wizard pages:
- Welcome
@@ -45,5 +45,5 @@ contains the following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+You can hide the Welcome page by selecting the **Don't display this page the next time** checkbox
+when the wizard is open and you save configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/probableowner.md b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/probableowner.md
index 410b9ab38a..c12b817a26 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/probableowner.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/probableowner.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# SystemInfo: Probable Owner
On the Probable Owner page, select options for determining the owner using weighted calculations.
-This page is enabled when the **Probable Owner** property is selected on the Results page.
+This page becomes available when you select the **Probable Owner** property on the Results page.
@@ -20,7 +20,7 @@ In the Determine owner section, select from the following options:
- Determine owner from Current User
- Determine owner from Last User
- Custom weights – Select this radio button to use custom weights to determine the probable owner.
- These weights can be set by clicking the ellipsis next to the Result weights box to open the
+ Set these weights by clicking the ellipsis next to the Result weights box to open the
Probable Owner Settings window.
@@ -52,7 +52,7 @@ Click **Set Users to Exclude** to open the Probable Owner Settings window:
In the Output options section, select from the following options:
-- Get the most probable owner(s)
+- Get the most probable owners
- Get probable owners with relative deviation to the most probable owner – Enables the following
option:
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/results.md b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/results.md
index 5b089854c5..26276434c8 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/results.md
@@ -6,11 +6,11 @@ sidebar_position: 20
# SystemInfo: Results
-The Results page is used to select which properties are gathered out of those available for the
+Use the Results page to select which properties to gather from those available for the
category. It is a wizard page for all categories.
-Properties can be selected individually or the **Check all**, **Uncheck all**, and **Reset to
-defaults** buttons can be used. All selected properties are gathered. Available properties vary
+You can select properties individually, or use the **Check all**, **Uncheck all**, and **Reset to
+defaults** buttons. Access Analyzer gathers all selected properties. Available properties vary
based on the category selected.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/summary.md
index 2407432b34..05fa9bc7dd 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query. It is a wizard page
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the System Info Data Collector Wizard ensuring that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the System Info Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/vipmembership.md b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/vipmembership.md
index 77142f5185..4cee2b2368 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/vipmembership.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/vipmembership.md
@@ -7,8 +7,8 @@ sidebar_position: 50
# SystemInfo: VIP Membership
The VIP Membership provides the option to add members to a VIP List and exclude them from contact
-about probable ownership. Any users can be added to VIP membership. This page is enabled when the
-VIPList property is selected on the Results page.
+about probable ownership. You can add any users to VIP membership. This page becomes available
+when you select the VIPList property on the Results page.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/textsearch/advancedcriteria.md b/docs/accessanalyzer/12.0/admin/datacollector/textsearch/advancedcriteria.md
index 941235e841..97f50f03b1 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/textsearch/advancedcriteria.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/textsearch/advancedcriteria.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# TextSearch: Advanced Criteria
-The Advanced Criteria page is displayed if the **Use advanced criteria (instead of simple
-criteria)** checkbox is selected on the Search Criteria page. This page provides configuration
+The Advanced Criteria page displays if you select the **Use advanced criteria (instead of simple
+criteria)** checkbox on the Search Criteria page. This page provides configuration
options to specify the text to search for across the entire row of each file or within the specified
column in each row.
@@ -17,7 +17,7 @@ The configurable options are:
- Return Multiple Columns – Return data values in multiple columns
- Load Sample Data – Click this button to browse for sample data to test the filters entered. If the
- sample data file is large, it is recommended to sample an excerpt of the file to reduce the amount
+ sample data file is large, sample an excerpt of the file to reduce the amount
of time it takes to load the data.
- Customize – Click this button to open the Filter builder
@@ -26,4 +26,4 @@ The configurable options are:
See the [Filtration Dialog](/docs/accessanalyzer/12.0/admin/navigate/datagrid.md#filtration-dialog) topic for information
on using the Filter builder.
-The filter section cannot be blank.
+The filter section can't be blank.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/textsearch/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/textsearch/overview.md
index fd1b767340..1441dcc771 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/textsearch/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/textsearch/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 380
# TextSearch Data Collector
The TextSearch Data Collector enables searches through text based log files. The TextSearch Data
-Collector is a core component of Access Analyzer, but it has been preconfigured within the Windows
-Solution. While the data collector is available with all Access Analyzer license options, the
+Collector is a core component of Access Analyzer, but Access Analyzer preconfigures it within the
+Windows Solution. While the data collector is available with all Access Analyzer license options, the
Windows Solution is only available with a special Access Analyzer license. See the
[Windows Solution](/docs/accessanalyzer/12.0/solutions/windows/overview.md) topic for additional information.
@@ -27,7 +27,7 @@ Windows Solution is only available with a special Access Analyzer license. See t
## TextSearch Query Configuration
-The TextSearch Data Collector is configured through the Text Search Data Collector Wizard, which
+You configure the TextSearch Data Collector through the Text Search Data Collector Wizard, which
contains the following wizard pages:
- Welcome
@@ -39,5 +39,5 @@ contains the following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+You can hide the Welcome page by selecting the **Don't display this page the next time** checkbox
+when the wizard is open and you save configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/textsearch/results.md b/docs/accessanalyzer/12.0/admin/datacollector/textsearch/results.md
index 70afb245a6..2754860f87 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/textsearch/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/textsearch/results.md
@@ -6,12 +6,12 @@ sidebar_position: 40
# TextSearch: Results
-The Results page is where properties that will be gathered are selected.
+Use the Results page to select properties to gather.
-Properties can be selected individually or the **Check all**, **Uncheck All**, and **Reset to
-Defaults** buttons can be used. All selected properties are gathered. Available properties vary
+You can select properties individually, or use the **Check all**, **Uncheck All**, and **Reset to
+Defaults** buttons. Access Analyzer gathers all selected properties. Available properties vary
based on the category selected.
- Size units – Select from the following:
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/textsearch/searchcriteria.md b/docs/accessanalyzer/12.0/admin/datacollector/textsearch/searchcriteria.md
index 1dc19e705c..f8ad94030c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/textsearch/searchcriteria.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/textsearch/searchcriteria.md
@@ -14,8 +14,8 @@ entire row of each file.
The configurable functions are:
- Use advanced criteria (instead of simple criteria) – Select this checkbox to display the Advanced
- Criteria page and configure the search with additional filtering options. Advanced search criteria
- is configured on the Advanced Criteria page. See the
+ Criteria page and configure the search with additional filtering options. Configure advanced search criteria
+ on the Advanced Criteria page. See the
[TextSearch: Advanced Criteria](/docs/accessanalyzer/12.0/admin/datacollector/textsearch/advancedcriteria.md) topic for additional information.
- Simple Criteria
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/textsearch/sourcefiles.md b/docs/accessanalyzer/12.0/admin/datacollector/textsearch/sourcefiles.md
index 048e01d26c..3e9b15df2c 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/textsearch/sourcefiles.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/textsearch/sourcefiles.md
@@ -21,11 +21,11 @@ The Location section provides options to scope the search.
- Current Job Directory – Search the job’s root folder for the specified file
- Registry Lookup – Select this option to programmatically obtain a file path from a registry key
that exists on the target host in the environment. Click the ellipsis to open the Access Analyzer
- Registry Browser and connect to a host to select a registry key and path to be used for the
+ Registry Browser and connect to a host to select a registry key and path to use for the
lookup.
- Value Name – This value is automatically populated from the registry key
- - Levels – The Levels slider can be used to truncate the path for the key value in the Adjust
+ - Levels – Use the Levels slider to truncate the path for the key value in the Adjust
Path dialog box
- Current value data – Displays the current value for the registry key
- Query 32-bit – Select this checkbox to query a 32-bit view
@@ -37,7 +37,7 @@ The Files section provides options to define the object or set of objects to fin
- File name – Enter file names to search in the following format: `filename.extension`. Separate
multiple file names with a semicolon and no spaces between the names. Wild cards can be used.
-- File type – Select the extension type of the file name entered above to tell the collection
+- File type – Select the extension type of the file name you entered to tell the collection
routine how the data within the underlying file is structured and should be handled:
- Autodetect – Select this when the data type is unknown. The data collection routine will
@@ -48,7 +48,7 @@ The Files section provides options to define the object or set of objects to fin
- Binary
- Space Separated Text
-- First line is header captions line – Enabled when CSV, TSV, or Space Separated Text is selected
+- First line is header captions line – Active only when you select CSV, TSV, or Space Separated Text
**Options**
@@ -71,17 +71,17 @@ The Last Modification Time Filter section provides options to apply time filters
Clicking the ellipsis in the Location section of the Source Files page opens the Remote Folder
Explorer search window. In the Remote Folder Explorer window, navigate to the file folder location
-and add the path to the scope. Multiple paths can be added to the scope.
+and add the path to the scope. You can add multiple paths to the scope.
The Remote Folder Explorer functions are:
-- Sample from host (path) – If the desired file does not exist on the local Access Analyzer Console,
+- Sample from host (path) – If the file you want doesn't exist on the local Access Analyzer Console,
enter the name of the host that contains the file and click **Connect** to browse that host
- Selected Path – Displays the path selected in the box above
- Add path – Click **Add path** to add the selected path to the Path box. This adds the path to the
search scope.
- Delete path – Select a path in the Path box and click **Delete path** to delete the path from the
search scope
-- Path – Displays the paths that have been added to the search scope
+- Path – Displays the paths added to the search scope
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/textsearch/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/textsearch/summary.md
index e0898aded6..5e841a8c1e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/textsearch/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/textsearch/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Text Search Data Collector Wizard ensuring that no accidental clicks
-are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the Text Search Data Collector Wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/unix/editscript.md b/docs/accessanalyzer/12.0/admin/datacollector/unix/editscript.md
index e3303e377d..cfdbbbe858 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/unix/editscript.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/unix/editscript.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Unix: Edit Script
-The Edit Script page allows the script to be customized.
+Use the Edit Script page to customize the script.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/unix/input.md b/docs/accessanalyzer/12.0/admin/datacollector/unix/input.md
index 57269886ab..b40c8d5544 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/unix/input.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/unix/input.md
@@ -15,12 +15,12 @@ The configurable options are:
- Use SQL table for scoping input – Select the checkbox to enable scoping options
- Input Table
- - Name – Select the SQL table from the drop-down menu
+ - Name – Select the SQL table from the dropdown menu
- Filter Nulls – Select the checkbox to ignore blank rows in the table
- Filter Duplicates – Select the checkbox to ignore duplicate rows in the table
- Filter by host column – Select the checkbox to sort rows by host
-- Columns – Select the desired rows from the SQL table
+- Columns – Select the rows you want from the SQL table
- Data Input Method
- Run command once per table row
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/unix/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/unix/overview.md
index 3774b0c11e..a38cfffefb 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/unix/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/unix/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 390
# Unix Data Collector
The Unix Data collector provides host inventory, software inventory, and logical volume inventory on
-UNIX & Linux platforms. The Unix Data Collector has been preconfigured within the Unix Solution.
-Both this data collector and the solution are available with a special Access Analyzer license. See
+UNIX & Linux platforms. Access Analyzer preconfigures the Unix Data Collector within the Unix
+Solution. Both this data collector and the solution are available with a special Access Analyzer license. See
the [Unix Solution](/docs/accessanalyzer/12.0/solutions/unix/overview.md) topic for additional information.
**Protocols**
@@ -24,14 +24,14 @@ the [Unix Solution](/docs/accessanalyzer/12.0/solutions/unix/overview.md) topic
- Root permissions in Unix/Linux
-If the Root permission is unavailable, a least privileged model can be used. See the
+If the Root permission is unavailable, you can use a least privileged model. See the
[Least Privilege Model](/docs/accessanalyzer/12.0/requirements/unix/target.md#least-privilege-model) topic additional
information.
## Unix Query Configuration
-The Unix Data Collector is configured through the Unix Data Collector Wizard. It is designed to scan
-and import information from UNIX / Linux systems. The Unix Data Collector has these pages:
+You configure the Unix Data Collector through the Unix Data Collector Wizard. It scans
+and imports information from UNIX / Linux systems. The Unix Data Collector has these pages:
- [Unix: Settings](/docs/accessanalyzer/12.0/admin/datacollector/unix/settings.md)
- [Unix: Input](/docs/accessanalyzer/12.0/admin/datacollector/unix/input.md)
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/unix/results.md b/docs/accessanalyzer/12.0/admin/datacollector/unix/results.md
index 6ee5a873ca..8f30b9cf3e 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/unix/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/unix/results.md
@@ -6,16 +6,16 @@ sidebar_position: 50
# Unix: Results
-On the Results page, select which properties will be gathered out of those available for the query.
-Additionally select properties based on which ROWKEY will be built.
+On the Results page, select which properties Access Analyzer gathers for the query.
+Additionally, select the properties that make up the ROWKEY.
The configurable options are:
-- Properties to return – Select the desired columns
-- ROWKEY's components – Select the desired columns
+- Properties to return – Select the columns you want
+- ROWKEY's components – Select the columns you want
Click **Finish** to save the configuration changes, or **Back** to return to the previous page. If
-no changes were made, it is a best practice to click **Cancel** to close the Unix Data Collector
-Wizard to make sure that no accidental settings are saved.
+you made no changes, click **Cancel** instead to close the Unix Data Collector Wizard without
+saving accidental settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/overview.md
index 3d0a280a88..d2915c62dc 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/overview.md
@@ -9,7 +9,7 @@ sidebar_position: 400
The UsersGroups Data Collector audits user and group accounts for both local and domain, extracting
system policies.
-The UsersGroups Data Collector has been preconfigured within the Windows Solution. Both this data
+Access Analyzer preconfigures the UsersGroups Data Collector within the Windows Solution. Both this data
collector and the solution are available with a special Access Analyzer license. See the
[Windows Solution](/docs/accessanalyzer/12.0/solutions/windows/overview.md) topic for additional information.
@@ -29,7 +29,7 @@ collector and the solution are available with a special Access Analyzer license.
- Member of the Local Administrators group
- - If a less-privileged option is required, you can use a regular domain user that has been added
+ - If a less-privileged option is required, you can use a regular domain user added
to the **Network access: Restrict clients allowed to make remote calls to SAM** Local Security
Policy
@@ -37,7 +37,7 @@ collector and the solution are available with a special Access Analyzer license.
## UsersGroups Query Configuration
-The UsersGroups Data Collector is configured through the Users and Groups Browser wizard, which
+You configure the UsersGroups Data Collector through the Users and Groups Browser wizard, which
contains the following wizard pages:
- Welcome
@@ -46,5 +46,5 @@ contains the following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** box when
-the wizard is open and configuration settings are saved.
+You can hide the Welcome page by selecting the **Don't display this page the next time** box when
+the wizard is open and you save configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/groups.md b/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/groups.md
index 89e15c3f3b..61047f2f84 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/groups.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/groups.md
@@ -46,8 +46,8 @@ options opens the Find a Group or Find a User browser.
-The Find a Group and Find a User browsers display a list of groups or users, depending on which one
-is being used, that can be selected for the option. Select from a specific host using the Sample
+The Find a Group and Find a User browsers display a list of groups or users you can select for the
+option, depending on which browser you use. Select from a specific host using the Sample
from host option, or leave the text field blank and click **Connect** to retrieve all user groups or
users that are selectable.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/results.md b/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/results.md
index 95e6eff791..85521a8c19 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/results.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/results.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# UsersGroups: Results
-The Results page is where the type of data to be returned is configured. Each type has a different
+Use the Results page to configure the type of data to return. Each type has a different
set of options.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/security.md b/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/security.md
index 6959317e1a..fc4eec6499 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/security.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/security.md
@@ -6,11 +6,11 @@ sidebar_position: 30
# UsersGroups: Security Category
-This Security policy is used to audit security policies.
+Use this category to audit security policies.
-Select from the following options for what data will be returned:
+Select from the following options for the data to return:
- Security Policy (User Rights Assignment) – Identifies user rights assignment for each individual
policy part that grants or removes rights
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/users.md b/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/users.md
index 53f7b0029b..0f28653f4f 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/users.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/results/users.md
@@ -15,11 +15,11 @@ In the Users section, select from the following options:
- All users – All users found on the target host
- All users in the following groups – Click the ellipsis (**…**) to open the Find a Group browser
window and specify a group. See the [Find a Group/User Browser](#find-a-groupuser-browser) topic
- for additional information. A specific group can also be entered manually into the text field.
+ for additional information. You can also enter a specific group manually into the text field.
- These users – Click the ellipsis (**…**) to open the Find a User browser window and specify one or
more users. See the [Find a Group/User Browser](#find-a-groupuser-browser) topic for additional
- information. A specific user can also be entered manually into the text field.
-- Special users – The users found can be flagged as special users in the following categories:
+ information. You can also enter a specific user manually into the text field.
+- Special users – Flag found users as special users in the following categories:
- Administrator
- Guest
@@ -64,8 +64,8 @@ opens the Find a Group or Find a User browser.
-The Find a Group and Find a User browsers display a list of groups or users, depending on which one
-is being used, that can be selected for the option. Select from a specific host using the Sample
+The Find a Group and Find a User browsers display a list of groups or users you can select for the
+option, depending on which browser you use. Select from a specific host using the Sample
from host option, or leave the text field blank and click **Connect** to retrieve all user groups or
users that are selectable.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/summary.md
index a0b5b5fefe..cd46268021 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/usersgroups/summary.md
@@ -10,6 +10,5 @@ The Summary page displays a summary of the configured query.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the Users and Groups Browser wizard ensuring that no accidental clicks are
-saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the Users and Groups Browser wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/classes.md b/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/classes.md
index f484d39ee9..aaf8cfe275 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/classes.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/classes.md
@@ -10,6 +10,6 @@ On the Classes page, configure the WMICollector namespaces and classes to use as
-Select the **Namespace** and **Class** from the drop-down lists to use as a data source. The default
-namespace, **root\CIMV2**, is typically what should be used. Select the **Win32 classes only**
+Select the **Namespace** and **Class** from the dropdown lists to use as a data source. You
+typically use the default namespace, **root\CIMV2**. Select the **Win32 classes only**
checkbox to use only Win32 classes.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/overview.md b/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/overview.md
index 8242a80b76..72acecb4ff 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/overview.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 410
# WMICollector Data Collector
The WMICollector Data Collector identifies data for certain types of WMI classes and namespaces. The
-WMICollector Data Collector is a core component of Access Analyzer, but it has been preconfigured
-within the Windows Solution. While the data collector is available with all Access Analyzer license
+WMICollector Data Collector is a core component of Access Analyzer, but Access Analyzer
+preconfigures it within the Windows Solution. While the data collector is available with all Access Analyzer license
options, the Windows Solution is only available with a special Access Analyzer license. See the
[Windows Solution](/docs/accessanalyzer/12.0/solutions/windows/overview.md) topic for additional information.
@@ -28,7 +28,7 @@ options, the Windows Solution is only available with a special Access Analyzer l
## WMICollector Query Configuration
-The WMICollector Data Collector is configured through the WMI Browser wizard, which contains the
+You configure the WMICollector Data Collector through the WMI Browser wizard, which contains the
following wizard pages:
- Welcome
@@ -39,5 +39,5 @@ following wizard pages:
-The Welcome page can be hidden by selecting the **Do not display this page the next time** checkbox
-when the wizard is open and configuration settings are saved.
+You can hide the Welcome page by selecting the **Don't display this page the next time** checkbox
+when the wizard is open and you save configuration settings.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/properties.md b/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/properties.md
index 8dcfe3daba..505d085b29 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/properties.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/properties.md
@@ -10,10 +10,10 @@ On the Properties page, select the properties to extract.
-If the **Extract only selected instances** checkbox is not selected, data is returned from all
-process instances displayed in the **Instances of `\`** box. To return data from a
-single process instance, select an instance and select the **Extract only selected instances**
-checkbox. Only one instance can be selected at a time.
+If you don't select the **Extract only selected instances** checkbox, Access Analyzer returns data
+from all process instances displayed in the **Instances of `\`** box. To return
+data from a single process instance, select an instance and select the **Extract only selected
+instances** checkbox. You can select only one instance at a time.
-In the **Instance data** box, select the checkboxes next to the desired properties to return during
+In the **Instance data** box, select the checkboxes next to the properties you want to return during
query execution.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/samplehost.md b/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/samplehost.md
index c2089a3a8f..2a3cea94e9 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/samplehost.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/samplehost.md
@@ -10,7 +10,7 @@ On the Sample Host page, enter a sample host to populate options for the query.
-On the Sample Host page, if the desired classes and namespaces to audit reside on the local host,
-click **Next**. (The local host is represented by `.` in the **Sample host name** box). If a
-different sample host is needed to populate the namespace and class options, enter the name for the
+On the Sample Host page, if the classes and namespaces you want to audit reside on the local host,
+click **Next**. (A period (`.`) represents the local host in the **Sample host name** box). If you need
+a different sample host to populate the namespace and class options, enter the name for the
remote host and click **Next**.
diff --git a/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/summary.md b/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/summary.md
index 961cb26dac..0996dfb448 100644
--- a/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/summary.md
+++ b/docs/accessanalyzer/12.0/admin/datacollector/wmicollector/summary.md
@@ -10,5 +10,5 @@ The Summary page, or Results page, displays a summary of the configured query.
-Click **Finish** to save configuration changes. If no changes were made, it is a best practice to
-click **Cancel** to close the WMI Browser wizard ensuring that no accidental clicks are saved.
+Click **Finish** to save configuration changes. If you made no changes, click **Cancel** instead to
+close the WMI Browser wizard without saving accidental clicks.
diff --git a/docs/accessanalyzer/12.0/admin/hostdiscovery/activities.md b/docs/accessanalyzer/12.0/admin/hostdiscovery/activities.md
index 63e49678d0..300cdcb246 100644
--- a/docs/accessanalyzer/12.0/admin/hostdiscovery/activities.md
+++ b/docs/accessanalyzer/12.0/admin/hostdiscovery/activities.md
@@ -19,7 +19,7 @@ The options are:
- A confirmation window displays. Click **Yes** to complete the deletion
- Run Query – Begins an immediate execution of the selected query
-- Stop Query – Stops the selected query which is currently running
+- Stop Query – Stops the selected query which is running
- No action occurs if the query is **Idle**
diff --git a/docs/accessanalyzer/12.0/admin/hostdiscovery/log.md b/docs/accessanalyzer/12.0/admin/hostdiscovery/log.md
index 31de07f4c9..ffc08c6552 100644
--- a/docs/accessanalyzer/12.0/admin/hostdiscovery/log.md
+++ b/docs/accessanalyzer/12.0/admin/hostdiscovery/log.md
@@ -17,9 +17,9 @@ the [Host Discovery](/docs/accessanalyzer/12.0/admin/settings/hostdiscovery.md)
The following options are above the data grid:
- Reload Log – Refresh the log data for the selected Log date and Query Name
-- Log date – Select the desired **Log date** from the drop-down menu to view transactions
+- Log date – Select the **Log date** you want from the dropdown menu to view transactions
- Query Name – The default selection is **All Queries**. To narrow the data to a desired query,
- select a query name from the drop-down menu.
+ select a query name from the dropdown menu.
The data grid contains the following columns:
diff --git a/docs/accessanalyzer/12.0/admin/hostdiscovery/overview.md b/docs/accessanalyzer/12.0/admin/hostdiscovery/overview.md
index 77c32302ed..cec0fc851c 100644
--- a/docs/accessanalyzer/12.0/admin/hostdiscovery/overview.md
+++ b/docs/accessanalyzer/12.0/admin/hostdiscovery/overview.md
@@ -11,7 +11,7 @@ the Host Discovery node to discover hosts within the targeted environment that m
criteria (for example, all domain controllers for Active Directory auditing).
The Host Discovery queries view displays a list of previously configured queries, opens the Host
-Discovery Wizard to create new queries, and is where host inventory process can be automated. The
+Discovery Wizard to create new queries, and lets you automate the host inventory process. The
**Host Discovery** node houses the Discovery Log. The **Settings** > **Host Discovery** node
contains the global settings that affect discovery queries. See the
[Host Discovery](/docs/accessanalyzer/12.0/admin/settings/hostdiscovery.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/hostdiscovery/queries.md b/docs/accessanalyzer/12.0/admin/hostdiscovery/queries.md
index 447ad2a1ed..fee662859d 100644
--- a/docs/accessanalyzer/12.0/admin/hostdiscovery/queries.md
+++ b/docs/accessanalyzer/12.0/admin/hostdiscovery/queries.md
@@ -10,7 +10,7 @@ The Host Discovery Queries Pane contains a list of previously-configured queries
-The list of previously configured queries is provided in a table format with the following columns:
+The list of previously configured queries appears in a table format with the following columns:
- Name – Displays the name assigned to the query during creation
- Query Source – Identifies where the query searches for hosts
@@ -27,13 +27,13 @@ The list of previously configured queries is provided in a table format with the
- Snapshot – Only shows host found during the most recent query execution
:::note
- The Snapshot mode is configured on the Options page of the Host Discovery Wizard.
+ Configure the Snapshot mode on the Options page of the Host Discovery Wizard.
:::
## View Hidden Columns
-Follow the steps to view the hidden columns in the table:
+To view the hidden columns in the table:
**Step 1 –** Right-click a header in the table, which opens a context menu.
@@ -47,7 +47,7 @@ Follow the steps to view the hidden columns in the table:
-**Step 4 –** Drag and drop the desired column between any header of the table.
+**Step 4 –** Drag and drop the column you want between any header of the table.
diff --git a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/addomaincontrollers.md b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/addomaincontrollers.md
index 4b7049c7d3..9f9c9c4b61 100644
--- a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/addomaincontrollers.md
+++ b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/addomaincontrollers.md
@@ -20,8 +20,8 @@ Directory server (Discover Domain Controllers)** option. Click **Next**.
**Step 2 –** On the Query page, name the query and select the credentials used to access the source.
- Query Name – Provide a unique descriptive name for this query by typing over the `NEWQUERY`
- default name. Two queries can't have the same name. If you use an existing name, a number is
- automatically appended to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
+ default name. Two queries can't have the same name. If you use an existing name, Access Analyzer automatically appends a number
+ to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
for querying the source:
@@ -43,7 +43,7 @@ Click **Next** to continue.
domains and sites. By default, all domains and sites are selected. If desired, scope to target
specific domains and sites.
-- Connection – Select the radio button to specify the server to be connected to and searched:
+- Connection – Select the radio button to specify the server to connect to and search:
- Connect to default directory – Selects a default domain controller from the domain in which
the Access Analyzer Console server resides
@@ -73,7 +73,7 @@ Click **Next** to continue.
- Run the query when jobs that reference it are run – Select this option to automatically execute
the Host Discovery query before executing a job that has the host list generated by this query
- assigned. This ensures any new hosts have been discovered and are available for auditing.
+ assigned. This ensures Access Analyzer has discovered any new hosts and they're available for auditing.
:::info
Use this setting only for host lists tied to specific jobs that require
@@ -85,7 +85,7 @@ Click **Next** to continue.
- Yes, grow the host list by appending newly discovered hosts – The host list includes every
host the query has ever discovered
- - No, only show hosts that were found during the most recent run – The host list generated by
+ - No, only show hosts found during the most recent run – The host list generated by
this query includes only hosts found in the most recent query execution. This option removes
hosts from the generated host list, but doesn't remove hosts from the Host Master Table.
@@ -127,7 +127,7 @@ configuration process.
query at another time.
Both options close the Host Discovery Wizard and return to the Host Discovery Queries view on the
-Host Discovery node. If **Yes** is selected, the **Query State** indicates the running query.
+Host Discovery node. If you select **Yes**, the **Query State** indicates the running query.
## Required Permissions
diff --git a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/adexchange.md b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/adexchange.md
index 5e54d419d8..66b102f6c8 100644
--- a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/adexchange.md
+++ b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/adexchange.md
@@ -21,8 +21,8 @@ Directory server (Discover Exchange servers)** option. Click **Next**.
**Step 2 –** On the Query page, name the query and select the credentials used to access the source.
- Query Name – Provide a unique descriptive name for this query by typing over the `NEWQUERY`
- default name. Two queries can't have the same name. If you use an existing name, a number is
- automatically appended to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
+ default name. Two queries can't have the same name. If you use an existing name, Access Analyzer automatically appends a number
+ to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
for querying the source:
@@ -52,7 +52,7 @@ Leave this page unchanged. If you must modify this page, see the
- Run the query when jobs that reference it are run – Select this option to automatically execute
the Host Discovery query before executing a job that has the host list generated by this query
- assigned. This ensures any new hosts have been discovered and are available for auditing.
+ assigned. This ensures Access Analyzer has discovered any new hosts and they're available for auditing.
:::info
Use this setting only for host lists tied to specific jobs that require
@@ -64,7 +64,7 @@ Leave this page unchanged. If you must modify this page, see the
- Yes, grow the host list by appending newly discovered hosts – The host list includes every
host the query has ever discovered
- - No, only show hosts that were found during the most recent run – The host list generated by
+ - No, only show hosts found during the most recent run – The host list generated by
this query includes only hosts found in the most recent query execution. This option removes
hosts from the generated host list, but doesn't remove hosts from the Host Master Table.
@@ -106,7 +106,7 @@ configuration process.
query at another time.
Both options close the Host Discovery Wizard and return to the Host Discovery Queries view on the
-Host Discovery node. If **Yes** is selected, the **Query State** indicates the running query.
+Host Discovery node. If you select **Yes**, the **Query State** indicates the running query.
## Required Permissions
diff --git a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/adgeneral.md b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/adgeneral.md
index 901e0466ff..372baa0806 100644
--- a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/adgeneral.md
+++ b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/adgeneral.md
@@ -21,8 +21,8 @@ Directory server (General)** option. Click **Next**.
**Step 2 –** On the Query page, name the query and select the credentials used to access the source.
- Query Name – Provide a unique descriptive name for this query by typing over the `NEWQUERY`
- default name. Two queries can't have the same name. If you use an existing name, a number is
- automatically appended to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
+ default name. Two queries can't have the same name. If you use an existing name, Access Analyzer automatically appends a number
+ to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
for querying the source:
@@ -77,7 +77,7 @@ Click **Next** to continue.
- Run the query when jobs that reference it are run – Select this option to automatically execute
the Host Discovery query before executing a job that has the host list generated by this query
- assigned. This ensures any new hosts have been discovered and are available for auditing.
+ assigned. This ensures Access Analyzer has discovered any new hosts and they're available for auditing.
:::info
Use this setting only for host lists tied to specific jobs that require
@@ -89,7 +89,7 @@ Click **Next** to continue.
- Yes, grow the host list by appending newly discovered hosts – The host list includes every
host the query has ever discovered
- - No, only show hosts that were found during the most recent run – The host list generated by
+ - No, only show hosts found during the most recent run – The host list generated by
this query includes only hosts found in the most recent query execution. This option removes
hosts from the generated host list, but doesn't remove hosts from the Host Master Table.
@@ -131,7 +131,7 @@ configuration process.
query at another time.
Both options close the Host Discovery Wizard and return to the Host Discovery Queries view on the
-Host Discovery node. If **Yes** is selected, the **Query State** indicates the running query.
+Host Discovery node. If you select **Yes**, the **Query State** indicates the running query.
## Required Permissions
diff --git a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/csv.md b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/csv.md
index f4b0fd52d0..2758e462be 100644
--- a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/csv.md
+++ b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/csv.md
@@ -31,8 +31,8 @@ The source in this case is the Access Analyzer Console server.
- Query Name – Provide a unique descriptive name for this query by typing over the `NEWQUERY`
- default name. Two queries can't have the same name. If you use an existing name, a number is
- automatically appended to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
+ default name. Two queries can't have the same name. If you use an existing name, Access Analyzer automatically appends a number
+ to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
for querying the source:
@@ -69,7 +69,7 @@ Click **Next** to continue.
- Run the query when jobs that reference it are run – Select this option to automatically execute
the Host Discovery query before executing a job that has the host list generated by this query
- assigned. This ensures any new hosts have been discovered and are available for auditing.
+ assigned. This ensures Access Analyzer has discovered any new hosts and they're available for auditing.
:::info
Use this setting only for host lists tied to specific jobs that require
@@ -81,7 +81,7 @@ Click **Next** to continue.
- Yes, grow the host list by appending newly discovered hosts – The host list includes every
host the query has ever discovered
- - No, only show hosts that were found during the most recent run – The host list generated by
+ - No, only show hosts found during the most recent run – The host list generated by
this query includes only hosts found in the most recent query execution. This option removes
hosts from the generated host list, but doesn't remove hosts from the Host Master Table.
@@ -123,7 +123,7 @@ configuration process.
query at another time.
Both options close the Host Discovery Wizard and return to the Host Discovery Queries view on the
-Host Discovery node. If **Yes** is selected, the **Query State** indicates the running query.
+Host Discovery node. If you select **Yes**, the **Query State** indicates the running query.
## Required Permissions
diff --git a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/database.md b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/database.md
index 379c029b11..c1f3b4151b 100644
--- a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/database.md
+++ b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/database.md
@@ -26,8 +26,8 @@ database** option. Click **Next**.
**Step 2 –** On the Query page, name the query and select the credentials used to access the source.
- Query Name – Provide a unique descriptive name for this query by typing over the `NEWQUERY`
- default name. Two queries can't have the same name. If you use an existing name, a number is
- automatically appended to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
+ default name. Two queries can't have the same name. If you use an existing name, Access Analyzer automatically appends a number
+ to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
for querying the source:
@@ -65,11 +65,11 @@ names are located:
- - Click **Test Connection** to confirm a connection has been established. Click **OK** on the
+ - Click **Test Connection** to confirm the connection succeeded. Click **OK** on the
confirmation window.
- Database – Select the **Select the database on the server** option and use the dropdown menu
to select the database
- - The other tabs in the Data Link Properties window shouldn't be modified
+ - Don't modify the other tabs in the Data Link Properties window:
- Provider tab – The database connector, dictated by the source of the data and the data
sources that are available on the Access Analyzer Console server. This is set by default
@@ -93,7 +93,7 @@ Click **Next** to continue.
- Run the query when jobs that reference it are run – Select this option to automatically execute
the Host Discovery query before executing a job that has the host list generated by this query
- assigned. This ensures any new hosts have been discovered and are available for auditing.
+ assigned. This ensures Access Analyzer has discovered any new hosts and they're available for auditing.
:::info
Use this setting only for host lists tied to specific jobs that require
@@ -105,7 +105,7 @@ Click **Next** to continue.
- Yes, grow the host list by appending newly discovered hosts – The host list includes every
host the query has ever discovered
- - No, only show hosts that were found during the most recent run – The host list generated by
+ - No, only show hosts found during the most recent run – The host list generated by
this query includes only hosts found in the most recent query execution. This option removes
hosts from the generated host list, but doesn't remove hosts from the Host Master Table.
@@ -147,7 +147,7 @@ configuration process.
query at another time.
Both options close the Host Discovery Wizard and return to the Host Discovery Queries view on the
-Host Discovery node. If **Yes** is selected, the **Query State** indicates the running query.
+Host Discovery node. If you select **Yes**, the **Query State** indicates the running query.
## Required Permissions
diff --git a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/ipnetwork.md b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/ipnetwork.md
index 5e5740d1c4..593479c906 100644
--- a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/ipnetwork.md
+++ b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/ipnetwork.md
@@ -20,8 +20,8 @@ option. Click **Next**.
**Step 2 –** On the Query page, name the query and select the credentials used to access the source.
- Query Name – Provide a unique descriptive name for this query by typing over the `NEWQUERY`
- default name. Two queries can't have the same name. If you use an existing name, a number is
- automatically appended to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
+ default name. Two queries can't have the same name. If you use an existing name, Access Analyzer automatically appends a number
+ to the query name, for example `NEWQUERY` becomes `NEWQUERY1`.
- Credentials – Select a Connection Profile. These credentials require the appropriate permissions
for querying the source:
@@ -62,10 +62,10 @@ Click **Next** to continue.
- IP Ranges box – Displays the selected range of IP Addresses. Use the links at the top of the box
to edit the list:
- - Add as inclusion – Adds information provided in the IP Address Textboxes into the to be
- collected list
- - Add as exclusion – Adds information provided in the IP Address Textboxes into the to be
- ignored list
+ - Add as inclusion – Adds the information from the IP Address Textboxes to the list of
+ addresses to include
+ - Add as exclusion – Adds the information from the IP Address Textboxes to the list of
+ addresses to exclude
- Remove – Removes the selection from the IP Ranges box
- (Optional) Only include host with the following ports open – If selected, this option limits the
@@ -84,7 +84,7 @@ Click **Next** to continue.
- Run the query when jobs that reference it are run – Select this option to automatically execute
the Host Discovery query before executing a job that has the host list generated by this query
- assigned. This ensures any new hosts have been discovered and are available for auditing.
+ assigned. This ensures Access Analyzer has discovered any new hosts and they're available for auditing.
:::info
Use this setting only for host lists tied to specific jobs that require
@@ -96,7 +96,7 @@ Click **Next** to continue.
- Yes, grow the host list by appending newly discovered hosts – The host list includes every
host the query has ever discovered
- - No, only show hosts that were found during the most recent run – The host list generated by
+ - No, only show hosts found during the most recent run – The host list generated by
this query includes only hosts found in the most recent query execution. This option removes
hosts from the generated host list, but doesn't remove hosts from the Host Master Table.
@@ -138,7 +138,7 @@ configuration process.
query at another time.
Both options close the Host Discovery Wizard and return to the Host Discovery Queries view on the
-Host Discovery node. If **Yes** is selected, the **Query State** indicates the running query.
+Host Discovery node. If you select **Yes**, the **Query State** indicates the running query.
## Required Permissions
diff --git a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/overview.md b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/overview.md
index 33d9be835e..ee6a121ad0 100644
--- a/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/overview.md
+++ b/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/overview.md
@@ -6,13 +6,13 @@ sidebar_position: 30
# Host Discovery Wizard
-The Host Discovery Wizard gives complete control over how hosts are discovered on the targeted
-network and which hosts are discovered.
+The Host Discovery Wizard gives complete control over how Access Analyzer discovers hosts on the
+targeted network and which hosts it discovers.
Use the Host Discovery Wizard to create new queries. The wizard opens in the Results pane. Use any
-of the following methods in order to access the Host Discovery Wizard from the Host Discovery node:
+of the following methods to access the Host Discovery Wizard from the Host Discovery node:
- Select **Create Query** in the Activities pane
- Right-click the **Host Discovery** node and select **Create Query** from the pop-up menu
@@ -38,7 +38,6 @@ for hosts. Hosts are discoverable using one of the following options:
- [Import From a Database](/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/database.md) – Imports a host list from a specified SQL Server database
:::note
-The Advanced Options checkbox in the lower-left corner is a legacy item and should not be
-selected.
+Don't select the Advanced Options checkbox in the lower-left corner; it's a legacy item.
:::
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/add.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/add.md
index fb78353439..bd8e97c8ac 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/add.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/add.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Add Hosts
The **Add Hosts** option creates a new host list. It can be accessed through the **Host Management**
-node. Follow the steps to add a new host list.
+node. To add a new host list:
@@ -18,9 +18,9 @@ node. Follow the steps to add a new host list.
**Step 2 –** On the Manual Host Entry page, choose to either enter the hosts manually one at a time,
or use the **Import** option. When the list is completed, click **Next**.
-- To enter hosts manually, type the host name in the **Host name** textbox. Then click **Add**. The
- entry will appear in the **Host list** box. Repeat the process until all hosts for this list have
- been entered.
+- To enter hosts manually, enter the host name in the **Host name** textbox. Then click **Add**. The
+ entry will appear in the **Host list** box. Repeat the process until you've entered all hosts for
+ this list.
- The **Import** option opens the Import Hosts window. See the [Import Hosts Option](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/importhost.md)
topic for additional information.
- Use **Remove** to delete a selected host from the **Host list** box
@@ -30,7 +30,7 @@ or use the **Import** option. When the list is completed, click **Next**.
**Step 3 –** On the Specify Host List Properties page, provide a unique descriptive **Host List
Name**.
-- There cannot be two host lists with the same name. Access Analyzer automatically appends a numeral
+- There can't be two host lists with the same name. Access Analyzer automatically appends a numeral
to the end of a host list name to avoid duplicates.
**Step 4 –** On the Specify Host List Properties page, configure when inventory fields should be
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/deletehost.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/deletehost.md
index 238cad6377..79867a8a57 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/deletehost.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/deletehost.md
@@ -4,24 +4,24 @@ description: "Delete Host(s)"
sidebar_position: 30
---
-# Delete Host(s)
+# Delete Hosts
-Use the **Delete Host(s)** option at the **Host Management** node to permanently delete a host from
+Use the **Delete Hosts** option at the **Host Management** node to permanently delete a host from
the master host table, or at an individual host list node to remove the host from the selected list.
## Delete From Host Management Node
-Follow the steps to delete a host from the Host Management node.
+To delete a host from the Host Management node:
**Step 1 –** In the Host Management node, select the host in the data grid and click **Delete
-Host(s)** on the Activities pane.
+Hosts** on the Activities pane.
:::warning
-A deletion from the host master table at the Host Management node cannot be undone, as
+A deletion from the host master table at the Host Management node can't be undone, as
it deletes it from the host management database tables. It also removes the host from any host list
-to which it has been assigned. Click **Cancel** to stop the deletion.
+it's assigned to. Click **Cancel** to stop the deletion.
:::
@@ -32,9 +32,9 @@ The host is no longer in the master host table.
## Delete From Individual Host List
-Follow the steps to delete a host from an individual host list.
+To delete a host from an individual host list:
-**Step 1 –** In the host list, select the host in the data grid and click **Delete Host(s)** on the
+**Step 1 –** In the host list, select the host in the data grid and click **Delete Hosts** on the
Activities pane.
@@ -48,12 +48,12 @@ is limited to removing the selected host from the current host list.
:::warning
-A deletion from the host master table cannot be undone, as it deletes it from the host
+A deletion from the host master table can't be undone, as it deletes it from the host
management database tables.
:::
-**Step 3 –** If the host is not found in another static host list, Access Analyzer asks if you also
+**Step 3 –** If the host isn't found in another static host list, Access Analyzer asks if you also
want to remove the host from the Host Master Table. On the Confirm dialog, select the desired
action.
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/deletelist.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/deletelist.md
index 37040ef69e..bff99da579 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/deletelist.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/deletelist.md
@@ -10,7 +10,7 @@ Use the **Delete List** option to remove the selected list. This option is avail
individual host list node.
:::info
-Before deleting a host list, first ensure it is not assigned to a job.
+Before deleting a host list, first ensure it isn't assigned to a job.
:::
@@ -19,7 +19,7 @@ Before deleting a host list, first ensure it is not assigned to a job.
:::warning
-This action cannot be undone. Click **Cancel** to stop the deletion.
+This action can't be undone. Click **Cancel** to stop the deletion.
:::
@@ -31,14 +31,14 @@ lists.
**Step 3 –** If no hosts are found in any other host list, then Access Analyzer asks if you want to
-remove the host from the master host table. On the Confirm dialog box, select the desired option.
+remove the host from the master host table. On the Confirm dialog box, select the option you want.
- Yes – Deletes the specified host from the master host table
-- No – Does not delete the specified host from the master host table
-- No to All – Does not delete other hosts that are not found in another static host list from the
+- No – Doesn't delete the specified host from the master host table
+- No to All – Doesn't delete other hosts that aren't found in another static host list from the
master host table
- Yes to All – Deletes other hosts not found in any other static host list from the master host
table
When the operation is complete, the list is no longer visible under the Host Management node in the
-Navigation pane and it cannot be used to execute jobs against.
+Navigation pane and you can't use it to execute jobs against.
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/editlist.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/editlist.md
index 2a76d8e7b5..6e40125da3 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/editlist.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/editlist.md
@@ -19,7 +19,7 @@ the Specify Host List Properties page where you can modify the following:
- Host List Name
:::warning
- Changing the name of a host list that has been assigned to a job can cause the job
+ Changing the name of a host list assigned to a job can cause the job
to fail.
:::
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/editquery.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/editquery.md
index 6ae23ad8a0..0ded97e385 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/editquery.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/editquery.md
@@ -11,7 +11,7 @@ Use the **Edit Query** option to modify host lists created by a Host Discovery q
In the Navigation pane, select the query-created host list to edit and click **Edit Query**. The
-Host Discovery Wizard opens to the Query page where the query settings for the selected
-query-created host list are modified. See the
+Host Discovery Wizard opens to the Query page, where you can modify the query settings for the
+selected query-created host list. See the
[Host Discovery Wizard](/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/overview.md) topic for information on modifying
these settings.
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/export.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/export.md
index f47698ec18..1be6667bea 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/export.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/export.md
@@ -7,7 +7,7 @@ sidebar_position: 70
# Export Data
Use the **Export Data** option to export all information available in the current grid view for the
-selected host list to a HTML, XML , or CSV file. Follow the steps to export data.
+selected host list to a HTML, XML, or CSV file. To export data:
**Step 1 –** Select the Host Management or individual host list node to export data from, and
configure the data grid to contain all the columns you want to export. See the
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/importhost.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/importhost.md
index b8144f954d..8e7aeb3980 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/importhost.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/importhost.md
@@ -9,7 +9,7 @@ sidebar_position: 20
On the Manual Host Entry page of the Host List Wizard, the **Import** option allows hosts to be
imported from either a CSV file or a database into the host list being created.
-Follow the steps to import hosts.
+To import hosts:
@@ -28,11 +28,11 @@ step.
- CSV File
- - File Name – Click the ellipsis (**…**) to open a browser window and select the CSV file. This
- file needs to be stored on the Access Analyzer Console server. Once selected, a preview of the
- file is shown in the preview box.
- - Includes header row – Select this checkbox if the file contains a header row. Otherwise, the
- header row will be included in the import (visible within the preview box).
+ - File Name – Click the ellipsis (**…**) to open a browser window and select the CSV file. You
+ must store this file on the Access Analyzer Console server. After you select the file, Access
+ Analyzer shows a preview in the preview box.
+ - Includes header row – Select this checkbox if the file contains a header row. Otherwise, Access Analyzer
+ includes the header row in the import (visible within the preview box).
@@ -45,15 +45,15 @@ step.
information.
:::note
- The Provider, Advanced, and All tabs of the Data Link Properties window should not
- be modified.
+ Don't modify the Provider, Advanced, and All tabs of the Data Link Properties
+ window.
:::
- - Table – Use the dropdown to select the table that contains the hosts to be imported. A preview
- of the selected table is displayed in the preview box.
+ - Table – Use the dropdown to select the table that contains the hosts to import. Access Analyzer displays a preview
+ of the selected table in the preview box.
-**Step 4 –** Use either the drop-down menu or click on the column in the preview box to select the
+**Step 4 –** Use either the dropdown menu or click the column in the preview box to select the
column containing the host names. The selected column is highlighted in the preview box.
**Step 5 –** Click **OK** to complete the import.
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/importlocation.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/importlocation.md
index ff0a098bfd..09c070ba0d 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/importlocation.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/importlocation.md
@@ -11,14 +11,14 @@ customized version of the Import Hosts window. Add host locations from a CSV fil
database without creating a new host list. See the [Host Inventory Data Grid](/docs/accessanalyzer/12.0/admin/hostmanagement/datagrid.md) topic
for information on the Location column of host inventory.
-Follow the steps to import physical location data for hosts.
+To import physical location data for hosts:
**Step 1 –** Ensure the import source file has columns for both the host name as it is identified
within Access Analyzer and the location.
:::note
-When a host name does not match any existing hosts within the Host Master Table, it can be
-added as a new host.
+When a host name doesn't match any existing hosts within the Host Master Table, you can
+add it as a new host.
:::
@@ -36,11 +36,11 @@ step.
- CSV File
- - File Name – Click the ellipsis (**…**) to open a browser window and select the CSV file. This
- file needs to be stored on the Access Analyzer Console server. Once selected, a preview of the
- file is shown in the preview box.
- - Includes header row – Select this checkbox if the file contains a header row. Otherwise, the
- header row will be included in the import (visible within the preview box).
+ - File Name – Click the ellipsis (**…**) to open a browser window and select the CSV file. You
+ must store this file on the Access Analyzer Console server. After you select the file, Access
+ Analyzer shows a preview in the preview box.
+ - Includes header row – Select this checkbox if the file contains a header row. Otherwise, Access Analyzer
+ includes the header row in the import (visible within the preview box).
- Database
@@ -51,20 +51,20 @@ step.
information.
:::note
- The Provider, Advanced, and All tabs of the Data Link Properties window should not
- be modified.
+ Don't modify the Provider, Advanced, and All tabs of the Data Link Properties
+ window.
:::
- - Table – Use the dropdown to select the table that contains the hosts to be imported. A preview
- of the selected table is displayed in the preview box.
+ - Table – Use the dropdown to select the table that contains the hosts to import. Access Analyzer displays a preview
+ of the selected table in the preview box.
-**Step 5 –** Use either the drop-down menu or click on the column in the preview box to select the
+**Step 5 –** Use either the dropdown menu or click the column in the preview box to select the
column containing the host names. The selected column is highlighted in the preview box.
-**Step 6 –** Use the **Import column** drop-down menu to select the column containing the location
+**Step 6 –** Use the **Import column** dropdown menu to select the column containing the location
information. The selected column is highlighted a lighter color in the preview box.
**Step 7 –** Click **OK** to complete the import.
@@ -72,12 +72,12 @@ information. The selected column is highlighted a lighter color in the preview b
The Location column now contains the imported information. If any of the hosts included in the
-import file are not already in the Host Master Table, Access Analyzer prompts for confirmation on
-whether or not to import the host. Selecting **Yes** or **Yes to All** adds the new hosts to the
+import file aren't already in the Host Master Table, Access Analyzer prompts for confirmation on
+whether to import the host. Selecting **Yes** or **Yes to All** adds the new hosts to the
Host Master Table but not to any individual host lists.
:::note
-Any new hosts that match dynamic host list criteria will be added to the appropriate
+Access Analyzer adds any new hosts that match dynamic host list criteria to the appropriate
dynamic host lists.
:::
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/overview.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/overview.md
index 3d4ddb2b0f..5d3a30c3ef 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/overview.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/overview.md
@@ -18,9 +18,9 @@ The available actions are:
- [Add Hosts](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/add.md) – Create a new host list by manually entering hosts or importing a host list
(only available in the Host Management node)
- [View/Edit Host](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/viewhost.md) – Open the Host Details View, which displays the collected host
- inventory information for the selected host in an easier-to-read format and allows you to manually
+ inventory information for the selected host in an easier-to-read format and lets you manually
edit the host inventory information
-- [Delete Host(s)](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/deletehost.md) – Delete host from the selected list (permanently deletes host
+- [Delete Hosts](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/deletehost.md) – Delete host from the selected list (permanently deletes host
from the host master table if used in the Host Management node)
- [Import Location](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/importlocation.md) – Import the physical location data for hosts from a CSV file
or database without creating a new host list. Location column is in the
@@ -35,8 +35,9 @@ The available actions are:
- [Export Data](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/export.md) – Export the current data grid to a HTML, XML, or CSV file
- [Suspend/Resume Host Inventory](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/suspend.md) – Pause an **In progress** host inventory or resume a
paused **In queue** host inventory
-- External commands – Sub-header (not activity) that separates the Activities above which occur
- within the Access Analyzer Console from the Activities below which open external processes:
+- External commands – Sub-header (not activity) that separates the activities that occur
+ within the Access Analyzer Console from the following external command activities, which open
+ external processes:
- Manage Host – Opens the Microsoft Management Console interface for the selected host if it has
that feature enabled
@@ -50,7 +51,7 @@ Activities available only at the individual host list nodes are:
- [Edit List](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/editlist.md) – Edit the selected host list in the Host List Wizard
- [Edit Query](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/editquery.md) – Edit the Host Discovery query settings for the selected query-created
host list
-- [Rename List](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/rename.md) – Rename the selected host list (should not be used if the host list has
- already been assigned to a job for execution)
+- [Rename List](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/rename.md) – Rename the selected host list (don't use this option if you've
+ already assigned the host list to a job for execution)
- [Delete List](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/deletelist.md) – Delete the selected host list
- [View Query](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/viewquery.md) – Opens the Host Discovery Queries window
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/refresh.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/refresh.md
index 6c6c09a0e8..a5e7d33e2a 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/refresh.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/refresh.md
@@ -6,7 +6,7 @@ sidebar_position: 90
# Refresh Hosts
-Use the **Refresh Hosts** option to manually execute the Host Inventory query. It can be selected
+Use the **Refresh Hosts** option to manually execute the Host Inventory query. You can select it
for the following:
- All hosts – Use from the Host Management node
@@ -21,4 +21,4 @@ Select the hosts or host list to inventory and then click **Refresh Hosts** in t
-When only particular hosts are selected in a list, a dialog box asks for confirmation of the action.
+When you select only particular hosts in a list, a dialog box asks you to confirm the action.
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/rename.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/rename.md
index fbc22e0bb7..743b70c87f 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/rename.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/rename.md
@@ -10,7 +10,7 @@ Use the Rename List option to change the name of a selected host list. This opti
from an individual host list node.
:::warning
-Changing the name on a host list that has been assigned to a job can cause the job to
+Changing the name on a host list that you've already assigned to a job can cause the job to
fail.
:::
@@ -21,7 +21,7 @@ Select the host list to rename and click **Rename List** to open the Host list n
the new name for the host list and click **OK**.
:::note
-Host list names can also be changed using the **Edit List** option, see the
+You can also change host list names using the **Edit List** option. See the
[Edit List](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/editlist.md) topic for additional information.
:::
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/savetolist.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/savetolist.md
index 8cdf9b68af..5b17037174 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/savetolist.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/savetolist.md
@@ -9,7 +9,7 @@ sidebar_position: 120
Use the **Save Selected To List** option to create a static host list. This option is available from
either the Host Management node or an individual host list node. See the
[Static Host Lists](/docs/accessanalyzer/12.0/admin/hostmanagement/lists.md#static-host-lists) topic for additional information on static host
-lists. This option is inactive until at least one host within the data grid is selected.
+lists. This option is inactive until you select at least one host in the data grid.
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/saveview.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/saveview.md
index 3c636b240d..755ebd9093 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/saveview.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/saveview.md
@@ -8,11 +8,11 @@ sidebar_position: 110
Use the **Save Current View** option to create a dynamic host list. This option is available from
either the Host Management node or an individual host list node. The option is inactive until you
-apply a filter to the data grid. Follow the steps to create a dynamic host list.
+apply a filter to the data grid. To create a dynamic host list:
**Step 1 –** Select the Host Management or individual host list node to create the host list from.
-**Step 2 –** Filter the data grid for the desired criteria. See the
+**Step 2 –** Filter the data grid for the criteria you want. See the
[Host Inventory Data Grid](/docs/accessanalyzer/12.0/admin/hostmanagement/datagrid.md) topic for additional information.
@@ -26,12 +26,12 @@ and click **OK**.
The new host list displays under the Host Management node. When the Access Analyzer Console closes
the host lists under the Host Management node, the hosts reorganize in alphanumeric order. Like the
-default host lists, custom dynamic host lists are auto-populated and updated according to host
-inventory.
+default host lists, Access Analyzer auto-populates and updates custom dynamic host lists according
+to host inventory.
:::info
-Do not modify the criteria once a dynamic based list has been created. It is
-better to delete and recreate the list in order to modify a dynamic-based list.
+Don't modify the criteria after you create a dynamic-based list. Instead, delete and recreate the
+list.
:::
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/suspend.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/suspend.md
index ddf5cb096e..18b5da3e81 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/suspend.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/suspend.md
@@ -10,11 +10,11 @@ Use the **Suspend Host Inventory** option to pause an in progress inventory.
-Once clicked, the option changes to **Resume Host Inventory** and the **In progress** host
+After you click it, the option changes to **Resume Host Inventory** and the **In progress** host
inventories change to an **In queue** state.
:::note
-Clicking **Refresh Hosts** while inventory is suspended adds to the queue but does not
+Clicking **Refresh Hosts** while inventory is suspended adds to the queue but doesn't
resume the inventory.
:::
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/viewhost.md b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/viewhost.md
index 5fb55e4a00..97a6028118 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/actions/viewhost.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/actions/viewhost.md
@@ -20,9 +20,9 @@ The Host Details View displays in the Results pane, and the rest of the Access A
unavailable while it is open. You can use the view to manually edit the host inventory information.
- Edit – Enables the textboxes and checkboxes for editing
-- Apply – Saves any changes. This button appears when **Edit** is clicked.
+- Apply – Saves any changes. This button appears when you click **Edit**.
- Save as HTML – Exports the current view of the selected host’s inventory to an HTML file. Click,
- then provide a name and location for the export. The export is now sharable as desired. This
+ then provide a name and location for the export. Share the export as desired. This
button is inactive while in edit mode.
-- Cancel – Abandons any changes. This button displays when **Edit** is clicked.
+- Cancel – Abandons any changes. This button displays when you click **Edit**.
- Close – Exits the Host Details View
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/datagrid.md b/docs/accessanalyzer/12.0/admin/hostmanagement/datagrid.md
index 7720ec692d..0db926934d 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/datagrid.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/datagrid.md
@@ -12,7 +12,7 @@ at the **Host Management** node (the Host Master Table) or at individual host li
-The icon for each host entry is an indicator of its inventory state:
+The icon for each host entry indicates its inventory state:
| Icon | Inventory State |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------- |
@@ -33,8 +33,8 @@ Use the horizontal scrollbar at the bottom to view the host inventory data, whic
:::note
If the Access Analyzer application is stopped during host inventory collection, hosts
queued for inventory retain the **InventoryState** of **In queue** within the Host Management
- node data grid, as this is the last known state of inventory. It retains that state until the
- next host inventory collection is executed against the host.
+ node data grid, as this is the last known state of inventory. It retains that state until
+ Access Analyzer executes the next host inventory collection against the host.
:::
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/lists.md b/docs/accessanalyzer/12.0/admin/hostmanagement/lists.md
index 4ed240a659..70fdabac9d 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/lists.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/lists.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# Hosts Lists
-A host list is a grouping of hosts for the purpose of executing jobs against. Every host list
-created can be accessed by expanding the **Host Management** node in the Navigation pane.
+A host list is a grouping of hosts to execute jobs against. You can access every host list
+by expanding the **Host Management** node in the Navigation pane.
@@ -35,42 +35,43 @@ the data collected by host inventory.
## Dynamic Host Lists
-Dynamic host lists are lists of hosts that are grouped according to selected criteria within the
-host inventory. Each time a host inventory record is refreshed, the hosts are automatically added to
-or removed from dynamic host lists in accordance with the criteria set for the list. They include
+Dynamic host lists group hosts according to selected criteria within the host inventory. Each time
+Access Analyzer refreshes a host inventory record, it automatically adds or removes hosts from
+dynamic host lists according to the criteria set for the list. They include
both the default host lists and custom created dynamic host lists. See the
[Host Inventory](/docs/accessanalyzer/12.0/admin/settings/hostinventory.md) topic for a list of the default host lists and
instructions on controlling which of these lists are visible under the Host Management node.
-Custom dynamic host lists are created by filtering the data grid and using the
-[Save Current View](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/saveview.md) option in the Activities pane or right-click menu. This can
-be done at the Host Management node with the Host Master Table or at any host list node. See the
+Create custom dynamic host lists by filtering the data grid and using the
+[Save Current View](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/saveview.md) option in the Activities pane or right-click menu. Do this
+at the Host Management node with the Host Master Table or at any host list node. See the
[Filter](/docs/accessanalyzer/12.0/admin/navigate/datagrid.md#filter) topic for additional information on filtering data grids.
:::info
-Do not modify the criteria once a dynamic based list has been created. It is
-better to delete and recreate the list in order to modify a dynamic-based list.
+Don't modify the criteria after you create a dynamic-based list. Instead, delete and recreate the
+list.
:::
## Static Host Lists
-Static host lists are created either through host discovery queries or manually entered within the
-**Host Management** node. Lists created by [Host Discovery Node](/docs/accessanalyzer/12.0/admin/hostdiscovery/overview.md)
-queries are updated each time the query is run, manually or scheduled. Other static host lists can
-only be changed manually. Custom host lists are frequently created in order to scope a job to
+Access Analyzer creates static host lists automatically through host discovery queries, or you can
+create them manually within the **Host Management** node.
+[Host Discovery Node](/docs/accessanalyzer/12.0/admin/hostdiscovery/overview.md) queries create these
+lists and update them each time you run the query, manually or on a schedule. You can only change
+other static host lists manually. You frequently create custom host lists to scope a job to
execute against a select set of hosts.
For example, a user running the Exchange Solution might create a list to just run Mailbox queries
-against. Whereas a user running the File System Solution might create a list of servers being used
+against. Whereas a user running the File System Solution might create a list of servers used
for file shares.
There are two common ways to create static host lists:
- Use the [Add Hosts](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/add.md) option in the Activities pane or right-click menu to access
the Host List Wizard
-- Select multiple hosts from the data grid using the Windows Ctrl and left-click function. This can
- be done from the Host Mast Table or any host list under the Host Management node. Then use the
+- Select multiple hosts from the data grid using the Windows Ctrl and left-click function. You can
+ do this from the Host Mast Table or any host list under the Host Management node. Then use the
[Save Selected To List](/docs/accessanalyzer/12.0/admin/hostmanagement/actions/savetolist.md) option in the Activities pane or right-click menu
to open the Host List Wizard with a pre-filled in Manual Host Entry page.
diff --git a/docs/accessanalyzer/12.0/admin/hostmanagement/overview.md b/docs/accessanalyzer/12.0/admin/hostmanagement/overview.md
index 263d84cc9f..f8c181f45e 100644
--- a/docs/accessanalyzer/12.0/admin/hostmanagement/overview.md
+++ b/docs/accessanalyzer/12.0/admin/hostmanagement/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Host Management
-The **Host Management** node is used to manage hosts in a targeted environment. Hosts configured
-under the **Host Management** node can be audited using other features in Access Analyzer. This node
+Use the **Host Management** node to manage hosts in a targeted environment. You can audit hosts
+configured under the **Host Management** node using other features in Access Analyzer. This node
maintains information for audited computers. To view information on all computers in the
environment, use the
[.Active Directory Inventory Solution](/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/overview.md),
@@ -15,7 +15,7 @@ specifically the Active Directory Summary report.
The Host Management node provides a master list of every host ever introduced to Access Analyzer.
Introduce hosts through [Host Discovery Node](/docs/accessanalyzer/12.0/admin/hostdiscovery/overview.md) queries or by entering
-them manually. Hosts are removed from this list only by manually deleting them. This master listing
+them manually. You can only remove hosts from this list by manually deleting them. This master listing
of hosts, or the Host Master Table, is designed around unique host names, not necessarily unique
hosts themselves. The data grid provides all host inventory information collected on the hosts. See
the [Host Inventory Data Grid](/docs/accessanalyzer/12.0/admin/hostmanagement/datagrid.md) topic for additional information.
@@ -23,7 +23,7 @@ the [Host Inventory Data Grid](/docs/accessanalyzer/12.0/admin/hostmanagement/da
The Host Management process consists of the following phases:
- Host Discovery – The process of discovering hosts to audit through Host Discovery queries, which
- can be scoped to identify computers with commonalities. These queries are managed under the Host
+ you can scope to identify computers with commonalities. You manage these queries under the Host
Discovery node. See the [Host Discovery Node](/docs/accessanalyzer/12.0/admin/hostdiscovery/overview.md) topic for additional
information.
- Host Inventory – The process of collecting key pieces of information about each host to aid in
diff --git a/docs/accessanalyzer/12.0/admin/jobs/features.md b/docs/accessanalyzer/12.0/admin/jobs/features.md
index 96d93aa710..31d07f2291 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/features.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/features.md
@@ -6,13 +6,13 @@ sidebar_position: 40
# Special Features & Functions
-There are several special features and functions available for jobs and job components with which
-Access Analyzer users should be familiar.
+Access Analyzer users should be familiar with several special features and functions available for
+jobs and job components.
**View XML Files**
-Job, query, analysis, and action property windows all have the **View XML** option. These provide
-the ability to edit through an XML text window.
+Job, query, analysis, and action property windows all have the **View XML** option. These let you
+edit through an XML text window.
**Open Explore Folder**
@@ -21,19 +21,19 @@ the **Explore Folder** option in the right-click menu.
**Publish Reports after Report Generation**
-Reports that have been generated but not published can be sent to the Web Console using the
+You can send generated but unpublished reports to the Web Console by using the
**Publish** option in the right-click menu from the selected Jobs tree, job group, or job node. See
the [Publish Reports Window](#publish-reports-window) topic for additional information.
**Job Configuration Change Tracking**
-Jobs configuration changes can be tracked using the **Changes** option in the right-click menu from
+You can track job configuration changes using the **Changes** option in the right-click menu from
the selected Jobs tree, job group, or job node. See the [Changes Window](/docs/accessanalyzer/12.0/admin/jobs/overview.md#changes-window)
topic for additional information.
**Job Export**
-Jobs can be exported to a ZIP file using the **Export** option in the right-click menu from the
+You can export jobs to a ZIP file using the **Export** option in the right-click menu from the
selected job group or job node. See the
[Export Job to Zip Archive Window](#export-job-to-zip-archive-window) topic for additional
information.
@@ -60,33 +60,33 @@ There are two options for where to save the ZIP file:
- Save in the exported folder – Saves the file in the job’s directory, for example
`%sainstalldir%Jobs\GROUP_.Active Directory Inventory\.Active Directory Inventory.zip`
-- Save in the following location – Allows you to either type or browse to the desired save location
+- Save in the following location – Type or browse to the save location you want
-The **Email this archive**checkbox provides the opportunity to send an email notification with the
+The **Email this archive** checkbox lets you send an email notification with the
attached ZIP file.
-When the archive has been created, the Access Analyzer Support Email window opens. By default, the
-recipient is set to [Netwrix Support](https://www.netwrix.com/support.html) but it can be modified
-prior to sending. Additional recipients can be added, and the Subject and email body can be
-modified.
+After Access Analyzer creates the archive, the Support Email window opens. By default, Access
+Analyzer sets the recipient to [Netwrix Support](https://www.netwrix.com/support.html), but you can
+change it before sending. You can also add additional recipients and modify the Subject and email
+body.
## Publish Reports Window
-The **Publish Reports** wizard allows you to better manage the list of reports published to the Web
+Use the **Publish Reports** wizard to better manage the list of reports published to the Web
Console.
-When you right-click on a job group or job and select **Publish**, the Publish Reports wizard opens.
-You can choose the list of reports to be published or removed from the Web Console.
+When you right-click a job group or job and select **Publish**, the Publish Reports wizard opens.
+You can choose which reports to publish or remove from the Web Console.
-Follow the steps to publish the reports.
+To publish the reports:
-**Step 1 –** Right-click on a job group or job and select **Publish** from the drop-down list.
+**Step 1 –** Right-click a job group or job and select **Publish** from the dropdown list.
-**Step 2 –** On the Action Type page, select the type of action to be performed on the reports and
+**Step 2 –** On the Action Type page, select the type of action to perform on the reports and
click **Next**:
- Publish Reports
@@ -94,11 +94,11 @@ click **Next**:
-**Step 3 –** On the Report Tree page, select the reports to be published or removed (depending on
-the Action Type selected in the previous step). Click **Next** to proceed with the action.
+**Step 3 –** On the Report Tree page, select the reports to publish or remove (depending on
+the Action Type you selected in the previous step). Click **Next** to proceed with the action.
**Step 4 –** The Progress page shows you the status of the action. When it has completed, click
**Finish** to exit the wizard.
-Published reports can be viewed under the **[Job]** > **Results** node or through the Web Console.
+You can view published reports under the **[Job]** > **Results** node or through the Web Console.
See the [Reporting](/docs/accessanalyzer/12.0/admin/report/overview.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/group/overview.md b/docs/accessanalyzer/12.0/admin/jobs/group/overview.md
index 1e2de34053..80f8664fee 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/group/overview.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/group/overview.md
@@ -6,18 +6,18 @@ sidebar_position: 10
# Job Groups
-Job groups are designed to manage related jobs and can contain sub-job groups to ensure that related
-jobs are executed in the correct order. To create a new job group, right-click on the desired
+Job groups manage related jobs and can contain sub-job groups to ensure related
+jobs execute in the correct order. To create a new job group, right-click the desired
location (Jobs tree or another job group) and select **Create Group**. Then provide a unique,
descriptive name taking into consideration the alphanumeric ordering of the Jobs tree.
-Job groups are organized similar to the Jobs tree, with the Settings node at the top, followed by
-sub-job groups (job group for collection first, if applicable), then followed by analysis and
-reporting jobs. Both are sorted in alphanumeric order. This is necessary because data collection
-jobs must run prior to the analysis and reporting jobs that rely on the collected data without
-consideration to the job’s name (alphanumeric order).
+Access Analyzer organizes job groups similar to the Jobs tree, with the Settings node at the top,
+followed by sub-job groups (job group for collection first, if applicable), then followed by
+analysis and reporting jobs. It sorts both in alphanumeric order. This is necessary because data
+collection jobs must run before the analysis and reporting jobs that rely on the collected data,
+regardless of alphanumeric naming order.
## Job Group Description Page
@@ -43,13 +43,13 @@ Job Library, and creating a job.
Pre-configured job group description pages provide users with shortcuts and links to many of the
-functions that can be accessed in the Jobs Tree in the Navigation Pane.
+functions available in the Jobs Tree in the Navigation Pane.
The sections of the job group description page are:
-- Job Group Settings Shortcuts – These pages can also be accessed through the job group Settings
+- Job Group Settings Shortcuts – You can also access these pages through the job group Settings
Nodes in the Navigation Pane. See the [Job Groups Settings Node](/docs/accessanalyzer/12.0/admin/jobs/group/settings/settings.md) topic for additional
information.
@@ -61,11 +61,11 @@ The sections of the job group description page are:
- Help – Opens the [Netwrix Technical Knowledge Center](https://helpcenter.netwrix.com/) in a
browser to a relevant landing page for the job group
-- Run Now – Runs the currently selected job group
+- Run Now – Runs the selected job group
- Schedule – Opens the Schedule page to schedule the job group
- Open Folder – Opens the job group’s folder location with supporting files in the Windows Explorer
-- Create Group – Creates a job group within the currently selected job group
-- Create Job – Creates a job within the currently selected Job
+- Create Group – Creates a job group within the selected job group
+- Create Job – Creates a job within the selected Job
- Add Instant Job – Add an Instant Job using the Instant Job Wizard. See the
[Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md) topic for additional information.
@@ -75,12 +75,12 @@ The Overview section provides summary information about the job group. This sect
following information:
- Assigned Host List – Hovering over the **Assigned Host List** button shows a tool-tip with
- information on the hosts lists are assigned to the job group
+ information on which host lists you've assigned to the job group
- - Click on the **Assigned Host List** button to go to the Job Group's Host List Assignment node.
+ - Click the **Assigned Host List** button to go to the Job Group's Host List Assignment node.
See the [Host Lists Assignment](/docs/accessanalyzer/12.0/admin/jobs/group/settings/hostlistsassignment.md) topic for additional information.
-- Show Inherited Settings – Click on the **Show Inherited Settings** button to view information on
+- Show Inherited Settings – Click the **Show Inherited Settings** button to view information on
the following:
- Connection Profile
@@ -89,18 +89,18 @@ following information:
- Reporting Settings
- Storage Account
-- Contents – Shows the job groups and jobs contained within the currently selected job group
+- Contents – Shows the job groups and jobs contained within the selected job group
:::note
-If applicable, the page shows special instructions for which hosts need to be targeted for
+If applicable, the page shows special instructions for which hosts you need to target for
proper job group execution.
:::
### Job Settings: Inherited and Directly Applied
-Job group settings can be applied directly or inherited. On the job group level, it is considered
-that all settings are applied directly.
+Job group settings can be applied directly or inherited. At the job group level, all settings apply
+directly.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/group/settings/connection.md b/docs/accessanalyzer/12.0/admin/jobs/group/settings/connection.md
index d67a6d9e8e..8587f2002e 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/group/settings/connection.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/group/settings/connection.md
@@ -7,28 +7,27 @@ sidebar_position: 10
# Connection Node
At the job group level, the **Connection** node identifies the Connection Profile assigned for the
-job group. All Connection Profiles are created at the global level (**Settings** > **Connection**).
+job group. You create all Connection Profiles at the global level (**Settings** > **Connection**).
-By default, all job groups are set to inherit the **Use Default Profile** option from the global
-level or a parent job group. See the [Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) topic for
+By default, Access Analyzer sets all job groups to inherit the **Use Default Profile** option from
+the global level or a parent job group. See the [Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) topic for
additional information.
-If the Default Setting is not preferred, select the custom type of connection settings desired
-below:
+If you don't prefer the Default Setting, select one of the following custom connection settings:
- System default
- - For manual or ad hoc job execution, the account logged into the Access Analyzer Console is
- applied to the target hosts for authentication
- - For scheduled job execution, the account supplied as the Schedule Service account at the
- **Settings** > **Schedule** node is applied to the target hosts for authentication
+ - For manual or ad hoc job execution, Access Analyzer applies the account logged into the
+ Access Analyzer Console to the target hosts for authentication
+ - For scheduled job execution, Access Analyzer applies the account supplied as the Schedule
+ Service account at the **Settings** > **Schedule** node to the target hosts for authentication
- Select one of the following user defined profiles
- - Select a pre-configured Connection Profile from the drop-down menu
+ - Select a pre-configured Connection Profile from the dropdown menu
Selecting the **Set all the child objects to inherit these settings** option forces inheritance of
-this setting to all sub-groups and jobs within the job group. When enabled, this option overrides
-any custom settings configured for the child objects.
+this setting to all sub-groups and jobs within the job group. When you enable this option, it
+overrides any custom settings configured for the child objects.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/group/settings/history.md b/docs/accessanalyzer/12.0/admin/jobs/group/settings/history.md
index a175e5b956..a73a1dca4d 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/group/settings/history.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/group/settings/history.md
@@ -11,17 +11,17 @@ assigned for the job group.
-By default, all job groups are set to inherit **Use Default Setting** option from the global level
-(**Settings** > **History**) or a parent job group. See the [History](/docs/accessanalyzer/12.0/admin/settings/history.md)
+By default, Access Analyzer sets all job groups to inherit the **Use Default Setting** option from
+the global level (**Settings** > **History**) or a parent job group. See the [History](/docs/accessanalyzer/12.0/admin/settings/history.md)
topic for additional information.
:::warning
-It is important to understand that some pre-configured jobs require history retention
-while others do not support it. See job group and job descriptions for additional information.
+Some pre-configured jobs require history retention
+while others don't support it. See job group and job descriptions for additional information.
:::
-If the Default Setting is not preferred, select the custom type of retention settings desired below:
+If you don't prefer the Default Setting, select one of the following custom retention settings:
- Data Retention Period
@@ -34,5 +34,5 @@ If the Default Setting is not preferred, select the custom type of retention set
- Retain previous job logs for [number] [time period]
Selecting the **Set all the child objects to inherit these settings** option forces inheritance of
-this setting to all sub-groups and jobs within the job group. When enabled, this option overrides
-any custom settings configured for the child objects.
+this setting to all sub-groups and jobs within the job group. When you enable this option, it
+overrides any custom settings configured for the child objects.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/group/settings/hostlistsassignment.md b/docs/accessanalyzer/12.0/admin/jobs/group/settings/hostlistsassignment.md
index dcc26f9b1b..3bf26f3ee4 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/group/settings/hostlistsassignment.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/group/settings/hostlistsassignment.md
@@ -11,21 +11,21 @@ job group.
-At a top-level job group, there is no host list to be inherited. The **Use Default Settings** option
-is grayed-out. However, a sub-job group can inherit host lists from a parent job group. Host lists
-are configured through the **Host Management** node. See the
+At a top-level job group, there's no host list to inherit. The **Use Default Settings** option
+is grayed-out. However, a sub-job group can inherit host lists from a parent job group. You configure
+host lists through the **Host Management** node. See the
[Host Management](/docs/accessanalyzer/12.0/admin/hostmanagement/overview.md) topic for additional information.
Several pre-defined solutions have default host lists already assigned to the solution, for example
the .Active Directory Inventory Job Group has the Default domain controller assigned at the job
group and inherited to the jobs.
-Select the host lists to be targeted by the job group. The **Filter host lists by** feature scopes
-the list to match the search string provided. At the bottom of the list is an indicator of how many
-hosts lists have been selected out of the total number of hosts lists known to the Access Analyzer
-Console. If a filter has been applied, there is also an indicator of how many host lists matched the
+Select the host lists to target with the job group. The **Filter host lists by** feature scopes
+the list to match the search string provided. At the bottom of the list, an indicator shows how many
+host lists you've selected out of the total number of host lists known to the Access Analyzer
+Console. If you've applied a filter, an indicator also shows how many host lists matched the
search string.
Selecting the **Set all the child objects to inherit these settings** option forces inheritance of
-this setting to all sub-groups and jobs within the job group. When enabled, this option overrides
-any custom settings configured for the child objects.
+this setting to all sub-groups and jobs within the job group. When you enable this option, it
+overrides any custom settings configured for the child objects.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/group/settings/reporting.md b/docs/accessanalyzer/12.0/admin/jobs/group/settings/reporting.md
index bac3782a45..76693487a0 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/group/settings/reporting.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/group/settings/reporting.md
@@ -7,23 +7,23 @@ sidebar_position: 40
# Reporting Node
At the job group level, the **Reporting** node identifies the report publishing and email
-configurations assigned for the job group. By default, all job groups are set to inherit the
-reporting settings, the **Use default setting** option, from the global level (**Settings** >
-**Reporting**), or a parent job group. See the [Reporting](/docs/accessanalyzer/12.0/admin/settings/reporting.md) topic for
+configurations assigned for the job group. By default, Access Analyzer sets all job groups to
+inherit the reporting settings, the **Use default setting** option, from the global level
+(**Settings** > **Reporting**), or a parent job group. See the [Reporting](/docs/accessanalyzer/12.0/admin/settings/reporting.md) topic for
additional information.
:::note
-If the Role Based Access feature is enabled, it also displays a list of all accounts
-granted access to the published reports via the Web Console that are generated by any jobs within
-the job group.
+If you enable the Role Based Access feature, it also displays a list of all accounts
+granted access, via the Web Console, to the published reports that jobs within the job group
+generate.
:::
Checking the **Set all the child objects to inherit these settings** option at the bottom of the
-page forces inheritance of these settings to all sub-groups and jobs within the job group. When
-enabled, this option overrides any custom settings configured for the child objects.
+page forces inheritance of these settings to all sub-groups and jobs within the job group. When you
+enable this option, it overrides any custom settings configured for the child objects.
:::note
The **Set all the child objects to inherit these settings** option has no impact on the
diff --git a/docs/accessanalyzer/12.0/admin/jobs/group/settings/settings.md b/docs/accessanalyzer/12.0/admin/jobs/group/settings/settings.md
index 5efc549bcb..38824429b2 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/group/settings/settings.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/group/settings/settings.md
@@ -6,12 +6,12 @@ sidebar_position: 10
# Job Groups Settings Node
-A job group’s Settings node is where custom configurations can be set and where the host lists are
-assigned to a job group.
+A job group’s Settings node is where you set custom configurations and assign host lists to a job
+group.
-These settings inherit the global settings down by default unless inheritance is broken at a job
+These settings inherit the global settings down by default unless you break inheritance at a job
group or a job level.
- [Connection Node](/docs/accessanalyzer/12.0/admin/jobs/group/settings/connection.md) – Use the default Connection Profile or break inheritance to
@@ -22,7 +22,7 @@ group or a job level.
job group or break inheritance on assigned host lists for this job group
:::note
- Host List Assignments is not a global setting. The pre-configured solutions may
+ Host List Assignments isn't a global setting. The pre-configured solutions may
contain Host List Assignments configured to use Global Default Host Lists, for example All
Domain Controllers. See the
[Default Host Lists](/docs/accessanalyzer/12.0/admin/settings/hostinventory.md#default-host-lists) topic for additional
@@ -33,15 +33,15 @@ group or a job level.
- [Reporting Node](/docs/accessanalyzer/12.0/admin/jobs/group/settings/reporting.md) – Use the default report settings or break inheritance on Published
Report settings, Email settings, and Report role assignment for this job group
- [Storage Node](/docs/accessanalyzer/12.0/admin/jobs/group/settings/storage.md) – Use the default storage profile or break inheritance on where this
- job group's data is stored
+ job group stores its data
-If changes are made, click **Save** to implement the changes. Changes are not implemented unless
-they are saved.
+If you make changes, click **Save** to implement them. Access Analyzer doesn't implement changes
+unless you save them.
-**Host List Assignment** and **Connection** are the two settings that should always be confirmed
+**Host List Assignment** and **Connection** are the two settings you should always confirm
before executing a job group or job when data collection is included. The assigned host lists
-contains the hosts that are targeted by the job’s data collection queries. The assigned Connection
+contain the hosts that the job’s data collection queries target. The assigned Connection
Profile must have the appropriate level of permissions in order for the data collection to be
successful. See the
[Permissions by Data Collector (Matrix)](/docs/accessanalyzer/12.0/admin/datacollector/permissionmatrix.md) topic for
-information on the recommended permissions needed on the targeted hosts in order to collect data.
+information on the recommended permissions needed on the targeted hosts to collect data.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/group/settings/storage.md b/docs/accessanalyzer/12.0/admin/jobs/group/settings/storage.md
index 2a7634cc98..bbfe3f835d 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/group/settings/storage.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/group/settings/storage.md
@@ -7,16 +7,16 @@ sidebar_position: 50
# Storage Node
At the job group level, the Storage node identifies the Storage Profile assigned for the job group.
-All Storage Profiles are created at the global level (**Settings** > **Storage**). See the
+You create all Storage Profiles at the global level (**Settings** > **Storage**). See the
[Storage](/docs/accessanalyzer/12.0/admin/settings/storage/overview.md) topic for additional information.
-By default, all job groups are set to inherit the **Use Default Profile** option from the global
-level or a parent job group. If it is necessary for a job group to send data to a different
+By default, Access Analyzer sets all job groups to inherit the **Use Default Profile** option from
+the global level or a parent job group. If a job group needs to send data to a different
database, the Storage Profile must already exist at the global level. Select the **Use This
-Profile** radio button and choose the non-default Storage Profile from the drop-down menu.
+Profile** radio button and choose the non-default Storage Profile from the dropdown menu.
Selecting the **Set all the child objects to inherit these settings** option forces inheritance of
-this setting to all sub-groups and jobs within the job group. When enabled, this option overrides
-any custom settings configured for the child objects.
+this setting to all sub-groups and jobs within the job group. When you enable this option, it
+overrides any custom settings configured for the child objects.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/instantiate.md b/docs/accessanalyzer/12.0/admin/jobs/instantiate.md
index 68b0231ff9..3bf0d2283b 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/instantiate.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/instantiate.md
@@ -24,12 +24,12 @@ prefix for all job groups. `JOB_` is the prefix for all jobs. Changing the prefi
from the Jobs tree without deleting it.
Instantiating new, external jobs is as easy as copying and pasting the job or job group into this
-location. However, copying an existing job within the Jobs directory is not supported. If the job
+location. However, copying an existing job within the Jobs directory isn't supported. If the job
already exists within the Access Analyzer Console server, copying outside of the console may result
in reporting issues.
:::warning
-Do not use these steps to copy an existing job.
+Don't use these steps to copy an existing job.
:::
@@ -50,7 +50,7 @@ colleague, or other entity, it is most likely in one of two formats:
-- If in archive format, extract the desired content to the Jobs directory
+- If in archive format, extract the content you want to the Jobs directory
- Use the default path or specify a specific path using the browse button (…)
- Select whether to **Show extracted files when complete**. This option is selected by default.
@@ -64,7 +64,7 @@ match that of the jobs or job groups that are already there.
-**Step 4 –** In the Access Analyzer Console, right-click on the **Jobs** node and select **Refresh
+**Step 4 –** In the Access Analyzer Console, right-click the **Jobs** node and select **Refresh
Tree**.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/ad_passwordexpirationnotification.md b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/ad_passwordexpirationnotification.md
index 4eb2f67c7b..4d7895c1ba 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/ad_passwordexpirationnotification.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/ad_passwordexpirationnotification.md
@@ -7,10 +7,10 @@ sidebar_position: 10
# AD_PasswordExpirationNotification Job
The AD_PasswordExpirationNotification Job determines when Active Directory user passwords are about
-to expire and can be configured to send notifications to users prior to password expiration. It is
+to expire and can be configured to send notifications to users before password expiration. It is
available through the Instant Job Library under the Active Directory library. See the
[Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md) section for instructions to add this instant job into the Jobs
-tree. Since this job does not require a host to target, select Local host on the Hosts page of the
+tree. Since this job doesn't require a host to target, select Local host on the Hosts page of the
Instant Job Wizard.
@@ -92,11 +92,11 @@ AD_PasswordExpirationNotification Job produces the following pre-configured repo
Customizable parameters enable Access Analyzer users to set the values used to classify user and
group objects during this job’s analysis. The parameters can be customized and are listed in a
-section at the bottom of the SQL Script Editor. Follow the steps to customize an analysis task’s
-parameters.
+section at the bottom of the SQL Script Editor. To customize an analysis task’s
+parameters:
:::warning
-Do not change the table names or report name to align with a different value supplied
+Don't change the table names or report name to align with a different value supplied
for this parameter. Modifying the table names will result in analysis and report errors downstream.
Only the report title and descriptions can be modified within the report configuration.
:::
@@ -107,21 +107,21 @@ Only the report title and descriptions can be modified within the report configu
| 1. User Password Information | @pswLen | 15 | Number of days left until a password expires, should be set according to an organizations policy. |
The parameters that can be customized are listed in a section at the bottom of the SQL Script
-Editor. Follow the steps to customize an analysis task’s parameters.
+Editor. To customize an analysis task’s parameters:
**Step 1 –** Navigate to the **AD_PasswordExpirationNotification** > **Configure** node and select
**Analysis** to view the analysis tasks.
**Step 2 –** In the Analysis Selection view, select the **1. User Password Information** Analysis
-Task and click on **Analysis Configuration**. The SQL Script Editor opens.
+Task and click **Analysis Configuration**. The SQL Script Editor opens.
**Step 3 –** In the parameters section at the bottom of the editor, find the Value column.
-Double-click on the current value and change as desired.
+Double-click the current value and change as desired.
:::warning
-Do not change any parameters where the Value states **Created during execution**.
+Don't change any parameters where the Value states **Created during execution**.
:::
@@ -131,7 +131,7 @@ The new value will be applied to the next job execution.
## Notification Analysis Task in the AD_PasswordExpirationNotification Job
-The Notification Analysis Task can be used to send a single email to specified recipients containing
+Use the Notification Analysis Task to send a single email to specified recipients containing
a list of all users whose passwords will expire in the specified number of days, that is the users
listed in the PasswordExpirationNotification_ExpiresWithin15Days table. The analysis is enabled by
default. Therefore, when the job is executed the following message is sent to the specified
@@ -141,7 +141,7 @@ recipient, such as the organization’s help desk, with information from the ass
>
> Support Team,
>
-> Heads-up. The following users are facing password expiration in seven days or less:
+> Heads-up. The following users are facing password expiration in seven days or less:
>
>**[ -- Password for [User] ([NTAccount]) expires in [DaysUntilExpiration] days]**
>
@@ -150,22 +150,22 @@ recipient, such as the organization’s help desk, with information from the ass
> Netwrix
:::warning
-Do not modify the tags, highlighted in bold text above.
+Don't modify the tags, highlighted in bold text in the preceding message.
:::
The Subject or message body can be modified, for example to replace `Netwrix` with the
-organization’s name. Follow the steps to configure the 5. Help Desk Notification Analysis Task.
+organization’s name. To configure the 5. Help Desk Notification Analysis Task:
**Step 1 –** Navigate to the **AD_PasswordExpirationNotification** > **Configure** node and select
**Analysis** to view the Analysis tasks.
**Step 2 –** In the Analysis Selection view, select the **5. Help Desk Notification Analysis Task**
-and click on **Analysis Configuration**. The Notification Data Analysis Module opens.
+and click **Analysis Configuration**. The Notification Data Analysis Module opens.
-**Step 3 –** Use the **Next** button to navigate to the SMTP properties page. Do not make changes to
+**Step 3 –** Use the **Next** button to navigate to the SMTP properties page. Don't make changes to
the preceding pages. The email configuration takes place on the SMTP page. Provide the recipients’
email addresses, Message Subject, and add the notification email content.
@@ -187,7 +187,7 @@ In the Message section, the **Subject** should be configured. Then set the email
box as desired.
**Step 4 –** To save these configuration changes, use the **Next** button to navigate to the Summary
-page. Do not make changes to any other pages. Click **Finish**. The Notification Data Analysis
+page. Don't make changes to any other pages. Click **Finish**. The Notification Data Analysis
Module window closes.
@@ -203,7 +203,7 @@ is executed.
The 1. User Notification Action Task uses the SendMail Action Module to send users notification of
password expiration. It targets the SMTP Address Column of the users whose passwords are going to
-expire within the desired number of days, that is the users listed in the
+expire within the number of days you set, that is the users listed in the
PasswordExpirationNotification_ExpiresWithin15Days_UserNotifications table. The action is enabled by
default. Therefore, when the job is executed the following message is sent to all users in the
associated table:
@@ -212,8 +212,8 @@ associated table:
>
> Hello **[User]**,
>
-> The password for the account **[NTAccount]** expires on **[ExpirationDate]**. Please change the
-> password prior to the expiration date. If account profiles are used on mobile devices, please
+> The password for the account **[NTAccount]** expires on **[ExpirationDate]**. Change the
+> password before the expiration date. If account profiles are used on mobile devices,
> remember to update the password on each device used.
>
> Thank you,
@@ -221,14 +221,14 @@ associated table:
> Netwrix
:::warning
-Do not change the recipient for the action task. While the tags can be moved, do not
-remove or modify the tags, which are highlighted in bold text above.
+Don't change the recipient for the action task. While the tags can be moved, don't
+remove or modify the tags, which are highlighted in bold text in the preceding message.
:::
The subject or message body can be modified, for example to replace `Netwrix` with the
-organization’s name. Follow the steps to modify the Subject or message body within the 1. User
-Notification Action Task.
+organization’s name. To modify the Subject or message body within the 1. User
+Notification Action Task:
:::note
It is necessary for the
@@ -244,7 +244,7 @@ before this action task can be modified.
on **Action Properties** to view the actions.
:::warning
-Do not modify the action task properties.
+Don't modify the action task properties.
:::
diff --git a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/ex_registerazureappauth.md b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/ex_registerazureappauth.md
index adda8b9628..59d41146cd 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/ex_registerazureappauth.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/ex_registerazureappauth.md
@@ -22,7 +22,7 @@ authentication and provision appropriate permissions for Exchange Online scans.
- Azure AD PowerShell module installed on targeted hosts
:::note
- If the module is not already installed, the job will attempt to install it.
+ If the module isn't already installed, the job will attempt to install it.
:::
@@ -49,7 +49,7 @@ authentication and provision appropriate permissions for Exchange Online scans.
## Using the EX_RegisterAzureAppAuth Job
-Follow the steps to configure and run the EX_RegisterAzureAppAuth Job.
+To configure and run the EX_RegisterAzureAppAuth Job:
**Step 1 –** In Access Analyzer navigate to the Exchange Job Group (or any other Job Group you wish
to place the EX_RegistureAzureApp job into).
@@ -72,7 +72,7 @@ use for the Microsoft Entra ID application. Click **Save**.
**Step 6 –** (Optional) For non-standard tenant types, edit the **Azure Environment Name...** option
to provide the full environment name. For a standard tenant, leave this option blank.
-- For example, if leveraging a government (or GCC) tenant, enter **AzureGovernment**
+- For example, if using a government (or GCC) tenant, enter **AzureGovernment**
- Additional options include: AzureChinaCloud, AzureCloud, AzureGermanyCloud, AzurePPE,
AzureGovernment2, and AzureGovernment3
@@ -86,9 +86,9 @@ The job is now ready to be run.
Log-in as a Global Administrator, and grant administrator consent to the Application's configured
API Permissions.
-- If this login attempt fails or you close the browser, you will need to login to Microsoft Entra ID
+- If this login attempt fails or you close the browser, you will need to log in to Microsoft Entra ID
as a Global Administrator and navigate to the Application's API Permissions to grant Admin Consent
- before the Application can be used for Exchange scans in Access Analyzer.
+ before you can use the Application for Exchange scans in Access Analyzer.
The Microsoft Entra ID application is now provisioned with the necessary permissions for Exchange
Online scans. There will be a new Connection Profile for this Application. Restart the Access
diff --git a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/fs_migrateschema.md b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/fs_migrateschema.md
index 309f54c69c..21d267ce7a 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/fs_migrateschema.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/fs_migrateschema.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# FS_MigrateSchema Job
-The FS_Migrate_Schema Job migrates the schema in order to support the use of 64-bit ResourceID's
+The FS_Migrate_Schema Job migrates the schema to support the use of 64-bit ResourceID's
without affecting data. It is available through the Instant Job Library under the File System
library. See the [Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md) topic for instructions to add this instant job
into the Jobs tree.
@@ -24,7 +24,7 @@ Runtime Details:
- Multi-console Support – Not supported
- Additional Notes – None
-The FS_Migrate Schema Job migrates the schema in order to support the use of 64-bit ResourceID's
+The FS_Migrate Schema Job migrates the schema to support the use of 64-bit ResourceID's
without affecting data.
## Analysis Tasks for the FS_MigrateSchema Job
@@ -33,7 +33,7 @@ Navigate to the **Jobs** > **FS_MigrateSchema** > **Configure** node and select
the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -42,23 +42,23 @@ preconfigured for this job.
The default analysis tasks are:
-- 1.Migrate Resources – Migrates the SA_FSAA_Resources table to leverage 64-bit IDs
-- 2.Migrate UnixRights – Migrates the SA_FSAA_UnixRights table to leverage 64-bit IDs
-- 3.Migrate Gates – Migrates the SA_Gates table to leverage 64-bit IDs
-- 4.Migrate GatesProxy – Migrates the SA_FSAA_GatesProxy table to leverage 64-bit IDs
-- 5.Migrate Exceptions – Migrates the SA_FSAA_Exceptions table to leverage 64-bit IDs
-- 6.Migrate ProbableOwners – Migrates the SA_FSAA_ProbableOwners table to leverage 64-bit IDs
-- 7.Migrate FileSizes – Migrates the SA_FSAA_FileSizes table to leverage 64-bit IDs
-- 8.Migrate FileTypes – Migrates the SA_FSAA_FileTypes table to leverage 64-bit IDs
-- 9.Migrate FileAges – Migrates the SA_FSAA_FileAges table to leverage 64-bit IDs
-- 10.Migrate FileTags – Migrates the SA_FSAA_FileTags table to leverage 64-bit IDs
-- 11.Migrate DFS Links – Migrates the SA_FSDFS_Links table to leverage 64-bit IDs
-- 12.Migrate DLP Matches – Migrates the SA_FSDLP_Matches table to leverage 64-bit IDs
-- 13.Migrate DLP MatchHits – Migrates the SA_FSDLP_MatchHits table to leverage 64-bit IDs
+- 1.Migrate Resources – Migrates the SA_FSAA_Resources table to use 64-bit IDs
+- 2.Migrate UnixRights – Migrates the SA_FSAA_UnixRights table to use 64-bit IDs
+- 3.Migrate Gates – Migrates the SA_Gates table to use 64-bit IDs
+- 4.Migrate GatesProxy – Migrates the SA_FSAA_GatesProxy table to use 64-bit IDs
+- 5.Migrate Exceptions – Migrates the SA_FSAA_Exceptions table to use 64-bit IDs
+- 6.Migrate ProbableOwners – Migrates the SA_FSAA_ProbableOwners table to use 64-bit IDs
+- 7.Migrate FileSizes – Migrates the SA_FSAA_FileSizes table to use 64-bit IDs
+- 8.Migrate FileTypes – Migrates the SA_FSAA_FileTypes table to use 64-bit IDs
+- 9.Migrate FileAges – Migrates the SA_FSAA_FileAges table to use 64-bit IDs
+- 10.Migrate FileTags – Migrates the SA_FSAA_FileTags table to use 64-bit IDs
+- 11.Migrate DFS Links – Migrates the SA_FSDFS_Links table to use 64-bit IDs
+- 12.Migrate DLP Matches – Migrates the SA_FSDLP_Matches table to use 64-bit IDs
+- 13.Migrate DLP MatchHits – Migrates the SA_FSDLP_MatchHits table to use 64-bit IDs
- 14.Migrate DLP MatchHits Subject Profile – Migrates the SA_FSDLP_MatchHits_SubjectProfile table to
- leverage 64-bit IDs
-- 15.Migrate FSAC ActivityEvents – Migrates the SA_FSAC_ActivityEvents table to leverage 64-bit IDs
-- 16.Migrate DailyActivity – Migrates the SA_FSAC_DailyActivity table to leverage 64-bit IDs
-- 17.Migrate FSAC RenameTargets – Migrates the SA_FSAC_RenameTargets table to leverage 64-bit IDs
-- 18.Migrate FSAC Exceptions – Migrates the SA_FSAC_Exceptions table to leverage 64-bit IDs
+ use 64-bit IDs
+- 15.Migrate FSAC ActivityEvents – Migrates the SA_FSAC_ActivityEvents table to use 64-bit IDs
+- 16.Migrate DailyActivity – Migrates the SA_FSAC_DailyActivity table to use 64-bit IDs
+- 17.Migrate FSAC RenameTargets – Migrates the SA_FSAC_RenameTargets table to use 64-bit IDs
+- 18.Migrate FSAC Exceptions – Migrates the SA_FSAC_Exceptions table to use 64-bit IDs
- 19.Refresh Views – Updates viewable metadata
diff --git a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md
index 9845375b55..40bba6673e 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md
@@ -12,12 +12,12 @@ solve a wide range of problems within each category. Instant jobs help solve spe
instant solutions available align to an organization’s license key. See
the[Solutions](/docs/accessanalyzer/12.0/solutions/overview.md) topic for additional information.
-Follow the steps to install an instant solution or an instant job with the Instant Job Wizard.
+To install an instant solution or an instant job with the Instant Job Wizard:
-**Step 1 –** Select the Jobs tree (for an instant solution) or the desired job group (for an instant
-job), right-click on the node, and select **Add Instant Job**.
+**Step 1 –** Select the Jobs tree (for an instant solution) or the job group you want (for an instant
+job), right-click the node, and select **Add Instant Job**.
@@ -30,12 +30,12 @@ category, or click the plus icon (+) to expand a category group.
-**Step 4 –** Select the desired instant solution or job. To select multiple instant solutions or
+**Step 4 –** Select the instant solution or job you want. To select multiple instant solutions or
jobs, press the Windows **Ctrl** key and select the items to install. Click **Next**.
-**Step 5 –** Some of the Library selections add a Host Assignment page. If this page does not
+**Step 5 –** Some of the Library selections add a Host Assignment page. If this page doesn't
appear, skip to Step 7. If the page does appear, select either the **Use default settings (Inherit
from the parent group, if any)** or **Specify individual hosts or hosts lists** option. If the first
option is selected, skip to Step 7. If the second option is selected, click **Next** to go to the
@@ -46,7 +46,7 @@ Host Lists and Individual Hosts wizard pages.
| *Host Lists page* | *Individual Hosts page* |
**Step 6 –** Some of the Library selections add a Host Lists, and Individual Hosts page. If these
-pages do not appear with the selection, skip to Step 7. If the pages do appear, check the host list
+pages don't appear with the selection, skip to Step 7. If the pages do appear, check the host list
to be assigned to the job group or job. Alternatively enter hosts manually. Then click **Next**.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/sas_executionstatistics.md b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/sas_executionstatistics.md
index a4f062d022..0196cf2c30 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/sas_executionstatistics.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/sas_executionstatistics.md
@@ -10,7 +10,7 @@ The SAS_ExecutionStatistics Job tracks historical performance of Access Analyzer
functions and highlights when a particular task takes an abnormal length of time to execute. It is
available through the Instant Job Library under the Access Analyzer Utilities library. See the
[Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md) section for instructions to add this instant job into the Jobs
-tree. Since this job does not require a host to target, select Local host on the Hosts page of the
+tree. Since this job doesn't require a host to target, select Local host on the Hosts page of the
Instant Job Wizard.
The job is dependent upon the Job Statistics Retention configuration in the **Settings** >
@@ -39,7 +39,7 @@ Navigate to the **Jobs** > **SAS_ExecutionStatistics** > **Configure** node and
to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/sp_registerazureappauth.md b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/sp_registerazureappauth.md
index 868b3201ec..2c91c5ad23 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/sp_registerazureappauth.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/sp_registerazureappauth.md
@@ -19,10 +19,10 @@ authentication and provision appropriate permissions for SharePoint Online scans
## Instantiate the SP_RegisterAzureAppAuth Job.
-Follow the steps to instantiate the SP_RegisterAzureAppAuth Job.
+To instantiate the SP_RegisterAzureAppAuth Job:
**Step 1 –** In Access Analyzer navigate to the SharePoint Job Group (or any other Job Group you
-wish to place the SP_RegistureAzureApp job into).
+want to place the SP_RegistureAzureApp job into).
**Step 2 –** Click **Add Instant Job** to open the Instant Job Wizard.
@@ -41,8 +41,8 @@ application (for example, `myorg.onmicrosoft.com`). Click **Save**. The job is n
After the job successfully runs it will open a browser window to Microsoft Entra ID that, when
logged-in as a Global Administrator, allows the user to grant administrator consent to the
Application's configured API Permissions. If the login attempt fails, or the user closes the
-browser, they will need to login to Microsoft Entra ID as a Global Administrator and navigate to the
-Application's API Permissions to grant Admin Consent before the Application can be used for
+browser, they will need to log in to Microsoft Entra ID as a Global Administrator and navigate to the
+Application's API Permissions to grant Admin Consent before you can use the Application for
SharePoint scans in Access Analyzer.
**Additional Considerations**
diff --git a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/sp_removehost.md b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/sp_removehost.md
index 025bf16c85..4867ddd9d1 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/instantjobs/sp_removehost.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/instantjobs/sp_removehost.md
@@ -30,7 +30,7 @@ Navigate to the **Jobs** > **SP_RemoveHost** > **Configure** node and select **A
the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -39,4 +39,4 @@ preconfigured for this job.
The default analysis tasks are:
-- Remove Host(s) — Remove Scanned Hosts from Tier 1
+- Remove Hosts — Remove Scanned Hosts from Tier 1
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/configure/actions.md b/docs/accessanalyzer/12.0/admin/jobs/job/configure/actions.md
index 4586caaa82..a388902750 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/configure/actions.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/configure/actions.md
@@ -49,7 +49,7 @@ The Actions section at the top has five options:
- Execute Action – Opens the Action Execution window and starts executing the selected action
- - Does not require an action task to be checked, only selected
+ - Doesn't require an action task to be checked, only selected
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md b/docs/accessanalyzer/12.0/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md
index bee592a9bf..5d4840920d 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md
@@ -7,11 +7,11 @@ sidebar_position: 10
# Configure the Customizable Parameters in an Analysis Task
The parameters that can be customized and are listed in a section at the bottom of the SQL Script
-Editor. Follow the steps to customize an analysis task’s parameters.
+Editor. To customize an analysis task’s parameters:
**Step 1 –** Navigate to the Job’s **Configure** node and select **Analysis**.
-**Step 2 –** In the Analysis Selection view, select the desired analysis task and click **Analysis
+**Step 2 –** In the Analysis Selection view, select the analysis task you want and click **Analysis
Configuration**. The SQL Script Editor opens.
**Step 3 –** At the top of the SQL Script Editor, select **Parameters**.
@@ -27,11 +27,11 @@ based on the Job.
**Step 4 –** In the parameters section at the bottom of the editor, find the Value column.
:::warning
-Do not change any parameters where the Value states **Created during execution**.
+Don't change any parameters where the Value states **Created during execution**.
:::
-- Double-click on the customizable value and change as desired
+- Double-click the customizable value and change as desired
**Step 5 –** Click **Save and Close** to finalize the customization and close the SQL Script Editor.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/configure/hosts.md b/docs/accessanalyzer/12.0/admin/jobs/job/configure/hosts.md
index 9ab7d66701..b98c4ed22b 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/configure/hosts.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/configure/hosts.md
@@ -20,7 +20,7 @@ it triggers a host inventory query according to the global settings. The host wi
any individual host lists. See the [Manually Add Hosts to a Job](#manually-add-hosts-to-a-job) topic
for additional information.
-Click **Save** to apply any changes to the host selection. Changes are not implemented unless they
+Click **Save** to apply any changes to the host selection. Changes aren't implemented unless they
are saved.
## Manually Add Hosts to a Job
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/configure/queries.md b/docs/accessanalyzer/12.0/admin/jobs/job/configure/queries.md
index 2fb899876f..110d1715f0 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/configure/queries.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/configure/queries.md
@@ -15,21 +15,21 @@ chart with recommended permissions per data collector.
-The Query Selection view lists all queries for the selected job. Though it is possible to have
-multiple queries in a single job, it is not usually recommended. The listed information includes:
+The Query Selection view lists all queries for the selected job. Though a single job can have
+multiple queries, it isn't usually recommended. The listed information includes:
- Name – Name of the query (as provided by the creator of the query)
- Source – Name of the Access Analyzer data collector
- Table – Name of the Native Data table
-- Enumerates – Whether or not the data collector will return enumerated data, or multiple lines of
+- Enumerates – Whether the data collector will return enumerated data, or multiple lines of
data per target host
- If **Yes**, only one query can write to a single table
- If **No**, then multiple related queries can write to a single table
- Properties – Number of the properties to be returned
- Filters – Number of in-line filters applied to the data being returned by the query
-- Script – Whether or not a VB Script was added to the query
+- Script – Whether a VB Script was added to the query
- If **Yes**, a VB Script was added to query execution
- - If **No**, a VB Script was not added to query execution
+ - If **No**, a VB Script wasn't added to query execution
- Description – Description of the query (as provided by the creator of the query)
## Tables
@@ -46,8 +46,8 @@ The Tables section at the top has three options:
database table if it has already been created. This action does require confirmation.
:::warning
- Do not delete the last table in a job’s Query Selection view. Doing so will also
- delete the Messages table. In order to delete the last table, it is necessary to delete the job.
+ Don't delete the last table in a job’s Query Selection view. Doing so will also
+ delete the Messages table. To delete the last table, delete the job.
:::
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/configure/reports.md b/docs/accessanalyzer/12.0/admin/jobs/job/configure/reports.md
index 9fe360ef38..b07c189740 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/configure/reports.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/configure/reports.md
@@ -15,7 +15,7 @@ related to configuring reports. The options at the top of the Reports view are:
- Properties – Opens the [Job Properties](/docs/accessanalyzer/12.0/admin/jobs/job/properties/overview.md) page for the job that the
report is for
-- Run Now – Runs the currently selected job that the report is for
+- Run Now – Runs the selected job that the report is for
- Open Folder – Opens the Report’s folder location with supporting files in the Windows Explorer
- View Log – Opens the log for the job that the report is for
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/create.md b/docs/accessanalyzer/12.0/admin/jobs/job/create.md
index 5560b52aa3..40532a0546 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/create.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/create.md
@@ -6,11 +6,11 @@ sidebar_position: 50
# Create a New Job
-Follow the steps to create a new job.
+To create a new job:
-**Step 1 –** Select the Jobs tree or the desired job group to add the new job to. Right-click and
+**Step 1 –** Select the Jobs tree or the job group you want to add the new job to. Right-click and
select **Create Job**.
@@ -19,7 +19,7 @@ select **Create Job**.
considerations for naming conventions:
:::warning
-Do not end a job name with a space.
+Don't end a job name with a space.
:::
@@ -30,7 +30,7 @@ Do not end a job name with a space.
article for limitations.
- Jobs in a group are run alphanumerically
- When possible, keep names short to avoid report path errors caused by Microsoft’s maximum path
- length. See the Microsoft article referenced above.
+ length. See the Microsoft Naming Conventions article referenced previously.
The new job is now ready to be configured. See the
[Data Collectors](/docs/accessanalyzer/12.0/admin/datacollector/overview.md), [Analysis Modules](/docs/accessanalyzer/12.0/admin/analysis/overview.md),
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/disableenable.md b/docs/accessanalyzer/12.0/admin/jobs/job/disableenable.md
index e9c666f844..fd58914fb3 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/disableenable.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/disableenable.md
@@ -6,9 +6,9 @@ sidebar_position: 60
# Disable or Enable a Job
-Job groups may contain individual jobs that should not be run when the entire job group is run. Some
+Job groups may contain individual jobs that shouldn't be run when the entire job group is run. Some
job groups also contain jobs that can optionally be run separately from the rest of the job group.
-Individual jobs can be disabled or enabled at the job group or job level. Disabled jobs do not
+Individual jobs can be disabled or enabled at the job group or job level. Disabled jobs don't
execute when the parent job group is run.
If the role based access feature is enabled, the ability to enable and disable jobs is limited by
@@ -17,21 +17,21 @@ for additional information.
## Disable a Job
-Jobs can be disabled from the Jobs tree. Disabled jobs cannot be run manually, through a scheduled
-task, or executed as part of the job group. Follow the steps to disable a job.
+Jobs can be disabled from the Jobs tree. Disabled jobs can't be run manually, through a scheduled
+task, or executed as part of the job group. To disable a job:
**Step 1 –** Select a job group or job.
:::note
When disabling jobs at the job group level, all jobs contained in the job group are
-disabled, but the job group is not disabled. Any additional jobs added to that job group at a later
+disabled, but the job group isn't disabled. Any additional jobs added to that job group at a later
time will be enabled by default.
:::
-**Step 2 –** Right-click on the job group or job and select **Disable Job(s)** from the menu.
+**Step 2 –** Right-click the job group or job and select **Disable Jobs** from the menu.
@@ -43,7 +43,7 @@ Disabled jobs are grayed out, and a red cross is displayed in front of the job.
A yellow banner also notifies users that a job is disabled in the Job’s Description page.
Additionally, if a disabled job is run, a warning message appears in the Messages table stating:
-`[UserName] requested [JobName] to run but it is in a disabled state`. Job statistics also do not
+`[UserName] requested [JobName] to run but it is in a disabled state`. Job statistics also don't
display on the job’s description page.
## Enable a Job
@@ -56,6 +56,6 @@ group to enable all of the disabled jobs.
-**Step 2 –** Right-click on the job group or job and select **Enable Job(s)** from the menu.
+**Step 2 –** Right-click the job group or job and select **Enable Jobs** from the menu.
The job is now enabled. If a job group was selected, all the jobs in the group are now enabled.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/overview.md b/docs/accessanalyzer/12.0/admin/jobs/job/overview.md
index 00e7272390..bb88adba8e 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/overview.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/overview.md
@@ -21,7 +21,7 @@ structure to run those jobs together in the proper order.
:::
-Jobs do not have a Settings node like a job group. Job Properties provide the option to break
+Jobs don't have a Settings node like a job group. Job Properties provide the option to break
inheritance on global or job group settings. See the [Job Properties](/docs/accessanalyzer/12.0/admin/jobs/job/properties/overview.md) topic
for additional information.
@@ -42,7 +42,7 @@ the Web Console.
## Job Description Page
The Job Description page displays shortcuts, links, and important information on the job. The Job
-Page allows users to view and modify common job configurations, such as Connection and Storage
+Page lets users view and modify common job configurations, such as Connection and Storage
profiles, job properties, SQL analysis parameters, and PowerShell parameters. Depending on the type
of job, the description page will appear different and display information specific to the job
selected.
@@ -88,7 +88,7 @@ information:
- Inherited settings – Job settings can be applied directly or inherited from a parent job group or
even the General Settings level. See the
[Jobs with Inherited Settings](#jobs-with-inherited-settings) topic for additional information.
-- Reports – Displays a list of reports that are generated by this job
+- Reports – Displays a list of reports that this job generates
- Results – Displays a list of data tables and views created and populated by the job
- Configuration - If applicable, configure parameters for the job's analysis tasks
@@ -103,7 +103,7 @@ information:
- Graph – Displays a line graph that has information for the last five times the job was executed
-Prior to running any job or job group, ensure the following have been properly configured:
+Before running any job or job group, ensure the following have been properly configured:
- Queries, Analysis, Actions, and Reports are configured as desired
- If collecting data, at least one host list has been assigned
@@ -121,7 +121,7 @@ under the job description:
-In the example above, the **Assigned 1 Host List** setting is applied directly to the job. Other
+In the preceding example, the **Assigned 1 Host List** setting is applied directly to the job. Other
settings are inherited from the parent job group. Clicking the **Show inherited settings** button
opens this list of the inherited settings.
@@ -142,7 +142,7 @@ The following settings can be inherited from a parent:
If a job has analysis parameters that can be customized, those parameters can be configured in the
Configuration section of the Job Description Page.
-Follow the steps to configure customizable parameters using the Configuration option on the Job
+To configure customizable parameters using the Configuration option on the Job
Description Page:
**Step 1 –** Navigate to the **Jobs > [Job Group] > [Job]** node. If the job has customizable
@@ -150,7 +150,7 @@ parameters, they will be located under Configuration in the job's Overview secti
-**Step 2 –** Click on a parameter to open the Parameter Configuration window.
+**Step 2 –** Click a parameter to open the Parameter Configuration window.
:::note
To view a tool-tip that contains information about the Variable Name and the Task Name
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/properties/autoretry.md b/docs/accessanalyzer/12.0/admin/jobs/job/properties/autoretry.md
index 106e4c1305..2805961a40 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/properties/autoretry.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/properties/autoretry.md
@@ -11,7 +11,7 @@ the selected host status values: Offline, Failed, Errors, and Warnings.
-Check the desired Host Status values to generate a retry, and then configure the Refresh Data and
+Check the Host Status values you want to generate a retry, and then configure the Refresh Data and
Retry Options settings. Finally, enter a User name (domain\user) and Password in the Scheduler
Authentication section.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/properties/connection.md b/docs/accessanalyzer/12.0/admin/jobs/job/properties/connection.md
index d327878d46..2fd0b368e6 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/properties/connection.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/properties/connection.md
@@ -21,7 +21,7 @@ is where the Connection Profile should be configured. If the host list is set un
-Select the desired option to identify the required Connection Profile for the job. See the
+Select the option you want to identify the required Connection Profile for the job. See the
[Connection Node](/docs/accessanalyzer/12.0/admin/jobs/group/settings/connection.md) topic for additional information for the three
connection options.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/properties/general.md b/docs/accessanalyzer/12.0/admin/jobs/job/properties/general.md
index df8da9c2cd..1f0845ae9e 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/properties/general.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/properties/general.md
@@ -15,12 +15,13 @@ The following options are available:
- Job Name
- Description
- Log Level – Indicates the job log level, which can be inherited from the global **Settings** >
- **Application** log level or customized here. See below for additional information.
+ **Application** log level or customized here. See the [Log Level](#log-level) topic for additional
+ information.
- Write CSV Files To Job Output Directory – Exports the native data table created by a query to a
CSV file in the job’s output directory. If there are multiple tables in the job, this option
creates one file per table.
- Timeout [value] minutes – Job’s thread timeout value
-- Command – Provides the ability to enter a command that will be executed from the command line upon
+- Command – lets you enter a command that will be executed from the command line upon
job completion
## Log Level
@@ -30,7 +31,7 @@ The log level feature includes the following options:
- Use global setting – use the Application log level feature, configured at the global level.
:::note
- By selecting the another option from the drop-down list, you break inheritance for
+ By selecting the another option from the dropdown list, you break inheritance for
this job.
:::
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/properties/history.md b/docs/accessanalyzer/12.0/admin/jobs/job/properties/history.md
index 1517e071db..eaef25f648 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/properties/history.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/properties/history.md
@@ -14,8 +14,8 @@ broken inheritance at a job group level, or to configure settings just for this
By default, all jobs are set to inherit the Data Retention Period and Log Retention Period settings,
the **Use Default Setting** option. Deselect the **Use Default Settings** option to configure custom
-settings for the job. Then provide the desired Data Retention Period and Log Retention Period
-settings. See the [History](/docs/accessanalyzer/12.0/admin/settings/history.md) topic for additional information.
+settings for the job. Then provide the Data Retention Period and Log Retention Period
+settings you want. See the [History](/docs/accessanalyzer/12.0/admin/settings/history.md) topic for additional information.
Click **OK** to save configuration changes and close the Job Properties window. Click **Cancel** if
no changes were made.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/properties/performance.md b/docs/accessanalyzer/12.0/admin/jobs/job/properties/performance.md
index 1938ef7c2e..89ec4242a8 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/properties/performance.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/properties/performance.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Performance Tab
-The Performance tab provides options that can be used to improve job performance and runtime.
+The Performance tab provides options you can use to improve job performance and runtime.
@@ -14,12 +14,12 @@ Adjust the following settings by sliding the needle up and down the line:
- Concurrent Worker Threads – The number of worker threads selected equals the number of hosts being
queried concurrently. If needed, this value can be increased.
-- Skip Hosts that do not respond to PING – Selected by default. Deselect if a target host has been
+- Skip Hosts that don't respond to PING – Selected by default. Deselect if a target host has been
configured to not respond to PING requests, allowing Access Analyzer to scan the target host
without a PING response.
:::note
- In most cases, it is not recommend to deselect this option, as it causes the job to
+ In most cases, it isn't recommend to deselect this option, as it causes the job to
continue querying offline hosts until the job timeout value is reached, set by default to 20
minutes.
:::
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/properties/reportroles.md b/docs/accessanalyzer/12.0/admin/jobs/job/properties/reportroles.md
index d57ec36927..129dd62921 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/properties/reportroles.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/properties/reportroles.md
@@ -14,15 +14,15 @@ for additional information.
-On the Report Roles tab, report role inheritance cannot be broken. Access to reports is inherited
+On the Report Roles tab, report role inheritance can't be broken. Access to reports is inherited
from the global level to job groups to jobs to report configuration. All user roles configured at
the global level (**Settings** > **Roles**) are inherited down to all reports. Only the Global
-Options Administrator, the Access Administrator, and the Host Management Administrator do not have
+Options Administrator, the Access Administrator, and the Host Management Administrator don't have
access to reports.
The **Include Report Viewers from this object's parent** option can be unchecked to automatically
remove any user with the Report Viewer role inherited from a parent object to the job. Remember,
-this does not apply to global inheritance.
+this doesn't apply to global inheritance.
Additional accounts can be added with the Report Viewer role at the job level and inherited down to
all reports generated by the job. Click **Add Report Viewer** to open the Select User or Group
@@ -36,7 +36,7 @@ The table displays the following information:
- Type – Account type (user or group)
- Role – Role assigned to account which grants access to reports
- Inherited From – Indicates the level at which the account was granted access to reports. Remember,
- global inheritance cannot be broken.
+ global inheritance can't be broken.
Click **OK** to save configuration changes and close the Job Properties window. Click **Cancel** if
no changes were made.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/properties/reportsettings.md b/docs/accessanalyzer/12.0/admin/jobs/job/properties/reportsettings.md
index a55cb9a39c..4d2558b6f9 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/properties/reportsettings.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/properties/reportsettings.md
@@ -13,9 +13,9 @@ this job.
-Use the Publish Options drop-down menu to customize the publish setting for the job. To configure
+Use the Publish Options dropdown menu to customize the publish setting for the job. To configure
custom Email settings for the job, select the **Use These Email Settings** option and then provide
-the desired Email information. Multiple email addresses can be input by adding a semicolon (;) and
+the Email information you want. Multiple email addresses can be input by adding a semicolon (;) and
space between entries. See the [Reporting Node](/docs/accessanalyzer/12.0/admin/jobs/group/settings/reporting.md) topic for additional
information on the Publish and Email options.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/properties/storage.md b/docs/accessanalyzer/12.0/admin/jobs/job/properties/storage.md
index 97cbf195e0..3e32e563f8 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/properties/storage.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/properties/storage.md
@@ -14,7 +14,7 @@ group level, or to configure settings just for this job.
By default, all jobs are set to inherit the storage setting, the **Use Default** option. To
configure a different profile for the job, select the **Use This Profile** option and select the
-desired Storage Profile from the drop-down menu. Storage Profiles can only be configured at the
+desired Storage Profile from the dropdown menu. Storage Profiles can only be configured at the
**Settings** > **Storage** node. See the [Storage](/docs/accessanalyzer/12.0/admin/settings/storage/overview.md) topic for
additional information.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/results.md b/docs/accessanalyzer/12.0/admin/jobs/job/results.md
index bfbe385e54..a46966f1eb 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/results.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/results.md
@@ -23,7 +23,7 @@ Every job generates a native data table when executed, which appears at the top
The native data table, or raw data table, is produced by query execution. It contains all raw data
collected by the scan. It is often named DEFAULT, but may have another name that is set during query
configuration. If no query is executed by the job, the DEFAULT table is listed as a placeholder only
-and will be empty (0 rows). It is possible to have multiple queries in the same job, though not
+and will be empty (0 rows). A job can have multiple queries, though not
recommended. These queries could write to the same native data table, or each query could write to
its own native data table. If multiple native data tables are being generated by one job, they are
listed in alphanumeric order at the top of the Results node list.
diff --git a/docs/accessanalyzer/12.0/admin/jobs/job/status.md b/docs/accessanalyzer/12.0/admin/jobs/job/status.md
index 09b32fbd35..417bee63b2 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/job/status.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/job/status.md
@@ -35,7 +35,7 @@ The Status node tables are:
execution of the job. For example, a frequently generated message is
`WARNING: No Host found for processing`.
- - If this message is generated by an analysis or reporting job, then there is no problem as that
- type of job does not need a host list assigned
- - However, if this message is generated by a job running a data collection query, this warning
+ - If an analysis or reporting job generates this message, then there is no problem as that
+ type of job doesn't need a host list assigned
+ - However, if a job running a data collection query generates this message, this warning
would explain why the native data table is empty
diff --git a/docs/accessanalyzer/12.0/admin/jobs/overview.md b/docs/accessanalyzer/12.0/admin/jobs/overview.md
index ecaa2840a6..049f8fbf2d 100644
--- a/docs/accessanalyzer/12.0/admin/jobs/overview.md
+++ b/docs/accessanalyzer/12.0/admin/jobs/overview.md
@@ -69,14 +69,14 @@ jobs can be enabled to track changes to configuration settings. When enabled, co
are tracked in change logs stored within the job folder. Changes can also be viewed within this
window.
-Remember, custom jobs are not shipped with Access Analyzer but instead user created.
+Remember, custom jobs aren't shipped with Access Analyzer but instead user created.
The Changes window opens from the **Changes** option in the right-click menu from the selected Jobs
tree, job group, or job node.
-Select **Enabled** from the drop-down menu in the upper-left corner to turn on change tracking of
+Select **Enabled** from the dropdown menu in the upper-left corner to turn on change tracking of
configuration settings. Select a modification from the table and click **Undo** to revert the
change.
@@ -110,7 +110,7 @@ the Access Analyzer pop-up window to confirm the merge.
Changes between releases are tracked. Only jobs that are locked can be upgraded.
:::note
-Jobs that are included in Access Analyzer are locked and changes cannot be made to those
+Jobs that are included in Access Analyzer are locked and changes can't be made to those
jobs.
:::
diff --git a/docs/accessanalyzer/12.0/admin/maintenance/backuprecovery.md b/docs/accessanalyzer/12.0/admin/maintenance/backuprecovery.md
index 795d536ed0..6b0e4b56d8 100644
--- a/docs/accessanalyzer/12.0/admin/maintenance/backuprecovery.md
+++ b/docs/accessanalyzer/12.0/admin/maintenance/backuprecovery.md
@@ -6,20 +6,20 @@ sidebar_position: 30
# Backup and Recovery
-For data recovery purposes, the Access Analyzer does not need a complete image back up of the Access
+For data recovery purposes, the Access Analyzer doesn't need a complete image back up of the Access
Analyzer Console server. Rather a standard file level back up of a few key components is all that is
necessary. This document contains a step-by-step guide for back up and recovery. The choice of back
up utility is left to the Access Analyzer user.
:::note
-This does not cover back up of the Access Analyzer database.
+This doesn't cover back up of the Access Analyzer database.
:::
## Steps to Back Up the Console Server
-Follow these steps to back up the key components necessary for data recovery of the Access Analyzer
-Console server.
+To back up the key components necessary for data recovery of the Access Analyzer
+Console server:
**Step 1 –** Obtain or save the installation media for Access Analyzer.
@@ -38,7 +38,7 @@ built-in environment variable `%SAINSTALLDIR%`):
- ...\ STEALTHbits\StealthAUDIT\StealthAUDIT.LIC: The license key
**Step 3 –** Back up all Scheduled Tasks. The method of back up is determined by the Access Analyzer
-user. This can be as simple as copying the contents of the tasks folder from the following two
+user. For example, you can copy the contents of the tasks folder from the following two
locations:
@@ -58,7 +58,7 @@ Follow these steps for data recovery of the Access Analyzer Console server.
**Step 1 –** Confirm the prerequisites have been met on the Access Analyzer Console Server. See the
[Requirements](/docs/accessanalyzer/12.0/requirements/overview.md) topic for specific prerequisites.
-**Step 2 –** Install the Access Analyzer application. Do not start the Access Analyzer application
+**Step 2 –** Install the Access Analyzer application. Don't start the Access Analyzer application
at this time.
**Step 3 –** Restore all of the backed up files and folders from Step 2 of Steps to Back up the
@@ -70,8 +70,8 @@ Analyzer Console Server to the corresponding tasks folder of the operating syste
**Step 5 –** For Host Management and Host List Replication in a new host scenario, run the following
code within the SQL Studio on the Access Analyzer database.
-- Replace `OldServer` and `NewServer` in the script below with the names of the old and new Access
- Analyzer servers
+- Replace `OldServer` and `NewServer` in the following script with the names of the old and new
+ Access Analyzer servers
```
Declare @OHost varchar (128)
diff --git a/docs/accessanalyzer/12.0/admin/maintenance/bestpractices.md b/docs/accessanalyzer/12.0/admin/maintenance/bestpractices.md
index 8dab10b820..765b8ad21d 100644
--- a/docs/accessanalyzer/12.0/admin/maintenance/bestpractices.md
+++ b/docs/accessanalyzer/12.0/admin/maintenance/bestpractices.md
@@ -6,20 +6,19 @@ sidebar_position: 50
# Best Practices
-With any new product, a few pointers can really get us started on the right foot. In the spirit of
-making you successful, here are some tips that will help you become an effective user of the Access
-Analyzer in no time. Enjoy!
+With any new product, a few pointers can help you get started effectively. The following tips help
+you become an effective user of Access Analyzer.
## Do
The following is a list of best practices to use for Access Analyzer:
-- Read all Job and Job Group descriptions and instructions prior to running any solution
-- Scope all collection queries to target just the desired objects, locations, or hosts you want to
+- Read all Job and Job Group descriptions and instructions before running any solution
+- Scope all collection queries to target just the objects, locations, or hosts you want to
collect information from
-- Run new solutions against a single host or subset of data prior to running against all to ensure
+- Run new solutions against a single host or subset of data before running against all to ensure
proper operation, configuration, and output of each job
-- Leverage service accounts (if possible) containing the proper permissions to access the
+- Use service accounts (if possible) containing the proper permissions to access the
information you want to audit rather than personal user accounts (this will reduce “access denied”
warnings due to insufficient privileges)
- Set a username and password for any scheduled task
@@ -27,31 +26,31 @@ The following is a list of best practices to use for Access Analyzer:
Analyzer System Requirements & Installation Notes document for details)
- Set a connection profile inside the Job “properties” menu for any job that runs using the Exchange
Metrics data collector
-- Check the “Messages” table within any Job’s “Results” node if reports do not generate or
+- Check the “Messages” table within any Job’s “Results” node if reports don't generate or
collection doesn’t appear to be working properly
- Configure history settings at the Job level (as opposed to at the Global or Job Group level) to
avoid unnecessary storage consumption within SQL
- Contact Netwrix Support with ANY questions you have
-## Do Not
+## Don't
The following is a list of practices to avoid for Access Analyzer.
-- Do not change Job or Job Group names within the Job Tree
-- Do not attempt to run an entire Solution Set without configuring your scoping options first
-- Do not confuse WARNINGS for errors in data collection. Warnings are purely informational
-- Do not change the name of your Access Analyzer database
-- Do not edit a job’s configuration or open any query or analysis rule while that job is running
-- Do not use the Fully Qualified Domain Name of a host when manually entering hosts to run queries
+- Don't change Job or Job Group names within the Job Tree
+- Don't attempt to run an entire Solution Set without configuring your scoping options first
+- Don't confuse WARNINGS for errors in data collection. Warnings are purely informational
+- Don't change the name of your Access Analyzer database
+- Don't edit a job’s configuration or open any query or analysis rule while that job is running
+- Don't use the Fully Qualified Domain Name of a host when manually entering hosts to run queries
against; instead, use the Common Name
-- Do not enable “Debug” logging unless needed for additional troubleshooting
-- Do not change the database Access Analyzer writes to at the global level; instead, change the
+- Don't enable “Debug” logging unless needed for additional troubleshooting
+- Don't change the database Access Analyzer writes to at the global level; instead, change the
database at the job level if desired
### Contact Support
-When the checklist items do not resolve the issue, contact support with as much applicable
-information as possible from the table below. It is possible that a hot fix may already exist for
+When the checklist items don't resolve the issue, contact support with as much applicable
+information as possible from the following list. A hot fix may already exist for
the product.
**What is the version of the Access Analyzer application?**
diff --git a/docs/accessanalyzer/12.0/admin/maintenance/troubleshooting.md b/docs/accessanalyzer/12.0/admin/maintenance/troubleshooting.md
index e5bc613fd8..a6c4f9e449 100644
--- a/docs/accessanalyzer/12.0/admin/maintenance/troubleshooting.md
+++ b/docs/accessanalyzer/12.0/admin/maintenance/troubleshooting.md
@@ -24,7 +24,7 @@ purposes. This includes:
- The Application log which contains logging of all activities within Access Analyzer
- The Upgrade log which logs activities related to the upgrade process
-- The upgrade archive which is a zip file containing all of your Access Analyzer jobs prior to the
+- The upgrade archive which is a zip file containing all of your Access Analyzer jobs before the
upgrade process
- Sensitive Data logs that contain details from sensitive data scans performed against various
repositories
@@ -35,14 +35,14 @@ See the [Logs](#logs) topic for additional information.
## Logs
-Access Analyzer has a few areas where it stores logs. Make sure the log level is set to DEBUG in
-Access Analyzer to gather all necessary information. Once the logs have been created and sent to
-Netwrix Support, then reset the logging level to save disc space.
+Access Analyzer has a few areas where it stores logs. Ensure the log level is set to DEBUG in
+Access Analyzer to gather all necessary information. After the logs have been created and sent to
+Netwrix Support, reset the logging level to save disc space.
To set your logging level to debug go to **Settings** > **Application** – **Set the Application log
level to Debug** and restart the application.
-#### Where Are the Logs Located?
+#### Log File Locations
| Log Name | Log Location |
| --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -70,7 +70,7 @@ and DFS scan types:
FSAA Trace Logs:
-Below are two types of FSAA trace logs created while in local, applet, or proxy modes:
+Access Analyzer creates the following two types of FSAA trace logs while in local, applet, or proxy modes:
- Parent Trace Log – StealthAUDITRPC*[YYYYMMDD_hhmmss]*[Execution_Host].log
- ProccessID is logged in the job log
diff --git a/docs/accessanalyzer/12.0/admin/navigate/activitiespane.md b/docs/accessanalyzer/12.0/admin/navigate/activitiespane.md
index 6020b88cf6..f323c77371 100644
--- a/docs/accessanalyzer/12.0/admin/navigate/activitiespane.md
+++ b/docs/accessanalyzer/12.0/admin/navigate/activitiespane.md
@@ -6,11 +6,11 @@ sidebar_position: 40
# Activities Pane
-The Activities pane displays a list of activities which can be conducted within the currently
+The Activities pane displays a list of activities which can be conducted within the
selected console section. It is only visible if there are activities available for the selected
section. In the few cases where the Results pane is a wizard, this pane becomes the navigation pane
-for the wizard, e.g. the Access Analyzer Host Discovery Wizard. If the currently selected console
-section has an associated Activities Pane, it can be found on the right-hand side of the Access
+for the wizard, e.g. the Access Analyzer Host Discovery Wizard. If the selected console
+section has an associated Activities Pane, it appears on the right-hand side of the Access
Analyzer Console.
@@ -23,4 +23,4 @@ The following console sections have associated Activities Panes:
- Jobs > [Job Group/Job] > Settings node
The Guidance section of the Activities Pane will display context sensitive information depending on
-what the currently selected console section is.
+what the selected console section is.
diff --git a/docs/accessanalyzer/12.0/admin/navigate/datagrid.md b/docs/accessanalyzer/12.0/admin/navigate/datagrid.md
index 6c0c426cd1..45d35e0882 100644
--- a/docs/accessanalyzer/12.0/admin/navigate/datagrid.md
+++ b/docs/accessanalyzer/12.0/admin/navigate/datagrid.md
@@ -23,7 +23,7 @@ Grid view in the Results Pane, indicates how many rows of data are available wit
(the first value) and how many rows of data are available in the Access Analyzer database for this
data grid (the second value). The maximum value can be changed by the user and only affects the
maximum number of rows available for this data grid within the Access Analyzer Console. The total
-value is automatically supplied from the Access Analyzer database and cannot be changed by the user.
+value is automatically supplied from the Access Analyzer database and can't be changed by the user.
If the total value is less than the maximum value, then all available data for this grid is present
for sorting, filtering, and searching.
@@ -57,7 +57,7 @@ for information on right-click menus within a data grid.
### Customization Window
-The Customization window can be used to customize the data grid to only display specific columns.
+Use the Customization window to customize the data grid to only display specific columns.
@@ -66,7 +66,7 @@ To open the Customization window, select Field Chooser from the column header ri
Any column that has been removed from the data grid, either by dragging it off the screen or by
-dropping it into this window, will be listed here. A column not currently displayed can be returned
+dropping it into this window, will be listed here. A column not displayed can be returned
to the data grid by dragging-and-dropping it from this window onto the header row.
### Footer
@@ -80,8 +80,8 @@ To enable the footer, right-click in a column header and select Footer from the
-The footer appears as a gray bar at the bottom of the grid (or grid group). Right-click on the
-footer under the desired column. Only the options applicable to the desired column will be valid for
+The footer appears as a gray bar at the bottom of the grid (or grid group). Right-click the
+footer under the column you want. Only the options applicable to that column will be valid for
selection.
@@ -133,7 +133,7 @@ either to the stationary section on the left or to the mobile section on the rig
counts as a single row for the total rows value, but displays in two rows with the second row
dedicated for the moved column.
-Drag the column header(s) back to the table to remove the grouping or use the Clear Sort option in
+Drag the column headers back to the table to remove the grouping or use the Clear Sort option in
the [Data Grid Right-Click Menu](#data-grid-right-click-menu). Additionally, the sort will clear
when the user navigates to another place in the console.
@@ -145,9 +145,9 @@ dialog located above the Activities Pane.
-In the header of every column is a drop-down arrow. This provides users with the ability to filter
-the data grid for a particular item or items within a column. The drop-down menu has the options of
-(All), (Custom…), and an alphabetical listing of all items currently within that column for the data
+In the header of every column is a dropdown arrow. This provides users with the ability to filter
+the data grid for a particular item or items within a column. The dropdown menu has the options of
+(All), (Custom…), and an alphabetical listing of all items within that column for the data
grid.
- [Custom Filter](#custom-filter) – Click Custom Filter in the header dropdown to open the Custom
@@ -171,20 +171,20 @@ The Custom Filter window options are:
- Second Comparison Operator – Select from a list of different logical operators that will apply
to the second custom filter criteria.
- Two wildcard options:
- - The underscore (\_) can be used to represent any single character
- - The asterisk (\*) can be used to represent any series of characters
+ - Use the underscore (\_) to represent any single character
+ - Use the asterisk (\*) to represent any series of characters
#### Creating a Custom Filter
-Follow the steps to create a Custom Filter:
+To create a Custom Filter:
**Step 1 –** Click the dropdown arrow in the column header for the column where the Custom Filter is
going to be applied and select (Custom…) from the list. The Custom Filter window opens.
-**Step 2 –** Set the desired criteria for the custom filter. Select the logical operator from the
-drop-down menu on the left and set the criteria in the textbox on the right.
+**Step 2 –** Set the criteria you want for the custom filter. Select the logical operator from the
+dropdown menu on the left and set the criteria in the textbox on the right.
**Step 3 –** Select either AND/OR and set the second criteria field, following the same method as
Step 2.
@@ -192,7 +192,7 @@ Step 2.
**Step 4 –** Click OK to confirm changes. The custom filter criteria is now applied to the Data
Grid.
-In the example above, OSName is like \*2008\* AND not like \*Standard\*, the filter returns all data
+In the preceding example, OSName is like \*2008\* AND not like \*Standard\*, the filter returns all data
records with an operating system name that contains “2008” but not “Standard,” e.g. Windows Server
2008 Enterprise Edition, 64 bit and Windows Server 2008 R2 Datacenter Edition, 64-bit, etc. Complex
filters can be created using the Advanced Search option in the Filtration Dialog.
@@ -207,7 +207,7 @@ set. See the [Filtration Dialog](#filtration-dialog) topic for additional inform
feature.
Filters can be cleared by clicking the red X in the filtration dialog (to clear all filter
-statements), selecting All from the column’s drop-down menu (to clear filters one column at a time),
+statements), selecting All from the column’s dropdown menu (to clear filters one column at a time),
or by navigating to another place in the console (to clear all filter statements). However, the
Recent Filters option in the filtration dialog provides a list of the most recent filters applied to
the data set for users to quickly return to a filtered view.
@@ -253,7 +253,7 @@ The filter options and logical operators are:
- Comparison Operator – The comparison operator (dark red text) can be changed by clicking on it to
open a menu with:
- equals
- - does not equal
+ - doesn't equal
- is less than
- is less than or equal to
- is greater than
@@ -261,7 +261,7 @@ The filter options and logical operators are:
- like
- not like
- is blank
- - is not blank
+ - isn't blank
- between
- not between
- in
diff --git a/docs/accessanalyzer/12.0/admin/navigate/overview.md b/docs/accessanalyzer/12.0/admin/navigate/overview.md
index 8b40ee74e5..90e3482821 100644
--- a/docs/accessanalyzer/12.0/admin/navigate/overview.md
+++ b/docs/accessanalyzer/12.0/admin/navigate/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Navigating the Console
-There are several options that can be used to navigate the Access Analyzer Console. This section
+Several options let you navigate the Access Analyzer Console. This section
covers basic Access Analyzer Console navigation, including menu options, buttons, and the different
panes through which users can access Access Analyzer’s various functions and options.
@@ -21,8 +21,8 @@ The primary sections of the Access Analyzer Console are:
- [Results Pane](/docs/accessanalyzer/12.0/admin/navigate/resultspane.md) – Displays various interfaces based on what is selected in the
Navigation Pane or Activities Pane
- [Activities Pane](/docs/accessanalyzer/12.0/admin/navigate/activitiespane.md) – Displays a list of activities which can be conducted within
- the currently selected console section
+ the selected console section
-Access Analyzer Data Grids also have specific navigation options that enable users to filter, group,
+Access Analyzer Data Grids also have specific navigation options that let users filter, group,
and search through data. See the [Data Grid Functionality](/docs/accessanalyzer/12.0/admin/navigate/datagrid.md) topic for additional
information.
diff --git a/docs/accessanalyzer/12.0/admin/navigate/pane.md b/docs/accessanalyzer/12.0/admin/navigate/pane.md
index 2b430a6e13..5e1e482507 100644
--- a/docs/accessanalyzer/12.0/admin/navigate/pane.md
+++ b/docs/accessanalyzer/12.0/admin/navigate/pane.md
@@ -135,7 +135,7 @@ Menu items include:
needs to be modified. Unlocking a job will prevent Job Initiators from scheduling or running the
job. This option only applies to Role Based Access. See the
[Role Based Access](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/overview.md) for additional information.
-- Enable/Disable Job(s) – Disables the selected job or job group and skips them during scan
+- Enable/Disable Jobs – Disables the selected job or job group and skips them during scan
execution. When a job group is disabled, all existing jobs within the job group are disabled. See
the [Disable or Enable a Job](/docs/accessanalyzer/12.0/admin/jobs/job/disableenable.md) topic for more information.
- Schedules – Opens the [Schedule Jobs](/docs/accessanalyzer/12.0/admin/schedule/overview.md#schedule-jobs) to schedule job group
diff --git a/docs/accessanalyzer/12.0/admin/navigate/top.md b/docs/accessanalyzer/12.0/admin/navigate/top.md
index f5cbfb7598..02a69f7a47 100644
--- a/docs/accessanalyzer/12.0/admin/navigate/top.md
+++ b/docs/accessanalyzer/12.0/admin/navigate/top.md
@@ -159,4 +159,4 @@ The options in the Button Bar are:
|  | Clipboard with paper | Paste the query from the clipboard (Ctrl + V) |
|  | Red X | Delete the selected query |
-Select a button for the desired action.
+Select a button for the action you want.
diff --git a/docs/accessanalyzer/12.0/admin/overview.md b/docs/accessanalyzer/12.0/admin/overview.md
index 82141d8b6e..af83c8ab6b 100644
--- a/docs/accessanalyzer/12.0/admin/overview.md
+++ b/docs/accessanalyzer/12.0/admin/overview.md
@@ -14,7 +14,7 @@ applications with the application.
## Data Collectors Overview
-Access Analyzer leverages a wide variety of APIs and protocols to connect to and communicate with
+Access Analyzer uses a wide variety of APIs and protocols to connect to and communicate with
the systems and applications in an organization’s environment. From MAPI to PowerShell, WMI, LDAP,
CIFS, and more. It uses the best, most appropriate data collection methodology for every data
collection task. The majority of Access Analyzer data comes from agentless scans and log collection.
@@ -34,7 +34,7 @@ Access Analyzer employs a series of powerful, yet easy-to-use Analysis Modules w
end-users with the ability to perform very simple and sophisticated data analysis routines with
ease:
-- Correlation – Easily correlate data from multiple datasets to create meaningful views
+- Correlation – Correlate data from multiple datasets to create meaningful views
- Policy – Create rules and policies which automatically categorize your data output, i.e. Severity,
Classifications, etc.
- Change – Turn on change detection to see exactly what has changed between time periods
diff --git a/docs/accessanalyzer/12.0/admin/report/chartwizard/chartformat.md b/docs/accessanalyzer/12.0/admin/report/chartwizard/chartformat.md
index 867bb53d98..ea9b05fca8 100644
--- a/docs/accessanalyzer/12.0/admin/report/chartwizard/chartformat.md
+++ b/docs/accessanalyzer/12.0/admin/report/chartwizard/chartformat.md
@@ -33,5 +33,5 @@ The Chart Format page has the following options:
for the chart type. If a value greater than the default is entered, then the value automatically
resets back to the default.
-Once you have configured the options as required, click **Next** to proceed to the Data Source page.
+After you configure the options as required, click **Next** to proceed to the Data Source page.
See the [Data Source](/docs/accessanalyzer/12.0/admin/report/chartwizard/datasource.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/report/chartwizard/configure.md b/docs/accessanalyzer/12.0/admin/report/chartwizard/configure.md
index 7437907fa4..981792251d 100644
--- a/docs/accessanalyzer/12.0/admin/report/chartwizard/configure.md
+++ b/docs/accessanalyzer/12.0/admin/report/chartwizard/configure.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Configure
-The Configure page of the Chart Configuration wizard allows you to configure the chart as required.
+Use the Configure page of the Chart Configuration wizard to configure the chart as required.
The page consist of two tabs, Chart Configuration and Data Preview.
## Chart Configuration
@@ -17,9 +17,9 @@ shown in the chart.
-The left side shows all the columns from the data source table that can be used for the label axis.
+The left side shows all the columns from the data source table that you can use for the label axis.
For example, the label column is the x-axis on a line chart and the y-axis on a bar chart. Select
-the checkbox of the desired label column from the list. You can use the search bar to filter this
+the checkbox of the label column you want from the list. You can use the search bar to filter this
list of columns.
If a datetime label column has been selected, you can optionally select a transformation function
@@ -42,25 +42,25 @@ existing data series. The following options are available:
- Color Picker – Available only for pie charts. Opens the Pie slices color window, which allows you
to customize the color for each slice of the pie chart. On the Pie slices color window:
- - Select the row of the desired value to customize and click **Change Color**
- - Use the color picker to choose the desired color, then click **OK**
+ - Select the row of the value you want to customize and click **Change Color**
+ - Use the color picker to choose the color you want, then click **OK**
- Repeat for each color you want to customize
- Click **OK** to save your selections and close the Pie slices color window, or click
**Cancel** to close the window without changing the colors
-At the bottom of the page is a preview of the chart as it is currently configured using the
+At the bottom of the page is a preview of the chart as it is configured using the
available data. See the [Chart Preview](#chart-preview) topic for additional information.
Additionally, you can see a preview of the source data table in the Data Preview tab. See the
[Data Preview](#data-preview) topic for additional information.
-Once you have finished configuring the chart, click **Finish** to close the wizard. You are returned
+After you finish configuring the chart, click **Finish** to close the wizard. You are returned
to the Widgets page of the Report Configuration wizard, where the newly configured chart is shown.
You must complete the Report Configuration wizard to save the chart on the report. See the
[Widgets Page](/docs/accessanalyzer/12.0/admin/report/wizard/widgets.md) topic for additional information.
### Add New Series / Edit Series Window
-The Add new series and Edit series windows allow you to configure the data series of the chart. The
+Use the Add new series and Edit series windows to configure the data series of the chart. The
appropriate window is opened by clicking **Add** to create a new series, or by selecting an existing
series and clicking **Edit**.
@@ -68,8 +68,8 @@ series and clicking **Edit**.
These windows contain the following options for the data series:
-- Column table – This table displays the available columns in the source table that are not
- currently selected in a series for the chart. Select the checkbox for column that contains the
+- Column table – This table displays the available columns in the source table that aren't
+ selected in a series for the chart. Select the checkbox for column that contains the
data for the series. You can use the search bar to filter the list of columns.
:::note
@@ -77,7 +77,7 @@ These windows contain the following options for the data series:
:::
-- Select a function to aggregate the column by – Use the drop-down to select an aggregation
+- Select a function to aggregate the column by – Use the dropdown to select an aggregation
function. The available options vary depending on the column selected. The possible options are:
- None
@@ -98,7 +98,7 @@ window without saving.
### Chart Preview
-At the bottom of the page a preview of the currently configured chart is displayed.
+At the bottom of the page a preview of the configured chart is displayed.
@@ -115,14 +115,14 @@ would cause them:
## Data Preview
-The Data Preview tab allows you to see and customize the data that is to be shown in the chart.
+Use the Data Preview tab to see and customize the data that is to be shown in the chart.
The buttons above the column names provide you the following options for configuring the table
arrangement:
-- Filter Editor – Opens the Filter Editor which allows you to add custom filters with conditional
+- Filter Editor – Opens the Filter Editor, which lets you add custom filters with conditional
statements and logical connectives
- Best Fit (all columns) – Adjusts the width of the columns to display all the data within the
cells
diff --git a/docs/accessanalyzer/12.0/admin/report/chartwizard/datasource.md b/docs/accessanalyzer/12.0/admin/report/chartwizard/datasource.md
index 499a0db977..e253aad9bb 100644
--- a/docs/accessanalyzer/12.0/admin/report/chartwizard/datasource.md
+++ b/docs/accessanalyzer/12.0/admin/report/chartwizard/datasource.md
@@ -10,11 +10,11 @@ On the Data Source page of the Chart Configuration wizard configure the data sou
-In order to generate results, a location must first be selected as the source of the data. The table
+to generate results, a location must first be selected as the source of the data. The table
on this wizard page contains a list of tables and views within Access Analyzer from jobs that have
been executed. Select the required data source from the table.
-You can use the search bar located above the table to easily find a desired table. The **Limit
+You can use the search bar located above the table to find a specific table. The **Limit
selection to tables from the current job**option limits the displayed data to tables from the
current job. This option is selected by default. You can clear the option to widen the available
data to all jobs.
@@ -26,5 +26,5 @@ There are the following additional data source options:
- Show historical data – If there is historical data, selecting this option displays all
collections. It is keyed off of the Jobruntimekey column.
-Once you have selected the data source, click **Next** to proceed to the Configure page. See the
+After you select the data source, click **Next** to proceed to the Configure page. See the
[Configure](/docs/accessanalyzer/12.0/admin/report/chartwizard/configure.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/report/chartwizard/overview.md b/docs/accessanalyzer/12.0/admin/report/chartwizard/overview.md
index ea96d3f829..3e05d29ffa 100644
--- a/docs/accessanalyzer/12.0/admin/report/chartwizard/overview.md
+++ b/docs/accessanalyzer/12.0/admin/report/chartwizard/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Chart Configuration Wizard
-The Chart Configuration wizard allows you to configure the charts that display on reports. The
+Use the Chart Configuration wizard to configure the charts that display on reports. The
wizard opens when you select to configure a Chart widget from the Widgets page of the Report
Configuration Wizard. See the [Widgets Page](/docs/accessanalyzer/12.0/admin/report/wizard/widgets.md) topic for additional information.
@@ -16,6 +16,6 @@ The Chart Configuration wizard consists of three pages:
- [Data Source](/docs/accessanalyzer/12.0/admin/report/chartwizard/datasource.md)
- [Configure](/docs/accessanalyzer/12.0/admin/report/chartwizard/configure.md)
-Once you have finished configuring the chart, click **Finish** to close the wizard. You are returned
+After you finish configuring the chart, click **Finish** to close the wizard. You are returned
to the Widgets page of the Report Configuration wizard, where the newly configured chart is shown.
You must complete the Report Configuration wizard to save the chart on the report.
diff --git a/docs/accessanalyzer/12.0/admin/report/cleanup.md b/docs/accessanalyzer/12.0/admin/report/cleanup.md
index 13fd033c2b..f94df628e3 100644
--- a/docs/accessanalyzer/12.0/admin/report/cleanup.md
+++ b/docs/accessanalyzer/12.0/admin/report/cleanup.md
@@ -6,18 +6,18 @@ sidebar_position: 80
# Report Cleanup when Deleting a Job or Job Group
-When deleting a job or job group, the Delete Job and Delete Group wizards allow you to delete any
-published reports contained in the jobs that are being deleted. Follow the steps to delete a job or
-job group that contains published reports.
+When deleting a job or job group, the Delete Job and Delete Group wizards let you delete any
+published reports contained in the jobs that are being deleted. To delete a job or
+job group that contains published reports:
:::warning
-Deleted objects cannot be restored.
+Deleted objects can't be restored.
:::
-**Step 1 –** In the Jobs tree, right-click on the job or group that you want to delete and select
+**Step 1 –** In the Jobs tree, right-click the job or group that you want to delete and select
**Delete Job/Group**.
diff --git a/docs/accessanalyzer/12.0/admin/report/create.md b/docs/accessanalyzer/12.0/admin/report/create.md
index f69215f639..f8fcaf5d71 100644
--- a/docs/accessanalyzer/12.0/admin/report/create.md
+++ b/docs/accessanalyzer/12.0/admin/report/create.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Creating a Report
-Creating and customizing reports allows you to design outputs uniquely crafted to your requirements.
+Create and customize reports to design outputs uniquely crafted to your requirements.
Reports can vary by section order, sourced data, file format, and other elements within the reports
configuration.
@@ -16,16 +16,15 @@ You can add additional reports by the following methods:
- [Copy an Existing Report](#copy-an-existing-report)
:::note
-It is important to consider whether a report should be added to an existing job, or a new
-job created to generate the report. Contact [Netwrix Support](https://www.netwrix.com/support.html)
+Consider whether to add a report to an existing job or create a new
+job to generate the report. Contact [Netwrix Support](https://www.netwrix.com/support.html)
for additional information on report outputs.
:::
## Create a Custom Report
-You can create a new custom report for an existing job from the job’s Reports node. Follow the steps
-to create a new report.
+You can create a new custom report for an existing job from the job’s Reports node.
**Step 1 –** Navigate to **Jobs** > **[Job]** > **Configure** and select the **Reports** node.
@@ -49,17 +48,16 @@ topic.
## Copy an Existing Report
You can create a new report by copying an existing report and pasting it in a job’s Reports node.
-You can then optionally customize the report as required. Follow the steps to create a copy of an
-existing report.
+You can then optionally customize the report as required.
-**Step 1 –** Navigate to the Reports node where the desired report to copy is located. Click the
+**Step 1 –** Navigate to the Reports node where the report you want to copy is located. Click the
vertical ellipsis menu next to the report and select Copy.
-**Step 2 –** Navigate to the Reports node in the desired destination for the new report. Click the
+**Step 2 –** Navigate to the Reports node in the destination you want for the new report. Click the
vertical ellipsis menu in the header row of the Reports table and select Paste.
The copy of the report is added to the Reports table. Reports that are copied maintain the same
diff --git a/docs/accessanalyzer/12.0/admin/report/edit.md b/docs/accessanalyzer/12.0/admin/report/edit.md
index 7e8f1ca039..b92f654fb0 100644
--- a/docs/accessanalyzer/12.0/admin/report/edit.md
+++ b/docs/accessanalyzer/12.0/admin/report/edit.md
@@ -6,15 +6,13 @@ sidebar_position: 20
# Editing Existing Reports
-It is not recommended to edit existing reports unless there are changes to a job’s settings at the
+It isn't recommended to edit existing reports unless there are changes to a job’s settings at the
global level, job group level, or job level. Changes to when data is collected, the types of data
-collected, and the properties of collected data are not reflected in a report’s configuration. As a
+collected, and the properties of collected data aren't reflected in a report’s configuration. As a
result, generated reports could appear with blank fields or misleading information about the purpose
of the collected data, unless the report is modified to reflect the changes to the job's settings.
To modify a report, use the Report Configuration Wizard.
-Follow the steps to modify an existing report.
-
**Step 1 –** Navigate to the Reports node that contains the report.
@@ -25,7 +23,7 @@ Follow the steps to modify an existing report.
[Report Configuration Wizard](/docs/accessanalyzer/12.0/admin/report/wizard/overview.md) topic for instructions.
- You must go through all pages of the wizard, and click **Finish** on the final page to save your
- changes. Skip any sections or pages that do not require changes to the existing configuration. You
+ changes. Skip any sections or pages that don't require changes to the existing configuration. You
can click **Cancel** on any page to exit the wizard without saving your changes.
Your configuration updates have been saved. To view the updated report you need to first generate
diff --git a/docs/accessanalyzer/12.0/admin/report/interactivegrids/copyingcells.md b/docs/accessanalyzer/12.0/admin/report/interactivegrids/copyingcells.md
index b1220a42db..ab9e923553 100644
--- a/docs/accessanalyzer/12.0/admin/report/interactivegrids/copyingcells.md
+++ b/docs/accessanalyzer/12.0/admin/report/interactivegrids/copyingcells.md
@@ -12,7 +12,7 @@ under a column can be selected and copied to the clipboard.
-To copy a cell, select the cell, then right-click on it and select **Copy Cell Data**.
+To copy a cell, select the cell, then right-click it and select **Copy Cell Data**.
:::note
You may need to allow programmatic clipboard access for your browser the first time you
diff --git a/docs/accessanalyzer/12.0/admin/report/interactivegrids/grouping.md b/docs/accessanalyzer/12.0/admin/report/interactivegrids/grouping.md
index 9f21a5691c..5a5ae6e2fa 100644
--- a/docs/accessanalyzer/12.0/admin/report/interactivegrids/grouping.md
+++ b/docs/accessanalyzer/12.0/admin/report/interactivegrids/grouping.md
@@ -6,11 +6,11 @@ sidebar_position: 10
# Grouping Data
-If grouping is enabled, the **Group by** field provides a drop-down list of categories by which the
+If grouping is enabled, the **Group by** field provides a dropdown list of categories by which the
data can be grouped.
:::note
-Grouping and filtering cannot be enabled at the same time. If grouping is enabled, the
+Grouping and filtering can't be enabled at the same time. If grouping is enabled, the
Filter icon is disabled in the report.
:::
@@ -20,5 +20,5 @@ The following example shows an interactive grid in which grouping has been enabl
-The drop-down list to the right of the Group by field can be accessed by clicking the down arrow.
-Click an item from the drop-down list to group the report by that category.
+The dropdown list to the right of the Group by field can be accessed by clicking the down arrow.
+Click an item from the dropdown list to group the report by that category.
diff --git a/docs/accessanalyzer/12.0/admin/report/interactivegrids/overview.md b/docs/accessanalyzer/12.0/admin/report/interactivegrids/overview.md
index bb460827f8..10631f4607 100644
--- a/docs/accessanalyzer/12.0/admin/report/interactivegrids/overview.md
+++ b/docs/accessanalyzer/12.0/admin/report/interactivegrids/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 70
# Interactive Grids
-Interactive grids in the table section of a report provide the ability to interact with the data and
-filter it as required. Interactive grids allow you to perform the following actions:
+Interactive grids in the table section of a report let you interact with the data and
+filter it as required. With interactive grids, you can perform the following actions:
- Group data
- Search and filter data
@@ -19,7 +19,7 @@ filter it as required. Interactive grids allow you to perform the following acti
The toolbar in an interactive grid can display the following options:
- Filter icon – Click this icon to activate searching and filter the data
-- Group by – Provides a drop-down list of available categories to select for grouping. When grouping
+- Group by – Provides a dropdown list of available categories to select for grouping. When grouping
is enabled, searching is disabled.
- Up arrow and down arrow – Click to expand or collapse the groups
- Download Data – Click to download all data to a CSV file. This option is displayed when the
diff --git a/docs/accessanalyzer/12.0/admin/report/interactivegrids/paging.md b/docs/accessanalyzer/12.0/admin/report/interactivegrids/paging.md
index c6b8d69a5d..5c8fc8ffda 100644
--- a/docs/accessanalyzer/12.0/admin/report/interactivegrids/paging.md
+++ b/docs/accessanalyzer/12.0/admin/report/interactivegrids/paging.md
@@ -6,20 +6,20 @@ sidebar_position: 30
# Paging
-Paging allows users to interact with large sets of data more efficiently when viewing, filtering,
-and sorting generated report tables by limiting the amount of data being displayed at a given time.
-Reports provide the ability to navigate to specific pages using arrows at the bottom of the report.
+Use paging to interact with large sets of data more efficiently when viewing, filtering,
+and sorting generated report tables by limiting the amount of data displayed at a given time.
+Reports let you navigate to specific pages using arrows at the bottom of the report.
Paging is enabled by default. See the [Grid](/docs/accessanalyzer/12.0/admin/report/wizard/widgets.md#grid) topic for additional
information.
:::note
-Paging and grouping cannot be enabled at the same time. When Paging is enabled, the
+Paging and grouping can't be enabled at the same time. When Paging is enabled, the
Grouping options are disabled for the report.
:::
-When paging is enabled, arrows are displayed that allow you to navigate to the next page, last page,
+When paging is enabled, arrows appear so you can navigate to the next page, last page,
previous page, or first page. If the data is filtered, it is indicated at the end of the line. Each
page contains 10 records.
diff --git a/docs/accessanalyzer/12.0/admin/report/interactivegrids/searchfilter.md b/docs/accessanalyzer/12.0/admin/report/interactivegrids/searchfilter.md
index e236c2a57a..8b0d032eb5 100644
--- a/docs/accessanalyzer/12.0/admin/report/interactivegrids/searchfilter.md
+++ b/docs/accessanalyzer/12.0/admin/report/interactivegrids/searchfilter.md
@@ -10,7 +10,7 @@ When dealing with large sets of data, it may be useful to search for a desired a
be done using the Filter icon.
:::note
-Searching and grouping cannot be enabled at the same time. If grouping is enabled, the
+Searching and grouping can't be enabled at the same time. If grouping is enabled, the
Search icon is disabled in the report.
:::
@@ -23,7 +23,7 @@ The following example shows an interactive grid in which searching has been enab
Enter search criteria in the boxes under the columns to filter the data. Click the search icon again
to clear the filters.
-Click on a column to sort by that column. Clicking on a cell in a column automatically expands the
+Click a column to sort by that column. Clicking on a cell in a column automatically expands the
column size to fit the largest length of text contained in the column.
## Searching Enumerated Tables
@@ -35,7 +35,7 @@ types to display as enumerated tables.
To change the enumeration in the report, select an option from the enumerated column list. When
enumeration is set on an interactive grid, a second download button is displayed with the name of
-the currently selected enumerated column. You can use this to download a CSV file that only contains
+the selected enumerated column. You can use this to download a CSV file that only contains
the data for the selected enumeration.
## Filtering on Dates & Times
@@ -45,12 +45,12 @@ filter on specific time periods.
-Enter a Start and End date and select the desired time period.
+Enter a Start and End date and select the time period you want.
## Filtering on Numeric Columns
-Comparison operators can also be used for filtering. Comparison operators which can be used for
-filtering include the following:
+Use comparison operators to filter data. The available comparison operators include the
+following:
| Description | Operator |
| ------------------------ | -------- |
@@ -67,5 +67,5 @@ Columns can be added or removed from the table.
-Right-click on a column to display a list of the available columns. Select the checkboxes of the
+Right-click a column to display a list of the available columns. Select the checkboxes of the
columns you want to be displayed. Click the up or down arrows to scroll through the list of columns.
diff --git a/docs/accessanalyzer/12.0/admin/report/overview.md b/docs/accessanalyzer/12.0/admin/report/overview.md
index 8e00f92d8f..ec32024e74 100644
--- a/docs/accessanalyzer/12.0/admin/report/overview.md
+++ b/docs/accessanalyzer/12.0/admin/report/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# Reporting
-Access Analyzer provides the ability to report on collected data in multiple ways such as tables,
+Access Analyzer lets you report on collected data in multiple ways such as tables,
views, graphs, and emails. Depending on the type of data collected, different reporting methods can
simplify how to present and understand the information.
diff --git a/docs/accessanalyzer/12.0/admin/report/tags.md b/docs/accessanalyzer/12.0/admin/report/tags.md
index eac344ce7d..a8b5cc2072 100644
--- a/docs/accessanalyzer/12.0/admin/report/tags.md
+++ b/docs/accessanalyzer/12.0/admin/report/tags.md
@@ -8,19 +8,19 @@ sidebar_position: 60
Tags can be added to reports to describe the content of the report and use cases for the report. For
example, tags can be included in a report to show the compliance frameworks to which the report
-maps. To view tags or click on tag links, reports must be viewed in the Web Console. Tags are not
+maps. To view tags or click tag links, reports must be viewed in the Web Console. Tags aren't
supported in reports in the Jobs tree.
-If Reports from solutions that have been run have tags added to them, those tags can be found under
-the Tags tab in the Navigation section on the right-hand side of the Published Reports homepage.
+If Reports from solutions that have been run have tags added to them, the Tags tab in the Navigation
+section on the right-hand side of the Published Reports homepage lists those tags.
|  |  |
|:-----------------------------------------------------------------------------------------------------:|:--------------------------------------------------------------------------------------------------------------:|
| *Privileged Accounts Tag on Published Reports homepage* | *Privileged Accounts Tag page* |
-Click on a tag to view all reports that contain the selected tag.
+Click a tag to view all reports that contain the selected tag.
@@ -31,13 +31,13 @@ name.
When viewing a report in either the Web Console or the Access Analyzer console, tags are displayed
-below the report title. Click on a tag to view all reports that contain that tag. If the tag is
+below the report title. Click a tag to view all reports that contain that tag. If the tag is
selected from the Reports view in the Access Analyzer Console, the Published Reports Web Console
opens and direct users to the tag page.
## Default Tags in Reports
-The following sections list out of the box reports that contain each tag. The tags are:
+The following sections list the default reports that contain each tag. The tags are:
### Open Access
diff --git a/docs/accessanalyzer/12.0/admin/report/view.md b/docs/accessanalyzer/12.0/admin/report/view.md
index 07b1c0165e..5bcc441c72 100644
--- a/docs/accessanalyzer/12.0/admin/report/view.md
+++ b/docs/accessanalyzer/12.0/admin/report/view.md
@@ -21,7 +21,7 @@ report is unpublished, the report is still displayed here.
-Select the desired report to be viewed. The report displays in the Results pane of the console.
+Select the report you want to view. The report displays in the Results pane of the console.
@@ -45,7 +45,7 @@ that solution’s job group. This list includes reports with changed Publish Pat
Clicking a report name link opens the selected report, or navigate through the folders to select a
report.
-From within the Web Console, reports cannot be edited or deleted. However, the interactive grid
+From within the Web Console, reports can't be edited or deleted. However, the interactive grid
functions are enabled. See the [Interactive Grids](/docs/accessanalyzer/12.0/admin/report/interactivegrids/overview.md) topic for
additional information. An additional feature available within the Web Console is the option to
download data as a CSV file, which can be enabled for grid elements. This exports the data within
diff --git a/docs/accessanalyzer/12.0/admin/report/wizard/authoring.md b/docs/accessanalyzer/12.0/admin/report/wizard/authoring.md
index 49e7b310e1..3cd0cdb022 100644
--- a/docs/accessanalyzer/12.0/admin/report/wizard/authoring.md
+++ b/docs/accessanalyzer/12.0/admin/report/wizard/authoring.md
@@ -25,7 +25,7 @@ Configure the following settings as required:
- Author – Name of the person or group who created the report. This is displayed at the top of the
generated report.
- Tags – Use the tag editor to add and remove tags, see the
- [Add Tags to a Report](#add-tags-to-a-report) topic below for more information. Tags are displayed
+ [Add Tags to a Report](#add-tags-to-a-report) topic for more information. Tags are displayed
in the header of the generated reported.
- Description – A description of the report content. It is displayed beneath the report Title in the
generated report.
@@ -41,17 +41,15 @@ Configure the following settings as required:
[Report Settings Tab](/docs/accessanalyzer/12.0/admin/jobs/job/properties/reportsettings.md) topics for additional
information.)
- Publish report – Select this option to publish the report
- - Do not publish report – Select this option to not publish the report
+ - Don't publish report – Select this option to not publish the report
- Publish State – Shows the current publish state of the report. If the report is already published,
you can click the link to open the report in the Web Console.
## Add Tags to a Report
You can add tags to reports to describe the content and use cases of the report (see the
-[Tags](/docs/accessanalyzer/12.0/admin/report/tags.md) topic for additional information). The Tag Editor allows you to select the tags
-for a report, including creating new ones to select.
-
-Follow the steps to select tags using the Tag Editor.
+[Tags](/docs/accessanalyzer/12.0/admin/report/tags.md) topic for additional information). Use the Tag Editor to select the tags
+for a report, including creating new ones.
**Step 1 –** On the Authoring page of the Report Configuration wizard, click the **Edit** button
located next to the Tags text box.
@@ -62,7 +60,7 @@ located next to the Tags text box.
report.
- In addition to selecting existing tags, you can also add new tags to be selected. To create a tag,
- enter the desired tag name in the text box and click **Add**.
+ enter the tag name in the text box and click **Add**.
**Step 3 –** Click **OK**.
diff --git a/docs/accessanalyzer/12.0/admin/report/wizard/email.md b/docs/accessanalyzer/12.0/admin/report/wizard/email.md
index 574943f913..5f746d5ed6 100644
--- a/docs/accessanalyzer/12.0/admin/report/wizard/email.md
+++ b/docs/accessanalyzer/12.0/admin/report/wizard/email.md
@@ -26,7 +26,7 @@ for additional information.
:::
-To configure the setting for the report, use the Settings drop-down menu to select one of the
+To configure the setting for the report, use the Settings dropdown menu to select one of the
following options:
- Use default setting – The default option. Applies the Global notification settings, or whatever
@@ -34,9 +34,9 @@ following options:
**Email this report** is enabled by default, then using this option sends the report to the
recipients configured at the parent level where the inheritance begins.
- Email this report – Select this option if you want to email the report and the inherited setting
- is **Do not email this report**, or if you want to configure specific email settings for the
+ is **Don't email this report**, or if you want to configure specific email settings for the
report. If it is selected, you must then configure the additional fields below.
-- Do not email this report – Select this option to not email the report
+- Don't email this report – Select this option to not email the report
@@ -55,7 +55,7 @@ configure:
`[ReportName]`variable being automatically populated.
- Send-To / Send-Cc / Send-Bcc – Enter the email addresses of the required recipients for the email
notification. Use a semicolon (;) to separate multiple recipients.
-- Do not e-mail this report if blank – Select this checkbox to not email the report if all elements
+- Don't e-mail this report if blank – Select this checkbox to not email the report if all elements
of it are blank when it is generated
- A blank report can occur if there is an error in data collection or if the report is
configured for data which might not always be present (for example, new computer objects
diff --git a/docs/accessanalyzer/12.0/admin/report/wizard/layout.md b/docs/accessanalyzer/12.0/admin/report/wizard/layout.md
index b3185c749c..51a93c1bce 100644
--- a/docs/accessanalyzer/12.0/admin/report/wizard/layout.md
+++ b/docs/accessanalyzer/12.0/admin/report/wizard/layout.md
@@ -6,16 +6,16 @@ sidebar_position: 40
# Layout Page
-The Layout page allows you to configure the layout of the report's content.
+Use the Layout page to configure the layout of the report's content.
-Follow the steps to select the layout:
+To select the layout:
-**Step 1 –** Click the **Select the number of rows** drop-down menu and select an option from: 1
+**Step 1 –** Click the **Select the number of rows** dropdown menu and select an option from: 1
row, 2 rows, or 3 rows.
-**Step 2 –** Click on the layout tile you want for the report.
+**Step 2 –** Click the layout tile you want for the report.
The layout for the report has been selected. Each box on the selected tile corresponds to a separate
widget that you next need to configure on the [Widgets Page](/docs/accessanalyzer/12.0/admin/report/wizard/widgets.md) page of the Report
diff --git a/docs/accessanalyzer/12.0/admin/report/wizard/overview.md b/docs/accessanalyzer/12.0/admin/report/wizard/overview.md
index 6793558de6..96a035df4c 100644
--- a/docs/accessanalyzer/12.0/admin/report/wizard/overview.md
+++ b/docs/accessanalyzer/12.0/admin/report/wizard/overview.md
@@ -10,10 +10,8 @@ You can use the Report Configuration Wizard to configure reports. The wizard can
existing report or when creating a new report. See the [Creating a Report](/docs/accessanalyzer/12.0/admin/report/create.md) and
[Editing Existing Reports](/docs/accessanalyzer/12.0/admin/report/edit.md) topics for additional information.
-Follow the steps to configure a report using the wizard.
-
:::note
-Skip any sections or pages that do not require changes to the existing configuration.
+Skip any sections or pages that don't require changes to the existing configuration.
:::
@@ -27,18 +25,18 @@ specific settings. Click **Next**.
**Step 4 –** The [Publish Security Page](/docs/accessanalyzer/12.0/admin/report/wizard/publishsecurity.md) page is only enabled if role-based
access is configured for the Access Analyzer console. On this page you can view and configure
-accounts with permissions to view the report. If you are not using role-based access, you can skip
+accounts with permissions to view the report. If you aren't using role-based access, you can skip
this page. Click **Next**.
**Step 5 –** On the [Layout Page](/docs/accessanalyzer/12.0/admin/report/wizard/layout.md) page, select the number of rows using the dropdown
-menu. Then select the desired pre-defined layout from the options displayed. Click **Next**.
+menu. Then select the pre-defined layout you want from the options displayed. Click **Next**.
**Step 6 –** On the [Widgets Page](/docs/accessanalyzer/12.0/admin/report/wizard/widgets.md) page, configure widgets for each element of the
layout.
**Step 7 –** Click **Finish** to save your changes.
-- If you do not want to save your changes or have not made any changes, click **Cancel** on any page
+- If you don't want to save your changes or have not made any changes, click **Cancel** on any page
to exit the wizard without saving your changes.
Your configuration has been saved. For information on how to view your report, see the
diff --git a/docs/accessanalyzer/12.0/admin/report/wizard/publishsecurity.md b/docs/accessanalyzer/12.0/admin/report/wizard/publishsecurity.md
index c04792d778..537169b571 100644
--- a/docs/accessanalyzer/12.0/admin/report/wizard/publishsecurity.md
+++ b/docs/accessanalyzer/12.0/admin/report/wizard/publishsecurity.md
@@ -32,7 +32,7 @@ steps to add an account.
-**Step 2 –** On the Select User, Service Account or Group window, select the desired account and
+**Step 2 –** On the Select User, Service Account or Group window, select the account you want and
then click **OK**.
@@ -40,7 +40,7 @@ then click **OK**.
The selected account is added to the list with a Role of Report Viewer.
:::note
-The permission for accounts that are not Inherited can also be removed using the wizard.
+The permission for accounts that aren't Inherited can also be removed using the wizard.
To remove an account, select it and then click **Remove**.
:::
diff --git a/docs/accessanalyzer/12.0/admin/report/wizard/widgets.md b/docs/accessanalyzer/12.0/admin/report/wizard/widgets.md
index 11f4367544..b6f8853cb0 100644
--- a/docs/accessanalyzer/12.0/admin/report/wizard/widgets.md
+++ b/docs/accessanalyzer/12.0/admin/report/wizard/widgets.md
@@ -16,7 +16,7 @@ locations where widgets need to be configured.
-To add a new widget to an empty element, click **Configure** and select the desired widget type from
+To add a new widget to an empty element, click **Configure** and select the widget type you want from
the dropdown menu. The following widgets are available:
- [Grid](#grid)
diff --git a/docs/accessanalyzer/12.0/admin/runninginstances/jobdetails.md b/docs/accessanalyzer/12.0/admin/runninginstances/jobdetails.md
index 2dfe497db7..5d7d08f1b5 100644
--- a/docs/accessanalyzer/12.0/admin/runninginstances/jobdetails.md
+++ b/docs/accessanalyzer/12.0/admin/runninginstances/jobdetails.md
@@ -38,7 +38,7 @@ The tab includes:
- Status – Execution status, for example **Queued**, **Running**, **Success**, or **Warning**.
- Message – Access Analyzer message regarding runtime activity
- Runtime – Duration of task execution
-- Stop – Aborts all currently running instances
+- Stop – Aborts all running instances
## History Tab
diff --git a/docs/accessanalyzer/12.0/admin/runninginstances/overview.md b/docs/accessanalyzer/12.0/admin/runninginstances/overview.md
index 08ffe7f89e..1126147ce8 100644
--- a/docs/accessanalyzer/12.0/admin/runninginstances/overview.md
+++ b/docs/accessanalyzer/12.0/admin/runninginstances/overview.md
@@ -43,14 +43,14 @@ It also has hyperlinks for:
Clicking on any of the hyperlinks displays more information about the running job. The
**ProcessID**, **View Details, View Log**, and **Stop** links only work while the job is running.
-Once the job is complete, these links are disabled. The host and Connection Profile links continue
+After the job is complete, these links are disabled. The host and Connection Profile links continue
to work. The **View Schedule** link only displays and is valid for jobs that are running via a
-scheduled task and is not enabled for interactive job executions.
+scheduled task and isn't enabled for interactive job executions.
-The number of jobs currently being run can be found in the lower-left-hand corner of the Access
-Analyzer Console.
+The lower-left-hand corner of the Access Analyzer Console shows the number of jobs currently
+running.
## View Host
@@ -115,8 +115,8 @@ Scheduler.
Click the **View Schedule** link to display the corresponding Scheduled Task for the running job or
-job group. This link is only enabled for jobs that are running via scheduled task and will not be
-enabled for interactive job executions.
+job group. The **View Schedule** link is only enabled for jobs that are running via scheduled task
+and will not be enabled for interactive job executions.
@@ -129,5 +129,5 @@ The job execution can be stopped if needed.
-Click **Stop** to abort all instances in the job queue. This link is only enabled while a job is
-running.
+Click **Stop** to abort all instances in the job queue. The **Stop** link is only enabled while a
+job is running.
diff --git a/docs/accessanalyzer/12.0/admin/schedule/overview.md b/docs/accessanalyzer/12.0/admin/schedule/overview.md
index 2f018bdfee..89586fbefb 100644
--- a/docs/accessanalyzer/12.0/admin/schedule/overview.md
+++ b/docs/accessanalyzer/12.0/admin/schedule/overview.md
@@ -35,7 +35,7 @@ Jobs can be scheduled at the job group or job level.
-Select the desired job group or job. Right-click on the node and select **Schedule** to open the
+Select the job group or job you want. Right-click the node and select **Schedule** to open the
Schedule wizard.
diff --git a/docs/accessanalyzer/12.0/admin/schedule/renamewizard.md b/docs/accessanalyzer/12.0/admin/schedule/renamewizard.md
index 9c810df14a..1c0a23a96c 100644
--- a/docs/accessanalyzer/12.0/admin/schedule/renamewizard.md
+++ b/docs/accessanalyzer/12.0/admin/schedule/renamewizard.md
@@ -12,11 +12,11 @@ to provide the credentials needed for the scheduled task, so that the task is st
after it has been renamed. Custom credentials are configured on the Run as page of the Schedule
wizard. See the [Run As](wizard.md#run-as) topic for additional information.
-If a scheduled task does not contain custom credentials, then the job, job group, inventory query,
+If a scheduled task doesn't contain custom credentials, then the job, job group, inventory query,
or discovery query can be renamed and the scheduled task is automatically renamed without requiring
the wizard.
-Follow the steps to update the credential for a scheduled task.
+Update the credential for a scheduled task.
@@ -29,7 +29,7 @@ for and click **Update**.
- If you are renaming a group that has sub-groups that use custom credentials, then the wizard
- displays these accounts even if the parent group does not use custom credentials. For sub-groups,
+ displays these accounts even if the parent group doesn't use custom credentials. For sub-groups,
the table additionally shows the path to the sub-group, and only the sub-groups that have custom
credentials set are displayed in the wizard. If there are multiple groups requiring credentials,
then all of them must be updated.
@@ -59,7 +59,7 @@ renamed.
-**Step 5 –** The Progress page shows a progress bar and message. Once the scheduled tasks have been
+**Step 5 –** The Progress page shows a progress bar and message. After the scheduled tasks are
renamed successfully, click **Finish** to close the wizard.
The scheduled tasks have now been renamed and will run as before . The modified task name shows in
diff --git a/docs/accessanalyzer/12.0/admin/schedule/wizard.md b/docs/accessanalyzer/12.0/admin/schedule/wizard.md
index 6b34dccbf0..15180745aa 100644
--- a/docs/accessanalyzer/12.0/admin/schedule/wizard.md
+++ b/docs/accessanalyzer/12.0/admin/schedule/wizard.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Schedule Wizard
-The schedule wizard allows you to configure scheduled tasks for jobs, job groups, Host Discovery
+Use the schedule wizard to configure scheduled tasks for jobs, job groups, Host Discovery
queries, and Host Inventory queries. The wizard has five wizard pages with options for setting up
the schedule task:
@@ -17,8 +17,8 @@ the schedule task:
- [Options](#options)
On the Schedule page, click **New** to schedule when the task will run. The Host List and Connection
-pages are optional customizations. See the relevant section below for more information on the
-settings on each wizard page.
+pages are optional customizations. See the relevant section in the preceding list for more
+information on the settings on each wizard page.
When the settings on the wizard pages are configured as desired, click **OK** to save the changes
and close the window. The task is visible in the Schedule Actions view, at the Schedules node.
@@ -54,7 +54,7 @@ The options in the Trigger window are:
Days [value] of the month or the [value] [Day of the Week] of the month. By default, this is
set to recur every month. To select only specific months, use Months dropdown menu and
deselect the undesired months.
- - The drop-down menu next to **Start** opens a calendar view for selecting the date
+ - The dropdown menu next to **Start** opens a calendar view for selecting the date
- Selecting the **Synchronize across time zones** checkbox will synchronize the scheduled task
to run without respect to the time zone
@@ -78,7 +78,7 @@ configuration of this tab is optional.
-Choose the desired setting from the following options:
+Choose the setting you want from the following options:
- Use Host list from Job – A default setting and applies the host list designated at the job or job
group level. This is also the recommended setting.
@@ -95,7 +95,7 @@ queried by the task being scheduled. Customizations to the configuration of this
-Choose the desired setting from the following options:
+Choose the setting you want from the following options:
- Use Profile from Job – A default setting and applies the Connection Profile designated at the job
or job group level
@@ -123,7 +123,7 @@ The options on the Run as wizard page are:
- Use default Schedule Service Account – Uses the default Schedule Service Account that is set at
the **Settings** > **Schedule** node
- Use selected Schedule Service Account – Select the Schedule Service Account to use for the task
- from a list of available accounts in the drop-down menu
+ from a list of available accounts in the dropdown menu
- Use Custom Credentials – Use custom credentials not stored in the Access Analyzer Console. Enter
the User Name for the custom credentials.
diff --git a/docs/accessanalyzer/12.0/admin/schema/sqldc/coretables/overview.md b/docs/accessanalyzer/12.0/admin/schema/sqldc/coretables/overview.md
index f0ffba48f0..02edc15bb3 100644
--- a/docs/accessanalyzer/12.0/admin/schema/sqldc/coretables/overview.md
+++ b/docs/accessanalyzer/12.0/admin/schema/sqldc/coretables/overview.md
@@ -49,7 +49,7 @@
|---|---|---|---|---|---|---|---|
| id | int | | No | PK | | IDENTITY | Surrogate primary key |
| instance_id | int | | No | | | | Reference to the hosting SQL Server instance |
-| active_database_id | int | | Yes | | FK | | FK to `SA_SQLServer_Databases.id`; links to the currently active database record |
+| active_database_id | int | | Yes | | FK | | FK to `SA_SQLServer_Databases.id`; links to the active database record |
| name | nvarchar | 128 | No | | | | Database name as recorded in audit events |
| minimum_event_datetime | datetime2 | | Yes | | | | Earliest event timestamp recorded for this database |
@@ -715,7 +715,7 @@
**Indexes:** `UQ_SA_SQLServer_Events_StaleDataLookup` on `(file_id, event_time)` (nonclustered, non-unique despite UQ_ prefix)
-> **Note:** Despite the `UQ_` prefix used in some environments, this index is **not unique** per the live schema (`is_unique = 0`).
+> **Note:** Despite the `UQ_` prefix used in some environments, this index **isn't unique** per the live schema (`is_unique = 0`).
---
@@ -950,7 +950,7 @@
| instance_id | int | | No | PK | | IDENTITY | Auto-incrementing surrogate primary key |
| instance_label | nvarchar | 256 | No | | | | Unique display label for the instance |
| service_name | nvarchar | 128 | Yes | | | | Named instance or service/database name |
-| is_active | bit | | No | | | `1` | Whether the instance is currently active for data collection |
+| is_active | bit | | No | | | `1` | Whether the instance is active for data collection |
| enable_impersonation | bit | | No | | | `0` | Whether Windows impersonation is enabled for connecting to this instance |
| database_type | int | | No | | | | Database platform type (see Section 6.11) |
| host_name | nvarchar | 150 | No | | | | Server hostname or IP address |
diff --git a/docs/accessanalyzer/12.0/admin/schema/sqldc/enumeration/overview.md b/docs/accessanalyzer/12.0/admin/schema/sqldc/enumeration/overview.md
index 8ff9afaedf..207c7a009f 100644
--- a/docs/accessanalyzer/12.0/admin/schema/sqldc/enumeration/overview.md
+++ b/docs/accessanalyzer/12.0/admin/schema/sqldc/enumeration/overview.md
@@ -91,7 +91,7 @@ Referenced by `SA_SQLServer_ServerPermissions.class` and `SA_SQLServer_DatabaseP
## Permission Names (`SA_SQLServer_PermissionNames`)
-Referenced by `SA_SQLServer_ServerPermissions.type` and `SA_SQLServer_DatabasePermissions.type`. Values are populated at runtime from `sys.server_permissions` and `sys.database_permissions`. The table below lists commonly encountered permission names; additional permissions may be present depending on SQL Server version and features in use.
+Referenced by `SA_SQLServer_ServerPermissions.type` and `SA_SQLServer_DatabasePermissions.type`. Values are populated at runtime from `sys.server_permissions` and `sys.database_permissions`. The following table lists commonly encountered permission names; additional permissions may be present depending on SQL Server version and features in use.
| Code | Permission Name |
|---|---|
@@ -121,7 +121,7 @@ Referenced by `SA_SQLServer_ServerPermissions.type` and `SA_SQLServer_DatabasePe
## Audit Class Types (`SA_SQLServer_AuditClassType`)
-Referenced by `SA_SQLServer_AuditActions.class_type` and `SA_SQLServer_Events.class_type`. The full list contains 107 entries; the most commonly encountered types are shown below.
+Referenced by `SA_SQLServer_AuditActions.class_type` and `SA_SQLServer_Events.class_type`. The full list contains 107 entries; the following table shows the most commonly encountered types.
| Code | Description | Code | Description |
|---|---|---|---|
@@ -148,7 +148,7 @@ Referenced by `SA_SQLServer_AuditActions.class_type` and `SA_SQLServer_Events.cl
## Audit Actions (Common) (`SA_SQLServer_AuditActions`)
-Referenced by `SA_SQLServer_Events.action_id`. The full list contains 173 action definitions; frequently referenced actions are shown below.
+Referenced by `SA_SQLServer_Events.action_id`. The full list contains 173 action definitions; the following sections show frequently referenced actions.
**Login / Logout Actions:**
@@ -265,13 +265,13 @@ Used to compute the `Database Type` column in `SA_SQLServer_EffectiveRoleMembers
| `5` | MySql | MySQL |
| `6` | AzureSqlServerManagedInstance | Azure SQL Managed Instance |
| `7` | SaDataSource | StealthAUDIT Data Source |
-| `8` | AWSPostgres | AWS PostgreSQL (not currently supported) |
-| `9` | AWSMySql | AWS MySQL (not currently supported) |
-| `10` | EDBPostgreSql | EDB PostgreSQL (not currently supported) |
-| `11` | SqlServerCluster | SQL Server Cluster (not currently supported) |
+| `8` | AWSPostgres | AWS PostgreSQL (not supported) |
+| `9` | AWSMySql | AWS MySQL (not supported) |
+| `10` | EDBPostgreSql | EDB PostgreSQL (not supported) |
+| `11` | SqlServerCluster | SQL Server Cluster (not supported) |
| `12` | Db2LUW | IBM Db2 LUW |
| `20` | MongoDb | MongoDB |
:::note
Within the SQL Server Data Collector context, only values `0` (Unset), `1` (SqlServer), `2` (AzureSqlServer), and `6` (AzureSqlServerManagedInstance) are applicable. The remaining values are used by other database collector modules that share the `SA_SQL_Instances` table.
-:::
\ No newline at end of file
+:::
diff --git a/docs/accessanalyzer/12.0/admin/schema/sqldc/reportingtables/overview.md b/docs/accessanalyzer/12.0/admin/schema/sqldc/reportingtables/overview.md
index 024266a3db..bb5584d4c6 100644
--- a/docs/accessanalyzer/12.0/admin/schema/sqldc/reportingtables/overview.md
+++ b/docs/accessanalyzer/12.0/admin/schema/sqldc/reportingtables/overview.md
@@ -1,6 +1,6 @@
# Reporting Tables
-The following 59 tables are **denormalized reporting tables** populated by NAA analysis jobs. They use human-readable column names with spaces (e.g., `"Database Type"`, `"Instance"`) and are designed for direct consumption by the NAA console and reports. They do not participate in foreign key relationships with the core tables.
+The following 59 tables are **denormalized reporting tables** populated by NAA analysis jobs. They use human-readable column names with spaces (e.g., `"Database Type"`, `"Instance"`) and are designed for direct consumption by the NAA console and reports. They don't participate in foreign key relationships with the core tables.
:::note
All reporting tables share a common `Database Type` column (varchar/nvarchar) that identifies the SQL Server platform variant (e.g., `"SQL Server"`, `"Azure SQL Database"`, `"Azure SQL Managed Instance"`). None of these tables have primary keys or foreign keys — they are heap tables optimized for bulk INSERT/TRUNCATE patterns.
@@ -625,7 +625,7 @@ All reporting tables share a common `Database Type` column (varchar/nvarchar) th
| Database | nvarchar | 128 | Yes | | Database name |
| Schema | nvarchar | 128 | Yes | | Schema name |
| Table | nvarchar | 128 | Yes | | Table name containing sensitive data |
-| Criteria | nvarchar | MAX | Yes | | Matched SDD criteria name(s) |
+| Criteria | nvarchar | MAX | Yes | | Matched SDD criteria names |
| Table Row Count | bigint | | Yes | | Total rows in the table |
| Match Count | bigint | | Yes | | Number of sensitive data matches |
| Match Types | nvarchar | MAX | Yes | | Types of matches found |
@@ -679,7 +679,7 @@ All reporting tables share a common `Database Type` column (varchar/nvarchar) th
| Client | nvarchar | 128 | Yes | | Client IP or hostname |
| Application | nvarchar | 128 | Yes | | Application name |
| Action | nvarchar | 56 | Yes | | Action type (SELECT, INSERT, UPDATE, etc.) |
-| Criteria | nvarchar | 256 | Yes | | SDD criteria name(s) for the object |
+| Criteria | nvarchar | 256 | Yes | | SDD criteria names for the object |
| Match Data | nvarchar | 256 | Yes | | Sample match data |
---
@@ -710,7 +710,7 @@ All reporting tables share a common `Database Type` column (varchar/nvarchar) th
| Instance | nvarchar | 128 | Yes | | SQL Server instance name |
| Database | nvarchar | 128 | Yes | | Database name |
| Object | nvarchar | 128 | Yes | | Object name containing sensitive data |
-| Criteria | nvarchar | MAX | Yes | | SDD criteria name(s) |
+| Criteria | nvarchar | MAX | Yes | | SDD criteria names |
| Permission | nvarchar | 128 | Yes | | Permission name |
| Grantee | nvarchar | 513 | Yes | | Grantee principal |
| Grantee Id | nvarchar | 128 | Yes | | Grantee identifier |
diff --git a/docs/accessanalyzer/12.0/admin/schema/sqldc/views/overview.md b/docs/accessanalyzer/12.0/admin/schema/sqldc/views/overview.md
index 2d74f9ba6a..06a84c8dd1 100644
--- a/docs/accessanalyzer/12.0/admin/schema/sqldc/views/overview.md
+++ b/docs/accessanalyzer/12.0/admin/schema/sqldc/views/overview.md
@@ -117,7 +117,7 @@
| is_policy_checked | bit | | No | SA_SQLServer_SqlLogins.is_policy_checked | Whether password policy is enforced |
| is_expiration_checked | bit | | No | SA_SQLServer_SqlLogins.is_expiration_checked | Whether password expiration is enforced |
| password_hash | varbinary | 256 | Yes | SA_SQLServer_SqlLogins.password_hash | Hashed password value |
-| is_locked | bit | | Yes | SA_SQLServer_SqlLogins.is_locked | Whether the account is currently locked out |
+| is_locked | bit | | Yes | SA_SQLServer_SqlLogins.is_locked | Whether the account is locked out |
| is_expired | bit | | Yes | SA_SQLServer_SqlLogins.is_expired | Whether the password has expired |
| is_must_change | bit | | Yes | SA_SQLServer_SqlLogins.is_must_change | Whether the password must be changed at next login |
| password_hash_algorithm | int | | Yes | SA_SQLServer_SqlLogins.password_hash_algorithm | Algorithm used to hash the password |
diff --git a/docs/accessanalyzer/12.0/admin/settings/access/restapi/assignappaccess.md b/docs/accessanalyzer/12.0/admin/settings/access/restapi/assignappaccess.md
index 0ba777e48c..2f702889a0 100644
--- a/docs/accessanalyzer/12.0/admin/settings/access/restapi/assignappaccess.md
+++ b/docs/accessanalyzer/12.0/admin/settings/access/restapi/assignappaccess.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# Assign Application Access through the Web Service
-An application can be assigned to access data remotely through the Web Service. Follow the steps to
-assign roles in the Console.
+An application can be assigned to access data remotely through the Web Service. Assign roles in the
+Console:
@@ -50,11 +50,11 @@ name** box to filter the list of objects by the characters entered.
app token.
- Application name – The name of the application accessing that data
-- Access Expiration – The expiration for the client secret. Select an option for the desired access
- expiration:
+- Access Expiration – The expiration for the client secret. Select the access expiration option
+ you want:
- - Access expires within – Select a time frame from the drop-down list. The default is 72 hours.
- - Access expires on specified date – Select a date from the drop-down list
+ - Access expires within – Select a time frame from the dropdown list. The default is 72 hours.
+ - Access expires on specified date – Select a date from the dropdown list
- Generate – Click this button to generate the Client ID and Client secret
- Client ID – Copy the Client ID into the application accessing data remotely through the Web
diff --git a/docs/accessanalyzer/12.0/admin/settings/access/restapi/getdata.md b/docs/accessanalyzer/12.0/admin/settings/access/restapi/getdata.md
index 34b83c7c1a..7a08b58078 100644
--- a/docs/accessanalyzer/12.0/admin/settings/access/restapi/getdata.md
+++ b/docs/accessanalyzer/12.0/admin/settings/access/restapi/getdata.md
@@ -28,7 +28,7 @@ GET, POST
- **object-name** – Required value that specifies the unique object name.
- **alias-name** – Required value that specifies the unique alias associated with the table, available as a more thoughtfully designed namespace.
- **jobRuntimeKey**(Optional) – The execution to retrieve information for. If this is omitted the latest report is provided.
-- **filters** (Optional) – A filter to be applied prior to returning data, multiple filters are applied with `and` operators. If an array is specified for the value field for a filter, the filter returns any successful match from the array of values. String comparisons are case insensitive. A list of the available functions is below. Filter functions:
+- **filters** (Optional) – A filter to be applied before returning data, multiple filters are applied with `and` operators. If an array is specified for the value field for a filter, the filter returns any successful match from the array of values. String comparisons are case insensitive. The following filter functions are available:
- equals
- not_equals
- greater (greater_equal)
@@ -81,7 +81,7 @@ Sample JSON response:
**ERRORS**
- 400 One or more the parameters passed in are invalid.
-- 404 The object requested does not exist.
+- 404 The object requested doesn't exist.
## PROC
@@ -100,7 +100,7 @@ POST
**PARAMETERS**
- **object-name** – Required value that specifies the unique object name.
-- **groupby**(Optional) – A list of columns to group each row by, resulting in a JSON object that contains those keys followed by an array of entries. The parameters passed in here are passed to the stored procedure untouched. Arrays are mapped to a user defined table type, currently only single value arrays are supported.
+- **groupby**(Optional) – A list of columns to group each row by, resulting in a JSON object that contains those keys followed by an array of entries. The parameters passed in here are passed to the stored procedure untouched. Arrays are mapped to a user defined table type, only single value arrays are supported.
Sample JSON request:
@@ -139,4 +139,4 @@ Sample JSON request:
**ERRORS**
- 400 One or more the parameters passed in are invalid.
-- 404 The object requested does not exist.
+- 404 The object requested doesn't exist.
diff --git a/docs/accessanalyzer/12.0/admin/settings/access/restapi/obtaintoken.md b/docs/accessanalyzer/12.0/admin/settings/access/restapi/obtaintoken.md
index 4fd23ba3f2..c081205113 100644
--- a/docs/accessanalyzer/12.0/admin/settings/access/restapi/obtaintoken.md
+++ b/docs/accessanalyzer/12.0/admin/settings/access/restapi/obtaintoken.md
@@ -38,7 +38,7 @@ article for additional information.
:::
-If the token does not have the ability to perform this request, is invalid, or the specific resource
+If the token doesn't have the ability to perform this request, is invalid, or the specific resource
has been blocked from access remotely, an HTTP status code of 401 is returned.
If the request for an access token is valid, the authorization server generates an access token and
diff --git a/docs/accessanalyzer/12.0/admin/settings/access/restapi/refreshtoken.md b/docs/accessanalyzer/12.0/admin/settings/access/restapi/refreshtoken.md
index a52d82f245..1f362eb0c9 100644
--- a/docs/accessanalyzer/12.0/admin/settings/access/restapi/refreshtoken.md
+++ b/docs/accessanalyzer/12.0/admin/settings/access/restapi/refreshtoken.md
@@ -11,8 +11,8 @@ refresh token when the access token expires.
- `grant_type` (Required) – The `grant_type` parameter must be set to `client_credentials`
- `refresh_token` (Required) – The refresh token previously issue to the client
-- `scope` (Optional) – The requested scope must not include additional scopes that were not issued
- in the original access token. If the scope is not included in the request, the service issues an
+- `scope` (Optional) – The requested scope must not include additional scopes that weren't issued
+ in the original access token. If the scope isn't included in the request, the service issues an
access token with the same scope as previously issued.
- Client Authentication – Required if the client was issued a secret
@@ -30,11 +30,11 @@ grant_type=refresh_token
&client_secret=xxxxxxxxxx
```
-If the token does not have the ability to perform this request, is invalid, or the specific resource
+If the token doesn't have the ability to perform this request, is invalid, or the specific resource
has been blocked from access remotely, an HTTP status code of 401 is returned.
The response for a refresh token is the same as the response for an access token. Optionally, a new
-refresh token can be included in the response. If a new refresh token is not included in the
+refresh token can be included in the response. If a new refresh token isn't included in the
response, the current refresh token will continue to be valid. The following example shows a
successful access token response:
diff --git a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/assignroles.md b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/assignroles.md
index bfb8323205..1fce927d89 100644
--- a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/assignroles.md
+++ b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/assignroles.md
@@ -17,7 +17,7 @@ roles and enable Role Based Access.
:::
-Follow the steps to assign roles in the Access Analyzer Console.
+Assign roles in the Access Analyzer Console:
@@ -37,7 +37,7 @@ ellipsis (**…**) to browse for accounts with the Select User or Group window.
[Group Managed Service Accounts](https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview)
article for additional information.
- - Change the location to the desired domain and click **Object Types**, then select **Service
+ - Change the location to the domain you want and click **Object Types**, then select **Service
Accounts**.
- Add the gMSA name (`gMSAadmin$`), then click **OK**.
- The Member Type will show as `msDS-GroupManagedServiceAccount` on the Access page.
@@ -50,11 +50,11 @@ user and role is added to the Role Membership list in the Roles view.
**Step 5 –** Repeat Steps 1-4 to assign roles to other groups or users.
**Step 6 –** Click **Save** and then **OK** to confirm the changes. All applied roles are lost if
-they are not saved.
+they aren't saved.
Role Based Access is enabled when the first role has been assigned.
-
+
The first role or set of roles saved must include the Administrator role. Clicking **Save** for the
first role or set or roles without including the Administrator generates an error message in the
@@ -64,11 +64,11 @@ When Role Based Access is first enabled, restart the Access Analyzer application
are properly active. When saving roles for the first time, an NEAUsers local group is created on the
Access Analyzer Console server with permissions to the Access Analyzer application directory. When
users are assigned roles, they are added to this NEAUsers group to give them the necessary
-permissions. This allows roles to be leveraged without requiring local Administrator rights.
+permissions. This allows roles to be used without requiring local Administrator rights.
:::note
-The Web Administrator and Report Viewer roles do not require access to the Access Analyzer
-console, so users assigned these roles are not added to the NEAUsers group.
+The Web Administrator and Report Viewer roles don't require access to the Access Analyzer
+console, so users assigned these roles aren't added to the NEAUsers group.
:::
@@ -81,11 +81,11 @@ There are two separate sets of permissions:
## Edit Role Members' Responsibilities
-Follow the steps to edit a Access Analyzer user’s role.
+Edit an Access Analyzer user's role:
-**Step 1 –** On the Access page, select the desired user and click **Edit Member Role**.
+**Step 1 –** On the Access page, select the user and click **Edit Member Role**.
@@ -96,7 +96,7 @@ Follow the steps to edit a Access Analyzer user’s role.
**Step 4 –** Repeat Steps 1-3 to edit other users’ roles.
**Step 5 –** Click **Save** and then **OK** to confirm the changes. All applied roles are lost if
-they are not saved.
+they aren't saved.
The changed roles take affect the next time the users logs into the Access Analyzer application. If
a user is actively logged into Access Analyzer at the same time the role for that user is changed,
@@ -104,11 +104,11 @@ then the user needs to exit and re-launch the application for the role to take e
## Delete Role Member
-Follow the steps to delete a user from having access to the Access Analyzer Console.
+Delete a user's access to the Access Analyzer Console:
-**Step 1 –** On the Access page, select the desired user and click **Delete Role Member**. The
+**Step 1 –** On the Access page, select the user and click **Delete Role Member**. The
selected user will be removed from the list.
:::note
@@ -120,7 +120,7 @@ is completed.
**Step 2 –** Repeat Step 1 to remove other users as desired.
**Step 3 –** Click **Save** and then **OK** to confirm the deletions. The users will not be deleted
-if the changes are not saved.
+if the changes aren't saved.
The deleted users will no longer be able to log into the Access Analyzer application. If a user is
actively logged into Access Analyzer at the same time of the deletion, the user will need to exit
diff --git a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/configureroles.md b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/configureroles.md
index 44168e3ca4..1df8150885 100644
--- a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/configureroles.md
+++ b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/configureroles.md
@@ -23,7 +23,7 @@ This is a three-part process:
- Delete Role Members
:::note
-This configuration process is not required if only using Role Based Access to secure
+This configuration process isn't required if only using Role Based Access to secure
Published Reports. See the [Securing Published Reports Only](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/securereports.md) topic for additional
information.
:::
@@ -32,7 +32,7 @@ information.
## Configure the Installation Account
The Access Analyzer Installation Account is used both to perform the initial installation of Access
-Analyzer and to change Storage Profile settings. It needs additional rights in order to query
+Analyzer and to change Storage Profile settings. It needs additional rights to query
objects in the master database. This is only necessary so the user can enumerate the available
databases to choose from when configuring the Access Analyzer Storage Profile.
@@ -56,15 +56,15 @@ GO
## Configure Roles in SQL Management Studio
-It is necessary to provision rights to the SQL Server database so the Access Analyzer application
+Provision rights to the SQL Server database so the Access Analyzer application
rights and database access rights are consistent and provide the minimum rights necessary to support
the Access Analyzer roles. This approach involves creating custom database roles which will be
assigned rights and privileges. Then, individual domain user accounts must be assigned to these
roles.
:::note
-For any SQL Server version prior to 2012, Windows groups cannot be used because SQL Server
-does not allow the assignment of default schemas to Windows groups. Access Analyzer requires the
+For any SQL Server version before 2012, Windows groups can't be used because SQL Server
+doesn't allow the assignment of default schemas to Windows groups. Access Analyzer requires the
default schema of [dbo] to function properly.
:::
@@ -76,7 +76,7 @@ To create the roles within the SQL Server database, run the following script.
Be sure to set the context of this query to the Access Analyzer database by selecting the right
-database from the drop-down window. Alternatively, prefix the script with a
+database from the dropdown window. Alternatively, prefix the script with a
`USE [Access Analyzer DATABASE NAME]` clause.
```
@@ -118,13 +118,13 @@ GO
```
-Once the script has been successfully executed, assign domain users to these database roles.
+After the script executes successfully, assign domain users to these database roles.
### Assigning Users to SQL Roles
Now that the SQL Server database roles have been created the next step is to assign domain users to
-those roles. This can be done interactively in SQL Management Studio. Follow the steps to assign
-users to SQL Server database roles.
+those roles. This can be done interactively in SQL Management Studio. Assign users to SQL Server
+database roles:
**Step 1 –** Connect to the Access Analyzer database through SQL Management Studio.
@@ -142,7 +142,7 @@ users to SQL Server database roles.
|  |
**Step 3 –** After confirmation of role creation, the next step is to map users to these roles.
-Right-click on the **Security** > **Users** node and select **New User**.
+Right-click the **Security** > **Users** node and select **New User**.
diff --git a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/customroles.md b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/customroles.md
index a7ba65d4c0..a4779e40f3 100644
--- a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/customroles.md
+++ b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/customroles.md
@@ -7,10 +7,11 @@ sidebar_position: 20
# Custom Roles
A custom role can be created within Access Analyzer to combine the rights of other defined roles.
-Follow the steps below to create a custom role.
+
+## Create a Custom Role
**Step 1 –** In the Access Analyzer directory, navigate to **PrivateAssemblies** and edit the
-**rba-roles.conf** file. Add a new section for the custom role as shown in the following
+**rba-roles.conf** file. Add a new section for the custom role as shown in the following
instructions:
```
@@ -23,24 +24,24 @@ instructions:
```
-- Replace `Special User` between the double quotes in the script above with the name of the new
+- Replace `Special User` between the double quotes in the preceding script with the name of the new
role.
-- Replace `Description of Special User` between the double quotes in the script above with a
- description of what a user assigned the new role is able to do.
+- Replace `Description of Special User` between the double quotes in the preceding script with a
+ description of what a user assigned the new role can do.
-**Step 2 –** Add privileged values for the desired rights on new lines between the beginning comment
-`` and ending comment `` in the script above.
+**Step 2 –** Add privileged values for the rights you want on new lines between the beginning comment
+`` and ending comment `` in the preceding script.
- For example, to create a single role which has the same privileges as the Host Management
Administrator and Global Options Administrator roles, copy the privileges from the sections of the
**rba-roles.conf** file to the newly added section, and remove duplicate values if there is any
overlap.
-See the sections below for examples of how roles should be added in the **rba-roles.conf** file.
+See the following sections for examples of how roles should be added in the **rba-roles.conf** file.
## Default Global Options Administrator Privileges
-The following example shows what is currently contained in the Global Options Administrator role,
+The following example shows what is contained in the Global Options Administrator role,
and how the created role should be added in the **rba-roles.conf** file.
```
@@ -85,7 +86,7 @@ and how the created role should be added in the **rba-roles.conf** file.
## Default Host Management Administrator Privileges
-The following example shows what is currently contained in the Host Management Administrator role,
+The following example shows what is contained in the Host Management Administrator role,
and how the created role should be added in the **rba-roles.conf** file.
```
diff --git a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/faq.md b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/faq.md
index 66ee5ad4b3..b1bc7f2c08 100644
--- a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/faq.md
+++ b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/faq.md
@@ -17,22 +17,22 @@ only locked jobs can be run. Therefore, the Job Initiator can only run or schedu
already been locked.
:::note
-Locked jobs do not affect the functionality of the Administrator role. See the
+Locked jobs don't affect the functionality of the Administrator role. See the
[Role Definitions](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/roledefinitions.md) topic for more information.
:::
-How can I make sure that a lock on a job will not get tampered with through the associated XML file?
+How does Access Analyzer protect a lock on a job from tampering through the associated XML file?
The Scheduling Service Account provides limited rights for the Job Approver. Previously, the Job
-Approver required permissions on the Jobs folder in order to apply the lock to a job. Now, the
-credentials specified in the Scheduling Service Account will be used to apply the locks. Therefore,
-the Job Approver no longer needs access to the Jobs folder and cannot manually remove or tamper with
+Approver required permissions on the Jobs folder to apply the lock to a job. Now, Access Analyzer
+uses the credentials specified in the Scheduling Service Account to apply the locks. Therefore,
+the Job Approver no longer needs access to the Jobs folder and can't manually remove or tamper with
the associated XML file.
:::note
-If using a Job Initiator’s credentials for a Schedule Service Account, all jobs must be
-locked in order for them to be executed. See the [Role Definitions](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/roledefinitions.md) and
+If the Schedule Service Account uses a Job Initiator's credentials, all jobs must be
+locked before they run. See the [Role Definitions](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/roledefinitions.md) and
[Roles & the Schedule Service Account](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/scheduleserviceaccount.md) topics for more information.
:::
@@ -41,33 +41,33 @@ Why can the Host Management Administrator not manage settings for the Host Disco
Inventory nodes under Settings?
The Host Management Administrator role is designed specifically to access the Host Management node.
-Therefore, this role does not grant access to the global settings menu under the Settings node.
+Therefore, this role doesn't grant access to the global settings menu under the Settings node.
:::note
-In order to access this node, the user must have either the Administrator or the Global
+to access this node, the user must have either the Administrator or the Global
Options Administrator role. See the [Role Definitions](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/roledefinitions.md) topic for more
information.
:::
-What rights do I need to give the user on the local machine in order to use Access Analyzer?
+What rights does the user need on the local machine to use Access Analyzer?
Enabling Role Based Access removes the necessity to explicitly provide users rights on the Access
Analyzer folder structure. Instead, when the Administrator role is first assigned and Role Based
-Access is enabled, a new local group called NEAUsers is created on Access Analyzer Console server.
-This NEAUsers group is given the necessary permissions on the Access Analyzer application directory.
-When a user is assigned a role, they are added to the NEAUsers group to give them the necessary
-access to Access Analyzer.
+Access is enabled, Access Analyzer creates a new local group called NEAUsers on the Access Analyzer
+Console server. Access Analyzer grants the NEAUsers group the necessary permissions on the Access Analyzer application directory.
+When you assign a user a role, Access Analyzer adds them to the NEAUsers group to give them the
+necessary access to Access Analyzer.
See the [Assign User to Role Members](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/assignroles.md) topic for additional information.
When a user’s role is changed, when does the new role take affect?
-If a user’s role has been altered while they are in an active Access Analyzer session, the user must
+If you change a user's role while they're in an active Access Analyzer session, the user must
exit the Access Analyzer Console and re-open the application for the new role to take effect. This
-is also true if a user has been given an additional role or removed from role membership. The
-capabilities of the new role will not come into effect until the Access Analyzer application has
-been restarted.
+is also true if you give a user an additional role or remove them from role membership. The
+capabilities of the new role don't take effect until the user restarts the Access Analyzer
+application.
:::note
See the
@@ -76,18 +76,18 @@ See the
:::
-I locked a job, but when going back to it, it appears to be unlocked. Why?
+A job was locked, but it now appears unlocked. Why?
-A locked job signifies that the job has been approved for execution and should not be modified. If a
-job is modified in any way, the lock is immediately removed. Although most roles should not be able
-to modify locked jobs, the Administrator role can. This role is not governed by the limitations of
-Role Based Access. Thus, if a locked job is modified by an Administrator, the job will become
-unlocked. This event will be logged as a job-change related event by Administrator in the Access
-Analyzer Event Log.
+A locked job signifies that the Job Approver approved the job for execution and that no one should
+modify it. If anyone modifies a job in any way, Access Analyzer immediately removes the lock.
+Although most roles shouldn't be able to modify locked jobs, the Administrator role can, because
+Role Based Access limitations don't govern this role. Thus, if an Administrator modifies a locked
+job, the job becomes unlocked. The Access Analyzer Event Log records this event as a job-change-related
+event performed by the Administrator.
:::note
-If using a Job Initiator’s credentials for the Schedule Service Account, all jobs must be
-locked in order for them to execute. See the [Role Definitions](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/roledefinitions.md),
+If the Schedule Service Account uses a Job Initiator's credentials, all jobs must be
+locked before they can execute. See the [Role Definitions](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/roledefinitions.md),
[Workflow with Role Based Access Enabled](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/workflow.md), and [Roles and the Event Log](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/eventlog.md)
topics for more information.
:::
@@ -96,13 +96,12 @@ topics for more information.
What should be the group type when assigning Role Based Access to an AD group in a multi-domain
environment?
-When assigning an Role Based Access to an AD group, it is important to consider the domain
+When assigning Role Based Access to an AD group, consider the domain
relationship between the AD group and the Access Analyzer server.
If the Access Analyzer server and the AD group are in different domains then the AD group must be a
-universal group. If the group type is not universal then it will result in the RBA being unable to
-access the user's group membership and the user who is a member of that AD group will be unable to
-view any reports.
+universal group. If the group type isn't universal, RBA can't access the user's group membership,
+and the user in that AD group can't view any reports.
However, if both the Access Analyzer server and the AD group are in the same domain, the AD group
can be either a local group, global group, or universal group.
diff --git a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/overview.md b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/overview.md
index fe3207808c..8809e547d6 100644
--- a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/overview.md
+++ b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/overview.md
@@ -6,48 +6,48 @@ sidebar_position: 10
# Role Based Access
-Role Based Access allows Access Analyzer users to not have local Administrator rights on the console
-server. This is done through the creation of different roles which cover all aspects of the Access
-Analyzer work flow introduced by enabling Role Based Access. These roles can be leveraged without
-such elevated rights. Responsibilities within the Access Analyzer Console have been divided among
-these roles.
-
-Role Based Access also allows users to secure published reports when accessed through the Web
-Console. This is done by first enabling Role Based Access and then by assigning users/groups as
-viewers to the reports to which they should have access.
-
-Report security through Role Based Access can be applied without implementing a least privileged
-access model to the Access Analyzer Console. See the
+Role Based Access allows Access Analyzer users to work without local Administrator rights on the
+console server. It does this by creating different roles that cover all aspects of the Access
+Analyzer workflow introduced by enabling Role Based Access. Users can use these roles without
+such elevated rights. Role Based Access divides responsibilities within the Access Analyzer
+Console among these roles.
+
+With Role Based Access, users can also secure published reports when accessed through the Web
+Console. To do this, first enable Role Based Access, then assign users or groups as viewers to
+the reports they should access.
+
+You can apply report security through Role Based Access without implementing a least privileged
+access model for the Access Analyzer Console. See the
[Securing Published Reports Only](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/securereports.md) topic for additional information.
:::note
-The least privileged access model to the Access Analyzer Console does not work in
-conjunction with the Exchange Solution. Role Based Access can be enabled, but the Administrator role
-is required to run the Exchange Solution jobs.
+The least privileged access model to the Access Analyzer Console doesn't work in
+conjunction with the Exchange Solution. You can enable Role Based Access, but running the
+Exchange Solution jobs requires the Administrator role.
:::
:::warning
-Please use caution when enabling Role Based Access, as it is a very powerful tool
-within the console designed to be difficult to disable once activated. If Role Based Access is
-enabled by accident, please contact [Netwrix Support](https://www.netwrix.com/support.html) for
+use caution when enabling Role Based Access, as it is a very powerful tool
+within the console designed to be difficult to disable once activated. If you enable Role Based
+Access by accident, contact [Netwrix Support](https://www.netwrix.com/support.html) for
assistance in disabling it.
:::
-The account used to perform the initial Access Analyzer installation, as well as to change Storage
-Profile settings after installation, require additional rights in order to query objects in the
+The account you use to perform the initial Access Analyzer installation, and to change Storage
+Profile settings after installation, requires additional rights to query objects in the
master database. See the
[Configure the Installation Account](configureroles.md#configure-the-installation-account) topic for
additional information on this account.
-To enable Role Based Access within Access Analyzer, corresponding roles must first be created within
-SQL Management Studio. Then Access Analyzer users must be assigned roles both in SQL Management
-Studio and in Access Analyzer.
+To enable Role Based Access within Access Analyzer, first create the corresponding roles in SQL
+Management Studio. Then assign roles to Access Analyzer users in both SQL Management Studio and
+Access Analyzer.
The first Access Analyzer user assigned a role must be an Administrator. Assigning this first user
role officially enables Role Based Access within Access Analyzer. When Role Based access is first
-enabled, an NEAUsers local group is created on the Access Analyzer server with the required
-permissions to the Access Analyzer application directory. When a user is assigned a role, they are
-added to the NEAUsers group to give them the necessary access. See the
+enabled, Access Analyzer creates an NEAUsers local group on the Access Analyzer server with the
+required permissions to the Access Analyzer application directory. When you assign a user a role,
+Access Analyzer adds them to the NEAUsers group to give them the necessary access. See the
[Assign User to Role Members](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/assignroles.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/roledefinitions.md b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/roledefinitions.md
index 194dd2456b..5e4daae4d7 100644
--- a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/roledefinitions.md
+++ b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/roledefinitions.md
@@ -6,19 +6,19 @@ sidebar_position: 10
# Role Definitions
-The following is a list of all roles leveraged within Access Analyzer once Role Based Access is
-enabled, including their intended functionality. A user may have more than one role assigned to
-them.
+The following is a list of all roles used within Access Analyzer once Role Based Access is
+enabled, including their intended functionality. You can assign a user more than one role.
:::note
-When a job is moved or copied to a separate job group, it inherits the assigned roles at
-the parent and global level from the new job group. Any previous role inheritance is overwritten.
+When you move or copy a job to a separate job group, it inherits the assigned roles at
+the parent and global level from the new job group. Access Analyzer overwrites any previous
+role inheritance.
:::
- OS Administrator – Used only for installation purposes
- - This is not not a configured role, but rather the access required during installation
+ - This isn't not a configured role, but rather the access required during installation
- Administrator – At least one must be set before any other roles are assigned
@@ -27,8 +27,8 @@ the parent and global level from the new job group. Any previous role inheritanc
- Rights to preform an upgrade on Access Analyzer
:::note
-In order to use Role Base Access with the Exchange Solution, all Exchange users must be
-assigned the Administrator role. This is because the solution requires local Administrator rights on
+to use Role Base Access with the Exchange Solution, assign all Exchange users the
+Administrator role. This is because the solution requires local Administrator rights on
the Access Analyzer Console server.
:::
@@ -58,8 +58,8 @@ the Access Analyzer Console server.
- Global Options Administrator
- Able to modify global settings, except for the **Setting** > **Access** node
- - The Exchange node is the exception due to its requirements. Therefore, this node cannot be
- modified by the Global Options Administrator.
+ - The Exchange node is the exception due to its requirements. Therefore, the Global Options
+ Administrator can't modify this node.
- Rights to view report Tags within the Web Console but not report content or permissions
- Host Management Administrator
@@ -120,8 +120,9 @@ the Access Analyzer Console server.
**Configure** > **Reports**> **Configure** > **Publish Security** page) – Able to view
only this report
-By default, many roles are granted rights to view all reports and report content. The inheritance of
-the Report Viewer role can be broken at the job group, job, or report configuration levels. See the
+By default, Access Analyzer grants many roles rights to view all reports and report content. You
+can break the inheritance of the Report Viewer role at the job group, job, or report configuration
+levels. See the
[Report Viewer Inheritance](#report-viewer-inheritance) topic for additional information.
## Access Analyzer Console Roles & Rights
@@ -198,15 +199,15 @@ This table describes the roles that will be created within the SQL Server databa
they will have to the Access Analyzer database. It also describes which Access Analyzer roles they
are mapped to.
-| Database Role(s) | Access Analyzer Role | Rights | Role Description |
+| Database Roles | Access Analyzer Role | Rights | Role Description |
| --------------------------------------------- | ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SMP Administrator db_datareader db_datawriter | Administrator Job Initiator Job Initiator (No Actions) | On the dbo schema: ALTER, EXECUTE, INSERT, UPDATE, REFERENCES On the Access Analyzer database: CREATE TABLE, CREATE VIEW, CREATE PROCEDURE, CREATE FUNCTION, CREATE TYPE | This role is used by full Administrators and Job Initiators who must run the 2-FSAA Bulk Import Job which requires manipulation of the Access Analyzer database |
| SMP Builder | Job Builder Host Management Administrator | On the dbo schema: ELECT, INSERT, DELETE On the Access Analyzer database: CREATE TABLE | This role is used by the Job Builder who must be able to create/delete tables, view data, and insert and delete hosts from the Access Analyzer Console |
-| SMP Viewer | Job Viewer Access Administrator Job Approver All other roles | On the dbo schema: SELECT | This role is used by all roles who do not require anything more than just reading data and information from the database |
+| SMP Viewer | Job Viewer Access Administrator Job Approver All other roles | On the dbo schema: SELECT | This role is used by all roles who don't require anything more than just reading data and information from the database |
## Report Viewer Inheritance
-When Role-Based Access is enabled, users assigned the following roles inherit rights to view all
+When you enable Role-Based Access, users assigned the following roles inherit rights to view all
reports and their content:
- Administrator role
@@ -218,10 +219,9 @@ reports and their content:
- Job Viewer
- Web Administrator
-Additional users can be assigned the Report Viewer role at the global, job group, job, or report
-configuration levels. These rights are inherited down through child objects. However, the Report
-Viewer role inheritance can be broken at any level. Break inheritance to remove the right to view
-specific reports at:
+You can assign additional users the Report Viewer role at the global, job group, job, or report
+configuration levels. Child objects inherit these rights. However, you can break the Report Viewer
+role inheritance at any level. Break inheritance to remove the right to view specific reports at:
- Job Group level – **[Job Group]** >**Settings** > **Reporting** node
- Job level – **[Job]** > **Properties** >**Report Roles** tab
@@ -245,5 +245,5 @@ There are two options that control inheritance for Report Viewers when selected:
Viewer role inherited from a parent object at the lower levels
- Set all the child objects to inherit these settings – Only available at the Job Group level. Sets
all Jobs and Reports to inherit group settings for all child objects by automatically selecting
- the **Include Report Viewers from this object’s parent** option. Any previous configurations are
- overwritten once **Yes** is selected in the confirmation window.
+ the **Include Report Viewers from this object’s parent** option. Access Analyzer overwrites any
+ previous configurations after you select **Yes** in the confirmation window.
diff --git a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/scheduleserviceaccount.md b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/scheduleserviceaccount.md
index d7a1d2e575..e062e56a0c 100644
--- a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/scheduleserviceaccount.md
+++ b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/scheduleserviceaccount.md
@@ -6,9 +6,9 @@ sidebar_position: 30
# Roles & the Schedule Service Account
-Once Role-Based Access is enabled, a user or group with the appropriate access role has the ability
+After you enable Role-Based Access, a user or group with the appropriate access role has the ability
to schedule a job or job group as a Schedule Service Account at the **Settings** > **Schedule**
-node. Multiple accounts can be added as needed.
+node. You can add multiple accounts as needed.
**Who Configures This Account?**
@@ -16,7 +16,7 @@ node. Multiple accounts can be added as needed.
- Power User role
- Global Options Administrator role
-Whose Credentials Should Be Used as the Schedule Service Account?
+Whose Credentials Should You Use for the Schedule Service Account?
- A user with either:
@@ -25,18 +25,18 @@ Whose Credentials Should Be Used as the Schedule Service Account?
- Job Initiator role
:::note
-In order to run or schedule a Host Inventory query, the Schedule Service Account must have
+to run or schedule a Host Inventory query, the Schedule Service Account must have
an Administrator, Power User, or Host Management Administrator role. Therefore, if the account has
the Job Initiator role assigned, it must have the Host Management Administrator role as well.
:::
-The Schedule Service Account is used to access the Task folders when scheduling tasks and to apply
-locks on jobs.
+Access Analyzer uses the Schedule Service Account to access the Task folders when scheduling tasks
+and to apply locks on jobs.
- Schedule Tasks
- - In order to have the appropriate level of rights to schedule tasks, the credentials specified
+ - to have the appropriate level of rights to schedule tasks, the credentials specified
must at least have the following:
- Create Files/Write Data rights on the Windows Task Folder
@@ -44,7 +44,7 @@ locks on jobs.
- Otherwise, they should have local Administrator privileges on the Access Analyzer Console
server
- - The user whose credentials are specified must also have a role that allows the scheduling of
+ - The user whose credentials are specified must also have a role that allows scheduling
tasks – Administrator, Power User, or Job Initiator
- Apply Locks
@@ -55,19 +55,19 @@ locks on jobs.
:::
- - These credentials are used to apply locks on jobs, enabling the Job Approver to have fewer
- rights on the Jobs directory. Therefore, the credentials specified must at least have the
- following:
+ - Access Analyzer uses these credentials to apply locks on jobs, which lets the Job Approver
+ have fewer rights on the Jobs directory. Therefore, the credentials specified must at least
+ have the following:
- Modify rights on this directory
- Otherwise, these credentials should have local Administrator privileges on the Access
Analyzer Console server
- - The Job Approver uses these credentials to apply locks. Therefore, the Job Approver must be
- added to the local policy **Impersonate a client after Authentication**.
+ - The Job Approver uses these credentials to apply locks. Therefore, you must add the Job
+ Approver to the local policy **Impersonate a client after Authentication**.
-Do not choose the **Use local System account to schedule tasks** option. This account does not have
-the appropriate rights to apply locks on jobs. Therefore, it does not work in conjunction with Role
+Don't choose the **Use local System account to schedule tasks** option. This account doesn't have
+the appropriate rights to apply locks on jobs. Therefore, it doesn't work in conjunction with Role
Based Access.
See the [Schedule](/docs/accessanalyzer/12.0/admin/settings/schedule.md) topic for additional instructions on configuring the Schedule
diff --git a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/securereports.md b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/securereports.md
index d440f0b810..91089fed8b 100644
--- a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/securereports.md
+++ b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/securereports.md
@@ -6,14 +6,14 @@ sidebar_position: 60
# Securing Published Reports Only
-In order to secure published reports through the Web Console, it is necessary to enable Role Based
-Access within the Access Analyzer Console. If that is the only reason the Role Based Access feature
-is being enabled, ensure the following requirements are met:
+To secure published reports through the Web Console, enable Role Based
+Access within the Access Analyzer Console. If that is the only reason you're enabling the Role
+Based Access feature, ensure you meet the following requirements:
- Administrator role assigned to all Access Analyzer Console users
- - Anyone not assigned an Administrator role are unable to access the Access Analyzer Console
- after Role Based Access is enabled
+ - Anyone without an Administrator role can't access the Access Analyzer Console after you
+ enable Role Based Access
- Web Administrator role assigned to individuals who should have access to all reports, tags, and
report permissions but not the Access Analyzer Console
@@ -25,7 +25,7 @@ is being enabled, ensure the following requirements are met:
- Job Level Assignment – Access to reports published by the job
- Report Configuration Level Assignment – Access to the specific report
-Follow the steps to assign roles at the global level.
+Assign roles at the global level as follows.
**Step 1 –** Navigate to the **Settings** > **Access** node.
@@ -44,8 +44,8 @@ ellipsis (**…**) to browse for accounts with the Select User or Group window.
-**Step 5 –** Select a role for the group or user from the Role list. Click **Finish**. The group or
-user and role is added to the Role Membership list in the Roles view.
+**Step 5 –** Select a role for the group or user from the Role list. Click **Finish**. Access
+Analyzer adds the group or user and role to the Role Membership list in the Roles view.
:::warning
The first role or set of roles saved must include the Administrator role. Clicking Save
@@ -57,20 +57,20 @@ the Access Analyzer Console.
**Step 6 –** Repeat Steps 2-4 to assign the Administrator, Web Administrator, and Report Viewer
roles to other groups or users.
-**Step 7 –** Click **Save** and then **OK** to confirm the changes. All applied roles are lost if
-they are not saved.
+**Step 7 –** Click **Save** and then **OK** to confirm the changes. You lose all applied roles if
+you don't save them.
-Role Based Access is enabled when the first role has been assigned.
+Access Analyzer enables Role Based Access when you assign the first role.
-
+
The first role or set of roles saved must include the Administrator role. Clicking **Save** for the
first role or set or roles without including the Administrator generates an error message in the
Access Analyzer Console.
-When Role Based Access is first enabled, restart the Access Analyzer application to ensure all roles
-are properly active. The Report Viewer role can be assigned at the job group, job, and report
-configuration levels. See the [Reporting Node](/docs/accessanalyzer/12.0/admin/jobs/group/settings/reporting.md),
+When you first enable Role Based Access, restart the Access Analyzer application to ensure all
+roles are properly active. You can assign the Report Viewer role at the job group, job, and
+report configuration levels. See the [Reporting Node](/docs/accessanalyzer/12.0/admin/jobs/group/settings/reporting.md),
[Report Roles Tab](/docs/accessanalyzer/12.0/admin/jobs/job/properties/reportroles.md), and
[Publish Security Page](/docs/accessanalyzer/12.0/admin/report/wizard/publishsecurity.md) topics for additional
information.
diff --git a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/workflow.md b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/workflow.md
index 04b4e7c5b7..70d353e6af 100644
--- a/docs/accessanalyzer/12.0/admin/settings/access/rolebased/workflow.md
+++ b/docs/accessanalyzer/12.0/admin/settings/access/rolebased/workflow.md
@@ -6,8 +6,8 @@ sidebar_position: 70
# Workflow with Role Based Access Enabled
-The following workflow summarizes the necessary steps involved to deploy a job once Role Based
-Access is enabled and roles have been assigned.
+The following workflow summarizes the necessary steps involved to deploy a job after you enable
+Role Based Access and assign roles.
**Step 1 –** The Job Builder creates and configures a Access Analyzer job
@@ -16,40 +16,41 @@ rejects it
-- If a job is approved, then a lock needs to be applied by right-clicking the job title in the Jobs
+- If the Job Approver approves a job, apply a lock by right-clicking the job title in the Jobs
tree and selecting **Lock Job**
-- If a job is rejected, then the job remains unlocked
-- If the **Lock Job** option is visible, then the job has not yet been approved
-- If the **Lock Job** option is not visible, then the job has been approved
+- If the Job Approver rejects a job, the job remains unlocked
+- If the **Lock Job** option is visible, the Job Approver hasn't approved the job yet
+- If the **Lock Job** option isn't visible, the Job Approver has approved the job
**Step 3 –** The Job Initiator can choose to run the job directly through the Access Analyzer
-Console or schedule it to run with the Schedule Service Account. This user will know the job was
-approved by the grayed-out **Unlock Job** option in the right-click menu.
+Console or schedule it to run with the Schedule Service Account. The grayed-out **Unlock Job**
+option in the right-click menu tells this user the job was approved.
- Job Initiator/Job Initiator (No Actions) – The Job Initiator can only execute locked job.
- For the Job Initiator (No Actions) role, the user is unable to execute a job which contains
configured actions, even if it is approved and locked
- - Both roles can enable and disable job groups and jobs regardless of whether or not they are
- locked. Disabled jobs are grayed out with a red x next to it and are not executed with the job
- group. When applied at the job group level, all nested jobs are disabled and do not run.
- However, any new job added to that group is enabled by default.
+ - Both roles can enable and disable job groups and jobs regardless of whether they are
+ locked. Disabled jobs are grayed out with a red x next to them, and Access Analyzer doesn't
+ execute them with the job group. When you disable a job group, Access Analyzer also disables
+ all nested jobs, and they don't run. However, Access Analyzer enables any new job added to
+ that group by default.
:::note
The Job initiator can also publish the reports already generated by the job.
:::
-- Publish – To publish reports which have already been generated to the Web Console
+- Publish – To publish reports the job has already generated to the Web Console
- See the [Report Settings Tab](/docs/accessanalyzer/12.0/admin/jobs/job/properties/reportsettings.md) topic for
additional information
-**Step 4 –** After a job has been successfully run, the **Job Viewer** can now view the results of
+**Step 4 –** After a job runs successfully, the **Job Viewer** can now view the results of
the job under the job’s Status and Results node, or in the Web Console. See the
[Viewing Generated Reports](/docs/accessanalyzer/12.0/admin/report/view.md) topic for additional information.
@@ -62,10 +63,10 @@ Console.
## Other Console Roles
-Any modifications needed in the Settings or Host Management nodes must be done by the corresponding
-administrator role (Global Options Administrator, Access Administrator, or Host Management
-Administrator). These roles can be used in conjunction with any other role (for example, a user can
-be a Job Builder and Global Options Administrator in order to build jobs and manage corresponding
+The corresponding administrator role (Global Options Administrator, Access Administrator, or Host
+Management Administrator) must make any modifications needed in the Settings or Host Management
+nodes. You can use these roles in conjunction with any other role (for example, a user can
+be a Job Builder and Global Options Administrator to build jobs and manage corresponding
Connection Profiles).
### Web Administrator
@@ -82,8 +83,8 @@ Console.
### Report Viewer
-The Report Viewer can view reports within the Web Console according to where the user’s role was
-assigned: global, job group, job, or report configuration.
+The Report Viewer can view reports within the Web Console according to where you assigned the
+user’s role: global, job group, job, or report configuration.
:::tip
Remember, a user with only the Report Viewer role is unable to access the Access Analyzer Console.
diff --git a/docs/accessanalyzer/12.0/admin/settings/application/overview.md b/docs/accessanalyzer/12.0/admin/settings/application/overview.md
index 31e1c180c9..c8eb9df798 100644
--- a/docs/accessanalyzer/12.0/admin/settings/application/overview.md
+++ b/docs/accessanalyzer/12.0/admin/settings/application/overview.md
@@ -13,15 +13,15 @@ Analyzer Console functions.
**Application Log**
-The Access Analyzer Application Log section determines what information is stored in the Access
-Analyzer application log.
+The Access Analyzer Application Log section determines what information Access Analyzer stores
+in the application log.
The Application log level controls the types of messages generated for each job and the application.
-It can be modified at the job level in the **Job Properties** window. See the
+You can modify it at the job level in the **Job Properties** window. See the
[General Tab](/docs/accessanalyzer/12.0/admin/jobs/job/properties/general.md) topic for additional information. Options
-available in the Application log level drop-down menu include:
+available in the Application log level dropdown menu include:
- Debug – Records everything that happens during job execution, most verbose level of logging
@@ -47,47 +47,47 @@ available in the Application log level drop-down menu include:
- Records job completion time
:::info
-Set the log level to **Warning**. The global log level determines what messages are written to the SA_Messages table and visible in the NAA Console. If a job has a higher log level than the global setting, those additional messages will be written to the job log only and will not appear in the database. For additional information on changing the job log level, see [Job Properties | General tab](https://docs.netwrix.com/docs/accessanalyzer/12_0/admin/jobs/job/properties/general).
+Set the log level to **Warning**. The global log level determines what messages Access Analyzer writes to the SA_Messages table and displays in the Access Analyzer Console. If a job has a higher log level than the global setting, those additional messages go to the job log only and don't appear in the database. For additional information on changing the job log level, see [Job Properties | General tab](https://docs.netwrix.com/docs/accessanalyzer/12_0/admin/jobs/job/properties/general).
:::
-The other log levels are designed to assist with troubleshooting job execution issues. The Debug
-level is only recommended when experiencing problems. After the problem is fixed or the Application
-log has been sent to [Netwrix Support](https://www.netwrix.com/support.html), reduce the logging
+The other log levels are designed to assist with troubleshooting job execution issues. Only use
+the Debug level when experiencing problems. After you fix the problem or send the Application
+log to [Netwrix Support](https://www.netwrix.com/support.html), reduce the logging
level to **Warning** or **Info**.
**Profile Security**
The Profile Security section provides the option to enable an enhanced method of encryption to
-various credentials stored by the Access Analyzer application.
+various credentials the Access Analyzer application stores.
.
-There are two options available in the Profiles stored with drop-down menu:
+There are two options available in the Profiles stored with dropdown menu:
-- Application – Default setting, does not employ the enhanced encryption
+- Application – Default setting, doesn't employ the enhanced encryption
- Vault – Enables the enhanced encryption of stored credentials. See the [Vault](/docs/accessanalyzer/12.0/admin/settings/application/vault.md) topic for
requirements and additional information.
**Usage Statistics**
-The Usage Statistics section allows you to select whether to send usage statistics data to Netwrix
-to help us improve our product.
+Use the Usage Statistics section to select whether to send usage statistics data to Netwrix
+to help improve the product.
-- If selected, usage statistics are collected and sent to Netwrix
+- If selected, Access Analyzer collects usage statistics and sends them to Netwrix
- - Upon startup of the Access Analyzer console, the system checks if usage statistics have been
- sent in the last 7 days. If they have not been, stored procedures run against the Access
+ - Upon startup of the Access Analyzer console, the system checks whether it has sent usage
+ statistics in the last 7 days. If it hasn't, stored procedures run against the Access
Analyzer database and gather data about job runs, access times, and environmental details like
- resource counts, users counts, number of exceptions, and so on. This data is then sent back to
- Netwrix to help us identify usage trends and common pain points, so that we can use this
- information to improve the product.
- - Only anonymous statistic-level data is included. No private company or personal data is
- collected or sent to Netwrix.
+ resource counts, user counts, number of exceptions, and so on. Access Analyzer then sends
+ this data back to Netwrix to help identify usage trends and common problem areas and
+ improve the product.
+ - This includes only anonymous statistic-level data. Access Analyzer doesn't collect or send
+ any private company or personal data to Netwrix.
-- If cleared, no usage statistics are collected or sent to Netwrix
+- If cleared, Access Analyzer doesn't collect or send usage statistics to Netwrix
**Host Target Options**
@@ -111,7 +111,7 @@ Console.
- Automatically rename duplicate columns within a table – Checks for and renames columns with
duplicate names
- Automatically correct invalid column names – Checks for and corrects column names which contain
- characters SQL cannot handle
+ characters SQL can't handle
:::info
Leave both options selected.
@@ -123,27 +123,27 @@ Console.
- Maximum row count for interactive grid view – Indicates the number of rows displayed in tables
accessible in under a job’s Status and Results nodes
- - Maximum row count is set to 1000 by default and has a cap of 99,999 rows. This number does not
+ - Maximum row count defaults to 1000 and has a cap of 99,999 rows. This number doesn't
impact the number of rows within the SQL database. To view the full row count for a table
exceeding this size, use the SQL Server Management Studio or another SQL Server interface tool
which displays the full table.
-Filtered data grids are not lost if persistent filters are not saved. The Filtration Dialog
+Filtered data grids aren't lost if you don't save persistent filters. The Filtration Dialog
available for every data grid maintains a list of recent filters. See the
[Data Grid Functionality](/docs/accessanalyzer/12.0/admin/navigate/datagrid.md) topic for additional information.
**Cleanup**
The Cleanup section is designed to conserve space in the SQL Database Transaction Log. It only works
-when the database is configured to use Simple Recovery Model.
+when you configure the database to use Simple Recovery Model.
-- Compact Database Transaction Log – If selected, every time the Access Analyzer application is
- closed, the Database Transaction Log is compacted
+- Compact Database Transaction Log – If selected, Access Analyzer compacts the Database
+ Transaction Log every time you close the Access Analyzer application
:::info
- In most environments, it is recommended to leave this option selected. If a
+ In most environments, leave this option selected. If a
scheduled task ends while multiple tasks are still running, the process of compacting the
database freezes it and causes the running tasks to fail.
:::
@@ -153,14 +153,14 @@ when the database is configured to use Simple Recovery Model.
of SUCCESS, WARNING, or ERROR to indicate what happened on that host during job execution
:::info
- It is recommended that this option be left selected.
+ Leave this option selected.
:::
**Application Exit Options**
-The Application Exit Options section controls whether or not a confirmation is displayed when the
-Access Analyzer application is closed.
+The Application Exit Options section controls whether Access Analyzer displays a confirmation
+when you close the Access Analyzer application.
@@ -170,10 +170,10 @@ application closes without confirmation.
-The Confirm Exit window requires the **Yes** button to be clicked before the Access Analyzer
+The Confirm Exit window requires you to click **Yes** before the Access Analyzer
application closes.
The **Cancel** and **Save** buttons are in the lower-right corner of the Application view. These
-buttons become enabled when modifications are made to the Application global settings. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you modify the Application global settings. Whenever
+you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you didn't intend to make changes.
diff --git a/docs/accessanalyzer/12.0/admin/settings/application/vault.md b/docs/accessanalyzer/12.0/admin/settings/application/vault.md
index a39c433f0c..08c5d2471d 100644
--- a/docs/accessanalyzer/12.0/admin/settings/application/vault.md
+++ b/docs/accessanalyzer/12.0/admin/settings/application/vault.md
@@ -7,15 +7,15 @@ sidebar_position: 10
# Vault
The Access Analyzer vault provides additional security through enhanced encryption to various
-credentials stored by the Access Analyzer application, such as Connection Profile credentials or
-Schedule Service Account credentials. In order to enable the vault, the following prerequisites must
-be met in the order listed:
+credentials the Access Analyzer application stores, such as Connection Profile credentials or
+Schedule Service Account credentials. to enable the vault, meet the following prerequisites
+in the order listed:
- Access Analyzer Vault Service must be running
- - This service was installed during the Access Analyzer installation and is configured for
- Manual Startup Type
- - It needs to be configured to Log On (Service > Properties) with a service account which has
+ - The Access Analyzer installation installs this service and configures it for Manual
+ Startup Type
+ - You need to configure it to Log On (Service > Properties) with a service account that has
Log on as Service rights, as well as Read and Execute rights to the VaultService.exe file
located within the Access Analyzer installation directory
@@ -23,17 +23,17 @@ be met in the order listed:
- The vault was designed to provide enhanced security when employing the Role Based Access, or
least privilege, option of Access Analyzer
- - At least one Administrator role must be assigned to enable the vault:
+ - You must assign at least one Administrator role to enable the vault:
- - If full Role Based Access is not desired but enabling the vault is, all of the Access
- Analyzer users should be given the Administrator role
- - No additional Role Based Access prerequisites are required for this option
+ - If you don't want full Role Based Access but do want to enable the vault, give all
+ Access Analyzer users the Administrator role
+ - This option doesn't require additional Role Based Access prerequisites
- See the [Access](/docs/accessanalyzer/12.0/admin/settings/access/overview.md) topic for additional information on Role Based Access
:::note
- Once the vault has been enabled, it is not possible to disable Role Based Access
- without first disabling the vault. Please contact
+ After you enable the vault, you can't disable Role Based Access
+ without first disabling the vault. contact
[Netwrix Support](https://www.netwrix.com/support.html) for assistance in disabling Role Based
Access.
:::
@@ -46,17 +46,17 @@ be met in the order listed:
If the previous prerequisites have not been met, then one of the following errors will occur
when attempting to save the Vault Profile Security setting:
- - Role Based Access Error – Role Based Access must be configured in order to use the Access
- Analyzer Vault. Please configure Role Based Access and try again
- - Access Analyzer Vault Service Error – Access Analyzer is not running
+ - Role Based Access Error – Role Based Access must be configured to use the Access
+ Analyzer Vault. configure Role Based Access and try again
+ - Access Analyzer Vault Service Error – Access Analyzer isn't running
- The Netwrix Access Analyzer (formerly Enterprise Auditor) Web Server service must be run with an
account that has the Administrator role assigned
- - If the Administrator role is not assigned, the vault service does not allow the web server to
- access the SQL profile and throws an access denied error in the web server log file
+ - If you don't assign the Administrator role, the vault service doesn't allow the web server
+ to access the SQL profile and throws an access denied error in the web server log file
-The credentials which are encrypted once the vault has been enabled are:
+The credentials that the Access Analyzer Vault Service encrypts after you enable the vault are:
- Storage Profile credentials
- Connection Profile credentials
@@ -64,12 +64,13 @@ The credentials which are encrypted once the vault has been enabled are:
- Role Definitions
- Role Assignments
-Once encrypted, the files with these stored credentials are moved into a new directory location.
+Once encrypted, the Access Analyzer Vault Service moves the files with these stored credentials
+into a new directory location.
-This location is protected by the service account used to run the Access Analyzer Vault Service.
+The service account used to run the Access Analyzer Vault Service protects this location.
## Disabling the Vault
To disable the vault, navigate to the **Settings** > **Application** node and change the Profile
-Security section setting to **Application**. It is a best practice to also stop the Access Analyzer
+Security section setting to **Application**. As a best practice, also stop the Access Analyzer
Vault Service.
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/create/activedirectory.md b/docs/accessanalyzer/12.0/admin/settings/connection/create/activedirectory.md
index fda1943041..0c6a311fd4 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/create/activedirectory.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/create/activedirectory.md
@@ -6,14 +6,14 @@ sidebar_position: 10
# Active Directory Account for User Credentials
-If the account type selected on the User Credentials window is **Active Directory Account**, the
-following information is required for the credential:
+If the account type selected on the User Credentials window is **Active Directory Account**, you
+must provide the following information for the credential:
-- Domain – Drop-down menu with available trusted domains will appear. Either type the short domain
+- Domain – dropdown menu with available trusted domains will appear. Either enter the short domain
name in the textbox or select a domain from the menu.
-- User name – Type the user name
+- User name – Enter the user name
- Password Storage – Choose the option for credential password storage:
- Application – Uses the configured Profile Security setting as selected at the **Settings** >
@@ -21,11 +21,11 @@ following information is required for the credential:
additional information.
- CyberArk – Uses the CyberArk Enterprise Password Vault. See the
[CyberArk Integration](/docs/accessanalyzer/12.0/admin/settings/connection/cyberarkintegration.md) topic for additional information. The
- password fields do not apply for CyberArk password storage.
+ password fields don't apply for CyberArk password storage.
- Managed Service Account – Use previously configured MSA and gMSAs for authentication. The
- password fields are not applicable when this option is selected. See the
+ password fields aren't applicable when this option is selected. See the
[Group Managed Service Accounts (gMSA) Configuration](/docs/accessanalyzer/12.0/admin/settings/connection/gmsa.md) topic for additional
information.
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/create/aws.md b/docs/accessanalyzer/12.0/admin/settings/connection/create/aws.md
index 1290603d91..686f0a267e 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/create/aws.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/create/aws.md
@@ -13,17 +13,17 @@ type in the User Credentials window.
The required credentials for Amazon Web Services are:
-- Access Key ID — Used to sign programmatic requests made to AWS. If access keys are not available,
+- Access Key ID — Used to sign programmatic requests made to AWS. If access keys aren't available,
create them with the IAM console.
- Password Storage: Application – Uses the configured Profile Security setting as selected at the
**Settings >** **Application** node
-- Secret Key — Used to sign programmatic requests made to AWS. If secret keys are not available,
+- Secret Key — Used to sign programmatic requests made to AWS. If secret keys aren't available,
create them with the IAM console.
- Scan Roles — Role used to scan other organization accounts
## Create a Connection Profile for AWS
-A new connection profile will need to be created to be leveraged in the AWS Solution.
+You need to create a new connection profile for use in the AWS Solution.
**Step 1 –** Under Settings > Connection, click Add Connection profile.
@@ -33,7 +33,7 @@ A new connection profile will need to be created to be leveraged in the AWS Solu
Access Token section.
:::tip
-Remember, these are obtained from AWS when the permissions are configured. See the
+Remember, you obtain these from AWS when you configure the permissions. See the
[Configure AWS for Scans](/docs/accessanalyzer/12.0/requirements/aws/configurescans.md) topic for additional
information.
:::
@@ -41,4 +41,4 @@ information.
**Step 4 –** Click OK in the User Credentials modal, name the Connection Profile, and click Save.
-This connection profile can now be assigned to the AWS Solution.
+You can now assign this connection profile to the AWS Solution.
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/create/create.md b/docs/accessanalyzer/12.0/admin/settings/connection/create/create.md
index 9946b42e84..7ef5b42228 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/create/create.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/create/create.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Create a Connection Profile
-Follow the steps to create a Connection Profile.
-
**Step 1 –** Click Add Connection profile at the top of the Connection view.
@@ -18,15 +16,15 @@ Follow the steps to create a Connection Profile.
name in the Connection profile name textbox.
:::note
-A good profile name should be chosen so that it does not need to be changed at a later
-time. If the profile name is changed after being applied to job groups or jobs, it requires the user
-to go back through all of those job groups or jobs and re-apply the Connection Profile.
+Choose a good profile name so that you don't need to change it later. If you change the
+profile name after applying it to job groups or jobs, you must go back through all of those job
+groups or jobs and reapply the Connection Profile.
:::
-**Step 3 –** Now it is time to add credentials to this profile. Click Add User credential and the
+**Step 3 –** Add credentials to this profile. Click Add User credential and the
User Credentials window opens.
@@ -51,8 +49,8 @@ See the individual account type sections for information on the fields. Then cli
:::note
-If the entered passwords are not the same, an error message will pop-up after clicking OK
-on the User Credentials window. Click OK on the error message and re-type the passwords.
+If the entered passwords aren't the same, an error message pops up after you click OK
+on the User Credentials window. Click OK on the error message and re-enter the passwords.
:::
@@ -69,28 +67,28 @@ are no more credentials to try.
:::info
Limit the User Credentials list to a minimal number per profile, especially when
-considering that a successful authentication does not automatically mean that particular credential
-has the appropriate level of permissions in order for the data collection to occur.
+considering that a successful authentication doesn't automatically mean that particular credential
+has the appropriate level of permissions for the data collection to occur.
:::
-There are Move Up and Move Down buttons for arranging priority within the User Credentials list.
+Use the Move Up and Move Down buttons to arrange priority within the User Credentials list.
**Step 6 –** (Optional): At the bottom of the Connection view, is the Use the Windows account that
Access Analyzer runs with before trying the user credentials above option. This option is per
-Connection Profile. If checked, Access Analyzer applies the local login credentials prior to any of
+Connection Profile. If checked, Access Analyzer applies the local login credentials before any of
the credentials saved to the Connection Profile.
:::note
-If a data collector utilizes an applet, this option must be unchecked.
+If a data collector uses an applet, uncheck this option.
:::
-**Step 7 –** When the user credentials have been added and ordered, click Save and then OK to
+**Step 7 –** After you add and order the user credentials, click Save and then OK to
confirm the changes to the Connection Profile.
The new Connection Profile is now visible in the Profile list and available for use at the job group
@@ -98,36 +96,32 @@ or job level.
## Edit User Credentials within a Connection Profile
-Follow the steps to edit user credentials within a Connection Profile.
-
-**Step 1 –** Select the Connection Profile to be modified from the Profile list. Remember, changing
-the Connection Profile name results in breaking job groups or jobs that are assigned this profile.
+**Step 1 –** Select the Connection Profile you want to modify from the Profile list. Remember,
+changing the Connection Profile name results in breaking job groups or jobs assigned this profile.
-**Step 2 –** Select the user credential to be edited from the User Credentials list. Click Edit.
+**Step 2 –** Select the user credential you want to edit from the User Credentials list. Click Edit.
**Step 3 –** Modify the information in the User Credentials window. For the password, choose between
the Use the existing password option or the Specify a new password below option. Click OK.
-**Step 4 –** When the Connection Profile’s user credentials have been edited as desired, click Save
+**Step 4 –** After you edit the Connection Profile’s user credentials as desired, click Save
and then OK to confirm the changes to the Connection Profile.
-The edited user credentials are now used for authentication to target hosts for this Connection
-Profile.
+Access Analyzer now uses the edited user credentials for authentication to target hosts for this
+Connection Profile.
## Delete a User Credential from a Connection Profile
-Follow the steps to delete a user credential from a Connection Profile.
-
-**Step 1 –** Select the Connection Profile to be modified from the Profile list. Remember, changing
-the Connection Profile name results in breaking job groups or jobs that are assigned this profile.
+**Step 1 –** Select the Connection Profile you want to modify from the Profile list. Remember,
+changing the Connection Profile name results in breaking job groups or jobs assigned this profile.
-**Step 2 –** Select the user credential to be edited from the User Credentials list. Click Delete.
+**Step 2 –** Select the user credential you want to delete from the User Credentials list. Click Delete.
@@ -145,20 +139,16 @@ The default profile is marked with the green checkmark.
-Follow the steps to set a new default Connection Profile.
-
-**Step 1 –** Select the desired profile in the Connection Profile list and click Set as default.
+**Step 1 –** Select the profile in the Connection Profile list and click Set as default.
**Step 2 –** The green checkmark moves. Click Save and then OK to confirm the changes.
-This Connection Profile is now used as the default Connection Profile.
+Access Analyzer now uses this Connection Profile as the default Connection Profile.
## Delete a Connection Profile
-Follow the steps to delete a Connection Profile.
-
**Step 1 –** Select the profile from the Connection Profile list and click Delete.
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/create/dropbox.md b/docs/accessanalyzer/12.0/admin/settings/connection/create/dropbox.md
index a2be06eb9b..99a0f5db5b 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/create/dropbox.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/create/dropbox.md
@@ -16,6 +16,6 @@ The required credentials for Dropbox are:
- Password Storage – Application (Uses the configured Profile Security setting as selected at the
**Settings** > **Application** node. See the [Application](/docs/accessanalyzer/12.0/admin/settings/application/overview.md) topic
for additional information.)
-- Access Token – Copy and paste the access token after it has been generated from the Scan Options
- page of the DropboxAccess Data Collector configuration wizard. See the Dropbox for User
+- Access Token – Copy and paste the access token after the DropboxAccess Data Collector
+ configuration wizard generates it from the Scan Options page. See the Dropbox for User
Credentials topic for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/create/entraid.md b/docs/accessanalyzer/12.0/admin/settings/connection/create/entraid.md
index 183c35c958..9f4eddf6c4 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/create/entraid.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/create/entraid.md
@@ -21,7 +21,7 @@ The required credentials for this account type are:
- Password Storage – Application (Uses the configured Profile Security setting as selected at the
**Settings** > **Application** node. See the [Application](/docs/accessanalyzer/12.0/admin/settings/application/overview.md) topic
for additional information.)
-- Key – The required Key depends on the target environment the Connection Profile is being used for:
+- Key – The required Key depends on the target environment where you use the Connection Profile:
- Entra ID – Client secret value for the Access Analyzer application registered with Microsoft
Entra ID. See the
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/create/exchangemodernauth.md b/docs/accessanalyzer/12.0/admin/settings/connection/create/exchangemodernauth.md
index 04843591d6..e08b9e8f4e 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/create/exchangemodernauth.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/create/exchangemodernauth.md
@@ -16,11 +16,11 @@ The values for the required credentials for the Exchange Modern Authentication a
- Password Storage – Application (Uses the configured Profile Security setting as selected at the
**Settings** > **Application** node. See the [Application](/docs/accessanalyzer/12.0/admin/settings/application/overview.md) topic
for additional information.)
-- Organization – The primary domain name of the Microsoft Entra tenant being leveraged to make the
+- Organization – The primary domain name of the Microsoft Entra tenant used to make the
connection. See the
[Identify the Tenant's Name](/docs/accessanalyzer/12.0/requirements/exchange/exchangeonline/access.md#identify-the-tenants-name)
topic for additional information.
-- Email Address – The email address for the mailbox to be leveraged in Exchange Online environment
+- Email Address – The email address for the mailbox used in Exchange Online environment
scans. The mailbox must belong to the primary domain used in the Organization field.
- AppID – Application (client) ID of the Access Analyzer application registered with Microsoft Entra
ID. See the
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/create/localwindows.md b/docs/accessanalyzer/12.0/admin/settings/connection/create/localwindows.md
index e264f35875..5c3dade01e 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/create/localwindows.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/create/localwindows.md
@@ -13,7 +13,7 @@ User Credentials window.
The required credentials for the Local Windows Account are:
-- User name – Type the user name
+- User name – Enter the user name
- Password Storage – Choose the option for credential password storage:
- Application – Uses the configured Profile Security setting as selected at the **Settings** >
@@ -21,14 +21,14 @@ The required credentials for the Local Windows Account are:
additional information.
- CyberArk – Uses the CyberArk Enterprise Password Vault. See the
[CyberArk Integration](/docs/accessanalyzer/12.0/admin/settings/connection/cyberarkintegration.md) topic for additional information. The
- password fields do not apply for CyberArk password storage.
+ password fields don't apply for CyberArk password storage.
:::note
- If using the CyberArk option, then the associated Connection Profile can only have
- one user credential in it. Multiple user credentials are not supported with the CyberArk
- integration when using local Windows accounts.
+ If you use the CyberArk option, the associated Connection Profile can only have
+ one user credential in it. The CyberArk integration doesn't support multiple user
+ credentials when you use local Windows accounts.
:::
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/create/oracle.md b/docs/accessanalyzer/12.0/admin/settings/connection/create/oracle.md
index 2d8ba704b5..f66e698023 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/create/oracle.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/create/oracle.md
@@ -14,24 +14,24 @@ window.
The required credentials for Oracle are:
- Domain – Field options are dependent upon the additional account type option selected:
- - Oracle Account – Domain is not a field for this type of credential
- - Windows account that Access Analyzer is run with – (Domain is not a field for this type of
+ - Oracle Account – Domain isn't a field for this type of credential
+ - Windows account that Access Analyzer is run with – (Domain isn't a field for this type of
credential)
- - Active Directory – Drop-down menu with available trusted domains displays. Either type the
+ - Active Directory – dropdown menu with available trusted domains displays. Either enter the
short domain name in the textbox or select a domain from the menu.
-- User name – Type the user name
- - This is not a field for the additional account type of Windows account that Access Analyzer is
+- User name – Enter the user name
+ - This isn't a field for the additional account type of Windows account that Access Analyzer is
run with is selected
- Password Storage: Application – Uses the configured Profile Security setting as selected at the
**Settings >** **Application** node
-- Password – Type the password
- - This is not a field for the additional account type of Windows account that Access Analyzer is
+- Password – Enter the password
+ - This isn't a field for the additional account type of Windows account that Access Analyzer is
run with
-- Confirm – Re-type the password
- - This is not a field for the additional account type of Windows account that Access Analyzer is
+- Confirm – Re-enter the password
+ - This isn't a field for the additional account type of Windows account that Access Analyzer is
run with
-- Role – Specify an Oracle role, if desired. The drop-down menu provides a list of roles. Either
- type the role name in the textbox or select a role from the menu.
+- Role – Specify an Oracle role, if desired. The dropdown menu provides a list of roles. Either
+ enter the role name in the textbox or select a role from the menu.
- **NOTE:** When using a least privileged model for Oracle, **SYSDBA** must be selected for the
Role.
- Additional Account type – Select radio button of the secondary account type from the list at the
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/create/sql.md b/docs/accessanalyzer/12.0/admin/settings/connection/create/sql.md
index 23c576f38f..04da18c785 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/create/sql.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/create/sql.md
@@ -10,7 +10,7 @@ This information applies to **Select Account Type** > **SQL Authentication** in
window.
:::note
-SQL Authentication credentials are used in the Connection Profiles for the SQL, MySQL, and
+You use SQL Authentication credentials in the Connection Profiles for the SQL, MySQL, and
PostgreSQL Solutions.
:::
@@ -23,5 +23,5 @@ The required credentials for SQL Authentication are:
- Password Storage – Application (Uses the configured Profile Security setting as selected at the
**Settings** > **Application** node. See the [Application](/docs/accessanalyzer/12.0/admin/settings/application/overview.md) topic
for additional information.)
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/create/task.md b/docs/accessanalyzer/12.0/admin/settings/connection/create/task.md
index cf77933eea..cd25ae7d76 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/create/task.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/create/task.md
@@ -17,10 +17,10 @@ The required credentials for Task (Local) and Task (Domain) are:
- Domain
- Local – Not a field for this type of credential, defaults to ``
- - Domain – Drop-down menu with available trusted domains displays. Either type the short domain
+ - Domain – dropdown menu with available trusted domains displays. Either enter the short domain
name in the textbox or select a domain from the menu.
-- User name – Type the user name
+- User name – Enter the user name
- Password Storage: Application – Uses the configured Profile Security setting as selected at the
**Settings > Application** node
-- Password – Type the password
-- Confirm – Re-type the password
+- Password – Enter the password
+- Confirm – Re-enter the password
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/create/unix.md b/docs/accessanalyzer/12.0/admin/settings/connection/create/unix.md
index af9901751d..710fa37379 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/create/unix.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/create/unix.md
@@ -20,12 +20,12 @@ The required credentials for the Unix Account are:
- Password/Confirm
- If not using a private key, enter the **Password** and re-type in the **Confirm** field
- - If using a private key, then the password is not needed. Provide the private key information
+ - If you use a private key, the password isn't needed. Provide the private key information
in the **Use the following private key when connecting** field.
- Use the following port/ports (CSV) for SSH
- - The SSH port needs to be opened in software and hardware firewalls
+ - You need to open the SSH port in software and hardware firewalls
- If desired, select this option and provide the port value
- Use the following private key when connecting
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/create/webservices.md b/docs/accessanalyzer/12.0/admin/settings/connection/create/webservices.md
index 62083d668c..033299d779 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/create/webservices.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/create/webservices.md
@@ -16,6 +16,6 @@ The required credentials for Web Services (JWT) are:
- User name – `{not a field for this type of credential}`
- Password Storage: Application – Uses the configured Profile Security setting as selected at the
**Settings > Application** node
-- Access Token – Copy and paste the StealthDEFEND App Token after it has been generated within
- StealthDEFEND. See the [FS_DEFEND_SDD Job](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/fs_defend_sdd.md) topic for
+- Access Token – Copy and paste the StealthDEFEND App Token after StealthDEFEND generates it.
+ See the [FS_DEFEND_SDD Job](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/fs_defend_sdd.md) topic for
additional information.
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/cyberarkintegration.md b/docs/accessanalyzer/12.0/admin/settings/connection/cyberarkintegration.md
index 2394d3426e..b38505e663 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/cyberarkintegration.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/cyberarkintegration.md
@@ -6,31 +6,32 @@ sidebar_position: 20
# CyberArk Integration
-In order for Access Analyzer to be able to retrieve service account passwords from the CyberArk
-Password Vault, the following prerequisites must be completed:
+For Access Analyzer to retrieve service account passwords from the CyberArk
+Password Vault, complete the following prerequisites:
- The Secrets Manager must be installed on the Access Analyzer Console server. The organization’s
Vault administrator can provide the Secrets Manager installation package and most likely needs to
- be present during the installation to provide credentials in order for the Secrets Manager
+ be present during the installation to provide credentials for the Secrets Manager
installation to complete. See the CyberArk
[Credential Provider (CP)](https://docs.cyberark.com/credential-providers/Latest/en/Content/CP%20and%20ASCP/Installing-CP.htm) article
for additional information.
-- An application must be added to CyberArk for the integration with Access Analyzer. The Application
- Id of this application must then be added to the `GlobalOptions.xml` file for Access Analyzer. See
- the [Customize CyberArk Application Id](#customize-cyberark-application-id) topic for additional
- information. The application can be locked down by providing an OS User, a Path, or a Hash. See
+- An application must be added to CyberArk for the integration with Access Analyzer. You must then
+ add the Application Id of this application to the `GlobalOptions.xml` file for Access Analyzer.
+ See the [Customize CyberArk Application Id](#customize-cyberark-application-id) topic for
+ additional information. You can lock down the application by providing an OS User, a Path, or a
+ Hash. See
the CyberArk
[Add applications](https://docs.cyberark.com/credential-providers/14.0/en/Content/Common/Adding-Applications.htm) article
for additional information.
- The OS User needs to be the account running Access Analyzer. This could be the account used to
launch the Access Analyzer application or an account used as the Schedule Service Account
- within Access Analyzer. More than one OS User can be added.
+ within Access Analyzer. You can add more than one OS User.
- The Path should be a local path to the `StealthAUDIT.exe` file. The path should end with the
file name: `…\StealthAUDIT.exe`.
- - The Hash should be generated using the **AimGetAppInfo** tool in the
+ - Generate the Hash using the **AimGetAppInfo** tool in the
`…\CyberArk\ApplicationPasswordProvider\Utils` folder on the server where Secrets Manager is
- installed. AimGetAppInfo should be run in an Administrator Command Prompt. Run the following
+ installed. Run AimGetAppInfo in an Administrator Command Prompt. Run the following
command:
```
@@ -38,7 +39,7 @@ Password Vault, the following prerequisites must be completed:
```
:::info
- Pipe the output hash value to a file to easily copy and paste it to the
+ Pipe the output hash value to a file to copy and paste it to the
CyberArk application.
:::
@@ -54,12 +55,12 @@ Password Vault, the following prerequisites must be completed:
- - The machine name for the Access Analyzer console needs to be added on the Allowed Machines
+ - Add the machine name for the Access Analyzer console to the Allowed Machines
list for the CyberArk application
-- Once the Secrets Manager installation has completed and the Access Analyzer application has been
- created, the necessary CyberArk accounts must be given access to the Safes in which the Access
- Analyzer service accounts are stored. This includes the account which was created automatically
+- After the Secrets Manager installation completes and you create the Access Analyzer application,
+ give the necessary CyberArk accounts access to the Safes in which the Access
+ Analyzer service accounts are stored. This includes the account CyberArk creates automatically
during the Secrets Manager installation, as well as the account created automatically as a result
of the application creation.
@@ -67,19 +68,19 @@ Password Vault, the following prerequisites must be completed:
- The account created during the AIM installation is under the naming convention
`Prov_[COMPUTERNAME]`, where `COMPUTERNAME` is the name of the computer on which AIM is
- installed. This account should be given **Retrieve accounts**, **List accounts**, and **View
- Safe Members** rights on the desired Safes.
+ installed. Give this account **Retrieve accounts**, **List accounts**, and **View
+ Safe Members** rights on the Safes it needs to access.
- The account created during the application creation has the same name as the application
- itself and should be given **Retrieve accounts** rights on the desired Safes
+ itself. Give it **Retrieve accounts** rights on the Safes it needs to access
## Customize CyberArk Application Id
-The Application id value of the application created within CyberArk for the integration with Access
-Analyzer must be configured within Access Analyzer. This is done in the `GlobalOptions.xml` file
+You must configure Access Analyzer with the Application id value of the application created within
+CyberArk for the integration. You do this in the `GlobalOptions.xml` file
within the Access Analyzer installation directory. The default location is
`…\STEALTHbits\StealthAUDIT\`.
-Follow the steps to customize the CyberArk Application Id within Access Analyzer.
+Customize the CyberArk Application Id within Access Analyzer:
**Step 1 –** Navigate to the `GlobalOptions.xml` file. Open it with a text editor, for example
Notepad.
@@ -106,7 +107,7 @@ required, customize the Command Timeout and Connection Port properties.
- AppId – The name of the CyberArk application
- CommandTimeout – Set to the suggested default of 30
- ConnectionPort – This is a configurable option found during the installation of the CyberArk
- Credential Provider. After installation, it can be found in the configuration file located in the
+ Credential Provider. After installation, it is in the configuration file located in the
installation folder.
See the CyberArk
@@ -125,8 +126,8 @@ window when configuring an **Active Directory Account** or **Local Windows Accou
The credential information supplied in the User Credentials window must be an exact match to what is
in CyberArk as the privileged account for which it is linked. It is case-sensitive.
-If the Connection Profile with a Local Windows Account credential using CyberArk password storage is
-used to target multiple hosts, then the local credential on each host needs to have the exact same
+If you use the Connection Profile with a Local Windows Account credential using CyberArk password
+storage to target multiple hosts, the local credential on each host needs to have the exact same
username and password combination.
@@ -141,8 +142,8 @@ in CyberArk. These values are case-sensitive, and must be an exact match.
-The table below shows the values from your CyberArk configuration that the User Credentials window
-should be populated with:
+The following table shows the values from your CyberArk configuration that you should use to
+populate the User Credentials window:
| Access Analyzer | CyberArk Property | CyberArk Description | Example Value |
| --------------- | ----------------- | -------------------------------------- | ----------------- |
@@ -159,8 +160,8 @@ value is `` and the CyberArk Address property value is the server address.
-The table below shows the values from your CyberArk configuration that the User Credentials window
-should be populated with:
+The following table shows the values from your CyberArk configuration that you should use to
+populate the User Credentials window:
| Access Analyzer | CyberArk Property | CyberArk Description | Example Value |
| --------------- | ----------------- | -------------------------------------- | ------------- |
@@ -171,7 +172,7 @@ should be populated with:
:::info
Only use one Local Windows Account credential with CyberArk password storage in a
Connection Profile. As part of the Access Analyzer to CyberArk integration, the Access Analyzer job
-is stopped immediately if the query from Access Analyzer to CyberArk for the credential fails.
-Therefore, a second credential within the Connection Profile would not be queried.
+stops immediately if the query from Access Analyzer to CyberArk for the credential fails.
+Therefore, Access Analyzer wouldn't query a second credential within the Connection Profile.
:::
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/gmsa.md b/docs/accessanalyzer/12.0/admin/settings/connection/gmsa.md
index 2a98ee4628..cde422d5c1 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/gmsa.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/gmsa.md
@@ -7,17 +7,17 @@ sidebar_position: 30
# Group Managed Service Accounts (gMSA) Configuration
Access Analyzer can use a previously-configured Group Managed Service Accounts (gMSA/MSA) account.
-Make sure that Managed Service Account is selected in the User Credentials window. See the
+ensure that Managed Service Account is selected in the User Credentials window. See the
[Create a Connection Profile](/docs/accessanalyzer/12.0/admin/settings/connection/create/create.md) or
[Create a Schedule Service Account](/docs/accessanalyzer/12.0/admin/settings/schedule.md#create-a-schedule-service-account) topic for
additional information.
-To run a job or scheduled task with a gMSA/MSA account, the following prerequisites must be met:
+To run a job or scheduled task with a gMSA/MSA account, meet the following prerequisites:
- The account that Access Analyzer is run with must have permissions to retrieve the gMSA account
password
- The gMSA account must be a Local Admin in the target hosts
-- The gMSA account does not have to be a local admin in the Access Analyzer Console
+- The gMSA account doesn't have to be a local admin in the Access Analyzer Console
- The Data Collector used must support unicode characters in the Connection Profile's credential
password to retrieve the gMSA account password
@@ -27,7 +27,7 @@ mechanism in the query configuration.
:::
:::note Action Modules
-Using action modules with gMSAs is not currently supported.
+Access Analyzer doesn't support using action modules with gMSAs.
:::
See the Microsoft
diff --git a/docs/accessanalyzer/12.0/admin/settings/connection/overview.md b/docs/accessanalyzer/12.0/admin/settings/connection/overview.md
index 9b256eb395..7a39233fb0 100644
--- a/docs/accessanalyzer/12.0/admin/settings/connection/overview.md
+++ b/docs/accessanalyzer/12.0/admin/settings/connection/overview.md
@@ -11,28 +11,28 @@ the information Access Analyzer uses to connect to the target hosts during job e
-There are two methods for authentication to a targeted host:
+You can authenticate to a targeted host using one of two methods:
- Use Local Login Credentials
- Use a Connection Profile
## Use Local Login Credentials
-This method is traditionally assigned through the **Only use the Windows account that the
+You traditionally assign this method through the **Only use the Windows account that the
application is run with System default** option. It is generally referred to as the System Default
or trusted method. When used, Access Analyzer authenticates to the target hosts during host
inventory or job execution with the Windows account used to launch Access Analyzer. This can be:
-- Account which was used to log on to the Access Analyzer Console server and start the application
-- Account which was used to launch the Access Analyzer application through the run-as security
+- Account used to log on to the Access Analyzer Console server and start the application
+- Account used to launch the Access Analyzer application through the run-as security
context
-- Account which was used to provision a Windows scheduled task when running a job group or job via a
+- Account used to provision a Windows scheduled task when running a job group or job via a
scheduled task
## Use a Connection Profile
-This method allows you to define a Connection Profile which houses one or several sets of
-credentials to be used for authentication on the target hosts during host inventory or job
+Use this method to define a Connection Profile which houses one or several sets of
+credentials for authentication on the target hosts during host inventory or job
execution. The credentials specified in a Connection Profile could be any of the following:
- Local machine account
@@ -44,21 +44,21 @@ execution. The credentials specified in a Connection Profile could be any of the
- Web service JWT
- Oracle account
-For the majority of auditing scenarios, domain-based accounts are preferred if not required by the
-nature of the auditing task. The credentials must have the permissions required by the data
+For the majority of auditing scenarios, use domain-based accounts unless the auditing task requires
+otherwise. The credentials must have the permissions required by the data
collector being used.
### Password Storage Options
-The password for the credential provided can be stored in Access Analyzer application or Access
-Analyzer Vault. Certain types of credentials can be stored in CyberArk®.
+You can store the password for the credential provided in the Access Analyzer application or
+Access Analyzer Vault. You can store certain types of credentials in CyberArk®.
-Choosing to store passwords in either the Access Analyzer application or the Access Analyzer Vault
-is a global setting configured in the **Settings** > **Application** node. See the
+You configure whether to store passwords in the Access Analyzer application or the Access Analyzer
+Vault as a global setting in the **Settings** > **Application** node. See the
[Application](/docs/accessanalyzer/12.0/admin/settings/application/overview.md) topic for additional information.
The Access Analyzer vault provides enhanced security through enhanced encryption to various
-credentials stored by the Access Analyzer application. See the [Vault](/docs/accessanalyzer/12.0/admin/settings/application/vault.md)
+credentials the Access Analyzer application stores. See the [Vault](/docs/accessanalyzer/12.0/admin/settings/application/vault.md)
topic for additional information.
CyberArk integration stores supported credentials in the CyberArk Enterprise Password Vault.
@@ -70,9 +70,9 @@ additional information.
The **Cancel** and **Save** buttons are in the lower-right corner of the Connection view. These
-buttons become enabled when modifications are made to the Connection global setting.
+buttons become enabled when you modify the Connection global setting.
-Whenever changes are made at the global level, click **Save** and then **OK** to confirm the
-changes. Otherwise, click **Cancel** if no changes were intended.
+Whenever you make changes at the global level, click **Save** and then **OK** to confirm the
+changes. Otherwise, click **Cancel** if you didn't intend to make changes.
diff --git a/docs/accessanalyzer/12.0/admin/settings/exchange.md b/docs/accessanalyzer/12.0/admin/settings/exchange.md
index 9f147534b5..3f750966a2 100644
--- a/docs/accessanalyzer/12.0/admin/settings/exchange.md
+++ b/docs/accessanalyzer/12.0/admin/settings/exchange.md
@@ -11,22 +11,22 @@ These settings are exclusive to the Access Analyzer for Exchange Solution.
-The Exchange node is grayed-out by default. In order for these settings to be enabled, it is
-necessary to install both Access Analyzer MAPI CDO and Microsoft Exchange MAPI CDO on the Access
-Analyzer Console server. See the
+The Exchange node is grayed-out by default. To enable these settings, install both Access Analyzer
+MAPI CDO and Microsoft Exchange MAPI CDO on the Access Analyzer Console server. See the
[StealthAUDIT MAPI CDO Installation](/docs/accessanalyzer/12.0/install/mapicdo/installation.md)
topic for additional information.
-Once the requirements have been met, the Exchange node is enabled for configuration. These settings
-are utilized to make MAPI connections to the Exchange Server for the Mailbox, PublicFolder,
-Exchange2K, and ExchangePS Data Collectors. The Client Access Server field, or CAS, is also utilized
-by the ExchangePS Data Collector in order to make Remote PowerShell connections for Exchange 2010 or
-newer. The data collectors apply these settings unless modified inside the job query.
+After you meet the requirements, Access Analyzer enables the Exchange node for configuration.
+Access Analyzer uses these settings to make MAPI connections to the Exchange Server for the
+Mailbox, PublicFolder, Exchange2K, and ExchangePS Data Collectors. The ExchangePS Data Collector
+also uses the Client Access Server field, or CAS, to make Remote PowerShell connections for
+Exchange 2010 or newer. The data collectors apply these settings unless modified inside the job
+query.
The three options in the Exchange Connection Setting section at the top of the window are dependent
-on which version of Exchange is audited.
+on which version of Exchange you audit.
- For Auditing Microsoft Exchange 2007 or Older Versions:
- Select the radio button for System Attendant (2003 & 2007) – The System Attendant Account is
@@ -39,38 +39,38 @@ on which version of Exchange is audited.
- Use the mailbox associated with the Windows account that Access Analyzer is run with –
This option uses either the account logged into the Access Analyzer Console server or the
account set to run the Access Analyzer application.
- - Exchange Mailbox (2010 and newer) – This option allows an Exchange Mailbox Alias to be
- specified for MAPI connections.
+ - Exchange Mailbox (2010 and newer) – This option lets you specify an Exchange Mailbox
+ Alias for MAPI connections.
- Enter the Alias name in the textbox. The Alias needs to be an Exchange 2010 or newer
- mailbox, not a mail-enabled service account. However, this mailbox does not need
+ mailbox, not a mail-enabled service account. However, this mailbox doesn't need
rights on the Exchange Organization; it only needs to reside within it.
- Enter the name of the physical CAS in the Client Access Server textbox. This server can be
- part of an array, but do not enter the name of a CAS Array. This should also be the
- Exchange CAS where both Remote PowerShell and Windows Authentication on the PowerShell
- Virtual Directory have been enabled.
+ part of an array, but don't enter the name of a CAS Array. This should also be the
+ Exchange CAS where you have enabled both Remote PowerShell and Windows Authentication on
+ the PowerShell Virtual Directory.
:::info
-Once the Exchange Connection Settings have been properly configured for the
-version of Exchange to be audited, it is strongly recommended that the settings be tested.
+After you properly configure the Exchange Connection Settings for the version of Exchange you
+want to audit, test the settings.
:::
In the Test Exchange Connection Settings section:
-- Enter a Mailbox Server with mailboxes to be audited in the Exchange Server textbox.
+- Enter a Mailbox Server with mailboxes you want to audit in the Exchange Server textbox.
- Click the Test Exchange settings link.
If the Exchange Connection Settings are correct, an output field opens. At the bottom of the output
-field, a mailbox count is stated and a message appears which says, “You have successfully connected
-to this Exchange Server.” Click OK.
+field, Access Analyzer states a mailbox count and displays a message that says, “You have
+successfully connected to this Exchange Server.” Click OK.
The Cancel and Save buttons are in the lower-right corner of the Exchange view. These buttons become
-enabled when modifications are made to the Exchange global setting. Whenever changes are made at the
-global level, click Save and then OK to confirm the changes. Otherwise, click Cancel if no changes
-were intended.
+enabled when you modify the Exchange global setting. Whenever you make changes at the
+global level, click Save and then OK to confirm the changes. Otherwise, click Cancel if you didn't
+intend to make changes.
diff --git a/docs/accessanalyzer/12.0/admin/settings/history.md b/docs/accessanalyzer/12.0/admin/settings/history.md
index 51bc3dc6d2..7682ffa7bf 100644
--- a/docs/accessanalyzer/12.0/admin/settings/history.md
+++ b/docs/accessanalyzer/12.0/admin/settings/history.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# History
-The History node is where the history retention of job data and job logs are configured. The setting
+The History node is where you configure the history retention of job data and job logs. The setting
specified here at the global level applies to all jobs in the Jobs tree unless specifically changed
at the job group or job level. See the [History Node](/docs/accessanalyzer/12.0/admin/jobs/group/settings/history.md) and
[History Tab](/docs/accessanalyzer/12.0/admin/jobs/job/properties/history.md) topics for additional information.
@@ -14,7 +14,7 @@ at the job group or job level. See the [History Node](/docs/accessanalyzer/12.0/
The Data Retention Period settings are for configuring the job data history retention within the
-database. There are three options:
+database. Choose from three options:
- Never retain previous job data
- Retain previous job data for [number] [time period]
@@ -25,29 +25,30 @@ for more control over the quantity of data by applying history retention at the
level. All jobs run with this default setting only keep the most current record set.
:::warning
-It is important to understand that some pre-configured jobs require history retention
-while others do not support it. Changing the history retention settings at the global level can
+Some pre-configured jobs require history retention
+while others don't support it. Changing the history retention settings at the global level can
cause issues with data analysis and reporting on jobs that don't support it. See the relevant job
group and job descriptions for additional information.
:::
-The Diagnostics Retention Period settings determine how long this data is retained for all jobs that
-do not have an explicit setting. Setting the retention period for a specific job overrides the
-default setting. There are two settings:
+The Diagnostics Retention Period settings determine how long Access Analyzer retains this data for
+all jobs that don't have an explicit setting. Setting the retention period for a specific job
+overrides the default setting. Configure two settings:
- Logs and Messages
- Retain previous application logs, job logs, and messages for [number] [time period] – Controls
- how long the messages for previous job executions are stored in the SA_Messages table for each
- job. Older job execution messages are cleared.
- - The default value is 7 Times. With this setting, the messages are stored for the previous
- seven job executions.
+ how long Access Analyzer stores the messages for previous job executions in the SA_Messages
+ table for each job. Access Analyzer clears older job execution messages.
+ - The default value is 7 Times. With this setting, Access Analyzer stores the messages for the
+ previous seven job executions.
- Job Statistics
- - Retain job statistics in database for [number] [time period] – Controls how long job
- statistics history is stored within the Access Analyzer database in the following two tables:
+ - Retain job statistics in database for [number] [time period] – Controls how long Access
+ Analyzer stores job statistics history within the Access Analyzer database in the following
+ two tables:
- SA_JobStatsTbl
- SA_JobTaskStatsTbl
@@ -56,19 +57,19 @@ default setting. There are two settings:
This directly affects each job’s **Status** node. See the [Status Node](/docs/accessanalyzer/12.0/admin/jobs/job/status.md)
topic for additional information.
-For both the **Logs and Messages** and **Job Statistics** options above:
+For both the **Logs and Messages** and **Job Statistics** options:
-- Enter a number in the first textbox and select the desired time period from the drop-down menu in
- the second box. Retention can be set to a specific number of **Days**, **Weeks**, **Months**, or
+- Enter a number in the first textbox and select the time period you want from the dropdown menu in
+ the second box. You can set retention to a specific number of **Days**, **Weeks**, **Months**, or
**Times** for both.
- All jobs run with this setting add the newly collected data set or job logs on top of the
- previously collected record sets or logs. Any record sets or logs outside the specified historical
- retention limit are dropped.
+ previously collected record sets or logs. Access Analyzer drops any record sets or logs outside
+ the specified historical retention limit.
The **Cancel** and **Save** buttons are in the lower-right corner of the History view. These buttons
-become enabled when modifications are made to the History global settings. Whenever changes are made
+become enabled when you modify the History global settings. Whenever you make changes
at the global level, click **Save** and then **OK** to confirm the changes. Otherwise, click
-**Cancel** if no changes were intended.
+**Cancel** if you didn't intend to make changes.
## Job Data History Retention & Database Size Concerns
@@ -80,19 +81,19 @@ following scenario explains a common concern.
- To reduce data retention periods, navigate to the **Settings** > **History** node. Change the
time period to a smaller interval, for example 90 days. Click **Save** and rerun the jobs.
- - All of the record sets outside the new retention limit are dropped, and the database size is
- back down where it belongs
+ - Access Analyzer drops all of the record sets outside the new retention limit, and the
+ database size returns to where it belongs
## Job Logs
-The job logs are stored within the output folder of each job. They can be read in the Access
-Analyzer Console within the job’s **Status** > **Messages** table. To access the logs within the
-job’s directory, right-click on the job’s node in the Navigation pane and select **Explore Folder**.
+Access Analyzer stores the job logs within the output folder of each job. You can read them in the
+Access Analyzer Console within the job’s **Status** > **Messages** table. To access the logs within the
+job’s directory, right-click the job’s node in the Navigation pane and select **Explore Folder**.
-The most recent log is open. Older jobs are stored as zip files, according to the Log Retention
-Period setting. Each log is named in the following format:
+The most recent log is open. Access Analyzer stores older jobs as zip files, according to the Log
+Retention Period setting. Access Analyzer names each log in the following format:
- Open/Latest Log Name – `[Jobname]_Log.tsv`
- Older/Zipped Log Name – `[Jobname]_Log_[Date]_[Time].zip`
diff --git a/docs/accessanalyzer/12.0/admin/settings/hostdiscovery.md b/docs/accessanalyzer/12.0/admin/settings/hostdiscovery.md
index 4b2527683a..8ea3ac1522 100644
--- a/docs/accessanalyzer/12.0/admin/settings/hostdiscovery.md
+++ b/docs/accessanalyzer/12.0/admin/settings/hostdiscovery.md
@@ -7,23 +7,23 @@ sidebar_position: 60
# Host Discovery
The Host Discovery node is for configuring the settings which dictate how Access Analyzer handles
-newly discovered hosts, what information is logged during the host discovery process, and how long
-the logged information is stored.
+newly discovered hosts, what information Access Analyzer logs during the host discovery process,
+and how long it stores the logged information.
In the Host Discovery Options section at the top is a checkbox for the **Perform the first inventory
-right away for newly discovered hosts** option. This option is selected by default.
+right away for newly discovered hosts** option. By default, Access Analyzer selects this option.
- If selected, Access Analyzer retrieves information about a host as soon as it is discovered
-- If deselected, the host inventory information can be obtained later according to the Host
+- If deselected, you can obtain the host inventory information later according to the Host
Inventory node options
The configurable options in the Discovery Log section are:
-- Retention period – Determines how long the Host Discovery query log is kept. This is set by
- default to 14 days which is based on average Access Analyzer usage.
-- Log level – Determines what information is stored in the Host Discover query log
+- Retention period – Determines how long Access Analyzer keeps the Host Discovery query log. This
+ defaults to 14 days, based on average Access Analyzer usage.
+- Log level – Determines what information Access Analyzer stores in the Host Discover query log
@@ -33,8 +33,8 @@ The log levels are:
logging
- Records all Info level information
- - If files are referenced or updated during the process of running the query then the path to
- the affected file is shown
+ - If the query references or updates files while running, Access Analyzer shows the path to
+ the affected file
- Helps [Netwrix Support](https://www.netwrix.com/support.html) to assist in diagnosing issues
which may be causing host inventories to fail
- Creates the largest file
@@ -56,16 +56,15 @@ The log levels are:
- Error – Records all errors which occur during the host discovery process
:::info
- Set the Log Level to Error. The default setting is Info, but it is
- recommended that the setting for daily use be set to Error. The other log levels are designed to
- assist with troubleshooting host discovery and host inventory issues.
+ Set the Log Level to Error for daily use. The default setting is Info. The other log levels
+ are designed to assist with troubleshooting host discovery and host inventory issues.
:::
The **Cancel** and **Save** buttons are in the lower-right corner of the Host Discovery view. These
-buttons become enabled when modifications are made to the Host Discovery global settings. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you modify the Host Discovery global settings. Whenever
+you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you didn't intend to make changes.
diff --git a/docs/accessanalyzer/12.0/admin/settings/hostinventory.md b/docs/accessanalyzer/12.0/admin/settings/hostinventory.md
index dd7dc1eda9..8bc3e5f7c1 100644
--- a/docs/accessanalyzer/12.0/admin/settings/hostinventory.md
+++ b/docs/accessanalyzer/12.0/admin/settings/hostinventory.md
@@ -12,7 +12,7 @@ setting what out-of-the box host lists are visible in the Host Management node.
-In the Inventory Items section, there are four program property groups:
+The Inventory Items section contains four program property groups:
- Operating System – Includes 7 Items
- Application – Includes 7 Items
@@ -21,8 +21,8 @@ In the Inventory Items section, there are four program property groups:
Each of these groups brings back the properties enumerated in the list below the group title. These
collected properties correspond to the columns in the Host Management tables. Deselecting a checkbox
-prevents that information from being collected for target hosts. However, some solutions require
-this information.
+prevents Access Analyzer from collecting that information for target hosts. However, some
+solutions require this information.
:::info
Leave the default setting of all the groups selected. Consult with
@@ -31,15 +31,15 @@ groups.
:::
-In the Performance Tuning section, there are five settings which allocate console resources to the
+The Performance Tuning section contains five settings that allocate console resources to the
host inventory process:
-- Threads – Indicates the number of job threads that are employed during the host inventory process
+- Threads – Indicates the number of job threads Access Analyzer employs during the host inventory
+ process
- The default setting is 20 Threads
- - Maximum thread count is 100. Thread count will revert back to 100 if values over 100 are
- entered.
- - Restart Access Analyzer if thread count is changed for changes to take place
+ - Maximum thread count is 100. Thread count reverts back to 100 if you enter values over 100.
+ - Restart Access Analyzer if you change thread count for changes to take place
- Thread timeout [in seconds] – Indicates the time a thread will spend in retrieving information
from a host
@@ -48,16 +48,16 @@ host inventory process:
- If thread can't receive an active response from target host, the thread will move on to the
next host in the queue
-- Stop on Failed Ping – If the Stop on Failed Ping checkbox is selected, hosts that don't respond
- to pings aren't queried. Otherwise, hosts will be queried regardless.
+- Stop on Failed Ping – If the Stop on Failed Ping checkbox is selected, Access Analyzer doesn't
+ query hosts that don't respond to pings. Otherwise, Access Analyzer queries hosts regardless.
- PING timeout [in seconds] – Indicates the time a thread will spend pinging a host
- Default setting is 4 seconds
- - If thread can't connect with a host, the host will be designated as being offline and the
- thread will move on to the next host in the queue
+ - If the thread can't connect with a host, Access Analyzer designates the host as offline and
+ the thread moves on to the next host in the queue
- Only refresh inventory items older than [time selected] – Indicates the time that needs to pass
- before the host inventory process is automatically refreshed
+ before Access Analyzer automatically refreshes the host inventory process
- Default setting is 60 days
- The number textbox has a five-character limit
@@ -72,16 +72,17 @@ host inventory process:
[Host Discovery Wizard](/docs/accessanalyzer/12.0/admin/hostdiscovery/wizard/overview.md) topic for additional information.
The Desired Host List Views section at the bottom contains all available host lists, both
-built-in lists and custom-created lists. There are seven Default Hosts Lists which correspond
-to the solutions that target them. During the host inventory process, hosts which meet the filter
-criteria for these default lists are automatically populated into that host list. A checkmark in
+built-in lists and custom-created lists. Seven Default Host Lists correspond
+to the solutions that target them. During the host inventory process, Access Analyzer automatically
+populates hosts which meet the filter criteria for these default lists into that host list. A
+checkmark in
front of the host list indicates that the list is visible in the **Host Management** > **All Hosts**
node.
The **Cancel** and **Save** buttons are in the lower-right corner of the Host Inventory view. These
-buttons become enabled when modifications are made to the Host Inventory global settings. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you modify the Host Inventory global settings. Whenever
+you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you didn't intend to make changes.
## Default Host Lists
@@ -90,7 +91,7 @@ filter criteria. These lists correspond to the pre-configured solution jobs whic
### AD Host List
-The **AD** Host List can be expanded and contains five sub-groups used by the Active Directory
+You can expand the **AD** Host List, which contains five sub-groups used by the Active Directory
Solution and the Active Directory Inventory Solution:
@@ -113,7 +114,7 @@ There are no sub-groups for ALL WINDOWS HOSTS.
### DG Host List
-The **DG** Host List can be expanded and contains three sub-groups used by the Data Access
+You can expand the **DG** Host List, which contains three sub-groups used by the Data Access
Governance for File System Solution.
@@ -126,8 +127,8 @@ The sub-groups are:
### EXCHANGE Host List
-The **EXCHANGE** Host List can be expanded and contains six sub-groups used by the Exchange
-Solution. Four of these sub-groups can also be expand.
+You can expand the **EXCHANGE** Host List, which contains six sub-groups used by the Exchange
+Solution. You can also expand four of these sub-groups.
@@ -153,7 +154,7 @@ There are no sub-groups for SQL SERVERS.
### Windows Server Host List
-The **Windows Server** Host List can be expanded and contains three sub-groups used by the
+You can expand the **Windows Server** Host List, which contains three sub-groups used by the
Windows Solution.
@@ -166,7 +167,7 @@ The sub-groups are:
### Work Station Host List
-The **Work Station** Host List can be expanded and contains one sub-group used by the Windows
+You can expand the **Work Station** Host List, which contains one sub-group used by the Windows
Solution.
diff --git a/docs/accessanalyzer/12.0/admin/settings/notification.md b/docs/accessanalyzer/12.0/admin/settings/notification.md
index 0a54bbec5c..dba2133a06 100644
--- a/docs/accessanalyzer/12.0/admin/settings/notification.md
+++ b/docs/accessanalyzer/12.0/admin/settings/notification.md
@@ -6,31 +6,31 @@ sidebar_position: 80
# Notification
-The Notification node is where email notifications are configured. Emails can be sent from the
+The Notification node is where you configure email notifications. You can send emails from the
Access Analyzer Console for a variety of purposes: reports on collected data, change detection
alerts, conformance analysis notification, and more.
-To enable notifications from the Access Analyzer Console, a mail server must be configured for
+To enable notifications from the Access Analyzer Console, configure a mail server for
Access Analyzer to employ for sending emails.
-Access Analyzer supports authentication and encryption when sending email notifications.
-Notifications can be configured based on the requirements of an organizations mail environment.
+Access Analyzer supports authentication and encryption when sending email notifications. You can
+configure notifications based on the requirements of an organizations mail environment.
-Enable Access Analyzer notifications by configuring the Mail Server and Sender Information. It is
-recommended to send a test email to yourself after initial configuration to ensure proper settings.
+Enable Access Analyzer notifications by configuring the Mail Server and Sender Information. Send a
+test email to yourself after initial configuration to ensure proper settings.
See the [Test Notification Settings](#test-notification-settings) topic for additional information.
The **Cancel** and **Save** buttons are in the lower-right corner of the Notification view. These
-buttons become enabled when modifications are made to the Notification global setting. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you modify the Notification global setting. Whenever
+you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you didn't intend to make changes.
## Configure SMTP Server Information
-The Mail Server section at the top of the page is where an organization’s SMTP Server information is
-provided.
+The Mail Server section at the top of the page is where you provide an organization’s SMTP Server
+information.
@@ -67,45 +67,45 @@ account.
**Step 2 –** Click **Save**.
-The credentials for Mail Server authentication account have been updated and committed to the
-Console.
+Access Analyzer updates and commits the credentials for the Mail Server authentication account to
+the Console.
## Sender Information
-The Sender Information section is where the sender information is provided.
+The Sender Information section is where you provide the sender information.
Configure the sender information for all Access Analyzer notifications. Since this is a global
settings, any recipients configured at this level receive all notifications sent from Access
-Analyzer, and are sent to this recipient list unless inheritance is broken at the job group or job
+Analyzer, and are sent to this recipient list unless you break inheritance at the job group or job
level.
- Sender Name – Name displayed in the sent from field of the email
-- Sender Address – Sender’s email address. This does not have to be a real email address, unless
+- Sender Address – Sender’s email address. This doesn't have to be a real email address, unless
required by the organization. It can be something as simple as `accessanalyzer@yourdomain.com`.
## Email Content
-The Email Content section is where the recipient information is provided.
+The Email Content section is where you provide the recipient information.
- To / CC / BCC – Enter the email addresses for the recipients of the email notifications. Use a
semicolon (;) to separate multiple recipients.
- Recipients listed at this global level receive all email notifications sent by Access Analyzer
- unless inheritance is broken at the job group or job levels
+ unless you break inheritance at the job group or job levels
## Test Notification Settings
-Once the global **Notification** settings have been configured, it is recommended to send a test
-email to ensure proper configuration. This verifies all settings are correct and email is received
-as expected.
+After you configure the global **Notification** settings, send a test
+email to ensure proper configuration. This verifies all settings are correct and that you receive
+the email as expected.
-The Test Email Settings button sends a test email to the recipient list. It is recommended that you
-test by sending an email to yourself. Once all Notification settings are configured, click the
+The Test Email Settings button sends a test email to the recipient list. Test by sending an email
+to yourself. After you configure all Notification settings, click the
**Test Email Settings** button.
@@ -115,13 +115,14 @@ A message displays stating that the test e-mail was sent successfully.
:::note
-If there are any problems with the information, an error message will appear during the
-Test Email settings process. Correct the Notification settings until the test email is sent
-successfully.
+If any problems occur with the information, an error message appears during the
+Test Email settings process. Correct the Notification settings until Access Analyzer sends the
+test email successfully.
:::
-This email is sent to all recipients when the **Test Email settings** link is clicked. When the
-Notification settings are configured, click **Save** and then **Ok** to complete the configuration.
+Access Analyzer sends this email to all recipients when you click the **Test Email settings**
+link. When you configure the Notification settings, click **Save** and then **Ok** to complete
+the configuration.
diff --git a/docs/accessanalyzer/12.0/admin/settings/overview.md b/docs/accessanalyzer/12.0/admin/settings/overview.md
index 0fd64df73b..80fb7fc0cd 100644
--- a/docs/accessanalyzer/12.0/admin/settings/overview.md
+++ b/docs/accessanalyzer/12.0/admin/settings/overview.md
@@ -6,15 +6,15 @@ sidebar_position: 20
# Global Settings
-The global settings have an overall impact on the running ofAccess Analyzer jobs. Settings are
-inherited through a parent-child structure from the Settings node through the Jobs tree to the
-individual jobs unless inheritance is broken by direct assignment at either the job group or the
-individual job level.
+The global settings have an overall impact on the running of Access Analyzer jobs. Access Analyzer
+inherits settings through a parent-child structure from the Settings node through the Jobs tree to
+the individual jobs, unless direct assignment at either the job group or the individual job level
+breaks the inheritance.
-Some of these settings are configured during the initial launching of theAccess Analyzer Console.
-Others are configured as desired by the end-user. Expand the Settings node in the Navigation pane to
+You configure some of these settings during the initial launch of the Access Analyzer Console, and
+configure others as needed. Expand the Settings node in the Navigation pane to
select a global setting to configure:
- [Access](/docs/accessanalyzer/12.0/admin/settings/access/overview.md)
@@ -37,11 +37,11 @@ select a global setting to configure:
according to the data collector being used
- [Exchange](/docs/accessanalyzer/12.0/admin/settings/exchange.md)
- Required for auditing an organization’s Exchange environment
- - Only enabled for configuration once the Access Analyzer for Exchange Solution prerequisites
+ - Only enabled for configuration after the Access Analyzer for Exchange Solution prerequisites
are installed
- Configure Microsoft Exchange server connections and requires Exchange server versions and
names
- - The ExchangeMailbox, Exchange2K, ExchangePS, and ExchangePublicFolder Data Collectors utilize
+ - The ExchangeMailbox, Exchange2K, ExchangePS, and ExchangePublicFolder Data Collectors use
these global settings
- [History](/docs/accessanalyzer/12.0/admin/settings/history.md)
- Configure job data retention period settings
@@ -65,11 +65,11 @@ select a global setting to configure:
- [Schedule](/docs/accessanalyzer/12.0/admin/settings/schedule.md)
- Optional configuration during the initial launch if Windows authentication is used with the
Storage Profile
- - Required in order to schedule host inventory, job, analysis task, and action task execution
+ - Required to schedule host inventory, job, analysis task, and action task execution
- Provide credentials used against the Access Analyzer Console server to execute scheduled jobs
with the Windows Task Scheduler
- Creating a Schedule Service Account requires credentials on the Access Analyzer Console server
- - Multiple Schedule Service Accounts can be configured
+ - You can configure multiple Schedule Service Accounts
- [Sensitive Data](/docs/accessanalyzer/12.0/admin/settings/sensitivedata/overview.md)
- Flag locations which are known to contain false positive criteria matches to be filtered out
of Sensitive Data Discovery reports
diff --git a/docs/accessanalyzer/12.0/admin/settings/reporting.md b/docs/accessanalyzer/12.0/admin/settings/reporting.md
index 65df5f4142..c859e72d2c 100644
--- a/docs/accessanalyzer/12.0/admin/settings/reporting.md
+++ b/docs/accessanalyzer/12.0/admin/settings/reporting.md
@@ -7,21 +7,20 @@ sidebar_position: 90
# Reporting
The Reporting node is for configuring the global settings for publishing Access Analyzer reports.
-The Web Console is where any reports which have been published can be viewed outside of the Access
+The Web Console is where users can view published reports outside the Access
Analyzer Console. The Web Console provides a consolidated logon housing both the published reports
-and the AIC (when applicable).
+and the Access Information Center (AIC) (when applicable).
-The publishing of reports can be disabled at the global level by selecting **Do not publish
-reports** from the Publish Option drop-down menu. It can also be disabled at the job group, job, or
+The publishing of reports can be disabled at the global level by selecting **Don't publish
+reports** from the Publish Option dropdown menu. It can also be disabled at the job group, job, or
report configuration level. See the [Jobs Tree](/docs/accessanalyzer/12.0/admin/jobs/overview.md) topic for additional
information.
The **Cancel** and **Save** buttons are in the lower-right corner of the Reporting view. These
-buttons become enabled when modifications are made to the Reporting global settings. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you modify the Reporting global settings. Whenever you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you didn't intend to make changes.
## Website URL
@@ -34,10 +33,10 @@ The default address is:
http://[Fully Qualified Domain Name of the Access Analyzer Console server]:8082
-This link is used to access the Web Console, and it is used for the web link in an emailed report.
-The protocol and port number may need to be modified to align with the organization’s environment,
-but it must match the information in the website’s configuration file. If the Web Console has been
-secured, this address must be manually updated:
+This address accesses the Web Console, and it also serves as the web link in an emailed report.
+You might need to modify the protocol and port number to align with the organization’s environment,
+but it must match the information in the website’s configuration file. If the Web Console is
+secured, you must manually update this address:
https://[Fully Qualified Domain Name of the StealthAUDIT Console server]:[Port Number]
@@ -51,11 +50,11 @@ topic for additional information.
## Publish Option
-The Publish Option allows you to enable or disable the publishing of reports at the global level.
+Use the Publish Option to enable or disable the publishing of reports at the global level.
-Select the **Publish reports** option to publish all Access Analyzer reports or select **Do not
+Select the **Publish reports** option to publish all Access Analyzer reports or select **Don't
publish reports** to disable the publishing. The inheritance of this setting can be broken at the
job group, job, or report levels.
@@ -65,10 +64,10 @@ Configure email reports sent out by Access Analyzer using the Email Report optio
-The **E-mail reports** checkbox enables recipients to receive all published reports, unless
-inheritance is broken at the job group, job, or report level. Separate multiple recipients with a
-semicolon. If commas are used as delimiters for email addresses, they will be converted into
-semicolons when the settings are saved.
+The **E-mail reports** checkbox enables recipients to receive all published reports, unless direct
+assignment at the job group, job, or report level breaks the inheritance. Separate multiple
+recipients with a semicolon. If you use commas to delimit email addresses, Access Analyzer converts
+them into semicolons when you save the settings.
:::info
Configure email reporting at a specific level to ensure recipients only receive
@@ -77,23 +76,23 @@ reports which apply to them.
:::note
-Email reports does not work unless Access Analyzer has been configured to send email
+Email reports doesn't work unless you configure Access Analyzer to send email
notifications through the **Notification** node. See the [Notification](/docs/accessanalyzer/12.0/admin/settings/notification.md) topic for
additional information.
:::
-The **Do Not Email Report If Blank** checkbox prevents reports from being sent via email if all
-elements are blank when generated. A blank report can occur if there is an error in data collection
-or if the report is configured for data which might not always be present (for example, new computer
-objects created since last scan).
+The **Don't Email Report If Blank** checkbox stops Access Analyzer from sending reports by email if
+all elements are blank when generated. A blank report can occur if there is an error in data
+collection or if you configured the report for data that might not always be present (for example,
+new computer objects created since last scan).
:::info
-Enable the **Do Not Email Report If Blank** option.
+Enable the **Don't Email Report If Blank** option.
:::
-The report can be sent using the desired **Email Content** option:
+You can send the report using the **Email Content** option you want:
- Web Link – Sends an email notice that the report has been published and provides the recipient
with a link to it in the Web console
@@ -102,15 +101,15 @@ The report can be sent using the desired **Email Content** option:
without row limit) to an email as a CSV file, excluding any charts
- PDF – Attaches the report to an email as a PDF file
-The **Subject(Prefix)** field identifies the prefix of the email subject line, unless inheritance is
-broken at the job group, job, or report level. The prefix appears in the email header preceding the
+The **Subject(Prefix)** field identifies the prefix of the email subject line, unless direct
+assignment at the job group, job, or report level breaks the inheritance. The prefix appears in the email header preceding the
report name. If left blank, Access Analyzer applies a prefix of `Access Analyzer Report` to the
email subject line.
## Configure JavaScript Settings for the Web Console
Any browser used to access the Web Console must have JavaScript allowed for all features of the Web
-Console to function correctly. If the JavaScript permission is not set as allowed for the entire
+Console to function correctly. If the JavaScript permission isn't set as allowed for the entire
browser, you must add the Web Console as an allowed site.
Follow the steps to allow JavaScript on the Web Console in Microsoft Edge.
@@ -128,9 +127,9 @@ under All permissions.
Console and click **Add**.
:::note
-If the global Allowed option is selected, you do not need to specifically add the Web
+If you select the global Allowed option, you don't need to specifically add the Web
Console as an allowed site.
:::
-The Web Console's URL is added to the Allow list and JavaScript is enabled for the Web Console.
+Microsoft Edge adds the Web Console's URL to the Allow list and enables JavaScript for the Web Console.
diff --git a/docs/accessanalyzer/12.0/admin/settings/schedule.md b/docs/accessanalyzer/12.0/admin/settings/schedule.md
index 460ecd17df..884a6ca30e 100644
--- a/docs/accessanalyzer/12.0/admin/settings/schedule.md
+++ b/docs/accessanalyzer/12.0/admin/settings/schedule.md
@@ -6,28 +6,28 @@ sidebar_position: 100
# Schedule
-The Schedule node contains objects referred to as Schedule Service Accounts. A Schedule Service
-Account is used to run scheduled tasks on the Access Analyzer Console server.
+The Schedule node contains objects referred to as Schedule Service Accounts. Use a Schedule Service
+Account to run scheduled tasks on the Access Analyzer Console server.
-Jobs can be executed manually as desired or scheduled to execute at designated times. For example,
+You can execute jobs manually, or schedule them to execute at designated times. For example,
you could schedule a job to run during hours when the office is closed and network traffic is low.
Windows uses the Schedule Service Account to access the task folders when launching scheduled tasks.
-Schedule Service Accounts are configured at the global level, and this account can be used to
+Configure Schedule Service Accounts at the global level. Use this account to
schedule jobs in the Schedule Wizard. See the [Schedules](/docs/accessanalyzer/12.0/admin/schedule/overview.md) topic for
additional information.
:::warning
-On Windows 2016 servers, the Schedule Service Account cannot be signed into an active
-session when the time comes for a scheduled task to start. Windows blocks the starting or running of
-scheduled tasks using an account that is logged into the server.
+On Windows 2016 servers, you can't sign the Schedule Service Account into an active
+session when the time comes for a scheduled task to start. Windows blocks scheduled tasks from
+starting or running when they use an account that's logged in to the server.
:::
**Password Storage Options**
-The password for the credential provided can be stored in the Access Analyzer application or the
+You can store the password for the provided credential in the Access Analyzer application or the
Access Analyzer Vault.
Choosing between the Access Analyzer application and Access Analyzer Vault is a global setting
@@ -55,16 +55,16 @@ least the following to meet Least Privileged specifications:
- Write Attributes
- Write Extended Attributes
-- To configure Least Privilege Model Schedule Service Accounts when Role Based Access is enabled,
+- To configure Least Privilege Model Schedule Service Accounts when you enable Role Based Access,
see the [Role Based Access](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/overview.md) topic for additional information
- If using Windows authentication for the Storage Profile, the Schedule Service Account must have a
sufficient level of rights to connect to and interact with the Access Analyzer database. See the
[Storage](/docs/accessanalyzer/12.0/admin/settings/storage/overview.md) topic for additional information.
The **Cancel** and **Save** buttons are in the lower-right corner of the Schedule view. These
-buttons become enabled when modifications are made to the Schedule global settings. Whenever changes
-are made at the global level, click **Save** and then **OK** to confirm the changes. Otherwise,
-click **Cancel** if no changes were intended.
+buttons become enabled when you modify the Schedule global settings. Whenever you make changes
+at the global level, click **Save** and then **OK** to confirm the changes. Otherwise,
+click **Cancel** if you didn't intend to make changes.
The Access Analyzer vault provides enhanced security through enhanced encryption to various
credentials stored by the Access Analyzer application. See the [Vault](/docs/accessanalyzer/12.0/admin/settings/application/vault.md) topic
@@ -72,7 +72,7 @@ for additional information.
## Schedule Service Account Types
-There are two types of accounts that can be used to configure the Schedule Service Account.
+Two types of accounts are available for the Schedule Service Account.
@@ -83,7 +83,7 @@ Use one of the following options for the Schedule Service Account:
- Credentials must have privileges sufficient for scheduling tasks on the Access Analyzer
Console server. If not, scheduled tasks fail to start.
- - This option cannot be edited or deleted
+ - You can't edit or delete this option
- User-supplied credentials – Provide credentials for a specific account with sufficient rights to
schedule tasks on the Access Analyzer Console server
@@ -92,20 +92,16 @@ Use one of the following options for the Schedule Service Account:
- A local Windows account is a specific account and not the default local system account
:::tip
-Remember, the Schedule Service Account cannot be signed into an active session on the Access
-Analyzer Console server when the time comes for a scheduled task to start when it has a Windows 2016
-operating system.
+Remember, on an Access Analyzer Console server running Windows 2016, you can't sign the Schedule
+Service Account into an active session when the time comes for a scheduled task to start.
:::
## Create a Schedule Service Account
-Follow the steps to create a Schedule Service Account.
-
:::tip
-Remember, the Schedule Service Account cannot be signed into an active session on the Access
-Analyzer Console server when the time comes for a scheduled task to start when it has a Windows 2016
-operating system.
+Remember, on an Access Analyzer Console server running Windows 2016, you can't sign the Schedule
+Service Account into an active session when the time comes for a scheduled task to start.
:::
@@ -130,12 +126,12 @@ types are:
- Application – Uses Access Analyzer’s configured Profile Security setting as selected at
the **Settings** > **Application** node
- Managed Service Account – Use previously configured MSA and gMSAs for authentication. The
- password fields are not applicable when this option is selected. See the
+ password fields aren't applicable when you select this option. See the
[Group Managed Service Accounts (gMSA) Configuration](/docs/accessanalyzer/12.0/admin/settings/connection/gmsa.md) topic for
additional information.
- - Password – Type the password
- - Confirm – Re-type the password
+ - Password – Enter the password
+ - Confirm – Re-enter the password
- Local Account – Use this option to specify a local account for the Access Analyzer Console server
@@ -145,43 +141,43 @@ types are:
- Application – Uses Access Analyzer’s configured Profile Security setting as selected at
the **Settings** > **Application** node
- - Password – Type the password
- - Confirm – Re-type the password
+ - Password – Enter the password
+ - Confirm – Re-enter the password
-**Step 3 –** Click **OK** and the credentials are verified. If there are no problems with the
+**Step 3 –** Click **OK**. Access Analyzer verifies the credentials. If there are no problems with the
provided credentials, the User Credentials window closes. Otherwise, one of the following error
messages might appear:
-- Passwords Do Not Match Error
+- Passwords Don't Match Error
- 
+ 
- - This error indicates the two password entries do not match. Click **OK** and reenter the
+ - This error indicates the two password entries don't match. Click **OK** and reenter the
passwords.
- Bad User Name or Password Error
- - This error indicates either the user account does not exist or the username and password do
+ - This error indicates either the user account doesn't exist or the username and password do
not match. Click **OK** and reenter the information.
- Insufficient Rights Error
- - This error indicates the account supplied does not have sufficient rights to create and run
+ - This error indicates the account supplied doesn't have sufficient rights to create and run
scheduled tasks. Click **OK** and provide credentials with sufficient rights.
- GPO Network Security Error
- - This error indicates that the GPO Network Security settings are configured to not allow
- storage of passwords and credentials for network authentication. Click OK. Disable the
+ - This error indicates that the GPO Network Security settings block storage of passwords and
+ credentials for network authentication. Click OK. Disable the
domain’s GPO Network Security settings or exempt the Access Analyzer Server from GPO.
- This error will also appear when trying to schedule a task using the domain’s Schedule Service
- Account where GPO Network Security is set to not allow storage of passwords and credentials
+ Account where the GPO Network Security setting blocks storage of passwords and credentials
for network authentication
**Step 4 –** The credential information appears in the User Credentials table. Click **Save** and
@@ -192,33 +188,28 @@ Access Analyzer can now schedule tasks with this Scheduled Service Account.
## Edit a Schedule Service Account
-Follow the steps to edit a Schedule Service Account credentials.
-
:::tip
-Remember, the Schedule Service Account cannot be signed into an active session on the Access
-Analyzer Console server when the time comes for a scheduled task to start when it has a Windows 2016
-operating system.
+Remember, on an Access Analyzer Console server running Windows 2016, you can't sign the Schedule
+Service Account into an active session when the time comes for a scheduled task to start.
:::
-**Step 1 –** Select a credential from the User Credentials list and click on **Edit**. The User
+**Step 1 –** Select a credential from the User Credentials list and click **Edit**. The User
Credentials window opens.
**Step 2 –** Modify the credential information as needed. See Step 2 of the
[Create a Schedule Service Account](#create-a-schedule-service-account) topic for additional
information.
-**Step 3 –** Click **OK** and the credentials will be verified. If there are no problems with the
+**Step 3 –** Click **OK**. Access Analyzer verifies the credentials. If there are no problems with the
provided credentials, the User Credentials window closes.
Access Analyzer can now schedule tasks with this Scheduled Service Account.
## Delete a Schedule Service Account
-Follow the steps to delete a Schedule Service Account.
-
**Step 1 –** Select the credential from the User Credentials list and click **Delete**. The Delete
@@ -232,6 +223,6 @@ Credentials confirmation window appears.
Account. Click **Save** and then **OK** to confirm the changes. To ensure these changes take effect,
exit and restart the Access Analyzer application.
-If all Schedule Service Accounts are removed and only the local System account remains, Access
-Analyzer cannot create or run scheduled tasks unless the local system account has adequate
+If you remove all Schedule Service Accounts and only the local System account remains, Access
+Analyzer can't create or run scheduled tasks unless the local system account has adequate
permissions.
diff --git a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/criteria.md b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/criteria.md
index e520fb1793..74f7117164 100644
--- a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/criteria.md
+++ b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/criteria.md
@@ -13,23 +13,22 @@ jobs using the Criteria Tab.
The options on the Criteria Tab are:
-- Add – Opens the Select Criteria window to add search criteria that will be inherited by Sensitive
- Data scan jobs. See the [Select Criteria Window](#select-criteria-window) topic for additional
+- Add – Opens the Select Criteria window to add search criteria that Sensitive Data scan jobs
+ inherit. See the [Select Criteria Window](#select-criteria-window) topic for additional
information.
-- Remove – Removes the selected criteria from being inherited by Sensitive Data scan jobs
+- Remove – Removes the selected criteria, so Sensitive Data scan jobs no longer inherit them
- Launch Editor – Opens the Sensitive Data Criteria Editor. See the
[Sensitive Data Criteria Editor](/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/overview.md) topic
for additional information.
- Search selected criteria – Filter the criteria listed in the Criteria tab
The **Cancel** and **Save** buttons are in the lower-right corner of the Sensitive Data view. These
-buttons become enabled when modifications are made to the Sensitive Data global settings. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you modify the Sensitive Data global settings. Whenever you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you didn't intend to make changes.
## Select Criteria Window
-Follow the steps to add Search Criteria for Sensitive Data scan jobs.
+Add Search Criteria for Sensitive Data scan jobs:
@@ -37,13 +36,13 @@ Follow the steps to add Search Criteria for Sensitive Data scan jobs.
-**Step 2 –** Select the checkbox to select the criteria. Use the **Search Criteria** text field to
-filter the list using keywords or expand each category to view and select individual Sensitive Data
+**Step 2 –** Select the checkbox for each criterion you want. Use the **Search Criteria** text field
+to filter the list by keyword, or expand each category to view and select individual Sensitive Data
search criteria.
**Step 3 –** Click **OK** to confirm changes. The Select Criteria window closes.
**Step 4 –** Click **Save** on the Sensitive Data view to save changes.
-The selected Search Criteria are now inherited by Sensitive Data scan jobs that are set to use
-global sensitive data criteria settings.
+Sensitive Data scan jobs that use global sensitive data criteria settings now inherit the selected
+Search Criteria.
diff --git a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/add.md b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/add.md
index eeb1f80544..91bfdf2fe5 100644
--- a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/add.md
+++ b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/add.md
@@ -6,25 +6,23 @@ sidebar_position: 10
# Adding False Positive Exclusion Filters
-Follow the steps to add a False Positive Exclusion Filter.
-
**Step 1 –** Click **Add Filter** to open the Add False Positive Exclusion Filter window.
-**Step 2 –** Enter the **File Path** according to the type of format for the repository.
+**Step 2 –** Enter the **File Path** using the format required for the repository type.
**Step 3 –** Indicate the type of repository by selecting either **File System** or **SharePoint**
-from the **Source** drop-down menu.
+from the **Source** dropdown menu.
-**Step 4 –** Select the required criteria from the list by selecting the relevant checkboxes. You
-can use the **Search Criteria** textbox to filter the list by keywords.
+**Step 4 –** Select the required criteria from the list by checking the relevant boxes. You
+can use the **Search Criteria** textbox to filter the list by keyword.
**Step 5 –** Click **OK** to add the filter to the False Criteria list. The Add False Positive
Exclusion Filter window closes.
**Step 6 –** Click **Save** on the Sensitive Data view to save changes.
-The false positive exclusion filter is now applied to Sensitive Data reports.
+Access Analyzer now applies the false positive exclusion filter to Sensitive Data reports.
diff --git a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/delete.md b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/delete.md
index 68825cdc8e..1704dd2fc4 100644
--- a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/delete.md
+++ b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/delete.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Deleting False Positive Exclusion Filters
-Follow the steps to delete a False Positive Exclusion Filter.
+To delete a False Positive Exclusion Filter:
@@ -14,4 +14,4 @@ Follow the steps to delete a False Positive Exclusion Filter.
**Step 2 –** Click **Save** on the Sensitive Data view to save changes.
-The false positive exclusion filter has been successfully deleted.
+Access Analyzer deletes the false positive exclusion filter.
diff --git a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/edit.md b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/edit.md
index b6caf7a1da..b6d1a8ed4f 100644
--- a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/edit.md
+++ b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/edit.md
@@ -6,8 +6,6 @@ sidebar_position: 20
# Editing False Positive Exclusion Filters
-Follow the steps to edit a False Positive Exclusion Filter.
-
**Step 1 –** Click **Edit Filter** to open the Edit False Positive Exclusion Filter window.
@@ -21,4 +19,4 @@ closes.
**Step 4 –** Click **Save** on the Sensitive Data view to save changes.
-The false positive exclusion filter has been successfully edited.
+Access Analyzer updates the false positive exclusion filter.
diff --git a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/export.md b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/export.md
index 8bdaf0abfc..ac761ca75f 100644
--- a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/export.md
+++ b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/export.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Exporting False Positive Exclusion Filters
-Follow the steps to export selected False Positive Exclusion Filters into a TXT file.
+Export selected False Positive Exclusion Filters into a TXT file.
@@ -18,4 +18,4 @@ Explorer opens.
**Step 2 –** Enter a File name for the TXT file that the exported false positive exclusion filters
will be contained in. Click **Save**.
-The False Positive Exclusion Filters are now exported.
+Access Analyzer exports the False Positive Exclusion Filters.
diff --git a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/import.md b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/import.md
index 17f8b147f9..1eccd8b36c 100644
--- a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/import.md
+++ b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/import.md
@@ -10,7 +10,7 @@ Create an import (TXT) file containing a list of file paths for the files to be
Sensitive Data reports. The text file should have one file path per row. The import file needs to be
scoped to a single solution and a criteria set.
-Follow the steps to import a list of False Positive Exclusion Filter.
+Import a list of False Positive Exclusion Filters:
@@ -19,12 +19,12 @@ window.
-**Step 2 –** Navigate to the file that will be imported. Select the file and click **Open**. The
+**Step 2 –** Navigate to the file to import. Select the file and click **Open**. The
Configure Imported False Positive Exclusion Filters window opens.
-**Step 3 –** Select the repository type from the **Source** drop-down menu.
+**Step 3 –** Select the repository type from the **Source** dropdown menu.
**Step 4 –** Select the required criteria from the list. You can use the **Search Criteria** textbox
to filter the list by keywords.
@@ -34,6 +34,7 @@ Filters window closes.
**Step 6 –** Click **Save** on the Sensitive Data view to save changes.
-The imported list of False Positive Exclusion Filters are now applied to Sensitive Data reports. If
-all of the files in the import were not meant to have the same Source and Criteria set, see the
+Access Analyzer now applies the imported list of False Positive Exclusion Filters to Sensitive Data
+reports. If
+all of the files in the import weren't meant to have the same Source and Criteria set, see the
[Editing False Positive Exclusion Filters](/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/edit.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/overview.md b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/overview.md
index 77c7faaf34..3936fbb6dc 100644
--- a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/overview.md
+++ b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/exclusions/overview.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# False Positives Tab
-Configure False Positive exclusion filters using the options in the False Positives tab. False
-Positives Filters listed here as False Positives results in the corresponding matches being removed
-from Access Analyzer and Access Information Center reports.
+Configure False Positive exclusion filters using the options on the False Positives tab. Filters
+listed here remove the corresponding matches from Access Analyzer and Access Information Center
+reports.
@@ -40,6 +40,5 @@ Filters:
- Criteria – Sensitive Data criteria where the exclusion filter is applied
The **Cancel** and **Save** buttons are in the lower-right corner of the Sensitive Data view. These
-buttons become enabled when modifications are made to the Sensitive Data global settings. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you modify the Sensitive Data global settings. Whenever you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you didn't intend to make changes.
diff --git a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/overview.md b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/overview.md
index d7d4af8e1e..c92756cb50 100644
--- a/docs/accessanalyzer/12.0/admin/settings/sensitivedata/overview.md
+++ b/docs/accessanalyzer/12.0/admin/settings/sensitivedata/overview.md
@@ -12,7 +12,7 @@ positive exclusion filters. These settings require Sensitive Data Discovery to b
information.
:::note
-Sensitive data exclusion filters can only be applied to the
+You can only apply sensitive data exclusion filters to the
[File System Solution](/docs/accessanalyzer/12.0/solutions/filesystem/overview.md) and the
[SharePoint Solution](/docs/accessanalyzer/12.0/solutions/sharepoint/overview.md).
:::
diff --git a/docs/accessanalyzer/12.0/admin/settings/servicenow.md b/docs/accessanalyzer/12.0/admin/settings/servicenow.md
index e9322d9ff6..79b4e12806 100644
--- a/docs/accessanalyzer/12.0/admin/settings/servicenow.md
+++ b/docs/accessanalyzer/12.0/admin/settings/servicenow.md
@@ -7,8 +7,8 @@ sidebar_position: 120
# ServiceNow
The ServiceNow® node is for configuring the settings needed to integrate with ServiceNow. These
-settings are exclusive to the Access Analyzer integration with ServiceNow and are used by the
-ServiceNow Action Module. See the [ServiceNow Action Module](/docs/accessanalyzer/12.0/admin/action/servicenow/overview.md) topic
+settings are exclusive to the Access Analyzer integration with ServiceNow, and the ServiceNow
+Action Module uses them. See the [ServiceNow Action Module](/docs/accessanalyzer/12.0/admin/action/servicenow/overview.md) topic
for additional information.
@@ -16,22 +16,19 @@ for additional information.
Provide ServiceNow authentication information to your ServiceNow instance.
- Instance – The ServiceNow instance, for example `example.service-now.com`
-- User Name and Password – The **Settings** > **ServiceNow** node at the global level can be
- configured with a credential provisioned to create incidents as Callers in the **Assigned to**
+- User Name and Password – You can configure the **Settings** > **ServiceNow** node at the global
+ level with a credential provisioned to create incidents as Callers in the **Assigned to**
field, and any other ServiceNow incident field that references the **sys_user** table.
The **Cancel** and **Save** buttons are in the lower-right corner of the ServiceNow view. These
-buttons become enabled when modifications are made to the ServiceNow global settings. Whenever
-changes are made at the global level, click **Save** and then **OK** to confirm the changes.
-Otherwise, click **Cancel** if no changes were intended.
+buttons become enabled when you modify the ServiceNow global settings. Whenever you make changes at the global level, click **Save** and then **OK** to confirm the changes.
+Otherwise, click **Cancel** if you didn't intend to make changes.
## Update ServiceNow Authentication Credentials
-Follow the steps to update the ServiceNow authentication credentials.
-
**Step 1 –** In the ServiceNow Authentication section, enter a new **Password** for the user
account.
**Step 2 –** Click **Save**.
-The credentials have been updated for ServiceNow authentication.
+Access Analyzer updates the credentials for ServiceNow authentication.
diff --git a/docs/accessanalyzer/12.0/admin/settings/storage/add.md b/docs/accessanalyzer/12.0/admin/settings/storage/add.md
index 874b25c73a..06be21957b 100644
--- a/docs/accessanalyzer/12.0/admin/settings/storage/add.md
+++ b/docs/accessanalyzer/12.0/admin/settings/storage/add.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Add a Storage Profile
-Follow the steps to create a Storage Profile.
+Create a Storage Profile:
@@ -19,8 +19,8 @@ Profile name to a unique and descriptive name.
-**Step 3 –** Type the SQL **Server name** in the textbox provided. This can be a NetBIOS name, a
-fully qualified domain name, or an IP Address. If the SQL Server specified is configured to use a
+**Step 3 –** Enter the SQL **Server name** in the textbox provided. This can be a NetBIOS name, a
+fully qualified domain name, or an IP Address. If the specified SQL Server uses a
named instance, provide the **Instance name** in the next textbox.
@@ -45,17 +45,17 @@ for additional information.
|:-------------------------------------------------------------------------------------------------------------------:|:-------------------------------------------------------------------------------------------------------------------------:|
| *Good Connection Test* | *Bad Connection Test* |
-**Step 6 –** It is recommended to test the credentials provided at this point. The radio button for
-**Use existing database** should be selected by default. Test the SQL Server connection by clicking
-the drop-down arrow for an existing database. If the connection is established, a listing of
-databases appears. If the connection cannot be established, an error warning displays.
+**Step 6 –** Test the credentials you provided at this point. By default, Access Analyzer selects the
+radio button for **Use existing database**. Test the SQL Server connection by clicking
+the dropdown arrow for an existing database. If Access Analyzer establishes the connection, a listing
+of databases appears. If Access Analyzer can't establish the connection, an error warning displays.
**Step 7 –** Set the database through one of the following options:
- Use existing database – Click this radio button and select a database from this list provided in
- the drop-down menu
+ the dropdown menu
- Create new database – Click this radio button and provide a unique, descriptive name in the
textbox
@@ -66,8 +66,8 @@ the appropriate permissions and lists any that are missing. If no permissions ar
message appears in the Connection report window. When there is a `Successful connection test`, click
**Close**.
-**Step 9 –** If **Create new database** was selected, the new database now exists. If **Use existing
-database** was selected, the Storage Profile is now linked to the database. Click **Save** and then
+**Step 9 –** If you selected **Create new database**, the new database now exists. If you selected
+**Use existing database**, the Storage Profile is now linked to the database. Click **Save** and then
**OK** to complete the creation of the new Storage Profile.
-The new Storage Profile is available to be used by Access Analyzer.
+Access Analyzer can now use the new Storage Profile.
diff --git a/docs/accessanalyzer/12.0/admin/settings/storage/default.md b/docs/accessanalyzer/12.0/admin/settings/storage/default.md
index 0a82c29851..2cfbbc8f02 100644
--- a/docs/accessanalyzer/12.0/admin/settings/storage/default.md
+++ b/docs/accessanalyzer/12.0/admin/settings/storage/default.md
@@ -6,9 +6,9 @@ sidebar_position: 30
# Set a Default Storage Profile
-While multiple Storage Profiles can exist, only one profile can be set as the default. A green
-checkmark next to the profile name indicates the default Storage Profile. Follow the steps to change
-the default Storage Profile at the global level.
+While multiple Storage Profiles can exist, you can set only one profile as the default. A green
+checkmark next to the profile name indicates the default Storage Profile. Change the default Storage
+Profile at the global level:
@@ -17,27 +17,28 @@ storage profile window opens.
-**Step 2 –** There are three options for host management data migration. Select the desired option,
-choose whether or not to apply the secondary option, and click **OK**.
+**Step 2 –** There are three options for host management data migration. Select the option you want,
+choose whether to apply the secondary option, and click **OK**.
- Merge your host management data with data in the destination table (Recommended) – This option
keeps existing hosts and host discovery tasks in the destination and updates the tasks based on
the information found in the source database
- - Use destination value on conflict – If selected, any conflicting information between the
- destination table and the source database is resolved in favor of the destination table
+ - Use destination value on conflict – If selected, this option resolves any conflicting
+ information between the destination table and the source database in favor of the destination
+ table
- Overwrite data in the destination table – This option replaces existing hosts and host discovery
tasks with ones found in the source database
- - Also overwrite shared host inventory data – If selected, host inventory data is also replaced
- with data found in the source database
+ - Also overwrite shared host inventory data – If selected, this option also replaces host
+ inventory data with data found in the source database
-- Don’t copy your host management data to destination table – This option does not copy, update, or
+- Don’t copy your host management data to destination table – This option doesn't copy, update, or
overwrite information between databases
- - Clear data in destination table – If selected, all host management data in the destination
- table is deleted
+ - Clear data in destination table – If selected, this option deletes all host management data in
+ the destination table
@@ -46,11 +47,11 @@ choose whether or not to apply the secondary option, and click **OK**.
**Step 4 –** A blue arrow now points to the new default Storage Profile. However, the arrow is also
-an indication that the new default is not fully recognized by Access Analyzer. Click **Save** and
+an indication that Access Analyzer doesn't yet fully recognize the new default. Click **Save** and
then **OK** to confirm the changes.
**Step 5 –** Finally, to ensure these changes take effect, exit the Access Analyzer application and
relaunch it.
-The blue arrow is replaced by the green checkmark, indicating the new default Storage Profile is
-recognized.
+The green checkmark replaces the blue arrow, indicating that Access Analyzer now recognizes the new
+default Storage Profile.
diff --git a/docs/accessanalyzer/12.0/admin/settings/storage/delete.md b/docs/accessanalyzer/12.0/admin/settings/storage/delete.md
index 62517f0759..2bc0ae4828 100644
--- a/docs/accessanalyzer/12.0/admin/settings/storage/delete.md
+++ b/docs/accessanalyzer/12.0/admin/settings/storage/delete.md
@@ -6,17 +6,17 @@ sidebar_position: 40
# Delete a Storage Profile
-Follow the steps to delete a Storage Profile.
+To delete a Storage Profile:
:::note
-This procedure does not delete databases from the SQL Server. It only removes the selected
+This procedure doesn't delete databases from the SQL Server. It only removes the selected
Storage Profile from this Access Analyzer Console.
:::
-**Step 1 –** Select the Storage Profile to be removed, and click **Delete**.
+**Step 1 –** Select the Storage Profile you want to delete, and click **Delete**.
@@ -25,4 +25,4 @@ Storage Profile from this Access Analyzer Console.
**Step 3 –** The profile disappears from the Storage Profiles list. Click **Save** and then **OK**
to confirm the changes.
-The Storage Profile has now been deleted.
+Access Analyzer deletes the Storage Profile.
diff --git a/docs/accessanalyzer/12.0/admin/settings/storage/overview.md b/docs/accessanalyzer/12.0/admin/settings/storage/overview.md
index fa6b500da7..fd0d5c6fe0 100644
--- a/docs/accessanalyzer/12.0/admin/settings/storage/overview.md
+++ b/docs/accessanalyzer/12.0/admin/settings/storage/overview.md
@@ -40,7 +40,7 @@ Each Storage Profile consists of the following parts:
:::
- - Windows authentication – Leverages the account used to run the Access Analyzer Console
+ - Windows authentication – Uses the account used to run the Access Analyzer Console
:::note
This option affects the credentials used for Schedule Service Accounts. See the
@@ -48,16 +48,16 @@ Each Storage Profile consists of the following parts:
:::
- - SQL Server authentication – Leverages the account provided in the **User name** and
+ - SQL Server authentication – Uses the account provided in the **User name** and
**Password** textboxes
- Use existing password – Use the password configured for the Storage Profile account
- Specify a new password below – Enter a new password for the selected Storage Profile account
- Database name – Name of the Access Analyzer database to use in this storage profile
- - Use existing database – Drop-down menu provides a list of databases on the named SQL Server,
+ - Use existing database – dropdown menu provides a list of databases on the named SQL Server,
provided the connection information supplied is correct. If the menu is empty, then a
- connection to the SQL Server was not established.
+ connection to the SQL Server wasn't established.
- Create new database – Access Analyzer automatically creates a new database using the name
provided in the textbox. This value should be a unique, descriptive name.
@@ -78,9 +78,9 @@ A green checkmark in the Storage Profiles list indicates the default Storage Pro
The **Cancel** and **Save** buttons are in the lower-right corner of the Storage view. These buttons
-become enabled when modifications are made to the Storage global setting. Whenever changes are made
+become enabled when you modify the Storage global settings. Whenever you make changes
at the global level, click **Save** and then **OK** to confirm the changes. Otherwise, click
-**Cancel** if no changes were intended.
+**Cancel** if you didn't intend to make changes.
The vault provides enhanced security through enhanced encryption to various credentials stored by
the Access Analyzer application. See the [Vault](/docs/accessanalyzer/12.0/admin/settings/application/vault.md) topic for additional
diff --git a/docs/accessanalyzer/12.0/admin/settings/storage/updateauth.md b/docs/accessanalyzer/12.0/admin/settings/storage/updateauth.md
index 11f161406c..31fe705594 100644
--- a/docs/accessanalyzer/12.0/admin/settings/storage/updateauth.md
+++ b/docs/accessanalyzer/12.0/admin/settings/storage/updateauth.md
@@ -6,9 +6,6 @@ sidebar_position: 20
# Update Authentication Credentials in a Storage Profile
-Follow the steps to update authentication credentials for a Storage Profile in the Access Analyzer
-Console.
-
**Step 1 –** Navigate to the **Settings** > **Storage** page.
**Step 2 –** Locate and select a **Storage Profile** to update.
@@ -21,4 +18,4 @@ Console.
**Step 5 –** Click **Apply**.
-A new password has been added to a Storage profile.
+Access Analyzer adds the new password to the Storage Profile.
diff --git a/docs/accessanalyzer/12.0/cdsa/job.md b/docs/accessanalyzer/12.0/cdsa/job.md
index 07ad440294..addcb73355 100644
--- a/docs/accessanalyzer/12.0/cdsa/job.md
+++ b/docs/accessanalyzer/12.0/cdsa/job.md
@@ -11,7 +11,7 @@ The CDSA Job is available through the Instant Job Library under the CDSA library
this instant job to the Jobs tree. When installing the job, select **Local host** on the Host pages
of the Instant Job Wizard.
-Ensure the supporting solutions have successfully collected and analyzed data prior to running this
+Ensure the supporting solutions have successfully collected and analyzed data before running this
job. See the [Presentation Dependencies](/docs/accessanalyzer/12.0/cdsa/presentation.md) topic for alignment between presentation
slides and jobs that supply the data points.
@@ -29,12 +29,12 @@ The CDSA job generates three PowerPoint files:
self-review as a PDF file
:::warning
-Do not send any these presentations to a customer in PowerPoint format.
+Don't send any these presentations to a customer in PowerPoint format.
:::
-The printable assets can be converted to PDFs or printed booklet style at a professional print shop
-(suggested) if desired.
+You can convert the printable assets to PDFs, or have them printed booklet style at a professional
+print shop (suggested), if desired.
These presentations are located within the job’s folder in the Access Analyzer installation
directory, which varies according to the location of the job within the Jobs tree. Navigate to this
@@ -53,7 +53,7 @@ are two presentation options for the live slide show:
- The **ePHI Security Assessment** slide show contains the ending slides with select summary slides
from the Classic slide show and is applicable to the healthcare industry
-Use the Custom Slide Show drop-down menu on the Slide Show ribbon in PowerPoint to select the
+Use the Custom Slide Show dropdown menu on the Slide Show ribbon in PowerPoint to select the
appropriate presentation.
:::note
@@ -73,7 +73,7 @@ Both of the printable assets have two customized options for converting to a PDF
- ePHI Security Assessment – Contains the ending slides with select summary slides from the Classic
slide show and is applicable to the healthcare industry
-Follow the steps to create the appropriate custom PDF.
+To create the appropriate custom PDF:
**Step 1 –** Use the **Save As** option.
@@ -81,12 +81,12 @@ Follow the steps to create the appropriate custom PDF.
**Step 3 –** Click **Options** and change the Range to **Custom show**.
-**Step 4 –** By default, this is set to the **CDSA Classic** show. If needed, change it to the
+**Step 4 –** By default, the file uses the **CDSA Classic** show. If needed, change it to the
**ePHI Security Assessment** show.
**Step 5 –** Click **OK** to confirm the option, and then click **Save** to generate the PDF.
-The presentation is converted to a PDF with only the applicable slides included.
+PowerPoint converts the presentation to a PDF with only the applicable slides included.
:::note
Slide 16 is hidden by default as same information is available on Slides 17-19.
diff --git a/docs/accessanalyzer/12.0/cdsa/overview.md b/docs/accessanalyzer/12.0/cdsa/overview.md
index 1fb89ff57c..b794fb2263 100644
--- a/docs/accessanalyzer/12.0/cdsa/overview.md
+++ b/docs/accessanalyzer/12.0/cdsa/overview.md
@@ -15,7 +15,7 @@ The CDSA job depends upon several Access Analyzer solutions for data collection.
## Supporting Solutions
-At a minimum the following solutions need to run prior to the CDSA job to provide the data used to
+At a minimum the following solutions need to run before the CDSA job to provide the data used to
generate the CDSA presentations:
- .Active Directory Inventory Solution
diff --git a/docs/accessanalyzer/12.0/cdsa/presentation.md b/docs/accessanalyzer/12.0/cdsa/presentation.md
index 795a74482e..ab511aed89 100644
--- a/docs/accessanalyzer/12.0/cdsa/presentation.md
+++ b/docs/accessanalyzer/12.0/cdsa/presentation.md
@@ -6,10 +6,10 @@ sidebar_position: 20
# Presentation Dependencies
-In the following subsections, each slide is aligned to the jobs that supply its data. The slide
+The following subsections align each slide to the jobs that supply its data. The slide
number is specific to the **Netwrix_CDSA_Presentation.pptx** file, as there are slight various in
page numbering with the files designed to be saved as PDFs. Many jobs contribute to multiple slides,
-so jobs are highlighted in bold text the first time they are listed.
+so this topic highlights jobs in bold text the first time they appear.
## Executive Summary Slide
@@ -416,8 +416,8 @@ Data is also supplied by the following jobs when they have been executed:
## Additional Findings (FS, AD, Windows OS) Slide
-Slide 17 in the **Netwrix_CDSA_Presentation.pptx** file is hidden by default. It is recommended to
-use Slides 18-20 instead, even when the primary jobs are the only ones supplying data. Slide 17 is
+Slide 17 in the **Netwrix_CDSA_Presentation.pptx** file is hidden by default. Use Slides 18-20
+instead, even when the primary jobs are the only ones supplying data. Slide 17 is
an alternative to slides 18-20. It has the following primary job dependencies:
- .Active Directory Inventory
diff --git a/docs/accessanalyzer/12.0/gettingstarted.md b/docs/accessanalyzer/12.0/gettingstarted.md
index f37693f394..31b86db720 100644
--- a/docs/accessanalyzer/12.0/gettingstarted.md
+++ b/docs/accessanalyzer/12.0/gettingstarted.md
@@ -6,14 +6,14 @@ sidebar_position: 2
# Getting Started
-Once Access Analyzer is installed, the following workflow will quickly enable users to begin
+Once Access Analyzer is installed, use the following workflow to quickly begin
auditing the organization’s IT infrastructure. See the
[Navigating the Console](/docs/accessanalyzer/12.0/admin/navigate/overview.md) topic for additional information and data grid
functionality.
## Initial Configuration During First Launch
-During the initial Access Analyzer Configuration Wizard, users are walked through configuring
+The initial Access Analyzer Configuration Wizard walks you through configuring
several key global settings:
- Storage
@@ -22,25 +22,25 @@ several key global settings:
- Requires credential on the SQL® Server database which is used to create and modify the Access
Analyzer database
- Option to either create a new database or point to an existing database
- - If using Windows Authentication, the Schedule node must be configured also
+ - If using Windows Authentication, you must also configure the Schedule node
- See the [Storage](/docs/accessanalyzer/12.0/admin/settings/storage/overview.md) topic for additional information
- Schedule
- - Only appears if the Storage Profile is configured to use Windows Authentication
- - If the Storage Profile is configured to use SQL Authentication, the setting is configured
+ - Only appears if you configure the Storage Profile to use Windows Authentication
+ - If you configure the Storage Profile to use SQL Authentication, you configure the setting
later
- See the [Schedule](/docs/accessanalyzer/12.0/admin/settings/schedule.md) topic for additional information
- Instant Job
- - Install the pre-configured solutions for which the organization is licensed
+ - Install the pre-configured solutions the organization has a license for
- See the [Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md) topic for additional
information
## Global Settings Configured
-The global Settings have an overall impact on the running of Access Analyzer jobs. They are managed
+The global Settings have an overall impact on the running of Access Analyzer jobs. You manage them
through the Settings node at the top of the Navigation pane. The following global Settings require
configuration from the start:
@@ -57,7 +57,7 @@ The other global Settings provide additional options for impacting how Access An
privileged application of Access Analyzer and report viewing or the enable the REST API
:::note
- If Role Based Access is enabled by accident, contact
+ If you enable Role Based Access by accident, contact
[Netwrix Support](https://www.netwrix.com/support.html) for assistance in disabling it.
:::
@@ -67,7 +67,7 @@ The other global Settings provide additional options for impacting how Access An
- [Exchange](/docs/accessanalyzer/12.0/admin/settings/exchange.md) – Configure Microsoft® Exchange Server connections
:::warning
-Do not configure data retention at the global level without ensuring History is
+Don't configure data retention at the global level without ensuring History is
supported by ALL solutions to be run.
:::
@@ -88,23 +88,23 @@ See the [Global Settings](/docs/accessanalyzer/12.0/admin/settings/overview.md)
## Discover Hosts
Within the terminology of Access Analyzer, hosts are the machines being targeted during data
-collection. Hosts can be discovered or manually introduced to Access Analyzer. Known hosts are then
-inventoried to populate dynamic host lists. Host discovery is done at the Host Discovery node.
-Hosts are manually introduced at the Host Management node.
+collection. You can discover hosts or manually introduce them to Access Analyzer. Access Analyzer
+then inventories known hosts to populate dynamic host lists. Perform host discovery at the Host
+Discovery node. Manually introduce hosts at the Host Management node.
-Host management consists of maintaining up-to-date host inventories and host lists which can be
-assigned to job groups or jobs as targeted hosts. See the
+Host management consists of maintaining up-to-date host inventories and host lists that you can
+assign to job groups or jobs as targeted hosts. See the
[Host Management](/docs/accessanalyzer/12.0/admin/hostmanagement/overview.md) topic for additional information.
## Job Workflow
-Once the global Settings are configured and hosts have been introduced to Access Analyzer, it is
+After you configure the global Settings and introduce hosts to Access Analyzer, it's
time to begin auditing. This requires an understanding of the relationship between solutions, job
groups, jobs, queries, analysis, actions, and reports.
The Access Analyzer job is the fundamental unit. Jobs are responsible for all data collection
-queries, analysis tasks, notification tasks, action tasks, and report generation. When Jobs are
-designed to work together, they are housed within job groups to control the order of job execution.
+queries, analysis tasks, notification tasks, action tasks, and report generation. When jobs are
+designed to work together, job groups house them to control the order of job execution.
Solutions are pre-configured job groups which have been designed to target specific types of
environments to audit for specific data sets, typically the most common types of information
desired.
diff --git a/docs/accessanalyzer/12.0/index.md b/docs/accessanalyzer/12.0/index.md
index 8f757e84f2..de30ff3b44 100644
--- a/docs/accessanalyzer/12.0/index.md
+++ b/docs/accessanalyzer/12.0/index.md
@@ -19,7 +19,7 @@ The platform framework contains the following key components:
Access Analyzer contains over 40 built-in data collection modules covering both on-premises and
cloud-based platforms from Operating Systems to Office 365. Leveraging an agentless architectural
-approach, our proprietary AnyData collector provides an easy, wizard-driven interface for
+approach, the proprietary AnyData collector provides a wizard-driven interface for
configuring the application to collect exactly the data needed, enabling fast, flawless,
lightest-weight possible data collection from dozens of data sources.
@@ -34,8 +34,8 @@ require a license.
The .Active Directory Inventory Solution is designed to provide essential user, group membership,
and computer details from the targeted domains to many Access Analyzer built-in solutions. Key
-information includes user status, user attributes, and group membership. The collected data is
-accessed by other Access Analyzer solutions and the Netwrix Access Information Center for analysis.
+information includes user status, user attributes, and group membership. Other Access Analyzer solutions and the Netwrix Access Information Center access the collected data
+for analysis.
This is a core solution available to all Access Analyzer users.
@@ -65,7 +65,7 @@ information.
The .NIS Inventory Solution is designed to provide essential user and group membership information
from a NIS domain, mapping these principals to Windows-style SIDs. This provides valuable
-information to the File Systems Solution when auditing NFS shares.
+information to the File Systems Solution for auditing NFS shares.
This is a core solution available to all Access Analyzer users.
@@ -83,7 +83,7 @@ information.
### Active Directory Permissions Analyzer Solution
-The Active Directory Permissions Analyzer Solution is designed to easily and automatically determine
+The Active Directory Permissions Analyzer Solution is designed to automatically determine
effective permissions applied to any and all Active Directory objects, at any scope, allowing for
the most authoritative view available of who has access to what in Active Directory.
@@ -131,18 +131,18 @@ reports that provide visibility into various aspects of supported databases.
- Instance Discovery – The Instance Discovery Solution discovers instances on supported database
servers.
- MongoDB Solution – The MongoDB Solution automates the process of understanding where MongDB
- databases exist and provides an overview of the MongoDB environment in order to answer questions
+ databases exist and provides an overview of the MongoDB environment to answer questions
around data access. With visibility into every corner of MongoDB and the operating system it
relies upon, organizations can proactively highlight and prioritize risks to sensitive data.
Additionally, organizations can automate manual, time-consuming, and expensive processes
- associated with compliance, security, and operations to easily adhere to best practices that keep
+ associated with compliance, security, and operations to adhere to best practices that keep
MongoDB Server safe and operational.
- MySQL Solution – The MySQL Solution automates the process of understanding where SQL databases
- exist and provides an overview of the MySQL environment in order to answer questions around data
+ exist and provides an overview of the MySQL environment to answer questions around data
access. With visibility into every corner of Microsoft SQL Server and the Windows operating system
it relies upon, organizations can proactively highlight and prioritize risks to sensitive data.
Additionally, organizations can automate manual, time-consuming, and expensive processes
- associated with compliance, security, and operations to easily adhere to best practices that keep
+ associated with compliance, security, and operations to adhere to best practices that keep
SQL Server safe and operational.
- Oracle Solution – The Oracle Solution delivers comprehensive permissions, activity, and sensitive
data auditing and reporting for Oracle databases. Through the power of Access Analyzer, users can
@@ -219,9 +219,8 @@ Sensitive data auditing requires the Sensitive Data Discovery Add-on.
### Unix Solution
-The Unix Solution reports on areas of administrative concern for Unix and Linux systems. Attention
-is given to users and group details, privileged access rights, and NFS and Samba sharing
-configurations.
+The Unix Solution reports on areas of administrative concern for Unix and Linux systems, focusing on
+users and group details, privileged access rights, and NFS and Samba sharing configurations.
See the [Unix Solution](/docs/accessanalyzer/12.0/solutions/unix/overview.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/install/application/database/database.md b/docs/accessanalyzer/12.0/install/application/database/database.md
index 633147cb50..d97adb77eb 100644
--- a/docs/accessanalyzer/12.0/install/application/database/database.md
+++ b/docs/accessanalyzer/12.0/install/application/database/database.md
@@ -6,20 +6,20 @@ sidebar_position: 10
# Access Analyzer Database
-The Access Analyzer database is dynamic in nature. There are a handful of required system tables
-which are created at installation time or when individual features are used the first time. All
-other data tables in the Access Analyzer database are created and bound to individual jobs which are
-added to the Access Analyzer Console. As jobs are created and modified, corresponding tables are
-created and modified in the database. A job can generate one or more tables.
-
-The structure and schema of each data table is controlled by the Access Analyzer data collector used
-to collect data and write results to the table. There is a one-to-one relationship between a task
+The Access Analyzer database is dynamic in nature. Access Analyzer creates a handful of required
+system tables at installation time or when you use individual features for the first time. It
+creates and binds all other data tables in the Access Analyzer database to individual jobs that you
+add to the Access Analyzer Console. As you create and modify jobs, Access Analyzer creates and
+modifies corresponding tables in the database. A job can generate one or more tables.
+
+The Access Analyzer data collector used to collect data and write results to the table controls the
+structure and schema of each data table. There is a one-to-one relationship between a task
created within a Access Analyzer job and the table to which the task writes results. Creating tasks
or adding and removing properties within a task modifies the schema of the table on subsequent
execution of the job.
Access Analyzer offers users the ability to modify its preconfigured jobs or create custom jobs and
-tasks as needed. Therefore, precise schema information for data tables cannot be predicted,
+tasks as needed. Therefore, precise schema information for data tables can't be predicted,
restricted, or locked down.
## Database Permissions
@@ -34,8 +34,8 @@ to the database.
:::
-If database owner rights cannot be obtained, the following SQL script can be executed by a database
-administrator (DBA) against the Access Analyzer database to grant the necessary permissions to the
+If database owner rights can't be obtained, a database
+administrator (DBA) can execute the following SQL script against the Access Analyzer database to grant the necessary permissions to the
appropriate users (replacing `` and `` with the appropriate values):
```sql
@@ -86,16 +86,16 @@ Analyzer.
user-configured time frame
- Reporting Needs – Anticipated data needed to generate reports
-Recommended SQL Server database sizes are provided for specific solutions in the
-[Requirements](/docs/accessanalyzer/12.0/requirements/overview.md) topics. These recommendations are based on
+The [Requirements](/docs/accessanalyzer/12.0/requirements/overview.md) topics provide recommended
+SQL Server database sizes for specific solutions. These recommendations are based on
environmental factors, the number of target objects within an environment (users, hosts, mailboxes,
-etc.), and the applicable factors listed above for the specific solution.
+etc.), and the applicable factors described earlier in this topic for the specific solution.
### Customer Examples of Database Sizing
-The overall database size is ultimately governed by an organization’s auditing objectives. The
-examples below provide a glimpse into how these objectives combine with the applicable factors above
-to impact the Access Analyzer database resource consumption.
+An organization’s auditing objectives ultimately govern the overall database size. The
+following examples provide a glimpse into how these objectives combine with the applicable factors
+described earlier in this topic to impact the Access Analyzer database resource consumption.
- Example from an Active Directory Solution Customer
- An Active Directory (AD) customer intends to collect AD User/Group/Membership information and
@@ -115,9 +115,9 @@ to impact the Access Analyzer database resource consumption.
information on file permissions and ages (and possibly, ad hoc, information on file system
activity) with an overall plan to identify stale data, consolidate active data on a subset of
the organization’s file system infrastructure, and to move that active data to a cloud-based
- platform like SharePoint Online. Activity monitoring (FSAC) is to be used ad hoc against open
- shares to profile resource ownership and also to validate the “staleness” of certain
- resources. The database sizing for a project of this scope could be up to 750 GB for the
+ platform like SharePoint Online. The customer plans to use Activity monitoring (FSAC) ad hoc
+ against open shares to profile resource ownership and also to validate the “staleness” of
+ certain resources. The database sizing for a project of this scope could be up to 750 GB for the
database, 240 GB for the transaction log, and 380 GB of TEMPDB space.
- Example from an Exchange Solution Customer
- An Exchange customer only intends to collect Mail-Flow Metrics for 100,000 Mailboxes from 10
@@ -131,12 +131,12 @@ to impact the Access Analyzer database resource consumption.
## Securing the Access Analyzer Database
-The typical database configuration is to have **sysadmin Server Role** assigned to the ID used to
+The typical database configuration assigns the **sysadmin Server Role** to the ID used to
connect to the SQL instance. It will allow full control over the instance where the Access Analyzer
-database resides. This configuration is chosen because Access Analyzer requires some interaction
-with the master database in order to install and configure the initial Access Analyzer database.
-When it is necessary to secure the Access Analyzer database, the following steps should be followed
-to achieve the minimum SQL security levels without breaking core Access Analyzer functionality.
+database resides. Use this configuration because Access Analyzer requires some interaction
+with the master database to install and configure the initial Access Analyzer database.
+The following sections describe how to secure the Access Analyzer database and achieve the minimum
+SQL security levels without breaking core Access Analyzer functionality.
### Database Creation & First Level of Security
@@ -145,7 +145,7 @@ for the server roles and user mappings.
-**Step 1 –** Create a new database for use with Access Analyzer. Right-click on the **Databases**
+**Step 1 –** Create a new database for use with Access Analyzer. Right-click the **Databases**
node and choose **New Database**.
@@ -168,8 +168,8 @@ Analyzer database. The available options are Windows authentication and SQL Serv
-- If **Windows authentication** is desired, then click **Search** and select the desired Windows
- account, which has been set up for use with Access Analyzer.
+- If **Windows authentication** is desired, then click **Search** and select the Windows
+ account that's set up for use with Access Analyzer.
@@ -177,7 +177,7 @@ Analyzer database. The available options are Windows authentication and SQL Serv
Analyzer.
:::note
-Set the **Default Database** as Access Analyzer (or the desired Access Analyzer database)
+Set the **Default Database** as Access Analyzer (or the Access Analyzer database you want)
and choose English as the **Default Language**.
:::
@@ -212,8 +212,8 @@ This step requires the completion of the Access Analyzer installation. See the
-- Click **Apply** and a Connection report window will open. Verify that the connection and test
- table drop were performed successfully.
+- Click **Apply** and a Connection report window will open. Verify that Access Analyzer performed the
+ connection and test table drop successfully.
- Click **Close** on the Connection report window and then **Save** the new Storage Profile.
@@ -225,11 +225,11 @@ appropriate options and then click **OK** to migrate data.
:::
-**Step 9 –** Make sure to close and re-open the Access Analyzer Console before continuing to
-configure or use Access Analyzer if a new database Storage Profile was chosen as the default.
+**Step 9 –** ensure to close and re-open the Access Analyzer Console before continuing to
+configure or use Access Analyzer if you chose a new database Storage Profile as the default.
-The **blue arrow** signifies the default profile was changed but does not take effect until the
-required restart of the Access Analyzer Console.
+The **blue arrow** signifies that you changed the default profile, but the change doesn't take
+effect until you restart the Access Analyzer Console.
See the [Access Analyzer Initial Configuration](/docs/accessanalyzer/12.0/install/application/firstlaunch.md) topic to perform these steps during
the initial configuration process after installation.
diff --git a/docs/accessanalyzer/12.0/install/application/database/otherlanguages.md b/docs/accessanalyzer/12.0/install/application/database/otherlanguages.md
index 0044b4b8b5..07654aba36 100644
--- a/docs/accessanalyzer/12.0/install/application/database/otherlanguages.md
+++ b/docs/accessanalyzer/12.0/install/application/database/otherlanguages.md
@@ -11,21 +11,21 @@ environment, specifically when the environment uses a non-Latin alphabet.
## Requirements
-The following collation requirements need to be met prior to the Access Analyzer installation.
+Meet the following collation requirements before installing Access Analyzer.
### Database & Server Collation Settings
-The collation settings at the database level must match what is set at the server level.
+The collation settings at the database level must match the server-level collation setting.
**Symptoms**
Common errors that occur are:
-- Implicit conversion of VARCHAR value to VARCHAR cannot be performed because the collation of the
+- Implicit conversion of VARCHAR value to VARCHAR can't be performed because the collation of the
value is unresolved due to a collation conflict.
- - Could not find stored procedure `#SA_ImportObject`
- - Cannot drop the procedure `#SA_ImportObject`, because it does not exist or lack of permission
-- Cannot resolve the collation conflict between **SQL_Latin1_General_CP1_CI_AS** and
+ - Couldn't find stored procedure `#SA_ImportObject`
+ - Can't drop the procedure `#SA_ImportObject`, because it doesn't exist or lack of permission
+- Can't resolve the collation conflict between **SQL_Latin1_General_CP1_CI_AS** and
**French_CI_AS** in the equal to operation.
**Cause**
@@ -37,17 +37,15 @@ Therefore, there will be issues in analysis due to the mismatch.
**Resolution**
-The following is a work-around which we use to avoid collation errors. However, when making changes
+The following is a workaround to avoid collation errors. However, when making changes
at the SQL Server level, use caution as it actually rebuilds all user/system database objects. If
-there are schema bound objects (i.e. Constraints), the whole operation will fail. Make sure to have
+there are schema bound objects (i.e. Constraints), the whole operation will fail. ensure to have
all of the information or scripts needed to recreate the Access Analyzer user’s databases and all of
-the objects in them. Customers should use a localized version of the SQL Server, and this should not
+the objects in them. Customers should use a localized version of the SQL Server, and this shouldn't
be done in production environments.
#### Change Collation at the Database Level
-Follow the steps to change the collation at the database level.
-
**Step 1 –** Access the Database Properties in SQL Server Management Studio.
@@ -58,8 +56,6 @@ Now that the collations match, proceed with Access Analyzer installation.
#### Change Collation at the SQL Server Level
-Follow the steps to change the collation at the SQL Server level.
-
**Step 1 –** Stop the SQL Server service from the Configuration Manager.
@@ -87,13 +83,13 @@ Now that the collations match, proceed with Access Analyzer installation.
### Case Sensitive Collation
-Access Analyzer does not support case sensitive collation settings. Case insensitive collations are
-notated by having **CI** in the collation, for example **Latin1_General_CI_AS**.
+Access Analyzer doesn't support case sensitive collation settings. Case insensitive collations
+include **CI** in the collation name, for example **Latin1_General_CI_AS**.
**Cause**
-For example, `SYS.INDEXES` will be unable to be found if there was an English install of SQL Server
-but a Turkish collation which is case sensitive. So `'SYS.INDEXES != 'sys.indexes' `in the
+For example, if there's an English install of SQL Server but a Turkish collation, which is case
+sensitive, SQL Server can't find `SYS.INDEXES`. So `'SYS.INDEXES != 'sys.indexes' `in the
environment.
**Resolution**
@@ -105,9 +101,9 @@ All collation settings must be case insensitive.
The following are possible problems for future consideration.
During comparison or joining of columns, collation conflict error occurs in two cases if collation
-of one column does not match with collation of another column:
+of one column doesn't match with collation of another column:
-This can be generated by the following script:
+The following script can generate this:
```
CREATE TABLE TestTab
@@ -119,18 +115,18 @@ INSERT INTO TestTab VALUES (1, 'abc', 'abc')
SELECT * FROM TestTab WHERE CharCol = CharCol2
```
-- Error Returned – Cannot resolve the collation conflict between **Greek_CI_AS** and
+- Error Returned – Can't resolve the collation conflict between **Greek_CI_AS** and
**French_CI_AS** in the equal to operation.
-- Resolution – If the select statement is changed as below, then it would run successfully.
+- Resolution – If you change the select statement as follows, it runs successfully.
```
SELECT * FROM TestTab WHERE CharCol = CharCol2 COLLATE Albanian_CI_AI
```
:::note
-Explicit collation (Albanian_CI_AI) is not one of any column, but after that it will
-complete successfully. The collation of two columns have not been matched, instead the third rule of
-collation precedence was implemented. See the Microsoft
+Explicit collation (Albanian_CI_AI) isn't one of any column, but after that it will
+complete successfully. SQL Server hasn't matched the collation of the two columns; instead, it
+implements the third rule of collation precedence. See the Microsoft
[Collation Precedence](https://learn.microsoft.com/en-us/sql/t-sql/statements/collation-precedence-transact-sql)
article for additional information.
:::
diff --git a/docs/accessanalyzer/12.0/install/application/firstlaunch.md b/docs/accessanalyzer/12.0/install/application/firstlaunch.md
index dce40faf05..cfdd4ea176 100644
--- a/docs/accessanalyzer/12.0/install/application/firstlaunch.md
+++ b/docs/accessanalyzer/12.0/install/application/firstlaunch.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Access Analyzer Initial Configuration
-Once the Access Analyzer installation process is complete, and before performing actions within
-Access Analyzer, the initial settings for the Access Analyzer Console must be configured.
+After the Access Analyzer installation process is complete, and before performing actions within
+Access Analyzer, you must configure the initial settings for the Access Analyzer Console.
@@ -36,7 +36,7 @@ StealthAUDIT root folder path to copy from**. See the
**Step 4 –** Configure the options on the SQL Server Settings page.
- Server name – Enter the database server host name (NetBIOS name, FQDN, or IP Address)
-- Instance name – If the SQL Server is configured to use an instance name, provide the instance name
+- Instance name – If you configured the SQL Server to use an instance name, provide the instance name
in the text box. If not, leave this text box blank.
- To change the instance port number, provide the instance name in the format
@@ -46,30 +46,30 @@ StealthAUDIT root folder path to copy from**. See the
- Command timeout [number] minutes – Number of minutes before Access Analyzer halts any SQL queries
running for that amount of time. This prevents SQL queries from running excessively long. The
default is 1440 minutes.
-- Windows authentication – Leverages the account used to open the Access Analyzer Console. This
+- Windows authentication – Uses the account used to open the Access Analyzer Console. This
option will use Windows NT Authentication to authenticate to the SQL Server. It also requires the
Schedule Service Account to have proper permissions on the SQL database.
-- SQL Server authentication – Leverages an account created within the SQL Server.
+- SQL Server authentication – Uses an account created within the SQL Server.
- - User name and password – If SQL Server authentication is selected, provide the **User name**
+ - User name and password – If you select SQL Server authentication, provide the **User name**
and **Password** for the SQL account.
- Specify a new password below – Specify a new password for the SQL server.
-- Use existing database – Confirm the SQL Server connection has been established by selecting the
- radio button for **Use existing database** and clicking the drop-down arrow. If a listing of
- databases appears, then the connection has been established. Select this option to use a
- pre-existing database. Then select a database from the drop-down menu of available databases.
+- Use existing database – Confirm that Access Analyzer established the SQL Server connection by
+ selecting the radio button for **Use existing database** and clicking the dropdown arrow. If a
+ listing of databases appears, Access Analyzer established the connection. Select this option to
+ use a pre-existing database. Then select a database from the dropdown menu of available databases.
- Create new database – Select this option to create a new database during the configuration of the
storage profile. Enter a unique, descriptive name for the new database. If multiple databases
- might exist for Access Analyzer, then the default name of Access Analyzer is not recommended.
+ might exist for Access Analyzer, avoid using the default name of Access Analyzer.
See the [Securing the Access Analyzer Database](/docs/accessanalyzer/12.0/install/application/database/database.md#securing-the-access-analyzer-database)
topic for additional information on creating a SQL Server database for Access Analyzer.
**Step 5 –** Click **Next**.
-- If SQL Server authentication is used, the Options page is displayed next. Skip to Step 7.
-- If Windows Server authentication is used, the **Schedule Account** page is enabled for
+- If you use SQL Server authentication, the Options page displays next. Skip to Step 7.
+- If you use Windows Server authentication, the **Schedule Account** page becomes enabled for
configuration. Continue to Step 6.
@@ -79,7 +79,7 @@ page. The account configured here must be an Active Directory account and must h
Access Analyzer Console server’s local Task folders as well as sufficient rights to the Access
Analyzer database.
-There are two options that can be selected:
+You can select one of two options:
- Skip this step, I will configure a schedule service account later – Select this radio button to
skip this step and configure the schedule service account later
@@ -93,22 +93,21 @@ There are two options that can be selected:
-**Step 7 –** On the Options page, select whether to send usage statistics to Netwrix to help us
-improve our product. After the Usage Statistics option is set as desired, click **Next** to
+**Step 7 –** On the Options page, select whether to send usage statistics to Netwrix to help improve the product. After you set the Usage Statistics option as desired, click **Next** to
continue.
-- If selected, usage statistics are collected and sent to Netwrix
+- If selected, Access Analyzer collects usage statistics and sends them to Netwrix
- - Upon startup of the Access Analyzer console, the system checks if usage statistics have been
- sent in the last 7 days. If they have not been, stored procedures run against the Access
+ - Upon startup of the Access Analyzer console, the system checks whether it sent usage
+ statistics in the last 7 days. If not, stored procedures run against the Access
Analyzer database and gather data about job runs, access times, and environmental details like
- resource counts, users counts, number of exceptions, and so on. This data is then sent back to
- Netwrix to help us identify usage trends and common pain points, so that we can use this
- information to improve the product.
- - Only anonymous statistic-level data is included. No private company or personal data is
- collected or sent to Netwrix.
+ resource counts, users counts, number of exceptions, and so on. Access Analyzer then sends this
+ data back to Netwrix to help identify usage trends and common issues, which Netwrix uses to
+ improve the product.
+ - Access Analyzer includes only anonymous statistic-level data, and doesn't collect or send any
+ private company or personal data to Netwrix.
-- If cleared, no usage statistics are collected or sent to Netwrix
+- If cleared, Access Analyzer doesn't collect or send usage statistics to Netwrix
@@ -126,6 +125,6 @@ the log after exiting the wizard, it is located in the installation directory at
The Access Analyzer Console is now ready for custom configuration and use. There are a few
-additional steps to complete in order to begin collecting data, such as configuring a Connection
+additional steps to complete to begin collecting data, such as configuring a Connection
Profile and a Schedule Service account as well as discovering hosts and setting up host lists. See
the [Getting Started](/docs/accessanalyzer/12.0/gettingstarted.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/install/application/overview.md b/docs/accessanalyzer/12.0/install/application/overview.md
index b4478b1262..c0f9bf9bc2 100644
--- a/docs/accessanalyzer/12.0/install/application/overview.md
+++ b/docs/accessanalyzer/12.0/install/application/overview.md
@@ -11,7 +11,7 @@ required when first launching the Access Analyzer Console. It also includes addi
such as how to secure the Access Analyzer Database, and configuring the Web Console for viewing
reports outside of the Access Analyzer Console.
-Prior to installing Access Analyzer, please ensure that all of the prerequisites have been met. See
+Before installing Access Analyzer, ensure that you meet all of the prerequisites. See
the [Requirements](/docs/accessanalyzer/12.0/requirements/overview.md) topic for more information.
## Binaries
@@ -22,16 +22,14 @@ Your Netwrix Representative will provide the appropriate binaries.
- Access Analyzer binary – Core installation package
- Includes data collectors, analysis modules, and action modules
- - An organization’s license key, needed during installation, controls which components are laid
- down during installation
- - If your license includes Sensitive Data Discovery (SDD), the necessary SDD components are
- installed
+ - An organization’s license key, needed during installation, controls which components the
+ installation lays down
+ - If your license includes Sensitive Data Discovery (SDD), Access Analyzer installs the necessary SDD components
- Installs the Web Console
- File System Proxy binary – Installation package for the File System Proxy Scanning option
- - If your license includes Sensitive Data Discovery (SDD), the necessary SDD components are
- installed
+ - If your license includes Sensitive Data Discovery (SDD), Access Analyzer installs the necessary SDD components
- See the [File System Proxy Service Installation](/docs/accessanalyzer/12.0/install/filesystemproxy/wizard.md) topic for
additional information.
@@ -45,8 +43,7 @@ Your Netwrix Representative will provide the appropriate binaries.
- SharePoint Agent binary – Installation package for the SharePoint Agent (optional for Access
Auditing of SharePoint farms)
- - If your license includes Sensitive Data Discovery (SDD), the necessary SDD components are
- installed
+ - If your license includes Sensitive Data Discovery (SDD), Access Analyzer installs the necessary SDD components
- See the [SharePoint Agent Installation](/docs/accessanalyzer/12.0/install/sharepointagent/overview.md) topic for additional
information.
@@ -70,7 +67,7 @@ Your Netwrix Representative will provide the appropriate binaries.
are logged into the Netwrix Partner Portal can download the latest version of their software
products from the My Product page:
[https://www.netwrix.com/par/site/products](https://www.netwrix.com/my_products.html). To
- receive an invitation to the Partner Portal, please contact
+ receive an invitation to the Partner Portal, contact
[netwrix.msp@netwrix.com](http://netwrix.msp@netwrix.com/).
- See the
[Netwrix Access Information Center Documentation](https://helpcenter.netwrix.com/category/accessinformationcenter)
diff --git a/docs/accessanalyzer/12.0/install/application/reports/adfs.md b/docs/accessanalyzer/12.0/install/application/reports/adfs.md
index 944062cdb9..98b9a9e934 100644
--- a/docs/accessanalyzer/12.0/install/application/reports/adfs.md
+++ b/docs/accessanalyzer/12.0/install/application/reports/adfs.md
@@ -6,11 +6,11 @@ sidebar_position: 80
# Configuring the Web Console to use ADFS
-The Access Analyzer Webserver and Access Information Center are able to support Single-Sign-On (SSO)
+The Access Analyzer Webserver and Access Information Center can support Single-Sign-On (SSO)
leveraging WSFederation with SAML tokens. This guide contains steps for implementing SSO using
Active Directory Federation Services (ADFS).
-Follow the steps to configure the Web Console to use ADFS authentication:
+Configure the Web Console to use ADFS authentication:
:::note
A certificate from the ADFS server is required. Confer with a PKI administrator to
@@ -21,7 +21,7 @@ determine which certificate method will conform to the organization's security p
**Step 1 –** Import the certificate for the ADFS server onto the hosting server using the
Certificate Management MMC snap-in.
-- If used, self-signed certificates will also need to be imported
+- If used, also import self-signed certificates
**Step 2 –** On the ADFS server, open **AD FS Management**.
@@ -33,7 +33,7 @@ Add Relying Party Trust Wizard to configure the relying party trust:
**Next**.
- On the Specify Display Name page, enter a display name for the relying party trust. Click
**Next**.
-- On the Configure URL page, do not select any options and click **Next**.
+- On the Configure URL page, don't select any options and click **Next**.
@@ -46,7 +46,7 @@ Add Relying Party Trust Wizard to configure the relying party trust:
-**Step 4 –** Double-click on the newly added relying party trust to open it's Properties window.
+**Step 4 –** Double-click the newly added relying party trust to open it's Properties window.
Navigate to the Endpoints tab and click **Add WS-Federation**. On the Add an Endpoint window, add
``https://``:``/federation`` as the Trusted URL, then click
**OK**.
@@ -66,7 +66,7 @@ right-hand panel.
- On the Configure Claim Rule page, enter a name in the **Claim rule name** field.
-If the SID claim is not configured by default, add it to the Claim Description as follows:
+If ADFS doesn't configure the SID claim by default, add it to the Claim Description as follows:
@@ -121,12 +121,12 @@ The following is an example of how the parameters should look when configured in
**Step 9 –** Navigate to Services (`services.msc`). Restart the **Access Analyzer Web Server**
service.
-ADFS authentication is now enabled for Access Analyzer.
+Access Analyzer now supports ADFS authentication.
## Update the Published Reports URL for ADFS
-If ADFS does not accept `http://localhost:8082/` as an acceptable path, the path will need to be
-updated in the Published Reports properties window. Follow the steps to configure the Published
+If ADFS doesn't accept `http://localhost:8082/` as an acceptable path, you must update the path
+in the Published Reports properties window. Configure the Published
Reports URL for ADFS:
**Step 1 –** Right-click the Published Reports shortcut on the desktop and select **Properties**.
@@ -137,4 +137,4 @@ Reports URL for ADFS:
**Step 3 –** Click **Apply**. Exit the window.
-The Published Reports URL is now configured for ADFS.
+You've now configured the Published Reports URL for ADFS.
diff --git a/docs/accessanalyzer/12.0/install/application/reports/disclaimer.md b/docs/accessanalyzer/12.0/install/application/reports/disclaimer.md
index 2edb8758e9..ce192e450d 100644
--- a/docs/accessanalyzer/12.0/install/application/reports/disclaimer.md
+++ b/docs/accessanalyzer/12.0/install/application/reports/disclaimer.md
@@ -8,7 +8,6 @@ sidebar_position: 70
Users can add a disclaimer message to the logon screen by adding a custom `Disclaimer.txt` file in
the Web folder in the Access Analyzer directory and configuring the `WebServer.exe.config` file.
-Follow the steps to configure the optional disclaimer message:
**Step 1 –** Navigate to the Web folder of the installation directory:
` …\STEALTHbits\StealthAUDIT\Web`.
@@ -18,8 +17,8 @@ Follow the steps to configure the optional disclaimer message:
**Step 2 –** Create a `Disclaimer.txt` file in the Web folder. Write a custom disclaimer that
displays on the login page for the Web Console.
-- The text file must be named `Disclaimer.txt`. The disclaimer message option is not configured
- properly if using a text file with a different name.
+- You must name the text file `Disclaimer.txt`. If you use a text file with a different name, the
+ disclaimer message option won't work correctly.
@@ -43,10 +42,10 @@ displays on the login page for the Web Console.
-**Step 7 –** To check if the disclaimer message was configured correctly, open the Web Console to
-access the login page.
+**Step 7 –** To check whether you configured the disclaimer message correctly, open the Web Console
+to access the login page.
-- If the disclaimer is configured correctly, the custom disclaimer message displays at the bottom of
- the login page.
+- If you configured the disclaimer correctly, the custom disclaimer message displays at the bottom
+ of the login page.
The disclaimer message displays on the Web Console login page.
diff --git a/docs/accessanalyzer/12.0/install/application/reports/domains.md b/docs/accessanalyzer/12.0/install/application/reports/domains.md
index c6fb702078..d5ee4fc857 100644
--- a/docs/accessanalyzer/12.0/install/application/reports/domains.md
+++ b/docs/accessanalyzer/12.0/install/application/reports/domains.md
@@ -8,23 +8,23 @@ sidebar_position: 30
When the `AuthenticationDomains` parameter in the **WebServer.exe.config** file is blank, only
domain users from the domain where the Access Analyzer Console resides can access the Web Console.
-Access can be granted from other domains when specified within this parameter.
+You can grant access from other domains by specifying them within this parameter.
:::note
-Once another domain is added, then it is necessary to also add the domain where the Access
+After adding another domain, also add the domain where the Access
Analyzer Console resides.
:::
All domains provided or enumerated must have a trust relationship with the domain where Access
-Analyzer resides. Follow the steps to allow access to the Web Console from other domains.
+Analyzer resides.
**Step 1 –** Open the **WebServer.exe.config** file with a text editor, for example Notepad. It is
located within the Web folder of the Access Analyzer installation directory.
-**Step 2 –** Add the desired domains to the value for the `AuthenticationDomains` parameter:
+**Step 2 –** Add the domains you want to the value for the `AuthenticationDomains` parameter:
```
@@ -40,10 +40,10 @@ Use domain name in a comma-separated list. For example:
**Step 4 –** Navigate to Services (`services.msc`). Restart the Access Analyzer Web Server service.
-The Web Console can now be accessed from multiple domains.
+Users can now access the Web Console from multiple domains.
:::note
-In order for the AIC to be accessed from these domains, this must also be configured for
+For users to access the AIC from these domains, you must also configure this setting for
the AIC. See the Multiple Domains topic in the
[Netwrix Access Information Center Documentation](https://helpcenter.netwrix.com/category/accessinformationcenter)
for additional information.
diff --git a/docs/accessanalyzer/12.0/install/application/reports/entraidsso.md b/docs/accessanalyzer/12.0/install/application/reports/entraidsso.md
index f7780723e2..e277493faf 100644
--- a/docs/accessanalyzer/12.0/install/application/reports/entraidsso.md
+++ b/docs/accessanalyzer/12.0/install/application/reports/entraidsso.md
@@ -6,9 +6,9 @@ sidebar_position: 50
# Microsoft Entra ID Single Sign-On
-Microsoft Entra ID Single Sign-On (SSO) can be configured for logging in to the Web Console to view
-reports. When configured, users accessing the Web Console are directed to the Microsoft Entra
-ID login page, and can log in using their existing Entra credentials.
+You can configure Microsoft Entra ID Single Sign-On (SSO) for logging in to the Web Console to view
+reports. When configured, the Web Console directs users to the Microsoft Entra
+ID login page, where they can log in using their existing Entra credentials.
The following is required to use Microsoft Entra ID SSO:
@@ -20,9 +20,8 @@ ID, and then configure the Web Console to use it.
## Configure an Application in Microsoft Entra ID
-An application must be registered for the Web Console with your Microsoft Entra ID tenant and be
-configured with the necessary single sign-on settings. Follow the steps to create and configure the
-application.
+You must register an application for the Web Console with your Microsoft Entra ID tenant and
+configure it with the necessary single sign-on settings. Create and configure the application:
**Step 1 –** Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/).
@@ -53,8 +52,7 @@ Configuration section. Add your Identifier and Reply URL, and then click **Save*
https://app0190.train90.local:8082/federation
```
-**Step 6 –** Next, click **Edit** on the Attributes & Claims section. The four claims in the table
-below are required. For each of these, click **Add new claim**, enter the information from the
+**Step 6 –** Next, click **Edit** on the Attributes & Claims section. The four claims in the following table are required. For each of these, click **Add new claim**, enter the information from the
table, and then click **Save**.
| Name | Namespace | Source attribute |
@@ -64,23 +62,23 @@ table, and then click **Save**.
| sid | http://schemas.xmlsoap.org/ws/2005/05/identity/claims | user.onpremisessecurityidentifier |
| upn | http://schemas.xmlsoap.org/ws/2005/05/identity/claims | user.onpremisesuserprincipalname |
-Once configured they should show under Additional claims as below:
+Once configured, they should show under Additional claims as follows:
**Step 7 –** In the **Manage** > **Users and groups** section for your application, add any required
users or groups to give permission to access the application.
-The application is now configured with the necessary settings. The next step is to enable the use of
+You've now configured the application with the necessary settings. The next step is to enable the use of
Microsoft Entra ID SSO in the web server config file.
## Enable in the Web Server Config File
-To enable Microsoft Entra ID SSO for the Web Console, the web server config file needs to be updated
-with values from Microsoft Entra ID. Follow the steps to enable the SSO.
+To enable Microsoft Entra ID SSO for the Web Console, you need to update the web server config file
+with values from Microsoft Entra ID. Enable the SSO:
:::tip
-Remember, Enabling Entra ID SSO requires SSL to already have been enabled for the web server. See
+Remember, enabling Entra ID SSO requires that you already enabled SSL for the web server. See
the [Securing the Web Console](/docs/accessanalyzer/12.0/install/application/reports/secure.md) topic for additional information.
:::
@@ -95,17 +93,17 @@ Parameters in the config file, and add the required values from your Microsoft E
- WsFederationMetaData – Metadata markup for describing the services provided
- - This value can be retrieved from your application in Microsoft Entra ID: **Manage** > **Single
+ - You can retrieve this value from your application in Microsoft Entra ID: **Manage** > **Single
sign-on** > **SAML Certificates** > **App Federation Metadata Url**
- WsFederationRealm – Maps to the application identifier to Microsoft Entra ID
- - This value can be retrieved from your application in Microsoft Entra ID: **Manage** > **Single
+ - You can retrieve this value from your application in Microsoft Entra ID: **Manage** > **Single
sign-on** > **Basic SAML Configuration** > **Identifier**
- WsFederationReply – This is the endpoint for the configured relying party trust
- - This value can be retrieved from your application in Microsoft Entra ID: **Manage** > **Single
+ - You can retrieve this value from your application in Microsoft Entra ID: **Manage** > **Single
sign-on** > **Basic SAML Configuration** > **Reply URL**
For example:
@@ -121,4 +119,4 @@ For example:
**Step 4 –** Navigate to Services (`services.msc`). Restart the Netwrix Access Analyzer (formerly
Enterprise Auditor) Web Server service.
-The Web Console has been enabled for Microsoft Entra ID single sign-on.
+You've now enabled Microsoft Entra ID single sign-on for the Web Console.
diff --git a/docs/accessanalyzer/12.0/install/application/reports/kerberosencryption.md b/docs/accessanalyzer/12.0/install/application/reports/kerberosencryption.md
index 917acd99be..fbbebfcfa2 100644
--- a/docs/accessanalyzer/12.0/install/application/reports/kerberosencryption.md
+++ b/docs/accessanalyzer/12.0/install/application/reports/kerberosencryption.md
@@ -10,28 +10,28 @@ If a computer's Local Security Policy, or applicable Group Policy, enforces cert
methods for Kerberos authentication, then the service account running the Access Analyzer Web Server
must support the same encryption methods.
-If encryption methods have been configured for Kerberos on the Access Analyzer server but not on the
-service account running the Access Analyzer Web Server service, then users will not be able to
-log-in to the Web Console and will receive the below error message.
+If you configured encryption methods for Kerberos on the Access Analyzer server but not on the
+service account running the Access Analyzer Web Server service, users won't be able to
+log in to the Web Console and will receive the following error message.
-When this occurs, the following error will be logged:
+When this occurs, Access Analyzer logs the following error:
_ERROR - Unhandled server error: Nancy.RequestExecutionException: Oh noes! --->
-System.Security.SecurityException: The encryption type requested is not supported by the KDC_.
+System.Security.SecurityException: The encryption type requested isn't supported by the KDC_.
-This error will be logged in the following location:
+Access Analyzer logs this error in the following location:
**%SAINSTALLDIR%\SADatabase\Logs\Web\service.log**
-While it is not required to configure these settings, this section provides the locations and steps
+While it isn't required to configure these settings, this section provides the locations and steps
necessary to configure encryption methods in Local and Group policies to allow Kerberos for the
Report Index if an error does occur.
## Local Security Policies
-Follow the steps to configure a Local Security Policy to allow Kerberos.
+Configure a Local Security Policy to allow Kerberos.
**Step 1 –** Open the Local Security Policy window.
@@ -48,14 +48,14 @@ policy > click **Properties**.
**Step 5 –** Click **Apply**, then click **OK**.
-A Local Security Policy has been configured to allow encryption methods for Kerberos. Proceed to the
-[Configure Active Directory Users and Computers Settings to allow Kerberos](#configure-active-directory-users-and-computers-settings-to-allow-kerberos)
-section of this topic to ensure Active Directory Users and Computer settings are configured to allow
+You've now configured a Local Security Policy to allow encryption methods for Kerberos. Proceed to
+the [Configure Active Directory Users and Computers Settings to allow Kerberos](#configure-active-directory-users-and-computers-settings-to-allow-kerberos)
+section of this topic to ensure you configure Active Directory Users and Computer settings to allow
the encryption methods for Kerberos.
## Group Security Policy
-Follow the steps to configure a Local Group Security Policy to allow Kerberos.
+Configure a Local Group Security Policy to allow Kerberos.
**Step 1 –** Open the Local Group Policy Editor window.
@@ -73,17 +73,17 @@ policy, then click **Properties**.
**Step 5 –** Click **Apply**, then click **OK**.
-A Local Group Security Policy has been configured to allow encryption methods for Kerberos. Proceed
-to the
+You've now configured a Local Group Security Policy to allow encryption methods for Kerberos.
+Proceed to the
[Configure Active Directory Users and Computers Settings to allow Kerberos](#configure-active-directory-users-and-computers-settings-to-allow-kerberos)
-section of this topic to ensure Active Directory Users and Computer settings are configured to allow
+section of this topic to ensure you configure Active Directory Users and Computer settings to allow
the encryption methods for Kerberos.
## Configure Active Directory Users and Computers Settings to allow Kerberos
-Follow the steps to ensure the settings for Active Directory Users and Computers are configured to
-allow the encryption methods to allow Kerberos. Configurations selected in this section should
-reflect the configuration options selected in the two sections above. See the
+Ensure you configure the settings for Active Directory Users and Computers to
+allow the encryption methods for Kerberos. Configurations you select in this section should
+reflect the configuration options you selected in the two preceding sections. See the
[Local Security Policies](#local-security-policies) and
[Group Security Policy](#group-security-policy) topics for additional information.
@@ -103,6 +103,6 @@ reflect the configuration options selected in the two sections above. See the
**Step 6 –** Click **Apply**, then click **OK**.
-Active Directory Users and Computer settings have been configured to allow the encryption methods
+You've now configured Active Directory Users and Computer settings to allow the encryption methods
for Kerberos. These settings should match the configuration options for Local Security Policies and
Local Group Policies.
diff --git a/docs/accessanalyzer/12.0/install/application/reports/okta.md b/docs/accessanalyzer/12.0/install/application/reports/okta.md
index 4d3ffa765f..b20cb83937 100644
--- a/docs/accessanalyzer/12.0/install/application/reports/okta.md
+++ b/docs/accessanalyzer/12.0/install/application/reports/okta.md
@@ -8,7 +8,7 @@ sidebar_position: 90
Create an Access Analyzer Application in Okta Using the WS-Fed Template
-Follow the steps to create an Access Analyzer Application in Okta Using the WS-Fed Template:
+To create an Access Analyzer Application in Okta using the WS-Fed template:
**Step 1 –** Log in to Okta.
@@ -28,12 +28,12 @@ Retrieve the Values to Paste into the Access Analyzer WebServer.exe.config File
**Step 1 –** In the Access Analyzer application, click the **Sign On** tab.
-**Step 2 –** Right click on the **Identity Provider metadata** link and select **Copy Link Address**
+**Step 2 –** Right click the **Identity Provider metadata** link and select **Copy Link Address**
to get the value for the WSFederationMetadata URL.
****
-**Step 3 –** Click on the General tab to copy the value for the **Realm**. This value will be unique
+**Step 3 –** Click the General tab to copy the value for the **Realm**. This value will be unique
per tenant.
`https://www.okta.com/`
@@ -44,7 +44,7 @@ per tenant.
Edit the WebServer.exe.config File
-Follow the steps to edit the **WebServer.exe.config** file:
+To edit the **WebServer.exe.config** file:
**Step 1 –** Open the **WebServer.exe.config** file with a text editor, such as Notepad++. It is
located in the Web folder within the Access Analyzer installation.
@@ -111,7 +111,7 @@ populate the following fields.
-**Step 2 –** Navigate to the Directory menu and select **Profile Editor** from the drop-down menu.
+**Step 2 –** Navigate to the Directory menu and select **Profile Editor** from the dropdown menu.
Click the **Edit Profile** button for the Access Analyzer application.
@@ -138,12 +138,12 @@ attribute, click **Save and Add Another**.
-**Step 5 –** Navigate to the **Directory** menu and click on the **Provisioning** tab. Click **To
+**Step 5 –** Navigate to the **Directory** menu and click the **Provisioning** tab. Click **To
Okta**.
-**Step 6 –** Locate and map the attributes that were added for the profile by clicking the
+**Step 6 –** Locate and map the attributes that you added for the profile by clicking the
**Pencil** icon to edit attributes. To locate the attributes, scroll down and select **Show Unmapped
Attributes**.
@@ -165,7 +165,7 @@ additional information.
## Setting Up Multi-Factor Authentication
-Follow the steps to configure multi-factor-authentication for Access Analyzer:
+To configure multi-factor authentication for Access Analyzer:
@@ -181,4 +181,4 @@ opens. Configure the following options:
**Step 2 –** Scroll down to the Access section. Check the **Prompt for factor** box and select
**Every Sign On**. Click **Save**.
-Multi-Factor Authentication is now configured for Access Analyzer.
+You've now configured Multi-Factor Authentication for Access Analyzer.
diff --git a/docs/accessanalyzer/12.0/install/application/reports/overview.md b/docs/accessanalyzer/12.0/install/application/reports/overview.md
index 073ba21c27..b135ca2f1e 100644
--- a/docs/accessanalyzer/12.0/install/application/reports/overview.md
+++ b/docs/accessanalyzer/12.0/install/application/reports/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Reports via the Web Console
-The Web Console is where any reports which have been published can be viewed outside of the Access
+The Web Console is where you can view any published reports outside of the Access
Analyzer Console. This is also known as the Published Reports site.
- Web Console – This console uses an embedded website for published reports. It provides a
@@ -19,7 +19,7 @@ Console upon installation.
:::note
The Access Analyzer Web Server service must run as an account that has access to the
-Access Analyzer database. This may be a different account than the one used to connect Access
+Access Analyzer database. This may be a different account than the one you use to connect Access
Analyzer to the database. If the Access Analyzer Vault service is running, the account running the
Web Server service must be an Access Analyzer Administrator. See the
[Vault](/docs/accessanalyzer/12.0/admin/settings/application/vault.md) topic for additional information.
@@ -30,8 +30,8 @@ The Web folder that the Access Analyzer installer places at the root of the Acce
directory also contains a `WebServer.exe.config` file. This file contains configurable parameters.
:::warning
-If encryption methods have been configured for Kerberos on the Access Analyzer server
-but not on the service account running the Access Analyzer Web Server service, then users will not
+If you configure encryption methods for Kerberos on the Access Analyzer server
+but not on the service account running the Access Analyzer Web Server service, users will not
be able to log-in to the Web Console and will receive an error message. See the
[Manage Kerberos Encryption Warning for the Web Console](/docs/accessanalyzer/12.0/install/application/reports/kerberosencryption.md) topic for additional
information on configuring security polices to allow Kerberos encryption.
@@ -40,21 +40,21 @@ information on configuring security polices to allow Kerberos encryption.
## Log into the Web Console
-In order for a user to log into the Web Console, the user’s account must have the User Principal
-Name (UPN) attribute populated within Active Directory. Then the user can login using domain
-credentials. If multiple domains are being utilized, then
+To log into the Web Console, the user’s account must have a populated User Principal
+Name (UPN) attribute within Active Directory. Then the user can login using domain
+credentials. If the organization uses multiple domains,
the username needs to be in the `domain\username` format when logging into the Published Reports site.
-Access to reports in the Web Console can be managed through the Role Based Access feature of Access
+You can manage access to reports in the Web Console through the Role Based Access feature of Access
Analyzer (**Settings** > **Access**). The Web Administrator role and the Report Viewer role grant
access to the published reports. See the
[Role Based Access](/docs/accessanalyzer/12.0/admin/settings/access/rolebased/overview.md) topic for addition
information.
-The address to the Web Console can be configured within the Access Analyzer Console (**Settings** >
+You can configure the address to the Web Console within the Access Analyzer Console (**Settings** >
**Reporting**). The default address is `http://[hostname.domain.com]:8082`. From the Access Analyzer
-Console server, it can be accessed at `http://localhost/` with any standard browser. To access the
+Console server, you can access it at `http://localhost/` with any standard browser. To access the
Web Console from another machine in or connected to the environment, replace localhost with the name
of the Access Analyzer Console. See the [Update Website URLs](secure.md#update-website-urls) topic
for additional information.
@@ -67,7 +67,7 @@ topic for additional information.
:::
-Follow the steps to login to the Web Console.
+To log in to the Web Console:
**Step 1 –** To open the Web Console page, use one of the following methods:
@@ -80,7 +80,7 @@ Follow the steps to login to the Web Console.
- `https://[machinename]:8082`
:::note
-The URL that is used may need to be added to the browser’s list of trusted sites.
+You may need to add the URL to the browser’s list of trusted sites.
:::
diff --git a/docs/accessanalyzer/12.0/install/application/reports/secure.md b/docs/accessanalyzer/12.0/install/application/reports/secure.md
index 27fb00c1c9..95ca242c0f 100644
--- a/docs/accessanalyzer/12.0/install/application/reports/secure.md
+++ b/docs/accessanalyzer/12.0/install/application/reports/secure.md
@@ -6,19 +6,19 @@ sidebar_position: 10
# Securing the Web Console
-Published reports can be accessed in the Web Console. There are several options for enhancing
+You can access published reports in the Web Console. There are several options for enhancing
security.
Additional configuration options for enhanced security include:
- Enable SSL – The `BindingUrl` parameter shows the port used by the Access Analyzer web server for
SSL reports. If SSL is enabled, the value will be HTTPS instead of HTTP.
-- Enable Multiple Domain Access – The `AuthenticationDomains` parameter allows the Web Console to be
- accessed from multiple domains. By default this parameter is blank, allowing only domain users
+- Enable Multiple Domain Access – The `AuthenticationDomains` parameter lets users
+ access the Web Console from multiple domains. By default this parameter is blank, allowing only domain users
from the domain where the Access Analyzer Console resides to access the Web Console.
-- Enable Single Sign-On – The `WindowsAuthentication` parameter allows domain users to be
- automatically logged into the Web Console. By default this parameter is set to `false`, which
- requires domain users to login each time the Web Console is accessed. See the
+- Enable Single Sign-On – The `WindowsAuthentication` parameter lets domain users log in
+ automatically to the Web Console. By default this parameter is set to `false`, which
+ requires domain users to login each time they access the Web Console. See the
[Enable Single Sign-On](/docs/accessanalyzer/12.0/install/application/reports/sso.md) topic for additional information.
:::note
@@ -27,13 +27,13 @@ Additional configuration options for enhanced security include:
:::
-These parameters can be configured within the **WebServer.exe.config** file in the Web folder of the
+You can configure these parameters within the **WebServer.exe.config** file in the Web folder of the
Access Analyzer installation directory `…\STEALTHbits\StealthAUDIT\Web`.
## Enable SSL for the Web Console
-To enable Secure Sockets Layer (SSL) for secure, remote connections to the Web Console it is
-necessary to bind a certificate to the port. See the
+To enable Secure Sockets Layer (SSL) for secure, remote connections to the Web Console, you must
+bind a certificate to the port. See the
[Use a Self-Signed Certificate for SSL](#use-a-self-signed-certificate-for-ssl) topic for more
information. Follow the steps on the server where Access Analyzer is installed to enable SSL for the
Web Console.
@@ -41,8 +41,8 @@ Web Console.
:::note
The following steps require a certificate to be available. Organizations typically have
one or more system administrators responsible for Public Key Infrastructure (PKI) and certificates.
-To continue with this configuration it will first be necessary to confer with the PKI administrator
-to determine which certificate method will conform to the organization’s security policies.
+To continue with this configuration, you must first confer with the PKI administrator
+to determine which certificate method conforms to the organization’s security policies.
Optionally, see [Use a Self-Signed Certificate for SSL](#use-a-self-signed-certificate-for-ssl) for
an Administrator PowerShell command which will both create and import a self-signed certificate.
:::
@@ -52,16 +52,16 @@ an Administrator PowerShell command which will both create and import a self-sig
snap-in.
:::note
-If using a self-signed certificate, it will also need to be imported.
+If you're using a self-signed certificate, you must also import it.
:::
-**Step 2 –** Create an SSL binding. It is necessary to use the certificate’s **Hash** value for the
+**Step 2 –** Create an SSL binding. Use the certificate’s **Hash** value for the
`$certHash` value:
:::note
-The following Administrator PowerShell dir command can be run on the certificate's “drive”
-to find the **Hash** value of a certificate which was already created and the output will include
+You can run the following Administrator PowerShell dir command on the certificate's “drive”
+to find the **Hash** value of an existing certificate. The output includes
the Thumbprint (**Hash**) value and the certificate name:
:::
@@ -92,8 +92,8 @@ located within the Web folder of the Access Analyzer installation directory.
```
-- After changing the `BindingUrl` value in the **WebServer.exe.config** file, the Website URL must
- be updated to match the new value in the following places:
+- After you change the `BindingUrl` value in the **WebServer.exe.config** file, you must
+ update the Website URL to match the new value in the following places:
- Access Analyzer's **Settings** > **Reporting** node
- Access Analyzer's Published Reports Desktop icon properties
- See the [Update Website URLs](#update-website-urls) topic for additional information.
@@ -104,14 +104,14 @@ located within the Web folder of the Access Analyzer installation directory.
Enterprise Auditor) Web Server service.
:::note
-If also using the AIC, then SSL needs to be enabled for the AIC using this certificate.
+If you're also using the AIC, you must enable SSL for the AIC using this certificate.
See the Securing the AIC section of the
[Netwrix Access Information Center Documentation](https://helpcenter.netwrix.com/category/accessinformationcenter)
for additional information.
:::
-The Web Console has been enabled for SSL communication. Access it using the server’s fully qualified
+You have now enabled the Web Console for SSL communication. Access it using the server’s fully qualified
domain name and the HTTPS port (`https://[hostname.domain.com]:8082`). If a self-signed certificate
was used, then the client-side access to the Web Console will generate a Certificate error. See the
[Add the Certificate for Client-Side Access](#add-the-certificate-for-client-side-access) topic for
@@ -127,8 +127,6 @@ URL must be updated to match the new value in the following places:
**Update the Website URL in the Reporting Node**
-Follow the steps to update the Website URL in the **Settings** > **Reporting** node.
-
**Step 1 –** Expand **Settings** and select the **Reporting** node.
@@ -137,14 +135,11 @@ Follow the steps to update the Website URL in the **Settings** > **Reporting** n
**Step 3 –** Click **Save**.
-The Website URL is now updated.
+You have now updated the Website URL.
Update the URL in the Published Reports Desktop Icon Properties
-Follow the steps to update the URL in the Published Reports desktop icon's Published Report's
-Properties window.
-
-**Step 1 –** Right click on the **Published Reports** desktop shortcut and click **Properties**.
+**Step 1 –** Right click the **Published Reports** desktop shortcut and click **Properties**.
@@ -153,7 +148,7 @@ Properties window.
**Step 3 –** Click **Apply** and then **OK** to exit.
-The URL is now updated.
+You have now updated the URL.
### Remove Certificate from the Port
@@ -190,12 +185,12 @@ The output will show this info:
`80F78FD2566793D2F39E748CDF6DED09B6F57A82 CN=machinename.domain.com`
-The Thumbprint value is the certificate **Hash** value to be used when binding to the port. The port
+The Thumbprint value is the certificate **Hash** value you use when binding to the port. The port
can be the same as in HTTP (8082). Use this **Hash** value for Step 2 of the
[Enable SSL for the Web Console](#enable-ssl-for-the-web-console) instructions.
-Creation and import of the self-signed certificate can be validated in Microsoft Management Console.
-Follow these steps to confirm the certificate is in Microsoft Management Console.
+You can validate the creation and import of the self-signed certificate in Microsoft Management Console.
+Confirm the certificate is in Microsoft Management Console.
**Step 1 –** Open Microsoft Management Console (`mmc.exe`).
@@ -217,14 +212,14 @@ window. Click **OK** to close the window.
**Step 5 –** Navigate to **Certificates** > **Personal** > **Certificates**. The certificate should
show in the pane on the right.
-The self-signed certificate was created and imported. Repeat these steps for each client-side host.
+You have now created and imported the self-signed certificate. Repeat these steps for each client-side host.
### Add the Certificate for Client-Side Access
When you open the Web Console with SSL enabled, the web browser shows a Your connection isn't
-private warning message. This can be removed by importing the certificate onto the client server.
+private warning message. You can remove this by importing the certificate onto the client server.
-Follow the steps to remove the certificate error.
+Remove the certificate error.
**Step 1 –** Open the Web Console in your browser.
@@ -240,7 +235,7 @@ Viewer from the warning details.
- In Microsoft Edge, click the **Your Connection to this site isn't secure** section, and then click
the certificate icon.
-- In Google Chrome, click **Certificate is not valid**.
+- In Google Chrome, click **Certificate isn't valid**.
@@ -263,7 +258,7 @@ should state that the import was successful. Click **OK** to close out all dialo
**Step 7 –** In the Microsoft Management Console, check the **Trusted Root Certification
-Authorities** > **Certificates**. The self-signed certificate should now be listed there.
+Authorities** > **Certificates**. The self-signed certificate should now appear there.
The client-side access to the Web Console will no longer generate a certificate error. Repeat these
steps for each client-side host.
diff --git a/docs/accessanalyzer/12.0/install/application/reports/sso.md b/docs/accessanalyzer/12.0/install/application/reports/sso.md
index 52320c6c3d..708fd25f01 100644
--- a/docs/accessanalyzer/12.0/install/application/reports/sso.md
+++ b/docs/accessanalyzer/12.0/install/application/reports/sso.md
@@ -6,10 +6,10 @@ sidebar_position: 40
# Enable Single Sign-On
-Single sign-on using Windows authentication allows users to be automatically log into the Web
-Console according to the user’s current login session. When opening a session from a different
-domain, the user will be prompted for credentials from a pop-up windows. After authenticating, the
-user will be automatically logged in the Web Console.
+With single sign-on using Windows authentication, the Web Console automatically logs users
+in according to the user’s current login session. When a user opens a session from a different
+domain, a pop-up window prompts the user for credentials. After authenticating, the Web Console
+automatically logs the user in.
:::note
The Web Console also supports using Microsoft Entra ID single sign-on. See the
@@ -17,7 +17,7 @@ The Web Console also supports using Microsoft Entra ID single sign-on. See the
:::
-Follow the steps to enable single sign-on for the Web Console.
+Enable single sign-on for the Web Console.
**Step 1 –** Open the **WebServer.exe.config** file with a text editor, for example Notepad. It is
located within the Web folder of the Access Analyzer installation directory.
@@ -35,15 +35,15 @@ located within the Web folder of the Access Analyzer installation directory.
**Step 4 –** Navigate to Services (`services.msc`). Restart the Netwrix Access Analyzer (formerly
Enterprise Auditor) Web Server service.
-The Web Console has been enabled for single sign-on.
+You have now enabled the Web Console for single sign-on.
## Local Intranet Settings
-Next, configure local intranet settings to enable SSO. This enables users to have authentication
-pass through Windows Authentication and bypass SSO configuration Prompts for credentials via Browser
-pop-up.
+Next, configure local intranet settings to enable SSO. With this configuration, authentication
+passes through Windows Authentication and bypasses SSO configuration prompts for credentials via
+browser pop-up.
-Follow the steps to configure local intranet settings.
+Configure local intranet settings.
**Step 1 –** Open Windows Internet Properties (**Control Panel** > **Network and
Internet** > **Internet Options**).
@@ -70,7 +70,7 @@ Authentication will now pass through Windows Authentication and bypass SSO confi
credentials via Browser pop-up
:::note
-A list of allowed authentication servers can also be configured using the
+You can also configure a list of allowed authentication servers using the
AuthServerAllowList policy.
:::
diff --git a/docs/accessanalyzer/12.0/install/application/reports/timeout.md b/docs/accessanalyzer/12.0/install/application/reports/timeout.md
index 9932fb5305..244d0eeca8 100644
--- a/docs/accessanalyzer/12.0/install/application/reports/timeout.md
+++ b/docs/accessanalyzer/12.0/install/application/reports/timeout.md
@@ -6,19 +6,17 @@ sidebar_position: 60
# Timeout Parameter for the Web Console
-The Web Console is configured with a default timeout parameter of 15 minutes. This can be configured
+The Web Console has a default timeout parameter of 15 minutes. You can configure this
within the **WebServer.exe.config** file in the Web folder of the Access Analyzer installation
directory:
**…\STEALTHbits\StealthAUDIT\Web**
-Follow the steps to modify the timeout parameter for the Web Console.
-
**Step 1 –** Open the **WebServer.exe.config** file with a text editor, for example Notepad.
-**Step 2 –** Change the value for the `SessionTimeout` parameter to the desired number of minutes:
+**Step 2 –** Change the value for the `SessionTimeout` parameter to the number of minutes you want:
```
diff --git a/docs/accessanalyzer/12.0/install/application/updatelicense.md b/docs/accessanalyzer/12.0/install/application/updatelicense.md
index 19bfbd5779..cdba2f5a27 100644
--- a/docs/accessanalyzer/12.0/install/application/updatelicense.md
+++ b/docs/accessanalyzer/12.0/install/application/updatelicense.md
@@ -6,23 +6,22 @@ sidebar_position: 60
# Update License Key
-It is necessary to install a new license key for an existing Access Analyzer installation due to the
-following:
+Install a new license key for an existing Access Analyzer installation for the following reasons:
- To renew a Access Analyzer license that is due to expire
- To grant access to additional Solutions
- To enable Sensitive Data Discovery
-In these situations it is possible to update the license file without going through the full
+In these situations, you can update the license file without going through the full
installation process.
## Install a New License File
-Follow the steps to update the Access Analyzer license key without installing a new version of the
-Access Analyzer Console.
+Update the Access Analyzer license key without installing a new version of the Access Analyzer
+Console:
-**Step 1 –** Ensure the new `StealthAUDIT.lic` license file is stored locally on the Access Analyzer
-Console server in order to be referenced during the installation process.
+**Step 1 –** Store the new `StealthAUDIT.lic` license file locally on the Access Analyzer
+Console server so the installer can reference it during the installation process.
@@ -43,13 +42,13 @@ Features**), select the Access Analyzer application and click **Change**.
**Step 5 –** On the License File page, click **Browse** and navigate to the **StealthAUDIT.lic**
file. It must be stored on the Access Analyzer Console server before the installation begins. When
-the path to the file is visible in the text box, click **Next**. The license will be imported.
+the path to the file is visible in the text box, click **Next**. The installer imports the license.
**Step 6 –** The License Features page displays a list of all features covered by the imported
license. It also displays the name of the organization which owns the license, the expiration date,
-and the host limit. These are the features that will be installed. Click **Next**.
+and the host limit. These are the features the installer will install. Click **Next**.
@@ -59,6 +58,6 @@ and the host limit. These are the features that will be installed. Click **Next*
**Step 8 –** When the installation has completed, click **Finish** to exit the wizard.
-The new license file has been imported. If the license granted access to any additional solutions,
-they will now be accessible from within the Access Analyzer Console. If the new license added
-Sensitive Data Discovery, the necessary components for Sensitive Data Discovery have been installed.
+You have now imported the new license file. If the license granted access to any additional solutions,
+they are now accessible from within the Access Analyzer Console. If the new license added
+Sensitive Data Discovery, Access Analyzer has now installed the necessary components for Sensitive Data Discovery.
diff --git a/docs/accessanalyzer/12.0/install/application/upgrade/overview.md b/docs/accessanalyzer/12.0/install/application/upgrade/overview.md
index baf5d872d4..ad0bfe86a8 100644
--- a/docs/accessanalyzer/12.0/install/application/upgrade/overview.md
+++ b/docs/accessanalyzer/12.0/install/application/upgrade/overview.md
@@ -10,15 +10,15 @@ Access Analyzer 12.0 uses the Upgrade Wizard. For upgrades from versions of Acce
no longer supported, contact [Netwrix Support](https://www.netwrix.com/support.html) for assistance.
:::note
-If any customizations have been done by a Netwrix Engineer, please ensure custom work is
-not lost during the upgrade process. While using the Upgrade Wizard, customizations are archived
-prior to solution upgrades. These archives are available after the solution upgrades have been
-completed. Contact [Netwrix Support](https://www.netwrix.com/support.html) for additional
+If a Netwrix Engineer has made any customizations, ensure the custom work is
+not lost during the upgrade process. The Upgrade Wizard archives customizations
+before solution upgrades. These archives are available after the solution upgrades
+complete. Contact [Netwrix Support](https://www.netwrix.com/support.html) for additional
information.
:::
-The purpose of this document is to provide the basic steps needed for upgrading Access Analyzer and
+This document provides the basic steps for upgrading Access Analyzer and
the stock solutions. Contact [Netwrix Support](https://www.netwrix.com/support.html) for additional
information.
@@ -33,59 +33,59 @@ Analyzer application directory. If you already have Role Based Access enabled in
version of Access Analyzer, then during the first initialization of Access Analyzer 12.0 the
following happens:
-- The NEAUsers local group is created on the Access Analyzer Console server, and is given the
- required permissions on the Access Analyzer application (StealthAUDIT) folder
-- Existing configured RBA users are added to this new NEAUsers group
+- Access Analyzer 12.0 creates the NEAUsers local group on the Access Analyzer Console server and
+ gives it the required permissions on the Access Analyzer application (StealthAUDIT) folder
+- Access Analyzer 12.0 adds existing configured RBA users to this new NEAUsers group
:::note
- The Web Administrator and Report Viewer roles do not require access to the Access
- Analyzer console, so users assigned these roles are not added to the NEAUsers group.
+ The Web Administrator and Report Viewer roles don't require access to the Access
+ Analyzer console, so Access Analyzer doesn't add users assigned these roles to the NEAUsers group.
:::
:::note
- Adding a user to the NEAUsers group does not apply to the Web Service access type, it
+ Adding a user to the NEAUsers group doesn't apply to the Web Service access type, it
only gives Console access.
:::
-- The local users group is removed from the Access Analyzer application folder permissions
+- Access Analyzer 12.0 removes the local users group from the Access Analyzer application folder permissions
For this process to complete successfully, on first launch the user running Access Analyzer must
-have local administrator rights. Otherwise, an exception will be thrown during the initialization.
+have local administrator rights. Otherwise, Access Analyzer throws an exception during initialization.
Multiple Access Analyzer Consoles Connecting to the Same Database
-In environments where multiple Access Analyzer Consoles are using the same SQL Server database,
-every console using the database must also be updated. The act of connecting a Access Analyzer
+In environments where multiple Access Analyzer Consoles use the same SQL Server database,
+you must also update every console that uses the database. The act of connecting a Access Analyzer
Console with a newer version to a database updates the database’s schema pursuant to the new
definition. If a Access Analyzer Console with an older version connects to the same database after
-the schema has been updated, corruption to Access Analyzer’s system tables can result.
+you update the schema, corruption to Access Analyzer’s system tables can result.
SQL Server Supported Version Change for the Access Analyzer Database
With the release of Access Analyzer v12.0, SQL Server 2016 through SQL Server 2022 are the supported
versions for the Access Analyzer database.
-To grant access to additional Solutions in an existing Access Analyzer installation, a new license
-key is required. To update the Access Analyzer license key without installing a new version of the
+To grant access to additional Solutions in an existing Access Analyzer installation, you need a new
+license key. To update the Access Analyzer license key without installing a new version of the
Access Analyzer Console, see the [Update License Key](/docs/accessanalyzer/12.0/install/application/updatelicense.md) topic for instructions.
**License Key Changes**
-The following changes in licensing requires the organization needing a new key:
+The following licensing changes require the organization to obtain a new key:
- Access Analyzer v12.0
- - No additional licenses are required for this version
+ - This version doesn't require additional licenses
- Enterprise Auditor v11.6
- - No additional licenses are required for this version
+ - This version doesn't require additional licenses
- StealthAUDIT v11.5
- - No additional licenses are required for this version
+ - This version doesn't require additional licenses
See the [Update License Key](/docs/accessanalyzer/12.0/install/application/updatelicense.md) section for instructions on updating the license
key.
diff --git a/docs/accessanalyzer/12.0/install/application/upgrade/solutionconsiderations.md b/docs/accessanalyzer/12.0/install/application/upgrade/solutionconsiderations.md
index 3f06ab8f3c..2747278ea5 100644
--- a/docs/accessanalyzer/12.0/install/application/upgrade/solutionconsiderations.md
+++ b/docs/accessanalyzer/12.0/install/application/upgrade/solutionconsiderations.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Solution Upgrade Considerations
-The following items must be taken into consideration for upgrades:
+Consider the following items for upgrades:
**Access Information Center**
@@ -23,7 +23,7 @@ instructions.
**Sensitive Data Discovery**
-- In Access Analyzer 12.0 the Sensitive Data Discovery features are included in the standard
+- Access Analyzer 12.0 includes the Sensitive Data Discovery features in the standard
installations when your license includes it. If you have the old Sensitive Data Discovery Add-On
installed from a previous Access Analyzer version, then you must manually uninstall it from the
Access Analyzer Console server, and any File System proxy and SharePoint Agent servers where it is
@@ -31,18 +31,18 @@ instructions.
:::warning
The new global settings will overwrite any previously configured criteria. Make a
- note of any configured Sensitive Data Criteria before upgrading Access Analyzer. Sensitive Data
- Criteria must be reconfigured after an upgrade.
+ note of any configured Sensitive Data Criteria before upgrading Access Analyzer. You must
+ reconfigure Sensitive Data Criteria after an upgrade.
:::
-- Sensitive Data Criteria selection is configured globally and used by default in all solution sets.
+- You configure Sensitive Data Criteria selection globally, and Access Analyzer uses it by default in all solution sets.
See the [Configure Global Sensitive Data Settings](#configure-global-sensitive-data-settings) for
additional information.
**Active Directory Solution Considerations**
-- The Active Directory solution by default upgrades as **Upgrade in Place**. Do not change this
+- The Active Directory solution by default upgrades as **Upgrade in Place**. Don't change this
upgrade option. After completing the upgrade, you need to manually add the new **Active
Directory** > **7. Certificate Authority** job group from the `InstantSolutions` directory.
- For Activity – Ensure the Netwrix Activity Monitor is a compatible version. See the Upgrade
@@ -52,7 +52,7 @@ instructions.
**File System Solution Considerations**
-- For Proxy Mode as a Service – File System Proxy Service needs to be updated on the proxy servers.
+- For Proxy Mode as a Service – You need to update the File System Proxy Service on the proxy servers.
See the [Upgrade Proxy Service Procedure](/docs/accessanalyzer/12.0/install/filesystemproxy/upgrade.md) topic for
instructions.
- For Activity – Ensure the Netwrix Activity Monitor is a compatible version. See the Upgrade
@@ -62,8 +62,8 @@ instructions.
**SharePoint Solution Considerations**
-- For SharePoint Agent – Access Analyzer SharePoint Agent needs to be updated on the SharePoint
- server where it was installed. See the
+- For SharePoint Agent – You need to update the Access Analyzer SharePoint Agent on the SharePoint
+ server where you installed it. See the
[Upgrade SharePoint Agent](/docs/accessanalyzer/12.0/install/sharepointagent/upgrade.md) section for instructions.
- For Activity – Ensure the Stealthbits Activity Monitor is a compatible version. See the Upgrade
Instructions in the
@@ -85,7 +85,7 @@ After upgrading to Access Analyzer 12.0, run the latest version of the **File Sy
**0.Collection** > **0-Create Schema** job to migrate the File System Solution to the latest
database schema.
-This database schema migration should be performed before running other jobs in the File System
+Perform this database schema migration before running other jobs in the File System
Solution after upgrading to Access Analyzer 12.0.
See the [File System Solution](/docs/accessanalyzer/12.0/solutions/filesystem/overview.md) topic for additional
@@ -95,36 +95,35 @@ information.
:::warning
The new global Settings will overwrite any previously configured criteria. Make a note
-of any configured Sensitive Data Criteria before commencing the upgrade Access Analyzer. Sensitive
-Data Criteria must be reconfigured after an upgrade.
+of any configured Sensitive Data Criteria before upgrading Access Analyzer. You must reconfigure
+Sensitive Data Criteria after an upgrade.
:::
-If Sensitive Data Criteria are configured differently for each solution, re-configure the criteria
+If you configure Sensitive Data Criteria differently for each solution, re-configure the criteria
selection at the solution level. See the topic for the applicable solution for additional
information.
-If the same Sensitive Data Criteria are used for all solutions, configure the criteria selection at
-the global **Settings** > **Sensitive Data** node, which will then be used by default in all
+If you use the same Sensitive Data Criteria for all solutions, configure the criteria selection at
+the global **Settings** > **Sensitive Data** node, which Access Analyzer then uses by default in all
solutions. The Sensitive Data node provides configuration options to manage Sensitive Data Criteria
and false positive exclusion filters. See the
[Sensitive Data](/docs/accessanalyzer/12.0/admin/settings/sensitivedata/overview.md) topic for additional
information.
-Follow the steps to configure Sensitive Data Criteria at the global level.
+To configure Sensitive Data Criteria at the global level:
-**Step 1 –** If the same Sensitive Data Criteria are used for all solutions, configure the criteria
-selection at the global Settings level, which will then be used by default in all solution sets.
+**Step 1 –** If you use the same Sensitive Data Criteria for all solutions, configure the criteria
+selection at the global Settings level, which Access Analyzer then uses by default in all solution sets.
Navigate to the **Settings** > **Sensitive Data** node and click **Add** to open the Select Criteria
window.
-**Step 2 –** Select the desired criteria. Use the **Search Criteria** text field to filter the list
+**Step 2 –** Select the criteria you want. Use the **Search Criteria** text field to filter the list
using keywords or expand each category to view and select individual Sensitive Data search criteria,
then click **OK**.
-By default, Sensitive Data Criteria configured at the global Settings level is inherited down to the
-applicable solutions.
+By default, applicable solutions inherit the Sensitive Data Criteria configured at the global Settings level.
diff --git a/docs/accessanalyzer/12.0/install/application/upgrade/wizard.md b/docs/accessanalyzer/12.0/install/application/upgrade/wizard.md
index 7ea88c9e50..43a78a8544 100644
--- a/docs/accessanalyzer/12.0/install/application/upgrade/wizard.md
+++ b/docs/accessanalyzer/12.0/install/application/upgrade/wizard.md
@@ -7,19 +7,19 @@ sidebar_position: 20
# Access Analyzer Core Upgrade Instructions
:::warning
-If Role Based Access has been enabled, a user with the Administrator role must perform
-the upgrade. Other user roles do not have the necessary permissions to perform upgrades.
+If you have enabled Role Based Access, a user with the Administrator role must perform
+the upgrade. Other user roles don't have the necessary permissions to perform upgrades.
:::
-Follow the steps to upgrade to Access Analyzer 12.0 on the same server where an older version of
+Upgrade to Access Analyzer 12.0 on the same server where an older version of
Access Analyzer is installed.
:::note
-If any customizations have been done by a Netwrix Engineer, please ensure the custom work
-is not lost during the upgrade process. While using the Upgrade Wizard, customizations are archived
-prior to solution upgrades. These archives are available after the solution upgrades have been
-completed. Contact [Netwrix Support](https://www.netwrix.com/support.html) for additional
+If a Netwrix Engineer has made any customizations, ensure the custom work
+isn't lost during the upgrade process. The Upgrade Wizard archives customizations
+before solution upgrades. These archives are available after the solution upgrades
+complete. Contact [Netwrix Support](https://www.netwrix.com/support.html) for additional
information.
:::
@@ -41,44 +41,44 @@ files, and reports remain in the installation directory after the uninstall proc
:::note
If you have the old Netwrix Sensitive Data Discovery Add-On installed, you must uninstall
-it before continuing with this upgrade. For Access Analyzer 12.0, Sensitive Data Discovery is
-installed as part of the main installation if your license includes it.
+it before continuing with this upgrade. For Access Analyzer 12.0, the main installation includes
+Sensitive Data Discovery if your license includes it.
:::
-- The `WebServer.exe.config` file is automatically retained in a Backup folder created under the Web
- folder of the installation directory. Any custom application settings contained in this file are
- kept as part of this upgrade process.
+- The installer automatically retains the `WebServer.exe.config` file in a Backup folder under the Web
+ folder of the installation directory and keeps any custom application settings in this file as
+ part of this upgrade process.
**Step 2 –** Install Access Analyzer 12.0. See the [Access Analyzer Core Installation](/docs/accessanalyzer/12.0/install/application/wizard.md)
topic for detailed instructions.
-- Before installation, ensure the new `StealthAUDIT.lic` license file is stored locally on the
- Access Analyzer Console in order to be referenced during the installation process
-- Access Analyzer is installed to the following directory by default: `…\STEALTHbits\StealthAUDIT`
+- Before installation, store the new `StealthAUDIT.lic` license file locally on the
+ Access Analyzer Console so the installer can reference it during the installation process
+- The installer installs Access Analyzer to the following directory by default: `…\STEALTHbits\StealthAUDIT`
- If another installation path is designated, please be sure to leave `STEALTHbits\StealthAUDIT`
+ If another installation path is designated, be sure to leave `STEALTHbits\StealthAUDIT`
as the path suffix in the installation wizard.
-- During the installation, any customizations to the settings in the `WebServer.exe.config` file are
- automatically restored from the backup file retained when installing the previous version. The
- `../Web/Backup` folder is deleted after the settings have been restored.
+- During the installation, the installer automatically restores any customizations to the settings
+ in the `WebServer.exe.config` file from the backup file retained when installing the previous
+ version. The installer deletes the `../Web/Backup` folder after it restores the settings.
-After the installation is completed, the upgrade wizard launches from the Access Analyzer desktop
+After the installation completes, the upgrade wizard launches from the Access Analyzer desktop
icon.
## Upgrade Wizard
-Once the Access Analyzer installation process is complete, it is necessary to go through the Upgrade
+After the Access Analyzer installation process is complete, go through the Upgrade
Wizard. There are three Upgrade options for a solution:
- Full Upgrade – Performs a full synchronization of the directory and file structure of the solution
to mirror the Instant Solution
- Upgrade in place – Performs file content updates of jobs matching the Instant Solutions but does
not change the Jobs tree structure
-- Do not upgrade – No upgrade is performed, leaving the previous version of the solution
+- Don't upgrade – Performs no upgrade, leaving the previous version of the solution
The default settings configured within the Advanced Upgrade Options window align with the best
practices of the Netwrix Professional Services and Support teams.
@@ -90,25 +90,25 @@ Upgrade action is set to **Full Upgrade** or **Upgrade in place**:
| -------- | ----------------------------------------------------------------------------------- | -------------------- | ------------------------ |
| Normal | Job exists in Locked state and has matching ID in Instant Solutions | Upgrade | Upgrade |
| New | Job exists in Instant Solutions but not in the Jobs tree for an existing solution | Install | Install |
-| Removed | Job exists in Locked state in the Jobs tree but does not exist in Instant Solutions | Delete | Nothing |
+| Removed | Job exists in Locked state in the Jobs tree but doesn't exist in Instant Solutions | Delete | Nothing |
| Copied | Original job exists in original location, but multiple instances of the job exists | Delete | Upgrade |
| Moved | Original job exists but in a different location than in the Instant Solutions | Move & Upgrade | Upgrade |
| Renamed | Job found via ID match but was renamed | Rename & Upgrade | Upgrade |
| Conflict | Changes have been made to the job | Overwrite | Overwrite |
-Conflicts are identified when customizations have been made by either a user or a Netwrix engineer.
-Conflicts need to be either resolved prior to the upgrade action or manually applied after the
-upgrade is complete. Conflict resolution can be done on the Changes window by undoing a
-customization. However, if the conflict is undone prior to a solution upgrade, then the
-customization will not be archived.
+The Upgrade Wizard identifies conflicts when a user or a Netwrix engineer has made customizations.
+You need to either resolve conflicts before the upgrade action or manually apply them after the
+upgrade is complete. You can resolve conflicts on the Changes window by undoing a
+customization. However, if you undo the conflict before a solution upgrade, the
+Upgrade Wizard will not archive the customization.
:::warning
-If Role Based Access has been enabled, a user with the Administrator role must perform
-the upgrade. Other user roles do not have the necessary permissions to perform upgrades.
+If you have enabled Role Based Access, a user with the Administrator role must perform
+the upgrade. Other user roles don't have the necessary permissions to perform upgrades.
:::
-Follow the steps to use the Upgrade Wizard.
+Use the Upgrade Wizard:
**Step 1 –** Launch the Access Analyzer application. The installation wizard placed the Access
Analyzer icon on the desktop.
@@ -118,17 +118,17 @@ Analyzer icon on the desktop.
**Step 2 –** The Access Analyzer Configuration Wizard opens. Click **Next** to continue.
:::note
-When Access Analyzer12.0 is installed on a server where a previous version of Access
-Analyzer had been installed, the Version Selection page of the Configuration Wizard will not appear.
+When you install Access Analyzer 12.0 on a server that already has a previous version of Access
+Analyzer installed, the Version Selection page of the Configuration Wizard doesn't appear.
:::
-**Step 3 –** On the Solution Set Files page, only upgrade conflicts are displayed by default.
+**Step 3 –** By default, the Solution Set Files page displays only upgrade conflicts.
:::info
-Investigate the changes where conflicts have been identified before proceeding.
+Investigate the changes where the Upgrade Wizard has identified conflicts before proceeding.
:::
@@ -143,31 +143,31 @@ Additional options include:
-**Step 5 –** (Optional) Conflicts can be resolved on the Changes window, which is opened by the
-**View conflicts** button. Remember, if the conflict is resolved prior to a solution upgrade, then
-the customization will not be archived. To resolve a conflict, select it from the list and click
-**Undo**.
+**Step 5 –** (Optional) You can resolve conflicts on the Changes window, which the
+**View conflicts** button opens. Remember, if you resolve the conflict before a solution upgrade,
+the Upgrade Wizard will not archive the customization. To resolve a conflict, select it from the
+list and click **Undo**.
-**Step 6 –** When the Upgrade options have been set as desired. Click **Next**.
+**Step 6 –** When you have set the Upgrade options as desired, click **Next**.
-**Step 7 –** On the Options page, select whether to send usage statistics to Netwrix to help us
-improve our product. After the Usage Statistics option is set as desired, click **Next** to
+**Step 7 –** On the Options page, select whether to send usage statistics to Netwrix to help
+improve the product. After you set the Usage Statistics option as desired, click **Next** to
continue.
-- If selected, usage statistics are collected and sent to Netwrix
+- If selected, Access Analyzer collects usage statistics and sends them to Netwrix
- - Upon startup of the Access Analyzer console, the system checks if usage statistics have been
- sent in the last 7 days. If they have not been, stored procedures run against the Access
+ - Upon startup of the Access Analyzer console, the system checks whether it has sent usage
+ statistics in the last 7 days. If it hasn't, stored procedures run against the Access
Analyzer database and gather data about job runs, access times, and environmental details like
- resource counts, users counts, number of exceptions, and so on. This data is then sent back to
- Netwrix to help us identify usage trends and common pain points, so that we can use this
- information to improve the product.
- - Only anonymous statistic-level data is included. No private company or personal data is
- collected or sent to Netwrix.
+ resource counts, users counts, number of exceptions, and so on. The system then sends this
+ data back to Netwrix to identify usage trends and common problem areas, which Netwrix uses to
+ improve the product.
+ - Access Analyzer includes only anonymous statistic-level data. It doesn't collect or send any
+ private company or personal data to Netwrix.
-- If cleared, no usage statistics are collected or sent to Netwrix
+- If cleared, Access Analyzer doesn't collect or send usage statistics to Netwrix
diff --git a/docs/accessanalyzer/12.0/install/application/wizard.md b/docs/accessanalyzer/12.0/install/application/wizard.md
index 9c831184e3..ab5a034496 100644
--- a/docs/accessanalyzer/12.0/install/application/wizard.md
+++ b/docs/accessanalyzer/12.0/install/application/wizard.md
@@ -7,8 +7,7 @@ sidebar_position: 20
# Access Analyzer Core Installation
Save the organization’s Access Analyzer license key, received from your Netwrix Sales
-Representative, to the server where Access Analyzer is to be installed. Then follow the steps to
-install Access Analyzer.
+Representative, to the server where you will install Access Analyzer.
:::note
The process explained in this topic assumes that both the downloaded binary and the
@@ -17,8 +16,8 @@ license (.lic) file are located on the server which will become the Access Analy
:::warning
-If User Account Control (UAC) is enabled on the server, ensure the installation package
-is run in Administrative/privilege mode.
+If User Account Control (UAC) is enabled on the server, ensure you run the installation package
+in Administrative/privilege mode.
:::
@@ -49,7 +48,7 @@ install Access Analyzer. The default destination folder is
file. When the path to the file is visible in the textbox, click **Next**.
:::note
-The license file must be stored on the Access Analyzer Console server before the
+You must store the license file on the Access Analyzer Console server before the
installation begins.
:::
@@ -58,7 +57,7 @@ installation begins.
**Step 6 –** The License Features page displays a list of all features covered by the imported
license. It also displays the name of the organization which owns the license, the expiration date,
-and the host limit. These are the features that will be installed. Click **Next**.
+and the host limit. These are the features the installer will install. Click **Next**.
@@ -69,6 +68,6 @@ installation.
**Step 8 –** When the installation has completed, click **Finish** to exit the wizard.
-The Access Analyzer Console has been installed, and two desktop icons have been created: Access
-Analyzer and Published Reports. Launch the Access Analyzer application to complete the initial
-configuration.
+You have now installed the Access Analyzer Console, and the installer has created two desktop
+icons: Access Analyzer and Published Reports. Launch the Access Analyzer application to complete
+the initial configuration.
diff --git a/docs/accessanalyzer/12.0/install/filesystemproxy/configuredatacollector.md b/docs/accessanalyzer/12.0/install/filesystemproxy/configuredatacollector.md
index 3333a8f02c..32bb63c444 100644
--- a/docs/accessanalyzer/12.0/install/filesystemproxy/configuredatacollector.md
+++ b/docs/accessanalyzer/12.0/install/filesystemproxy/configuredatacollector.md
@@ -12,7 +12,7 @@ Access Auditor Data Collector Wizard from the job’s query.
On the Applet Settings wizard page, select the following option:
-- Require applet to be running as service on target – Must be selected in the Applet Launch
+- Require applet to be running as service on target – Select this option in the Applet Launch
Mechanism section to prevent the deployment of the applet or the ad hoc installation of the
service during the scan
diff --git a/docs/accessanalyzer/12.0/install/filesystemproxy/overview.md b/docs/accessanalyzer/12.0/install/filesystemproxy/overview.md
index f11962eaca..1bc291c52b 100644
--- a/docs/accessanalyzer/12.0/install/filesystemproxy/overview.md
+++ b/docs/accessanalyzer/12.0/install/filesystemproxy/overview.md
@@ -6,20 +6,20 @@ sidebar_position: 20
# File System Proxy as a Service Overview
-The File System Solution can be enabled to use proxy servers for scanning targeted file systems in
+You can enable the File System Solution to use proxy servers for scanning targeted file systems in
very large or widely dispersed environments.
-When File System scans are run in proxy mode as a service, there are two methods available for
+When you run File System scans in proxy mode as a service, two methods are available for
deploying the service:
-- Pre-Installed File System Proxy Service – File System Proxy Service installation package must be
- installed on the Windows proxy servers prior to executing the scans. This is the recommended
+- Pre-Installed File System Proxy Service – You must install the File System Proxy Service
+ installation package on the Windows proxy servers before executing the scans. This is the recommended
method.
-- Ad Hoc File System Proxy Service Deployment – File System Proxy Service is installed on the
- Windows proxy server when the job is executed
+- Ad Hoc File System Proxy Service Deployment – Access Analyzer installs the File System Proxy
+ Service on the Windows proxy server when the job runs
-The data collection processing is conducted by the proxy server where the service is running and
-leverages a local mode-type scan to each of the target hosts. The final step in data collection is
+The proxy server where the service is running conducts the data collection processing and
+uses a local mode-type scan to each of the target hosts. The final step in data collection is
to compress and transfer the data collected in the SQLite databases, or Tier 2 databases, back to
the Access Analyzer Console server.
@@ -33,7 +33,7 @@ the required prerequisites.
## Supported Platforms
-The File System Proxy Service for the Access Analyzer File System Solution can be installed on the
+You can install the File System Proxy Service for the Access Analyzer File System Solution on the
following Windows operating systems:
- Windows Server 2022
@@ -42,15 +42,15 @@ following Windows operating systems:
## Proxy Scanning Architecture
-Access Analyzer is configured by default to process data collection against ten target hosts
-simultaneously. When File System scans are run in local mode ten hosts process simultaneously, and
-processing against the eleventh host begins after the processing against the first host is
-completed. Proxy scanning architecture supports large deployments or widely dispersed environments.
+By default, Access Analyzer processes data collection against ten target hosts
+simultaneously. When you run File System scans in local mode, ten hosts process simultaneously, and
+processing against the eleventh host begins after the processing against the first host
+completes. Proxy scanning architecture supports large deployments or widely dispersed environments.
-A proxy server is any server that can be leveraged to process data collection against target hosts.
+A proxy server is any server that can process data collection against target hosts.
:::warning
-The File System Proxy Service cannot be installed on the same server as Access
+You can't install the File System Proxy Service on the same server as Access
Analyzer.
:::
@@ -62,38 +62,38 @@ Two options are available for implementing the proxy scanning architecture:
### Proxy Mode with Applet
-When File System scans are run in proxy mode with applet, it means the File System applet is
-deployed to the Windows proxy server when the job is executed to conduct data collection. The data
-collection processing is initiated by the proxy server where the applet is deployed and leverages a
+When you run File System scans in proxy mode with applet, Access Analyzer deploys the File System
+applet to the Windows proxy server when the job runs to conduct data collection. The proxy server
+where the applet is deployed initiates the data collection processing and uses a
local mode-type scan to each of the target hosts. The final step in data collection is to compress
and transfer the data collected in the SQLite databases, or Tier 2 databases, back to the Access
Analyzer Console server.
-The diagram illustrates the Access Analyzer server sending an FSAA applet to a proxy server, which
+The diagram illustrates the Access Analyzer server sending a FileSystemAccess (FSAA) applet to a proxy server, which
runs the scan against a file server, and then returns data to the Access Analyzer server.
### Proxy Mode as a Service
-When File System scans are run in proxy mode as a service, there are two methods available for
+When you run File System scans in proxy mode as a service, two methods are available for
deploying the service:
-- Pre-Installed File System Proxy Service – File System Proxy Service installation package must be
- installed on the Windows proxy servers prior to executing the scans. This is the recommended
+- Pre-Installed File System Proxy Service – You must install the File System Proxy Service
+ installation package on the Windows proxy servers before executing the scans. This is the recommended
method.
-- Ad Hoc File System Proxy Service Deployment – File System Proxy Service is installed on the
- Windows proxy server when the job is executed
+- Ad Hoc File System Proxy Service Deployment – Access Analyzer installs the File System Proxy
+ Service on the Windows proxy server when the job runs
-The data collection processing is conducted by the proxy server where the service is running and
-leverages a local mode-type scan to each of the target hosts. The final step in data collection is
+The proxy server where the service is running conducts the data collection processing and
+uses a local mode-type scan to each of the target hosts. The final step in data collection is
to compress and transfer the data collected in the SQLite databases, or Tier 2 databases, back to
the Access Analyzer Console server.
-The proxy communication is configured during the installation of the service on the proxy server and
-certificate exchange options are configured via the Applet Settings page of the File System Access
-Auditing Data Collector Wizard. The credential provided for the secure communications in the
-installation wizard is also added to the Access Analyzer Connection Profile assigned to the File
+You configure the proxy communication during the installation of the service on the proxy server, and
+you configure certificate exchange options via the Applet Settings page of the File System Access
+Auditing Data Collector Wizard. The installation wizard also adds the credential provided for the
+secure communications to the Access Analyzer Connection Profile assigned to the File
System Solution.
See the [File System Proxy Service Installation](/docs/accessanalyzer/12.0/install/filesystemproxy/wizard.md) topic for additional information.
@@ -104,25 +104,25 @@ The diagram illustrates the Access Analyzer server communicating securely with t
a proxy server, which runs the scan against a file server, collecting the data locally and securely.
Then the proxy service returns data securely to the Access Analyzer server.
-When a proxy mode scan is initiated from the Access Analyzer Console, it will distribute hosts to be
-scanned across all proxy hosts. Access Analyzer monitors the scans from the central console. Once
-all proxy hosts have completed scanning, all results and SQLite databases are returned to the Access
-Analyzer Console server.
+When you initiate a proxy mode scan from the Access Analyzer Console, Access Analyzer distributes hosts
+for scanning across all proxy hosts. Access Analyzer monitors the scans from the central console. Once
+all proxy hosts have completed scanning, Access Analyzer returns all results and SQLite databases to
+the Access Analyzer Console server.
The diagram shows the difference between an implementation of Access Analyzer without proxy servers
(on the left) and with proxy servers (on the right). On the right side of the diagram, the scans
-have been configured to use the local host and two additional proxy servers to perform the FSAA Data
+use the local host and two additional proxy servers to perform the FSAA Data
Collector scans. This allows it to execute three times as many concurrent hosts than would be
possible without proxy servers. This provides a clear benefit in scalability and scan times.
The proxy functionality for the FSAA Data Collector provides security and reliability.
:::tip
-Remember, It is recommended that the File System Proxy Service is installed on the proxy server
-before running File System scans in proxy mode as a service. Once installed, the FileSystemAccess
-(FSAA) Data Collector must be configured to use the service. See the
+Install the File System Proxy Service on the proxy server before running File System scans in
+proxy mode as a service. After installation, you must configure the FileSystemAccess
+(FSAA) Data Collector to use the service. See the
[File System Data Collection Configuration for Proxy as a Service](/docs/accessanalyzer/12.0/install/filesystemproxy/configuredatacollector.md) topic
for additional information.
:::
@@ -130,7 +130,7 @@ for additional information.
## Sensitive Data Discovery Auditing Consideration
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By default, SDD scans are
-configured to run two concurrent threads. For example, if the job is configured to scan 8 hosts at a
-time with two concurrent SDD threads, then an extra 32 GB of RAM are required (8x2x2=32).
+If you run Sensitive Data Discovery (SDD) scans, you must increase the minimum amount
+of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By default, SDD scans
+run two concurrent threads. For example, if you configure the job to scan 8 hosts at a
+time with two concurrent SDD threads, you need an extra 32 GB of RAM (8x2x2=32).
diff --git a/docs/accessanalyzer/12.0/install/filesystemproxy/silentinstall.md b/docs/accessanalyzer/12.0/install/filesystemproxy/silentinstall.md
index 55b9bd0a51..02c0e1098b 100644
--- a/docs/accessanalyzer/12.0/install/filesystemproxy/silentinstall.md
+++ b/docs/accessanalyzer/12.0/install/filesystemproxy/silentinstall.md
@@ -6,12 +6,12 @@ sidebar_position: 30
# Silent Installer Option for Proxy
-It is possible to use one of the following methods to complete a silent installation of the File
+Use one of the following methods to complete a silent installation of the File
System Proxy Service.
:::warning
For all Active Directory versions, aside from Windows 2012 R2, the silent installer
-does not prompt an error message if a duplicate SPN value exists in the targeted domain for
+doesn't prompt an error message if a duplicate SPN value exists in the targeted domain for
[Option 1: Run as LocalSystem](#option-1-run-as-localsystem). Having duplicate SPN’s in the targeted
Active Directory environment prohibits connection to the proxy service, resulting in a failed scan.
:::
@@ -21,16 +21,16 @@ If a desired SPN already exists in a Windows 2012 R2 domain, the silent installe
following message:
> _There is a problem with this Windows Installer package. A script required for this install to
-> complete could not be run. Contact your support personnel or package vendor_.
+> complete couldn't be run. Contact your support personnel or package vendor_.
To resolve the problem, remove the duplicate SPN value and rerun the installer to complete
-installation. For any additional issues, verbose logging is included in the silent installer and
+installation. For any additional issues, the silent installer includes verbose logging and
creates an `install.txt` file on the desktop.
## Option 1: Run as LocalSystem
-Follow the steps to install the File System Proxy Service on the targeted proxy servers with a
-silent installer.
+Install the File System Proxy Service on the targeted proxy servers with a
+silent installer:
**Step 1 –** Copy the `FileSystemProxy.msi` executable to the desktop of the server designated as
the proxy server.
@@ -43,7 +43,7 @@ msiexec /i FileSystemProxy.msi /qb /l*v install.log SVC_ACCOUNT_TYPE=SYSTEM
- To add a non-default install directory, append `PRODUCTDIR="[path]"` to the command.
- - `path` – The path to the desired installation directory and must include
+ - `path` – The installation directory path, which must include
`...\STEALTHbits\StealthAUDIT\FSAA\...`
For example:
@@ -52,12 +52,12 @@ msiexec /i FileSystemProxy.msi /qb /l*v install.log SVC_ACCOUNT_TYPE=SYSTEM
msiexec /i FileSystemProxy.msi /qb /l*v install.log SVC_ACCOUNT_TYPE=SYSTEM PRODUCTDIR="E:\STEALTHbits\StealthAUDIT\FSAA"
```
-The SPN value is automatically added to the computer object in Active Directory with this option.
+This option automatically adds the SPN value to the computer object in Active Directory.
## Option 2: Run as a Service Account
-Follow the steps to install the File System Proxy Service on the targeted proxy servers with a
-silent installer.
+Install the File System Proxy Service on the targeted proxy servers with a
+silent installer:
**Step 1 –** Copy the `FileSystemProxy.exe` executable to the desktop of the server designated as
the proxy server.
@@ -71,11 +71,11 @@ msiexec /i FileSystemProxy.msi /qb /l*v install.log SVC_ACCOUNT_TYPE=DOMAIN SVC_
- `DOMAIN\USERNAME` – The service account credentials, which need to be a member the Local
Administrators group and have the**Log on as a service** local policy (**Local Policies** >
**User Rights Assignment**)
-- `secret` – The password for the credentials provided above (within quotes)
+- `secret` – The password for the `DOMAIN\USERNAME` credentials (within quotes)
- To add a non-default install directory, append `PRODUCTDIR="[path]"` to the command.
- - `path` – The path to the desired installation directory and must include
+ - `path` – The installation directory path, which must include
`...\STEALTHbits\StealthAUDIT\FSAA\...`
For example:
diff --git a/docs/accessanalyzer/12.0/install/filesystemproxy/troubleshooting.md b/docs/accessanalyzer/12.0/install/filesystemproxy/troubleshooting.md
index 5290b9ce4c..12bdb3d794 100644
--- a/docs/accessanalyzer/12.0/install/filesystemproxy/troubleshooting.md
+++ b/docs/accessanalyzer/12.0/install/filesystemproxy/troubleshooting.md
@@ -10,21 +10,20 @@ The following are potential errors that may occur during installation and how to
| Error Message | Resolution |
| ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Service ‘Access Analyzer FSAA Proxy Scanner’ (StealthAUDITFSAA) failed to start. Verify that you have sufficient privileges to start system services. | The domain account used during setup does not have sufficient privileges to start the service. Open Local Security Policies on the proxy server. In User Rights Assignment under Local policies, add the desired user to the Log on as a service policy. Once the user has this privilege, retry the installation. |
+| Service ‘Access Analyzer FSAA Proxy Scanner’ (StealthAUDITFSAA) failed to start. Verify that you have sufficient privileges to start system services. | The domain account used during setup doesn't have sufficient privileges to start the service. Open Local Security Policies on the proxy server. In User Rights Assignment under Local policies, add the user to the Log on as a service policy. After the user has this privilege, retry the installation. |
The following are potential errors that may occur during File System scans and how to resolve each.
| Error Message | Resolution |
| --------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Failed to launch SDD client (2): The system cannot find the file specified. | This indicates the Sensitive Data Discovery Add-On is not installed on the proxy server. |
-| Error creating DLP components. Error:Error initializing DLP communications, received invalid pipe handle. | This indicates the Sensitive Data Discovery Add-On is not installed on the proxy server. |
-| Unable to start scan: Could not initialize scan session with any proxy host supplied | This can indicate a few things and is a broad error: - The Access Analyzer Console cannot reach the proxy server via the network.
- Network communications are blocked for TCP on port 8766 – possibly by the Windows Firewall on the Access Analyzer Console server or proxy server, or by another firewall in the network (it is possible for this port to be customized through the FSAA Data Collector query configuration).
- The Netwrix Access Analyzer (formerly Enterprise Auditor) FSAA Proxy Scanner service is not running or is not installed on the target proxy server.
|
+| Failed to launch SDD client (2): The system can't find the file specified. | This indicates the Sensitive Data Discovery Add-On isn't installed on the proxy server. |
+| Error creating DLP components. Error:Error initializing DLP communications, received invalid pipe handle. | This indicates the Sensitive Data Discovery Add-On isn't installed on the proxy server. |
+| Unable to start scan: Couldn't initialize scan session with any proxy host supplied | This can indicate a few things and is a broad error: - The Access Analyzer Console can't reach the proxy server via the network.
- Network communications are blocked for TCP on port 8766 – possibly by the Windows Firewall on the Access Analyzer Console server or proxy server, or by another firewall in the network (you can customize this port through the FSAA Data Collector query configuration).
- The Netwrix Access Analyzer (formerly Enterprise Auditor) FSAA Proxy Scanner service isn't running or isn't installed on the target proxy server.
|
## Verbose Logging
-Sometimes it is necessary to enable verbose logging in order to troubleshoot a problem with the
-proxy server.
+Enable verbose logging to troubleshoot a problem with the proxy server.
Run the following command in the directory where the installer lives (to prompt the install):
diff --git a/docs/accessanalyzer/12.0/install/filesystemproxy/uninstall.md b/docs/accessanalyzer/12.0/install/filesystemproxy/uninstall.md
index cc332f88c8..0d15e7cd16 100644
--- a/docs/accessanalyzer/12.0/install/filesystemproxy/uninstall.md
+++ b/docs/accessanalyzer/12.0/install/filesystemproxy/uninstall.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# Uninstall Proxy Service Process
-The process to properly uninstall the File System Proxy Service is completed through the
-uninstalling of the Access Analyzer File System Scanning Proxy program.
+To properly uninstall the File System Proxy Service, uninstall the Access Analyzer File System
+Scanning Proxy program.
**Step 1 –** Open Control Panel and select **Programs** > **Uninstall a program**.
@@ -17,12 +17,12 @@ uninstalling of the Access Analyzer File System Scanning Proxy program.
and click **Uninstall**.
:::note
-If the installation was configured to use the LocalSystem account to run the RPC service
-the two SPN values are removed for that machine in Active Directory. If the service is running with
-a supplied account, the SPN values would need to be manually removed for that machine in Active
-Directory (unless the uninstall was completed as part of the
+If you configured the installation to use the LocalSystem account to run the RPC service,
+the uninstaller removes the two SPN values for that machine in Active Directory. If the service is
+running with a supplied account, you must manually remove the SPN values for that machine in Active
+Directory (unless you completed the uninstall as part of the
[Upgrade Proxy Service Procedure](/docs/accessanalyzer/12.0/install/filesystemproxy/upgrade.md)).
:::
-When the uninstall process is complete, this program is removed from the list.
+When the uninstall process is complete, the program no longer appears in the list.
diff --git a/docs/accessanalyzer/12.0/install/filesystemproxy/upgrade.md b/docs/accessanalyzer/12.0/install/filesystemproxy/upgrade.md
index 367817fb06..9a54bc21cf 100644
--- a/docs/accessanalyzer/12.0/install/filesystemproxy/upgrade.md
+++ b/docs/accessanalyzer/12.0/install/filesystemproxy/upgrade.md
@@ -6,9 +6,9 @@ sidebar_position: 40
# Upgrade Proxy Service Procedure
-When the Access Analyzer Console and File System Solution are upgraded, it is necessary to also
-upgrade the File System Proxy Service when running Access Analyzer in Proxy Mode as a Service. This
-upgrade can be done in two ways:
+When you upgrade the Access Analyzer Console and File System Solution, also
+upgrade the File System Proxy Service when running Access Analyzer in Proxy Mode as a Service. You
+can do this upgrade in two ways:
- Automatically – An instant job within the Access Analyzer Console
- Manually – On each server hosting the proxy service
@@ -16,21 +16,21 @@ upgrade can be done in two ways:
:::warning
When upgrading the Proxy Service to 11.6 from a previous version for the first time,
you must manually uninstall the previous version and follow the [Manual Upgrade](#manual-upgrade)
-steps below. Subsequent 11.6 upgrades can be done using the automatic upgrade option.
+steps. You can do subsequent 11.6 upgrades using the automatic upgrade option.
:::
:::note
If you have the old Netwrix Sensitive Data Discovery Add-On installed, you must uninstall
-it before continuing with this upgrade. For Access Analyzer 12.0, Sensitive Data Discovery is
-installed as part of the main installation if your license includes it.
+it before continuing with this upgrade. For Access Analyzer 12.0, the main installation includes
+Sensitive Data Discovery if your license includes it.
:::
## Automatic Upgrade
The **FS_UpdateProxy** Job is available through the Instant Job Wizard. This job updates the File
-System Proxy Service on all servers in the assigned host list. Follow the steps to instantiate this
+System Proxy Service on all servers in the assigned host list. Instantiate this
job.
**Step 1 –** Within the **Jobs** tree, right-click and select **Add Instant Job**. The Instant Job
@@ -46,15 +46,15 @@ Expand the category and select the **FS_UpgradeProxy** Job. Click **Next**.
**Step 4 –** On the Host Assignment page, select the **Specify individual hosts or host lists**
option and click **Next**.
-**Step 5 –** On the Host Lists page, assign the host lists containing the proxy servers to be
-updated . Multiple host lists can be added. Click Next.
+**Step 5 –** On the Host Lists page, assign the host lists containing the proxy servers you want to
+update. You can add multiple host lists. Click Next.
**Step 6 –** On the Individual Hosts page, click **Next**.
**Step 7 –** Review the Summary and click either **Save & Exit** or **Save & Run Jobs Now**.
-The proxy does not update until the job is run. Once successfully ran, the servers in the assigned
-host lists have been updated.
+The proxy doesn't update until you run the job. After the job runs successfully, Access Analyzer
+updates the servers in the assigned host lists.
## Manual Upgrade
diff --git a/docs/accessanalyzer/12.0/install/filesystemproxy/wizard.md b/docs/accessanalyzer/12.0/install/filesystemproxy/wizard.md
index 519a6bbe78..b90eab4f24 100644
--- a/docs/accessanalyzer/12.0/install/filesystemproxy/wizard.md
+++ b/docs/accessanalyzer/12.0/install/filesystemproxy/wizard.md
@@ -7,9 +7,9 @@ sidebar_position: 10
# File System Proxy Service Installation
The File System Proxy installer is designed to simplify the process of setting up File System
-Scanning Proxy as a service on the designated proxy server. It is a best practice to use a
-specifically provisioned domain account as the File System Proxy service account. Follow the steps
-to install the FSAA service on the targeted proxy servers.
+Scanning Proxy as a service on the designated proxy server. As a best practice, use a
+specifically provisioned domain account as the File System Proxy service account. To install the
+FileSystemAccess (FSAA) service on the targeted proxy servers:
**Step 1 –** Run the `FileSystemProxy.exe` executable. The Netwrix Access Analyzer (formerly
Enterprise Auditor) File System Scanning Proxy Setup wizard opens.
@@ -34,8 +34,8 @@ folder page.
On the Change destination folder page, choose a different destination folder for the installation.
- Look in – Select which folder or sub-folder to complete installation in using the Look in
- drop-down
-- Up one level – Click the Up one level button to select the folder one level above the currently
+ dropdown
+- Up one level – Click the Up one level button to select the folder one level above the
selected one
- Create a new folder – Click to create a new folder for the destination of the installation
@@ -62,33 +62,33 @@ radio buttons. Then, click **Next**.
**Step 7 –** When the installation completes, click **Finish** to exit the wizard.
:::note
-If the File System Proxy Service is installed on multiple servers, then a custom host list
-of proxy servers should also be created in Netwrix Access Analyzer (formerly Enterprise Auditor).
+If the File System Proxy Service is installed on multiple servers, you should also create a custom
+host list of proxy servers in Netwrix Access Analyzer (formerly Enterprise Auditor).
:::
-Once the File System Proxy Service has been installed on any proxy server, it is necessary to
-configure the File System Solution certificate exchange method for Proxy Mode as a Service. See the
+After you install the File System Proxy Service on any proxy server, configure the File System
+Solution certificate exchange method for Proxy Mode as a Service. See the
[FSAA Applet Certificate Management Overview](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/certificatemanagement.md)
topic for additional information.
## Custom Parameters for File System Proxy Service
-The port and priority parameters can be modified for the File System Proxy Service on the registry
+You can modify the port and priority parameters for the File System Proxy Service on the registry
key:
**HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\StealthAUDITFSAA\ImagePath**
-- Port parameter – Only needs to be added to the registry key value if a custom port is used. The
- default port of 8766 does not need to be set as a parameter
+- Port parameter – You only need to add this to the registry key value if you use a custom port.
+ You don't need to set the default port of 8766 as a parameter
- Append `-e [PORT NUMBER]` to the ImagePath key value
-- Priority parameter – Can be modified so that the service runs as a background priority, which may
- be desired if the service has been installed directly on a file server
+- Priority parameter – You can modify this so that the service runs as a background priority, which
+ may be useful if you installed the service directly on a file server
- Append `-r 0` to the ImagePath key value
:::note
- If both parameters are added, there is no required order.
+ If you add both parameters, there is no required order.
:::
@@ -98,12 +98,12 @@ key:
:::
-Follow the steps to configure these service parameters.
+Configure these service parameters:
**Step 1 –** After installing the File System Proxy Service, open Services Management Console
-(`services.msc`). To stop the service, right-click on the Netwrix Access Analyzer (formerly
+(`services.msc`). To stop the service, right-click the Netwrix Access Analyzer (formerly
Enterprise Auditor) FSAA Proxy Scanner service and select **Stop**.
@@ -112,8 +112,8 @@ Enterprise Auditor) FSAA Proxy Scanner service and select **Stop**.
**HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\StealthAUDITFSAA\ImagePath**
-**Step 3 –** Right-click on the **ImagePath** key and select **Modify**. The Value data was set
-during installation according to the installation directory location selected.
+**Step 3 –** Right-click the **ImagePath** key and select **Modify**. The installer set the Value data
+during installation according to the installation directory location you selected.
- Priority set to background priority:
- Add `-r 0` to the end of the path value
@@ -126,7 +126,7 @@ during installation according to the installation directory location selected.
**C:\Program Files (x86)\STEALTHbits\StealthAUDIT\FSAA\StealthAUDITRPC.EXEFSAASrv.DLL -e 1234**
:::note
- The port number needs to be added to the path only if a custom port is used.
+ You only need to add the port number to the path if you use a custom port.
:::
@@ -151,5 +151,5 @@ section for additional configurations required to run scans in proxy mode as a s
**Step 7 –** Repeat the previous step for each of the **FileSystem** > **0.Collection** jobs to
employ this proxy service.
-The custom port identified is now used for communication between the File System Proxy Service and
-Access Analyzer.
+Access Analyzer now uses the custom port you identified for communication between the File System
+Proxy Service and Access Analyzer.
diff --git a/docs/accessanalyzer/12.0/install/mapicdo/appendix.md b/docs/accessanalyzer/12.0/install/mapicdo/appendix.md
index 5fc9baad9b..62895e478b 100644
--- a/docs/accessanalyzer/12.0/install/mapicdo/appendix.md
+++ b/docs/accessanalyzer/12.0/install/mapicdo/appendix.md
@@ -6,16 +6,16 @@ Exchange MAPI CDO.
:::
-Before installing either binary, close the Access Analyzer application and ensure the following
-requirements have been met:
+Before installing either binary, close the Access Analyzer application and ensure you meet the
+following requirements:
-- Exchange System Manager for Exchange 2003 is not installed on the Access Analyzer Console server.
-- Microsoft Outlook is not installed on the Access Analyzer Console server.
+- Exchange System Manager for Exchange 2003 isn't installed on the Access Analyzer Console server.
+- Microsoft Outlook isn't installed on the Access Analyzer Console server.
These programs will interfere with the Microsoft Exchange MAPI CDO installation and with MAPI
connections if they are installed on the Access Analyzer Console server.
-Follow these steps to install the Microsoft Exchange MAPI CDO.
+Install the Microsoft Exchange MAPI CDO.
**Step 1 –** Download and run the ExchangeMapiCDO application from Microsoft.
@@ -46,5 +46,5 @@ agreement and click Next.
**Step 6 –** When the installation is complete, click Finish.
-Reopen the Access Analyzer application, and the Settings > Exchange node is enabled for
+Reopen the Access Analyzer application. Access Analyzer enables the Settings > Exchange node for
configuration.
diff --git a/docs/accessanalyzer/12.0/install/mapicdo/installation.md b/docs/accessanalyzer/12.0/install/mapicdo/installation.md
index 834e54de5b..b4ee801e43 100644
--- a/docs/accessanalyzer/12.0/install/mapicdo/installation.md
+++ b/docs/accessanalyzer/12.0/install/mapicdo/installation.md
@@ -1,17 +1,17 @@
# StealthAUDIT MAPI CDO Installation
-Both the Access Analyzer MAPI CDO and the Microsoft® Exchange MAPI CDO must to be installed in
-order to enable the Settings > Exchange node.
+You must install both the Access Analyzer MAPI CDO and the Microsoft® Exchange MAPI CDO
+to enable the Settings > Exchange node.
-The Microsoft Exchange MAPI CDO is only required to run the MAPI-based data collectors. See the
+You only need the Microsoft Exchange MAPI CDO to run the MAPI-based data collectors. See the
[Exchange Solution](/docs/accessanalyzer/12.0/solutions/exchange/overview.md) topic for additional
information.
-The Access Analyzer MAPI CDO can be downloaded from the
-[Product Downloads](https://www.stealthbits.com/product-downloads) page of the Netwrix website. The
-Microsoft Exchange MAPI CDO can be downloaded directly from Microsoft. See the
+You can download the Access Analyzer MAPI CDO from the
+[Product Downloads](https://www.stealthbits.com/product-downloads) page of the Netwrix website. You
+can download the Microsoft Exchange MAPI CDO directly from Microsoft. See the
[Appendix for the StealthAUDIT MAPI CDO Installation Guide](/docs/accessanalyzer/12.0/install/mapicdo/appendix.md) for requirements and
installation steps to install the Microsoft Exchange MAPI CDO.
@@ -21,16 +21,16 @@ Exchange MAPI CDO.
:::
-Before installing either binary, close the Access Analyzer application and ensure the following
-requirements have been met:
+Before installing either binary, close the Access Analyzer application and ensure you meet the
+following requirements:
-- Exchange System Manager for Exchange 2003 is not installed on the Access Analyzer Console server.
-- Microsoft Outlook is not installed on the Access Analyzer Console server.
+- Exchange System Manager for Exchange 2003 isn't installed on the Access Analyzer Console server.
+- Microsoft Outlook isn't installed on the Access Analyzer Console server.
These programs interfere with MAPI connections if they are installed on the Access Analyzer Console
server.
-Follow the steps to install the Access Analyzer MAPI CDO.
+Install the Access Analyzer MAPI CDO:
**Step 1 –** Run the StealthAuditMapiCDO executable.
diff --git a/docs/accessanalyzer/12.0/install/overview.md b/docs/accessanalyzer/12.0/install/overview.md
index 39ab7a684b..5782bd50e7 100644
--- a/docs/accessanalyzer/12.0/install/overview.md
+++ b/docs/accessanalyzer/12.0/install/overview.md
@@ -21,7 +21,7 @@ information.
## File System Proxy Service
-The File System Solution can be enabled to use proxy servers for scanning targeted file systems in
+You can enable the File System Solution to use proxy servers for scanning targeted file systems in
very large or widely dispersed environments. The File System Proxy installer is designed to simplify
the process of setting up File System Scanning Proxy as a service on the designated proxy server.
diff --git a/docs/accessanalyzer/12.0/install/sharepointagent/overview.md b/docs/accessanalyzer/12.0/install/sharepointagent/overview.md
index 0273ce5ac3..ce504906b8 100644
--- a/docs/accessanalyzer/12.0/install/sharepointagent/overview.md
+++ b/docs/accessanalyzer/12.0/install/sharepointagent/overview.md
@@ -21,8 +21,8 @@ The version of the SharePoint Agent must also match the major version of Access
## Supported Platforms
-The SharePoint Agent for the Access Analyzer SharePoint & SharePoint Online Solution can be
-installed on the following SharePoint versions as targeted environments:
+You can install the SharePoint Agent for the Access Analyzer SharePoint & SharePoint Online Solution
+on the following SharePoint versions as targeted environments:
- SharePoint® 2019
- SharePoint® 2016
@@ -30,6 +30,6 @@ installed on the following SharePoint versions as targeted environments:
## Sensitive Data Discovery Auditing Consideration
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, you must increase the minimum amount
+of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if you
+configure the job to scan 8 hosts at a time, you need an extra 16 GB of RAM (8x2=16).
diff --git a/docs/accessanalyzer/12.0/install/sharepointagent/upgrade.md b/docs/accessanalyzer/12.0/install/sharepointagent/upgrade.md
index 2a8a5b7842..5709368979 100644
--- a/docs/accessanalyzer/12.0/install/sharepointagent/upgrade.md
+++ b/docs/accessanalyzer/12.0/install/sharepointagent/upgrade.md
@@ -6,8 +6,6 @@ sidebar_position: 20
# Upgrade SharePoint Agent
-Follow the steps to upgrade the SharePoint Agent.
-
**Step 1 –** From Programs and Features (**Control Panel** > **Programs** > **Programs and
@@ -15,13 +13,13 @@ Features**), uninstall the previous version of SharePoint Agent.
:::note
If you have the old Netwrix Sensitive Data Discovery Add-On installed, you must uninstall
-it before continuing with this upgrade. For Access Analyzer 12.0, Sensitive Data Discovery is
-installed as part of the main installation if your license includes it.
+it before continuing with this upgrade. For Access Analyzer 12.0, the main installation includes
+Sensitive Data Discovery if your license includes it.
:::
**Step 2 –** Install the new version of the SharePoint Agent. See the
[Installing the SharePoint Agent](/docs/accessanalyzer/12.0/install/sharepointagent/wizard.md) topic for instructions.
-Now that the SharePoint Agent has been upgraded, it can be used by the SharePoint Solution. See the
+Now that you have upgraded the SharePoint Agent, the SharePoint Solution can use it. See the
[SharePoint Solution](/docs/accessanalyzer/12.0/solutions/sharepoint/overview.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/install/sharepointagent/wizard.md b/docs/accessanalyzer/12.0/install/sharepointagent/wizard.md
index 02d17224c5..d23601d5c4 100644
--- a/docs/accessanalyzer/12.0/install/sharepointagent/wizard.md
+++ b/docs/accessanalyzer/12.0/install/sharepointagent/wizard.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Installing the SharePoint Agent
-The installer will prompt for credentials which are used to set the identity that the SharePoint
+The installer will prompt for credentials that set the identity the SharePoint
Access Auditor Agent service runs as. The agent service does no additional impersonation, so this is
the account used to connect to and enumerate SharePoint. The service account credentials provided
need to be a member of the Log on as a service local policy. Additionally, the credentials provided
@@ -15,8 +15,8 @@ the Access Analyzer Console. See the
[SharePoint Scan Options](/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/scanoptions.md) topic for detailed
permission information.
-Follow the steps to install the SharePoint Agent on the application server which hosts the Central
-Administration component of the targeted SharePoint farms.
+Install the SharePoint Agent on the application server which hosts the Central Administration
+component of the targeted SharePoint farms:
**Step 1 –** Run the `SharePointAgent.exe` executable to open the Netwrix Access Analyzer (formerly
Enterprise Auditor) SharePoint Agent Setup Wizard.
@@ -49,7 +49,7 @@ SharePoint Agent page, click **Install** to start the installation.
**Step 7 –** When the installation has completed, click **Finish** to exit the wizard.
-Now that the SharePoint Agent has been installed on the appropriate application server, it can be
-used by the SharePoint Solution. See the
+Now that you have installed the SharePoint Agent on the appropriate application server, the
+SharePoint Solution can use it. See the
[SharePoint Solution](/docs/accessanalyzer/12.0/solutions/sharepoint/overview.md) topic for instructions on enabling
agent service scans on the Agent Settings page.
diff --git a/docs/accessanalyzer/12.0/requirements/activedirectory/activedirectory.md b/docs/accessanalyzer/12.0/requirements/activedirectory/activedirectory.md
index ca25dd38b3..0dbd6225b7 100644
--- a/docs/accessanalyzer/12.0/requirements/activedirectory/activedirectory.md
+++ b/docs/accessanalyzer/12.0/requirements/activedirectory/activedirectory.md
@@ -10,8 +10,8 @@ The core components for Netwrix Access Analyzer (formerly Enterprise Auditor) ar
Analyzer Console server, SQL Server, and Access Information Center. See the
[Requirements](/docs/accessanalyzer/12.0/requirements/overview.md) topic for the core requirements.
-In addition to these, integration with either the Netwrix Activity Monitor or the Netwrix Threat
-Prevention is required for event activity data to be scanned. See the
+In addition to these, you need integration with either the Netwrix Activity Monitor or the Netwrix
+Threat Prevention to scan event activity data. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor) or
the
[Netwrix Threat Prevention Documentation](https://helpcenter.netwrix.com/category/threatprevention)
diff --git a/docs/accessanalyzer/12.0/requirements/activedirectory/target/access.md b/docs/accessanalyzer/12.0/requirements/activedirectory/target/access.md
index 279cd76da0..fc7e10c62e 100644
--- a/docs/accessanalyzer/12.0/requirements/activedirectory/target/access.md
+++ b/docs/accessanalyzer/12.0/requirements/activedirectory/target/access.md
@@ -21,7 +21,7 @@ article for additional information.
**Domain Controller Requirements**
-The following are requirements for the domain controllers to be scanned:
+The following are requirements for the domain controllers you want to scan:
- .NET Framework 4.5+ installed
- WINRM Service installed
@@ -105,7 +105,7 @@ The following firewall ports are needed:
## Least Privilege Model
You can configure a least privilege model based on your auditing needs and the data collection jobs
-you use. The following jobs and their corresponding data collectors can be run with a
+you use. You can run the following jobs and their corresponding data collectors with a
least privilege permissions model.
**1-AD_Scan Job Permissions**
@@ -234,7 +234,7 @@ the following minimum requirements:
- Read permission on the Certification Authority, granted through the Certification Authority
console's Security tab
-The Certification Authority server does not require local administrator rights.
+The Certification Authority server doesn't require local administrator rights.
:::info
If the job fails to collect Certification Authority security, registry, or enrollment agent data
diff --git a/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/activity.md b/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/activity.md
index f3d78dfbcb..cee926d202 100644
--- a/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/activity.md
+++ b/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/activity.md
@@ -30,7 +30,7 @@ In this method, you will be deploying two agents:
- Next, deploy the AD Agent to all domain controllers in the target domain.
-Follow the steps to setup integration between Activity Monitor and Access Analyzer through an API
+Set up integration between Activity Monitor and Access Analyzer through an API
server.
**Step 1 –** Deploy the Activity Agent to the API server.
@@ -41,7 +41,7 @@ The next step is to configure the agent deployed to the API server.
## Configure API Server Agent
-Follow the steps to configure the agent deployed to the API server.
+Configure the agent deployed to the API server.
**Step 1 –** On the Agents tab of the Activity Monitor Console, select the agent deployed to the
API server.
@@ -51,8 +51,8 @@ API server.
**Step 3 –** Select the **API Server** tab and configure the following:
- Select the **Enable API access on this agent** checkbox.
-- The default **API server port (TCP)** is 4494, but it can be modified if desired. Ensure the
- modified port is also used by Access Analyzer.
+- The default **API server port (TCP)** is 4494, but you can modify it if desired. Ensure Access
+ Analyzer also uses the modified port.
- Click **Add Application**. The Add or edit API client window opens.
- Configure the following:
@@ -63,19 +63,19 @@ API server.
- Click **Copy** and save the Client Secret value to a text file.
:::warning
- It is not possible to retrieve the value after closing the Add or edit
- API client window. It must be copied first.
+ You can't retrieve the value after closing the Add or edit
+ API client window. Copy it first.
:::
- - By default, the **Secret Expires** in 3 days. That means it must be used in the Access
- Analyzer Connection Profile within 72 hours or a new secret will need to be generated. Modify
+ - By default, the **Secret Expires** in 3 days. That means you must use it in the Access
+ Analyzer Connection Profile within 72 hours, or you will need to generate a new secret. Modify
if desired.
- Click **OK** to save the configuration and close the Add or edit API client window.
-- If the Activity Monitor Console server is not the API Server, then click **Use this console** to
+- If the Activity Monitor Console server isn't the API Server, then click **Use this console** to
grant the Activity Monitor the ability to manage the API server.
-- The IPv4 or IPv6 allowlist allows you to limit access to the API server data to specific hosts.
+- Use the IPv4 or IPv6 allowlist to limit access to the API server data to specific hosts.
**Step 4 –** Click **OK** to save the configuration and close the Agent properties window.
@@ -83,7 +83,7 @@ The next step is to configure the agents deployed to the domain controllers.
## Configure Domain Controller Agent
-Follow the steps to configure the agent deployed to the domain controller.
+Configure the agent deployed to the domain controller.
**Step 1 –** On the Agents tab of the Activity Monitor Console, select an agent deployed to domain
controller.
@@ -94,9 +94,9 @@ controller.
- Select the **Enable Archiving for this agent** checkbox.
- Select the **Archive log files on a UNC path** option. Click the **...** button and navigate to
- the desired network share on the API server.
-- The **User name** and **User password** fields only need to be filled in if the account used to
- install the agent does not have access to this share.
+ the network share you want on the API server.
+- Fill in the **User name** and **User password** fields only if the account used to
+ install the agent doesn't have access to this share.
:::tip
Remember, The account used to install the agent on a domain controller is a Domain
@@ -110,7 +110,7 @@ controller.
**Step 5 –** Repeat Steps 1-4 for each agent deployed to domain controller.
-These agent are configured to save the Archive logs to the selected share.
+These agents save the Archive logs to the selected share.
## Configure Monitored Domain Output
@@ -119,16 +119,16 @@ Enterprise Auditor).
**Step 1 –** Select the **Monitored Domains** tab.
-**Step 2 –** Select the desired domain and click **Add Output**. The Add New Ouptut window opens.
+**Step 2 –** Select the domain you want and click **Add Output**. The Add New Ouptut window opens.
**Step 3 –** Configure the following:
-- Configure the desired number of days for the **Period to keep Log files**. This is the number of
- days the log files are kept on the API server configured in the sections above. This needs to be
- set to a greater value than the days between Access Analyzer scans.
+- Configure the number of days you want for the **Period to keep Log files**. This is the number of
+ days the log files are kept on the API server you configured earlier. You need to
+ set this to a greater value than the days between Access Analyzer scans.
- For example, if Access Analyzer runs the **AD_ActivityCollection** Job once a week (every 7
- days), then the Activity Monitor output should be configured to retain at least 10 days of log
+ days), you should configure the Activity Monitor output to retain at least 10 days of log
files.
- Check the **This log file is for StealthAUDIT** box.
@@ -142,12 +142,12 @@ Access Analyzer now has access to the agent log files for this domain.
## Configure Connection Profile
-Follow the steps to configure the Connection Profile in Access Analyzer.
+Configure the Connection Profile in Access Analyzer.
:::tip
-Remember, the Client ID and Client Secret were generated by the API server and copied to a text
-file. If the secret expired before the Connection Profile is configured, it will need to be
-re-generated.
+Remember, the API server generated the Client ID and Client Secret, and you copied them to a text
+file. If the secret expires before you configure the Connection Profile, you will need to
+re-generate it.
:::
@@ -172,19 +172,19 @@ name.
Group. Select the **Settings > Connection** node.
**Step 7 –** Select the **Select one of the following user defined profiles** option. Expand the
-drop-down menu and select the Connection Profile with this credential.
+dropdown menu and select the Connection Profile with this credential.
**Step 8 –** Click **Save** and then **OK** to confirm the changes to the job group settings.
-The Connection Profile will now be used for AD Activity collection.
+Access Analyzer will now use the Connection Profile for AD Activity collection.
## Configure the AD_ActivityCollection Job
-The Access Analyzer requires additional configurations in order to collect domain activity data.
-Follow the steps to configure the **AD_ActivityCollection** Job.
+The Access Analyzer requires additional configurations to collect domain activity data.
+Configure the **AD_ActivityCollection** Job.
:::note
-Ensure that the **.Active Directory Inventory** Job Group has been successfully run
+Ensure that you have successfully run the **.Active Directory Inventory** Job Group
against the target domain.
:::
@@ -223,10 +223,10 @@ last step.
- Absolute Timespan – Set the date range for activity logs to collect when the scan is run
:::info
-The threshold should be set to ensure the logs are collected before the Activity
+You should set the threshold to ensure the logs are collected before the Activity
Monitor domain output log retention expires. For example, if Access Analyzer runs the
-**AD_ActivityCollection** Job once a week (every 7 days), then the Activity Monitor output should be
-configured to retain at least 10 days of log files.
+**AD_ActivityCollection** Job once a week (every 7 days), you should configure the Activity Monitor
+output to retain at least 10 days of log files.
:::
@@ -246,30 +246,30 @@ Credential with the Refresh token:
- Click **OK** to save and close the User Credentials window.
- Click **Save** and then **OK** to confirm the changes to the Connection Profile.
-The query is now configured to target the Activity Monitor API Server to collect domain activity
-logs.
+Access Analyzer now targets the Activity Monitor API Server with this query to collect domain
+activity logs.
### (Optional) Configure Import of AD Activity into Netwrix Access Information Center
-AD Activity data can be imported into Netwrix Access Information Center by the
-**AD_ActivityCollection** Job. However, this is disabled by default. Follow the steps to enable the
-importing of AD activity data into the Access Information Center.
+The **AD_ActivityCollection** Job can import AD Activity data into Netwrix Access Information
+Center. However, this is disabled by default. Enable the
+import of AD activity data into the Access Information Center.
**Step 1 –** Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **0.Collection** >
**AD_ActivityCollection** Job.
**Step 2 –** On the job's Overview page, enable the import of AD Events.
-- Click on the **Enable to import AD events into the AIC** parameter.
+- Click the **Enable to import AD events into the AIC** parameter.
- On the Parameter Configuration window, select the **Enabled** checkbox and click **Save**.
**Step 3 –** On the job's Overview page, enable the import of authentication Events.
-- Click on the **Enable to import authentication events into the AIC** parameter.
+- Click the **Enable to import authentication events into the AIC** parameter.
- On the Parameter Configuration window, select the **Enabled** checkbox and click **Save**.
**Step 4 –** Optionally, modify the **List of attributes to track for Object Modified changes** and
**Number of days to retain activity data in the AIC** parameters.
-The **AD_ActivityCollection** Job is now configured to import both AD events and authentication
-events into the Netwrix Access Information Center.
+You have now configured the **AD_ActivityCollection** Job to import both AD events and
+authentication events into the Netwrix Access Information Center.
diff --git a/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/filearchive.md b/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/filearchive.md
index d77004d36c..c4c266063c 100644
--- a/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/filearchive.md
+++ b/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/filearchive.md
@@ -6,9 +6,9 @@ sidebar_position: 10
# File Archive Repository Option
-As an alternative to using an API Server, Netwrix Activity Monitor can be configured to store all
-archived logs to a network share. This option requires all of the domain logs to be stored in the
-same share location in order for Access Analyzer to collect the AD Activity data.
+As an alternative to using an API Server, you can configure Netwrix Activity Monitor to store all
+archived logs to a network share. This option requires storing all of the domain logs in the
+same share location for Access Analyzer to collect the AD Activity data.
**Prerequisite**
@@ -16,7 +16,7 @@ Deploy the AD Agent to each domain controller in the target domain.
## Configure Domain Controller Agent
-Follow the steps to configure the agent deployed to the domain controller.
+Configure the agent deployed to the domain controller.
:::note
These steps assume the network share where the activity log files will be archived already
@@ -34,12 +34,12 @@ controller.
- Check the Enable Archiving for this agent box.
- Select the **Archive log files on a UNC path** option. Click the ... button and navigate to the
desired network share.
-- The **User name** and **User password** fields only need to be filled in if the account used to
- install the agent does not have access to this share.
+- Fill in the **User name** and **User password** fields only if the account used to
+ install the agent doesn't have access to this share.
:::tip
Remember, The account used to install the agent on a domain controller is a Domain
- Administrator account. This is typically the credential that will be used in the Netwrix Access
+ Administrator account. This is typically the credential you will use in the Netwrix Access
Analyzer (formerly Enterprise Auditor) Connection Profile. However, a least privilege option is
a domain user account with Read access to this share.
:::
@@ -52,7 +52,7 @@ controller.
**Step 5 –** Repeat Steps 1-4 for each agent deployed to domain controller pointing to the same
network share in Step 3 for each agent.
-These agent are configured to save the Archive logs to the selected share.
+These agents save the Archive logs to the selected share.
## Configure Monitored Domain Output
@@ -61,16 +61,16 @@ Enterprise Auditor).
**Step 1 –** Select the **Monitored Domains** tab.
-**Step 2 –** Select the desired domain and click **Add Output**. The Add New Ouptut window opens.
+**Step 2 –** Select the domain you want and click **Add Output**. The Add New Ouptut window opens.
**Step 3 –** Configure the following:
-- Configure the desired number of days for the **Period to keep Log files**. This is the number of
- days the log files are kept on the API server configured in the sections above. This needs to be
- set to a greater value than the days between Access Analyzer scans.
+- Configure the number of days you want for the **Period to keep Log files**. This is the number of
+ days the log files are kept on the API server you configured earlier. You need to
+ set this to a greater value than the days between Access Analyzer scans.
- For example, if Access Analyzer runs the **AD_ActivityCollection** Job once a week (every 7
- days), then the Activity Monitor output should be configured to retain at least 10 days of log
+ days), you should configure the Activity Monitor output to retain at least 10 days of log
files.
- Check the **This log file is for StealthAUDIT** box.
@@ -84,7 +84,7 @@ Access Analyzer now has access to the agent log files for this domain.
## Configure Connection Profile
-Follow the steps to configure the Connection Profile in Access Analyzer.
+Configure the Connection Profile in Access Analyzer.
**Step 1 –** On the Settings > Connection node of the Access Analyzer Console, select the Connection
Profile for the Active Directory solution. If you haven't yet created a Connection Profile or desire
@@ -111,19 +111,19 @@ a specific one for AD Activity, create a new one and provide a unique descriptiv
the **Settings > Connection** node.
**Step 7 –** Select the **Select one of the following user defined profiles** option. Expand the
-drop-down menu and select the Connection Profile with this credential.
+dropdown menu and select the Connection Profile with this credential.
**Step 8 –** Click **Save** and then **OK** to confirm the changes to the job group settings.
-The Connection Profile will now be used for AD Activity collection.
+Access Analyzer will now use the Connection Profile for AD Activity collection.
## Configure the AD_ActivityCollection Job
-Access Analyzer requires additional configurations in order to collect domain activity data. Follow
+Access Analyzer requires additional configurations to collect domain activity data. Follow
the steps to configure the **AD_ActivityCollection** Job.
:::note
-Ensure that the .Active Directory Inventory Job Group has been successfully run against
+Ensure that you have successfully run the .Active Directory Inventory Job Group against
the target domain.
:::
@@ -154,10 +154,10 @@ Click **Next**.
- Absolute Timespan – Set the date range for activity logs to collect when the scan is run
:::info
-The threshold should be set to ensure the logs are collected before the Activity
+You should set the threshold to ensure the logs are collected before the Activity
Monitor domain output log retention expires. For example, if Access Analyzer runs the
-**AD_ActivityCollection** Job once a week (every 7 days), then the Activity Monitor output should be
-configured to retain at least 10 days of log files.
+**AD_ActivityCollection** Job once a week (every 7 days), you should configure the Activity Monitor
+output to retain at least 10 days of log files.
:::
@@ -168,5 +168,5 @@ the collected data in the SQL Server database.
**Step 9 –** Click **OK** to save the changes and close the Query Properties page.
-The query is now configured to target the network share where the Activity Monitor domain activity
+This query now targets the network share where the Activity Monitor domain activity
logs are archived.
diff --git a/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/threatprevention.md b/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/threatprevention.md
index 6f3d36b0dc..619a14549c 100644
--- a/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/threatprevention.md
+++ b/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/threatprevention.md
@@ -6,22 +6,22 @@ sidebar_position: 20
# Send Active Directory Event Data from Netwrix Threat Prevention to Netwrix Access Analyzer
-When Netwrix Threat Prevention is configured to monitor a domain, the event data collected by the
-policies can be provided to Netwrix Access Analyzer (formerly Enterprise Auditor) for auditing and
+When you configure Netwrix Threat Prevention to monitor a domain, you can provide the event data
+collected by the policies to Netwrix Access Analyzer (formerly Enterprise Auditor) for auditing and
analysis. This is accomplished by configuring Threat Prevention to send data to Netwrix Activity
Monitor, which in turn creates the activity log files that Access Analyzer collects.
:::note
-Threat Prevention can only be configured to send event data to one Netwrix application,
-either Netwrix Activity Monitor or Netwrix Threat Manager but not both. However, the Activity
-Monitor can be configured with outputs for Access Analyzer and Threat Manager.
+You can only configure Threat Prevention to send event data to one Netwrix application,
+either Netwrix Activity Monitor or Netwrix Threat Manager but not both. However, you can configure
+the Activity Monitor with outputs for Access Analyzer and Threat Manager.
:::
-Follow the steps to configure this integration.
+Configure this integration.
:::info
-It is a best practice to use the API Server option of the Activity Monitor for
+As a best practice, use the API Server option of the Activity Monitor for
this integration between Threat Prevention and Access Analyzer.
:::
@@ -41,12 +41,12 @@ Threat Manager Configuration** on the menu. The Netwrix Threat Manager Configura
- App Token – Leave this field blank for integration with Activity Monitor
- Policies – The table displays all policies created in Threat Prevention along with a State icon
- indicating if the policy is active. Check the **Send** box for the desired policies monitoring the
- target domain activity.
+ indicating if the policy is active. Check the **Send** box for the policies you want that monitor
+ the target domain activity.
**Step 3 –** Click **Save**.
-All real-time event data from the selected policies is now sent to Activity Monitor. Additional
-policies can be added to this data stream through the Netwrix Threat Manager Configuration window or
-by selecting the **Send to Netwrix Threat Manager** option on the Actions tab of the respective
-policy.
+Threat Prevention now sends all real-time event data from the selected policies to Activity
+Monitor. You can add additional policies to this data stream through the Netwrix Threat Manager
+Configuration window or by selecting the **Send to Netwrix Threat Manager** option on the Actions
+tab of the respective policy.
diff --git a/docs/accessanalyzer/12.0/requirements/activedirectory/target/overview.md b/docs/accessanalyzer/12.0/requirements/activedirectory/target/overview.md
index e5cad5f2ed..bb25a830b6 100644
--- a/docs/accessanalyzer/12.0/requirements/activedirectory/target/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/activedirectory/target/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Active Directory Domain Target Requirements
Netwrix Access Analyzer (formerly Enterprise Auditor) can execute scans on Active Directory domains.
-The Netwrix Activity Monitor can be configured to monitor activity on Active Directory domains and
+You can configure the Netwrix Activity Monitor to monitor activity on Active Directory domains and
make the event data available for Access Analyzer Active Directory Activity scans.
## Auditing Permissions
@@ -16,7 +16,7 @@ The following permission is needed:
- Member of the Domain Administrators group
-Some collection jobs do allow for a least privilege model. See the
+Some collection jobs allow for a least privilege model. See the
[Active Directory Auditing Configuration](/docs/accessanalyzer/12.0/requirements/activedirectory/target/access.md) topic for additional information.
## Auditing Port Requirements
@@ -27,7 +27,7 @@ Ports vary based on the data collector being used. See the
## Activity Auditing Permissions
:::note
-Active Directory domain activity events can also be monitored through Netwrix Threat
+You can also monitor Active Directory domain activity events through Netwrix Threat
Prevention. This requires integration between it and Netwrix Activity Monitor to enable access to
the data for Access Analyzer Active Directory Activity scans. See the
[Send Active Directory Event Data from Netwrix Threat Prevention to Netwrix Access Analyzer](/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/threatprevention.md)
@@ -37,8 +37,8 @@ topic for additional information.
Requirements to Deploy the AD Agent on the Domain Controller
-The Netwrix Activity Monitor must have an AD Agent deployed on the domain controller to be
-monitored. While actively monitoring, the AD Agent generates activity log files stored on the
+The Netwrix Activity Monitor must have an AD Agent deployed on each domain controller you want to
+monitor. While actively monitoring, the AD Agent generates activity log files stored on the
server. The credential used to deploy the AD Agent must have the following permissions on the
server:
@@ -46,8 +46,8 @@ server:
- READ and WRITE access to the archive location for Archiving feature only
:::note
-For monitoring an Active Directory domain, the AD Agent must be installed on all domain
-controllers within the domain to be monitored.
+To monitor an Active Directory domain, you must install the AD Agent on all domain
+controllers within the domain.
:::
@@ -74,9 +74,9 @@ are required for communication between the Agent server and the Netwrix Activity
| -------------------------------- | -------- | ----- | ------------------- |
| Activity Monitor to Agent Server | TCP | 4498 | Agent Communication |
-The Windows firewall rules need to be configured on the Windows server, which require certain
-inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+You need to configure the Windows firewall rules on the Windows server, which require you to
+create certain inbound rules if the scans are running in applet mode. These scans operate over a
+default port range, which you can't specify via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/12.0/requirements/activedirectorypermissionsanalyzer/target.md b/docs/accessanalyzer/12.0/requirements/activedirectorypermissionsanalyzer/target.md
index 5844b2b7c4..44803343bc 100644
--- a/docs/accessanalyzer/12.0/requirements/activedirectorypermissionsanalyzer/target.md
+++ b/docs/accessanalyzer/12.0/requirements/activedirectorypermissionsanalyzer/target.md
@@ -21,7 +21,7 @@ article for additional information.
**Domain Controller Requirements**
-The following are requirements for the domain controllers to be scanned:
+The following are requirements for the domain controllers you want to scan:
- .NET Framework 4.5+ installed
- WINRM Service installed
diff --git a/docs/accessanalyzer/12.0/requirements/aws/aws.md b/docs/accessanalyzer/12.0/requirements/aws/aws.md
index 74da6a3ba7..2d0ed89f43 100644
--- a/docs/accessanalyzer/12.0/requirements/aws/aws.md
+++ b/docs/accessanalyzer/12.0/requirements/aws/aws.md
@@ -17,7 +17,7 @@ target environment requirements.
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment:
+These depend on the size of the target environment:
| Environment | Large | Medium – Small |
| ----------- | -------------- | -------------- |
@@ -27,20 +27,19 @@ These are dependent upon the size of the target environment:
| Disk Space | 30 GB | 30 GB |
:::note
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
-minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For
-example, if the job is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are
-required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each
+thread requires a minimum of 2 additional GB of RAM per host. For example, if you configure the
+job to scan 8 hosts at a time, you need an extra 16 GB of RAM (8x2=16).
:::
**Sensitive Data Discovery Auditing Requirement**
:::note
-The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
-conflict with other JDKs or Java Runtimes in the same environment.
+Access Analyzer installs the appropriate JDK (Java) version for Sensitive Data Discovery on
+the server. This JDK comes prepackaged and preconfigured to work with Access Analyzer, requires no
+additional configuration, and you should never customize it through Java. It doesn't conflict with
+other JDKs or Java Runtimes in the same environment.
:::
@@ -48,7 +47,7 @@ conflict with other JDKs or Java Runtimes in the same environment.
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment.
+These depend on the size of the target environment.
| Environment | Large | Medium – Small |
| ------------------------ | -------------- | -------------- |
diff --git a/docs/accessanalyzer/12.0/requirements/aws/configurescans.md b/docs/accessanalyzer/12.0/requirements/aws/configurescans.md
index 3d2f0f9900..69af9617f8 100644
--- a/docs/accessanalyzer/12.0/requirements/aws/configurescans.md
+++ b/docs/accessanalyzer/12.0/requirements/aws/configurescans.md
@@ -6,13 +6,12 @@ sidebar_position: 20
# Configure AWS for Scans
-In order to scan multiple AWS accounts using one account you need to create a role in each target
-account, so that It can provide the designated scanning account permissions to scan resources it
-controls. This is achieved through the following steps which will need to be completed leveraging a
-user with administrative access to each target account:
+To scan multiple AWS accounts using one account, create a role in each target account so it
+can grant the designated scanning account permission to scan the resources it controls. Complete
+the following steps using a user with administrative access to each target account:
**Step 1 –** Create a Managed Policy in each target account that will be used to allow access to
-account (S3, Org and IAM).
+account (S3, Org, and IAM).
**Step 2 –** Create a Role in each target account that will be used to allow access to listing IAM
users.
@@ -20,16 +19,16 @@ users.
**Step 3 –** Create a Managed Policy in the designated scanning account that will be used to allow
the service account to assume the configured role in each target account.
-**Step 4 –** Add Role to Access Analyzer. The Role created in the scanning account will need to be
-added to the **1-AWS_OrgScan**, **2-AWS_S3Scan**, and **3-AWS_IAMScan** job query configurations.
+**Step 4 –** Add the role created in the scanning account to Access Analyzer's
+**1-AWS_OrgScan**, **2-AWS_S3Scan**, and **3-AWS_IAMScan** job query configurations.
See the [AWS: Login Roles](/docs/accessanalyzer/12.0/admin/datacollector/aws/loginroles.md) topic for additional
information.
-Once these steps are completed, the role must be added to the AWS queries within Access Analyzer.
+After you complete these steps, add the role to the AWS queries within Access Analyzer.
## Create a Managed Policy in Each Target Account
-The following steps will need to be completed in each target account.
+Complete the following steps in each target account.
**Step 1 –** Sign into the Identity and Access Management Console (IAM) as an administrator of the
Trusting account.
@@ -86,7 +85,7 @@ and click **Create policy**.
**Step 7 –** Click **Create Policy**.
:::note
-If the designated scanning account is not in Root (Master Account), create a second policy
+If the designated scanning account isn't in Root (Master Account), create a second policy
in the Master Account with the following JSON definition:
:::
@@ -109,12 +108,11 @@ in the Master Account with the following JSON definition:
}
```
-The next step is to create a role in each target account that will be used to allow access to
-listing IAM users.
+The next step is to create a role in each target account that allows access to list IAM users.
## Create a Role in Each Target Account
-The following steps will need to be completed in each target account. For this, you will need the
+Complete the following steps in each target account. For this, you need the
Account ID of the designating scanning account.
:::note
@@ -133,7 +131,7 @@ target account.
**Step 3 –** Select the **Another AWS Account** option and add the Account ID of the scanning
-account that will be leveraged within Access Analyzer.
+account that Access Analyzer uses.
**Step 4 –** Click **Next: Permissions**.
@@ -151,13 +149,13 @@ account that will be leveraged within Access Analyzer.
**Step 9 –** Click **Create Role**.
-The next step is to create a Managed Policy in the designated scanning account that will be used to
-allow the service account to assume the configured role in each target account.
+The next step is to create a Managed Policy in the designated scanning account that lets the
+service account assume the configured role in each target account.
## Configure the Scanning Account
-Create a Managed Policy in the scanning account that will be used to allow the user to assume the
-roles configured in each target account.
+Create a Managed Policy in the scanning account that lets the user assume the roles configured in
+each target account.
**Step 1 –** Sign into the Identity and Access Management Console (IAM) as an administrator of the
scanning account.
@@ -197,8 +195,8 @@ scanning account.
```
:::note
-Replace `ROLENAME` with the name of the role that was created. If the `ROLENAME` is
-different in each account, then a policy will need to be created for each distinct role name.
+Replace `ROLENAME` with the name of the role you created. If `ROLENAME` differs across
+accounts, create a policy for each distinct role name.
:::
@@ -216,8 +214,8 @@ different in each account, then a policy will need to be created for each distin
-**Step 10 –** In the Security credentials tab, click **Create access key**. Make sure to note the
-Access key ID and Secret access key which need to be input into Access Analyzer.
+**Step 10 –** In the Security credentials tab, click **Create access key**, and note the Access
+key ID and Secret access key. Enter both into Access Analyzer.
You can now create the Connection Profile for the AWS Solution. See the
[Amazon Web Services for User Credentials](/docs/accessanalyzer/12.0/admin/settings/connection/create/aws.md) topic
diff --git a/docs/accessanalyzer/12.0/requirements/aws/target.md b/docs/accessanalyzer/12.0/requirements/aws/target.md
index 2d5a6919bb..f45279c2c7 100644
--- a/docs/accessanalyzer/12.0/requirements/aws/target.md
+++ b/docs/accessanalyzer/12.0/requirements/aws/target.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Target Amazon Web Service Requirements, Permissions, and Ports
-The Access Analyzer for AWS Solution provides the ability to audit Amazon Web Services (AWS) to
+The Access Analyzer for AWS Solution lets you audit Amazon Web Services (AWS) to
collect IAM users, groups, roles, and policies, as well as S3 permissions, content, and sensitive
data from target AWS accounts. It scans:
diff --git a/docs/accessanalyzer/12.0/requirements/box/box.md b/docs/accessanalyzer/12.0/requirements/box/box.md
index d96200d4e7..1c61730ba7 100644
--- a/docs/accessanalyzer/12.0/requirements/box/box.md
+++ b/docs/accessanalyzer/12.0/requirements/box/box.md
@@ -17,7 +17,7 @@ environment requirements.
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment:
+These depend on the size of the target environment:
| Environment | Large | Medium – Small |
| ----------- | ----------------------- | ---------------------- |
@@ -30,7 +30,7 @@ These are dependent upon the size of the target environment:
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment.
+These depend on the size of the target environment.
| Environment | Large | Medium – Small |
| ------------------------ | ----------------------- | ---------------------- |
diff --git a/docs/accessanalyzer/12.0/requirements/databases/azuresql/azuresql.md b/docs/accessanalyzer/12.0/requirements/databases/azuresql/azuresql.md
index dcfa0cbc40..5fd69449d5 100644
--- a/docs/accessanalyzer/12.0/requirements/databases/azuresql/azuresql.md
+++ b/docs/accessanalyzer/12.0/requirements/databases/azuresql/azuresql.md
@@ -13,10 +13,10 @@ used by AzureSQL to return the required audit logs. See the
Microsoft Knowledge Base article for additional information.
:::info
-It is recommended to create a new user when leveraging a least privilege access
-model to access the AzureSQL database because the user must exist in the master database and all
-target databases. A least privilege access model is one that uses the bare minimum privileges
-required to carry out collections for the AzureSQL data collector.
+Netwrix recommends creating a new user when you use a least privilege access model to
+access the AzureSQL database, because the user must exist in the master database and all target
+databases. A least privilege access model is one that uses the bare minimum privileges required to
+carry out collections for the AzureSQL data collector.
:::
@@ -27,7 +27,7 @@ The Least Privilege Model requires the following role and permissions:
- Control permission on target databases
:::note
- Control permission must be granted on any database you want to collect data for.
+ Grant Control permission on any database you want to collect data for.
:::
diff --git a/docs/accessanalyzer/12.0/requirements/databases/azuresql/azuresqlaccess.md b/docs/accessanalyzer/12.0/requirements/databases/azuresql/azuresqlaccess.md
index 55500526b7..61a231eec9 100644
--- a/docs/accessanalyzer/12.0/requirements/databases/azuresql/azuresqlaccess.md
+++ b/docs/accessanalyzer/12.0/requirements/databases/azuresql/azuresqlaccess.md
@@ -9,8 +9,8 @@ sidebar_position: 20
Access Analyzer for Azure SQL relies on the native Azure SQL auditing capabilities to collect and
report on user activity, as well as successful or unsuccessful server or database logon activity.
Azure SQL Auditing supports three different audit log destinations. At present Access Analyzer only
-supports storage as the audit log destination. This document describes the necessary permissions
-required to configure the Access Analyzer Azure SQL Job Group.
+supports storage as the audit log destination. This document describes the permissions required to
+configure the Access Analyzer Azure SQL Job Group.
With Access Analyzer for Azure SQL, you can create custom roles for differential access to Access Analyzer.
@@ -22,8 +22,8 @@ Access Analyzer for Azure SQL creates roles specifically to target Azure SQL Dat
The scope of a particular role largely defines that role. A scope-defined role has
access to, or is limited to all resources in a Management Group, Subscription, Resource Group or
-Resource. For example, if all SQL databases reside within a resource group, then the scope can be
-restricted to that resource group. If databases reside in different resource groups, then the scope
+Resource. For example, if all SQL databases reside within a resource group, you can restrict the
+scope to that resource group. If databases reside in different resource groups, then the scope
for the custom role should be at the subscription level.
This enables Access Analyzer to discover all SQL databases in the subscription.
@@ -114,8 +114,8 @@ following example) and save it to a local directory.
it. Selecting that file enables the Review + Create button.
Click **Review + Create** to create the role or click **Next** to review and edit the permissions.
-When you open the JSON file, the Custom Role Name and Description boxes are populated
-automatically. You can customize the name and description of the custom role in this step.
+Opening the JSON file automatically populates the Custom Role Name and Description boxes.
+You can customize the name and description of the custom role in this step.
diff --git a/docs/accessanalyzer/12.0/requirements/databases/databases.md b/docs/accessanalyzer/12.0/requirements/databases/databases.md
index ca3e635d2d..07f7e444e1 100644
--- a/docs/accessanalyzer/12.0/requirements/databases/databases.md
+++ b/docs/accessanalyzer/12.0/requirements/databases/databases.md
@@ -30,7 +30,7 @@ See the following topics for target environment requirements:
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment:
+These depend on the size of the target environment:
| Environment | Extra-Large | Large | Medium | Small |
| ----------- | -------------------- | ------------------------ | --------------------- | -------------------- |
@@ -76,7 +76,7 @@ conflict with other JDKs or Java Runtimes in the same environment.
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment.
+These depend on the size of the target environment.
| Environment | Extra-Large | Large | Medium | Small |
| ------------------------ | -------------------- | ------------------------ | --------------------- | -------------------- |
diff --git a/docs/accessanalyzer/12.0/requirements/databases/db2.md b/docs/accessanalyzer/12.0/requirements/databases/db2.md
index f0fdafeee4..5eefb1904c 100644
--- a/docs/accessanalyzer/12.0/requirements/databases/db2.md
+++ b/docs/accessanalyzer/12.0/requirements/databases/db2.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Target Db2 Requirements, Permissions, and Ports
-The Access Analyzer for Databases Solution provides the ability to audit and monitor Db2 database
+The Access Analyzer for Databases Solution lets you audit and monitor Db2 database
environments to collect permissions and sensitive data. It scans:
- DB2LUW 11+
@@ -25,7 +25,7 @@ addition, the following clients and drivers must be installed:
- IBM .NET Driver NuGet
:::note
-All necessary clients and drivers can be found on IBM Support's
+IBM Support provides all necessary clients and drivers on its
[Download initial version 11.5 clients and drivers](https://www.ibm.com/support/pages/download-initial-version-115-clients-and-drivers)
page. From the list of available packages, select the IBM Data Server Client, which is the
all-in-one client package. This package includes all of the client tools and available libraries, as
diff --git a/docs/accessanalyzer/12.0/requirements/databases/mongodb.md b/docs/accessanalyzer/12.0/requirements/databases/mongodb.md
index b17ec05975..70e5ab1f2a 100644
--- a/docs/accessanalyzer/12.0/requirements/databases/mongodb.md
+++ b/docs/accessanalyzer/12.0/requirements/databases/mongodb.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Target MongoDB Requirements, Permissions, and Ports
-The Access Analyzer for Databases Solution provides the ability to audit and monitor MongoDB
+The Access Analyzer for Databases Solution lets you audit and monitor MongoDB
database environments to collect permissions and sensitive data. It scans:
- MongoDB 5.0
diff --git a/docs/accessanalyzer/12.0/requirements/databases/mysql.md b/docs/accessanalyzer/12.0/requirements/databases/mysql.md
index dead4951f6..547b6cf0fa 100644
--- a/docs/accessanalyzer/12.0/requirements/databases/mysql.md
+++ b/docs/accessanalyzer/12.0/requirements/databases/mysql.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Target MySQL Requirements, Permissions, and Ports
-The Access Analyzer for Databases Solution provides the ability to audit and monitor MySQL database
+The Access Analyzer for Databases Solution lets you audit and monitor MySQL database
environments to collect permissions and sensitive data. It scans:
- MySQL 5.x
diff --git a/docs/accessanalyzer/12.0/requirements/databases/oracle/leastprivilege.md b/docs/accessanalyzer/12.0/requirements/databases/oracle/leastprivilege.md
index b93a6f09c6..a70a563017 100644
--- a/docs/accessanalyzer/12.0/requirements/databases/oracle/leastprivilege.md
+++ b/docs/accessanalyzer/12.0/requirements/databases/oracle/leastprivilege.md
@@ -6,9 +6,9 @@ sidebar_position: 10
# Oracle Target Least Privilege Model
-We recommend using an account DBA privilege to run Access Analyzer against an Oracle database.
-However, if that is not acceptable all the privileges that are required to configure and run the
-solution are below and can be used to implement the least privileges necessary.
+Netwrix recommends using an account with DBA privilege to run Access Analyzer against an Oracle
+database. If that isn't acceptable, this topic lists all the privileges required to configure and
+run the solution. Use them to implement the least privileges necessary.
## Create Session Privilege
@@ -21,7 +21,7 @@ GRANT CREATE SESSION TO %USERNAME%;
```
:::note
-The above command will grant the privilege only in the current container. To follow the
+This command grants the privilege only in the current container. To follow the
least privilege model, only grant the privilege on the containers (or pluggable databases) that you
will be scanning with Access Analyzer.
:::
@@ -36,7 +36,7 @@ GRANT CREATE SESSION TO %USERNAME% CONTAINER=ALL;
## User Credentials Role
-When using a least privileged model for Oracle, **SYSDBA** must be selected for the Role in the User
+When using a least privileged model for Oracle, select **SYSDBA** for the Role in the User
Credentials window for the Oracle Connection Profile. See the
[Oracle for User Credentials](/docs/accessanalyzer/12.0/admin/settings/connection/create/oracle.md) topic for
additional information.
@@ -45,22 +45,22 @@ additional information.
This Job uses Nmap to locate listening Oracle ports on servers by scanning for ports using the
service Oracle TNS Listener or optionally using specified ports, such as 1521. The Nmap utility can
-be downloaded from [nmap.org](http://www.nmap.org/). To run this job, the user needs to have a
-permission to execute any PowerShell script on the local host if the host is running the Microsoft
-Windows operating system. In addition, on the Windows host, PowerShell execution policy needs to be
-sent as well. For example, to set the execution policy to `Unrestricted`, run the following command
-on the PowerShell command line:
+be downloaded from [nmap.org](http://www.nmap.org/). To run this job, the user needs permission to
+execute any PowerShell script on the local host if the host runs the Microsoft Windows operating
+system. In addition, you need to set the PowerShell execution policy on the Windows host. For
+example, to set the execution policy to `Unrestricted`, run the following command on the PowerShell
+command line:
```
Set-ExecutionPolicy -ExecutionPolicy Unrestricted
```
-In case of Linux and UNIX hosts, the `plink` command needs to be executed on the Access Analyzer
+For Linux and UNIX hosts, run the `plink` command on the Access Analyzer
Console server to update the local file with the SSH keys.
:::note
-The plink utility in the Access Analyzer installation directory has to be used. A version
-of plink gets installed with the Nmap utility.
+Use the plink utility in the Access Analyzer installation directory. The Nmap utility
+installs a version of plink.
:::
@@ -77,11 +77,11 @@ C:\Program Files (x86)\Stealthbits\StealthAUDIT\plink -store_new_k
## Oracle SID Discovery
This Job collects the Oracle SID from discovered Oracle servers and uses WMI or SSH to collect
-running Oracle processes from the Oracle servers. The process is used to determine the name of the
+running Oracle processes from the Oracle servers. This process determines the name of the
Oracle SID. When multiple Oracle instances are running on a server, each SID will have its own entry
in this table.
-This Job requires local administrator rights on the target hosts in order to read the running
+This Job requires local administrator rights on the target hosts to read the running
processes using either WMI or SSH.
## Oracle Instance Discovery
@@ -117,12 +117,12 @@ ALTER USER %USERNAME% SET CONTAINER_DATA=ALL CONTAINER = CURRENT;
## Oracle Permission Auditing
-The Oracle Permissions Scan job is responsible for collecting all permissions from all licensed
+The Oracle Permissions Scan job collects all permissions from all licensed
database types for all target instances.
### Oracle Database 19c Series Permissions
-In order to collect permissions from Oracle Database 19c series, the user credential requires at
+to collect permissions from Oracle Database 19c series, the user credential requires at
least the following `SELECT` privilege on the targeted database for the following views and tables:
- CDB_COL_PRIVS view
@@ -152,7 +152,7 @@ least the following `SELECT` privilege on the targeted database for the followin
- DBA_SYS_PRIVS view
- DBA_TAB_PRIVS view
-For example, to grant all of the above privileges, run the following set of commands in SQL
+For example, to grant all of the preceding privileges, run the following set of commands in SQL
Developer or SQL\*Plus:
```
@@ -189,7 +189,7 @@ GRANT SELECT ON DBA_TAB_PRIVS TO %USERNAME%;
### Oracle Database 12c Series Permissions
-In order to collect permissions from Oracle Database 12c series, the user credential requires at
+to collect permissions from Oracle Database 12c series, the user credential requires at
least the following `SELECT` privilege on the targeted database for the following views and tables:
- CDB_COL_PRIVS view
@@ -209,7 +209,7 @@ least the following `SELECT` privilege on the targeted database for the followin
- V\_$CONTAINERS view.
- SYS.USER$ table.
-For example, to grant all of the above privileges, run the following set of commands in SQL
+For example, to grant all of the preceding privileges, run the following set of commands in SQL
Developer or SQL\*Plus:
```
@@ -233,7 +233,7 @@ GRANT SELECT ON SYS.USER$ TO %USERNAME%;
### Oracle Database 11g Series Permissions
-In order to collect permissions from Oracle Database 11g series, the user credential requires at
+to collect permissions from Oracle Database 11g series, the user credential requires at
least the following `SELECT` privileges on the targeted database for the following views and tables:
- DBA_COL_PRIVS view
@@ -251,7 +251,7 @@ least the following `SELECT` privileges on the targeted database for the followi
- V\_$PARAMETER view
- SYS.USER$ table
-For example, to grant all of the above privileges, run the following set of commands in Oracle SQL
+For example, to grant all of the preceding privileges, run the following set of commands in Oracle SQL
Developer or SQL\*Plus:
```
@@ -273,8 +273,7 @@ GRANT SELECT ON SYS.USER$ TO %USERNAME%;
## Oracle Sensitive Data Auditing
-This job is responsible for identifying sensitive data that has been stored within target database
-instances.
+This job identifies sensitive data stored within target database instances.
Before running this scan, ensure that Oracle database statistics are up to date at least for the
targeted schema or tables. Use one of the following commands:
@@ -286,7 +285,7 @@ EXEC DBMS_STATS.GATHER_TABLE_STATS('%SCHEMA_NAME%', ‘%TABLE_NAME%’);
### Oracle Database 12c Series Sensitive Data
-In order to perform a sensitive data scan on Oracle database 12c series, the user credential
+to perform a sensitive data scan on Oracle database 12c series, the user credential
requires at least the following `SELECT` privileges on the targeted database for the following
views:
@@ -295,7 +294,7 @@ views:
- CDB_TAB_COLS view
- CDB_OBJECTS view
-For example, to grant the above privileges, run the following set of commands in SQL Developer or
+For example, to grant the preceding privileges, run the following set of commands in SQL Developer or
SQL\*Plus:
```
@@ -307,7 +306,7 @@ GRANT SELECT ON CDB_OBJECTS TO %USERNAME%;
### Oracle Database 11g Series Sensitive Data
-In order to perform a sensitive data scan on Oracle database 11g series, the user credential
+to perform a sensitive data scan on Oracle database 11g series, the user credential
requires at least the following `SELECT` privileges on the targeted database for the following
views:
@@ -315,7 +314,7 @@ views:
- DBA_TAB_COLS view
- DBA_OBJECTS view
-For example, to grant the above privileges, run the following set of commands in SQL Developer or
+For example, to grant the preceding privileges, run the following set of commands in SQL Developer or
SQL\*Plus:
```
@@ -324,9 +323,12 @@ GRANT SELECT ON DBA_TAB_COLS TO %USERNAME%;
GRANT SELECT ON DBA_OBJECTS TO %USERNAME%;
```
-Please note that the `SELECT` privilege needs to be granted individually on all sensitive data
-tables to be targeted (more secure). To accomplish it, run the following command for each targeted
-sensitive data table:
+:::note
+Grant the `SELECT` privilege individually on all sensitive data tables you want to target
+(more secure).
+:::
+
+To accomplish it, run the following command for each targeted sensitive data table:
```
GRANT SELECT ON %YOUR_SENSITIVE_DATA_TABLE% TO %USERNAME%;
@@ -341,12 +343,11 @@ GRANT SELECT ANY TABLE TO %USERNAME%;
## Oracle Activity Auditing
-This job is responsible for collecting audit data from configured database server audits on target
-endpoints.
+This job collects audit data from configured database server audits on target endpoints.
### Oracle Database 12c Series Activity Data
-In order to perform an activity data scan on Oracle database 12c series, the user credential
+to perform an activity data scan on Oracle database 12c series, the user credential
requires at least the following `SELECT` privileges on the targeted database for the following
views:
@@ -354,7 +355,7 @@ views:
- CDB_COMMON_AUDIT_TRAIL view
- UNIFIED_AUDIT_TRAIL view
-For example, to grant the above privileges, run the following set of commands in SQL Developer or
+For example, to grant the preceding privileges, run the following set of commands in SQL Developer or
SQL\*Plus:
```
@@ -363,8 +364,8 @@ GRANT SELECT ON CDB_COMMON_AUDIT_TRAIL TO %USERNAME%;
GRANT SELECT ON UNIFIED_AUDIT_TRAIL TO %USERNAME%;
```
-If the audit trail mode is `QUEUED`, then audit records are not written to disk until the in-memory
-queues are full. The following procedure explicitly flushes the queues to disk, so that the audit
+If the audit trail mode is `QUEUED`, then Oracle doesn't write audit records to disk until the
+in-memory queues are full. The following procedure explicitly flushes the queues to disk, so that the audit
trail records are viewable in the `UNIFIED_AUDIT_TRAIL` view:
```
@@ -373,14 +374,14 @@ EXEC SYS.DBMS_AUDIT_MGMT.FLUSH_UNIFIED_AUDIT_TRAIL;
### Oracle Database 11g Series Activity Data
-In order to perform an activity data scan on Oracle database 11g series, the user credential
+to perform an activity data scan on Oracle database 11g series, the user credential
required at least the following `SELECT` privileges on the targeted database for the following
views:
- V\_$DATABASE view
- DBA_COMMON_AUDIT_TRAIL view
-For example, to grant the above privileges, run the following set of commands in SQL Developer or
+For example, to grant the preceding privileges, run the following set of commands in SQL Developer or
SQL\*Plus:
```
@@ -390,10 +391,10 @@ GRANT SELECT ON DBA_COMMON_AUDIT_TRAIL TO %USERNAME%;
## Oracle Users with Default Passwords Job
-The 4-Oracle_DefaultPasswordUsers job is responsible for collecting usernames of users whose
-passwords have not been updated since the database creation.
+The 4-Oracle_DefaultPasswordUsers job collects usernames of users who haven't updated their
+passwords since the database was created.
-The user needs to have a `SELECT` privilege on `CDB_USERS_WITH_DEFPWD` table for Oracle container
+The user needs `SELECT` privilege on `CDB_USERS_WITH_DEFPWD` table for Oracle container
databases (version 12c and higher) or `DBA_USERS_WITH_DEFPWD` for the non-container database (any
version below 12c).
diff --git a/docs/accessanalyzer/12.0/requirements/databases/oracle/oracle.md b/docs/accessanalyzer/12.0/requirements/databases/oracle/oracle.md
index 075ed31f9b..f25dc75429 100644
--- a/docs/accessanalyzer/12.0/requirements/databases/oracle/oracle.md
+++ b/docs/accessanalyzer/12.0/requirements/databases/oracle/oracle.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Target Oracle Requirements, Permissions, and Ports
-The Access Analyzer for Databases Solution provides the ability to audit and monitor Oracle database
+The Access Analyzer for Databases Solution lets you audit and monitor Oracle database
environments to collect permissions, sensitive data, and activity events. It scans:
- Oracle Database 12c
diff --git a/docs/accessanalyzer/12.0/requirements/databases/postgresql.md b/docs/accessanalyzer/12.0/requirements/databases/postgresql.md
index c57771625a..658ff9d630 100644
--- a/docs/accessanalyzer/12.0/requirements/databases/postgresql.md
+++ b/docs/accessanalyzer/12.0/requirements/databases/postgresql.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Target PostgreSQL Requirements, Permissions, and Ports
-The Access Analyzer for Databases Solution provides the ability to audit and monitor PostgreSQL
+The Access Analyzer for Databases Solution lets you audit and monitor PostgreSQL
database environments to collect permissions and sensitive data. It scans:
- Open Source PostgreSQL 9x through 12x
diff --git a/docs/accessanalyzer/12.0/requirements/databases/redshift.md b/docs/accessanalyzer/12.0/requirements/databases/redshift.md
index ec3a445d05..5bf5e07714 100644
--- a/docs/accessanalyzer/12.0/requirements/databases/redshift.md
+++ b/docs/accessanalyzer/12.0/requirements/databases/redshift.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# Target Redshift Requirements, Permissions, and Ports
-The Access Analyzer for Databases Solution provides the ability to audit and monitor Redshift
+The Access Analyzer for Databases Solution lets you audit and monitor Redshift
database environments to collect permissions and sensitive data. It scans:
- Amazon AWS Redshift
diff --git a/docs/accessanalyzer/12.0/requirements/dropbox/dropbox.md b/docs/accessanalyzer/12.0/requirements/dropbox/dropbox.md
index 5f528fb984..077efd3c5b 100644
--- a/docs/accessanalyzer/12.0/requirements/dropbox/dropbox.md
+++ b/docs/accessanalyzer/12.0/requirements/dropbox/dropbox.md
@@ -10,8 +10,8 @@ The core components for Netwrix Access Analyzer (formerly Enterprise Auditor) ar
Analyzer Console server, SQL Server, and Access Information Center. See the
[Requirements](/docs/accessanalyzer/12.0/requirements/overview.md) topic for the core requirements.
-In addition to these, integration with either the Netwrix Activity Monitor or the Netwrix Threat
-Prevention is required for event activity data to be scanned. See the
+In addition to these, you need to integrate either the Netwrix Activity Monitor or the Netwrix
+Threat Prevention to scan event activity data. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor) or
the
[Netwrix Threat Prevention Documentation](https://helpcenter.netwrix.com/category/threatprevention)
@@ -24,7 +24,7 @@ environment requirements.
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment:
+These depend on the size of the target environment:
| Environment | Large | Medium – Small |
| ----------- | ----------------------- | ---------------------- |
@@ -34,20 +34,19 @@ These are dependent upon the size of the target environment:
| Disk Space | 30 GB | 30 GB |
:::note
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
-minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host.For
-example, if the job is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are
-required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each
+thread requires a minimum of 2 additional GB of RAM per host. For example, if you configure the
+job to scan 8 hosts at a time, you need an extra 16 GB of RAM (8x2=16).
:::
**Sensitive Data Discovery Auditing Requirement**
:::note
-The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
-conflict with other JDKs or Java Runtimes in the same environment.
+Access Analyzer installs the appropriate JDK (Java) version for Sensitive Data Discovery on
+the server. This JDK comes prepackaged and preconfigured to work with Access Analyzer, requires no
+additional configuration, and you should never customize it through Java. It doesn't conflict with
+other JDKs or Java Runtimes in the same environment.
:::
@@ -55,7 +54,7 @@ conflict with other JDKs or Java Runtimes in the same environment.
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment.
+These depend on the size of the target environment.
| Environment | Large | Medium – Small |
| ------------------------ | ----------------------- | ---------------------- |
diff --git a/docs/accessanalyzer/12.0/requirements/dropbox/target.md b/docs/accessanalyzer/12.0/requirements/dropbox/target.md
index c1a3bc8f66..a5ed13345d 100644
--- a/docs/accessanalyzer/12.0/requirements/dropbox/target.md
+++ b/docs/accessanalyzer/12.0/requirements/dropbox/target.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Target Dropbox Requirements, Permissions, and Ports
-The Access Analyzer for AWS Solution provides the ability to audit Dropbox. It scans:
+The Access Analyzer for AWS Solution lets you audit Dropbox. It scans:
- Dropbox
@@ -20,10 +20,10 @@ This solution employs the following data collector to scan the target environmen
- Dropbox Team Administrator
-The DropboxAccess Data Collector requires the generation of an access token that is used to
-configure the Connection Profile for Dropbox. The access token is generated from within the Dropbox
-Access Auditor Data Collector Wizard on the Scan Options page. Once the access token is copied into
-a Connection Profile for Dropbox, it will be saved and does not need to be generated again. See the
+The DropboxAccess Data Collector requires generating an access token to configure the Connection
+Profile for Dropbox. You generate the access token from within the Dropbox Access Auditor Data
+Collector Wizard on the Scan Options page. After you copy the access token into a Connection
+Profile for Dropbox, Access Analyzer saves it and you don't need to generate it again. See the
[DropboxAccess: Scan Options](/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/scanoptions.md) topic for
additional information.
diff --git a/docs/accessanalyzer/12.0/requirements/entraid/entraid.md b/docs/accessanalyzer/12.0/requirements/entraid/entraid.md
index a921d8a2cf..2ff3de58b0 100644
--- a/docs/accessanalyzer/12.0/requirements/entraid/entraid.md
+++ b/docs/accessanalyzer/12.0/requirements/entraid/entraid.md
@@ -22,7 +22,7 @@ for target environment requirements.
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment:
+These depend on the size of the target environment:
| Environment | Large | Medium – Small |
| ----------- | ----------------------- | ---------------------- |
@@ -35,7 +35,7 @@ These are dependent upon the size of the target environment:
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment.
+These depend on the size of the target environment.
| Environment | Large | Medium – Small |
| ------------------------ | ----------------------- | ---------------------- |
diff --git a/docs/accessanalyzer/12.0/requirements/entraid/entraid/access.md b/docs/accessanalyzer/12.0/requirements/entraid/entraid/access.md
index 1d06b6dcf1..3bc34aa749 100644
--- a/docs/accessanalyzer/12.0/requirements/entraid/entraid/access.md
+++ b/docs/accessanalyzer/12.0/requirements/entraid/entraid/access.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Microsoft Entra ID Auditing Configuration
-The Access Analyzer for Entra ID Solution provides the ability to audit Microsoft Entra ID, formerly
+The Access Analyzer for Entra ID Solution lets you audit Microsoft Entra ID, formerly
Azure Active Directory. It scans:
- Microsoft Entra ID (formerly Azure AD)
@@ -23,19 +23,19 @@ Microsoft Entra ID.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you register the application:
- Client ID – This is the Application (client) ID for the registered application
- Key – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
- copied first.
+ You can't retrieve the value after saving the new key, so copy it
+ first.
:::
:::note
-In order to add custom attributes, you will also need to know the Tenant name of the Entra
+to add custom attributes, you will also need to know the Tenant name of the Entra
ID environment.
:::
@@ -67,10 +67,10 @@ The following permissions are required:
## Register a Microsoft Entra ID Application
-Follow the steps to register Access Analyzer with Microsoft Entra ID.
+Register Access Analyzer with Microsoft Entra ID.
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+The following steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -92,14 +92,14 @@ registrations.
**Step 5 –** Click **Register**.
The Overview page for the newly registered app opens. Review the newly created registered
-application. Now that the application has been registered, permissions need to be granted to it.
+application. Now that you've registered the application, grant it permissions.
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
+Grant permissions to the registered application.
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+The following steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -131,11 +131,11 @@ tab. Select the following permissions:
**Step 6 –** Click **Grant Admin Consent for [tenant]**. Then click **Yes** in the confirmation
window.
-Now that the permissions have been granted to it, the Connection Profile and host settings for
-Access Analyzer need to be collected.
+Now that you've granted the permissions, collect the Connection Profile and host settings for
+Access Analyzer.
:::note
-Additional permissions need to be configured to collect Microsoft Entra roles information.
+Configure additional permissions to collect Microsoft Entra roles information.
See the
[Microsoft Entra Roles Auditing Configuration](/docs/accessanalyzer/12.0/requirements/entraid/entraid/entraroles.md)
topic for additional information.
@@ -144,10 +144,10 @@ topic for additional information.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
+Find the registered application's Client ID.
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+The following steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -161,7 +161,7 @@ list.
**Step 3 –** Save this value in a text file.
-This Application (client) ID value is needed for the Access Analyzer Connection Profile and the
+You need this Application (client) ID value for the Access Analyzer Connection Profile and the
Custom Attributes page of the AzureADInventory Data Collector. See the
[Azure Active Directory for User Credentials](/docs/accessanalyzer/12.0/admin/settings/connection/create/entraid.md)
topic and the
@@ -170,18 +170,18 @@ topic for additional information. Next generate the application’s Client Secre
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
+Find the registered application's Client Secret, create a new key, and save its
value when saving the new key.
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+The following steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
+You can't retrieve the value after saving the new key, so copy it
first.
:::
@@ -208,17 +208,17 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
-this process will have to be repeated.
+If you leave this page before copying the key, the key becomes unretrievable, and
+you'll have to repeat this process.
:::
-**Step 6 –** The Client Secret will be displayed in the Value column of the table. You can use the
+**Step 6 –** The Value column of the table shows the Client Secret. You can use the
Copy to clipboard button to copy the Client Secret.
**Step 7 –** Save this value in a text file.
-This Client Secret value is needed for the Access Analyzer Connection Profile and the Custom
+You need this Client Secret value for the Access Analyzer Connection Profile and the Custom
Attributes page of the AzureADInventory Data Collector. See the
[Azure Active Directory for User Credentials](/docs/accessanalyzer/12.0/admin/settings/connection/create/entraid.md)
topic and the
@@ -227,10 +227,10 @@ topic for additional information.
## Identify the Tenant Name
-Follow the steps to find the Tenant Name where the registered application resides.
+Find the Tenant Name where the registered application resides.
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+The following steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -245,7 +245,7 @@ names** to open the Custom domain names list.
**Step 4 –** Save this value in a text file.
-This is needed for the Host List and the Custom Attributes page of the AzureADInventory Data
+You need this for the Host List and the Custom Attributes page of the AzureADInventory Data
Collector. See the
[Microsoft Entra ID Connection Profile & Host List](/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/configurejob.md)
and [AzureADInventory: Custom Attributes](/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/customattributes.md)
diff --git a/docs/accessanalyzer/12.0/requirements/entraid/entraid/entraroles.md b/docs/accessanalyzer/12.0/requirements/entraid/entraid/entraroles.md
index 21766ce6df..ff54316ada 100644
--- a/docs/accessanalyzer/12.0/requirements/entraid/entraid/entraroles.md
+++ b/docs/accessanalyzer/12.0/requirements/entraid/entraid/entraroles.md
@@ -22,20 +22,20 @@ Microsoft Entra ID.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you register the application:
- Client ID – This is the Application (client) ID for the registered application
- Key – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
- copied first.
+ You can't retrieve the value after saving the new key, so copy it
+ first.
:::
:::note
-It is recommended to use the same registered application for the Access and Entra roles
-auditing configurations. In this case, these values are only needed once for the tenant. See the
+Netwrix recommends using the same registered application for the Access and Entra roles
+auditing configurations. In this case, you only need these values once for the tenant. See the
[Microsoft Entra ID Registered Application](#microsoft-entra-id-registered-application) topic for
additional information.
:::
@@ -62,26 +62,26 @@ The following permissions are required for Microsoft Entra Roles auditing:
## Microsoft Entra ID Registered Application
-You must have a registered application to assign the required permissions to. It is recommended to
-use the same registered application that is used for access auditing using the AzureADInventory data
+You must have a registered application to assign the required permissions to. Netwrix recommends
+using the same registered application you use for access auditing with the AzureADInventory data
collector. See the
[Register a Microsoft Entra ID Application](/docs/accessanalyzer/12.0/requirements/entraid/entraid/access.md#register-a-microsoft-entra-id-application)
topic for additional information on registering an application.
-The Client ID and Key for the registered application are required for the Access Analyzer connection
+You need the Client ID and Key for the registered application for the Access Analyzer connection
profile. If, as recommended, you are using a single registered application for the tenant, then you
-do not need to add an additional user credential in the connection profile. If you create a separate
-registered application for Entra roles auditing, then the Client ID and Key for this must be added
+don't need to add an additional user credential in the connection profile. If you create a separate
+registered application for Entra roles auditing, add the Client ID and Key for this
to the connection profile as an additional Azure Active Directory user credential. See the
[Microsoft Entra ID Connection Profile & Host List](/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/configurejob.md)
topic for additional information.
-Once you have the registered application, the next step is to grant it the required permissions for
+After you have the registered application, the next step is to grant it the required permissions for
the Entra data collector.
## Grant Permissions to the Registered Application
-Follow the steps to grant the required permissions to the registered application.
+Grant the required permissions to the registered application.
**Step 1 –** Log in to [Azure Portal](https://portal.azure.com/).
@@ -104,12 +104,12 @@ tab. Select the following permissions:
**Step 7 –** Click **Grant Admin Consent for [tenant]**. Then click **Yes** in the confirmation
window.
-The permissions have been granted to the registered application. Next, you need to create a custom
+You've granted the permissions to the registered application. Next, create a custom
role and assign the necessary resource manager permissions.
## Create Custom Role with Resource Manager Permissions
-Follow the steps to create the required custom role and assign the necessary permissions.
+Create the required custom role and assign the necessary permissions.
**Step 1 –** In Azure portal, navigate to **Management groups** within the Microsoft Entra tenant.
@@ -120,9 +120,9 @@ Follow the steps to create the required custom role and assign the necessary per
group.
:::info
-It is recommended to create this custom role at the root management group level.
-This ensures that all of necessary information on the Microsoft Entra environment is collected.
-Creating the custom role on a lower level management group can result in missing data.
+Netwrix recommends creating this custom role at the root management group level.
+This ensures Access Analyzer collects all the necessary information on the Microsoft Entra
+environment. Creating the custom role on a lower level management group can result in missing data.
:::
@@ -173,7 +173,7 @@ permissions.
:::
-**Step 7 –** Once the permissions are configured, click **Create** on the Review + create tab to
+**Step 7 –** After you configure the permissions, click **Create** on the Review + create tab to
finish creating the custom role.
Now that you have created the custom role with the necessary permissions, you must assign this
@@ -181,7 +181,7 @@ custom role to the registered application.
## Assign the Custom Role to the App Registration
-Follow the steps to assign the custom role to your registered application.
+Assign the custom role to your registered application.
**Step 1 –** Navigate back to Access Control (IAM) in the Tenant Root Group.
@@ -189,7 +189,7 @@ Follow the steps to assign the custom role to your registered application.
**Step 3 –** On the Add role assignment page, select the newly created role and click **Next**.
-- You can use the search bar to easily find the custom role.
+- You can use the search bar to find the custom role.
**Step 4 –** On the Members tab, select the Assign access to option as **User, group, or service
principal**. Then, click **Select members** and search for your registered application. Select the
@@ -197,5 +197,5 @@ application from the list and click **Select**.
**Step 5 –** On the Review + assign tab, click **Review + assign** to complete the role assignment.
-The registered application has now been configured with all the necessary permissions for Entra
+You've now configured the registered application with all the necessary permissions for Entra
roles scans.
diff --git a/docs/accessanalyzer/12.0/requirements/entraid/entraid/overview.md b/docs/accessanalyzer/12.0/requirements/entraid/entraid/overview.md
index 186f93242a..6e3849ba23 100644
--- a/docs/accessanalyzer/12.0/requirements/entraid/entraid/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/entraid/entraid/overview.md
@@ -11,8 +11,8 @@ formerly Azure Active Directory.
## Auditing Permissions
-It is necessary to register Access Analyzer as a web application to the targeted Microsoft Entra ID
-in order for Access Analyzer to scan the environment. This generates the Client ID (App ID) and Key
+Register Access Analyzer as a web application in the targeted Microsoft Entra ID so it can scan the
+environment. This generates the Client ID (App ID) and Key
(App Key) needed for the Connection Profile credentials and the Custom Attributes Import Wizard
page.
@@ -20,9 +20,9 @@ See the [Microsoft Entra ID Auditing Configuration](/docs/accessanalyzer/12.0/re
## Entra Roles Permissions
-To collect Microsoft Entra roles information from the Microsoft Entra tenant additional permissions
-are required to be assigned to the registered application. This includes creating a custom role with
-the required resource manager permissions.
+To collect Microsoft Entra roles information from the Microsoft Entra tenant, you must assign
+additional permissions to the registered application. This includes creating a custom role with the
+required resource manager permissions.
See the
[Microsoft Entra Roles Auditing Configuration](/docs/accessanalyzer/12.0/requirements/entraid/entraid/entraroles.md)
diff --git a/docs/accessanalyzer/12.0/requirements/exchange/exchange.md b/docs/accessanalyzer/12.0/requirements/exchange/exchange.md
index 6eb9b84750..a58b03ab65 100644
--- a/docs/accessanalyzer/12.0/requirements/exchange/exchange.md
+++ b/docs/accessanalyzer/12.0/requirements/exchange/exchange.md
@@ -10,8 +10,8 @@ The core components for Netwrix Access Analyzer (formerly Enterprise Auditor) ar
Analyzer Console server, SQL Server, and Access Information Center. See the
[Requirements](/docs/accessanalyzer/12.0/requirements/overview.md) topic for the core requirements.
-In addition to these, integration with either the Netwrix Activity Monitor or the Netwrix Threat
-Prevention is required for event activity data to be scanned. See the
+In addition to these, you need to integrate either the Netwrix Activity Monitor or the Netwrix
+Threat Prevention to scan event activity data. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor) or
the
[Netwrix Threat Prevention Documentation](https://helpcenter.netwrix.com/category/threatprevention)
@@ -26,7 +26,7 @@ See the following topics for target environment requirements:
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment:
+These depend on the size of the target environment:
| Environment | Extra Large – Large | Medium – Small |
| ----------- | ------------------------- | ----------------------- |
@@ -36,20 +36,19 @@ These are dependent upon the size of the target environment:
| Disk Space | 120 GB | 120 GB |
:::note
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
-minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host.For
-example, if the job is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are
-required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each
+thread requires a minimum of 2 additional GB of RAM per host. For example, if you configure the
+job to scan 8 hosts at a time, you need an extra 16 GB of RAM (8x2=16).
:::
**Sensitive Data Discovery Auditing Requirement**
:::note
-The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
-conflict with other JDKs or Java Runtimes in the same environment.
+Access Analyzer installs the appropriate JDK (Java) version for Sensitive Data Discovery on
+the server. This JDK comes prepackaged and preconfigured to work with Access Analyzer, requires no
+additional configuration, and you should never customize it through Java. It doesn't conflict with
+other JDKs or Java Runtimes in the same environment.
:::
@@ -58,7 +57,7 @@ conflict with other JDKs or Java Runtimes in the same environment.
The following are additional requirements for the Access Analyzer Console server specific to running
the Exchange Solution:
-- Outlook should not be installed
+- Outlook shouldn't be installed
- StealthAUDIT MAPI CDO installed (for MAPI- based data collectors). See the
[StealthAUDIT MAPI CDO Installation](/docs/accessanalyzer/12.0/install/mapicdo/installation.md)
topic for additional information.
@@ -87,7 +86,7 @@ Analyzer.
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment.
+These depend on the size of the target environment.
| Environment | Extra-Large | Large | Medium | Small |
| ------------------------ | ------------------ | ----------------- | ----------------- | ---------------- |
diff --git a/docs/accessanalyzer/12.0/requirements/exchange/exchangeonline/access.md b/docs/accessanalyzer/12.0/requirements/exchange/exchangeonline/access.md
index 01fedd1e17..22ffcf91d8 100644
--- a/docs/accessanalyzer/12.0/requirements/exchange/exchangeonline/access.md
+++ b/docs/accessanalyzer/12.0/requirements/exchange/exchangeonline/access.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# Exchange Online Auditing Configuration
-It is necessary to register Access Analyzer as a web application to the targeted Microsoft Entra ID,
-formerly Azure Active Directory, in order for Access Analyzer to scan the environment. This
+Register Access Analyzer as a web application in the targeted Microsoft Entra ID, formerly Azure
+Active Directory, so it can scan the environment. This
generates the Client ID (App ID) and self-signed certificate (Certificate Thumbprint) needed for the
Connection Profile credentials and/or the Custom Attributes Import Wizard page. See
[Microsoft Support](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-reporting-api-prerequisites-azure-portal)
@@ -21,7 +21,7 @@ Microsoft Entra ID.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you register the application:
- Client ID – This is the Application (client) ID for the registered application
- Tenant name – This is the primary domain name of the Microsoft Entra tenant
@@ -30,9 +30,9 @@ The following settings are needed from your tenant once you have registered the
Configure Modern Authentication for Exchange Online using EX_RegisterAzureAppAuth Instant Job
-Registering a Microsoft Entra ID application and provisioning it to grant permissions to Exchange
-Online can be automated using the EX_RegisterAzureAppAuth job from the Access Analyzer Instant Job
-Library. The EX_RegisterAzureAppAuth job uses the PowerShell Data Collector to automatically
+You can automate registering a Microsoft Entra ID application and provisioning it to grant
+permissions to Exchange Online using the EX_RegisterAzureAppAuth job from the Access Analyzer
+Instant Job Library. The EX_RegisterAzureAppAuth job uses the PowerShell Data Collector to automatically
configure modern authentication for Exchange Online. It requires:
- A Connection Profile containing a Microsoft Entra ID Global Admin credential with an Account Type
@@ -48,7 +48,7 @@ configure modern authentication for Exchange Online. It requires:
- Azure AD PowerShell module installed on targeted hosts
:::note
- If the module is not already installed, the job will attempt to install it.
+ If the module isn't already installed, the job will attempt to install it.
:::
@@ -58,7 +58,7 @@ configure modern authentication for Exchange Online. It requires:
Install-Module AzureAD
```
- - TLS 1.2 is required for the Azure AD PowerShell module. Run the following command to configure
+ - You need TLS 1.2 for the Azure AD PowerShell module. Run the following command to configure
it:
```
@@ -107,12 +107,12 @@ The following permissions are required:
## Create Self–Signed Certificate
-A self signed certificate needs to be created on the Access Analyzer console server. This is used by
-Access Analyzer to connect to the Microsoft Entra tenant.
+Create a self-signed certificate on the Access Analyzer console server. Access Analyzer uses this
+certificate to connect to the Microsoft Entra tenant.
Follow the steps create the self-signed certificate.
-**Step 1 –** To generate a certificate, use the sample PowerShell command below:
+**Step 1 –** To generate a certificate, use the following sample PowerShell command:
- Change the following parameters in the sample PowerShell command. See the Microsoft
[New-SelfSignedCertificate](https://docs.microsoft.com/en-us/powershell/module/pki/new-selfsignedcertificate)
@@ -122,9 +122,9 @@ Follow the steps create the self-signed certificate.
certificate
- Subject – A unique name for the new App (always starts with CN=, to denote a canonical name)
- FriendlyName – Same as Subject name minus the canonical name prefix
- - NotAfter – A datetime string denoting the certificate's expiration date - in the above sample,
- Get-Date.AddYears(11) specifies that the certificate will expire 11 years from the current
- datetime
+ - NotAfter – A datetime string denoting the certificate's expiration date - in the following
+ sample, Get-Date.AddYears(11) specifies that the certificate will expire 11 years from the
+ current datetime
Example PowerShell:
@@ -138,7 +138,7 @@ $certPath variable (see Step 1).
:::note
The environment variable `SAINSTALLDIR` always points to the base Access Analyzer install
-directory; simply append the PrivateAssemblies to point to that folder with the following cmdlet:
+directory; append the PrivateAssemblies to point to that folder with the following cmdlet:
:::
@@ -167,15 +167,15 @@ Export-PfxCertificate -Cert $cert -FilePath "$($env:SAINSTALLDIR)PrivateAssembli
[Export-PfxCertificate](https://docs.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate)
article for additional information.
-The self signed certificate has been created. The next steps are to create a Microsoft Entra ID
+You've created the self-signed certificate. The next steps are to create a Microsoft Entra ID
application and then upload this certificate to it.
## Register a Microsoft Entra ID Application
-Follow the steps to register Access Analyzer with Microsoft Entra ID.
+Register Access Analyzer with Microsoft Entra ID.
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+The following steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -197,14 +197,14 @@ registrations.
**Step 5 –** Click **Register**.
The Overview page for the newly registered app opens. Review the newly created registered
-application. Now that the application has been registered, permissions need to be granted to it.
+application. Now that you've registered the application, grant it permissions.
## Upload Self-Signed Certificate
Follow the steps upload your self-signed certificate.
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+The following steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -225,17 +225,17 @@ Optionally add a Description.
**Step 6 –** Click **Add**.
-The Certificate Thumbprint of this uploaded certificate is needed for the Access Analyzer Connection
+You need the Certificate Thumbprint of this uploaded certificate for the Access Analyzer Connection
Profile. See the
[Exchange Modern Authentication for User Credentials](/docs/accessanalyzer/12.0/admin/settings/connection/create/exchangemodernauth.md)
topic for additional information.
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
+Grant permissions to the registered application.
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+The following steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -264,15 +264,15 @@ uses tab to find and select Office 365 Exchange Online. Select the following per
**Step 6 –** Click **Grant Admin Consent for [tenant]**. Then click **Yes** in the confirmation
window.
-Now that the permissions have been granted to it, the Connection Profile and host settings for
-Access Analyzer need to be collected.
+Now that you've granted the permissions, collect the Connection Profile and host settings for
+Access Analyzer.
## Identify the Tenant's Name
-Follow the steps to find the Tenant Name where the registered application resides.
+Find the Tenant Name where the registered application resides.
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+The following steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -287,16 +287,16 @@ names** to open the Custom domain names list.
**Step 4 –** Save this value in a text file.
-This is needed for the Access Analyzer Connection Profile. See the
+You need this for the Access Analyzer Connection Profile. See the
[Exchange Modern Authentication for User Credentials](/docs/accessanalyzer/12.0/admin/settings/connection/create/exchangemodernauth.md)
topic for additional information. Next identify the application’s Client ID.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
+Find the registered application's Client ID.
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+The following steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -310,6 +310,6 @@ list.
**Step 3 –** Save this value in a text file.
-This is needed for the Access Analyzer Connection Profile. See the
+You need this for the Access Analyzer Connection Profile. See the
[Exchange Modern Authentication for User Credentials](/docs/accessanalyzer/12.0/admin/settings/connection/create/exchangemodernauth.md)
topic for additional information.
diff --git a/docs/accessanalyzer/12.0/requirements/exchange/exchangeonline/exchangeonline.md b/docs/accessanalyzer/12.0/requirements/exchange/exchangeonline/exchangeonline.md
index bb35b58f1e..91d4468f0a 100644
--- a/docs/accessanalyzer/12.0/requirements/exchange/exchangeonline/exchangeonline.md
+++ b/docs/accessanalyzer/12.0/requirements/exchange/exchangeonline/exchangeonline.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Target Exchange Online Requirements, Permissions, and Ports
-The Access Analyzer for Exchange Solution provides the ability to audit Exchange Online. It scans:
+The Access Analyzer for Exchange Solution lets you audit Exchange Online. It scans:
- Exchange Online (Limited)
diff --git a/docs/accessanalyzer/12.0/requirements/exchange/support/mailflow.md b/docs/accessanalyzer/12.0/requirements/exchange/support/mailflow.md
index a0a46ca194..a6be61cf11 100644
--- a/docs/accessanalyzer/12.0/requirements/exchange/support/mailflow.md
+++ b/docs/accessanalyzer/12.0/requirements/exchange/support/mailflow.md
@@ -8,7 +8,7 @@ sidebar_position: 10
The ExchangeMetrics Data Collector collects Mail-Flow metrics from the Exchange Message Tracking
Logs on the Exchange servers. Some examples of this include server volume and message size
-statistics. This data collector utilizes an applet to process and collect summarized metrics from
+statistics. This data collector uses an applet to process and collect summarized metrics from
the Message Tracking Log.
1. HUB Metrics Job Group Requirement
@@ -17,7 +17,7 @@ In addition to the permissions required by the ExchangeMetrics Data Collector, t
Profile assigned to the 1. HUB Metrics Job Group requires the following permission and User Rights
(based on default settings):
-- Member of the local Administrator group on the targeted Exchange server(s) where the Hub Transport
+- Member of the local Administrator group on the targeted Exchange servers where the Hub Transport
service is running
- Log on as a Service Group Policy:
@@ -30,7 +30,7 @@ Profile assigned to the 1. HUB Metrics Job Group requires the following permissi
This is required because the ExchangeMetrics Data Collector is an applet-based data collector. It
requires
-- Member of the local Administrator group on the targeted Exchange server(s)
+- Member of the local Administrator group on the targeted Exchange servers
This grants access to the Message Tracking Logs and the ability to create the
`SA_ExchangeMetricsData` folder, which will contain the applet files and the processed message
@@ -39,8 +39,8 @@ tracking log files stored inside a SQLite database for each day. For example:
\\ExchangeServerName\c$\Program Files\Microsoft\Exchange
Server\V14\TransportRoles\Logs\MessageTracking
-If there have been additional security or permission modifications on the server(s), the following
-rights and policies may need to be enabled on the targeted host:
+If there have been additional security or permission modifications on the servers, you may need to
+enable the following rights and policies on the targeted host:
- Ensure the Administrator group has been granted Full Control over Message Tracking Log Directories
- WMI Control (`wmimgmt.msc`) > Right Click Properties > Security
diff --git a/docs/accessanalyzer/12.0/requirements/exchange/support/mapi.md b/docs/accessanalyzer/12.0/requirements/exchange/support/mapi.md
index 2c0064aca9..ac4250d0fb 100644
--- a/docs/accessanalyzer/12.0/requirements/exchange/support/mapi.md
+++ b/docs/accessanalyzer/12.0/requirements/exchange/support/mapi.md
@@ -10,7 +10,7 @@ The Exchange2K, ExchangeMailbox, and ExchangePublicFolder data collectors have o
requirements.
These data collectors supports Exchange 2010 through Exchange 2013. Since this data collectors are
-MAPI-based, they do not support Exchange Online, Exchange 2019, nor Exchange 2016.
+MAPI-based, they don't support Exchange Online, Exchange 2019, nor Exchange 2016.
All MAPI-based data collectors have the following prerequisites:
diff --git a/docs/accessanalyzer/12.0/requirements/exchange/support/powershell.md b/docs/accessanalyzer/12.0/requirements/exchange/support/powershell.md
index 4deac51328..0ef9cfee03 100644
--- a/docs/accessanalyzer/12.0/requirements/exchange/support/powershell.md
+++ b/docs/accessanalyzer/12.0/requirements/exchange/support/powershell.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Exchange PowerShell Permissions
-The ExchangePS Data Collector utilizes PowerShell to collect various information from the Exchange
-environment. This data collector utilizes Remote PowerShell to collect information about Exchange
+The ExchangePS Data Collector uses PowerShell to collect various information from the Exchange
+environment. This data collector uses Remote PowerShell to collect information about Exchange
Users Configuration, Mailboxes, Public Folders, and Exchange Online Mail-Flow.
**Job Group Requirements in Addition to ExchangePS**
@@ -47,13 +47,12 @@ assigned to these job groups requires the following permissions:
**Remote PowerShell and Windows Authentication Enabled**
-The Remote PowerShell and Windows Authentication configurations for Exchanges servers are required
-to be enabled on at least one Exchange server running the Client Access Service so that the
-ExchangePS Data Collector can make a remote PowerShell connection and authenticate through Access
-Analyzer.
+You must enable the Remote PowerShell and Windows Authentication configurations for Exchange
+servers on at least one Exchange server running the Client Access Service so that the ExchangePS
+Data Collector can make a remote PowerShell connection and authenticate through Access Analyzer.
Access Analyzer passes credentials saved in the Connection Profile to the data collector so that it
-is able to connect to the targeted host. This requires the Exchange server to allow for Windows
+can connect to the targeted host. This requires the Exchange server to allow for Windows
Authentication. See the
[Enable Remote PowerShell for ExchangePS Data Collector](#enable-remote-powershell-for-exchangeps-data-collector)
topic and the
@@ -62,19 +61,19 @@ topic for additional information.
**View-Only Organization Management Role Group**
-This is required so the ExchangePS Data Collector is able to run the various Exchange PowerShell
+This is required so the ExchangePS Data Collector can run the various Exchange PowerShell
cmdlets.
**Public Folder Management**
-This permission is only required if utilizing the ExchangePublicFolder Data Collector or
+This permission is only required if using the ExchangePublicFolder Data Collector or
ExchangeMailbox Data Collector, as well as the PublicFolder or Mailbox Action Modules. This is
-required in order to make a connection through the MAPI protocol. The following job group requires
+required to make a connection through the MAPI protocol. The following job group requires
the Public Folder Management Role Group:
- **5. Public Folders** > **Ownership**
-If not running this collection, then this permission is not required.
+If not running this collection, then this permission isn't required.
**Mailbox Search Role**
@@ -93,14 +92,14 @@ topic for additional information.
There are five different scoping options within this data collector. Since not all query categories
support all scoping options, No Scoping is an option. If there are no scoping options available,
-then the data collector should be run against the host specified in the Summary page of the data
-collector wizard.
+run the data collector against the host specified in the Summary page of the data collector
+wizard.
**No Scoping**
This option will gather information about the entire Exchange Organization. When using the applet,
the data collector will gather information about the Exchange Forest in which the Access Analyzer
-Console currently resides. For Remote PowerShell, the data collector will gather information about
+Console resides. For Remote PowerShell, the data collector will gather information about
the Exchange Organization to which the Remote PowerShell connection was made. This refers to the
server entered in the Client Access Server (CAS) field of the global configuration from the
**Settings** > **Exchange** node or on the Scope Page of the data collector wizard. See the
@@ -111,7 +110,7 @@ information.
This option will gather information about any databases which are chosen. When using the applet, the
data collector will return databases in the Scope by DB page of the data collector wizard for the
-Exchange Organization in which the Access Analyzer Console currently resides, as well as, only
+Exchange Organization in which the Access Analyzer Console resides, as well as, only
return information about those databases. For Remote PowerShell, the data collector will return
databases in the Scope by DB page of the data collector wizard for the Exchange Forest, as well as,
only return information about those databases. See the
@@ -122,7 +121,7 @@ additional information.
This option will gather information about any mailboxes which are chosen. When using the applet, the
data collector will return mailboxes in the Scope by Mailboxes page of the data collector wizard for
-the Exchange Forest in which the Access Analyzer Console currently resides, as well as, only return
+the Exchange Forest in which the Access Analyzer Console resides, as well as, only return
information about those mailboxes. For Remote PowerShell, the data collector will return mailboxes
in the Scope by Mailboxes page of the data collector wizard for the Exchange Forest, as well as,
only return information about those mailboxes. See the
@@ -135,14 +134,14 @@ This option will gather information about objects which reside on the chosen ser
this option, the data collector will then use the Host List applied to the job’s **Configure** >
**Hosts** node as the servers scoping list. When using the applet, the data collector will deploy a
process to the targeted host to run the PowerShell on that server. For Remote PowerShell, the data
-collector will deploy no applet and utilize the WinRM protocol to gather information about the
+collector will deploy no applet and use the WinRM protocol to gather information about the
objects on that server.
**Scope by Public Folder**
This option will gather information about any public folders which are chosen. When using the
applet, the data collector will return public folders in the Scope by Public Folders page of the
-data collector wizard for the Exchange Forest in which the Access Analyzer Console currently
+data collector wizard for the Exchange Forest in which the Access Analyzer Console
resides, as well as, only return information about those public folders. For Remote PowerShell, the
data collector will return public folders in the Scope by Public Folders page of the data collector
wizard for the Exchange Forest, as well as, only return information about those public folders. See
@@ -152,7 +151,7 @@ topic for additional information.
## Enable Remote PowerShell for ExchangePS Data Collector
-Follow these steps to enable Remote PowerShell.
+Enable Remote PowerShell.
**Step 1 –** On the server that Access Analyzer will connect with Remote PowerShell, open
PowerShell.
@@ -165,7 +164,7 @@ Enable-PSRemoting
**Step 3 –** When prompted, type `A` and `A` again to enable the appropriate services and protocols.
-Remote PowerShell has been enabled. See the Microsoft
+You've enabled Remote PowerShell. See the Microsoft
[Tip: Enable and Use Remote Commands in Windows PowerShell](https://technet.microsoft.com/en-us/library/ff700227.aspx)
article for additional information.
@@ -173,9 +172,8 @@ Next, enable Windows Authentication for PowerShell Virtual Directory on the same
## Enable Windows Authentication for PowerShell Virtual Directory
-Once Remote PowerShell has been enabled on an Exchange Server in the environment, it is necessary to
-also enable Windows Authentication for the PowerShell Virtual Directory on the same Exchange server.
-Follow these steps to enable Windows Authentication.
+After you enable Remote PowerShell on an Exchange Server in the environment, enable Windows
+Authentication for the PowerShell Virtual Directory on the same Exchange server.
**Step 1 –** On the server where Remote PowerShell was enabled, open the Internet Information
Services (IIS) Manager.
@@ -187,13 +185,13 @@ Services (IIS) Manager.
-**Step 3 –** Right-click on **Windows Authentication** and select **Enable**.
+**Step 3 –** Right-click **Windows Authentication** and select **Enable**.
-Windows Authentication has been enabled for the PowerShell Virtual Directory.
+You've enabled Windows Authentication for the PowerShell Virtual Directory.
## Create Custom Application Impersonation Role in Exchange
-Follow the steps to create the custom Application Impersonation role. The process is the same for
+Create the custom Application Impersonation role. The process is the same for
Exchange 2010 Service Pack 1 through Exchange 2019 and Exchange Online.
**Step 1 –** Within the Exchange Admin Center, navigate to the permissions section and select admin
@@ -223,8 +221,8 @@ The new role group appears in the list.
## Enable Exchange Mailbox Access Auditing
-The 4. Mailboxes Job Group requires the Exchange Mailbox Access Auditing to be enabled. In order to
-collect Mailbox Access Auditing events, it is necessary to enable Exchange Mailbox Access Auditing
+The 4. Mailboxes Job Group requires you to enable Exchange Mailbox Access Auditing. To
+collect Mailbox Access Auditing events, enable Exchange Mailbox Access Auditing
for Exchange. See the following Microsoft articles:
- Exchange Online –
diff --git a/docs/accessanalyzer/12.0/requirements/exchange/support/remoteconnections.md b/docs/accessanalyzer/12.0/requirements/exchange/support/remoteconnections.md
index 6e6a747aa1..ba14f43263 100644
--- a/docs/accessanalyzer/12.0/requirements/exchange/support/remoteconnections.md
+++ b/docs/accessanalyzer/12.0/requirements/exchange/support/remoteconnections.md
@@ -7,8 +7,8 @@ sidebar_position: 20
# Exchange Remote Connections Permissions
The SMARTLog Data Collector processes the IIS Logs on the server running the Client Access Service
-(CAS) to return information about the remote connections being made to Exchange. This data collector
-uses an applet to process and collect the IIS Logs.
+(CAS) to return information about remote connections to Exchange. This data collector uses an applet
+to process and collect the IIS Logs.
2. CAS Metrics Job Group Requirement
@@ -16,7 +16,7 @@ In addition to the permissions required by the SMARTLog Data Collector, the Conn
assigned to the 2. CAS Metrics Job Group requires the following permissions and User Rights (based
on default settings):
-- Member of the local Administrator group on the targeted Exchange server(s) where the Client Access
+- Member of the local Administrator group on the targeted Exchange servers where the Client Access
Service is running
- Log on as a Service Group Policy:
@@ -39,7 +39,7 @@ example:
**\\ExchangeServerName\c$\Program Files (x86)\STEALTHbits\StealthAUDIT\LogProcessor**
-If there have been additional security or permission modifications on the server(s), the following
+If there have been additional security or permission modifications on the servers, the following
rights and policies may need to be enabled on the targeted host:
- Ensure the Administrator group has been granted Full Control over IIS Log Directories
diff --git a/docs/accessanalyzer/12.0/requirements/exchange/support/webservicesapi.md b/docs/accessanalyzer/12.0/requirements/exchange/support/webservicesapi.md
index e7d63767fd..e40ef43db1 100644
--- a/docs/accessanalyzer/12.0/requirements/exchange/support/webservicesapi.md
+++ b/docs/accessanalyzer/12.0/requirements/exchange/support/webservicesapi.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Exchange Web Services API Permissions
-The EWSMailbox and EWSPublicFolder data collectors utilizes Exchange Web Services API to access and
+The EWSMailbox and EWSPublicFolder data collectors uses Exchange Web Services API to access and
communicate with Exchange. These data collectors collect statistical, content, permission, and
sensitive data information from mailboxes and public folders.
diff --git a/docs/accessanalyzer/12.0/requirements/exchange/target.md b/docs/accessanalyzer/12.0/requirements/exchange/target.md
index db0bc2bb8c..4ca285699f 100644
--- a/docs/accessanalyzer/12.0/requirements/exchange/target.md
+++ b/docs/accessanalyzer/12.0/requirements/exchange/target.md
@@ -24,16 +24,16 @@ The following are requirements for the Exchange servers to be scanned:
- Enable Remote PowerShell on one Client Access Server (CAS)
- Enable Windows Authentication for the PowerShell Virtual Directory on the same CAS
- .NET Framework 4.5+ installed on all Exchange servers to be targeted
-- WINRM Service installed on all Exchange servers to be targeted as a back up in the event of a
+- WINRM Service installed on all Exchange servers to be targeted as a back up if there is a
remote PowerShell failure
- Within the Access Analyzer Console, the global **Settings > Exchange** node must be configured
:::note
- For Exchange 2013, 2016, and 2019 – If the global Settings have been configured for
- "MAPI over HTTP," then an actual CAS server name was supplied and will be used by the ExchangePS
- Data Collector. If the global Settings have been configured for "MAPI over HTTPS," then the
- global Settings will have a web address instead of an actual server. Therefore, each ExchangePS
- query requires the CAS server to be set as the specific server on the Category page. See the
+ For Exchange 2013, 2016, and 2019 – If you configure the global Settings for "MAPI over HTTP,"
+ you supply an actual CAS server name, and the ExchangePS Data Collector uses it. If you configure
+ the global Settings for "MAPI over HTTPS," the global Settings use a web address instead of an
+ actual server. In this case, each ExchangePS query requires you to set the CAS server as the
+ specific server on the Category page. See the
[ExchangePS Data Collector & Client Access Server](/docs/accessanalyzer/12.0/solutions/exchange/recommended.md)
topic for a list of queries for which this would apply.
:::
@@ -103,7 +103,7 @@ additional information.
**For Exchange Mail Flow with ExchangeMetrics Data Collector**
-- Member of the local Administrator group on the targeted Exchange server(s)
+- Member of the local Administrator group on the targeted Exchange servers
See the [Exchange Mail-Flow Permissions](/docs/accessanalyzer/12.0/requirements/exchange/support/mailflow.md) topic for additional
information.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystem.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystem.md
index 0cc53e9160..0d8a5945f6 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystem.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystem.md
@@ -10,11 +10,11 @@ The core components for Netwrix Access Analyzer (formerly Enterprise Auditor) ar
Analyzer Console server, SQL Server, and Access Information Center. See the
[Requirements](/docs/accessanalyzer/12.0/requirements/overview.md) topic for the core requirements.
-The File System solution can be configure to use Proxy servers either an applet or as a service. See
-the [File System Scan Options](/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/scanoptions.md) topic for additional information.
+You can configure the File System solution to use Proxy servers, either as an applet or as a service.
+See the [File System Scan Options](/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/scanoptions.md) topic for additional information.
-In addition to these, integration with either the Netwrix Activity Monitor or the Netwrix Threat
-Prevention is required for event activity data to be scanned. See the
+You also need to integrate with either Netwrix Activity Monitor or Netwrix Threat Prevention to scan
+event activity data. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor) or
the
[Netwrix Threat Prevention Documentation](https://helpcenter.netwrix.com/category/threatprevention)
@@ -29,7 +29,7 @@ See the following topics for target environment requirements:
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment:
+These depend on the size of the target environment:
| Environment | Enterprise | Extra-Large | Large | Medium | Small |
| ----------- | ------------------------------ | ----------------------------------- | ----------------------------------- | ----------------------------------- | ----------------------------------- |
@@ -38,26 +38,26 @@ These are dependent upon the size of the target environment:
| Cores | 8 CPU | 8 CPU | 8 CPU | 4 CPU | 2 CPU |
| Disk Space | 1.5 TB | 770 GB | 470 GB | 270 GB | 130 GB |
-The above recommended disk space sizing information is based on the needs of Access Analyzer as well
+This recommended disk space sizing information is based on the needs of Access Analyzer as well
as the File System solution for running Permission scans with default configuration (500 MB per
million files and folders), that means no tag collection, file-level scanning, activity, or
sensitive data.
-- For tag collection, add 125 MB per million documents to the totals above
+- For tag collection, add 125 MB per million documents to these totals
- For activity collection, add 250 MB per million files and folders and another 125 MB per million
- activity events to the totals above
+ activity events to these totals
- For sensitive data collection, add 500 MB per million files and folders and another 1%-10% of the
total size of the documents scanned for sensitive data (depending on targeted document types and
- selected criteria) to the totals above
+ selected criteria) to these totals
-For example, in order to scan 200 million files and folders, of which 10 million files will be
+For example, to scan 200 million files and folders, of which 10 million files will be
scanned for tag collection and sensitive data with a total size of 6 TB, you would need: 160 GB for
permission collection + 1.25 GB for tag collection (10x125 MB) + 100 GB for sensitive data
collection (200x500 MB) + 600 GB additional for sensitive data collection (10% of 6 TB) = 861.25 GB
total disk space.
:::note
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
+If you run Sensitive Data Discovery (SDD) scans, you need to increase the
minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By
default, SDD scans are configured to run two concurrent threads. For example, if the job is
configured to scan 8 hosts at a time with two concurrent SDD threads, then an extra 32 GB of RAM are
@@ -68,16 +68,16 @@ required (8x2x2=32).
**Additional Server Considerations for File System Scans**
If Data Activity Tracking for NAS is required or if NetApp Filers running Clustered Data ONTAP are
-in scope, reducing latency between the scanning server and the target device is highly recommended.
-Additional hardware may be required, especially if the target NAS devices are not collocated with
+in scope, you should reduce latency between the scanning server and the target device.
+Additional hardware may be required, especially if the target NAS devices aren't collocated with
the Access Analyzer Console server.
**Sensitive Data Discovery Auditing Requirement**
:::note
The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
+server. The JDK deployed is prepackaged and doesn't require any configuration; it's
+preconfigured to work with Access Analyzer, so don't customize it through Java. It will not
conflict with other JDKs or Java Runtimes in the same environment.
:::
@@ -85,7 +85,7 @@ conflict with other JDKs or Java Runtimes in the same environment.
Permissions on the Console Server to Run File System Scans
In most cases the Access Analyzer user is a member of the local Administrators group on the
-application server. However, if the Role Based Access usage is employed, then the user assigned the
+application server. However, if you use Role Based Access, the user assigned the
role of Job Initiator (for manual execution) or the credential used for the Schedule Service Account
(for scheduled execution) must have the following permissions to execute File System scans in local
mode, applet mode, or proxy mode with applet:
@@ -96,12 +96,12 @@ mode, applet mode, or proxy mode with applet:
- Administrators
These permissions grant the credential the ability to create a high integrity token capable of
-leveraging the “Back up files and directories” from where the Access Analyzer executable is run.
+leveraging the “Back up files and directories” right on the host where the Access Analyzer executable runs.
Additionally, the credential must have `WRITE` access to the `…\StealthAUDIT\FSAA` folder in the
-installation directory. This is required by either the user account running the Access Analyzer
-application, when manually executing jobs from the console, or the Schedule Service Account assigned
-within Access Analyzer, when running jobs as a scheduled tasks.
+installation directory. Either the user account running the Access Analyzer application (when
+manually executing jobs from the console) or the Schedule Service Account assigned within Access
+Analyzer (when running jobs as scheduled tasks) needs this access.
See the [File System Scan Options](/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/scanoptions.md) topic and the
[File System Supported Platforms](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/filesystems.md) topic for permissions required to scan
@@ -111,7 +111,7 @@ the environment.
**RAM, CPU, and Disk Space**
-These are dependent upon the size of the target environment.
+These depend on the size of the target environment.
| Environment | Enterprise | Extra-Large | Large | Medium | Small |
| ------------------------ | ------------------------------ | ----------------------------------- | ----------------------------------- | ----------------------------------- | ----------------------------------- |
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azurefiles.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azurefiles.md
index e5204363ae..c6695ac311 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azurefiles.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azurefiles.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Azure Files Target Requirements
-Azure Files is a fully managed, cloud-based file sharing service from Microsoft that allows users to
+Azure Files is a fully managed, cloud-based file sharing service from Microsoft. It lets users
access file shares from anywhere as a virtual network drive. Access Analyzer uses the File System
solution to execute Access Auditing (FSAA) and Sensitive Data Discovery Auditing scans on Azure
Files.
@@ -20,8 +20,8 @@ required both in Access Analyzer and the Azure environments:
## Create Host List
-A host list containing the desired target Azure hosts must be created and assigned to the collection
-jobs. You can create the host list with either of the following two methods:
+You must create a host list containing the Azure hosts you want to target and assign it to the
+collection jobs. You can create the host list with either of the following two methods:
- Use the FS_AzureTenantScan instant job to create the host list automatically. See the
[FS_AzureTenantScan Job](/docs/accessanalyzer/12.0/solutions/filesystem/collection/fs_azuretenantscan.md) topic for
@@ -55,7 +55,7 @@ applet, and credentials for each storage account. These should be configured as
- Client ID – The name of the storage account
- For example, if the target is `files.file.core.windows.net` then the Client ID should be
- `files`. It is not case sensitive.
+ `files`. It isn't case sensitive.
- Key – Connection string value for access keys on the storage account
@@ -72,21 +72,21 @@ Azure Files scans require the following configuration of the job and query perfo
### Jobs Targeting Azure Files
For FSAA and SEEK scans targeting Azure Files storage accounts, you must clear the **Skip Hosts that
-do not respond to PING** option in the job properties.
+don't respond to PING** option in the job properties.
-Right-click on the required scan job in the Jobs tree, and select **Properties** to open the Job
-Properties window. Navigate to the Performance tab, and ensure the **Skip Hosts that do not respond
-to PING** option is not selected. See the
+Right-click the required scan job in the Jobs tree, and select **Properties** to open the Job
+Properties window. Navigate to the Performance tab, and ensure the **Skip Hosts that don't respond
+to PING** option isn't selected. See the
[Job Properties](/docs/accessanalyzer/12.0/admin/jobs/job/properties/overview.md) and
[Performance Tab](/docs/accessanalyzer/12.0/admin/jobs/job/properties/performance.md) topics for additional
information.
### Query Configuration Considerations
-Last Access Time (LAT) preservation is not supported for Azure Files scans. This option must not be
-selected in the query for the FSAA or SEEK scan job.
+Last Access Time (LAT) preservation isn't supported for Azure Files scans. Don't select this option
+in the query for the FSAA or SEEK scan job.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md
index 9e8fa50972..5d7963377a 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azureinformationprotection.md
@@ -6,15 +6,15 @@ sidebar_position: 20
# **Azure Information Protection Target Requirements**
-Microsoft® Azure is a cloud-based computing platform that provides a range of services, such as file storage. Azure uses Azure Information Protection (AIP) labels, a Microsoft tool used to classify and protect stored files. Access Analyzer employs the File System Solution to execute Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing scans in order to find AIP Protection labels and scan protected (i.e. encrypted) files for sensitive data.
+Microsoft® Azure is a cloud-based computing platform that provides a range of services, such as file storage. Azure uses Azure Information Protection (AIP) labels, a Microsoft tool used to classify and protect stored files. Access Analyzer employs the File System Solution to execute Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing scans to find AIP Protection labels and scan protected (i.e. encrypted) files for sensitive data.
-This document provides information needed to properly configure access required by Access Analyzer to successfully scan for Azure Information Protection labels in a targeted environment.
+This document explains how to configure the access Access Analyzer needs to scan for Azure Information Protection labels in a target environment.
:::info
**NOTE**
-Access Analyzer does not scan for AIP Marking labels, only Protection labels.
+Access Analyzer doesn't scan for AIP Marking labels, only Protection labels.
:::
@@ -39,7 +39,7 @@ Ensure the following prerequisites are met before configuring AIP scanning:
* The PowerShell `Install-Module` command requires:
* PowerShell 5.0 (Run as Administrator)
* Windows Server 2016 and later
-* Active Directory Rights Management Services Client 2.1 installed on the server where the FSAA applet or proxy is being run
+* Active Directory Rights Management Services Client 2.1 installed on the server where the FSAA applet or proxy runs
### Rights Management Service Client Installation
@@ -75,7 +75,7 @@ Read the System Requirements and Install Instructions provided by Microsoft to c
:::warning
- This will disappear once you leave the page!
+ This disappears when you leave the page.
:::
4. Add API permissions
@@ -93,7 +93,7 @@ Read the System Requirements and Install Instructions provided by Microsoft to c
## **Enable the Account as an AIP Super User using PowerShell**
-Follow the steps to enable the Service Principal Account in AIP as a Super User:
+Enable the Service Principal Account in AIP as a Super User:
:::info
@@ -135,7 +135,7 @@ The Service Principal Account is now successfully added to the Azure Information
## **Access Analyzer Configurations**
-Before Access Analyzer can scan for AIP labels, two configurations must be done prior to the initial scan.
+Complete two configurations before Access Analyzer can scan for AIP labels.
* [Azure Connection Profile](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#azure-connection-profile)
* [Configure FSAA Data Collector](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/azureinformationprotection#configure-fsaa-data-collector)
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/access.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/access.md
index 2b7f11c235..9266641319 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/access.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/access.md
@@ -14,7 +14,7 @@ Follow the steps assign group membership through Computer Management.
**Step 1 –** Open Computer Management (`compmgmt.msc`).
-**Step 2 –** Right-click on the Computer Management (local) node and select Connect to another
+**Step 2 –** Right-click the Computer Management (local) node and select Connect to another
computer.
**Step 3 –** Enter the name of the Dell device in the textbox and click OK.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/activity/activity.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/activity/activity.md
index 50bb133989..3dd675aef1 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/activity/activity.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/activity/activity.md
@@ -11,15 +11,15 @@ events. All audit data can be forwarded to the Dell Common Event Enabler (CEE).
listens for all events coming through the Dell CEE and translates all relevant information into
entries in the Log files or syslog messages.
-Complete the following checklist prior to configuring the Activity Monitor to monitor the host.
+Complete the following checklist before configuring the Activity Monitor to monitor the host.
Instructions for each item of the checklist are detailed within the following sections.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - DNS name of Celerra or VNX CIFS share(s) to be monitored
- - Data Mover or Virtual Data Mover hosting the share(s) to be monitored
+ - DNS name of Celerra or VNX CIFS shares to be monitored
+ - Data Mover or Virtual Data Mover hosting the shares to be monitored
- Account with access to the CLI
- Download the Dell CEE from:
@@ -38,9 +38,9 @@ Instructions for each item of the checklist are detailed within the following se
- Important:
- - Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE
+ - Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE
is installed
- - Dell CEE 8.4.2 through Dell CEE 8.6.1 are not supported for use with the VCAPS feature
+ - Dell CEE 8.4.2 through Dell CEE 8.6.1 aren't supported for use with the VCAPS feature
- Dell CEE requires .NET Framework 3.5 to be installed on the Windows proxy server
- See the [Install & Configure Dell CEE](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/activity/installcee.md) topic for instructions.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/activity/installcee.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/activity/installcee.md
index 3f79cf2f19..e6009a33fa 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/activity/installcee.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/activity/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install & Configure Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,10 +20,10 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
+To install Dell CEE, complete the following steps.
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
-this component. It is recommended to use the most current version.
+this component. Use the most current version.
**Step 2 –** Follow the instructions in the Dell
[Using the Common Event Enabler on Windows Platforms](https://www.dell.com/support/home/en-us/product-support/product/common-event-enabler/docs)
@@ -33,7 +33,7 @@ guide to install and configure the CEE. The installation will add two services t
- EMC CEE Monitor (Display Name: EMC CEE Monitor)
:::info
-The latest version of .NET Framework and Dell CEE is recommended to use with the
+Use the latest version of .NET Framework and Dell CEE with the
asynchronous bulk delivery (VCAPS) feature.
:::
@@ -41,14 +41,14 @@ asynchronous bulk delivery (VCAPS) feature.
See the [CEE Debug Logs](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/validate.md#cee-debug-logs) section for information on
troubleshooting issues related to Dell CEE.
-After Dell CEE installation is complete, it is necessary to
-[Connect Data Movers to the Dell CEE Server](#connect-data-movers-to-the-dell-cee-server).
+After Dell CEE installation is complete,
+[connect the Data Movers to the Dell CEE Server](#connect-data-movers-to-the-dell-cee-server).
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell
+CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -58,12 +58,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
@@ -94,13 +94,13 @@ Mover.
administrative account should have a $ character in the terminal.
:::note
-Do not use a # charter.
+Don't use a # charter.
:::
**Step 2 –** Create or retrieve the `cepp.conf` file.
-If there is not a `cepp.conf` file on the Data Mover(s), use a text editor to create a new blank
+If there isn't a `cepp.conf` file on the Data Movers, use a text editor to create a new blank
file in the home directory named `cepp.conf`. The following is an example command if using the text
editor ‘vi’ to create a new blank file:
@@ -126,7 +126,7 @@ The Activity Monitor requires the following parameters to be set in the `cepp.co
- `pool name= `
- This should equal the name assigned to the configuration container. This container is composed
- of the server(s) IP Address or FQDN where the Dell CEE is installed and where the list of
+ of the servers IP Address or FQDN where the Dell CEE is installed and where the list of
events to be monitored is located. It can be named as desired but must be a pool name.
- `servers= `
- This should equal the IP Address or FQDN of the Windows server where the Dell CEE is
@@ -175,7 +175,7 @@ The Activity Monitor requires the following parameters to be set in the `cepp.co
postevents=CloseModified|CloseUnmodified|CreateDir|CreateFile|DeleteDir|DeleteFile|RenameDir|RenameFile|SetAclDir|SetAclFile
-**Step 4 –** Move the `cepp.conf` file to the Data Mover(s) root file system. Run the following
+**Step 4 –** Move the `cepp.conf` file to the Data Movers root file system. Run the following
command:
**$ server_file [DATA_MOVER_NAME]‑put cepp.conf cepp.conf**
@@ -201,7 +201,7 @@ Then verify the CEPA status using the following command:
**server_cepp [DATA_MOVER_NAME] -service –status**
-Once the `cepp.config` file has been configured, it is time to configure and enable monitoring with
+After you configure the `cepp.config` file, configure and enable monitoring with
the Activity Monitor. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor)
for additional information.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/activity/validate.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/activity/validate.md
index 2664d4594e..6e33035bb2 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/activity/validate.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/activity/validate.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
-configuration must be validated to ensure events are being monitored.
+After you configure the Activity Monitor agent to monitor the Dell device, validate the automated
+configuration to ensure it's monitoring events.
## Validate Dell CEE Registry Key Settings
@@ -18,13 +18,12 @@ topic for information on manually setting the registry key.
:::
-After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
-configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
-to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
-deployed.
+After you configure the Activity Monitor activity agent to monitor the Dell device, the agent
+automatically configures Dell CEE if it's installed on the same server. In rare cases, if you
+install Dell CEE on a different server than the Windows proxy servers where the activity agent is
+deployed, you need to set this manually.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -90,22 +89,22 @@ additional information.
## Validate Dell CEE Services are Running
-After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+After you configure the Activity Monitor Activity Agent to monitor the Dell device, the Dell
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
-The following services laid down by the Dell CEE installer should have Running as their status:
+The following services installed by the Dell CEE installer should show Running as their status:
- Dell CAVA
- Dell CEE Monitor
## Dell CEE Debug Logs
-If an issue arises with communication between the Dell CEE and the Activity Monitor, the debug logs
-need to be enabled for troubleshooting purposes. Follow the steps.
+If an issue arises with communication between the Dell CEE and the Activity Monitor, enable the
+debug logs for troubleshooting. Follow the steps.
**Step 6 –** In the Activity Monitor Console, change the **Trace level** value in the lower right
corner to Trace.
@@ -121,19 +120,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, add it.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, add it.
:::
@@ -154,7 +153,7 @@ and Enable monitoring.
- Use the **Collect Logs** button to collect debug logs from the activity agent
:::info
-After the logs have been gathered and sent to Netwrix Support, reset these
+After you gather the logs and send them to Netwrix Support, reset these
configurations.
:::
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/overview.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/overview.md
index 74c72d46ea..7132c844af 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellcelerravnx/overview.md
@@ -38,12 +38,12 @@ topic for additional information.
Troubleshooting Dell Celerra & Dell VNX Denied Access Errors
-If there are folders to which the credential is denied access, it is likely that the Backup
-Operators group does not have the “Back up files and directories” right. In that case, it is
-necessary to assign additional the “Back up files and directories” right to those groups or to
-create a new local group, using Computer Management from a Windows server. Then assign rights to it
-using the CelerraManagementTool.msc plugin, which is available to Dell customers. For further
-information, see the Celerra guide Using Windows Administrative Tools on VNX found on the Celerra
+If there are folders to which the credential is denied access, the Backup
+Operators group likely doesn't have the “Back up files and directories” right. In that case,
+assign the “Back up files and directories” right to those groups, or
+create a new local group using Computer Management on a Windows server. Then assign rights to it
+using the CelerraManagementTool.msc plugin, which is available to Dell customers. For more
+information, see the Celerra guide Using Windows Administrative Tools on VNX on the Celerra
website.
## Access & Sensitive Data Auditing Port Requirements
@@ -65,7 +65,7 @@ server:
- Membership in the local Administrators group
- READ and WRITE access to the archive location for Archiving feature only
-It is also necessary to enable the Remote Registry Service on the Activity Agent server.
+You also need to enable the Remote Registry Service on the Activity Agent server.
For integration between the Activity Monitor and Access Analyzer, the credential used by Access
Analyzer to read the activity log files must have also have this permission.
@@ -88,9 +88,9 @@ instructions.
**Activity Monitor Archive Location**
-If the activity log files are being archived, configurable within the Netwrix Activity Monitor
-Console, then the credential used by Access Analyzer to read the activity log files must also have
-READ and WRITE permissions on the archive location.
+If you configure the Netwrix Activity Monitor Console to archive activity log files, the credential
+used by Access Analyzer to read the activity log files must also have READ and WRITE permissions on
+the archive location.
## Activity Auditing Port Requirements
@@ -101,9 +101,9 @@ are required for communication between the Agent server and the Netwrix Activity
| -------------------------------- | -------- | ----- | ------------------- |
| Activity Monitor to Agent Server | TCP | 4498 | Agent Communication |
-The Windows firewall rules need to be configured on the Windows server, which require certain
-inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+Configure the Windows firewall rules on the Windows server. If the scans run in applet mode, create
+the required inbound rules. These scans operate over a default port range, which you can't specify
+in an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
@@ -119,7 +119,7 @@ Monitor Activity Agent server and the target Dell device:
Additional Firewall Rules for Integration between Access Analyzer and Activity Monitor
-Firewall settings are dependent upon the type of environment being targeted. The following firewall
+Firewall settings depend on the type of environment being targeted. The following firewall
settings are required for communication between the agent server and the Access Analyzer Console:
| Communication Direction | Protocol | Ports | Description |
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/activity.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/activity.md
index bf57ca9e42..e29b48eaaa 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/activity.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/activity.md
@@ -20,15 +20,15 @@ initiated the activity. The stored events are then forwarded by the node to the
concurrently to several instances. At this point, Dell CEE forwards the audit event to a defined
endpoint, such as Activity Monitor agent.
-Complete the following checklist prior to configuring Activity Monitor to monitor the host.
+Complete the following checklist before configuring Activity Monitor to monitor the host.
Instructions for each item of the checklist are detailed within the following sections.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - DNS name of Isilon/PowerScale CIFS share(s) to be monitored
- - Access Zone(s) containing the CIFS shares to be monitored
+ - DNS name of Isilon/PowerScale CIFS shares to be monitored
+ - Access Zones containing the CIFS shares to be monitored
- Account with access to the OneFS UI or CLI
- Download the Dell CEE from:
@@ -36,8 +36,8 @@ Instructions for each item of the checklist are detailed within the following se
:::info
You can achieve higher throughput and fault tolerance by monitoring the
-Isilon/PowerScale cluster with more than one pair of Dell CEE and Activity Monitor Agent. The
-activity will be evenly distributed between the pairs.
+Isilon/PowerScale cluster with more than one pair of Dell CEE and Activity Monitor Agent. Activity
+Monitor evenly distributes the activity between the pairs.
:::
@@ -79,20 +79,20 @@ Checklist Item 3: Configure Auditing on the Dell Isilon/PowerScale Cluster
- Important:
- Value of the **Storage Cluster Name** field must exactly match the name entered for the
- monitored host in the Activity Monitor Console. If the Storage Cluster Name cannot be modified
+ monitored host in the Activity Monitor Console. If the Storage Cluster Name can't be modified
(for example, another 3rd party depends on it), you need to set the Host Aliases parameter in
the Activity Monitor Console. Otherwise, if for some reason the Storage Cluster Name must be
- left empty, one can list OneFS cluster node names in the Host Aliases.
+ left empty, you can list OneFS cluster node names in the Host Aliases.
- - If the Storage Cluster Name is not empty, set the Host Aliases parameter to its value
+ - If the Storage Cluster Name isn't empty, set the Host Aliases parameter to its value
- If the Storage Cluster Name is empty, set the Host Aliases to a semicolon-separated list
of OneFS node names
- Include all Access Zones to be monitored in the auditing configuration
- As soon as the first CEE is installed, Isilon/PowerScale will start to send all activity,
including all previous audit events, to the agent. The start time can be modified to exclude
- previously recorded audit events to prevent the agent from becoming overloaded with data. It
- can be done using OneFS CLI only with isi audit modify command to edit the start time.
+ previously recorded audit events to prevent the agent from becoming overloaded with data. You
+ can only do this using the OneFS CLI with the isi audit modify command to edit the start time.
- Start time command:
@@ -123,7 +123,7 @@ For automatic configuration, an account needs to be provisioned with the followi
- ISI_PRIV_AUDIT
-Privileges can be added to a role and then the role can be assigned to an account. Use the following
+You can add privileges to a role and then assign the role to an account. Use the following
commands to create a role, add privileges, and assign the role to an account:
```
@@ -133,7 +133,7 @@ isi auth roles modify activity_monitor --add-priv-write="ISI_PRIV_AUDIT"
isi auth roles modify activity_monitor --add-user="ACCOUNT_NAME"
```
-Assigned privileges can be verified with the following command:
+Verify assigned privileges with the following command:
```
isi auth mapping token "ACCOUNT_NAME"
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/installcee.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/installcee.md
index 4d26538774..95c5237b9e 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/installcee.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,10 +20,10 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
+To install Dell CEE, complete the following steps.
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
-this component. It is recommended to use the most current version.
+this component. Use the most current version.
**Step 2 –** Follow the instructions in the Dell
[Using the Common Event Enabler on Windows Platforms](https://www.dell.com/support/home/en-us/product-support/product/common-event-enabler/docs)
@@ -33,7 +33,7 @@ guide to install and configure the CEE. The installation will add two services t
- EMC CEE Monitor (Display Name: EMC CEE Monitor)
:::info
-The latest version of .NET Framework and Dell CEE is recommended to use with the
+Use the latest version of .NET Framework and Dell CEE with the
asynchronous bulk delivery (VCAPS) feature.
:::
@@ -45,8 +45,8 @@ issues related to Dell CEE.
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell
+CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -56,12 +56,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/manualconfiguration.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/manualconfiguration.md
index cc3b8a747d..1bf0eb65ea 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/manualconfiguration.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/manualconfiguration.md
@@ -22,7 +22,7 @@ cluster, include all relevant zones.
Ensure that OneFS collects only events you are interested in. By default, OneFS may monitor things
like directory reads, which can take up a large amount of space. Configuring the OneFS events that
-need monitoring is not done through the Activity Monitor console. Configure OneFS event monitoring
+need monitoring isn't done through the Activity Monitor console. Configure OneFS event monitoring
using OneFS CLI with the isi audit modify command for each access zone. Enabling monitoring for only
what is needed for the environment will reduce the data load to the agent.
@@ -53,19 +53,18 @@ server hosting CEE. Use either of the following format:
http://[SERVER Name]:[PORT]/cee
:::info
-When deploying multiple Dell CEE instances at scale, it is recommended that an
-accommodating agent must be configured with each CEE instance. If multiple CEE instances send events
+When deploying multiple Dell CEE instances at scale, configure an accommodating agent for each CEE
+instance. If multiple CEE instances send events
to just one agent, it may create an overflow of data and overload the agent. Distributing the
activity stream into pairs will be the most efficient way of monitoring large data sets at scale.
:::
**Step 5 –** Also in the Event Forwarding section, set the **Storage Cluster Name** value. It must
-be an exact match to the name which is entered in the Activity Monitor for the **Monitored Host**
-list.
+exactly match the name entered in the Activity Monitor for the **Monitored Host** list.
This name is used as a ‘tag’ on all events coming through the CEE. This name must exactly match what
-is in the Activity Monitor or it does not recognize the events.
+is in the Activity Monitor or it doesn't recognize the events.
:::info
Use the CIFS DNS name for Dell OneFS.
@@ -78,12 +77,12 @@ name entered here must exactly match what is used for Access Analyzer as a targe
:::
-If the Storage Cluster Name cannot be modified (for example, another third-party depends on it), you
+If the Storage Cluster Name can't be modified (for example, another third-party depends on it), you
need to set the Host Aliases parameter in the Activity Monitor Console:
-- If the Storage Cluster Name is not empty, set the Host Aliases parameter to its value
+- If the Storage Cluster Name isn't empty, set the Host Aliases parameter to its value
- If the Storage Cluster Name is empty, set the Host Aliases to a semicolon-separated list of OneFS
node names
-Next, it is time to configure the monitoring agent on the Windows server to monitor the
+Next, configure the monitoring agent on the Windows server to monitor the
Isilon/PowerScale device.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/validate.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/validate.md
index 6c80e466bd..dcc95275f4 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/validate.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/activity/validate.md
@@ -6,18 +6,17 @@ sidebar_position: 30
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
-configuration must be validated to ensure events are being monitored.
+After you configure the Activity Monitor agent to monitor the Dell device, validate the automated
+configuration to ensure it's monitoring events.
## Validate Dell CEE Registry Key Settings
-After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
-configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
-to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
-deployed.
+After you configure the Activity Monitor activity agent to monitor the Dell device, the agent
+automatically configures Dell CEE if it's installed on the same server. In rare cases, if you
+install Dell CEE on a different server than the Windows proxy servers where the activity agent is
+deployed, you need to set this manually.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -83,22 +82,22 @@ additional information.
## Validate Dell CEE Services are Running
-After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+After you configure the Activity Monitor Activity Agent to monitor the Dell device, the Dell
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
-The following services laid down by the Dell CEE installer should have Running as their status:
+The following services installed by the Dell CEE installer should show Running as their status:
- Dell CAVA
- Dell CEE Monitor
## Dell CEE Debug Logs
-If an issue arises with communication between the Dell CEE and the Activity Monitor, the debug logs
-need to be enabled for troubleshooting purposes. Follow the steps.
+If an issue arises with communication between the Dell CEE and the Activity Monitor, enable the
+debug logs for troubleshooting. Follow the steps.
**Step 6 –** In the Activity Monitor Console, change the **Trace level** value in the lower right
corner to Trace.
@@ -114,19 +113,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, add it.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, add it.
:::
@@ -147,7 +146,7 @@ and Enable monitoring.
- Use the **Collect Logs** button to collect debug logs from the activity agent
:::info
-After the logs have been gathered and sent to Netwrix Support, reset these
+After you gather the logs and send them to Netwrix Support, reset these
configurations.
:::
@@ -158,8 +157,7 @@ The debug log is stored in `/opt/CEEPack/emc_cee_svc.log` file. To enable verbos
and Verbose parameters under **Configuration** to 255 and restart the CEE.
:::note
-Debug logs should only be used for troubleshooting purposes. It's recommended to have
-Debug Logs disabled by default.
+Only use debug logs for troubleshooting. Disable debug logs by default.
:::
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/overview.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/overview.md
index 8192a7b757..311d540cdd 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellpowerscale/overview.md
@@ -38,7 +38,7 @@ topic for additional information.
**Additional Sensitive Data Discovery Auditing Permission**
-In order to execute scoped Sensitive Data Discovery Auditing scans, the credential must also have
+to execute scoped Sensitive Data Discovery Auditing scans, the credential must also have
the LOCAL:System provider selected in each access zone in which the shares to be scanned reside.
The credential must have an Authentication Provider configured for the Isilon/PowerScale device. For
@@ -71,8 +71,8 @@ Share permissions can now be granted to this credential.
## BackupAdmin Role Assignment for OneFS
-Follow the steps to assign the credential to the **BackupAdmin** role through OneFS Storage
-Administration Console.
+To assign the credential to the **BackupAdmin** role through the OneFS Storage Administration
+Console, complete the following steps.
**Step 1 –** Navigate to the **Access** tab > **Membership & Roles** for the System Access Zone.
@@ -111,8 +111,8 @@ export** (per NFS export):
- Always read-only clients
- Root Clients
-The NFS export to be scanned also needs to be configured so root squash is disabled, which is
-performed in the same Edit export menu as the above settings.
+You must also disable root squash for the NFS export, which you configure in the same Edit export
+menu as these settings.
**Step 1 –** Navigate to the export's **Root user mapping** settings.
@@ -120,14 +120,12 @@ performed in the same Edit export menu as the above settings.
**Step 3 –** Set both User and Group to **0** (effectively mapping root client UID/GID to 0).
-Both of these steps need to be performed in each NFS export's settings that a user would like to
-scan.
+Perform both of these steps in each NFS export's settings that you want to scan.
### Troubleshooting NFSv3 Export Access
-If Access Analyzer is not discovering the expected NFS export, it is possible that the export policy
-is not properly configured to allow the Access Analyzer server or proxy server IP Address to mount
-the NFS export. One step in troubleshooting this issue is to confirm a Unix client (or WSL for
+If Access Analyzer isn't discovering the expected NFS export, the export policy might not be
+configured to allow the Access Analyzer server or proxy server IP address to mount the NFS export. One step in troubleshooting this issue is to confirm a Unix client (or WSL for
Windows) in the same IP range as the Access Analyzer server or proxy server can mount the NFS
export.
@@ -159,7 +157,7 @@ server:
- Membership in the local Administrators group
- READ and WRITE access to the archive location for Archiving feature only
-It is also necessary to enable the Remote Registry Service on the Activity Agent server.
+You also need to enable the Remote Registry Service on the Activity Agent server.
For integration between the Activity Monitor and Access Analyzer, the credential used by Access
Analyzer to read the activity log files must have also have this permission.
@@ -182,9 +180,9 @@ instructions.
**Activity Monitor Archive Location**
-If the activity log files are being archived, configurable within the Netwrix Activity Monitor
-Console, then the credential used by Access Analyzer to read the activity log files must also have
-READ and WRITE permissions on the archive location.
+If you configure the Netwrix Activity Monitor Console to archive activity log files, the credential
+used by Access Analyzer to read the activity log files must also have READ and WRITE permissions on
+the archive location.
## Activity Auditing Port Requirements
@@ -195,9 +193,9 @@ are required for communication between the Agent server and the Netwrix Activity
| -------------------------------- | -------- | ----- | ------------------- |
| Activity Monitor to Agent Server | TCP | 4498 | Agent Communication |
-The Windows firewall rules need to be configured on the Windows server, which require certain
-inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+Configure the Windows firewall rules on the Windows server. If the scans run in applet mode, create
+the required inbound rules. These scans operate over a default port range, which you can't specify
+in an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
@@ -213,7 +211,7 @@ Monitor Activity Agent server and the target Dell Isilon/PowerScale device:
Additional Firewall Rules for Integration between Access Analyzer and Activity Monitor
-Firewall settings are dependent upon the type of environment being targeted. The following firewall
+Firewall settings depend on the type of environment being targeted. The following firewall
settings are required for communication between the agent server and the Access Analyzer Console:
| Communication Direction | Protocol | Ports | Description |
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/access.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/access.md
index 8434e7f0bb..f4e1623f62 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/access.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/access.md
@@ -14,7 +14,7 @@ Follow the steps assign group membership through Computer Management.
**Step 1 –** Open Computer Management (`compmgmt.msc`).
-**Step 2 –** Right-click on the Computer Management (local) node and select Connect to another
+**Step 2 –** Right-click the Computer Management (local) node and select Connect to another
computer.
**Step 3 –** Enter the name of the Dell device in the textbox and click OK.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/activity.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/activity.md
index 5d57a74b20..7c4dd2220d 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/activity.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/activity.md
@@ -20,14 +20,14 @@ activity log file is created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Dell Unity devices.
+Complete the following checklist before configuring activity monitoring of Dell Unity devices.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - Data Mover or Virtual Data Mover hosting the share(s) to be monitored
+ - Data Mover or Virtual Data Mover hosting the shares to be monitored
- Account with access to the CLI
- Download the Dell CEE from:
@@ -35,7 +35,7 @@ Instructions for each item of the checklist are detailed within the following to
**Checklist Item 2: [Install Dell CEE](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/installcee.md)**
-- Dell CEE should be installed on the Windows proxy server(s) where the Activity Monitor activity
+- Dell CEE should be installed on the Windows proxy servers where the Activity Monitor activity
agent will be deployed
:::info
@@ -46,9 +46,9 @@ Instructions for each item of the checklist are detailed within the following to
- Important:
- - Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE
+ - Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE
is installed
- - Dell CEE 8.4.2 through Dell CEE 8.6.1 are not supported for use with the VCAPS feature
+ - Dell CEE 8.4.2 through Dell CEE 8.6.1 aren't supported for use with the VCAPS feature
- Dell CEE requires .NET Framework 3.5 to be installed on the Windows proxy server
**Checklist Item 3: Dell Unity Device Configuration**
@@ -69,8 +69,8 @@ Instructions for each item of the checklist are detailed within the following to
Checklist Item 5: Configure Dell CEE to Forward Events to the Activity Agent
:::note
-When Dell CEE is installed on Windows proxy server(s) where the Activity Monitor activity
-agent will be deployed, the following steps are not needed.
+When Dell CEE is installed on Windows proxy servers where the Activity Monitor activity
+agent will be deployed, the following steps aren't needed.
:::
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/installcee.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/installcee.md
index 86e17ed859..faa3387313 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/installcee.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,10 +20,10 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
+To install Dell CEE, complete the following steps.
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
-this component. It is recommended to use the most current version.
+this component. Use the most current version.
**Step 2 –** Follow the instructions in the Dell
[Using the Common Event Enabler on Windows Platforms](https://www.dell.com/support/home/en-us/product-support/product/common-event-enabler/docs)
@@ -33,19 +33,19 @@ guide to install and configure the CEE. The installation will add two services t
- EMC CEE Monitor (Display Name: EMC CEE Monitor)
:::info
-The latest version of .NET Framework and Dell CEE is recommended to use with the
+Use the latest version of .NET Framework and Dell CEE with the
asynchronous bulk delivery (VCAPS) feature.
:::
-After Dell CEE installation is complete, it is necessary to complete the
+After Dell CEE installation is complete, complete the
[Unity Initial Setup with Unisphere](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/setupunisphere.md).
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell
+CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -55,12 +55,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/setupunisphere.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/setupunisphere.md
index 99180a7932..f901ef939c 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/setupunisphere.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/setupunisphere.md
@@ -6,12 +6,12 @@ sidebar_position: 20
# Unity Initial Setup with Unisphere
-Follow the steps to configure the initial setup for a Unity device with Unisphere.
+To configure the initial setup for a Unity device with Unisphere, complete the following steps.
**Step 1 –** Edit the NAS Server > Protection and Events > Events Publishing > Select Pool settings:
-- Add CEPA server – This is the server where CEE is installed. It is recommended that this is also
- the server were the Activity Monitor activity agent is deployed.
+- Add CEPA server – This is the server where CEE is installed. Use the same server for the Activity
+ Monitor activity agent when possible.
- Enable the following events for Post Events.
Required Unity events needed for CIFS Activity:
@@ -29,5 +29,5 @@ Required Unity events needed for NFS Activity:
- NFS Events Publishing – Enabled (required for NFS protocol monitoring)
- SMB Events publishing – Enabled (required for SMB / CIFS protocol monitoring)
-Once Unity setup is complete, it is time to configure and enable monitoring with the Activity
+After you complete the Unity setup, configure and enable monitoring with the Activity
Monitor.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/validate.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/validate.md
index 8b6e6fbaeb..2c6ee5746d 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/validate.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/activity/validate.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
-configuration must be validated to ensure events are being monitored.
+After you configure the Activity Monitor agent to monitor the Dell device, validate the automated
+configuration to ensure it's monitoring events.
## Validate CEE Registry Key Settings
@@ -18,13 +18,12 @@ topic for information on manually setting the registry key.
:::
-After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
-configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
-to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
-deployed.
+After you configure the Activity Monitor activity agent to monitor the Dell device, the agent
+automatically configures Dell CEE if it's installed on the same server. In rare cases, if you
+install Dell CEE on a different server than the Windows proxy servers where the activity agent is
+deployed, you need to set this manually.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -90,22 +89,22 @@ additional information.
## Validate Dell CEE Services are Running
-After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+After you configure the Activity Monitor Activity Agent to monitor the Dell device, the Dell
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
-The following services laid down by the Dell CEE installer should have Running as their status:
+The following services installed by the Dell CEE installer should show Running as their status:
- Dell CAVA
- Dell CEE Monitor
## CEE Debug Logs
-If an issue arises with communication between the Dell CEE and the Activity Monitor, the debug logs
-need to be enabled for troubleshooting purposes. Follow the steps.
+If an issue arises with communication between the Dell CEE and the Activity Monitor, enable the
+debug logs for troubleshooting. Follow the steps.
**Step 6 –** In the Activity Monitor Console, change the **Trace level** value in the lower right
corner to Trace.
@@ -121,19 +120,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, add it.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, add it.
:::
@@ -154,7 +153,7 @@ and Enable monitoring.
- Use the **Collect Logs** button to collect debug logs from the activity agent
:::info
-After the logs have been gathered and sent to Netwrix Support, reset these
+After you gather the logs and send them to Netwrix Support, reset these
configurations.
:::
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/overview.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/overview.md
index 7ee308b3e3..5453442e4b 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/dellunity/overview.md
@@ -37,12 +37,12 @@ topic for additional information.
**Troubleshooting Dell Unity Denied Access Errors**
-If there are folders to which the credential is denied access, it is likely that the Backup
-Operators group does not have the “Back up files and directories” right. In that case, it is
-necessary to assign additional the “Back up files and directories” right to those groups or to
-create a new local group, using Computer Management from a Windows server. Then assign rights to it
-using the CelerraManagementTool.msc plugin, which is available to Dell customers. For further
-information, see the Celerra guide Using Windows Administrative Tools on VNX found on the Celerra
+If there are folders to which the credential is denied access, the Backup
+Operators group likely doesn't have the “Back up files and directories” right. In that case,
+assign the “Back up files and directories” right to those groups, or
+create a new local group using Computer Management on a Windows server. Then assign rights to it
+using the CelerraManagementTool.msc plugin, which is available to Dell customers. For more
+information, see the Celerra guide Using Windows Administrative Tools on VNX on the Celerra
website.
## Access & Sensitive Data Auditing Port Requirements
@@ -64,7 +64,7 @@ server:
- Membership in the local Administrators group
- READ and WRITE access to the archive location for Archiving feature only
-It is also necessary to enable the Remote Registry Service on the Activity Agent server.
+You also need to enable the Remote Registry Service on the Activity Agent server.
For integration between the Activity Monitor and Access Analyzer, the credential used by Access
Analyzer to read the activity log files must have also have this permission.
@@ -86,9 +86,9 @@ See the [Dell Unity Activity Auditing Configuration](/docs/accessanalyzer/12.0/r
**Activity Monitor Archive Location**
-If the activity log files are being archived, configurable within the Netwrix Activity Monitor
-Console, then the credential used by Access Analyzer to read the activity log files must also have
-READ and WRITE permissions on the archive location.
+If you configure the Netwrix Activity Monitor Console to archive activity log files, the credential
+used by Access Analyzer to read the activity log files must also have READ and WRITE permissions on
+the archive location.
## Activity Auditing Port Requirements
@@ -99,9 +99,9 @@ are required for communication between the Agent server and the Netwrix Activity
| -------------------------------- | -------- | ----- | ------------------- |
| Activity Monitor to Agent Server | TCP | 4498 | Agent Communication |
-The Windows firewall rules need to be configured on the Windows server, which require certain
-inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+Configure the Windows firewall rules on the Windows server. If the scans run in applet mode, create
+the required inbound rules. These scans operate over a default port range, which you can't specify
+in an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
@@ -117,7 +117,7 @@ Monitor Activity Agent server and the target Dell device:
Additional Firewall Rules for Integration between Access Analyzer and Activity Monitor
-Firewall settings are dependent upon the type of environment being targeted. The following firewall
+Firewall settings depend on the type of environment being targeted. The following firewall
settings are required for communication between the agent server and the Access Analyzer Console:
| Communication Direction | Protocol | Ports | Description |
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/filesystems.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/filesystems.md
index 628802ece1..f9705160a7 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/filesystems.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/filesystems.md
@@ -76,8 +76,8 @@ See the topic for target environment requirements.
## Azure Files Support
-Azure Files is a fully managed, cloud-based file sharing service from Microsoft that allows users to
-access file shares from anywhere as a virtual network drive. Access Analyzer supports Access
+Azure Files is a fully managed, cloud-based file sharing service from Microsoft. With Azure Files,
+users can access file shares from anywhere as a virtual network drive. Access Analyzer supports Access
Auditing (FSAA) and Sensitive Data Discovery Auditing scans of Azure Files.
See the [Azure Files Target Requirements](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/azurefiles.md) topic for additional information.
@@ -114,7 +114,7 @@ environment requirements.
See the [Hitachi Target Requirements](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/overview.md) topic for target
environment requirements.
-**Nasuni Nasuni Edge Appliances**
+**Nasuni Edge Appliances**
- 8.0+
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/activity.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/activity.md
index f3d6c50347..396cdbbd28 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/activity.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/activity.md
@@ -11,7 +11,7 @@ multiple file systems. Auditing is enabled and configured per file system. This
to enable auditing on an HNAS and to configure the Activity Monitor to monitor activity coming from
the Hitachi device auditing.
-The Activity Monitor does not use the EVS or file system name to connect to HNAS. Therefore, all
+The Activity Monitor doesn't use the EVS or file system name to connect to HNAS. Therefore, all
that is required of the user for HNAS activity collection is the following:
- Logs path (UNC)
@@ -39,11 +39,11 @@ clients using other protocols would be costly in terms of system performance, be
operation would have to be audited as an open operation. **Therefore, when file system auditing is
enabled, by default, only clients connecting through the CIFS protocol are allowed access to the
file system.** Access by clients using other protocols, like NFS, can, however, be allowed. When
-such access is allowed, access to file system objects through these protocols is not audited.”
+such access is allowed, access to file system objects through these protocols isn't audited.”
:::note
File system auditing can be configured to deny access to clients connecting with protocols
-that cannot be audited (NFS). Please see the Hitachi
+that can't be audited (NFS). see the Hitachi
[Server and Cluster Administration Guide](https://support.hds.com/download/epcra/hnas0106.pdf) for
additional information.
:::
@@ -51,7 +51,7 @@ additional information.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Hitachi devices.
+Complete the following checklist before configuring activity monitoring of Hitachi devices.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: [Configure Audit Logs on HNAS](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/configurelogs.md)**
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/configureaccesstologs.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/configureaccesstologs.md
index deade0c148..184fcdea91 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/configureaccesstologs.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/configureaccesstologs.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# Configure Access to HNAS Audit Logs on Activity Agent Server
-Follow the steps to configure access to the HNAS audit logs on the Windows server hosting the
-Activity Monitor activity agent.
+To configure access to the HNAS audit logs on the Windows server hosting the Activity Monitor
+activity agent, complete the following steps.
**Step 1 –** On the Windows computer, go to Run and type `compmgmt.msc`.
@@ -22,9 +22,9 @@ Folders > Shares.
**Step 5 –** Select the Security tab and click Advanced.
**Step 6 –** In the Advanced Security Settings dialog box, select the Audit tab. Click Add or Edit
-to select the users and groups to be audited and add the desired user or group.
+to select the users and groups to be audited and add the user or group you want to audit.
**Step 7 –** Select All for Type, and Full Control for Basic permissions.
-Once access has been configured on both the Hitachi device and the Activity Agent server, it is time
-to configure and enable monitoring with the Activity Monitor Console.
+After you configure access on both the Hitachi device and the Activity Agent server, configure and
+enable monitoring with the Activity Monitor Console.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/configurelogs.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/configurelogs.md
index 7c28b1fff3..ca24ebc10f 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/configurelogs.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/configurelogs.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Configure Audit Logs on HNAS
-Follow the steps to configure access to the HNAS audit logs on the Hitachi device.
+To configure access to the HNAS audit logs on the Hitachi device, complete the following steps.
**Step 1 –** Open a browser and enter the IP Address for HNAS in the address bar to launch the
Hitachi Storage Navigator (SN). Enter the username and password.
@@ -33,7 +33,7 @@ auditing). In the Audit Log section, set the maximum log file size to a value of
is recommended to set it to 16 MB. In the Log roll over policy section, select New. The product does
not support the Wrap policy. Click OK to close.
-Once access has been configured on the Hitachi device, it is necessary to configure access to the
-HNAS audit logs on the Windows server. See the
+After access is configured on the Hitachi device, configure access to the HNAS audit logs on the
+Windows server. See the
[Configure Access to HNAS Audit Logs on Activity Agent Server](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/activity/configureaccesstologs.md) topic for
additional information.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/overview.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/overview.md
index 11406b2b9f..6cca5091d6 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/hitachi/overview.md
@@ -49,7 +49,7 @@ server:
- Membership in the local Administrators group
- READ and WRITE access to the archive location for Archiving feature only
-It is also necessary to enable the Remote Registry Service on the Activity Agent server.
+You also need to enable the Remote Registry Service on the Activity Agent server.
For integration between the Activity Monitor and Access Analyzer, the credential used by Access
Analyzer to read the activity log files must have also have this permission.
@@ -71,9 +71,9 @@ See the [Hitachi Activity Auditing Configuration](/docs/accessanalyzer/12.0/requ
**Activity Monitor Archive Location**
-If the activity log files are being archived, configurable within the Netwrix Activity Monitor
-Console, then the credential used by Access Analyzer to read the activity log files must also have
-READ and WRITE permissions on the archive location.
+If you configure the Netwrix Activity Monitor Console to archive activity log files, the credential
+used by Access Analyzer to read the activity log files must also have READ and WRITE permissions on
+the archive location.
## Activity Auditing Port Requirements
@@ -84,15 +84,15 @@ are required for communication between the Agent server and the Netwrix Activity
| -------------------------------- | -------- | ----- | ------------------- |
| Activity Monitor to Agent Server | TCP | 4498 | Agent Communication |
-The Windows firewall rules need to be configured on the Windows server, which require certain
-inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+Configure the Windows firewall rules on the Windows server. If the scans run in applet mode, create
+the required inbound rules. These scans operate over a default port range, which you can't specify
+in an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
Additional Firewall Rules for Integration between Access Analyzer and Activity Monitor
-Firewall settings are dependent upon the type of environment being targeted. The following firewall
+Firewall settings depend on the type of environment being targeted. The following firewall
settings are required for communication between the agent server and the Access Analyzer Console:
| Communication Direction | Protocol | Ports | Description |
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nasuni/access.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nasuni/access.md
index e64b33da3b..baca1eb4ba 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nasuni/access.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nasuni/access.md
@@ -6,12 +6,12 @@ sidebar_position: 10
# Nasuni Edge Appliance Access & Sensitive Data Auditing Configuration
-It is necessary to generate an API Key Name and Passcode for each on-premise Nasuni Edge Appliance
+Generate an API Key Name and Passcode for each on-premise Nasuni Edge Appliance
and cloud filer.
## Nasuni Filer Management Interface
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Filer Management Interface.
+To generate a Nasuni API Access Key in the Nasuni Filer Management Interface:
**Step 1 –** Within the **Configuration** menu, under **USERS & SECURITY**, select API Access Keys.
The API Access Keys page opens.
@@ -39,14 +39,14 @@ documentation for additional information.
## Nasuni Management Console
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Management Console.
+To generate a Nasuni API Access Key in the Nasuni Management Console:
**Step 1 –** Click Filers and select API Keys from the menu on the left. The Filer API Access Key
Settings page opens.
**Step 2 –** Click New API Key button. The Add API Access Key window opens.
-**Step 3 –** From the Filer drop-down menu, select the desired Nasuni Edge Appliance. Then enter a
+**Step 3 –** From the Filer dropdown menu, select the Nasuni Edge Appliance you want. Then enter a
Name for the key; for example, the name of the application.
**Step 4 –** Click Add API Key.
@@ -68,13 +68,12 @@ documentation for additional information.
## Nasuni Best Practices for Access Auditing
-Nasuni is a hybrid NAS where actively-used data is stored on a Nasuni Edge appliance while the
-authoritative copy of all files and meta data is stored in private or public cloud object storage
-platforms by the UniFS® global file system, and there are egress fees associated with transferring
-data between the two. In order to minimize these egress fees and optimize scan performance, it is
-recommended to deploy a dedicated Nasuni Edge Appliance with all shares to be scanned by Access
-Analyzer mounted, and the Access Analyzer console server, in the same region where the authoritative
-copy resides.
+Nasuni is a hybrid NAS: actively used data resides on a Nasuni Edge Appliance, while the UniFS®
+global file system stores the authoritative copy of all files and metadata in private or public
+cloud object storage platforms. Because transferring data between the two incurs egress fees,
+deploy a dedicated Nasuni Edge Appliance with all shares you want Access Analyzer to scan mounted,
+and place the Access Analyzer console server in the same region as the authoritative copy. This
+minimizes egress fees and optimizes scan performance.
See the
[External Auditing and Nasuni Best Practices](https://nasuni.my.salesforce.com/sfc/p/#external-auditing-and-nasuni-best-practices)
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nasuni/activity.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nasuni/activity.md
index b4a1c231fb..e1017802ba 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nasuni/activity.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nasuni/activity.md
@@ -6,14 +6,14 @@ sidebar_position: 20
# Nasuni Edge Appliance Activity Auditing Configuration
-Generation of an API Access Key is required for Nasuni activity monitoring. The Nasuni Edge
-Appliance generates its own audit trail. An API Access Key is used by the Activity Monitor to form a
+You must generate an API Access Key for Nasuni activity monitoring. The Nasuni Edge
+Appliance generates its own audit trail. The Activity Monitor uses an API Access Key to form a
network connection to the appliance. Nasuni will then stream event data to the activity agent. See
[Nasuni Support Documentation](https://www.nasuni.com/support/) for additional information.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Nasuni Edge Appliances.
+Complete the following checklist before configuring activity monitoring of Nasuni Edge Appliances.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Generate Nasuni API Access Key**
@@ -30,7 +30,7 @@ Instructions for each item of the checklist are detailed within the following to
## Nasuni Filer Management Interface
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Filer Management Interface.
+To generate a Nasuni API Access Key in the Nasuni Filer Management Interface:
**Step 1 –** Within the **Configuration** menu, under **USERS & SECURITY**, select API Access Keys.
The API Access Keys page opens.
@@ -43,8 +43,8 @@ The API Access Keys page opens.
**Step 5 –** In the Successfully Generated API Key window, copy the Key Passcode.
-Both the Key Name and the Key Passcode are required by the Activity Monitor in order to connect to
-the Nasuni Edge Appliance. Once the API Key has been generated, it is time to configure and enable
+The Activity Monitor requires both the Key Name and the Key Passcode to connect to
+the Nasuni Edge Appliance. After you generate the API key, configure and enable
monitoring with the Activity Monitor console.
:::note
@@ -55,22 +55,22 @@ the exact same case as generated.
## Nasuni Management Console
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Management Console.
+To generate a Nasuni API Access Key in the Nasuni Management Console:
**Step 1 –** Click Filers and select API Keys from the menu on the left. The Filer API Access Key
Settings page opens.
**Step 2 –** Click New API Key button. The Add API Access Key window opens.
-**Step 3 –** From the Filer drop-down menu, select the desired Nasuni Edge Appliance. Then enter a
+**Step 3 –** From the Filer dropdown menu, select the Nasuni Edge Appliance you want. Then enter a
Name for the key; for example, the name of the application.
**Step 4 –** Click Add API Key.
**Step 5 –** A message appears which includes the Key Passcode; copy the Key Passcode.
-Both the Key Name and the Key Passcode are required by the Activity Monitor in order to connect to
-the Nasuni Edge Appliance. Once the API Key has been generated, it is time to configure and enable
+The Activity Monitor requires both the Key Name and the Key Passcode to connect to
+the Nasuni Edge Appliance. After you generate the API key, configure and enable
monitoring with the Activity Monitor console.
:::note
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nasuni/overview.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nasuni/overview.md
index 02e743064e..3826f40861 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nasuni/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nasuni/overview.md
@@ -59,7 +59,7 @@ Analyzer to read the activity log files must have also have this permission.
**Nasuni Edge Appliance Requirements**
-Additionally, it is necessary to generate an API Access Key for Nasuni activity monitoring. See the
+Additionally, generate an API Access Key for Nasuni activity monitoring. See the
[Nasuni Edge Appliance Activity Auditing Configuration](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nasuni/activity.md) topic for instructions.
**Activity Monitor Archive Location**
@@ -79,7 +79,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/access/access.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/access/access.md
index 94bcf8786b..109b67f9f0 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/access/access.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/access/access.md
@@ -30,7 +30,7 @@ api-volume-list-info-iter-*
## Bypass NTFS Security for 7-Mode
-In order to bypass NTFS, the credential needs to at least have the following permissions on the
+to bypass NTFS, the credential needs to at least have the following permissions on the
NetApp device:
- Group membership in both of the following groups:
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/access/provisionaccess.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/access/provisionaccess.md
index 90c2f0de68..984c7a4aca 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/access/provisionaccess.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/access/provisionaccess.md
@@ -8,13 +8,13 @@ sidebar_position: 10
This section describes the steps needed to create a user account with the privileges required to
execute Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing scans from Access Analyzer.
-It is necessary to:
+Complete the following steps:
- Create Role
- Create a Group & Assign Role
- Add User to Group
-Relevant NetApp Documentation: To learn more about node access controls, please visit the NetApp
+Relevant NetApp Documentation: For more information about node access controls, visit the NetApp
website and read the
[na_useradmin – Administers node access controls](https://library.netapp.com/ecmdocs/ECMP1511537/html/man1/na_useradmin.1.html)
article.
@@ -47,7 +47,7 @@ After the role is created, Create a Group & Assign Role.
## Create a Group & Assign Role
-Once the role has been created, it must be attached to a group. The following command needs to be
+After the role is created, it must be attached to a group. The following command needs to be
run to create a group and assign the role to it.
```
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/activity.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/activity.md
index 2e5a162f87..b7d376da0f 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/activity.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/activity.md
@@ -6,30 +6,30 @@ sidebar_position: 20
# NetApp Data ONTAP 7-Mode Activity Auditing Configuration
-The Activity Monitor agent employed to monitor NetApp leverages 128-bit encrypted Remote Procedure
+The Activity Monitor agent employed to monitor NetApp uses 128-bit encrypted Remote Procedure
Calls (RPC), NetApp ONTAP-API, and NetApp FPolicy to monitor file system events. This includes both
-NetApp 7-Mode and Cluster-Mode configurations. To learn more about FPolicy please visit the NetApp
+NetApp 7-Mode and Cluster-Mode configurations. For more information about FPolicy, visit the NetApp
website and read the
[What FPolicy is](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html)
article.
-If the activity agent is stopped, a notification will be sent to the NetApp device to disconnect and
-disable the associated FPolicy policy, but it will not be removed.
+If the activity agent stops, it sends a notification to the NetApp device to disconnect and
+disable the associated FPolicy policy, but it doesn't remove the policy.
-If the network connection is lost between the activity agent and the NetApp device, the NetApp
-device is configured with a default timeout to wait for a response. If a response is not received
-from the Activity Agent within the timeout, then the NetApp device will disconnect and disable the
-FPolicy policy. The Activity Agent will check every minute by default to see if the FPolicy policy
-has been disabled and will enable it (if the auto-enable functionality is enabled for the agent).
-The default setting to check every minute is configurable.
+If the network connection between the activity agent and the NetApp device drops, the NetApp
+device waits for a response for a default timeout period. If the NetApp device doesn't receive a
+response from the Activity Agent within the timeout, it disconnects and disables the
+FPolicy policy. By default, the Activity Agent checks every minute to see if the FPolicy policy
+is disabled and re-enables it (if the auto-enable functionality is enabled for the agent).
+The default check interval of one minute is configurable.
-The NetApp FPolicy uses a “push” mechanism such that notification will only be sent to the activity
-agent when a transaction occurs. Daily activity log files are created only if activity is performed.
-No activity log file will be created if there is no activity for the day.
+The NetApp FPolicy uses a “push” mechanism, so it sends a notification to the activity
+agent only when a transaction occurs. The Activity Agent creates daily activity log files
+only when activity occurs. It doesn't create an activity log file for a day with no activity.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of NetApp Data ONTAP
+Complete the following checklist before configuring activity monitoring of NetApp Data ONTAP
7-Mode devices. Instructions for each item of the checklist are detailed within the following
topics.
@@ -37,7 +37,7 @@ topics.
- Gather the following information:
- Names of the vFiler™(s) to be monitored
- - DNS name of the CIFS shares(s) to be monitored
+ - DNS name of the CIFS sharess to be monitored
**Checklist Item 2: [Provision FPolicy Account](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/provisionactivity.md)**
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/configurefpolicy.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/configurefpolicy.md
index eda4fcc7d7..f8def90d04 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/configurefpolicy.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/configurefpolicy.md
@@ -15,9 +15,9 @@ A tailored FPolicy
:::
-- If using vFilers the FPolicy must be created on the vFiler, and the Activity Monitor must target
- the vFiler. This is because FPolicy operates on the affected vFiler. Therefore, when executing
- these commands on a vFiler, the commands must be run from a vFiler context (e.g. via the vFiler
+- If using vFilers, create the FPolicy on the vFiler, and target the vFiler with the Activity
+ Monitor. This is because FPolicy operates on the affected vFiler. Therefore, when you run
+ these commands on a vFiler, run them from a vFiler context (e.g., via the vFiler
run command).
- Allow the Activity Monitor to create an FPolicy automatically. See the
[Automatic Configuration of FPolicy](#automatic-configuration-of-fpolicy) topic for additional
@@ -30,7 +30,7 @@ A tailored FPolicy
## Manually Configure FPolicy (Recommended Option)
This section describes how to manually configure FPolicy. Manual configuration of the FPolicy is
-recommended so that the policy can be scoped. It is necessary to create six FPolicy components and
+recommended so that the policy can be scoped. Create six FPolicy components and
then enable the FPolicy. See the sections corresponding to each part of this list:
- [Part 1: Create FPolicy](#part-1-create-fpolicy)
@@ -41,12 +41,12 @@ then enable the FPolicy. See the sections corresponding to each part of this lis
- [Part 6: Scope FPolicy for Specific Volumes](#part-6-scope-fpolicy-for-specific-volumes)
- [Part 7: Enable FPolicy](#part-7-enable-fpolicy)
-If using vFilers the FPolicy must be created on the vFiler, and the Activity Monitor must target the
-vFiler. This is because FPolicy operates on the affected vFiler. Therefore, when executing these
-commands on a vFiler, the commands must be run from a vFiler context (e.g. via the vFiler run
+If using vFilers, create the FPolicy on the vFiler, and target the vFiler with the Activity Monitor.
+This is because FPolicy operates on the affected vFiler. Therefore, when you run these
+commands on a vFiler, run them from a vFiler context (e.g., via the vFiler run
command).
-Relevant NetApp Documentation: To learn more about configuring file policies, please visit the
+Relevant NetApp Documentation: For more information about configuring file policies, visit the
NetApp website and read
[na_fpolicy – configure file policies](https://library.netapp.com/ecmdocs/ECMP1196890/html/man1/na_fpolicy.1.html)
article.
@@ -68,9 +68,9 @@ fpolicy create StealthAUDIT screen
### Part 2: Set FPolicy Required to Off
-If the `FPolicy Required` value is set to on, user requests are denied if an FPolicy server is not
-available to implement the policy. If it is set to off, user requests are allowed when it is not
-possible to apply the policy to the file because no FPolicy server is available.
+If you set the `FPolicy Required` value to on, the NetApp device denies user requests when no
+FPolicy server is available to implement the policy. If you set it to off, the NetApp device
+allows user requests even when no FPolicy server is available to apply the policy to the file.
IMPORTANT:
@@ -175,6 +175,6 @@ fpolicy enable StealthAUDIT
## Automatic Configuration of FPolicy
The Activity Monitor can automatically configure FPolicy on the targeted NetApp Data ONTAP 7-Mode
-device. The FPolicy created monitors all file system activity. This is done when the NetApp device
-is assigned to the agent for monitoring. This option is enabled on the NetApp FPolicy Configuration
+device. The FPolicy created monitors all file system activity. This happens when you assign the
+NetApp device to the agent for monitoring. This option is enabled on the NetApp FPolicy Configuration
page of the Add New Host window.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/customizefpolicy.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/customizefpolicy.md
index 77843dad69..4d90aecbe9 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/customizefpolicy.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/customizefpolicy.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Customize FPolicy Policy Name
There may be situations when FPolicy needs to be named something other than StealthAUDIT. In those
-cases it is necessary to manually add a parameter to the Activity Monitor agent’s `sbtfilemon.ini`
+cases, manually add a parameter to the Activity Monitor agent’s `sbtfilemon.ini`
file. After the monitoring agent has been deployed, follow the steps.
**Step 1 –** Open to the `sbtfilemon.ini` file on the agent server in a text editor:
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/provisionactivity.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/provisionactivity.md
index 690a741a7c..d351ba27d0 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/provisionactivity.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/activity/provisionactivity.md
@@ -16,7 +16,7 @@ Provisioning this account is a three part process:
- Part 2: Create a Group & Assign Role
- Part 3: Add User to Group
-Relevant NetApp Documentation: To learn more about node access controls, please visit the NetApp
+Relevant NetApp Documentation: For more information about node access controls, visit the NetApp
website and read the
[na_useradmin – Administers node access controls](https://library.netapp.com/ecmdocs/ECMP1511537/html/man1/na_useradmin.1.html)
article.
@@ -74,7 +74,7 @@ After the role is created, complete Part 2: Create a Group & Assign Role.
## Part 2: Create a Group & Assign Role
-Once the role has been created, it must be attached to a group. The following command needs to be
+After the role is created, it must be attached to a group. The following command needs to be
run to create a group and assign the role to it.
```
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/overview.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/overview.md
index 406c269a72..96e82deddf 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netapp7mode/overview.md
@@ -115,7 +115,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
@@ -139,7 +139,7 @@ Agent server and the target NetApp Data ONTAP 7-Mode device:
Activity Monitor.
:::note
-If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
+If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
device must be configured manually. Also, the External Engine will not reconnect automatically in
the case of a server reboot or service restart.
:::
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/access/access.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/access/access.md
index 4389bf9613..8ecd2969d4 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/access/access.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/access/access.md
@@ -104,8 +104,8 @@ The following permissions are required:
cifs users-and-groups local-group add-members ‑group-name "BUILTIN\Backup Operators" ‑member-names [DOMAIN_USER] ‑vserver [SVM_NAME]
```
-If an ACE does not already exist for a specific user/group on an SVM's c$ share, then it needs to be
-added with the desired rights (No_access, Read, Change, or Full_Control). To check the current ACE
+If an ACE doesn't already exist for a specific user/group on an SVM's c$ share, then it needs to be
+added with the rights you want (No_access, Read, Change, or Full_Control). To check the current ACE
for a user or group on each SVM's c$ share, the following ONTAP CLI command should be used at the
cluster management level.
@@ -117,7 +117,7 @@ The output will list each SVM's ACL for its c$ share. For example:
-If the desired ACE does not exist on an SVM's c$ share, then one can be created with the following
+If the ACE you want doesn't exist on an SVM's c$ share, then one can be created with the following
command:
```
@@ -127,7 +127,7 @@ vserver cifs share access-control create -share c$ -user-or-group [USER_OR_GROUP
If an existing ACE needs to be modified, the following command should be used:
:::warning
-The following command will overwrite an existing ACE. For example, it is possible to
+The following command will overwrite an existing ACE. For example, you can
downgrade a user with Full_Control to Read, or vice versa.
:::
@@ -142,14 +142,14 @@ instead give the SVM's Backup Operators group read-only access to each share to
:::
-In order to utilize Access Analyzer’s LAT Preservation (Last Access Time) feature during sensitive
+to use Access Analyzer’s LAT Preservation (Last Access Time) feature during sensitive
data scans and metadata tag collection, applying ONTAP’s SeRestorePrivilege to the service account
is also required.
As an alternative to membership in BUILTIN\Backup Operators, SeBackupPrivilege can be directly
applied to a user via the NetApp command line.
-The following commands can be used to grant these permissions to the service account to be used for
+Use the following commands to grant these permissions to the service account used for
scanning by Access Analyzer.
Use the following commands to add SeBackupPrivilege to the Service Account (or a BUILTIN Group):
@@ -196,13 +196,13 @@ cifs share access-control show ‑vserver [SVM_NAME] ‑share c$
## NFSv3 Credential Configuration
-The following is a list of example commands that can be used to configure a NetApp export policy to
+Use the following example commands to configure a NetApp export policy to
scan a volume via NFSv3 using the Access Analyzer File System Solution.
:::warning
The export policy for a volume's parent (ex. the SVM's root volume), or the export
policy for a qtree's parent, must have access rights that are equal or wider in scope to the export
-policy for the target volume/qtree. If Access Analyzer cannot access all segments of a target
+policy for the target volume/qtree. If Access Analyzer can't access all segments of a target
volume/qtree's junction path, then NFS access will be denied.
:::
@@ -259,7 +259,7 @@ volume modify ‑vserver testserver ‑volume testVolume ‑policy testNFS
### Troubleshooting NFSv3 Export Access
If Access Analyzeris not discovering the expected NFS export, it is possible that the export policy
-is not properly configured to allow the Access Analyzer server or proxy server IP Address to mount
+isn't properly configured to allow the Access Analyzer server or proxy server IP Address to mount
the NFS export. One step in troubleshooting this issue is to confirm a Unix client (or WSL for
Windows) in the same IP range as the Access Analyzer server or proxy server can mount the NFS
export.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/access/configureemptyfpolicy.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/access/configureemptyfpolicy.md
index 7902707762..0c3bbc2dec 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/access/configureemptyfpolicy.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/access/configureemptyfpolicy.md
@@ -95,14 +95,14 @@ Example:
security login role show enterpriseauditor
```
-Relevant NetApp Documentation: To learn more about creating security login roles, please visit the
+Relevant NetApp Documentation: For more information about creating security login roles, visit the
NetApp website and read the
[security login role create](https://library.netapp.com/ecmdocs/ECMP1196817/html/security/login/role/create.html)
article.
## Create Security Login for FSAA Scans
-Once the access control role has been created, apply it to a domain account.
+After the access control role is created, apply it to a domain account.
**:::warning**
@@ -154,7 +154,7 @@ Verify that the output is displayed as follows:
-Relevant NetApp Documentation: To learn more about creating security logins, please visit the NetApp
+Relevant NetApp Documentation: For more information about creating security logins, visit the NetApp
website and read the
[security login create](https://library.netapp.com/ecmdocs/ECMP12452955/html/security/login/create.html)
article.
@@ -165,7 +165,7 @@ The External Engine defines how FPolicy makes and manages connections to externa
IMPORTANT:
-- The `-primary-servers` must be the server from which the StealthAUDIT scans will be executed:
+- The `-primary-servers` must be the server that runs the StealthAUDIT scans:
- StealthAUDIT Console server for local mode
- proxy server if running in any of the proxy mode options
@@ -211,7 +211,7 @@ Verify that the output is displayed as follows:
-Relevant NetApp Documentation: To learn more about creating an external engine, please visit the
+Relevant NetApp Documentation: For more information about creating an external engine, visit the
NetApp website and read the
[vserver fpolicy policy external-engine create](https://library.netapp.com/ecmdocs/ECMP1366832/html/vserver/fpolicy/policy/external-engine/create.html)
article.
@@ -259,7 +259,7 @@ Verify that the output is displayed as follows:
-Relevant NetApp Documentation: To learn more about creating an event, please visit the NetApp
+Relevant NetApp Documentation: For more information about creating an event, visit the NetApp
website and read the
[vserver fpolicy policy event create](https://library.netapp.com/ecmdocs/ECMP1196817/html/vserver/fpolicy/policy/event/create.html)
article.
@@ -313,7 +313,7 @@ fpolicy policy show ‑instance
-Relevant NetApp Documentation: To learn more about creating a policy, please visit the NetApp
+Relevant NetApp Documentation: For more information about creating a policy, visit the NetApp
website and read the
[vserver fpolicy policy create](https://library.netapp.com/ecmdocs/ECMP1366832/html/vserver/fpolicy/policy/create.html)
article.
@@ -325,9 +325,9 @@ The FPolicy scope creates the filters necessary to perform scans on specific sha
IMPORTANT:
- The SVM used must be the SVM hosting the CIFS shares.
-- It is not necessary to specify both volumes and shares. One or the other is sufficient.
+- It isn't necessary to specify both volumes and shares. One or the other is sufficient.
-Use the following command to create the FPolicy scope by volume(s):
+Use the following command to create the FPolicy scope by volumes:
```
vserver fpolicy policy scope create ‑vserver [SVM_NAME] ‑policy-name StealthAUDIT ‑volumes-to-include
@@ -339,7 +339,7 @@ Example:
vserver fpolicy policy scope create ‑vserver testserver ‑policy-name StealthAUDIT ‑volumes-to-include
```
-Use the following command to create the FPolicy scope by share(s):
+Use the following command to create the FPolicy scope by shares:
```
vserver fpolicy policy scope create ‑vserver [SVM_NAME] ‑policy-name StealthAUDIT ‑shares-to-include
@@ -363,14 +363,14 @@ fpolicy policy scope show ‑instance
-Relevant NetApp Documentation: To learn more about creating scope, please visit the NetApp website
+Relevant NetApp Documentation: For more information about creating scope, visit the NetApp website
and read the
[vserver fpolicy policy scope create](https://library.netapp.com/ecmdocs/ECMP1196817/html/vserver/fpolicy/policy/scope/create.html)
article.
## Enable the Empty FPolicy
-Once the empty FPolicy has been created, it must be enabled.
+After the empty FPolicy is created, it must be enabled.
IMPORTANT:
@@ -400,7 +400,7 @@ vserver fpolicy show
-Relevant NetApp Documentation: To learn more about enabling a policy, please visit the NetApp
+Relevant NetApp Documentation: For more information about enabling a policy, visit the NetApp
website and read the
[vserver fpolicy enable](https://library.netapp.com/ecmdocs/ECMP1196817/html/vserver/fpolicy/enable.html)
article.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/activity.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/activity.md
index 694c852784..e8758e0d62 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/activity.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/activity.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# NetApp Data ONTAP Cluster-Mode Activity Auditing Configuration
-The Activity Monitor agent employed to monitor NetApp leverages NetApp ONTAP API, and the NetApp
+The Activity Monitor agent employed to monitor NetApp uses NetApp ONTAP API, and the NetApp
FPolicy framework to monitor file system events. This includes both NetApp 7-Mode and Cluster-Mode
configurations. For more information about FPolicy read the
[What are the two parts of the FPolicy solution ](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html)
@@ -25,17 +25,17 @@ list of volumes, list of LIFs. Depending on the configuration, the agent can als
of FPolicy to ensure it is enabled; configure FPolicy and register or unregister itself.
The FPolicy framework enables the collection of audit events on the ONTAP side and their transfer to
-the agent(s) via the designated Data LIFs. Each LIF establishes its own connection with one or
+the agents via the designated Data LIFs. Each LIF establishes its own connection with one or
several agents and sends notifications as soon as the file transaction occurs. The FPolicy
connection is asynchronous and buffered; both ONTAP and Activity Monitor have techniques in place to
-make sure that connections are alive and working. The connection can be secured using TLS with
+ensure that connections are alive and working. The connection can be secured using TLS with
server or mutual authentication.
FPolicy may have a significant impact on file system throughput, and it is always a best practice to
monitor performance when enabling FPolicy.
:::info
-Create a tailored FPolicy which only collects the desired activity from the
+Create a tailored FPolicy which only collects the activity you want from the
environment to limit the scope and impact.
:::
@@ -43,13 +43,13 @@ environment to limit the scope and impact.
For scale-out and fault tolerance purposes, the product supports a range of deployment options. A
single agent can receive events from multiple SVMs. Or events from a single SVM can be distributed
among multiple agents. Or a set of SVMs can distribute events among a set of agents. The choice
-depends on the fault tolerance requirements and the expected event flow. As a rule of thumb, the
-_average_ load on a single agent should not exceed 5000 events per second.
+depends on the fault tolerance requirements and the expected event flow. As a guideline, the
+_average_ load on a single agent shouldn't exceed 5000 events per second.
Starting with ONTAP 9.15.1, the FPolicy Persistent Store provides resilience and predictable latency
during scenarios such as network delays or bursts of activity. The feature uses a dedicated volume
for each SVM as a staging buffer before events are sent to the agent. FPolicy will automatically
-create a volume if one does not already exist.
+create a volume if one doesn't already exist.
:::info
Enable the Persistent Store feature and allow it to create a volume
@@ -59,7 +59,7 @@ automatically.
## Configuration Checklist
-Complete the following checklist prior to configuring the activity monitoring of NetApp Data ONTAP
+Complete the following checklist before configuring the activity monitoring of NetApp Data ONTAP
Cluster-Mode devices. Instructions for each item of the checklist are detailed within the following
sections.
@@ -67,10 +67,10 @@ sections.
- Gather the following information:
- - Names of the SVM(s) to be monitored
+ - Names of the SVMs to be monitored
- FPolicy is configured for each SVM separately
- - This should be the SVM(s) hosting the CIFS or NFS shares(s) to be monitored
+ - This should be the SVMs hosting the CIFS or NFS sharess to be monitored
- Credentials to access ONTAP to provision a role and account.
- Desired functionality level:
@@ -91,7 +91,7 @@ sections.
- Limiting the FPolicy to specific file operations is an effective way to limit the
performance impact of FPolicy
- - IP Address of the server(s) where the Activity Monitor Agent is deployed
+ - IP Address of the servers where the Activity Monitor Agent is deployed
- API enabled in ONTAP: the classic ONTAPI/ZAPI or the new REST API
- The product supports the REST API for ONTAP 9.13.1 and above.
@@ -218,9 +218,9 @@ Monitor Agent.
- It monitors file system activity on all volumes and shares of the SVM.
- FPolicy configuration is automatically updated to reflect the Activity Monitor
configuration.
- - Requires a Privileged Access credential be provided.
+ - Requires you to provide a Privileged Access credential.
-- Enable the Persistent Store to increase the resilience and control the latency in case of network
+- Enable the Persistent Store to increase the resilience and control the latency during network
outages or bursts of activity
**Checklist Item 5: Activity Monitor Configuration**
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/configurefirewall.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/configurefirewall.md
index 1a2d7de662..77ac955971 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/configurefirewall.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/configurefirewall.md
@@ -30,11 +30,11 @@ Monitor.
Both classic ONTAPI/ZAPI and the new REST API are supported. Starting with ONTAP 9.13.1, the product
uses REST API by default if it is available. HTTP and HTTPS protocols are supported. For HTTPS, two
-modes are supported: strict and ignore errors. For the strict mode, the product allows you to
-disable the host name validation in case the agent cannot resolve the FQDN of the LIF.
+modes are supported: strict and ignore errors. For the strict mode, you can
+disable the host name validation if the agent can't resolve the FQDN of the LIF.
Enabling the API access varies depending on ONTAP version. The following sections list common steps
-on enabling the API access. Please refer to the NetApp documentation for more details.
+on enabling the API access. refer to the NetApp documentation for more details.
### Management-http Service
@@ -74,7 +74,7 @@ network interface service-policy add-service -service management-https -policy d
### Firewall Policy
-For ONTAP 9.5 and older, the following commands can be used to either create a new firewall policy
+For ONTAP 9.5 and older, use the following commands to either create a new firewall policy
or modify an existing policy if ONTAPI is blocked.
#### Create New Firewall HTTP Policy
@@ -148,15 +148,15 @@ Verify that the output is displayed as follows:
## FPolicy
The FPolicy framework enables the collection of audit events on the ONTAP side and their transfer to
-the agent(s) via the designated Data LIFs. Each LIF establishes its own connection with one or
+the agents via the designated Data LIFs. Each LIF establishes its own connection with one or
several agents and sends notifications as soon as the file transaction occurs. The FPolicy
connection is asynchronous and buffered; both ONTAP and Activity Monitor have techniques in place to
-make sure that connections are alive and working. The connection can be secured using TLS with
+ensure that connections are alive and working. The connection can be secured using TLS with
server or mutual authentication.
ONTAP cluster nodes connect to the agent on port 9999 by default. The port can be changed in the
-agent's settings. The agent adds this port to Windows Firewall exclusions automatically. Please
-ensure the port is not blocked by other firewalls between ONTAP and the agent.
+agent's settings. The agent adds this port to Windows Firewall exclusions automatically. Ensure the
+port isn't blocked by other firewalls between ONTAP and the agent.
### Data-fpolicy-client Service
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/configurefpolicy.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/configurefpolicy.md
index 0e1fea0f40..5c3763e845 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/configurefpolicy.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/configurefpolicy.md
@@ -13,11 +13,11 @@ There are two ways to configure FPolicy:
- Activity Monitor agent can facilitate the
[Automatic Configuration of FPolicy](#automatic-configuration-of-fpolicy) for the monitored SVM
- using the ONTAP API. This mode is simple, but does not allow you to exclude certain volumes or
+ using the ONTAP API. This mode is simple, but you can't exclude certain volumes or
shares of the SVM from being monitored. It also requires additional permissions to create and
modify FPolicy.
-- Another option is to [Manually Configure FPolicy](#manually-configure-fpolicy) for each SVM. This
- mode allows you to fine tune FPolicy by excluding certain volumes or shares from being monitored.
+- Another option is to [Manually Configure FPolicy](#manually-configure-fpolicy) for each SVM. With
+ this mode, you can fine-tune FPolicy by excluding certain volumes or shares from being monitored.
It also reduces product permissions.
Regardless of the FPolicy configuration approach, perform extra steps if you need to secure FPolicy
@@ -78,9 +78,9 @@ locally on the Activity Monitor Console server.
### Create PEM File for Client Certificate
-A certificate (Client Certificate) for the SVM needs to be copied to a PEM file. This is required
-for the TLS, mutual authentication option. Follow the steps to create the PEM file for the Client
-Certificate.
+Copy a certificate (Client Certificate) for the SVM to a PEM file. This certificate is required
+for the TLS, mutual authentication option. To create the PEM file for the Client
+Certificate:
**Step 1 –** On the SVM , use the following command to show the security certificate details:
@@ -95,8 +95,8 @@ security certificate show -vserver testserver -type server instance
```
**Step 2 –** Copy the security certificate details into a text file and copy the public key to a PEM
-file. The following variables from security details will be needed to set mutual-authentication
-during Part 6 of manual configuration and prior to automatic configuration:
+file. You need the following variables from the security details to set mutual-authentication
+during Part 6 of manual configuration and before automatic configuration:
- SVM
- Common Name
@@ -117,7 +117,7 @@ dedicated volume for each SVM as a staging buffer before events are sent to the
Persistent Store requires the following parameters:
-- Volume name – If the volume does not exist, it will be created automatically (recommended).
+- Volume name – If the volume doesn't exist, it will be created automatically (recommended).
- Initial volume size – Specifies the starting size of the volume.
- Autosize mode – Options include Off, Grow, or Grow/Shrink.
@@ -141,7 +141,7 @@ To check that the SVM has assigned local tiers, use the following command:
**vserver show -vserver [SVM_NAME] -fields aggr-list**
-The command shows currently local tiers. If no tiers are assigned, "-" is displayed.
+The command shows local tiers. If no tiers are assigned, "-" is displayed.
To assign local tiers to the SVM use the following command:
@@ -161,7 +161,7 @@ the directory structure, and protects it from accidental deletion by marking it
If you choose to create the volume manually, ensure the following:
-- The volume is not mounted and has no junction point.
+- The volume isn't mounted and has no junction point.
- The snapshot policy for the volume is set to none.
For additional and up-to-date recommendations on volumes for the Persistent Store, refer to the
@@ -170,8 +170,8 @@ NetApp documentation.
## Manually Configure FPolicy
This section describes how to manually configure FPolicy. Use manual configuration when you need to
-scope the policy to monitor specific volumes or shares. It is necessary to
-create several FPolicy components and then enable the FPolicy. See the sections corresponding to
+scope the policy to monitor specific volumes or shares. Create several FPolicy components and then
+enable the FPolicy. See the sections corresponding to
each part of this list:
- Part 1: Install Server Certificate on the SVM (only if using TLS authentication)
@@ -185,7 +185,7 @@ each part of this list:
- Part 3: Create FPolicy Events
- - An FPolicy event defines which protocol(s) to monitor and which file access events to monitor.
+ - An FPolicy event defines which protocols to monitor and which file access events to monitor.
- Part 4: Create Persistent Store (only if Persistent Store is used. RECOMMENDED)
@@ -211,7 +211,7 @@ each part of this list:
- Part 8: Enable the FPolicy
- - Once the FPolicy is enabled, the Activity Monitor Agent can be configured to monitor the SVM.
+ - After the FPolicy is enabled, the Activity Monitor Agent can be configured to monitor the SVM.
- Part 9: Connect FPolicy Server / Agent to Cluster Node (optional)
@@ -266,7 +266,7 @@ IMPORTANT:
- The following values are required:
- `engine-name StealthAUDITEngine`, the names of the external engine object can be customized
- (see below).
+ (see [Customization of FPolicy Object Names](#customization-of-fpolicy-object-names)).
- `port 9999`, Port number can be customized, but it is recommended to use 9999.
- `extern-engine-type asynchronous`
- `ssl-option no-auth`
@@ -377,7 +377,7 @@ IMPORTANT:
- `read` – File read operations
- `first-read` – Limits notification to only first read operations for CIFS protocol. For
- ONTAP 9.2+, this filter can be used for both CIFS and NFS protocols.
+ ONTAP 9.2+, use this filter for both CIFS and NFS protocols.
- `rename`– File rename operations
- `rename_dir`– Directory rename operations
@@ -409,7 +409,7 @@ IMPORTANT:
- `write` – File write operations
- `first-write` – Limits notification to only first write operations for CIFS protocol. For
- ONTAP 9.2+, this filter can be used for both CIFS and NFS protocols.
+ ONTAP 9.2+, use this filter for both CIFS and NFS protocols.
- For failed/denied events, the list of supported file operations is limited to the following
values:
@@ -531,7 +531,7 @@ IMPORTANT:
- `volume` – The name of the volume used for event storage.
- - If the volume does not exist, it will be automatically created on an assigned local tier.
+ - If the volume doesn't exist, it will be automatically created on an assigned local tier.
This is recommended.
- `size` – The initial size of the volume. The format is `[KB|MB|GB]`.
@@ -691,10 +691,10 @@ with an asterisk (\*).
IMPORTANT:
- The SVM used must be the SVM hosting the CIFS or NFS shares to be monitored.
-- It is not necessary to specify both volumes and shares. One or the other is sufficient.
+- It isn't necessary to specify both volumes and shares. One or the other is sufficient.
- If you want to monitor everything, set the "`volumes-to-include`" value to "`*`".
-Use the following command to create the FPolicy scope by specifying volume(s):
+Use the following command to create the FPolicy scope by specifying volumes:
```
vserver fpolicy policy scope create -vserver [SVM_NAME] -policy-name StealthAUDIT -volumes-to-include [VOLUME_NAME],[VOLUME_NAME]
@@ -706,7 +706,7 @@ Example:
vserver fpolicy policy scope create -vserver testserver -policy-name StealthAUDIT -volumes-to-include samplevolume1,samplevolume2
```
-Use the following command to create the FPolicy scope by specifying share(s):
+Use the following command to create the FPolicy scope by specifying shares:
```
vserver fpolicy policy scope create -vserver [SVM_NAME] -policy-name StealthAUDIT -shares-to-include [SHARE_NAME],[SHARE_NAME]
@@ -876,7 +876,7 @@ Starting ONTAP 9.15.1 and later versions, it is recommended to enable the Persis
that stores events on disk before they are sent to the Activity Monitor Agent. This reduces
client-side latency and increases resilience during network delays or bursts of activity. To enable
the Persistent Store, specify a volume name and size on the Persistent Store tab of the FPolicy page
-in the monitored host properties. The volume will be automatically created if it does not already
+in the monitored host properties. The volume will be automatically created if it doesn't already
exist. See the [Persistent Store](#persistent-store) topic for additional information on the
recommended volume size.
@@ -926,6 +926,6 @@ These names can be customized in the monitored host's settings in the Activity M
useful in two scenarios:
- You want the names to match the company policies;
-- You want to configure FPolicy manually using your custom names, but also want to leverage the
+- You want to configure FPolicy manually using your custom names, but also want to use the
"Enable and Connect FPolicy" feature of the Activity Monitor, so that the product ensures that
FPolicy stays enabled and connected at all times.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/provisionactivity.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/provisionactivity.md
index a06458469c..c5ec9592ea 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/provisionactivity.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/provisionactivity.md
@@ -26,7 +26,7 @@ The permissions needed depends on the functionality level:
- Least Privileged: ONLY Collect Events – This is the minimal functionality level. A user manually
configures FPolicy and ensures that it stays enabled and connected. The product only collects
- events. This functionality level is not recommended as it requires an additional solution that
+ events. This functionality level isn't recommended as it requires an additional solution that
tracks the state of FPolicy and fixes the problem should ONTAP disconnect or should the policy
become disabled.
- **_RECOMMENDED:_** Less Privileged: Enable/Connect Policy & Collect Events – With this level, the
@@ -41,8 +41,8 @@ Part 2. See the
[Validate Part 1: Security Role Configuration](#validate-part-1-security-role-configuration) topic
for additional information.
-If the FPolicy is to be used for both the Activity Monitor and Access Analyzer, the account also
-needs to be provisioned with an additional permission. See the
+If you plan to use FPolicy for both the Activity Monitor and Access Analyzer, provision the account
+with an additional permission. See the
[Access Analyzer Integration](#access-analyzer-integration) topic for additional information.
The commands to create a role and names of permissions depend on the ONTAP API used. The product
@@ -105,7 +105,7 @@ security login rest-role create -role enterpriseauditorrest -api "/api/svm/svms"
```
:::note
-If the FPolicy account is configured with these permissions, it is necessary to manually
+If the FPolicy account is configured with these permissions, manually
configure the FPolicy. See the [Configure FPolicy](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/configurefpolicy.md) topic for additional
information.
:::
@@ -129,7 +129,7 @@ permissions to collect events:
:::tip
Remember, this permission permits the Activity Monitor to enable the FPolicy. If the “Enable
- and connect FPolicy” option is employed but the permission is not provided, the agent will
+ and connect FPolicy” option is employed but the permission isn't provided, the agent will
encounter “Failed to enable policy” errors, but it will still be able to connect to the FPolicy.
Since this permission model requires a manual configuration of the FPolicy, then the need to
manually enable the FPolicy will be met.
@@ -194,7 +194,7 @@ security login rest-role create -role enterpriseauditorrest -api "/api/protocols
```
:::note
-If the FPolicy account is configured with these permissions, it is necessary to manually
+If the FPolicy account is configured with these permissions, manually
configure the FPolicy. See the [Configure FPolicy](/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/activity/configurefpolicy.md) topic for additional
information.
:::
@@ -342,7 +342,7 @@ article.
## Part 2: Create Security Login
-Once the access control role has been created, apply it to a domain account. Ensure the following
+After the access control role is created, apply it to a domain account. Ensure the following
requirements are met:
- The SVM used in the following command must be the same SVM used when creating the access control
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/overview.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/overview.md
index 16dd962e83..96e3407364 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/netappcmode/overview.md
@@ -132,7 +132,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
@@ -151,7 +151,7 @@ Agent server and the target NetApp Data ONTAP Cluster-Mode device:
Activity Monitor.
:::note
-If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
+If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
device must be configured manually. Also, the External Engine will not reconnect automatically in
the case of a server reboot or service restart.
:::
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nutanix/access.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nutanix/access.md
index 6483fe3c3e..01a52aed2c 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nutanix/access.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nutanix/access.md
@@ -11,7 +11,7 @@ Admin: Backup Access only** role assigned.
## Nutanix Prism Central Interface
-Follow the steps to configure the required account in the Nutanix Prism Central Interface.
+To configure the required account in the Nutanix Prism Central Interface:
**Step 1 –** Select the **Home** dropdown and select **File Server**.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nutanix/activity.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nutanix/activity.md
index 4e77226158..d9f6bab55f 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nutanix/activity.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nutanix/activity.md
@@ -12,7 +12,7 @@ A user having REST API access must be created on the Nutanix Files server to mon
server using Activity Monitor. Additional configurations are done automatically by Activity Monitor
using the Nutanix API with the help of this user.
-Follow the steps to create a new user account with Nutanix Prism:
+## Create a new user account with Nutanix Prism
**Step 1 –** Open Nutanix Prism web portal.
@@ -37,7 +37,7 @@ Monitor.
:::note
-Nutanix Files does not report events for activity originating from a server where the
+Nutanix Files doesn't report events for activity originating from a server where the
Activity Monitor Agent is installed.
:::
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nutanix/overview.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nutanix/overview.md
index 096d93ef24..74d8ff0368 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nutanix/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/nutanix/overview.md
@@ -53,7 +53,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/qumulo/activity.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/qumulo/activity.md
index 28cc36243e..171dd6cde1 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/qumulo/activity.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/qumulo/activity.md
@@ -7,8 +7,7 @@ sidebar_position: 10
# Qumulo Activity Auditing Configuration
The Netwrix Activity Monitor can be configured to monitor activity on Qumulo devices. To prepare
-Qumulo to be monitored, an account needs to be provisioned and the audit event format may need to be
-modified.
+Qumulo for monitoring, provision an account and modify the audit event format if needed.
## Provision Account
@@ -19,7 +18,7 @@ steps to create a new account in the Qumulo web user interface with the Observer
**Step 2 –** Assign the Observers role to the user using **Cluster** > **Role Management**.
-This credential will then be used when configuring the Activity Agent to monitor the Qumulo device.
+Use this credential when configuring the Activity Agent to monitor the Qumulo device.
## Verify Audit Event Format
@@ -32,7 +31,7 @@ advanced filtering of Microsoft Office activity also requires the JSON format.
The JSON format for audit events was introduced in Qumulo Core 6.0.1. The new format can be enabled
via an SSH session to the Qumulo cluster.
-Follow the steps to verify that audit event format and change the format, if needed.
+Verify the audit event format and change it, if needed:
**Step 1 –** Connect to the Qumulo cluster with SSH.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/qumulo/overview.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/qumulo/overview.md
index 76f37aade5..672f01673c 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/qumulo/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/qumulo/overview.md
@@ -50,7 +50,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/windowsfile/access.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/windowsfile/access.md
index b74fcf9d87..8af8374f9d 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/windowsfile/access.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/windowsfile/access.md
@@ -17,7 +17,7 @@ Namespaces.
## Windows File System (Standard)
-Configure the credential(s) with the following rights on the Windows host(s):
+Configure the credentials with the following rights on the Windows hosts:
- Granted the "Network access: Restrict clients allowed to make remote calls to SAM" Local Policies > Security Options privilege
- Granted the “Backup files and directories” local policy privilege
@@ -30,11 +30,11 @@ Configure the credential(s) with the following rights on the Windows host(s):
- Local Administrators
- Granted the “Log on as a batch” privilege
- Remote Registry service must be enabled on the host where the applet is deployed (Applet or Proxy w/ Applet scans) to determine the system platform and where to deploy the applet.
- - The local policy, “Network access: Do not allow storage of passwords and credentials for network authentication” must be disabled in order for the applet to start.
+ - The local policy, “Network access: Don't allow storage of passwords and credentials for network authentication” must be disabled in order for the applet to start.
- Sensitive Data Discovery Auditing scans require .NET Framework 4.7.2 or later to be installed on the server where the applet is to be deployed in order for Sensitive Data Discovery collections to successfully occur.
:::note
-In order to collect data on administrative shares and local policies (logon policies) for a Windows target, the credential must have group membership in the local Administrators group.
+to collect data on administrative shares and local policies (logon policies) for a Windows target, the credential must have group membership in the local Administrators group.
:::
## Windows File System Clusters
@@ -43,7 +43,7 @@ The permissions necessary to collect file system data from a Windows File System
for all nodes that comprise the cluster.
:::note
-It is necessary to target the Windows Cluster File Server Role Server (name clients connect to) of interest when running a File System scan against a Windows File System Cluster.
+Target the Windows Cluster File Server Role Server (name clients connect to) of interest when running a File System scan against a Windows File System Cluster.
:::
Configure credentials on all cluster nodes according to the Windows File System (Standard) permissions, with the following additional requirements:
@@ -54,7 +54,7 @@ Configure credentials on all cluster nodes according to the Windows File System
### Host List Considerations
-It is necessary to target the Windows File Server Cluster (name of the cluster) of interest when running a File System scan against a Windows File System Cluster. Within the Master Host Table, there should be a host entry for the cluster as well as for each node. Additionally, each of these host entries must have the name of the cluster in the `WinCluster` column in the host inventory data. This may need to be updated manually.
+Target the Windows File Server Cluster (name of the cluster) of interest when running a File System scan against a Windows File System Cluster. Within the Master Host Table, there should be a host entry for the cluster as well as for each node. Additionally, each of these host entries must have the name of the cluster in the `WinCluster` column in the host inventory data. This may need to be updated manually.
See the View/Edit section of the [Host Management Activities](https://docs.netwrix.com/docs/accessanalyzer/12_0/admin/hostmanagement/actions/overview) topic for additional information on host inventory.
@@ -62,7 +62,7 @@ See the View/Edit section of the [Host Management Activities](https://docs.netwr
The host targeted by the File System scans is only the host entry for the cluster. For example:
-The environment has a Windows File System Cluster named `ExampleCluster1` with three nodes named `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. There would be four host entries in the Access Analyzer Master Host Table: `ExampleCluster1`, `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. Each of these four entries would have the same value of the cluster name in the `WinCluster` column: `ExampleCluster1`. An additional entry containing the File Server Role Server name(s) should also be added, including the WinCluster name of the nodes. **This File Server Role Server name will be our target host.**
+The environment has a Windows File System Cluster named `ExampleCluster1` with three nodes named `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. There would be four host entries in the Access Analyzer Master Host Table: `ExampleCluster1`, `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. Each of these four entries would have the same value of the cluster name in the `WinCluster` column: `ExampleCluster1`. An additional entry containing the File Server Role Server names should also be added, including the WinCluster name of the nodes. **This File Server Role Server name is the target host.**
### Least Privilege Permission Model for Windows Clusters
@@ -84,7 +84,7 @@ comprise the cluster:
The FileSystem > 0.Collection > 0-FSDFS System Scans Job is configured by default to target the
default domain controller for the domain in which Access Analyzer resides. This is the appropriate
target host for this job when targeting a domain-based namespace. To target a standalone namespace
-or multiple namespaces, create a custom host list of the server(s) hosting the namespace(s). Then
+or multiple namespaces, create a custom host list of the servers hosting the namespaces. Then
assign the custom host list to the 0-FSDFS System Scans Job. No additional host list is require for
the FileSystem > 0.Collection Job Group unless additional file servers are also being targeted.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/windowsfile/activity.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/windowsfile/activity.md
index 64ffdd9481..b1eb7b6535 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/windowsfile/activity.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/windowsfile/activity.md
@@ -10,7 +10,7 @@ In order for Netwrix Access Analyzer to collect and store Windows file server ac
## Windows File System (Standard)
-Configure the credential(s) with the following rights on the Windows host(s):
+Configure the credentials with the following rights on the Windows hosts:
- For **Local** or **Proxy as a Service Mode** Scans:
- Group membership in both of the following local groups:
@@ -21,7 +21,7 @@ Configure the credential(s) with the following rights on the Windows host(s):
- Local Administrators
- Granted the “Log on as a batch” privilege
- Remote Registry service must be enabled on the host where the applet is deployed (Applet or Proxy w/ Applet scans) to determine the system platform and where to deploy the applet.
- - The local policy, “Network access: Do not allow storage of passwords and credentials for network authentication” must be disabled in order for the applet to start.
+ - The local policy, “Network access: Don't allow storage of passwords and credentials for network authentication” must be disabled in order for the applet to start.
- Granted the "Network access: Restrict clients allowed to make remote calls to SAM" Local Policies > Security Options privilege
- Granted the “Backup files and directories” local policy privilege
- The service account in the credential profile requires access to the admin share (e.g. `C$`) where the `sbtfilemon.ini` file exists
@@ -29,10 +29,10 @@ Configure the credential(s) with the following rights on the Windows host(s):
## Windows File System Clusters
-In order to monitor a Windows File System Cluster, an Activity Agent needs to be deployed on all nodes that comprise the Windows File System Cluster.
+To monitor a Windows File System Cluster, deploy an Activity Agent on all nodes that comprise the cluster.
:::note
-It is necessary to target the Windows Cluster File Server Role Server (name clients connect to) when running a File System scan against a Windows File System Cluster.
+Target the Windows Cluster File Server Role Server (name clients connect to) when running a File System scan against a Windows File System Cluster.
:::
Configure credentials according to the Windows File System (Standard) permissions on all cluster nodes that comprise the cluster, with the following additional requirements:
@@ -43,7 +43,7 @@ Configure credentials according to the Windows File System (Standard) permission
### Host List Considerations
-It is necessary to target the Windows File Server Cluster (name of the cluster) of interest when running a File System scan against a Windows File System Cluster. Within the Master Host Table, there should be a host entry for the cluster as well as for each node. Additionally, each of these host entries must have the name of the cluster in the `WinCluster` column in the host inventory data. This may need to be updated manually.
+Target the Windows File Server Cluster (name of the cluster) of interest when running a File System scan against a Windows File System Cluster. Within the Master Host Table, there should be a host entry for the cluster as well as for each node. Additionally, each of these host entries must have the name of the cluster in the `WinCluster` column in the host inventory data. This may need to be updated manually.
See the View/Edit section of the [Host Management Activities](https://docs.netwrix.com/docs/accessanalyzer/12_0/admin/hostmanagement/actions/overview) topic for additional information on host inventory.
@@ -53,7 +53,7 @@ The host targeted by the File System scans is only the host entry for the cluste
:::note Example:
-The environment has a Windows File System Cluster named `ExampleCluster1` with three nodes named `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. There would be four host entries in the Access Analyzer Master Host Table: `ExampleCluster1`, `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. Each of these four entries would have the same value of the cluster name in the `WinCluster` column: `ExampleCluster1`. An additional entry containing the File Server Role Server name(s) should also be added, including the WinCluster name of the nodes. This File Server Role Server name will be our target host.
+The environment has a Windows File System Cluster named `ExampleCluster1` with three nodes named `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. There would be four host entries in the Access Analyzer Master Host Table: `ExampleCluster1`, `ExampleNodeA`, `ExampleNodeB`, and `ExampleNodeC`. Each of these four entries would have the same value of the cluster name in the `WinCluster` column: `ExampleCluster1`. An additional entry containing the File Server Role Server names should also be added, including the WinCluster name of the nodes. This File Server Role Server name is the target host.
:::
### Host Mapping
@@ -83,4 +83,4 @@ If a least privilege model is required by the organization, then the credential
* `HKEY_LOCAL_MACHINE\Cluster\Nodes`
* `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\SBTLogging\Parameters`
-Additionally, the credential must have READ access to the path where the activity log files are located.
\ No newline at end of file
+Additionally, the credential must have READ access to the path where the activity log files are located.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/windowsfile/overview.md b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/windowsfile/overview.md
index 6ba064a2da..1ea616697f 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/windowsfile/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/filesystems/windowsfile/overview.md
@@ -61,7 +61,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/applet-mode-scans/appletmodepermissions.md b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/applet-mode-scans/appletmodepermissions.md
index f50afaac10..4dea984329 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/applet-mode-scans/appletmodepermissions.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/applet-mode-scans/appletmodepermissions.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Applet Mode Permissions
-When File System scans are run in applet mode, it means the File System applet is deployed to the target host when the job is executed to conduct data collection. However, the applet can only be deployed to a server with a Windows operating system. The data is collected on the Windows target host where the applet is deployed. The final step in data collection is to compress and transfer the data collected in the SQLite database(s), or Tier 2 database(s), back to the Access Analyzer Console server. If the target host is a NAS device, the File System scans will default to local mode for that host.
+When File System scans are run in applet mode, it means the File System applet is deployed to the target host when the job is executed to conduct data collection. However, the applet can only be deployed to a server with a Windows operating system. The data is collected on the Windows target host where the applet is deployed. The final step in data collection is to compress and transfer the data collected in the SQLite databases, or Tier 2 databases, back to the Access Analyzer Console server. If the target host is a NAS device, the File System scans will default to local mode for that host.
Additionally, the credential must have `WRITE` access to the `…\StealthAUDIT\FSAA` folder in the installation directory on the target host/proxy server as well as on the Access Analyzer Console server. This is required by either the user account running the Access Analyzer application, when manually executing jobs within the console, or the Schedule Service Account assigned within Access Analyzer, when running jobs as a scheduled tasks.
@@ -21,7 +21,7 @@ the applet.
:::
:::warning
-The local policy, “Network access: Do not allow storage of passwords and credentials
+The local policy, “Network access: Don't allow storage of passwords and credentials
for network authentication” must be disabled in order for the applet to start.
:::
@@ -37,8 +37,8 @@ By default, the Applet will run as the connection profile account unless an addi
The account used in the connection profile associated with the File System scan jobs, should have the appropriate permissions required to access the target host. See the [File System Supported Platforms](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/) page for specific requirements per target file system.
-## How do I determine if I’m using Applet Mode scanning?
+## Determine whether you're using Applet Mode scanning
The best way to verify if you’re using Applet Mode scanning is via the FSAA Data Collector Query Settings > [Scan Server Selection](https://docs.netwrix.com/docs/accessanalyzer/12_0/admin/datacollector/fsaa/scanserverselection) page:
-- **Automatic** — If the target host being scanned is a Windows host, NEA will deploy for FS scanning.
\ No newline at end of file
+- **Automatic** — If the target host being scanned is a Windows host, NEA will deploy for FS scanning.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/applet-mode-scans/appletmodeports.md b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/applet-mode-scans/appletmodeports.md
index ff440b76b5..e2bf98e386 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/applet-mode-scans/appletmodeports.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/applet-mode-scans/appletmodeports.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Applet Mode Port Requirements
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
+The following firewall settings are required when executing the Access Auditing (FSAA)
and/or Sensitive Data Discovery Auditing scans in applet mode for communication between Access
Analyzer and the host:
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/local-mode-scans/localmodepermissions.md b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/local-mode-scans/localmodepermissions.md
index fdad7eebc1..372539eda3 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/local-mode-scans/localmodepermissions.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/local-mode-scans/localmodepermissions.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Local Mode Permissions
-When File System scans are run in local mode, it means all of the data collection processing is conducted by the Access Analyzer Console server across the network. The data is collected in the SQLite database(s), or Tier 2 database(s), on the Access Analyzer Console server, and then imported into the Access Analyzer database, or Tier 1 database, on the SQL Server.
+When File System scans are run in local mode, it means all of the data collection processing is conducted by the Access Analyzer Console server across the network. The data is collected in the SQLite databases, or Tier 2 databases, on the Access Analyzer Console server, and then imported into the Access Analyzer database, or Tier 1 database, on the SQL Server.
The account used to run either a manual execution or a scheduled execution of the File System scans, must have the following permissions on the Access Analyzer Console server:
@@ -19,7 +19,7 @@ The account used to run either a manual execution or a scheduled execution of th
Additionally, the credential must have `WRITE` access to the `…\StealthAUDIT\FSAA` folder in the installation directory on the Access Analyzer Console server. This is required by either the user account running the Access Analyzer application, when manually executing jobs within the console, or the Schedule Service Account assigned within Access Analyzer, when running jobs as a scheduled tasks.
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By default, SDD scans are configured to run two concurrent threads. For example, if the job is configured to scan 8 hosts at a time with two concurrent SDD threads, then an extra 32 GB of RAM are required (8x2x2=32).
+If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By default, SDD scans are configured to run two concurrent threads. For example, if the job is configured to scan 8 hosts at a time with two concurrent SDD threads, then an extra 32 GB of RAM are required (8x2x2=32).
Firewall rules must be configured to allow for communication between the applicable servers. See the [Local Mode Port Requirements](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/scanoptions/local-mode-scans/localmodeports) topic for firewall rule information.
@@ -32,9 +32,9 @@ See the [Local Mode Port Requirements](/docs/accessanalyzer/12.0/requirements/fi
The account used in the connection profile associated with the File System scan jobs, should have the appropriate permissions required to access the target host. See the [File System Supported Platforms](https://docs.netwrix.com/docs/accessanalyzer/12_0/requirements/filesystem/filesystems/) page for specific requirements per target file system.
-## How do I determine if I’m using Local Mode scanning?
+## Determine whether you're using Local Mode scanning
The best way to verify if you’re using Local Mode scanning is via the FSAA Data Collector Query Settings > [Scan Server Selection](https://docs.netwrix.com/docs/accessanalyzer/12_0/admin/datacollector/fsaa/scanserverselection) page:
-- **Automatic** — If the target host being scanned is a NAS/Non-Windows host, a Local Mode scan will be utilized.
-- **Local Server** — This will utilize a Local Mode scan, regardless of the OSType of the target host.
\ No newline at end of file
+- **Automatic** — If the target host being scanned is a NAS/Non-Windows host, a Local Mode scan will be used.
+- **Local Server** — This will use a Local Mode scan, regardless of the OSType of the target host.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/local-mode-scans/localmodeports.md b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/local-mode-scans/localmodeports.md
index 339a712512..672f9650fa 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/local-mode-scans/localmodeports.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/local-mode-scans/localmodeports.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Local Mode Port Requirements
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
+The following firewall settings are required when executing the Access Auditing (FSAA)
and/or Sensitive Data Discovery Auditing scans in local mode for communication between Access
Analyzer and the target host:
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/as-a-service/proxymodeservicepermissions.md b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/as-a-service/proxymodeservicepermissions.md
index 638c395cb4..daa0d20d4c 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/as-a-service/proxymodeservicepermissions.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/as-a-service/proxymodeservicepermissions.md
@@ -53,7 +53,7 @@ rule information.
- Console ↔ Proxy: **NAA** **Computer Account (Kerberos)**
- Target Access (Proxy ↔ Targets): Connection Profile Account
:::note
-If the service is deployed by the File System Scan job (as opposed to manually installed), the account used by the connection profile will be used to run the FSAA Proxy Service unless **Run service as Local System** is checked on the Applet Settings page of the job query. Alternatively, you can add a credential to the connection profile using either **Task (Local)** or **Task (Domain)** to run the service.
+If the File System Scan job deploys the service (as opposed to a manual installation), the FSAA Proxy Service runs using the connection profile account unless you select **Run service as Local System** on the Applet Settings page of the job query. Alternatively, you can add a credential to the connection profile using either **Task (Local)** or **Task (Domain)** to run the service.
If the target host resides in a different domain than the proxy server and there is no trust relationship between the two domains, you must stack a task credential for the proxy domain with the credential for scanning the target file system.
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/as-a-service/proxymodeserviceports.md b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/as-a-service/proxymodeserviceports.md
index d273ae4d88..e20e55532e 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/as-a-service/proxymodeserviceports.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/as-a-service/proxymodeserviceports.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Proxy Mode as a Service Port Requirements
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
+The following firewall settings are required when executing the Access Auditing (FSAA)
and/or Sensitive Data Discovery Auditing scans in proxy mode as a service for communication between
Access Analyzer and the proxy server:
@@ -22,7 +22,7 @@ Data Collector Wizard.
:::
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
+The following firewall settings are required when executing the Access Auditing (FSAA)
and/or Sensitive Data Discovery Auditing scans in proxy mode as a service for communication between
the proxy server and the target host:
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/proxymodeserver.md b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/proxymodeserver.md
index 773449ce98..d8dcb2a390 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/proxymodeserver.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/proxymodeserver.md
@@ -27,8 +27,8 @@ The server can be physical or virtual. The requirements for Access Analyzer are:
RAM, CPU, and Disk Space are dependent upon the size of the target environment:
:::warning
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
-minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. By
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each
+thread requires a minimum of 2 additional GB of RAM per host. By
default, SDD scans are configured to run two concurrent threads. For example, if the job is
configured to scan 8 hosts at a time with two concurrent SDD threads, then an extra 32 GB of RAM are
required (8x2x2=32).
@@ -65,19 +65,19 @@ required (8x2x2=32).
- 2 CPU Cores
- 130 GB Disk Space
-The above recommended disk space sizing information is based on the needs of Access Analyzer as well
-as the File System solution for running Permission scans with out of the box configuration (500 MB
+This recommended disk space sizing information is based on the needs of Access Analyzer as well
+as the File System solution for running Permission scans with the default configuration (500 MB
per million files and folders), that means no tag collection, file-level scanning, activity, or
sensitive data.
-- For tag collection, add 125 MB per million documents to the totals above
+- For tag collection, add 125 MB per million documents to the preceding totals
- For activity collection, add 250 MB per million files and folders and another 125 MB per million
- activity events to the totals above
+ activity events to the preceding totals
- For sensitive data collection, add 500 MB per million files and folders and another 1%-10% of the
total size of the documents scanned for sensitive data (depending on targeted document types and
- selected criteria) to the totals above
+ selected criteria) to the preceding totals
-For example, in order to scan 200 million files and folders, of which 10 million files will be
+For example, to scan 200 million files and folders, of which 10 million files will be
scanned for tag collection and sensitive data with a total size of 6 TB, you would need: 160 GB for
permission collection + 1.25 GB for tag collection (10x125 MB) + 100 GB for sensitive data
collection (200x500 MB) + 600 GB additional for sensitive data collection (10% of 6 TB) = 861.25 GB
@@ -107,7 +107,7 @@ The following are additional requirements for the server:
**Sensitive Data Discovery Auditing**
The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the server. The JDK
-deployed is prepackaged and does not require any configuration. It will not conflict with other JDKs
+deployed is prepackaged and doesn't require any configuration. It will not conflict with other JDKs
or Java Runtimes in the same environment.
See the following topics for additional information, based on the type of proxy mode you plan to
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/with-applet/proxymodeappletpermissions.md b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/with-applet/proxymodeappletpermissions.md
index ab5c4aaa49..2cfe18fe5a 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/with-applet/proxymodeappletpermissions.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/with-applet/proxymodeappletpermissions.md
@@ -14,7 +14,7 @@ Configure the credentials with the following rights on the proxy servers:
- Granted the Backup files and directories local policy privilege
- Granted the Log on as a batch privilege
-Additionally, the credential must have `WRITE` access to the `…\StealthAUDIT\FSAA` folder in the installation directory on the proxy server as well as on the Access Analyzer Console server. This is required by either the user account running the Access Analyzer application, when manually executing jobs within the console, or the Schedule Service Account assigned within Access Analyzer, when running jobs as a scheduled tasks.
+Additionally, the credential must have `WRITE` access to the `…\StealthAUDIT\FSAA` folder in the installation directory on the proxy server as well as on the Access Analyzer Console server. Whichever account runs the job needs this access — either the user account running the Access Analyzer application, when you execute jobs manually within the console, or the Schedule Service Account assigned within Access Analyzer, when jobs run as scheduled tasks.
:::tip
Remember, Remote Registry Service must be enabled on the host where the applet is deployed (for
@@ -29,9 +29,8 @@ for network authentication” must be disabled for the applet to start.
:::
-Sensitive Data Discovery Auditing scans require .NET Framework 4.7.2 or later to be installed on the
-server where the applet is to be deployed in order for Sensitive Data Discovery collections to
-successfully occur.
+Sensitive Data Discovery Auditing scans require .NET Framework 4.7.2 or later on the server where
+the applet is deployed.
See the [Proxy Mode with Applet Port Requirements](/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/with-applet/proxymodeappletports.md) topic for firewall rule
@@ -40,14 +39,14 @@ information.
**Secure Proxy Communication Considerations**
For Proxy Mode with Applet scans, the certificate exchange mechanism and certificate exchange port
-must be configured via the File System Access Auditing Data Collector Wizard before executing a
-scan. See the
+must be configured via the File System Access Auditing (FSAA) Data Collector Wizard before executing
+a scan. See the
[FSAA Applet Certificate Management Overview](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/certificatemanagement/certificatemanagement.md)
topic for additional information.
## Accounts Used
- **Job Execution:** Scheduled Task or Console User (launches the job)
-- Console ↔ Applet: **NAA** **Computer Account (Kerberos)**
+- Console ↔ Applet: **Netwrix Access Analyzer (NAA) Computer Account (Kerberos)**
- Target Access (Applet ↔ Targets): Connection Profile Account
:::note
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/with-applet/proxymodeappletports.md b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/with-applet/proxymodeappletports.md
index 7664a4b031..e1873c13a9 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/with-applet/proxymodeappletports.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/proxy-mode-scans/with-applet/proxymodeappletports.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# Proxy Mode with Applet Port Requirements
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
-and/or Sensitive Data Discovery Auditing scans in proxy mode with applet for communication between
-Access Analyzer and the proxy server:
+The following firewall settings are required for communication between Access Analyzer and the
+proxy server when running Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing scans in
+proxy mode with applet:
| Communication Direction | Protocol | Ports | Description |
| -------------------------------------------------------- | -------- | ----- | ---------------------------------------- |
@@ -23,9 +23,9 @@ Data Collector Wizard.
:::
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
-and/or Sensitive Data Discovery Auditing scans in proxy mode with applet for communication between
-the proxy server and the target host:
+The following firewall settings are required for communication between the proxy server and the
+target host when running Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing scans in
+proxy mode with applet:
| Communication Direction | Protocol | Ports | Description |
| ------------------------------------------ | -------- | ----- | ----------- |
diff --git a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/scanoptions.md b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/scanoptions.md
index 53dbfc47a1..c19aa5e6a6 100644
--- a/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/scanoptions.md
+++ b/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/scanoptions.md
@@ -6,21 +6,21 @@ sidebar_position: 10
# File System Scan Options
-Required permissions on the targeted file system are dependent upon not only the type of environment
-targeted but also the mode in which the data collection scan is executed. There are three primary
+Required permissions on the targeted file system depend on the type of environment targeted and the
+mode in which the data collection scan runs. There are three primary
types of scan modes: local, applet, or proxy. The proxy mode can be conducted via applet deployment,
or via running as a service (installed in advance).
-For the purpose of this document, “applet” refers to the runtime deployment of the
+To describe scan modes in this document, “applet” refers to the runtime deployment of the
`FSAAAppletServer.exe` to either the target host (applet mode scans) or the proxy host (proxy mode
-with applet scans) via Microsoft Task Scheduler. A “proxy” host is any host which can be leveraged
+with applet scans) via Microsoft Task Scheduler. A “proxy” host is any host you can use
for running File System scans against target hosts.
## Local Mode
When File System scans are run in local mode, it means all of the data collection processing is
conducted by the Access Analyzer Console server across the network. The data is collected in the
-SQLite database(s), or Tier 2 database(s), on the Access Analyzer Console server, and then imported
+SQLite databases, or Tier 2 databases, on the Access Analyzer Console server, and then imported
into the Access Analyzer database, or Tier 1 database, on the SQL Server.
@@ -35,7 +35,7 @@ See the following topics for additional information:
## Applet Mode
:::warning
-The local policy, “Network access: Do not allow storage of passwords and credentials
+The local policy, “Network access: Don't allow storage of passwords and credentials
for network authentication” must be disabled in order for the applet to start.
:::
@@ -44,7 +44,7 @@ When File System scans are run in applet mode, it means the File System applet i
target host when the job is executed to conduct data collection. However, the applet can only be
deployed to a server with a Windows operating system. The data is collected on the Windows target
host where the applet is deployed. The final step in data collection is to compress and transfer the
-data collected in the SQLite database(s), or Tier 2 database(s), back to the Access Analyzer Console
+data collected in the SQLite databases, or Tier 2 databases, back to the Access Analyzer Console
server. If the target host is a NAS device, the File System scans will default to local mode for
that host.
@@ -61,14 +61,14 @@ See the following topics for additional information:
## Proxy Mode with Applet
:::warning
-The local policy, “Network access: Do not allow storage of passwords and credentials
+The local policy, “Network access: Don't allow storage of passwords and credentials
for network authentication” must be disabled in order for the applet to start.
:::
When File System scans are run in proxy mode with applet, it means the File System applet is
deployed to the Windows proxy server when the job is executed to conduct data collection. The data
-collection processing is initiated by the proxy server where the applet is deployed and leverages a
+collection processing is initiated by the proxy server where the applet is deployed and uses a
local mode-type scan to each of the target hosts. The final step in data collection is to compress
and transfer the data collected in the SQLite databases, or Tier 2 databases, back to the Access
Analyzer Console server.
@@ -86,17 +86,17 @@ See the following topics for additional information:
## Proxy Mode as a Service
-When File System scans are run in proxy mode as a service, there are two methods available for
-deploying the service:
+When File System scans are run in proxy mode as a service, you can deploy the service in one of two
+ways:
- Pre-Installed File System Proxy Service – File System Proxy Service installation package must be
- installed on the Windows proxy servers prior to executing the scans. This is the recommended
+ installed on the Windows proxy servers before executing the scans. This is the recommended
method.
- Ad Hoc File System Proxy Service Deployment – File System Proxy Service is installed on the
Windows proxy server when the job is executed
The data collection processing is conducted by the proxy server where the service is running and
-leverages a local mode-type scan to each of the target hosts. The final step in data collection is
+uses a local mode-type scan to each of the target hosts. The final step in data collection is
to compress and transfer the data collected in the SQLite databases, or Tier 2 databases, back to
the Access Analyzer Console server.
diff --git a/docs/accessanalyzer/12.0/requirements/overview.md b/docs/accessanalyzer/12.0/requirements/overview.md
index ec1f7714c0..04f84dbeb5 100644
--- a/docs/accessanalyzer/12.0/requirements/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/overview.md
@@ -7,9 +7,8 @@ sidebar_position: 20
# Requirements
This topic describes the recommended configuration of the servers needed to install the application
-in a production environment. Depending on the size of the organization, it is recommended to review
-your environment and requirements with a Netwrix engineer prior to deployment to ensure all
-exceptions are covered.
+in a production environment. Depending on the size of your organization, review your environment
+and requirements with a Netwrix engineer before deployment to ensure all exceptions are covered.
## Architecture Overview
@@ -18,8 +17,8 @@ The following servers and applications are required for installation of the appl
**Core Components**
- Access Analyzer Console Server – This is where the v12.0 application is installed.
-- SQL Server for Access Analyzer Database – As a data-intensive application, a well-provisioned,
- dedicated SQL Server is recommended.
+- SQL Server for Access Analyzer Database – Because Access Analyzer is a data-intensive
+ application, use a well-provisioned, dedicated SQL Server for the database.
- Access Information Center Application Server – This application is typically installed on the
Access Analyzer Console server and is a browser-based, interactive dashboard for exploring
permissions, activity, and sensitive data.
@@ -37,10 +36,10 @@ The following servers and applications are required for installation of the appl
**File System Solution-Specific Components**
-- Access Analyzer File System Proxy Server – In certain environments, a proxy server may be utilized
- to scan hosts in remote or firewalled sites to increase scan capacity in large environments. This
- feature can be implemented through either an applet or a service. The applet would be deployed as
- part of the data collection process. The service should be installed prior to data collection. See
+- Access Analyzer File System Proxy Server – In certain environments, a proxy server can scan hosts
+ in remote or firewalled sites to increase scan capacity in large environments. You can implement
+ this feature through either an applet or a service: the applet deploys as part of the data
+ collection process, and you install the service before data collection. See
the [Proxy Mode as a Service](/docs/accessanalyzer/12.0/requirements/filesystem/scanoptions/scanoptions.md#proxy-mode-as-a-service) topic
for server requirements.
@@ -48,7 +47,7 @@ The following servers and applications are required for installation of the appl
- Access Analyzer SharePoint Agent Server – For agent-based scans, this application can be installed
on the SharePoint application server that hosts the “Central Administration” component of the
- targeted farm(s) to auditing permissions, content, and sensitive data for SharePoint On-Premise.
+ targeted farms to auditing permissions, content, and sensitive data for SharePoint On-Premise.
See the [SharePoint Scan Options](/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/scanoptions.md) topic for server
requirements.
@@ -66,8 +65,8 @@ The following servers and applications are required for installation of the appl
**Target Environment Considerations**
-The target environment encompasses all servers, devices, or infrastructure to be audited by Access
-Analyzer. Most solutions have additional target requirements.
+The target environment encompasses all servers, devices, or infrastructure that Access Analyzer
+audits. Most solutions have additional target requirements.
## Access Analyzer Console & Access Information Center Server Requirements
@@ -176,7 +175,7 @@ The following additional considerations are recommended for the SQL Server:
- The standard Autogrowth setting can cause Access Analyzer job delays. Database growth is
computationally intensive. While SQL Server is growing the database, no other activity can occur.
- If this option is employed, please speak with a Netwrix engineer to determine an appropriate
+ If you use this option, speak with a Netwrix engineer to determine an appropriate
setting for best performance.
- Microsoft SQL Server supports TLS 1.2, which requires the Access Analyzer Console server to have
either SQL Server Native Client 11 or Microsoft OleDB 18 installed.
@@ -191,10 +190,10 @@ The following permissions are required on the databases:
## Virtual Environment Recommendations
-While physical machines are always preferred, we fully support the use of virtual machines. This
-section contains special considerations when leveraging virtualization.
+While physical machines are always preferred, Access Analyzer fully supports the use of virtual machines. This
+section contains special considerations for virtualized environments.
-- VMWare® ESX® – If using ESX, the following specifications are recommended:
+- VMWare® ESX® – If you use ESX, the following specifications are recommended:
- ESX 4.0 / ESXi™ 4.1 or higher
- Virtual Hardware 7 or higher
@@ -202,5 +201,5 @@ section contains special considerations when leveraging virtualization.
- Virtual Storage Consideration
- - In the server requirements, when separate disks are required for the servers, that should
- translate to separate data stores on the VM host machine.
+ - When the server requirements call for separate disks, use separate data stores on the VM
+ host machine.
diff --git a/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-based-scans/agentpermissions.md b/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-based-scans/agentpermissions.md
index d0a8d7f8a7..fe3eb42a95 100644
--- a/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-based-scans/agentpermissions.md
+++ b/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-based-scans/agentpermissions.md
@@ -8,7 +8,7 @@ sidebar_position: 10
When Access Analyzer SharePoint scans are run in agent-based mode, the Access Analyzer SharePoint
Agent must be installed on the SharePoint Application server which hosts the Central Administration
-component prior to executing the scans. This is typically the first server stood up during the
+component before executing the scans. This is typically the first server stood up during the
SharePoint farm installation process in this mode. The data collection processing is conducted by
the SharePoint Agent for the target environment. The final step in data collection is to transfer
the data collected in the SQLite databases, or Tier 2 databases, on the Access Analyzer SharePoint
@@ -32,19 +32,19 @@ The following are additional requirements for the Access Analyzer SharePoint Age
:::note
The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
+server. The JDK deployed is prepackaged and doesn't require any configuration; it has been
preconfigured to work with Access Analyzer and should never be customized through Java. It will not
conflict with other JDKs or Java Runtimes in the same environment.
:::
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if the job
is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
## Permissions Explained
-If limited provisioning of the service account is not required by the organization, then the
+If limited provisioning of the service account isn't required by the organization, then the
following permissions are sufficient for successful agent-based scans:
- Membership in the local Administrator group on the on server where the Access Analyzer SharePoint
@@ -77,11 +77,11 @@ following permissions are sufficient for successful agent-based scans:
- This is required so the Access Analyzer auditing account can make calls against the
SharePoint web services to remotely gather information around permissions, site hierarchy,
content and more
- - If the group does not exist already, then you need to create a new group at that level and
+ - If the group doesn't exist already, then you need to create a new group at that level and
grant it Read access. Specifically, it is a group that exists within Central
- Administration at the farm administrator level. This group only requires Read access and
- is not giving farm admin access. Once the group is created, add the service account that
- Access Analyzer will be leveraging to scan SharePoint.
+ Administration at the farm administrator level. This group requires only Read access, not
+ farm admin access. After the group is created, add the service account that
+ Access Analyzer uses to scan SharePoint.
- Web Application permissions:
@@ -95,7 +95,7 @@ following permissions are sufficient for successful agent-based scans:
- SPDataAccess on the SharePoint Content database and all Configuration databases
- - This permission should be applied on the desired Configuration database and all Content
+ - This permission should be applied on the Configuration database and all Content
databases for the SharePoint version
- This version-specific permission is required for Access Analyzer to execute read
operations directly against the SharePoint databases, gather information from the
@@ -112,14 +112,14 @@ following permissions are sufficient for successful agent-based scans:
administrative access
- This grants Access Analyzer rights to scan MySites
-Additional permission models are explained for a less and least permission model.
+The following sections explain the less privilege and least privilege permission models.
## SharePoint Agent-Based Less Privilege Permission Model
If restricted permissions are desired by the organization, then the following permissions are needed
for the service account to successfully run SharePoint Agent-based scans.
-Prior to installation of the SharePoint Agent, the service account to be supplied during
+Before installing the SharePoint Agent, the service account to be supplied during
installation and later used to run the Access Auditing (SPAA) and Sensitive Data Discovery Auditing
scans against the targeted SharePoint environment needs the following permissions:
@@ -148,8 +148,8 @@ following permissions:
`C:\Program Files\STEALTHbits\StealthAUDIT\SPAA`
-The Access Analyzer SharePoint Agent utilizes Microsoft APIs. The Microsoft APIs require an account
-with the following permissions in order to collect all of the data:
+The Access Analyzer SharePoint Agent uses Microsoft APIs. The Microsoft APIs require an account
+with the following permissions to collect all of the data:
- WSS_CONTENT_APPLICATION_POOLS on the SharePoint Content databases
- WSS_CONTENT_APPLICATION_POOLS on the SharePoint Configuration database
@@ -164,7 +164,7 @@ If scans include Web Application scoping, this last permission requirement is al
If a least privilege model is required by the organization, then the following permissions are
needed for the service account to successfully run SharePoint Agent-based scans.
-Prior to installation of the SharePoint Agent, the service account to be supplied during
+Before installing the SharePoint Agent, the service account to be supplied during
installation and later used to run the Access Auditing (SPAA) and Sensitive Data Discovery Auditing
scans the targeted SharePoint environment needs the following permissions:
@@ -209,8 +209,8 @@ following permissions:
`C:\Program Files\STEALTHbits\StealthAUDIT\SPAA`
-The Access Analyzer SharePoint Agent utilizes Microsoft APIs. The Microsoft APIs require an account
-with the following permissions in order to collect all of the data:
+The Access Analyzer SharePoint Agent uses Microsoft APIs. The Microsoft APIs require an account
+with the following permissions to collect all of the data:
- `'GRANT EXECUTE'` permissions on the following stored procedures in the SharePoint Configuration
database:
@@ -222,8 +222,8 @@ with the following permissions in order to collect all of the data:
- `proc_ReturnWebFeatures`
:::note
- The above four stored procedures would already have the correct permissions if Web
- Application scoping is desired.
+ These four stored procedures already have the correct permissions if Web Application
+ scoping is desired.
:::
diff --git a/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-based-scans/agentports.md b/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-based-scans/agentports.md
index 52eebd64c8..c51f6c96f3 100644
--- a/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-based-scans/agentports.md
+++ b/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-based-scans/agentports.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# SharePoint Agent Ports
-The following are the firewall settings are required when executing the Access Auditing (FSAA)
-and/or Sensitive Data Discovery Auditing scans in Agent-based mode for communication between Access
-Analyzer and the target host:
+The following firewall settings are required for communication between Access Analyzer and the
+target host when running Access Auditing (FSAA) and/or Sensitive Data Discovery Auditing scans in
+Agent-based mode:
| Port | Protocol | Source | Direction | Target | Purpose |
| ------- | -------- | --------------------------------------- | --------- | --------------------------------------- | ---------------------------------------------------------------------- |
diff --git a/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-less-scans/agentlesspermissions.md b/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-less-scans/agentlesspermissions.md
index 33ab35d0e3..b7964d4210 100644
--- a/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-less-scans/agentlesspermissions.md
+++ b/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/agent-less-scans/agentlesspermissions.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When SharePoint agent-less scans are run, it means all of the data collection processing is
conducted by the Access Analyzer Console server across the network.
-The SharePoint agent-less scan architecture requires permissions to be configured on the specified
+The SharePoint agent-less scan architecture requires you to configure permissions on the specified
server:
- SharePoint Application Server permissions:
diff --git a/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/scanoptions.md b/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/scanoptions.md
index c06e8758c5..6fef88a8a0 100644
--- a/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/scanoptions.md
+++ b/docs/accessanalyzer/12.0/requirements/sharepoint/scanoptions/scanoptions.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# SharePoint Scan Options
-Required permissions on the targeted SharePoint environment are dependent upon not only the type of
-environment targeted but also the type of data collection scan being executed. There are two types
+Required permissions on the targeted SharePoint environment depend on the type of environment
+targeted and the type of data collection scan running. There are two types
of Access Auditing (SPAA) and/or Sensitive Data Discovery Auditing scans: agent-based and
agent-less. The Activity Auditing (SPAC) scans run as agent-less scans from Access Analyzer, but
they require the Netwrix Activity Monitor to have an activity agent deployed in the target
@@ -17,7 +17,7 @@ environment.
When Access Analyzer SharePoint scans are run in agent-based mode, the Access Analyzer SharePoint
Agent must be installed on the SharePoint Application server which hosts the Central Administration
-component prior to executing the scans. This is typically the first server stood up during the
+component before executing the scans. This is typically the first server stood up during the
SharePoint farm installation process in this mode. The data collection processing is conducted by
the SharePoint Agent for the target environment. The final step in data collection is to transfer
the data collected in the SQLite databases, or Tier 2 databases, on the Access Analyzer SharePoint
diff --git a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint.md b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint.md
index 16afd1c4be..d5001ffa25 100644
--- a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint.md
+++ b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint.md
@@ -10,18 +10,17 @@ The core components for Netwrix Access Analyzer (formerly Enterprise Auditor) ar
Analyzer Console server, SQL Server, and Access Information Center. See the
[Requirements](/docs/accessanalyzer/12.0/requirements/overview.md) topic for the core requirements.
-The SharePoint solution can be configured to run without an agent or to use the Access Analyzer
+You can configure the SharePoint solution to run without an agent or to use the Access Analyzer
SharePoint Agent. See the [SharePoint Agent Installation](/docs/accessanalyzer/12.0/install/sharepointagent/overview.md)
topic for additional information.
-In addition to these, integration with either the Netwrix Activity Monitor is required for event
-activity data to be scanned. See the
+You must also integrate with the Netwrix Activity Monitor to scan event activity data. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor)
for installation requirements and information on collecting activity data.
:::note
-For Activity Auditing (SPAC) scans, the audit logs generated by SharePoint must be
-retained for more days than the number of days between the Access Analyzer scans.
+For Activity Auditing (SPAC) scans, retain the audit logs that SharePoint generates for more days
+than the interval between Access Analyzer scans.
:::
@@ -59,10 +58,9 @@ These are dependent upon the size of the target environment:
| Disk Space | 460 GB | 280 GB | 160 GB | 80 GB |
:::note
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the
-minimum amount of RAM. Each thread requires a minimum of 2 additional GB of RAM per host.For
-example, if the job is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are
-required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if the job is configured to
+scan 8 hosts at a time, then an extra 16 GB of RAM are required (8x2=16).
:::
@@ -70,7 +68,7 @@ required (8x2=16).
:::note
The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
+server. The JDK deployed is prepackaged and doesn't require any configuration; it has been
preconfigured to work with Access Analyzer and should never be customized through Java. It will not
conflict with other JDKs or Java Runtimes in the same environment.
:::
diff --git a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint.md b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint.md
index cee7bf548b..5e1d585aa2 100644
--- a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint.md
+++ b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint.md
@@ -10,7 +10,7 @@ Netwrix products audit and monitor Microsoft® SharePoint® environments. Access
the SharePoint solution to execute Access Auditing (SPAA) and Sensitive Data Discovery Auditing
scans against SharePoint on-premise and SharePoint Online. Through integration with Activity
Monitor, Access Analyzer can also execute Activity Auditing (SPAC) scans against SharePoint
-on-premise and SharePoint online environments. Additionally, Activity Monitor can be configured to
+on-premise and SharePoint online environments. Additionally, you can configure Activity Monitor to
provide activity data to various SIEM products.
Ports and permissions vary based on the scan mode option selected as well as the target environment.
diff --git a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint/access.md b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint/access.md
index 224a1d8c56..93ef371434 100644
--- a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint/access.md
+++ b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint/access.md
@@ -30,14 +30,14 @@ The service account must be a member of the `Farm Read` group at the farm level.
Access Analyzer to call the SharePoint web services to gather permissions, site hierarchy, and
content information remotely.
-Follow these steps to configure farm-level permissions on SharePoint 2013 through SharePoint 2019:
+Configure farm-level permissions on SharePoint 2013 through SharePoint 2019:
1. In the SharePoint **Central Administration Center**, navigate to the **Security** section.
2. Select **Manage the farm administrators group** under **Users**.
3. If the `Farm Read` group exists, add the service account to that group. If the group has been
deleted, create a new group:
- Select **More** under the **Groups** section.
- - Select **New Group** from the **New** drop-down menu.
+ - Select **New Group** from the **New** dropdown menu.
- Ensure the group has the `Read – Can view pages and list items and download documents`
permission.
- Add the service account to the new group.
@@ -50,7 +50,7 @@ The service account requires a custom policy role with `Site Collection Auditor`
permissions at the web application level. This allows Access Analyzer to execute web service calls
against **Central Administration**.
-Follow these steps to configure web application-level permissions on SharePoint 2013 through
+Configure web application-level permissions on SharePoint 2013 through
SharePoint 2019:
1. In the **Central Administration Center**, navigate to the **Application Management** section.
@@ -82,7 +82,7 @@ configuration database and all content databases. This allows Access Analyzer to
operations directly against the SharePoint databases and gather information about web application
and content database locations.
-Follow these steps to configure database server permissions:
+Configure database server permissions:
1. Open the SharePoint database server user configuration in SQL Server Management Studio.
2. Grant the service account the `SPDataAccess` database role membership on the following
diff --git a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint/activity.md b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint/activity.md
index e35c5d82bd..d622f4dcad 100644
--- a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint/activity.md
+++ b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint/activity.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# SharePoint On-Premise Activity Auditing Configuration
-SharePoint Event Auditing must be enabled for each site collection to be monitored by the Netwrix
-Activity Monitor and/or audited by Netwrix Access Analyzer (formerly Enterprise Auditor).
+Enable SharePoint Event Auditing for each site collection that the Netwrix Activity Monitor
+monitors or that Netwrix Access Analyzer (formerly Enterprise Auditor) audits.
## User Requirements
@@ -44,7 +44,7 @@ select the events to be audited.
**Step 6 –** Click OK to save the changes.
-SharePoint will create the audit logs to be monitored by the Netwrix Activity Monitor and/or audited
-by Access Analyzer. See the Microsoft
+SharePoint creates the audit logs that the Netwrix Activity Monitor monitors and/or that Access
+Analyzer audits. See the Microsoft
[Configure audit settings for a site collection (SharePoint 2013/2016/2019)](https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2)
article for additional information.
diff --git a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint/overview.md b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint/overview.md
index 7bea1053d2..12f83b86c9 100644
--- a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 10
# SharePoint Target Requirements
Netwrix Access Analyzer (formerly Enterprise Auditor) can execute Access Auditing (SPAA) and/or
-Sensitive Data Discovery Auditing scans on SharePoint farms. The Netwrix Activity Monitor can be
-configured to monitor activity on SharePoint farms and make the event data available for Access
+Sensitive Data Discovery Auditing scans on SharePoint farms. You can configure the Netwrix Activity
+Monitor to monitor activity on SharePoint farms and make the event data available for Access
Analyzer Activity Auditing (SPAC) scans.
## Access & Sensitive Data Auditing Permissions
@@ -38,7 +38,7 @@ Activity Agent must have the following permissions on the proxy server:
- Membership in the local Administrators group
- READ and WRITE access to the archive location for Archiving feature only
-It is also necessary to enable the Remote Registry Service on the Activity Agent server.
+Also enable the Remote Registry Service on the Activity Agent server.
For integration between the Activity Monitor and Access Analyzer, the credential used by Access
Analyzer to read the activity log files must have also have this permission.
@@ -62,15 +62,15 @@ are required for communication between the Agent server and the Netwrix Activity
| -------------------------------- | -------- | ----- | ------------------- |
| Activity Monitor to Agent Server | TCP | 4498 | Agent Communication |
-The Windows firewall rules need to be configured on the Windows server, which require certain
-inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+Configure the Windows firewall rules on the Windows server. If the scans run in applet mode, create
+certain inbound rules. These scans operate over a default port range, which can't be specified via
+an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
Additional Firewall Rules for Integration between Access Analyzer and Activity Monitor
-Firewall settings are dependent upon the type of environment being targeted. The following firewall
+Firewall settings depend on the type of environment being targeted. The following firewall
settings are required for communication between the agent server and the Access Analyzer Console:
| Communication Direction | Protocol | Ports | Description |
diff --git a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepointonline/access.md b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepointonline/access.md
index 45b5188f6e..bdfcf51a6d 100644
--- a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepointonline/access.md
+++ b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepointonline/access.md
@@ -19,7 +19,7 @@ Microsoft Entra ID.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+After you register the application, the following settings are needed from your tenant:
- Client ID – This is the Application (client) ID for the registered application
- Key – The comma delimited string containing the path to the certificate PFX file, certificate
@@ -28,9 +28,10 @@ The following settings are needed from your tenant once you have registered the
Configure Modern Authentication for SharePoint Online using SP_RegisterAzureAppAuth Instant Job
-Registering a Microsoft Entra ID application and provisioning it to grant permissions to SharePoint
-Online can be automated using the SP_RegisterAzureAppAuth job from the Access Analyzer Instant Job
-Library. The SP_RegisterAzureAppAuth job uses the PowerShell Data Collector to automatically
+You can automate registering a Microsoft Entra ID application and provisioning it to grant
+permissions to SharePoint Online with the SP_RegisterAzureAppAuth job from the Access Analyzer
+Instant Job Library. The SP_RegisterAzureAppAuth job uses the PowerShell Data Collector to
+automatically
configure modern authentication for SharePoint Online. It requires:
- A Connection Profile containing the following two user credentials, both with an Account Type of
@@ -103,9 +104,9 @@ against Entra ID while requesting the App Only access token. See the Microsoft
[Granting access via Azure AD App-Only](https://learn.microsoft.com/en-us/sharepoint/dev/solution-guidance/security-apponly-azuread)
article for additional information.
-Follow the steps create the self-signed X.509 certificate.
+Create the self-signed X.509 certificate:
-**Step 1 –** To generate a certificate, use the sample PowerShell command below:
+**Step 1 –** To generate a certificate, use the following sample PowerShell command:
- Change the following parameters in the sample PowerShell command. See the Microsoft
[New-SelfSignedCertificate](https://docs.microsoft.com/en-us/powershell/module/pki/new-selfsignedcertificate)
@@ -115,7 +116,7 @@ Follow the steps create the self-signed X.509 certificate.
certificate
- Subject – A unique name for the new App (always starts with CN=, to denote a canonical name)
- FriendlyName – Same as Subject name minus the canonical name prefix
- - NotAfter – A datetime string denoting the certificate's expiration date - in the above sample,
+ - NotAfter – A datetime string denoting the certificate's expiration date - in the following example,
Get-Date.AddYears(11) specifies that the certificate will expire 11 years from the current
datetime
@@ -131,7 +132,7 @@ $certPath variable (see Step 1).
:::note
The environment variable `SAINSTALLDIR` always points to the base Access Analyzer install
-directory; simply append the PrivateAssemblies to point to that folder with the following cmdlet:
+directory; append the PrivateAssemblies to point to that folder with the following cmdlet:
:::
@@ -162,10 +163,10 @@ more secure before running this cmdlet.
## Register a Microsoft Entra ID Application
-Follow the steps to register Access Analyzer with Microsoft Entra ID.
+Register Access Analyzer with Microsoft Entra ID:
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+These steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -187,14 +188,14 @@ registrations.
**Step 5 –** Click **Register**.
The Overview page for the newly registered app opens. Review the newly created registered
-application. Now that the application has been registered, permissions need to be granted to it.
+application. Now that you've registered the application, grant it permissions.
## Upload Self-Signed Certificate
-Follow the steps to provision the upload your self-signed certificate.
+Upload your self-signed certificate:
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+These steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -219,10 +220,10 @@ The upload certificate public key .cer file is an application key credential.
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
+Grant permissions to the registered application:
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+These steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -298,15 +299,15 @@ Select the following permissions:
**Step 12 –** Click **Grant Admin Consent for [tenant]**. Then click **Yes** in the confirmation
window.
-Now that the permissions have been granted to it, the Connection Profile and host settings for
-Access Analyzer need to be collected.
+Now that you've granted the permissions, collect the Connection Profile and host settings for
+Access Analyzer.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
+Find the registered application's Client ID:
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+These steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
diff --git a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepointonline/activity.md b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepointonline/activity.md
index 520ea3d565..0df673ea20 100644
--- a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepointonline/activity.md
+++ b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepointonline/activity.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# SharePoint Online Activity Auditing Configuration
-In order to collect logs and monitor SharePoint Online activity using the Netwrix Activity Monitor,
-it needs to be registered with Microsoft® Entra ID® (formerly Azure AD).
+To collect logs and monitor SharePoint Online activity, register the Netwrix Activity Monitor with
+Microsoft® Entra ID® (formerly Azure AD).
:::note
A user account with the Global Administrator role is required to register an app with
@@ -26,15 +26,14 @@ additional information.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+After you register the application, the following settings are needed from your tenant:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
- copied first.
+ You can't retrieve the value after saving the new key, so copy it first.
:::
@@ -55,10 +54,10 @@ The following settings are needed from your tenant once you have registered the
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
+Register Activity Monitor with Microsoft Entra ID:
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+These steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -84,14 +83,14 @@ registrations.
**Step 5 –** Click **Register**.
The Overview page for the newly registered app opens. Review the newly created registered
-application. Now that the application has been registered, permissions need to be granted to it.
+application. Now that you've registered the application, grant it permissions.
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
+Grant permissions to the registered application:
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+These steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -131,15 +130,14 @@ Microsoft APIs tab. Select the following permissions:
**Step 9 –** Click **Grant Admin Consent for [tenant]**. Then click **Yes** in the confirmation
window.
-Now that the permissions have been granted to it, the settings required for Activity Monitor need to
-be collected.
+Now that you've granted the permissions, collect the settings required for Activity Monitor.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
+Find the registered application's Client ID:
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+These steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -174,10 +172,10 @@ application’s Client Secret Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
+Find the tenant name where the registered application resides:
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+These steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
@@ -194,18 +192,18 @@ application’s Client Secret Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
-value when saving the new key.
+Find the registered application's Client Secret, create a new key, and save its
+value when saving the new key:
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
+These steps are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
documentation for additional information.
:::
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
+It isn't possible to retrieve the value after saving the new key. It must be copied
first.
:::
@@ -225,15 +223,15 @@ list.
:::note
Setting the duration on the key to expire requires reconfiguration at the time of
- expiration. It is best to configure it to expire in 1 or 2 years.
+ expiration. Configure it to expire in 1 or 2 years.
:::
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
-this process will have to be repeated.
+If you leave this page before copying the key, you can't retrieve it, and you'll have to repeat
+this process.
:::
@@ -246,15 +244,15 @@ This is needed for adding a SharePoint Online host in the Activity Monitor.
## Enable Auditing for SharePoint Online
-Follow the steps to enable auditing for SharePoint Online so the Activity Monitor can receive
-events.
+Enable auditing for SharePoint Online so the Activity Monitor can receive
+events:
**Step 1 –** In the Microsoft Purview compliance portal at
[https://purview.microsoft.com](https://purview.microsoft.com/), go to **Solutions** > **Audit**.
Or, to go directly to the Audit page at
[https://purview.microsoft.com/audit/auditsearch](https://purview.microsoft.com/audit/auditsearch).
-**Step 2 –** If auditing is not turned on for your organization, a banner is displayed prompting you
+**Step 2 –** If auditing isn't turned on for your organization, a banner is displayed prompting you
start recording user and admin activity.
**Step 3 –** Select the **Start recording** user and **admin activity** banner.
diff --git a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepointonline/overview.md b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepointonline/overview.md
index 2e5aa98f4a..6248b11c58 100644
--- a/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepointonline/overview.md
+++ b/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepointonline/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 20
# SharePoint Online Target Requirements
Netwrix Access Analyzer (formerly Enterprise Auditor) can execute Access Auditing (SPAA) and
-Sensitive Data Discovery Auditing scans on SharePoint Online. The Netwrix Activity Monitor can be
-configured to monitor activity on SharePoint Online and make the event data available for Access
+Sensitive Data Discovery Auditing scans on SharePoint Online. You can configure the Netwrix Activity
+Monitor to monitor activity on SharePoint Online and make the event data available for Access
Analyzer Activity Auditing (SPAC) scans.
## Access & Sensitive Data Auditing Permissions
@@ -47,7 +47,7 @@ server:
- Membership in the local Administrators group
- READ and WRITE access to the archive location for Archiving feature only
-It is also necessary to enable the Remote Registry Service on the Activity Agent server.
+Also enable the Remote Registry Service on the Activity Agent server.
For integration between the Activity Monitor and Access Analyzer, the credential used by Access
Analyzer to read the activity log files must have also have this permission.
@@ -71,15 +71,15 @@ are required for communication between the Agent server and the Netwrix Activity
| -------------------------------- | -------- | ----- | ------------------- |
| Activity Monitor to Agent Server | TCP | 4498 | Agent Communication |
-The Windows firewall rules need to be configured on the Windows server, which require certain
-inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+Configure the Windows firewall rules on the Windows server. If the scans run in applet mode, create
+certain inbound rules. These scans operate over a default port range, which can't be specified via
+an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
Additional Firewall Rules for Integration between Access Analyzer and Activity Monitor
-Firewall settings are dependent upon the type of environment being targeted. The following firewall
+Firewall settings depend on the type of environment being targeted. The following firewall
settings are required for communication between the agent server and the Access Analyzer Console:
| Communication Direction | Protocol | Ports | Description |
diff --git a/docs/accessanalyzer/12.0/requirements/unix/target.md b/docs/accessanalyzer/12.0/requirements/unix/target.md
index 40db4d2a1c..ac4f7ac8da 100644
--- a/docs/accessanalyzer/12.0/requirements/unix/target.md
+++ b/docs/accessanalyzer/12.0/requirements/unix/target.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Target Unix Requirements, Permissions, and Ports
-The Access Analyzer for Unix Solution provides the ability to audit Unix servers. It scans:
+The Access Analyzer for Unix Solution lets you audit Unix servers. It scans:
- AIX® 4+
- Solaris™ 8+
@@ -33,7 +33,7 @@ This solution employs the following data collectors to scan the target environme
- Root permissions in Unix/Linux
-If the Root permission is unavailable, a least privileged model can be used. See the
+If the Root permission is unavailable, you can use a least privileged model instead. See the
[Least Privilege Model](#least-privilege-model) topic additional information.
## Ports
@@ -53,7 +53,7 @@ The following firewall ports are needed:
## Least Privilege Model
Access Analyzer for Unix collects information from Unix devices by running commands or executing
-scripts on your Unix hosts (if configured properly our tool can SCP scripts to your hosts before
+scripts on your Unix hosts (if configured properly, Access Analyzer can SCP scripts to your hosts before
execution). Therefore, the domain or local user credentials entered in the Connection Profile within
the Access Analyzer must be capable of running the necessary commands, executing the necessary
scripts or, in some cases, have rights to SCP scripts to the host.
@@ -62,7 +62,7 @@ scripts or, in some cases, have rights to SCP scripts to the host.
Access Analyzer for Unix connects to your host in two ways:
-- Plink – This mechanism is leveraged during our tools Host Inventory to test connectivity to a host
+- Plink – This mechanism is used during Access Analyzer's Host Inventory to test connectivity to a host
and to collect basic details about a host (Host Name, OS Type, etc.)
- Implementation of the SSH2 protocol built into Access Analyzer – This is how the Unix Data
Collector interacts with and pulls information from your environment
@@ -81,15 +81,15 @@ Access Analyzer for Unix connects to your host in two ways:
- SSH port opened in software and hardware firewalls. Default is 22.
- - If you do not use Port 22, you can specify your SSH port in the Connection Profile
+ - If you don't use Port 22, you can specify your SSH port in the Connection Profile
### Commands for Non-Root Accounts
-We recommend using the root account to run Access Analyzer against a Unix system. However, if that
-is not acceptable all the commands we leverage in the solution set are below and can be used to
-implement least privilege:
+Netwrix recommends using the root account to run Access Analyzer against a Unix system. However, if
+that isn't acceptable, the following commands used by the solution let you implement least
+privilege:
-All Perl scripts require the account to be able to execute the following commands:
+All Perl scripts require the account to execute the following commands:
```
scp [script] to a target location: /tmp/[script]
@@ -118,7 +118,7 @@ environment to run the following commands:
- `cat /etc/security/user` (read access)
- `cat /etc/shadow`
- - Requires root or customization to job to utilize sudo without password prompt (:NOPASSWD)
+ - Requires root or customization to job to use sudo without password prompt (:NOPASSWD)
- `egrep /etc/security/user` (read access)
- `egrep /etc/login.defs` (read access)
@@ -150,7 +150,7 @@ The 2.PrivilegedAccess > Sudoers > 0.Collection > UX_ParseSudoers Job requires p
Unix environment to run the following commands:
:::note
-To parse sudoers we either need root or an account that has access to use sudo without
+To parse sudoers, the account needs root access or access to use sudo without a
password prompt (:NOPASSWD)
:::
diff --git a/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/configuration.md b/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/configuration.md
index ada5834ca4..f75d967eb7 100644
--- a/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/configuration.md
+++ b/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/configuration.md
@@ -11,7 +11,7 @@ edit, and remove sub-criteria information for User Criteria.
-The information in the configuration pane changes based on the criteria currently selected in the
+The information in the configuration pane changes based on the criteria selected in the
navigation pane.
@@ -19,7 +19,7 @@ navigation pane.
The options at the top of the Configuration Pane are:
:::note
-Configuration settings for System Criteria cannot be modified.
+Configuration settings for System Criteria can't be modified.
:::
@@ -40,7 +40,7 @@ Configuration settings for System Criteria cannot be modified.
- The risk score can be set to **Low**, **Medium**, or **High**
- Click the **Risk Score** button to change the risk score for user-configured criteria
-- Required matched criteria list – Lists the sub-criteria configured for the currently selected
+- Required matched criteria list – Lists the sub-criteria configured for the selected
top-level criteria in the navigation pane. The columns in the table are:
- Name – Name of the sub-criteria
@@ -54,7 +54,7 @@ Configuration settings for System Criteria cannot be modified.
The options at the bottom of the configuration pane are:
:::note
-Configuration settings for System Criteria cannot be modified.
+Configuration settings for System Criteria can't be modified.
:::
@@ -67,7 +67,7 @@ Configuration settings for System Criteria cannot be modified.
- [Summary Criteria](/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/summary.md)
- Remove – Remove sub-criteria from the Required matched sub-criteria list
-- Edit – Edit the currently selected sub-criteria
+- Edit – Edit the selected sub-criteria
- Must match at least this many criteria – Adjust the slider to configure how many sub-criteria must
be matched for the sensitive data criteria to be reported
@@ -76,13 +76,13 @@ Configuration settings for System Criteria cannot be modified.
required matched criteria list
:::warning
- The character distance feature does not account for summaries that are nested
+ The character distance feature doesn't account for summaries that are nested
within other summaries.
:::
- Matches should be within this proximity of characters – Match hits for this criteria should be
- within this many characters of one another in order for there to be a match. Adjust the slider to
+ within this many characters of one another for there to be a match. Adjust the slider to
set the default character distance required for match hits.
- The minimum value is 0
@@ -90,15 +90,15 @@ Configuration settings for System Criteria cannot be modified.
- Using this feature requires any combination of two or more Regular Expression (Pattern) and
Keyword sub-criteria
-- Include keywords as part of match hits – Select this option to enable the inclusion of keywords as
- part of match hits. This option determines whether a match found based on a Keyword Criteria is
+- Include keywords as part of match hits – Select this option to include keywords in match hits.
+ This option determines whether a match found based on a Keyword Criteria is
reported as a match hit. When this option is selected, any matches found for a word in the Keyword
- list is reported as match hit. If this option is not selected, then only matches found based on
+ list is reported as match hit. If this option isn't selected, then only matches found based on
Pattern or child Summary Criteria are reported as a match hit.
- Metadata for this criteria – Click the green plus (**+**) button to add a new metadata type for
the criteria. Delete a metadata type by clicking the **X** button in the gray metadata tag.
- - For a list of available out-of-the-box metadata tags, see the
+ - For a list of available predefined metadata tags, see the
[Default Metadata Tag Values](/docs/accessanalyzer/12.0/sensitivedatadiscovery/metadatatags.md) topic for additional information
- Cancel – Exit the Sensitive Data Criteria Editor without saving changes
@@ -115,8 +115,8 @@ The options in the Criteria Tester are:
- Use the following sample text – Enter sample text to test against current configured criteria in
the **Use the following sample text** textbox
- Use the following file – Click **Browse** to import a file as sample text to test against
- currently configured criteria
-- Test Data – Click **Test Data** to test the sample text against currently configured criteria.
+ configured criteria
+- Test Data – Click **Test Data** to test the sample text against configured criteria.
Match hits show in the **Test Results** section.
- Test Results – Displays match hits for the sample text typed into the text box. The two tabs under
Test Results are:
diff --git a/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/keyword.md b/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/keyword.md
index c285ad4d0e..16d36e7431 100644
--- a/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/keyword.md
+++ b/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/keyword.md
@@ -21,8 +21,8 @@ The options on the Keywords window are:
- Match Type – Choose whether keyword matches for the Keyword criteria **Must match** or **Must not
match**
- Case Sensitive Keywords – If enabled, checks letter case when matching keywords
-- Count only distinct occurrences – Select the checkbox to enable only distinct occurrences to be
- counted during scan jobs
+- Count only distinct occurrences – Select the checkbox to count only distinct occurrences during
+ scan jobs
- Apply these keywords to these file components – Select which file components the keywords apply
to:
diff --git a/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/overview.md b/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/overview.md
index 844188b33d..c30852d2c2 100644
--- a/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/overview.md
+++ b/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/overview.md
@@ -6,10 +6,10 @@ sidebar_position: 50
# Sensitive Data Criteria Editor
-The Sensitive Data Criteria Editor is accessed from the Criteria Tab in the
-**Settings** > **Sensitive Data** node. Use the Sensitive Data Criteria Editor to view pre-defined
-criteria and to customize or create user-defined criteria. Sensitive Data Criteria can be configured
-in individual data collectors that use Sensitive Data Discovery or can be configured to inherit
+Access the Sensitive Data Criteria Editor from the Criteria tab in the
+**Settings** > **Sensitive Data** node. Use it to view pre-defined
+criteria and to customize or create user-defined criteria. You can configure Sensitive Data Criteria
+in individual data collectors that use Sensitive Data Discovery, or configure it to inherit
Sensitive Data Criteria settings from the **Settings** > **Sensitive Data** node. See the
[Sensitive Data](/docs/accessanalyzer/12.0/admin/settings/sensitivedata/overview.md) topic for additional information.
@@ -17,10 +17,9 @@ Sensitive Data Criteria settings from the **Settings** > **Sensitive Data** nod
The Sensitive Data Criteria Editor contains two sections:
-- Navigation pane – User-configured criteria can be added and removed in the navigation pane using
- the Add or Remove options. See the [Navigation Pane](#navigation-pane) topic for additional
- information.
-- Configuration pane – Displays configured settings for the currently selected criteria in the
+- Navigation pane – Add or remove user-configured criteria using the Add or Remove options in the
+ navigation pane. See the [Navigation Pane](#navigation-pane) topic for additional information.
+- Configuration pane – Displays configured settings for the selected criteria in the
navigation pane. See the [Configuration Pane](/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/configuration.md) topic for additional information.
## Navigation Pane
@@ -37,6 +36,6 @@ The options in the Navigation Pane are:
- System Criteria – Lists all pre-configured criteria. For a list of pre-configured System Criteria,
see the [Sensitive Data System Criteria](/docs/accessanalyzer/12.0/sensitivedatadiscovery/systemcriteria.md) topic for additional information.
- - System Criteria cannot be modified or removed. To use existing System Criteria configurations
- in a User Criteria, right-click on a System Criteria and select **Duplicate** from the
+ - System Criteria can't be modified or removed. To use existing System Criteria configurations
+ in a User Criteria, right-click a System Criteria and select **Duplicate** from the
right-click menu. A configurable copy of the System Criteria appears under User Criteria.
diff --git a/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/regularexpression.md b/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/regularexpression.md
index 4b170eac9f..41c4ac31ae 100644
--- a/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/regularexpression.md
+++ b/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/regularexpression.md
@@ -7,8 +7,8 @@ sidebar_position: 20
# Regular Expression (Pattern) Criteria
Regular Expression criteria are a set of pattern matching rules that provide a concise and flexible
-means for matching strings of text. This criteria type can be used to verify a series of numbers as
-potentially valid, for example credit card numbers.
+means for matching strings of text. Use this criteria type to verify a series of numbers as
+potentially valid, for example, credit card numbers.
@@ -18,7 +18,7 @@ The options on the Regular Expression window are:
- Expression – Enter the Regular Expression in the Expression text box
- Case Sensitive Expression – Select the checkbox for case sensitive Regular Expression pattern
matching
-- Validation – Select a validation method from the Validation drop-down. The default value is **No
+- Validation – Select a validation method from the Validation dropdown. The default value is **No
validation required**.
:::note
@@ -34,9 +34,9 @@ The options on the Regular Expression window are:
- Match Type – Choose whether pattern matches for the Regular Expression criteria **Must match** or
**Must not match**
- - Must match – The Regular Expression must be matched for there to be a match
- - Must not match – If the Regular Expression is matched and is designated **Must not match**,
- then the potential match is invalidated
+ - Must match – The Regular Expression must match for the criteria to register a match
+ - Must not match – If the Regular Expression matches and is designated **Must not match**,
+ the potential match is invalidated
- Apply this expression to these file components – Select which file components the expression
applies to:
diff --git a/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/summary.md b/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/summary.md
index 66e9ef6a23..f2bf2d6d08 100644
--- a/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/summary.md
+++ b/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/summary.md
@@ -6,8 +6,7 @@ sidebar_position: 40
# Summary Criteria
-Summary criteria are designed as a way of combining Regular Expression (Pattern) criteria and
-Keyword criteria.
+Summary criteria combine Regular Expression (Pattern) criteria and Keyword criteria.
@@ -22,7 +21,7 @@ The options on the Summary criteria configuration page are:
- Test Criteria – Opens the Criteria Tester window to test current Summary criteria configurations.
See the [Criteria Tester Window](/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/configuration.md#criteria-tester-window) topic for additional
information.
-- Required matched criteria – Lists sub-criteria configured for currently selected criteria in the
+- Required matched criteria – Lists sub-criteria configured for selected criteria in the
navigation pane. The columns in the table are:
- Name – Name of the sub-criteria
@@ -34,7 +33,7 @@ The options on the Summary criteria configuration page are:
- Add – Add a sub-criteria to the required matched criteria list. The three types of sub-criteria
that can be added are **Keyword**, **Pattern**, and **Summary**.
- Remove – Remove the selected sub-criteria from the Required matched criteria list
-- Edit – Edit the currently selected sub-criteria
+- Edit – Edit the selected sub-criteria
- Match Type – Choose whether match hits for the Summary criteria **Must match** or **Must not
match**
- Must match at least this many criteria – Adjust the slider to configure how many sub-criteria must
@@ -45,7 +44,7 @@ The options on the Summary criteria configuration page are:
Required matched criteria list
:::warning
-The character distance feature does not account for summaries that are nested within
+The character distance feature doesn't account for summaries that are nested within
other summaries.
:::
@@ -58,7 +57,6 @@ other summaries.
- Using this feature requires any combination of two or more Regular Expression (Pattern) and
Keyword sub-criteria
-- Include keywords as part of match hits – Select this checkbox to enable the inclusion of keywords
- as part of match hits
+- Include keywords as part of match hits – Select this checkbox to include keywords in match hits
- Cancel – Exit the Sensitive Data Criteria Editor without saving changes
-- Save – Save changes made to the currently selected criteria
+- Save – Save changes made to the selected criteria
diff --git a/docs/accessanalyzer/12.0/sensitivedatadiscovery/metadatatags.md b/docs/accessanalyzer/12.0/sensitivedatadiscovery/metadatatags.md
index 0800f579fc..722dc63c10 100644
--- a/docs/accessanalyzer/12.0/sensitivedatadiscovery/metadatatags.md
+++ b/docs/accessanalyzer/12.0/sensitivedatadiscovery/metadatatags.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Default Metadata Tag Values
-Sensitive Data Criteria can be tagged with one or more metadata tags to describe the criteria. The
+You can tag Sensitive Data Criteria with one or more metadata tags to describe the criteria. The
following is a list of default metadata tag values:
| Tag Name | Value Description |
diff --git a/docs/accessanalyzer/12.0/sensitivedatadiscovery/overview.md b/docs/accessanalyzer/12.0/sensitivedatadiscovery/overview.md
index 2f65c823ad..6467c663b6 100644
--- a/docs/accessanalyzer/12.0/sensitivedatadiscovery/overview.md
+++ b/docs/accessanalyzer/12.0/sensitivedatadiscovery/overview.md
@@ -13,11 +13,12 @@ criteria or create new criteria.
:::note
Sensitive Data Discovery requires a special license. If your license includes Sensitive
Data Discovery, then the necessary components for Sensitive Data Discovery are installed during the
-Access Analyzer, FSAA Proxy, and SPAA Agent installations.
+Access Analyzer, File System Access Auditing (FSAA) Proxy, and SharePoint Access Auditing (SPAA)
+Agent installations.
:::
-Sensitive Data Discovery can be used with any of the following Access Analyzer solutions:
+You can use Sensitive Data Discovery with any of the following Access Analyzer solutions:
- AWS Solution
- Dropbox Solution
@@ -50,7 +51,7 @@ Data Discovery.
:::note
The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
+server. The JDK deployed is prepackaged and doesn't require any configuration; it has been
preconfigured to work with Access Analyzer and should never be customized through Java. It will not
conflict with other JDKs or Java Runtimes in the same environment.
diff --git a/docs/accessanalyzer/12.0/sensitivedatadiscovery/supportedformats.md b/docs/accessanalyzer/12.0/sensitivedatadiscovery/supportedformats.md
index 87fdfb97ae..91b3a3fddd 100644
--- a/docs/accessanalyzer/12.0/sensitivedatadiscovery/supportedformats.md
+++ b/docs/accessanalyzer/12.0/sensitivedatadiscovery/supportedformats.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Supported Formats for Scanning & Metadata
This topic provides a comprehensive listing of all formats supported by Sensitive Data Discovery.
-The list is divided into three major categories:
+The list has three major categories:
- [Scan-able Formats](#scan-able-formats)
- [Metadata Only Formats](#metadata-only-formats)
@@ -101,10 +101,10 @@ attachment’s file type is a scan-able format, then it can extract text from th
| Tagged Image File Format | .TIF, .TIFF |
:::note
-The **FileSystem** > **0.Collection** > **1-SEEK System Scans** job can perform Optical
-Character Recognition (OCR) scans for Raster image files by enabling the option on the SDD Audit
-Settings page in the File System Access Auditor Data Collector Wizard. This is an option for the
-Sensitive Data Scan category. See the
+You can enable Optical Character Recognition (OCR) scans for raster image files on the SDD Audit
+Settings page in the File System Access Auditor Data Collector Wizard. This option belongs to the
+Sensitive Data Scan category. The **FileSystem** > **0.Collection** > **1-SEEK System Scans** job
+then performs the OCR scans. See the
[1-SEEK System Scans Job](/docs/accessanalyzer/12.0/solutions/filesystem/collection/1-seek_system_scans.md) topic for
additional information.
:::
@@ -165,15 +165,14 @@ multimedia. The following file formats are supported as metadata only formats.
## Scans Against Files with no Extensions
-Files with no extensions can be scanned by modifying the XML file for each job where this type of
-scan is desired. Add the following line to the `PerScanExtraScanOptions` section of a job's XML
-script:
+To scan files with no extensions, modify the XML file for each job that requires this type of scan.
+Add the following line to the `PerScanExtraScanOptions` section of a job's XML script:
```
true
```
-This line must be added to a specific location within the XML script. See below:
+Add this line to a specific location within the XML script, as shown in the following example:
```
@@ -192,5 +191,5 @@ This line must be added to a specific location within the XML script. See below:
```
-Once this line has been added to the job's XML script and the XML file is saved, files with no
+After you add this line to the job's XML script and save the XML file, files with no
extensions are included in scans for the job.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_activitycollection.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_activitycollection.md
index aeb28170aa..fe792054e7 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_activitycollection.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_activitycollection.md
@@ -12,7 +12,7 @@ days default).
-There are two ways AD Activity data can be retrieved by Access Analyzer:
+Access Analyzer can retrieve AD Activity data in two ways:
- Network share containing the archive logs
- API Server connected to the archive logs
@@ -23,7 +23,7 @@ additional information.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -32,13 +32,12 @@ instructions on how to edit parameters on a job overview page.
The AD_ActivityCollection page has the following configurable parameters:
-- Enable to import AD events into the AIC
+- Enable to import AD events into the Netwrix Access Information Center (AIC)
- Enable to import authentication events into the AIC
:::note
The import of AD events and authentication events is disabled by default. You must
- enable these parameters for the activity data to be imported into the Netwrix Access Information
- Center. See the
+ enable these parameters for the activity data to be imported into the AIC. See the
[(Optional) Configure Import of AD Activity into Netwrix Access Information Center](/docs/accessanalyzer/12.0/requirements/activedirectory/target/activity/activity.md#optional-configure-import-of-ad-activity-into-netwrix-access-information-center)
topic for instructions.
:::
@@ -70,9 +69,9 @@ The AD_ActivityCollection Job uses the ADActivity Data Collector for the followi
### Configure the Query to Import from the Activity Monitor
-The AD_ActivityCollection Job requires configuration to collect data. Follow the steps to modify the
-query configuration when Netwrix Activity Monitor is configured to host domain activity logs on an
-API server.
+The AD_ActivityCollection Job requires configuration to collect data. Complete the following steps to
+modify the query configuration when Netwrix Activity Monitor is configured to host domain activity
+logs on an API server.
:::note
Ensure the Activity Monitor API Server and the required Connection Profile are
@@ -144,9 +143,9 @@ logs.
### Configure the Query to Import from a Share
-The AD_ActivityCollection Job requires configuration to collect data. Follow the steps to modify the
-query configuration when Netwrix Activity Monitor is configured to store activity logs on a network
-share.
+The AD_ActivityCollection Job requires configuration to collect data. Complete the following steps to
+modify the query configuration when Netwrix Activity Monitor is configured to store activity logs on
+a network share.
:::note
Ensure the Activity Monitor domain output and the required Connection Profile are
@@ -205,7 +204,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **0.Collecti
**AD_ActivityCollection** Job. Select the **Configure** > **Analysis** node.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -229,8 +228,8 @@ The following analysis tasks are selected by default:
### Customize Analysis Parameters for the AD_ActivityCollection Job
-The customizable parameters for this job allow you to configure importing of AD activity data into
-the Netwrix Access Information Center.
+Use these customizable parameters to configure how the job imports AD activity data into the Netwrix
+Access Information Center.
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
| ----------------------------------------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- |
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_ldapqueries.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_ldapqueries.md
index 76522d757c..f862997f42 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_ldapqueries.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_ldapqueries.md
@@ -7,8 +7,8 @@ sidebar_position: 50
# LDAP > AD_LDAPQueries Job
The **LDAP** > **AD_LDAPQueries** Job analyzes LDAP traffic to determine trends such as most
-expensive queries, most active servers and users, successful/failed and signing status. This data
-can be used to troubleshoot performance issues, load balancing, and poorly configured services.
+expensive queries, most active servers and users, successful/failed and signing status. Use this data
+to troubleshoot performance issues, load balancing, and poorly configured services.
@@ -23,7 +23,7 @@ Navigate to the **Active Directory** > **6.Activity** > **LDAP** > **AD_LDAPQuer
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Except for the **Largest Queries** task, do not modify or deselect the remaining
+Except for the **Largest Queries** task, don't modify or deselect the remaining
selected analysis tasks. The remaining analysis tasks are preconfigured for this job.
:::
@@ -38,7 +38,7 @@ The following non-configurable analysis tasks are selected by default:
- User Summary – Creates the SA_AD_LDAPQueries_UserSummary table accessible under the job’s Results
node
-The following configurable analysis task can be optionally enabled:
+The following analysis task is optional:
- Largest Queries – Creates the SA_AD_LDAPQueries_ExpensiveQueries table accessible under the job’s
Results node
@@ -54,10 +54,10 @@ pre-configured reports:
### Configure the Largest Queries Analysis Task
-Customizable parameters enable you to set the values used to control the minimum objects returned
+Use the customizable parameters to set the values that control the minimum objects returned
and the days of traffic to analyze during this job’s analysis. The parameters can be customized and
-are listed in a section at the bottom of the SQL Script Editor. Follow the steps to customize an
-analysis task’s parameters.
+are listed in a section at the bottom of the SQL Script Editor. Complete the following steps to
+customize an analysis task’s parameters.
**Step 1 –** Navigate to the **Active Directory** > **6.Activity** > **LDAP** > **AD_LDAPQueries** >
**Configure** node and select **Analysis**.
@@ -68,14 +68,14 @@ analysis task’s parameters.
**Analysis Configuration**. The SQL Script Editor opens.
:::warning
-Do not change any parameters where the Value states `Created during execution`.
+Don't change any parameters where the Value states `Created during execution`.
:::
**Step 3 –** In the parameters section at the bottom of the editor, find the Value column. There are
-two integer variables that can be modified. Double-click on the current **value** and change as
+two integer variables that can be modified. Double-click the current **value** and change as
desired:
- @objects_returned – Controls the minimum number of objects returned for the queries to be
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_lockouts.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_lockouts.md
index fc5ec314f1..9913e92dff 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_lockouts.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_lockouts.md
@@ -23,7 +23,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Lockouts** > **AD_Lock
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/ad_computermodifications.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/ad_computermodifications.md
index 1467c5c4b6..b4ccadafc6 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/ad_computermodifications.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/ad_computermodifications.md
@@ -14,7 +14,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Changes** > **AD_Compu
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/ad_groupmodifications.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/ad_groupmodifications.md
index db642fbc08..385e7acf06 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/ad_groupmodifications.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/ad_groupmodifications.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# AD_GroupModifications Job
The AD_GroupModifications Job provides a report of all changes to group objects. A separate report
-is provided to highlight group membership changes. The list of top perpetrators can be used to
+is provided to highlight group membership changes. Use the list of top perpetrators to
identify out of band changes.
## Analysis Tasks for the AD_GroupModifications Job
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **Changes** >
**AD_GroupModifications** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/ad_usermodifications.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/ad_usermodifications.md
index 195a6efff2..eefbd230ac 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/ad_usermodifications.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/ad_usermodifications.md
@@ -14,7 +14,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **Changes** >
**AD_UserModifications** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/overview.md
index d786267148..490fb0e0e0 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/changes/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Changes Job Group
-The Changes Job Group provides an audit trail for changes made to Computer, Group and User objects
+The Changes Job Group provides an audit trail for changes made to Computer, Group, and User objects
within the environment.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/groupusage/ad_accesschanges.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/groupusage/ad_accesschanges.md
index 76761597ea..ab197a03e7 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/groupusage/ad_accesschanges.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/groupusage/ad_accesschanges.md
@@ -6,9 +6,9 @@ sidebar_position: 10
# AD_AccessChanges Job
-The AD_AccessChanges Job highlights the type and number of resources across the environment where
-access has been affected. Groups which have historically been the cause of most access changes are
-highlighted, to show potential issues in access sprawl and provisioning.
+The AD_AccessChanges Job highlights the type and number of resources in the environment affected by
+access changes. It also highlights groups that have historically caused the most access changes,
+revealing potential issues in access sprawl and provisioning.
## Analysis Tasks for the AD_AccessChanges Job
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **Group Usage
**AD_AccessChanges** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/groupusage/ad_grouphosts.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/groupusage/ad_grouphosts.md
index 45c8b8d3be..f26051e95f 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/groupusage/ad_grouphosts.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/groupusage/ad_grouphosts.md
@@ -14,7 +14,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **GroupUsage*
**AD_GroupHosts** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -35,4 +35,4 @@ following pre-configured reports:
| Report | Description | Default Tags | Report Elements |
| ---------------- | ------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Group Host Usage | Understand what groups are utilizing what hosts in the environment. | CCPA GDPR SOX HIPPA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of three elements: - Table – Displays security groups by target hosts
- Table – Displays hosts by associated groups
- Table – Displays authentication details
|
+| Group Host Usage | Understand what groups are using what hosts in the environment. | CCPA GDPR SOX HIPPA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of three elements: - Table – Displays security groups by target hosts
- Table – Displays hosts by associated groups
- Table – Displays authentication details
|
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/groupusage/ad_groupmemberactivity.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/groupusage/ad_groupmemberactivity.md
index 6e8d47938c..c794684ab9 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/groupusage/ad_groupmemberactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/groupusage/ad_groupmemberactivity.md
@@ -32,9 +32,10 @@ follow pre-configured report:
### Configure the Group Member Activity Analysis Task
-Customizable parameters enable you to set the values used to include the SIDs for admin groups
+Use the customizable parameters to set the values that include the SIDs for admin groups
during this job’s analysis. The parameters can be customized and are listed in a section at the
-bottom of the SQL Script Editor. Follow the steps to customize an analysis task’s parameters.
+bottom of the SQL Script Editor. Complete the following steps to customize an analysis task’s
+parameters.
**Step 1 –** Navigate to the **Active Directory** > **6.Activity** > **Group Usage** >
**AD_GroupMemberActivity** > **Configure** node and select **Analysis**.
@@ -42,10 +43,10 @@ bottom of the SQL Script Editor. Follow the steps to customize an analysis task
**Step 2 –** In the Analysis Selection view, select the Group Member Activity analysis task and
-click on **Analysis Configuration**. The SQL Script Editor opens.
+click **Analysis Configuration**. The SQL Script Editor opens.
:::warning
-Do not change any parameters where the Value states `Created during execution`.
+Don't change any parameters where the Value states `Created during execution`.
:::
@@ -54,8 +55,8 @@ Do not change any parameters where the Value states `Created during execution`.
**Step 3 –** In the parameters section at the bottom of the editor, find the Value column. Select
the cell for the temporary table called #admingroups, and click **Edit Table** to modify the value.
-- The new value should include SIDs for admin groups to be considered administrative groups beyond
- the default admin groups.
+- The new value should include the SIDs of any additional groups you want the job to treat as
+ administrative groups, beyond the default admin groups.
**Step 4 –** Click **Save and Close** to finalize the customization and close the SQL Script Editor
window.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_authenticationprotocol.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_authenticationprotocol.md
index 24d770c2bd..1814518ebc 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_authenticationprotocol.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_authenticationprotocol.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# AD_AuthenticationProtocol Job
The AD_Authentication Job shows what protocols are being used to authenticate across the environment
-and will help to identify what services and computers may be affected when disabling NTLM.
+and will help to identify what services and computers may be affected if you disable NTLM.
## Analysis Tasks for the AD_AuthenticationProtocol Job
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Operations** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_domaincontrollertraffic.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_domaincontrollertraffic.md
index 8efb6c4e4a..00a5bbfeb3 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_domaincontrollertraffic.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_domaincontrollertraffic.md
@@ -7,9 +7,9 @@ sidebar_position: 20
# AD_DomainControllerTraffic Job
The AD_DomainControllerTraffic Job provides a summary of the amount of traffic for Changes,
-Authentication, Replication, and LDAP Queries for each domain controller which can be used to
-identify issues with load balancing. If the AD_DCSummary job has been run, the roles for each domain
-controller will be provided.
+Authentication, Replication, and LDAP Queries for each domain controller. Use this summary to
+identify issues with load balancing. If you've run the AD_DCSummary job, the report includes the roles for each domain
+controller.
## Analysis Tasks for the AD_DomainControllerTraffic Job
@@ -18,7 +18,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Operations** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_hardcodeddcs.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_hardcodeddcs.md
index cc6cc87b1a..cf0a356aa9 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_hardcodeddcs.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_hardcodeddcs.md
@@ -14,7 +14,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Operations** > **AD_Ha
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_loadbalancing.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_loadbalancing.md
index 5a2a39386a..9737c1db75 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_loadbalancing.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_loadbalancing.md
@@ -7,9 +7,9 @@ sidebar_position: 40
# AD_LoadBalancing Job
The AD_LoadBalancing Job analyzes each domain controller's traffic to show what percent of all LDAP,
-Replication, Authentication and Changes are being handled by that particular machine. This helps to
-highlight domain controllers which are over utilized relative to others within the domain, or unused
-domain controllers which may be decommissioned.
+Replication, Authentication, and Changes traffic that particular machine handles. This helps you
+identify domain controllers that are overused relative to others in the domain, or unused domain
+controllers that you can decommission.
## Analysis Task for the AD_LoadBalancing Job
@@ -17,7 +17,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Operations** > **AD_Lo
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_machineowners.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_machineowners.md
index 12bd0a2662..47067a92b8 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_machineowners.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_machineowners.md
@@ -14,7 +14,7 @@ Navigate to the **Active Directory** > **6.Activity** > **Operations** > **AD_Ma
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/overview.md
index 18b3fd9707..0b8a674ffd 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/overview.md
@@ -21,15 +21,15 @@ Schedule these jobs to run with the 0.Collection job group.
- [AD_AuthenticationProtocol Job](/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_authenticationprotocol.md) – Shows what protocols are being
used to authenticate across the environment and will help to identify what services and computers
- may be affected when disabling NTLM
+ may be affected if you disable NTLM
- [AD_DomainControllerTraffic Job](/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_domaincontrollertraffic.md) – Provides a summary of the amount
- of traffic for Changes, Authentication, Replication, and LDAP Queries for each domain controller
- which can be used to identify issues with load balancing. If the AD_DCSummary job has been run,
- the roles for each DC will be provided.
+ of traffic for Changes, Authentication, Replication, and LDAP Queries for each domain controller.
+ Use this summary to identify issues with load balancing. If you've run the AD_DCSummary job,
+ the report includes the roles for each DC.
- [AD_HardcodedDCs Job](/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_hardcodeddcs.md) – Highlight machines that have communicated with only
one DC
- [AD_LoadBalancing Job](/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_loadbalancing.md) – Analyzes each domain controller's traffic to show
- what percent of all LDAP, Replication, Authentication and Changes are being handled by that
- particular machine. This helps to highlight domain controllers which are over utilized relative to
- others within the domain, or unused domain controllers which may be decommissioned.
+ what percent of all LDAP, Replication, Authentication, and Changes traffic that particular machine
+ handles. This helps you identify domain controllers that are overused relative to others in the
+ domain, or unused domain controllers that you can decommission.
- [AD_MachineOwners Job](/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/ad_machineowners.md) – Helps to identify the owner of a particular host
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/overview.md
index b5b0a3dcbc..ecf0881006 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/overview.md
@@ -32,11 +32,11 @@ The 6.Activity Job Group is comprised of the following jobs:
access across the entire environment, the actions taken by the members of a group, and identifies
where groups may be used for authorization in applications
- [LDAP > AD_LDAPQueries Job](/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_ldapqueries.md) – Analyzes LDAP traffic to determine trends such as
- most expensive queries, most active servers and users, successful/failed and signing status. This
- data can be used to troubleshoot performance issues, load balancing, and poorly configured
+ most expensive queries, most active servers and users, successful/failed and signing status. Use
+ this data to troubleshoot performance issues, load balancing, and poorly configured
services.
- [Lockouts > AD_Lockouts Job](/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_lockouts.md)– Provides a listing of all account lockouts with
- relevant details which can be used to aid troubleshooting
+ relevant details to aid troubleshooting
- [Operations Job Group](/docs/accessanalyzer/12.0/solutions/activedirectory/activity/operations/overview.md) – Reports on Active Directory activity events
related to operational activity. This group can help report on probable machine owners based on
authentications, domain controller traffic and activity, and authentication protocols being used
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/ad_adminaccounts.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/ad_adminaccounts.md
index e96c4b2d55..b52a5c5693 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/ad_adminaccounts.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/ad_adminaccounts.md
@@ -14,7 +14,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **Privileged
**AD_AdminAccounts** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -41,9 +41,10 @@ follow pre-configured reports:
### Configure the Summarize Administrative Account Activity Analysis Task
-Customizable parameters enable you to set the values used to include the NT Account name for admin
+Use the customizable parameters to set the values that include the NT Account name for admin
groups during this job’s analysis. The parameters can be customized and are listed in a section at
-the bottom of the SQL Script Editor. Follow the steps to customize an analysis task’s parameters.
+the bottom of the SQL Script Editor. Complete the following steps to customize an analysis task’s
+parameters.
**Step 1 –** Navigate to the **Active Directory** > **6.Activity** > **Privileged Accounts** >
**AD_AdminAccounts** > **Configure** node and select **Analysis**.
@@ -54,7 +55,7 @@ the bottom of the SQL Script Editor. Follow the steps to customize an analysis t
Activity** analysis task and click **Analysis Configuration**. The SQL Script Editor opens.
:::warning
-Do not change any parameters where the Value states `Created during execution`.
+Don't change any parameters where the Value states `Created during execution`.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/ad_serviceaccountauth.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/ad_serviceaccountauth.md
index 100a6cdd36..6c0f033b51 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/ad_serviceaccountauth.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/ad_serviceaccountauth.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **Operations*
**AD_ServiceAccountAuth** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/overview.md
index b13e8cdf27..d76b81d22d 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/overview.md
@@ -19,6 +19,6 @@ Schedule these jobs to run with the 0.Collection job group.
- [AD_AdminAccounts Job](/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/ad_adminaccounts.md) – Shows all actions taken by domain administrators
- within the environment being compromised
+ within the environment
- [AD_ServiceAccountAuth Job](/docs/accessanalyzer/12.0/solutions/activedirectory/activity/privilegedaccounts/ad_serviceaccountauth.md) – Shows the last time a service account,
identified by the presence of a servicePrincipalName, was active within the environment
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/recommended.md b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/recommended.md
index 0d7ead0f56..fdea2904c7 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/activity/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/activity/recommended.md
@@ -6,27 +6,27 @@ sidebar_position: 10
# Recommended Configurations for the 6.Activity Job Group
-The **Active Directory** > **6.Activity** Job Group has been configured by default to run with the
-out-of-the-box settings. It can be run directly or scheduled.
+By default, the **Active Directory** > **6.Activity** Job Group runs with the default settings. You
+can run it directly or schedule it.
**Dependencies**
- Successfully execute the **.Active Directory Inventory** Job Group
- Netwrix Activity Monitor 4.1+ is archiving AD Activity Logs
-- Successfully execute the **Active Directory** > **5.Domains Job Group** prior to running the
+- Successfully execute the **Active Directory** > **5.Domains Job Group** before running the
Operations Job Group
- (Optional) Successfully execute the **Active Directory Permissions Analyzer** > **0.Collection**
Job Group
- (Optional) Successfully execute the **FileSystem** > **0.Collection** Job Group
-**Targeted Host(s)**
+**Targeted Hosts**
Netwrix Activity Monitor API Server or the host with the network share housing archived log files.
**Connection Profile**
-Connection Profiles must be set directly on the
-[0.Collection > AD_ActivityCollection Job](/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_activitycollection.md) in order to connect to either
+Set Connection Profiles directly on the
+[0.Collection > AD_ActivityCollection Job](/docs/accessanalyzer/12.0/solutions/activedirectory/activity/ad_activitycollection.md) to connect to either
the SAM API Server or the host with the network share housing the archived log files.
**Access Token**
@@ -39,18 +39,18 @@ Required for SAM API Server integration for the
This group can be scheduled to run as desired.
:::info
-Run from the 6.Activity Job Group level in order to correlate 0.Collection job
+Run from the 6.Activity Job Group level to correlate 0.Collection job
group data with other jobs.
:::
**History Retention**
-History is not supported. Turning on history will cause issues with data analysis and reporting.
+History isn't supported. Turning on history will cause issues with data analysis and reporting.
**Multi-Console Support**
-Multiple Access Analyzer Consoles are not supported. This group should be run from a single Access
+Multiple Access Analyzer Consoles aren't supported. Run this group from a single Access
Analyzer Console.
**Workflow**
@@ -69,7 +69,7 @@ Monitor API Server or the host with the network share housing the archived log f
**Step 6 –** Run the jobs as desired.
-**Step 7 –** Run from the **6.Activity** Job Group level in order to correlate 0.Collection job
+**Step 7 –** Run from the **6.Activity** Job Group level to correlate 0.Collection job
group data with other jobs.
**Step 8 –** Review the reports generated by the jobs.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/ad_securityassessment.md b/docs/accessanalyzer/12.0/solutions/activedirectory/ad_securityassessment.md
index a8254b286b..7e0829f4d9 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/ad_securityassessment.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/ad_securityassessment.md
@@ -9,7 +9,7 @@ sidebar_position: 90
The AD_SecurityAssessment Job performs checks against Active Directory security best practices in
order to proactively identify critical security configurations that leave Active Directory
vulnerable to attack. The result are reports that provide a listing of findings by severity and
-category with corresponding details that can be used to prioritize and remediate security issues.
+category with corresponding details you can use to prioritize and remediate security issues.
@@ -17,7 +17,7 @@ category with corresponding details that can be used to prioritize and remediate
**Dependencies**
-One or more of the following job groups or jobs must be run to produce results:
+To produce results, run one or more of the following job groups or jobs:
- .Active Directory Inventory Job Group
- Active Directory Job Group
@@ -51,14 +51,14 @@ One or more of the following job groups or jobs must be run to produce results:
- Windows > Privileged Accounts > Service Accounts > SG_ServiceAccounts
:::note
-If any of the above jobs are not completed, the AD_SecurityAssessment job will run but all
-checks will not be assessed.
+If any of these jobs aren't completed, the AD_SecurityAssessment job runs, but it doesn't
+assess all checks.
:::
**Target Host**
-This job group does not collect data. No target host is required.
+This job group doesn't collect data. No target host is required.
**Connection Profile**
@@ -70,11 +70,11 @@ Scheduled to run as desired
**History Retention**
-History is not supported. Turning on history will cause issues with data analysis and reporting.
+History isn't supported. Turning on history will cause issues with data analysis and reporting.
**Multi-console Support**
-Multiple StealthAUDIT consoles are not supported. This job should be run from a single StealthAUDIT
+Multiple StealthAUDIT consoles aren't supported. Run this job from a single StealthAUDIT
console.
## Analysis Task for the AD_SecurityAssessment Job
@@ -83,7 +83,7 @@ Navigate to the **Jobs** > Active Directory > AD_SecurityAssessment > Configure
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/certificateauthority/ad_cacollection.md b/docs/accessanalyzer/12.0/solutions/activedirectory/certificateauthority/ad_cacollection.md
index a76c4886ef..20553c7392 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/certificateauthority/ad_cacollection.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/certificateauthority/ad_cacollection.md
@@ -12,8 +12,7 @@ job is located in the Collection job group.
**Target Host**
-It is recommended to target the **ONE DOMAIN CONTROLLER PER DOMAIN** or **Default domain
-controller** host list.
+Target the **ONE DOMAIN CONTROLLER PER DOMAIN** or **Default domain controller** host list.
## Queries for the AD_CACollection Job
@@ -39,7 +38,7 @@ Navigate to the **Active Directory** > **7.Certificate Authority** > **Collectio
**AD_CACollection** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/certificateauthority/ad_certificateaudit.md b/docs/accessanalyzer/12.0/solutions/activedirectory/certificateauthority/ad_certificateaudit.md
index 3aea5b8016..df46f0fd16 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/certificateauthority/ad_certificateaudit.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/certificateauthority/ad_certificateaudit.md
@@ -14,7 +14,7 @@ Navigate to the **Active Directory** > **7.Certificate Authority** > **AD_Certif
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -33,4 +33,4 @@ produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Certificate Authority Configuration | This report helps in identifying Certificate Authority configuration risks associated with permissions applied on the Active Directory object level as well as other unintended configurations set on the Certificate Authority level. Additionally, the rights on a Certificate Authority should be limited to those intended to administer or manage the Certificate Authority, so the ManageCA rights and ManageCertificate rights should be reviewed for potential misconfiguration. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays a summary of Certificate Authority permissions
- Table – Provides details on Certificate Authorities
- Table – Provides details on access rights
|
+| Certificate Authority Configuration | This report helps identify Certificate Authority configuration risks associated with permissions applied on the Active Directory object level as well as other unintended configurations set on the Certificate Authority level. Additionally, limit the rights on a Certificate Authority to those needed to administer or manage it, and review the ManageCA and ManageCertificate rights for potential misconfiguration. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays a summary of Certificate Authority permissions
- Table – Provides details on Certificate Authorities
- Table – Provides details on access rights
|
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/certificateauthority/ad_certificaterequests.md b/docs/accessanalyzer/12.0/solutions/activedirectory/certificateauthority/ad_certificaterequests.md
index 0f4063c5ad..078710c3cd 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/certificateauthority/ad_certificaterequests.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/certificateauthority/ad_certificaterequests.md
@@ -11,8 +11,8 @@ are expiring soon.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
-parameters used by analysis tasks in the job. See the
+Use the Configuration section on a Job's overview page to modify any customizable parameters used
+by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -20,9 +20,9 @@ The AD_CertificateRequests job has the following configurable parameter:
- Number of days to consider a cert close to expiration (default 60)
-This parameter sets the definition of an expiring certificate, which is used by the Certificate
-Expiration analysis task to identify any certificates expiring with this specified next number of
-days. The default is 60 days.
+This parameter defines what counts as an expiring certificate. The Certificate Expiration analysis
+task uses it to identify certificates expiring within the specified number of days. The default is
+60 days.
## Analysis Tasks for the AD_CertificateRequests Job
@@ -30,7 +30,7 @@ Navigate to the **Active Directory** > **7.Certificate Authority** > **AD_Certif
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -41,8 +41,8 @@ The default analysis tasks are:
- Suspicious Principal Certs – Identifies certificates that show the requester requesting a
certificate for a different principal
-- OID in Template – Analysis on certificate Extended Key Usage (EKU) Object Identifier (OID) being
- in template OID
+- OID in Template – Identifies certificates where the Extended Key Usage (EKU) Object Identifier
+ (OID) is in the template OID
- Certificate Expiration – Identifies certificates that expire in the next number of days set by the
customizable parameter. The default number of days is 60. Creates the
SA_AD_CertificateRequests_ExpiringSoon table accessible under the job’s Results node.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/ad_cleanupprogress.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/ad_cleanupprogress.md
index 1c78484f63..82b9b79bb8 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/ad_cleanupprogress.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/ad_cleanupprogress.md
@@ -6,10 +6,10 @@ sidebar_position: 50
# AD_CleanupProgress Job
-The AD_CleanupProgress Job performs checks against Active Directory security best practices in order
-to proactively identify critical security configurations that leave Active Directory vulnerable to
+The AD_CleanupProgress Job performs checks against Active Directory security best practices to
+proactively identify critical security configurations that leave Active Directory vulnerable to
attack. The result is a report which provides a listing of findings by severity and category with
-corresponding details that can be used to prioritize and remediate security issues.
+corresponding details you can use to prioritize and remediate security issues.
@@ -17,8 +17,8 @@ corresponding details that can be used to prioritize and remediate security issu
**Step 1 –** Ensure the following prerequisites are met:
-- The .Active Directory Inventory Job Group needs to be successfully run prior to running this job
-- The following jobs from the Active Directory Solution must be run prior to running this job:
+- The .Active Directory Inventory Job Group needs to be successfully run before running this job
+- The following jobs from the Active Directory Solution must be run before running this job:
- **Active Directory** > **1.Groups** > **AD_DuplicateGroups**
- **Active Directory** > **2.Users** > **AD_DirectMembership**
@@ -35,7 +35,7 @@ Navigate to the **Active Directory** > **Cleanup** > **AD_CleanupProgress** > **
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers.md
index 14f625f17d..4dc9dc7662 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers.md
@@ -10,7 +10,7 @@ The AD_DeprovisionComputers Job provides a simple automated workflow deprovision
**Step 1 –** Move stale computers to a staging OU for deletion.
-**Step 2 –** The assigned manager is alerted by email of the impending deletion.
+**Step 2 –** Alerts the assigned manager by email of the impending deletion.
**Step 3 –** Disables computer accounts.
@@ -19,8 +19,8 @@ staging OU. The default is 365 days.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
-parameters used by analysis tasks in the job. See the
+Use the Configuration section on a Job's overview page to modify any customizable parameters used
+by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -52,8 +52,8 @@ The default analysis tasks are:
### Customizable Analysis Parameters for the AD_DeprovisionComputers Job
-Customizable parameters enable you to set the values used to classify user and group objects during
-this job’s analysis.
+Use customizable parameters to set the values used to classify user and group objects during this
+job's analysis.
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
| --------------------------- | --------------------------- | ------------- | ---------------------------------------------- |
@@ -69,7 +69,7 @@ Navigate to the **Active Directory** > **Cleanup** > **3.Computers** > **AD_Depr
**Configure** node and select **Actions** to view the actions.
:::warning
-Do not enable the actions unless it is required. Disable the actions after execution to
+Don't enable the actions unless it is required. Disable the actions after execution to
prevent making unintended and potentially harmful changes to Active Directory.
:::
@@ -85,7 +85,7 @@ The action tasks must be executed together and in order.
- Move Computers – Move computers to staging OU for deletion
- - The target staging OU must be set in the Move Computers Action Task prior to executing the
+ - The target staging OU must be set in the Move Computers Action Task before executing the
action tasks. See the [Configure the Target OU](/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/configuretargetou.md) topic for additional
information.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers_status.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers_status.md
index fda4c83df8..64ef1271a1 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers_status.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/computers/ad_deprovisioncomputers_status.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **Cleanup** > **3.Computers** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/computers/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/computers/overview.md
index 856c8fefc9..85c06bd838 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/computers/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/computers/overview.md
@@ -24,10 +24,10 @@ The jobs in the 3.Computers Job Group are:
- The .Active Directory Inventory Job Group needs to be successfully run
- For the AD_DeprovisionComputers Job, the target OU needs to be manually set in the Move Computers
- Action Task prior to executing the actions. See the
+ Action Task before executing the actions. See the
[Action Tasks for the AD_DeprovisionComputers Job](ad_deprovisioncomputers.md#action-tasks-for-the-ad_deprovisioncomputers-job)
topic for additional information.
-- The AD_DeprovisionComputers Job needs to be run prior to running the
+- The AD_DeprovisionComputers Job needs to be run before running the
AD_DeprovisionComputers_Status Job
**Step 2 –** Schedule the 3.Computers Job Group to run as desired after the prerequisites have been
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/configuretargetou.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/configuretargetou.md
index ed002bb746..a0375d4830 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/configuretargetou.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/configuretargetou.md
@@ -6,13 +6,13 @@ sidebar_position: 60
# Configure the Target OU
-Follow the steps to configure the target staging OU.
+Configure the target staging OU:
**Step 1 –** Navigate to the **[Job]** > **Configure** > **Actions** node.
-**Step 2 –** On the Action Selection page, select the desired action task and click **Action
+**Step 2 –** On the Action Selection page, select the action task you want and click **Action
Properties**.
**Step 3 –** In the Action Properties window, select **Configure Action**. The Active Directory
@@ -21,8 +21,8 @@ Action Module Wizard opens.
**Step 4 –** Navigate to the Move Objects page of the Active Directory Action Module Wizard. In the
-OU field, enter or browse to the desired target OU. To create the target OU location, select the
-**Create target OU location if it does not already exist** checkbox.
+OU field, enter or browse to the target OU you want. To create the target OU location, select the
+**Create target OU location if it doesn't already exist** checkbox.
**Step 5 –** Navigate to the Summary page and click **Finish**.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups.md
index ca35e7bef4..a11eac7da5 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups.md
@@ -6,24 +6,24 @@ sidebar_position: 10
# AD_DeprovisionGroups Job
-The AD_DeprovisionGroups Job provides an automated workflow to deprovision stale groups. This
-workflow is completed by the action tasks.
+The AD_DeprovisionGroups Job provides an automated workflow to deprovision stale groups. The action
+tasks complete this workflow.
**Step 1 –** Move stale groups to a staging OU for deletion.
-**Step 2 –** The group is changed to a distribution list.
+**Step 2 –** Changes the group to a distribution list.
-**Step 3 –** The assigned manager is alerted by email of the impending deletion.
+**Step 3 –** Alerts the assigned manager by email of the impending deletion.
-**Step 4 –** The group is flagged as **To Be Deleted**.
+**Step 4 –** Flags the group as **To Be Deleted**.
-**Step 5 –** After a configurable amount of days in the staging OU, the group is deleted from the
+**Step 5 –** After a configurable amount of days in the staging OU, deletes the group from the
staging OU. The default is 365 days.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
-parameters used by analysis tasks in the job. See the
+Use the Configuration section on a Job's overview page to modify any customizable parameters used
+by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic
for instructions on how to edit parameters on a job overview page.
@@ -54,8 +54,8 @@ The default analysis tasks are:
### Customizable Analysis Parameters for the AD_DeprovisionGroups Job
-Customizable parameters enable you to set the values used to classify user and group objects during
-this job’s analysis.
+Use customizable parameters to set the values used to classify user and group objects during this
+job's analysis.
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
| ---------------- | --------------------------- | ------------- | -------------------------------------- |
@@ -71,7 +71,7 @@ Navigate to the **Active Directory** > **Cleanup** > **1.Groups** > **1. Deprovi
**AD_DeprovisonGroups** > **Configure** node and select **Actions** to view the action tasks.
:::warning
-Do not enable the actions unless it is required. Disable the actions after execution to
+Don't enable the actions unless it is required. Disable the actions after execution to
prevent making unintended and potentially harmful changes to Active Directory.
:::
@@ -87,15 +87,15 @@ The action tasks must be executed together and in order.
- Move Groups – Move groups to staging OU
- - The target staging OU must be set in the Move Groups Action Task prior to executing the action
+ - The target staging OU must be set in the Move Groups Action Task before executing the action
tasks. See the [Configure the Target OU](/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/configuretargetou.md) topic for additional
information.
-- Disable Groups – The group is changed to a distribution list
+- Disable Groups – Changes the group to a distribution list
- Notify Manager – Notify assigned manager by email of the impending deletion
-- Update Description – The group is changed to a distribution list to prevent its use for
- authentication and flagged as **To Be Deleted**
-- Delete Groups – After a configurable amount of days in the staging OU, the group is deleted. The
+- Update Description – Changes the group to a distribution list to prevent its use for
+ authentication and flags it as **To Be Deleted**
+- Delete Groups – After a configurable amount of days in the staging OU, deletes the group. The
default is 365 days.
After the `@days_before_deleting` analysis parameter has been configured and the target OU has been
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups_status.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups_status.md
index 2566235230..0f7962ae12 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups_status.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/deprovision/ad_deprovisiongroups_status.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **Cleanup** > **1.Groups** > **1. Deprovi
tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis tasks is
+Don't modify or deselect the selected analysis task. The analysis tasks is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/overview.md
index 1cf8e664dc..8052ea3807 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# 1.Groups Job Group
-The 1.Groups Job Group provides a workflow to safely deprovision groups, as well as the ability to
-stamp security groups with what resources they are given access to.
+The 1.Groups Job Group provides a workflow to safely deprovision groups and stamp security groups
+with the resources they can access.
@@ -25,8 +25,8 @@ The jobs in the 1.Groups Job Group are:
for all security groups to show where the group is provisioned inside the environment.
- [AD_GroupCleanup_Permissions Job](/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/stamping/ad_groupcleanup_permissions.md) – This job reports
- on where security groups are being used to assign permissions. This can be used to prioritize
- remediation for groups that are rarely used.
+ on where security groups are being used to assign permissions. Use this information to
+ prioritize remediation for groups that are rarely used.
- [AD_GroupStamping Job](/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/stamping/ad_groupstamping.md) – This job replaces the Notes attribute
for all security groups to show where the group is provisioned inside the environment. This
overwrites the Notes field with data from Access Analyzer.
@@ -37,10 +37,10 @@ The jobs in the 1.Groups Job Group are:
- The .Active Directory Inventory Job Group needs to be successfully run
- For the AD_DeprovisionGroups Job, the target OU needs to be manually set in the Move Groups Action
- Task prior to executing the actions. See the
+ Task before executing the actions. See the
[Action Tasks for the AD_DepvisionGroups Job](deprovision/ad_deprovisiongroups.md#action-tasks-for-the-ad_depvisiongroups-job)
topic for additional information.
-- The AD_DeprovisionGroups Job needs to be run prior to running the AD_DeprovisionGroups_Status Job
+- The AD_DeprovisionGroups Job needs to be run before running the AD_DeprovisionGroups_Status Job
**Step 2 –** Schedule the 1.Groups Job Group to run as desired after the prerequisites have been
satisfied.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/stamping/ad_groupcleanup_permissions.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/stamping/ad_groupcleanup_permissions.md
index bb53e84bc1..23cf6817ba 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/stamping/ad_groupcleanup_permissions.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/stamping/ad_groupcleanup_permissions.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# AD_GroupCleanup_Permissions Job
The AD_GroupCleanup_Permissions Job reports on where security groups are being used to assign
-permissions. This can be used to prioritize remediation for groups that are rarely used.
+permissions. Use this information to prioritize remediation for groups that are rarely used.
## Analysis Tasks for the AD_GroupCleanup_Permissions Job
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **Cleanup** > **1.Groups** > **2. Group S
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/stamping/ad_groupstamping.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/stamping/ad_groupstamping.md
index 6ad91c8268..444f65952c 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/stamping/ad_groupstamping.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/stamping/ad_groupstamping.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **Cleanup** > **1.Groups** > **2. Group S
AD_GroupStamping** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/overview.md
index 79f0eedd13..ec29a8b63c 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/overview.md
@@ -28,12 +28,11 @@ environment.
The job groups in the Cleanup Job Group are:
- [1.Groups Job Group](/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/groups/overview.md) – Provides an automated workflow to safely deprovision
- groups, as well as the ability to stamp security groups with what resources they are given access
- to
+ groups and stamp security groups with the resources they can access
- [2.Users Job Group](/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/users/overview.md) – Provides an automated workflow to deprovision stale and
unused user accounts
- [3.Computers Job Group](/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/computers/overview.md) – Provides an automated workflow to deprovision
stale computer accounts
- [AD_CleanupProgress Job](/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/ad_cleanupprogress.md) – Tracks Active Directory computer, group, and
- user exceptions over time. This information can be used to provide a high-level picture of an
+ user exceptions over time. Use this information to provide a high-level picture of an
organization's Active Directory cleanup effort.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/recommended.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/recommended.md
index 4ae21882f5..9238cbd6b6 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/recommended.md
@@ -14,7 +14,7 @@ The Cleanup job group has the following prerequisites:
- The Active Directory Actions license feature is required
- The Active Directory Actions Module must be installed
-- The .Active Directory Inventory Job Group needs to be successfully run prior to running this job
+- The .Active Directory Inventory Job Group needs to be successfully run before running this job
group
- The following job groups from the Activity Directory job group need to be successfully run prior
to running this job group:
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/users/ad_deprovisionusers.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/users/ad_deprovisionusers.md
index 95d81b2307..e5839b3a23 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/users/ad_deprovisionusers.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/users/ad_deprovisionusers.md
@@ -11,11 +11,11 @@ accounts.
**Step 1 –** Move stale users to a staging OU for deletion.
-**Step 2 –** The assigned manager is alerted by email of the impending deletion.
+**Step 2 –** Alerts the assigned manager by email of the impending deletion.
-**Step 3 –** User accounts are disabled.
+**Step 3 –** Disables user accounts.
-**Step 4 –** Users are flagged as **To Be Deleted**.
+**Step 4 –** Flags users as **To Be Deleted**.
**Step 5 –** Delete users from the staging OU.
@@ -23,8 +23,8 @@ accounts.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
-parameters used by analysis tasks in the job. See the
+Use the Configuration section on a Job's overview page to modify any customizable parameters used
+by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -57,8 +57,8 @@ The default analysis tasks are:
### Customizable Analysis Parameters for the AD_DeprovisionUsers Job
-Customizable parameters enable you to set the values used to classify user and group objects during
-this job’s analysis.
+Use customizable parameters to set the values used to classify user and group objects during this
+job's analysis.
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
| ----------------------- | --------------------------- | ------------- | ----------------------------------------------- |
@@ -74,7 +74,7 @@ Navigate to the **Active Directory** > **Cleanup** > **2.Users** > **AD_Deprovis
**Configure** node and select **Actions** to view the actions.
:::warning
-Do not enable the actions unless it is required. Disable the actions after execution to
+Don't enable the actions unless it is required. Disable the actions after execution to
prevent making unintended and potentially harmful changes to Active Directory.
:::
@@ -90,7 +90,7 @@ The action tasks must be executed together and in order.
- Move Users – Move users to staging OU for deletion
- - The target OU must be set in the Move Users Action Task prior to executing the action tasks.
+ - The target OU must be set in the Move Users Action Task before executing the action tasks.
See the [Configure the Target OU](/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/configuretargetou.md) topic for additional information.
- Notify Manager – Notify assigned manager by email of the impending deletion
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/users/ad_deprovisionusers_status.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/users/ad_deprovisionusers_status.md
index f1d3e79ca0..9564d6f6a7 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/users/ad_deprovisionusers_status.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/users/ad_deprovisionusers_status.md
@@ -14,7 +14,7 @@ Navigate to the **Active Directory** > **Cleanup** > **2.Users** > **AD_Deprovis
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/users/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/users/overview.md
index 4fa7116698..ce31625905 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/users/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/cleanup/users/overview.md
@@ -23,10 +23,10 @@ The jobs in the 2.Users Job Group are:
- The .Active Directory Inventory Job Group needs to be successfully run
- For the AD_DeprovisionUsers Job, the target OU needs to be manually set in the Move Users Action
- Task prior to executing the actions. See the
+ Task before executing the actions. See the
[Action Tasks for the AD_DeprovisionUsers Job](ad_deprovisionusers.md#action-tasks-for-the-ad_deprovisionusers-job)
topic for additional information.
-- The AD_DeprovisionUsers Job needs to be run prior to running the AD_DeprovisionUsers_Status Job
+- The AD_DeprovisionUsers Job needs to be run before running the AD_DeprovisionUsers_Status Job
**Step 2 –** Schedule the 2.Users Job Group to run as desired after the prerequisites have been
satisfied.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/computers/ad_computerdelegation.md b/docs/accessanalyzer/12.0/solutions/activedirectory/computers/ad_computerdelegation.md
index e767b277dc..88a29b88e5 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/computers/ad_computerdelegation.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/computers/ad_computerdelegation.md
@@ -6,11 +6,11 @@ sidebar_position: 20
# AD_ComputerDelegation Job
-The AD_ComputerDelegation Job provides details on computer accounts that have been enabled for
-unconstrained delegation. Once this configuration is enabled for a computer, any time an account
-connects to the computer for any reason, their ticket-granting ticket (TGT) is stored in memory so
-it can be used later by the computer for impersonation, which exposes a significant security risk in
-cases where privileged accounts access the computer. See the
+The AD_ComputerDelegation Job provides details on computer accounts that have unconstrained
+delegation enabled. When an account connects to one of these computers, Active Directory stores the
+account's ticket-granting ticket (TGT) in memory. The computer can then reuse that TGT for
+impersonation, which creates a significant security risk if privileged accounts access the computer.
+See the
[What Is Kerberos Delegation?](https://blog.netwrix.com/2021/11/30/what-is-kerberos-delegation-an-overview-of-kerberos-delegation/) Netwrix
blog article for more information about this configuration and the related security risks.
@@ -20,7 +20,7 @@ Navigate to the **Active Directory** > **3.Computers** > **AD_ComputerDelegation
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the analysis task. The analysis task is preconfigured for
+Don't modify or deselect the analysis task. The analysis task is preconfigured for
this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/computers/ad_stalecomputers.md b/docs/accessanalyzer/12.0/solutions/activedirectory/computers/ad_stalecomputers.md
index 439730b1e5..c1f1536ee1 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/computers/ad_stalecomputers.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/computers/ad_stalecomputers.md
@@ -10,8 +10,8 @@ The AD_StaleComputers Job provides details on stale computers that may be candid
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
-parameters used by analysis tasks in the job. See the
+Use the Configuration section on a Job's overview page to modify any customizable parameters used
+by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -30,7 +30,7 @@ Navigate to the **Active Directory** > **3.Computers** > **AD_StaleComputers** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the **2. Summarize by Domain** analysis task. This analysis
+Don't modify or deselect the **2. Summarize by Domain** analysis task. This analysis
task is preconfigured for this job.
:::
@@ -44,7 +44,7 @@ The default analysis tasks are:
- Identifies computer objects that are disabled or have exceeded the defined threshold of
inactivity
- Creates the SA_AD_StaleComputers_Details table accessible under the job’s Results node
- - Definition of a stale computer can be customized
+ - You can customize the definition of a stale computer
- **2. Summarize by Domain** – Creates the SA_AD_StaleComputers_DomainSummay table accessible under
the job’s Results node
@@ -65,7 +65,7 @@ Analysis parameters that can be customized have the following default values:
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
| --------------------------- | --------------------------- | ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1. Identify Stale Computers | @days_since_last_logon | 90 | A computer object that has been inactive for 90 days or more |
-| 1. Identify Stale Computers | @consider_disable | 1 | A computer object that has been disabled: - Value 1 = Disabled computers are included as stale
- Value 0 = Disabled computers are not included as stale
|
+| 1. Identify Stale Computers | @consider_disable | 1 | A computer object that has been disabled: - Value 1 = Disabled computers are included as stale
- Value 0 = Disabled computers aren't included as stale
|
See the
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/computers/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/computers/overview.md
index 2d439a8958..7a712d8e0b 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/computers/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/computers/overview.md
@@ -14,10 +14,10 @@ computer accounts, including stale computers and computers that have been truste
The following jobs comprise the 3.Computers Job Group:
- [AD_ComputerDelegation Job](/docs/accessanalyzer/12.0/solutions/activedirectory/computers/ad_computerdelegation.md) – Provides details on computer accounts that
- have been trusted for delegation. Once this configuration is enabled for a computer, any time an
- account connects to the computer for any reason, their ticket-granting ticket (TGT) is stored in
- memory so it can be used later by the computer for impersonation, which exposes a significant
- security risk in cases where privileged accounts access the computer. See the
+ have unconstrained delegation enabled. When an account connects to one of these computers, Active
+ Directory stores the account's ticket-granting ticket (TGT) in memory. The computer can then reuse
+ that TGT for impersonation, which creates a significant security risk if privileged accounts
+ access the computer. See the
[What Is Kerberos Delegation?](https://blog.netwrix.com/2021/11/30/what-is-kerberos-delegation-an-overview-of-kerberos-delegation/) Netwrix
blog article for more information about this configuration and the related security risks.
- [AD_StaleComputers Job](/docs/accessanalyzer/12.0/solutions/activedirectory/computers/ad_stalecomputers.md) – Provides details on stale computers that may be
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/computers/recommended.md b/docs/accessanalyzer/12.0/solutions/activedirectory/computers/recommended.md
index 521cf0da01..e9996c7a2c 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/computers/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/computers/recommended.md
@@ -11,22 +11,22 @@ default settings. It can be run directly or scheduled.
**Dependencies**
-The **.Active Directory Inventory** Job Group needs to be successfully executed prior to running
+The **.Active Directory Inventory** Job Group needs to be successfully executed before running
this job group.
**Target Host**
-This job group does not collect data. No target host is required.
+This job group doesn't collect data. No target host is required.
**Connection Profile**
-This job group does not collect data. No specific Connection Profile is required.
+This job group doesn't collect data. No specific Connection Profile is required.
**Schedule Frequency**
-The data analyzed by the 3.Computers Job Group jobs is collected by the .Active Directory Inventory
-Job Group. Therefore, it is recommended to schedule these jobs to run after the .Active Directory
-Inventory job group collection has completed. These jobs can be scheduled to run as desired.
+The .Active Directory Inventory Job Group collects the data that the 3.Computers Job Group jobs
+analyze. Schedule these jobs to run after the .Active Directory Inventory Job Group finishes
+collecting data, and run them as often as needed.
**Run at the Job Group Level**
@@ -43,8 +43,8 @@ analysis tasks are preconfigured for this Job Group.
Some analysis tasks have customizable parameters:
-- The **Active Directory** > **3.Computers** > **AD_StaleComputers** Job defines stale users. The
- parameters can be customized.
+- The **Active Directory** > **3.Computers** > **AD_StaleComputers** Job defines stale users. You
+ can customize the parameters.
**Workflow**
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_dcsummary.md b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_dcsummary.md
index 8447752c7e..3e76c2fe07 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_dcsummary.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_dcsummary.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory > 5.Domains > AD_DCSummary > Configure** node
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_domaininfo.md b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_domaininfo.md
index 9821d07153..3e1550e263 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_domaininfo.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_domaininfo.md
@@ -16,7 +16,7 @@ The AD_DomainInfo Job uses the ActiveDirectory Data Collector and the LDAP Data
following queries:
:::warning
-Do not modify the queries. The queries are preconfigured for this job.
+Don't modify the queries. The queries are preconfigured for this job.
:::
@@ -42,7 +42,7 @@ Navigate to the **Active Directory > 5.Domains > AD_DomainInfo > Configure** nod
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_dsrmsettings.md b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_dsrmsettings.md
index a23153dfef..b689df26b6 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_dsrmsettings.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_dsrmsettings.md
@@ -7,8 +7,8 @@ sidebar_position: 50
# AD_DSRMSettings Job
The AD_DRSMSettings Job provides details on domain controller registry settings for the
-DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the DSRM Admin Account can be used to log
-in to the domain controller even if it has not been started in DSRM which can present a potential
+DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the DSRM Admin Account can log
+in to the domain controller even if it has not been started in DSRM, which can present a potential
security vulnerability. Additional information on this registry key is available in this
[Microsoft Document](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732714(v=ws.10)?redirectedfrom=MSDN).
@@ -18,7 +18,7 @@ Navigate to the **Active Directory > 5.Domains > AD_DSRMSettings > Configure** n
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -37,4 +37,4 @@ the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| DSRM Admin Security | This report highlights domain controller registry settings for the DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the DSRM Admin account can be used to log in to the domain controller even if it has not been started in DSRM. This is a potential vulnerability. See the Microsoft [Restartable AD DS Step-by-Step Guide](https://technet.microsoft.com/en-us/library/cc732714(v=ws.10).aspx) for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays DSRM admin logon by domain controller
- Table – Provides details on domain controllers
|
+| DSRM Admin Security | This report highlights domain controller registry settings for the DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the DSRM Admin account can log in to the domain controller even if it has not been started in DSRM. This is a potential vulnerability. See the Microsoft [Restartable AD DS Step-by-Step Guide](https://technet.microsoft.com/en-us/library/cc732714(v=ws.10).aspx) for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays DSRM admin logon by domain controller
- Table – Provides details on domain controllers
|
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_kerberoastingrisk.md b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_kerberoastingrisk.md
index 540c5b92ef..59c861d03e 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_kerberoastingrisk.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_kerberoastingrisk.md
@@ -10,7 +10,8 @@ The AD_KerberoastingRisk job identifies accounts vulnerable to kerberoasting. Ke
threat where attackers target service accounts in Active Directory to steal their passwords.
In a kerberoasting attack, attackers request service tickets (TGS) for service accounts from the Key
-Distribution Center (KDC). These tickets are encrypted with the service account's password hash.
+Distribution Center (KDC). Active Directory encrypts these tickets with the service account's
+password hash.
Attackers attempt to crack these hashes offline to reveal the passwords for the service accounts.
Encryption types vulnerable to kerberoasting include RC4 and DES. AES-128 can also be considered
@@ -22,7 +23,7 @@ article for additional information on kerberoasting.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -43,7 +44,7 @@ Navigate to the **Active Directory** > **5.Domains** > **AD_KerberoastingRisk**
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -54,9 +55,9 @@ The default analysis tasks are:
- Kerberoasting Details – Provides details on accounts vulnerabilities to Kerberoasting
- - This task uses three customizable parameters. These allow you to optionally consider AES-128
- as a weak encryption type, consider Password Never Expires as being easily crackable, and
- include disabled user accounts. See the
+ - This task uses three customizable parameters. Use these parameters to optionally consider
+ AES-128 as a weak encryption type, consider Password Never Expires as being easily crackable,
+ and include disabled user accounts. See the
[Parameter Configuration](#parameter-configuration) topic for additional information.
- Kerberoasting Summary – Summarizes accounts by domain with counts for multiple vulnerabilities
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_domaincontrollers.md b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_domaincontrollers.md
index 2a68d9685d..d1046f7775 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_domaincontrollers.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_domaincontrollers.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# AD_DomainControllers Job
-The 0.Collection > AD_DomainControllers Job collects domain controller details which will be further
-analyzed in order to provide information on domains, sites, and trusts.
+The 0.Collection > AD_DomainControllers Job collects domain controller details for further analysis
+to provide information on domains, sites, and trusts.
## Queries for the AD_DomainControllers Job
@@ -15,7 +15,7 @@ The AD_DomainControllers Job uses the LDAP Data Collector and the ActiveDirector
the following queries:
:::warning
-Except the first query, do not modify the remaining queries. The remaining queries are
+Except the first query, don't modify the remaining queries. The remaining queries are
preconfigured for this job.
:::
@@ -26,7 +26,7 @@ The queries for this job are:
- Domain Controller Listing – Targets one domain controller per domain known to Access Analyzer to
collect a listing of all domain controllers
- - Can be modified to connect securely with TLS/SSL.
+ - You can modify this query to connect securely with TLS/SSL.
- See the [Connect Securely with TLS/SSL](#connect-securely-with-tlsssl) topic for additional
information.
- Actual Bridgehead Servers – Targets one domain controller per domain known to Access Analyzer to
@@ -47,10 +47,10 @@ The queries for this job are:
### Connect Securely with TLS/SSL
The Domain Controller Listing Query in the AD_DomainControllers Job is configured to use the LDAP
-Data Collector. This query can be optionally configured to connect securely with TLS/SSL.
+Data Collector. You can optionally configure this query to connect securely with TLS/SSL.
:::warning
-Do not modify any other settings in this query.
+Don't modify any other settings in this query.
:::
@@ -72,6 +72,6 @@ opens.
**Ignore Certificate Errors** to connect even if certificate errors occur. Use **Server Port** 686
for a secure connection. Click **OK** to close the Options page.
-**Step 6 –** Step 13 – Then click **OK** to close the LDAP template form wizard.
+**Step 6 –** Click **OK** to close the LDAP template form wizard.
The job now connects securely with TLS/SSL.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_dsrm.md b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_dsrm.md
index 0c045d1858..d988c9de71 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_dsrm.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_dsrm.md
@@ -7,17 +7,17 @@ sidebar_position: 20
# AD_DSRM Job
The **0.Collection > AD_DSRM** Job collects data related to domain controller registry settings for
-the DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the DSRM Admin Account can be used to
-log in to the domain controller even if it has not been started in DSRM which can present a
+the DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the DSRM Admin Account can log in to
+the domain controller even if it has not been started in DSRM, which can present a
potential security vulnerability. Additional information on this registry key is available in this
[Microsoft Document](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732714(v=ws.10)?redirectedfrom=MSDN).
## Query for the AD_DSRM Job
-The AD_TimeSync Job uses the Registry Data Collector for the following query:
+The AD_DSRM Job uses the Registry Data Collector for the following query:
:::warning
-Do not modify this query. The query is preconfigured for this job.
+Don't modify this query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_timesync.md b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_timesync.md
index d5a41bcb9b..a1de19ca8d 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_timesync.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_timesync.md
@@ -14,7 +14,7 @@ domain controller within the domain.
The AD_TimeSync Job uses the Registry Data Collector for the following query:
:::warning
-Do not modify this query. The query is preconfigured for this job.
+Don't modify this query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/overview.md
index b4ec884cdb..be61903bb2 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/overview.md
@@ -6,18 +6,18 @@ sidebar_position: 20
# 0.Collection Job Group
-The **5.Domains > 0.Collection** Job Group collects the data which will be further analyzed in order
-to provide details on domains, sites, and trusts.
+The **5.Domains > 0.Collection** Job Group collects the data for further analysis to provide details
+on domains, sites, and trusts.
The 0.Collection Job Group is comprised of:
-- [AD_DomainControllers Job](/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_domaincontrollers.md) – Collects domain controller details which
- will be further analyzed in order to provide information on domains, sites, and trusts.
+- [AD_DomainControllers Job](/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_domaincontrollers.md) – Collects domain controller details for
+ further analysis to provide information on domains, sites, and trusts.
- [AD_DSRM Job](/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_dsrm.md) – Collects data related to domain controller registry settings for the
- DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the DSRM Admin Account can be used to
- log in to the domain controller even if it has not been started in DSRM which can present a
+ DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the DSRM Admin Account can log in to
+ the domain controller even if it has not been started in DSRM, which can present a
potential security vulnerability. Additional information on this registry key is available in this
[Microsoft Document](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc732714(v=ws.10)?redirectedfrom=MSDN).
- [AD_TimeSync Job](/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/ad_timesync.md) – Collects TimeSync information from the registry for each
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/overview.md
index 65406ef5b3..7a7b6f5fcf 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/overview.md
@@ -13,8 +13,8 @@ configurations that may leave your environment at risk.
The following components comprises the 5.Domains job group:
-- [0.Collection Job Group](/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/overview.md) – Collects the data which will be further
- analyzed in order to provide details on domains, sites, and trusts
+- [0.Collection Job Group](/docs/accessanalyzer/12.0/solutions/activedirectory/domains/collection/overview.md) – Collects the data that this job group
+ analyzes to provide details on domains, sites, and trusts
- [AD_DCSummary Job](/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_dcsummary.md) – Provides operational reporting related to the details
collected for each domain controller. For each domain controller, the report identifies the FSMO
role, whether it is a bridgehead server, whether it is a global catalog, and the time server it
@@ -24,7 +24,7 @@ The following components comprises the 5.Domains job group:
domain and forest functional levels, and types and directions of trusts
- [AD_DSRMSettings Job](/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_dsrmsettings.md) – Provides details on domain controller registry
settings for the DSRMAdminLogonBehavior key. If this key is set to 1 or 2, the DSRM Admin Account
- can be used to log in to the domain controller even if it has not been started in DSRM which can
+ can log in to the domain controller even if it has not been started in DSRM, which can
present a potential security vulnerability.
- [AD_KerberoastingRisk Job](/docs/accessanalyzer/12.0/solutions/activedirectory/domains/ad_kerberoastingrisk.md) – Identifies accounts vulnerable to
kerberoasting. Kerberoasting is a threat where attackers target service accounts in Active
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/recommended.md b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/recommended.md
index 11954b4d04..ce660aaf43 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/domains/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/domains/recommended.md
@@ -11,7 +11,7 @@ default settings. It can be run directly or scheduled.
**Dependencies**
-This job group does not have dependencies.
+This job group doesn't have dependencies.
**Targeted Hosts**
@@ -50,7 +50,7 @@ entire job group, instead of the individual jobs.
**Query Configuration**
The 5.Domains > 0.Collection > AD_DomainControllers job should be run with the default query
-configurations. Most of these queries are preconfigured for this Job Group and should not be
+configurations. Most of these queries are preconfigured for this Job Group and shouldn't be
modified.
The following query can be modified to use a secure connection with TLS/SSL:
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_cpassword.md b/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_cpassword.md
index 3bd3434757..b5e5be4fdb 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_cpassword.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_cpassword.md
@@ -8,20 +8,20 @@ sidebar_position: 20
The AD_CPassword Job identifies passwords that are stored in Group Policy Preferences which present
a security risk allowing attackers access to these passwords. Microsoft published the AES private
-key, which can be used to decrypt passwords stored in Group Policy Preferences. See the Microsoft
+key, which attackers can use to decrypt passwords stored in Group Policy Preferences. See the Microsoft
[2.2.1.1.4 Password Encryption](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gppref/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be)
article for additional information. Since Authenticated Users have read access to SYSVOL, any
malicious insider or attacker can search for the cPassword file inside XML files shared through
SYSVOL to decrypt them. GPOs can be stored in the `%ProgramData%\Microsoft\Group Policy\History`
-folder on each machine, meaning any results found by this job should be deleted off every computer
-once this policy has been removed.
+folder on each machine. After you remove this policy, delete any results this job found from every
+computer.
## Query for the AD_CPassword Job
The AD_CPassword Job uses the PowerShell Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job
+Don't modify the query. The query is preconfigured for this job
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_grouppolicy.md b/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_grouppolicy.md
index 2fb4cf6a82..d3361ae12e 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_grouppolicy.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_grouppolicy.md
@@ -14,7 +14,7 @@ provides details on the containers they are linked to, and the settings that are
The AD_GroupPolicy Job uses the GroupPolicy Data Collector for the following query:
:::warning
-Do not modify the queries. The queries are preconfigured for this job.
+Don't modify the queries. The queries are preconfigured for this job.
:::
@@ -35,7 +35,7 @@ Navigate to the **Active Directory** > **4.GroupPolicy** > **AD_GroupPolicy** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_overlappinggpos.md b/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_overlappinggpos.md
index d7b0b829d4..14d0464645 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_overlappinggpos.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_overlappinggpos.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **4. Group Policy** > **AD_OverlappingGPO
node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected first analysis task. The first analysis task is
+Don't modify or deselect the selected first analysis task. The first analysis task is
preconfigured for this job.
:::
@@ -30,7 +30,7 @@ The default analysis tasks are:
The following analysis tasks are deselected by default:
:::note
-Deselect the **Conflicting** analysis task before selecting the analysis tasks below.
+Deselect the **Conflicting** analysis task before selecting the following analysis tasks.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_passwordpolicies.md b/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_passwordpolicies.md
index 37662dd0f4..d31fcdcfcd 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_passwordpolicies.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_passwordpolicies.md
@@ -15,7 +15,7 @@ different password policies within a single domain.
The AD_PasswordPolicies Job uses the LDAP Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -35,7 +35,7 @@ Navigate to the **Active Directory** > **4.GroupPolicy** > **AD_PasswordPolicies
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/overview.md
index 7cfce90290..108e12a4ce 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/overview.md
@@ -16,14 +16,14 @@ The following components comprise the 4.Group Policy Job Group:
- [AD_CPassword Job](/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_cpassword.md) – Identifies passwords that are stored in Group Policy
Preferences which present a security risk allowing attackers access to these passwords. Microsoft
- published the AES private key, which can be used to decrypt passwords stored in Group Policy
+ published the AES private key, which attackers can use to decrypt passwords stored in Group Policy
Preferences. See the Microsoft
[2.2.1.1.4 Password Encryption](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gppref/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be)
article for additional information. Since Authenticated Users have read access to SYSVOL, any
malicious insider or attacker can search for the cPassword file inside XML files shared through
SYSVOL to decrypt them. GPOs can be stored in the `%ProgramData%\Microsoft\Group Policy\History`
- folder on each machine, meaning any results found by this job should be deleted off every computer
- once this policy has been removed.
+ folder on each machine. After you remove this policy, delete any results this job found from every
+ computer.
- [AD_GroupPolicy Job](/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/ad_grouppolicy.md) – Audits all Group Policies that are present on the Domain
Controller, and provides details on the containers they are linked to and the settings that are
configured
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/recommended.md b/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/recommended.md
index c93ba4b510..a84076c9e9 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/grouppolicy/recommended.md
@@ -11,7 +11,7 @@ settings. It can be run directly or scheduled.
**Dependencies**
-This job group does not have dependencies.
+This job group doesn't have dependencies.
**Targeted Hosts**
@@ -41,7 +41,7 @@ This job group can be scheduled to run as desired.
:::info
Run the jobs in the 4.Group Policy Job Group together and in order by running the
entire job group, instead of the individual jobs. However, these jobs can be run independently, with
-the exception of the AD_OverlappingGPOs Job, which is dependent upon the AD_GroupPolicy Job for data
+the exception of the AD_OverlappingGPOs Job, which depends on the AD_GroupPolicy Job for data
collection.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_circularnesting.md b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_circularnesting.md
index 52b65b51a4..8ba2525ebc 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_circularnesting.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_circularnesting.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_CircularNesting** > *
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_dclogongroups.md b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_dclogongroups.md
index 126b38572f..6f39c5c96c 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_dclogongroups.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_dclogongroups.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# AD_DCLogonGroups Job
-The AD_DCLogonGroups Job identifies users who are able to log on to Domain Controllers through
+The AD_DCLogonGroups Job identifies users who can log on to Domain Controllers through
effective membership to the Enterprise Admins, Domain Admins, Administrators, Backup Operators,
Account Operators, Print Operators, or Remote Desktop Users groups. This type of access should be
limited to only those individuals who require this level of administrative privileges.
@@ -17,7 +17,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_DCLogonGroups** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_duplicategroups.md b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_duplicategroups.md
index 1a35b7c932..d28531a961 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_duplicategroups.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_duplicategroups.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_DuplicateGroups** > *
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_emptygroups.md b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_emptygroups.md
index 400a619083..6b0bd950d0 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_emptygroups.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_emptygroups.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_EmptyGroups** > **Con
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_groupprobableowners.md b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_groupprobableowners.md
index 28bb2ef58b..98040cf4aa 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_groupprobableowners.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_groupprobableowners.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# AD_GroupProbableOwners Job
-The AD_GroupProbableOwners Job determines potential owners for Active Directory Groups which can be
-used to perform automated membership reviews and enable self-service group management and membership
+The AD_GroupProbableOwners Job determines potential owners for Active Directory Groups, which you can
+use to perform automated membership reviews and enable self-service group management and membership
requests.
## Analysis Tasks for the AD_GroupProbableOwners Job
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_GroupProbableOwners**
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_largestgroups.md b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_largestgroups.md
index c6b1d69945..6fe51d7c1c 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_largestgroups.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_largestgroups.md
@@ -7,8 +7,8 @@ sidebar_position: 70
# AD_LargestGroups Job
The AD_LargestGroups Job identifies groups with large effective member counts. These types of groups
-may cause administrative overhead and burden in being able to easily understand who is getting
-access to resources, or how much access is being granted to resources through these groups.
+can create administrative overhead, making it hard to see who has access to resources or how much
+access these groups grant.
## Analysis Task for the AD_LargestGroups Job
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_LargestGroups** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_mailsecuritygroups.md b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_mailsecuritygroups.md
index 3ef9f6c6c9..9fadde48b4 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_mailsecuritygroups.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_mailsecuritygroups.md
@@ -14,7 +14,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_MailSecurityGroups**
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_nestedgroups.md b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_nestedgroups.md
index 5788cab962..09793c9629 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_nestedgroups.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_nestedgroups.md
@@ -7,8 +7,8 @@ sidebar_position: 90
# AD_NestedGroups Job
The AD_NestedGroups Job identifies nested groups within Active Directory and provides details such
-as the levels of nesting. While Active Directory provides the ability to nest certain types of
-groups within other groups, Microsoft recommends nesting does not go beyond two levels in order to
+as the levels of nesting. While Active Directory lets you nest certain types of
+groups within other groups, Microsoft recommends nesting doesn't go beyond two levels to
avoid difficulties in understanding effective membership and access.
## Analysis Tasks for the AD_NestedGroups Job
@@ -17,7 +17,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_NestedGroups** > **Co
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_sensitivesecuritygroups.md b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_sensitivesecuritygroups.md
index 5585ab1354..ab0fe3a5b1 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_sensitivesecuritygroups.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_sensitivesecuritygroups.md
@@ -17,7 +17,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_SensitiveSecurityGrou
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_stalegroups.md b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_stalegroups.md
index b33ce94b41..5a0b87bd34 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_stalegroups.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_stalegroups.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **1.Groups** > **AD_StaleGroups** > **Con
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -37,4 +37,4 @@ the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Stale Effective Membership (A.K.A. Stale Groups) | This report identifies groups with stale effective membership. A stale user is defined as someone who has not logged into the domain in over 60 days, is expired, or currently disabled. | None | This report is comprised of three elements: - Bar Chart – Displays group membership
- Table – Provides details on membership
- Table – Provides details on group membership
|
+| Stale Effective Membership (A.K.A. Stale Groups) | This report identifies groups with stale effective membership. A stale user is defined as someone who has not logged into the domain in over 60 days, is expired, or disabled. | None | This report is comprised of three elements: - Bar Chart – Displays group membership
- Table – Provides details on membership
- Table – Provides details on group membership
|
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/overview.md
index 6626322d5f..526189c710 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/overview.md
@@ -16,7 +16,7 @@ The following jobs comprise the 1.Groups Job Group:
- [AD_CircularNesting Job](/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_circularnesting.md) – Identifies circularly nested groups within
Active Directory which can pose administrative and operational challenges with identifying
effective access to resources
-- [AD_DCLogonGroups Job](/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_dclogongroups.md) – Identifies users who are able to log on to Domain
+- [AD_DCLogonGroups Job](/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_dclogongroups.md) – Identifies users who can log on to Domain
Controllers through effective membership to the Enterprise Admins, Domain Admins, Administrators,
Backup Operators, Account Operators, Print Operators, or Remote Desktop Users groups. This type of
access should be limited to only those individuals who require this level of administrative
@@ -27,12 +27,11 @@ The following jobs comprise the 1.Groups Job Group:
- [AD_EmptyGroups Job](/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_emptygroups.md) – Identifies empty and single member groups which are
suitable candidates for consolidation or cleanup
- [AD_GroupProbableOwners Job](/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_groupprobableowners.md) – Determines potential owners for Active
- Directory Groups which can be used to perform automated membership reviews and enable self-service
+ Directory Groups you can use to perform automated membership reviews and enable self-service
group management and membership requests
- [AD_LargestGroups Job](/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_largestgroups.md) – Identifies groups with large effective member
- counts. These types of groups may cause administrative overhead and burden in being able to easily
- understand who is getting access to resources, or how much access is being granted to resources
- through these groups.
+ counts. These types of groups can create administrative overhead, making it hard to see who has
+ access to resources or how much access these groups grant.
- The definition of a large group is set by the **.Active Directory Inventory** >
**3-AD_Exceptions** Job. It can be customized. See the
@@ -42,9 +41,9 @@ The following jobs comprise the 1.Groups Job Group:
- [AD_MailSecurityGroups Job](/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_mailsecuritygroups.md) – Identifies mail-enabled security groups
within Active Directory
- [AD_NestedGroups Job](/docs/accessanalyzer/12.0/solutions/activedirectory/groups/ad_nestedgroups.md) – Identifies nested groups within Active Directory and
- provides details such as the levels of nesting. While Active Directory provides the ability to
- nest certain types of groups within other groups, Microsoft recommends nesting does not go beyond
- two levels in order to avoid difficulties in understanding effective membership and access.
+ provides details such as the levels of nesting. While Active Directory lets you
+ nest certain types of groups within other groups, Microsoft recommends nesting doesn't go beyond
+ two levels to avoid difficulties in understanding effective membership and access.
- The definition of a deeply nested group is set by the **.Active Directory Inventory** >
**3-AD_Exceptions** Job. It can be customized. See the
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/recommended.md b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/recommended.md
index 63a9a82ec0..2c94a66e55 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/groups/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/groups/recommended.md
@@ -11,16 +11,16 @@ settings. It can be run directly or scheduled.
**Dependencies**
-The **.Active Directory Inventory** Job Group needs to be successfully executed prior to running
+The **.Active Directory Inventory** Job Group needs to be successfully executed before running
this job group.
**Target Host**
-This job group does not collect data. No target host is required.
+This job group doesn't collect data. No target host is required.
**Connection Profile**
-This job group does not collect data. No specific Connection Profile is required.
+This job group doesn't collect data. No specific Connection Profile is required.
**Schedule Frequency**
@@ -50,8 +50,8 @@ Some analysis tasks have customizable parameters:
- Customize within **.Active Directory Inventory** > **3-AD_Exceptions** Job analysis tasks
:::note
- Changes to an exception’s definition will affect all jobs dependent upon that
- exception as well as all Access Information Center Exceptions reports.
+ Changes to an exception’s definition affect all jobs that depend on that
+ exception, as well as all Access Information Center Exceptions reports.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_directmembership.md b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_directmembership.md
index ae16f94261..ce11ac66ae 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_directmembership.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_directmembership.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# AD_DirectMembership Job
-The AD_DirectMembership Job identifies users who do not have any group membership. This condition
+The AD_DirectMembership Job identifies users who don't have any group membership. This condition
may indicate unnecessary user accounts that are suitable candidates for review and cleanup.
## Analysis Tasks for the AD_DirectMembership Job
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_DirectMembership** > *
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_duplicateusers.md b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_duplicateusers.md
index ab0a3d1397..64a8c137ca 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_duplicateusers.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_duplicateusers.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_DuplicateUsers** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_orphanedusers.md b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_orphanedusers.md
index 2a4f96137d..010dca0d5f 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_orphanedusers.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_orphanedusers.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_OrphanedUsers** > **Co
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_passwordstatus.md b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_passwordstatus.md
index 18c2e95eaa..d77e49f394 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_passwordstatus.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_passwordstatus.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_PasswordStatus** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigure for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_serviceaccounts.md b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_serviceaccounts.md
index 58ec8e9a54..1c621dbe4f 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_serviceaccounts.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_serviceaccounts.md
@@ -26,7 +26,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_ServiceAccounts** > **
select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_sidhistory.md b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_sidhistory.md
index 369b3728fe..8d2455606e 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_sidhistory.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_sidhistory.md
@@ -17,7 +17,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_SIDHistory** > **Confi
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_staleusers.md b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_staleusers.md
index 3249482e8d..53c079f0be 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_staleusers.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_staleusers.md
@@ -7,12 +7,12 @@ sidebar_position: 80
# AD_StaleUsers Job
The AD_StaleUsers job identifies potentially stale users based on the amount of time since their
-last login to the domain, or if the account has been disabled. These accounts should be reviewed and
-cleaned up in order to increase security and reduce complexity.
+last log in to the domain, or if the account has been disabled. These accounts should be reviewed and
+cleaned up to increase security and reduce complexity.
:::note
The definition of a stale user is set by the .Active Directory Inventory solution. These
-parameters, including the number of days since last login to be considered stale (by default 60
+parameters, including the number of days since last log in to be considered stale (by default 60
days), can be customized within the **.Active Directory Inventory** > **3-AD_Exceptions** job's
**Stale Users** analysis task. See the
[3-AD_Exceptions Job](/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/3-ad_exceptions.md) topic for additional
@@ -26,7 +26,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_StaleUsers** > **Confi
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -44,4 +44,4 @@ the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Stale Users | This report identifies user accounts which have not logged into the domain for an extended amount of time or are currently disabled. A user account is considered stale if the last logon is over 60 days ago, is currently disabled, or expired. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays users by domain
- Table – Provides details on users
- Table – Provides details on users by domain
|
+| Stale Users | This report identifies user accounts which have not logged into the domain for an extended amount of time or are disabled. A user account is considered stale if the last logon is over 60 days ago, is disabled, or expired. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays users by domain
- Table – Provides details on users
- Table – Provides details on users by domain
|
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_userattributecompletion.md b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_userattributecompletion.md
index c48531545f..9b0232649a 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_userattributecompletion.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_userattributecompletion.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_UserAttributeCompletio
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_userdelegation.md b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_userdelegation.md
index 156d05fd78..0687d94dea 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_userdelegation.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_userdelegation.md
@@ -8,7 +8,7 @@ sidebar_position: 100
The AD_Delegation Job highlights user accounts which are trusted for delegation. Kerberos delegation
enables an application to access resources hosted on a different server, and opens up several
-avenues to compromise based on the type of delegation enabled. See the
+avenues to compromise based on the type of delegation enabled. See the
[What Is Kerberos Delegation?](https://blog.netwrix.com/2021/11/30/what-is-kerberos-delegation-an-overview-of-kerberos-delegation/) Netwrix
blog article for more information about this configuration and the related security risks.
@@ -18,7 +18,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_UserDelegation** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_usertoken.md b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_usertoken.md
index 44517ed218..6355a092e8 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_usertoken.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_usertoken.md
@@ -18,7 +18,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_UserToken** > **Config
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_weakpasswords.md b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_weakpasswords.md
index f620bcd2d2..4bb060dab8 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_weakpasswords.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_weakpasswords.md
@@ -19,20 +19,20 @@ dictionaries and other exceptions. Exceptions include:
- Delegable Admins – Administrator account is allowed to be delegated to a service
- DES Encryption Only – Account is using Kerberos DES encryption. DES encryption is considered weak
as the 56-bit key is prone to brute force attacks. See the Microsoft
- [AD DS: User accounts and trusts in this domain should not be configured for DES only](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff646918(v=ws.10))
+ [AD DS: User accounts and trusts in this domain shouldn't be configured for DES only](https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff646918(v=ws.10))
article for additional information.
- Empty Password – Account has an empty password
-- Kerberos Pre-authentication is not required – Account does not require Kerberos
+- Kerberos Pre-authentication isn't required – Account doesn't require Kerberos
pre-authentication. Kerberos pre-authentication can mitigate against brute force attacks. See the
Microsoft
- [Kerberos Pre-Authentication: Why It Should Not Be Disabled](https://learn.microsoft.com/en-us/archive/technet-wiki/23559.kerberos-pre-authentication-why-it-should-not-be-disabled)
+ [Kerberos Pre-Authentication: Why It Shouldn't Be Disabled](https://learn.microsoft.com/en-us/archive/technet-wiki/23559.kerberos-pre-authentication-why-it-should-not-be-disabled)
article for additional information.
- LM Hash – Account has stored LM hashes. The LM hash is a relatively weak hash that is prone to
brute force attacks. See the Microsoft
[How to prevent Windows from storing a LAN manager hash of your password in Active Directory and local SAM databases](https://learn.microsoft.com/en-US/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password)
article for additional information.
- Password Never Expires – Account has a password that never expires
-- Password Not Required – Account does not require a password
+- Password Not Required – Account doesn't require a password
- Weak Historical Password – Account has a historical password that was found in the dictionary
- Weak Password – Account has a password that was found in the dictionary
- Shares Common Password – Account shares a password with another account
@@ -53,8 +53,8 @@ The query for this job are:
### Configure the Weak Passwords Query
-The PasswordSecurity Data Collector can be scoped if desired. Follow the steps to modify the query
-configuration.
+The PasswordSecurity Data Collector can be scoped if desired. To modify the query configuration,
+complete the following steps.
**Step 1 –** Navigate to the job’s Configure node and select Queries.
@@ -67,7 +67,7 @@ Collector Wizard opens.
:::warning
-Read the warning prior to enabling the cleartext password feature.
+Read the warning before enabling the cleartext password feature.
:::
@@ -95,7 +95,7 @@ Navigate to the **Active Directory** > **2.Users** > **AD_WeakPasswords** > **Co
select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/users/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectory/users/overview.md
index 6ba5f375ff..a41d8e4e7d 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/users/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/users/overview.md
@@ -13,7 +13,7 @@ concern such as weak passwords, user token size, or stale users.
The following components comprise the 2.Users Job Group:
-- [AD_DirectMembership Job](/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_directmembership.md) – Identifies users who do not have any group
+- [AD_DirectMembership Job](/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_directmembership.md) – Identifies users who don't have any group
membership. This condition may indicate unnecessary user accounts that are suitable candidates for
review and cleanup.
- [AD_DuplicateUsers Job](/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_duplicateusers.md) – Identifies multiple user accounts which may be
@@ -31,8 +31,8 @@ The following components comprise the 2.Users Job Group:
include when a user has a historical SID from their current domain, or when a non-admin user has a
historical SID with administrative rights, both of which may be indicators of compromise.
- [AD_StaleUsers Job](/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_staleusers.md) – Identifies potentially stale users based on the amount of
- time since their last login to the domain, or if the account has been disabled. These accounts
- should be reviewed and cleaned up in order to increase security and reduce complexity.
+ time since their last log in to the domain, or if the account has been disabled. These accounts
+ should be reviewed and cleaned up to increase security and reduce complexity.
- [AD_UserAttributeCompletion Job](/docs/accessanalyzer/12.0/solutions/activedirectory/users/ad_userattributecompletion.md) – Identifies which attributes are
present within User fields in Active Directory, and which ones are blank for a majority of
objects. This may indicate accounts within Active Directory which are lacking appropriate
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectory/users/recommended.md b/docs/accessanalyzer/12.0/solutions/activedirectory/users/recommended.md
index 7a8c702563..18b709263d 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectory/users/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectory/users/recommended.md
@@ -7,15 +7,14 @@ sidebar_position: 10
# Recommended Configurations for the 2.Users Job Group
The **Active Directory** > **2.Users** Job Group has been configured by default to run with the
-out-of-the-box settings. It can be run directly or scheduled.
+default settings. It can be run directly or scheduled.
**Dependencies**
-- The **.Active Directory Inventory** Job Group needs to be successfully executed prior to running
- this job group
+- Successfully run the **.Active Directory Inventory** Job Group before running this job group.
- - For the **AD_ServiceAccounts** Job, the **.Active Directory Inventory** > **1-AD_Scan** Job
- needs to be configured to collect **servicePrincipalName** as a Custom Attribute
+ - For the **AD_ServiceAccounts** Job, configure the **.Active Directory Inventory** >
+ **1-AD_Scan** Job to collect **servicePrincipalName** as a Custom Attribute
- For the **AD_WeakPassword** Job:
@@ -26,12 +25,12 @@ out-of-the-box settings. It can be run directly or scheduled.
topic for additional information.
:::info
- If this job is not to be used, disable the job to prevent execution when the
- job group is executed.
+ If you don't need this job, disable it to prevent it from running with the
+ job group.
:::
-**Targeted Host(s)**
+**Targeted Hosts**
Only the **AD_WeakPasswords** Job requires a host list. The host list assignment has been configured
under the **2. Users** > **AD_WeakPasswords** > **Configure** > **Hosts** node. It is set to target
@@ -53,9 +52,8 @@ additional information.
**Schedule Frequency**
The data analyzed by the **2.Users** Job Group jobs is collected by the **.Active Directory
-Inventory** Job Group. Therefore, it is recommended to schedule these jobs to run after the
-**.Active Directory Inventory** job group collection has completed. These jobs can be scheduled to
-run as desired.
+Inventory** Job Group. Therefore, schedule these jobs to run after the **.Active Directory
+Inventory** job group collection finishes. These jobs can be scheduled to run as desired.
**Run at the Job Group Level**
@@ -63,7 +61,7 @@ Run the jobs in the **2.Users** Job Group together and in order by running the e
instead of the individual jobs.
:::tip
-Remember, if the **AD_WeakPassword** Job is not to be executed, it can be disabled.
+If you don't need to run the **AD_WeakPassword** Job, disable it.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/1-ad_scan.md b/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/1-ad_scan.md
index d79856e843..5091ea4729 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/1-ad_scan.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/1-ad_scan.md
@@ -8,7 +8,7 @@ sidebar_position: 20
The 1-AD_Scan Job collects data from Active Directory. In most environments, this job requires no
additional customizations before running it. Optionally, the job can be configured to scope scan
-options and to collect custom attributes. For enable SSL encryption for communication with Active
+options and to collect custom attributes. To enable SSL encryption for communication with Active
Directory, see the [Enable SSL Option](#enable-ssloption) topic for additional information.
## Queries for the 1-AD Scan Job
@@ -27,8 +27,8 @@ The 1-AD_Scan Job uses the ADInventory Data Collector for the following query:
### Customize the 1-AD_Scan Query
The 1-AD_Scan Job has been preconfigured to run with the default settings with the category of Scan
-Active Directory. Follow the steps to set any desired customizations to scan options or to collect
-custom attributes.
+Active Directory. To set any customizations to scan options or to collect
+custom attributes, complete the following steps.
**Step 1 –** Navigate to the **.Active Directory Inventory** > **1-AD_Scan** > **Configure** node
and select **Queries**.
@@ -40,8 +40,7 @@ opens.
DC Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
-purpose of this job.
+Don't make changes to other wizard pages. They're preconfigured for this job.
:::
@@ -67,8 +66,8 @@ topic for additional information.
click **Cancel** if no changes were made. Then click **OK** to close the Query Properties window.
:::note
-In order for the Access Information Center to populate NFS permissions within File System
-reports, the .Active Directory Inventory Job Group must be configured to collect the **uid** and
+For the Access Information Center to populate NFS permissions within File System
+reports, configure the .Active Directory Inventory Job Group to collect the **uid** and
**uidNumber** attributes for Users. See the
[NFS Permissions for the AIC ](#nfs-permissions-for-the-aic) topic for additional information.
:::
@@ -76,7 +75,7 @@ reports, the .Active Directory Inventory Job Group must be configured to collect
The 1-AD_Scan Job is now ready to run with the customized settings. If any custom attributes are
added to the data collection, the **Create Extended Attributes View** analysis task can be enabled
-in order to have visibility into the collected data.
+to have visibility into the collected data.
## Analysis Tasks for the 1-AD_Scan Job
@@ -84,7 +83,7 @@ View the analysis tasks by navigating to the **.Active Directory Inventory** > *
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -123,14 +122,14 @@ topic, the 1-AD_Scan Job produces the following pre-configured report:
## NFS Permissions for the AIC
-In order for the Access Information Center to populate NFS resources within all File System
-permissions and resource audit reports, the .Active Directory Inventory Job Group must be configured
+For the Access Information Center to populate NFS resources within all File System
+permissions and resource audit reports, configure the .Active Directory Inventory Job Group
to collect the following custom attributes for Users:
- uid
- uidNumber
-Follow the steps to add the custom attributes.
+To add the custom attributes, complete the following steps.
**Step 1 –** Navigate to the Active Directory Inventory DC Wizard for the AD Inventory Query within
the 1-AD_Scan Job.
@@ -141,8 +140,8 @@ the 1-AD_Scan Job.
option is deselected.
:::note
-Whenever query configurations are modified, it is necessary to do a full scan. After the
-first full scan, differential scanning can be re-enabled.
+Whenever you modify query configurations, run a full scan. After the
+first full scan, you can re-enable differential scanning.
:::
@@ -175,7 +174,7 @@ The .Active Directory Inventory Job Group is now collecting attributes required
visible within the Access Information Center.
:::tip
-Remember, it is necessary to re-enable differential scanning after Step 5 if desired.
+Remember to re-enable differential scanning after Step 5 if desired.
:::
@@ -185,7 +184,7 @@ for additional information.
## Enable SSL Option
-Follow the steps to enable SSL encryption for communications with Active Directory:
+To enable SSL encryption for communications with Active Directory, complete the following steps:
**Step 1 –** Navigate to the **1-AD_Scan > Configure** node and select **Queries**.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/2-ad_changes.md b/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/2-ad_changes.md
index ca1096b64b..375a7a63db 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/2-ad_changes.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/2-ad_changes.md
@@ -8,11 +8,11 @@ sidebar_position: 30
The 2-AD_Changes Job tracks changes within all scanned domains. Reports in the job highlight Active
Directory changes which have occurred since the last time the .Active Directory Inventory Job Group
-was run. It is dependent on the running of the 1-AD_Scan Job, also located in the .Active Directory
+was run. It is dependent on running the 1-AD_Scan Job, also located in the .Active Directory
Inventory Job Group.
The 1-AD_Scan Job must have the Query Option to **Track changes into Change tracking tables**
-selected in order for the Analysis Tasks in the 2-AD_Changes Job to work. See Step 4 of the
+selected for the Analysis Tasks in the 2-AD_Changes Job to work. See Step 4 of the
[Customize the 1-AD_Scan Query](1-ad_scan.md#customize-the-1-ad_scan-query) topic for additional
information.
@@ -22,7 +22,7 @@ View the analysis tasks by navigating to the **.Active Directory Inventory** > *
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -125,32 +125,32 @@ following pre-configured reports:
| Group Membership Changes (A.K.A. Most Active Groups) | This report tracks group membership changes in Active Directory. | None | This report is comprised of three elements: - Bar graph – Displays Most Active Groups (Past 24 Hours)
- Table – Provides details on the most active groups (Past 24 Hours)
- Table – Provides details on the most active groups
|
| New Principals | This report identifies when principals have been created on the targeted domains. | None | This report is comprised of two elements: - Bar graph – Displays New Principals by Domain (Past 24 Hours)
- Table – Provides details on the new principals by domain
|
| Object Moves | This report tracks object moves in Active Directory. | None | This report is comprised of two elements: - Table – Displays Most Active OUs (Past 24 Hours)
- Table – Provides details on the most active OUs
|
-| Org Changes (A.K.A. Organizational Changes) | This report tracks organizational moves such as manager, title or department changes. | None | This report is comprised of three elements: - Bar graph – Displays Organizational Changes (Past 24 Hours)
- Table – Provides details on organizational changes (Past 24 Hours)
- Table – Provides details on the organizational changes
|
+| Org Changes (A.K.A. Organizational Changes) | This report tracks organizational moves such as manager, title, or department changes. | None | This report is comprised of three elements: - Bar graph – Displays Organizational Changes (Past 24 Hours)
- Table – Provides details on organizational changes (Past 24 Hours)
- Table – Provides details on the organizational changes
|
| Principal Deletions (A.K.A. Past 24 Hours) | This report identifies when principals have been deleted from the targeted domains. | None | This report is comprised of three elements: - Bar graph – Displays Deleted Principals by Domain (Past 24 Hours)
- Table – Provides details on deleted principals by domain (Past 24 Hours)
- Table – Provides details on the principals by domain
|
| User Account Status Changes | This report tracks user account status changes. | None | This report is comprised of three elements: - Bar graph – Displays User Account Control Changes (Past 24 Hours)
- Table – Provides details on user account control changes (Past 24 Hours)
- Table – Provides details on the user account control changes
|
### Notification Analysis Tasks for the 2-AD_Changes Job
-In order for Access Analyzer to send email notifications, it is necessary for the **Settings** >
-**Notification** node to be properly configured. See the
+To send email notifications, properly configure the **Settings** >
+**Notification** node. See the
[Notification](/docs/accessanalyzer/12.0/admin/settings/notification.md) topic for instructions on enabling the Access
Analyzer Console to send email notifications. Once email notifications have been enabled, the
-individual notification analysis tasks can be configured and enabled. Follow the steps to configure
-a notification analysis task.
+individual notification analysis tasks can be configured and enabled. To configure
+a notification analysis task, complete the following steps.
**Step 1 –** Navigate to the **.Active Directory Inventory** > **2-AD_Changes** > **Configure** node
and select **Analysis**.
-**Step 2 –** In the Analysis Selection view, select the desired notification analysis task and click
+**Step 2 –** In the Analysis Selection view, select the notification analysis task you want and click
**Analysis Configuration**. The Notification Data Analysis Module opens.
:::warning
-Do not make changes to the pages preceding the SMTP page.
+Don't make changes to the pages preceding the SMTP page.
:::
@@ -169,9 +169,9 @@ provided. You can use the following options:
-**Step 5 –** In the Message section, edit the **Subject**. It is not recommended to remove any
-parameters. Then, customize the email content in the textbox to provide an explanation of the
-notification to the recipients.
+**Step 5 –** In the Message section, edit the **Subject**. Don't remove any parameters. Then,
+customize the email content in the textbox to provide an explanation of the notification to the
+recipients.
**Step 6 –** Click **Next** to save these configuration changes and navigate to the Summary page. Do
not make changes to any other pages. Click **Finish**. The Notification Data Analysis Module window
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/3-ad_exceptions.md b/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/3-ad_exceptions.md
index b6578e3397..075d72ed03 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/3-ad_exceptions.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/3-ad_exceptions.md
@@ -12,7 +12,7 @@ running the 1-AD_Scan Job, also located in the .Active Directory Inventory Job G
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -38,7 +38,7 @@ View the analysis tasks by navigating to the **.Active Directory Inventory** > *
the security concerns within them can be modified.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/overview.md
index b7d92961b8..336a527fdd 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# .Active Directory Inventory Solution
-Active Directory (AD) acts as the central nervous system of any Microsoft environment and plays a
+Active Directory (AD) is the core identity infrastructure of any Microsoft environment and plays a
vital role in granting access to resources such as Exchange, File Systems, SharePoint, and SQL
Server. The .Active Directory Inventory Solution is designed to provide essential user, group
membership, and computer details from the targeted domains to many Access Analyzer built-in
@@ -50,14 +50,13 @@ Inventory Job Group.
The .Active Directory Inventory Solution is a core component of all Access Analyzer installations.
Typically this solution is instantiated during installation, but it can be installed from the
-Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to the solution:
-**Jobs** > **.Active Directory Inventory**. This group has been named in such a way to keep it at
-the top of the Jobs tree.
+Instant Job Wizard. After it has been installed into the Jobs tree, navigate to the solution:
+**Jobs** > **.Active Directory Inventory**. This group's name keeps it at the top of the Jobs tree.
## Jobs
-This Job Group is comprised of three jobs that collect, analyze, and report on data. The data
-collection is conducted by the ADInventory Data Collector. See the
+This Job Group is comprised of three jobs that collect, analyze, and report on data. The
+ADInventory Data Collector performs the data collection. See the
[Standard Reference Tables & Views for the ADInventory Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/adinventory/standardtables.md)
topic for database table information.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/recommended.md b/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/recommended.md
index bfa25c9ab4..19a0f7535d 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectoryinventory/recommended.md
@@ -7,12 +7,12 @@ sidebar_position: 10
# Recommended Configurations for the .Active Directory Inventory Solution
The .Active Directory Inventory Solution has been configured by default to run with the
-out-of-the-box settings, but some settings are optional for configuration. It can be run directly or
+default settings, but some settings are optional for configuration. It can be run directly or
scheduled.
**Dependencies**
-This job group does not have dependencies.
+This job group doesn't have dependencies.
**Targeted Hosts**
@@ -53,11 +53,11 @@ Schedule the .Active Directory Inventory Job Group to run once a day.
If there are frequent AD changes within the target environment, then it can be executed more often.
-It is best to rerun it anytime AD changes might have occurred.
+Rerun it whenever AD changes occur.
**Run at the Solution Level**
-The jobs in the .Active Directory Inventory Job Group should be run together and in order by running
+Run the jobs in the .Active Directory Inventory Job Group together and in order by running
the entire solution, instead of the individual jobs.
**Query Configuration**
@@ -90,6 +90,6 @@ when targeting multiple domains.
**Step 2 –** Set a Connection Profile.
-**Step 3 –** chedule the .Active Directory Inventory Job Group to run as desired.
+**Step 3 –** Schedule the .Active Directory Inventory Job Group to run as desired.
**Step 4 –** Review the reports generated by the .Active Directory Inventory Job Group.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_brokeninheritance.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_brokeninheritance.md
index 73f0ac69d4..8388f4b6be 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_brokeninheritance.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_brokeninheritance.md
@@ -19,7 +19,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **6.BrokenInheritanc
**AD_BrokenInheritance** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_openaccess.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_openaccess.md
index decee2f36c..4f7a26376c 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_openaccess.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_openaccess.md
@@ -20,7 +20,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **5.Open Access** >
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_oupermissions.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_oupermissions.md
index ab86a4fd3f..92e750066c 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_oupermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_oupermissions.md
@@ -19,7 +19,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **3.OUs** > **AD_OUP
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -34,7 +34,7 @@ The default analysis tasks are:
downstream analysis and report generation
- Shadow Access OU Paths – Calculates the object location and permissions for shadow access
- OU Ownership – Lists the owners of each OU and determines if they are a non-standard owner.
- Principals that are not administrators are considered non-standard owners of OU objects. Creates
+ Principals that aren't administrators are considered non-standard owners of OU objects. Creates
the SA_AD_OUOwnership_Details table accessible under the job’s Results node.
- OU Ownership Summary – Summarizes owner type by domain
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_shadowaccess.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_shadowaccess.md
index a068b08e9b..7d1e3fd493 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_shadowaccess.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_shadowaccess.md
@@ -33,7 +33,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **AD_ShadowAccess**
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks, with the exception of the
+Don't modify or deselect the selected analysis tasks, with the exception of the
**Calculate Shadow Access** analysis tasks. The analysis tasks are preconfigured for this job. The
**Calculate Shadow Access** analysis task is the only analysis task that has customizable
parameters.
@@ -95,8 +95,8 @@ topic for additional information.
Customizable parameters enable Access Analyzer users to set the values used to classify user and
group objects during this job’s analysis. The parameters can be customized and are listed in a
-section at the bottom of the SQL Script Editor. Follow the steps to customize an analysis task’s
-parameters.
+section at the bottom of the SQL Script Editor. To customize an analysis task’s
+parameters, complete the following steps.
**Step 1 –** Navigate to the **Active Directory Permissions Analyzer** > **AD_ShadowAccess** >
**Configure** node and select **Analysis** to view analysis tasks.
@@ -109,12 +109,12 @@ then click **Analysis Configuration**. The SQL Script Editor opens.
**Step 3 –** In the parameters section at the bottom of the editor, find the Value column.
-Double-click on the current value and change as desired.
+Double-click the current value and change as desired.
- If the variable type is a table, select the cell and click **Edit Table** to modify the value.
:::warning
-Do not change any parameters where the Value states `Created during execution`.
+Don't change any parameters where the Value states `Created during execution`.
:::
@@ -154,7 +154,7 @@ domain and sensitive data.
The last report element displays information on potential attack paths for users found in the
targeted domain. Clicking on the green plus sign next to an attack path will open an Attack Path
-window that displays a step-by-step process of how a user object, if compromised, can be used to
+window that displays a step-by-step process of how an attacker can use a compromised user object to
conduct a shadow attack.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_certificaterights.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_certificaterights.md
index 6097f52ef3..81c06aee9a 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_certificaterights.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_certificaterights.md
@@ -14,7 +14,7 @@ objects within the targeted domains.
The AD_CertificateRights job uses the ADPermissions data collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -31,7 +31,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** >
**AD_CertificateRights** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_computerrights.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_computerrights.md
index 7c6285b2fe..05d272a18d 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_computerrights.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_computerrights.md
@@ -14,7 +14,7 @@ Active Directory.
The AD_ComputerRights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -31,7 +31,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** >
**AD_ComputerRights** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_containerrights.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_containerrights.md
index 037f16d9ce..b826339053 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_containerrights.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_containerrights.md
@@ -14,7 +14,7 @@ Active Directory.
The AD_ContainerRights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -31,7 +31,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** >
**AD_ContainerRights** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_domainrights.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_domainrights.md
index 80ab8ae1a7..46008e2a45 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_domainrights.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_domainrights.md
@@ -14,7 +14,7 @@ Active Directory.
The AD_DomainRights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -31,7 +31,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** > *
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_grouprights.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_grouprights.md
index 47f70088d8..4287f0b5ec 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_grouprights.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_grouprights.md
@@ -14,7 +14,7 @@ Directory.
The AD_GroupRights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -31,7 +31,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** > *
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_ourights.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_ourights.md
index 42d68b1a2f..1900bbbe64 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_ourights.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_ourights.md
@@ -14,7 +14,7 @@ in Active Directory.
The AD_OURights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -31,7 +31,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** > *
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_siterights.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_siterights.md
index 8f0c732381..8de97f0429 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_siterights.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_siterights.md
@@ -14,7 +14,7 @@ Directory.
The AD_SiteRights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -31,7 +31,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** > *
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_userrights.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_userrights.md
index 2b1998627f..c520c91880 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_userrights.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_userrights.md
@@ -14,7 +14,7 @@ Directory.
The AD_UserRights Job uses the ADPermissions Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -31,7 +31,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **0.Collection** > *
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/overview.md
index 1111e2ce72..c36a762cbc 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/overview.md
@@ -24,7 +24,7 @@ The jobs in the 0.Collection job group are:
domain objects within the targeted domains
- [AD_GroupRights Job](/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_grouprights.md) – Collects all Active Directory permissions applied to
group objects within the targeted domains
-- [AD_OURights Job](/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_ourights.md) – Collects all Active Directory permissions applied to group
+- [AD_OURights Job](/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_ourights.md) – Collects all Active Directory permissions applied to organizational unit
objects within the targeted domains
- [AD_SiteRights Job](/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/collection/ad_siterights.md) – Collects all Active Directory permissions applied to site
objects within the targeted domains
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/computers/ad_computerpermissions.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/computers/ad_computerpermissions.md
index 657cdebb1c..d63db93a73 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/computers/ad_computerpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/computers/ad_computerpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **4.Computers** >
**AD_ComputerPermissions** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -29,7 +29,7 @@ The default analysis tasks are:
- Summarize computer object permissions – Creates an interim processing table in the database for
use by downstream analysis and report generation
- Computer Ownership – Lists the owners of each computer object and determines if they are a
- non-standard owner. Users that are not administrators are considered non-standard owners of
+ non-standard owner. Users that aren't administrators are considered non-standard owners of
computer objects. Creates the SA_AD_ComputerOwnership_Details table accessible under the job’s
Results node.
- Computer Ownership Summary – Summarizes owner type by domain
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/computers/ad_lapspermissions.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/computers/ad_lapspermissions.md
index 02564a67b8..262a1cf883 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/computers/ad_lapspermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/computers/ad_lapspermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **4.Computers** >
**AD_LAPSPermissions** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/ad_adminsdholder.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/ad_adminsdholder.md
index 05ece97a15..2254a5bcfe 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/ad_adminsdholder.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/ad_adminsdholder.md
@@ -15,7 +15,7 @@ Container in Active Directory.
The AD_AdminSDHolder Job uses the PowerShell Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -32,7 +32,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **7.Containers** >
**AD_AdminSDHolder** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/ad_containerpermissions.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/ad_containerpermissions.md
index 2c2b5572d1..fecfd5e230 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/ad_containerpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/ad_containerpermissions.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# AD_ContainerPermissions Job
-The AD_ContainerPermissions Job is responsible for reporting on all Active Directory permissions
+The AD_ContainerPermissions Job reports on all Active Directory permissions
applied to container objects within the targeted domains.
## Analysis Tasks for the AD_ContainerPermissions Job
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **7.Containers** >
**AD_ContainerPermissions** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/overview.md
index 7e2c595958..634b20249d 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/overview.md
@@ -15,7 +15,7 @@ The jobs in the 7.Containers Job Group are:
- [AD_AdminSDHolder Job](/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/ad_adminsdholder.md) – Reports on all non-default Active Directory
permissions applied to the AdminSDHolder container within the targeted domains. The AdminSDHolder
- container can be leveraged by an attacker to create persistence within the environment. See the
+ container can be used by an attacker to create persistence within the environment. See the
Microsoft
[AdminSDHolder, Protected Groups and SDPROP](https://technet.microsoft.com/en-us/library/2009.09.sdadminholder.aspx)
article for additional information.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_certificateauthorityrights.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_certificateauthorityrights.md
index dd9633f776..24c98041ff 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_certificateauthorityrights.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_certificateauthorityrights.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **8.Domains** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -38,4 +38,4 @@ job produces the following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Enrollment Permissions | This report highlights vulnerable Access control Lists (ACLs) with permissions or owners assigned to open groups and non-standard ACLs with owners that are not domain or enterprise admins. | None | This report is comprised of three elements: - Bar Chart – Displays risky permissions by principal
- Pie Chart – Displays risky permissions by count
- Table – Provides details on risky permissions
|
+| Enrollment Permissions | This report highlights vulnerable Access control Lists (ACLs) with permissions or owners assigned to open groups and non-standard ACLs with owners that aren't domain or enterprise admins. | None | This report is comprised of three elements: - Bar Chart – Displays risky permissions by principal
- Pie Chart – Displays risky permissions by count
- Table – Provides details on risky permissions
|
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_certificatetemplates.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_certificatetemplates.md
index effa7f145d..77cec4302c 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_certificatetemplates.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_certificatetemplates.md
@@ -14,7 +14,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **8.Domains** >
**AD_CertificateTemplates** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_certificatevulnerabilities.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_certificatevulnerabilities.md
index ff442e3623..28a4ad3cf0 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_certificatevulnerabilities.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_certificatevulnerabilities.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **8.Domains** >
tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -30,7 +30,7 @@ The default analysis task is:
- SubjectAltName Allows Privilege Escalation (ESC1)
- Defined EKUs Allow Arbitrary Certificate Signing (ESC2)
- - Certificates in Combination can be used for Arbitrary Privilege Escalation (ESC3)
+ - Certificates in Combination Allow Arbitrary Privilege Escalation (ESC3)
- Exploitable Access Control Entries on Templates (ESC4)
- Public Key Infrastructure Misconfigurations (ESC5)
- EDITF_ATTRIBUTESUBJECTALTNAME2 Allows Privilege Escalation (ESC6)
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_domainpermissions.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_domainpermissions.md
index 715b858e04..6cb13c2785 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_domainpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_domainpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **8.Domains** >
**AD_DomainPermissions** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_domainreplication.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_domainreplication.md
index f9fedb2e4e..953e68e371 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_domainreplication.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/domains/ad_domainreplication.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **8.Domains** >
**AD_DomainReplication** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/groups/ad_groupmembershippermissions.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/groups/ad_groupmembershippermissions.md
index a7bfb21290..b35c19e089 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/groups/ad_groupmembershippermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/groups/ad_groupmembershippermissions.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **2.Groups** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/groups/ad_grouppermissions.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/groups/ad_grouppermissions.md
index f36f60be71..d7892efa7b 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/groups/ad_grouppermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/groups/ad_grouppermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **2.Groups** > **AD_
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -29,7 +29,7 @@ The default analysis tasks are:
- Summarize group object permissions – Creates an interim processing table in the database for use
by downstream analysis and report generation
- Group Ownership – Lists the owners of each group object and determines if they are a non-standard
- owner. Principals that are not administrators are considered non-standard owners of group objects.
+ owner. Principals that aren't administrators are considered non-standard owners of group objects.
- Group Ownership Summary – Summarizes owner type by domain
In addition to the tables and views created by the analysis tasks, the AD_GroupPermissions job
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/overview.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/overview.md
index c739d5975d..a4c836a4ec 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/overview.md
@@ -6,9 +6,9 @@ sidebar_position: 50
# Active Directory Permissions Analyzer Solution
-The Access Analyzer Active Directory Permissions Analyzer Solution enables organizations to easily
-and automatically determine effective permissions applied to any and all Active Directory (AD)
-objects. AD, Security, and Network Administrators can easily browse and compare information from
+The Access Analyzer Active Directory Permissions Analyzer Solution enables organizations to
+automatically determine effective permissions applied to all Active Directory (AD)
+objects. AD, Security, and Network Administrators can browse and compare information from
individual or multiple domains using comprehensive, preconfigured analyses and reports focused on
permissions associated with AD domains, organizational units, groups, users, and computers. These
capabilities enable them to obtain the most authoritative view of who has access to what in AD.
@@ -42,8 +42,8 @@ installed from the Instant Job Wizard, see the
[Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md) topic for additional information.
When purchased separately, the Permissions Analyzer Solution is installed into the Jobs tree with
the Active Directory instant solution. The license limits the solution to just the **Jobs** >
-**Active Directory Permissions Analyzer** Job Group. Once installed into the Jobs tree, navigate to
-the solution: **Jobs** > **Active Directory Permissions Analyzer**. The 0.Collection Job Group
+**Active Directory Permissions Analyzer** Job Group. After you install the solution into the Jobs tree, navigate to
+it: **Jobs** > **Active Directory Permissions Analyzer**. The 0.Collection Job Group
collects the data. The other job groups run analysis on the collected data and generate reports.
## Job Groups
@@ -72,8 +72,8 @@ The job groups and jobs in the Active Directory Permissions Analyzer Solution ar
- [4.Computers Job Group](/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/computers/overview.md) – Reports on all Active Directory permissions
applied to computer objects within the targeted domains
- [5.Open Access > AD_OpenAccess Job](/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_openaccess.md) – Reports on all Active Directory
- permissions granting open access within the targeted domains. Open Access can be defined as access
- granted to security principals such as: Domain Users, Authenticated Users, and Everyone.
+ permissions granting open access within the targeted domains. Open Access means access
+ granted to security principals such as Domain Users, Authenticated Users, and Everyone.
- [6.Broken Inheritance > AD_BrokenInheritance Job](/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_brokeninheritance.md) – Reports on all
locations within Active Directory where inheritance is broken within the targeted domains
- [7.Containers Job Group](/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/containers/overview.md) – Reports on all Active Directory permissions
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/recommended.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/recommended.md
index d6de0beda2..2f14fe2c55 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/recommended.md
@@ -8,11 +8,11 @@ sidebar_position: 10
**Dependencies**
-The following Access Analyzer job groups need to be successfully run:
+Successfully run the following Access Analyzer job groups:
- .Active Directory Inventory Job Group
-The following jobs need to be run prior to running the [AD_ShadowAccess Job](/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_shadowaccess.md):
+Run the following jobs before running the [AD_ShadowAccess Job](/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_shadowaccess.md):
- .Active Directory Inventory >1-AD_Scan > ADInventory
- Active Directory > 1.Groups > AD_SensitiveSecurityGroups
@@ -21,7 +21,7 @@ The following jobs need to be run prior to running the [AD_ShadowAccess Job](/do
- Active Directory Permissions Analyzer > 1.Users > AD_ResetPasswordPermissions
- Active Directory Permissions Analyzer > 2.Groups > AD_GroupMembershipPermissions
-The following jobs can be optionally run to enhance reporting in the
+You can optionally run the following jobs to enhance reporting in the
[AD_ShadowAccess Job](/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/ad_shadowaccess.md):
- Active Directory > 2.Users > AD_WeakPasswords
@@ -51,7 +51,7 @@ This job group can be scheduled to run as desired.
**Workflow**
-**Step 1 –** Prerequisite: Successful execution of the .Active Directory Inventory Job Group.
+**Step 1 –** Prerequisite: Successfully run the .Active Directory Inventory Job Group.
**Step 2 –** Schedule the Active Directory Permissions Analyzer Job Group to run as desired.
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/sites/ad_dcshadowpermissions.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/sites/ad_dcshadowpermissions.md
index 97264d6ef6..9027f77123 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/sites/ad_dcshadowpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/sites/ad_dcshadowpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **9.Sites** >
**AD_DCShadowPermissions** > **Configure** node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/sites/ad_sitepermissions.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/sites/ad_sitepermissions.md
index 2be820a4bb..8e75393317 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/sites/ad_sitepermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/sites/ad_sitepermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **9.Sites** > **AD_S
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/users/ad_resetpasswordpermissions.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/users/ad_resetpasswordpermissions.md
index 14bed4f8f0..fad81cc5f0 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/users/ad_resetpasswordpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/users/ad_resetpasswordpermissions.md
@@ -18,7 +18,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **1.Users** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/users/ad_userpermissions.md b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/users/ad_userpermissions.md
index 9182111f66..7190f6db1b 100644
--- a/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/users/ad_userpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/activedirectorypermissionsanalyzer/users/ad_userpermissions.md
@@ -16,7 +16,7 @@ Navigate to the **Active Directory Permissions Analyzer** > **1.Users** > **AD_U
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -30,7 +30,7 @@ The default analysis tasks are:
- Summarize user object permissions – Creates an interim processing table in the database for use by
downstream analysis and report generation
- User Ownership – Lists the owners of each user object and determines if they are a non-standard
- owner. Principals that are not administrators are considered non-standard owners of user objects.
+ owner. Principals that aren't administrators are considered non-standard owners of user objects.
Creates the SA_AD_UserOwnership_Details table accessible under the job’s Results node.
- User Ownership Summary – Summarizes the owner type by domain
diff --git a/docs/accessanalyzer/12.0/solutions/anyid/anyid_csv.md b/docs/accessanalyzer/12.0/solutions/anyid/anyid_csv.md
index 49f42927df..76c4801bfb 100644
--- a/docs/accessanalyzer/12.0/solutions/anyid/anyid_csv.md
+++ b/docs/accessanalyzer/12.0/solutions/anyid/anyid_csv.md
@@ -32,7 +32,7 @@ Local Host
**Connection Profile**
-The AnyID_CSV job does not require a connection profile.
+The AnyID_CSV job doesn't require a connection profile.
**History Retention**
@@ -80,7 +80,7 @@ The query is:
### Configure the AnyID_CSV Query
-Follow the steps to configure the AnyID_CSV query.
+To configure the AnyID_CSV query, complete the following steps.
@@ -109,11 +109,12 @@ The following attributes must be configured in order for the job to execute prop
- $inputfile – File path to the CSV file which contains the identity and attribute information
-- $RequiredAttributes – The list of attributes that need to be found in the document in order to
+- $RequiredAttributes – The list of attributes that need to be found in the document to
trigger a match
- - An attribute in the Attributes list will not be considered a match (in reporting and AIC)
- unless an attribute in the RequiredAttributes list is also found in the same file
+ - An attribute in the Attributes list will not be considered a match (in reporting and the
+ Access Information Center (AIC)) unless an attribute in the RequiredAttributes list is also
+ found in the same file
- $Attributes – The list of attributes that will be scanned for during sensitive data scanning
@@ -139,7 +140,7 @@ Navigate to the **Jobs** > **AnyID Connectors** > **AnyID_CSV** > **Configure**
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/anyid/anyid_epicclarity.md b/docs/accessanalyzer/12.0/solutions/anyid/anyid_epicclarity.md
index abbe3349ca..4f03cfd660 100644
--- a/docs/accessanalyzer/12.0/solutions/anyid/anyid_epicclarity.md
+++ b/docs/accessanalyzer/12.0/solutions/anyid/anyid_epicclarity.md
@@ -8,7 +8,7 @@ sidebar_position: 20
The AnyID_EpicClarity job collects patient information from Epic including MRNs, SSNs, Subscriber
IDs, and Account IDs. An account with read access to the underlying Clarity Oracle database is
-required in order to run queries.
+required to run queries.
@@ -44,7 +44,7 @@ Not supported
**Schedule Frequency**
-This job should be run based on the desired frequency of Sensitive Data Scans.
+This job should be run based on the frequency you want for Sensitive Data Scans.
**Query Configuration**
@@ -77,13 +77,13 @@ The queries are:
- Epic Clarity Coverage – Imports Epic Clarity subject profile information on coverage
- Epic Clarity Identity IDs – Imports Epic Clarity subject profile information on identity IDs
-The above queries have configurable parameters. See the
+The preceding queries have configurable parameters. See the
[Configure the AnyID_EpicClarity Queries](#configure-the-anyid_epicclarity-queries) topic for
additional information.
### Configure the AnyID_EpicClarity Queries
-Follow the steps to configure the AnyID_EpicClarity queries.
+To configure the AnyID_EpicClarity queries, complete the following steps.
**Step 1 –** Navigate to the **AnyID Connectors** > **AnyID_EpicClarity** > **Configure** node and
select **Queries**.
@@ -107,10 +107,11 @@ information. Configure the following attributes as needed:
- $Attributes – The list of attributes that will be scanned for during sensitive data scanning.
Default values are MRN, SSN, Name, Date of Birth, Subscriber ID, Identity ID, and Account ID.
- - An attribute in the Attributes list will not be considered a match (in reporting and AIC)
- unless an attribute in the RequiredAttributes list is also found in the same file
+ - An attribute in the Attributes list will not be considered a match (in reporting and the
+ Access Information Center (AIC)) unless an attribute in the RequiredAttributes list is also
+ found in the same file
-- $RequiredAttributes – The list of attributes that need to be found in the document in order to
+- $RequiredAttributes – The list of attributes that need to be found in the document to
trigger a match. The default values are SSN, MRN, and IdentityID.
- An attribute in the Attributes list will not be considered a match (in reporting and AIC)
@@ -130,7 +131,7 @@ Navigate to the **Jobs** > **AnyID Connectors** > **AnyID_EpicClarity** > **Con
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/anyid/anyid_paycom.md b/docs/accessanalyzer/12.0/solutions/anyid/anyid_paycom.md
index 78f7313c73..eb36da5408 100644
--- a/docs/accessanalyzer/12.0/solutions/anyid/anyid_paycom.md
+++ b/docs/accessanalyzer/12.0/solutions/anyid/anyid_paycom.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# AnyID_Paycom Job
The AnyID_Paycom job pulls employee information from Paycom including name, address, date of Birth,
-and SSN. Contact the organization's Paycom administrator in order to generate the CSV export
+and SSN. Contact the organization's Paycom administrator to generate the CSV export
required for this job. The recommended approach is to copy the CSV file to the Access Analyzer
Console for best import performance.
@@ -29,7 +29,7 @@ Local Host
**Connection Profile**
-The AnyID_Paycom job does not require a connection profile.
+The AnyID_Paycom job doesn't require a connection profile.
**History Retention**
@@ -42,7 +42,7 @@ Not supported
**Schedule Frequency**
-This job should be run based on the desired frequency of Sensitive Data Scans.
+This job should be run based on the frequency you want for Sensitive Data Scans.
**Query Configuration**
@@ -77,7 +77,7 @@ The queries are:
### Configure the AnyID_Paycom Job
-Follow the steps to configure the AnyID_Paycom query.
+To configure the AnyID_Paycom query, complete the following steps.
**Step 1 –** Navigate to the **AnyID Connectors** > **AnyID_Paycom** > **Configure** node and select
**Queries**.
@@ -95,16 +95,17 @@ the page to expand the Parameters window. See the
[PowerShell: Edit Query](/docs/accessanalyzer/12.0/admin/datacollector/powershell/editquery.md) topic for additional
information. Configure the following attributes as needed:
-- $SAHOSTNAME – Created during execution. This parameter cannot be modified.
-- $JobCredential – Created during execution. This parameter cannot be modified.
-- $JobCredentials – Created during execution. This parameter cannot be modified.
+- $SAHOSTNAME – Created during execution. This parameter can't be modified.
+- $JobCredential – Created during execution. This parameter can't be modified.
+- $JobCredentials – Created during execution. This parameter can't be modified.
- $inputfile – File path to the CSV file which contains the identity and attribute information
- $Attributes – The list of attributes that will be scanned for during sensitive data scanning
- - An attribute in the Attributes list will not be considered a match (in reporting and AIC)
- unless an attribute in the RequiredAttributes list is also found in the same file
+ - An attribute in the Attributes list will not be considered a match (in reporting and the
+ Access Information Center (AIC)) unless an attribute in the RequiredAttributes list is also
+ found in the same file
-- $RequiredAttributes – The list of attributes that need to be found in the document in order to
+- $RequiredAttributes – The list of attributes that need to be found in the document to
trigger a match
- An attribute in the Attributes list will not be considered a match (in reporting and AIC)
@@ -129,7 +130,7 @@ Navigate to the **Jobs** > **AnyID Connectors** > **AnyID_Paycom** > **Configur
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/anyid/anyid_salesforce.md b/docs/accessanalyzer/12.0/solutions/anyid/anyid_salesforce.md
index f5fbdc9258..3a9bf82097 100644
--- a/docs/accessanalyzer/12.0/solutions/anyid/anyid_salesforce.md
+++ b/docs/accessanalyzer/12.0/solutions/anyid/anyid_salesforce.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# AnyID_Salesforce Job
The AnyID_Salesforce job collects Salesforce contact details including phone, address, email, and
-date of birth. This job requires API access to Salesforce in order to collect this information. The
+date of birth. This job requires API access to Salesforce to collect this information. The
list of collected attributes can be adjusted as necessary.
@@ -87,7 +87,7 @@ The query is:
### Configure the AnyID_Salesforce Query
-Follow the steps to configure the AnyID_Salesforce query.
+To configure the AnyID_Salesforce query, complete the following steps.
**Step 1 –** Navigate to the **AnyID Connectors** > **AnyID_Salesforce** > **Configure** node and
select **Queries**.
@@ -105,15 +105,16 @@ the page to expand the Parameters window. See the
[PowerShell: Edit Query](/docs/accessanalyzer/12.0/admin/datacollector/powershell/editquery.md) topic for additional
information. Configure the following attributes as needed:
-- $SAHOSTNAME – Created during execution. This parameter cannot be modified.
-- $JobCredential – Created during execution. This parameter cannot be modified.
-- $JobCredentials – Created during execution. This parameter cannot be modified.
+- $SAHOSTNAME – Created during execution. This parameter can't be modified.
+- $JobCredential – Created during execution. This parameter can't be modified.
+- $JobCredentials – Created during execution. This parameter can't be modified.
- $Attributes – The list of attributes that will be scanned for during sensitive data scanning
- - An attribute in the Attributes list will not be considered a match (in reporting and AIC)
- unless an attribute in the RequiredAttributes list is also found in the same file
+ - An attribute in the Attributes list will not be considered a match (in reporting and the
+ Access Information Center (AIC)) unless an attribute in the RequiredAttributes list is also
+ found in the same file
-- $RequiredAttributes – The list of attributes that need to be found in the document in order to
+- $RequiredAttributes – The list of attributes that need to be found in the document to
trigger a match
- An attribute in the Attributes list will not be considered a match (in reporting and AIC)
@@ -135,7 +136,7 @@ Navigate to the **Jobs** > **AnyID Connectors** > **AnyID_Salesforce** > **Conf
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/anyid/overview.md b/docs/accessanalyzer/12.0/solutions/anyid/overview.md
index ad75fe889e..74b5bcf6cf 100644
--- a/docs/accessanalyzer/12.0/solutions/anyid/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/anyid/overview.md
@@ -6,24 +6,24 @@ sidebar_position: 60
# AnyID Connectors Solution
-The AnyID Connectors Solution allows you to quickly find where data for identities are stored,
+Use the AnyID Connectors Solution to quickly find where data for identities are stored,
reducing the response time to Data Subject Access Requests (DSARs). Integration with third party
-repositories allows you to perform exact data matching for profiles such as employees, customers,
+repositories lets you perform exact data matching for profiles such as employees, customers,
students, or patients across any data repository.
Data Privacy Engine works in conjunction with Access Analyzer Sensitive Data Discovery scans to
create an efficient, secure IdentityIndex™ that privacy, security, and legal professionals can
-leverage to quickly and easily map the location of subject information. Through a series of
-preconfigured Identity Connectors,you can easily extract identity-related attributes about customers
+use to quickly map the location of subject information. Through a series of
+preconfigured Identity Connectors, you can extract identity-related attributes about customers
and other potential subjects from verified systems of record like Salesforce, Epic, Peoplesoft, and
Paycom, as well as homegrown or alternative platforms.
Through the creation of a Subject Profile for each individual, Access Analyzer’s broad-reaching
Sensitive Data Discovery engine accurately identifies the specific location of a subject’s data
-across virtually any cloud or on-premises data repository. With this context in tow, organizations
-can now easily perform Data Subject Access Requests (DSARs), zero-in on where the implementation of
-Privacy by Design principles are needed most urgently, and know for certain when breach attempts and
-activities involve consumer, patient, resident, and other subject data.
+across virtually any cloud or on-premises data repository. With this context, organizations
+can perform Data Subject Access Requests (DSARs), identify where Privacy by Design principles are
+needed most urgently, and confirm when breach attempts and activities involve consumer, patient,
+resident, and other subject data.
## Supported Platforms
@@ -40,7 +40,7 @@ for additional information.
-Once installed into the Jobs tree, navigate to the solution: **Jobs** > **AnyID Connectors**.
+After you install the solution into the Jobs tree, navigate to it: **Jobs** > **AnyID Connectors**.
## Jobs
@@ -62,12 +62,12 @@ The jobs in the AnyID Connectors Solution are:
this when a native integration may not be available, or an export is the best option.
- [AnyID_EpicClarity Job](/docs/accessanalyzer/12.0/solutions/anyid/anyid_epicclarity.md) – Collects patient information from Epic including
MRNs, SSNs, Subscriber IDs, and Account IDs. An account with read access to the underlying Clarity
- Oracle database is required in order to run queries.
+ Oracle database is required to run queries.
- [AnyID_Paycom Job](/docs/accessanalyzer/12.0/solutions/anyid/anyid_paycom.md) – Pulls employee information from Paycom including Name,
- Address, Date of Birth, and SSN. Contact your Paycom administrator in order to generate the CSV
+ Address, Date of Birth, and SSN. Contact your Paycom administrator to generate the CSV
export required for this job.
- [AnyID_Salesforce Job](/docs/accessanalyzer/12.0/solutions/anyid/anyid_salesforce.md) – Collects Salesforce Contact details including Phone,
- Address, Email, and Date of birth. This job requires API access to Salesforce in order to collect
+ Address, Email, and Date of birth. This job requires API access to Salesforce to collect
this information.
:::note
diff --git a/docs/accessanalyzer/12.0/solutions/aws/collection/1.aws_orgscan.md b/docs/accessanalyzer/12.0/solutions/aws/collection/1.aws_orgscan.md
index 0a5eaf9d3a..8a6f6c87d6 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/collection/1.aws_orgscan.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/collection/1.aws_orgscan.md
@@ -23,7 +23,7 @@ The 1.AWS_OrgScan job has the following configurable query:
### Configure the Org Scan Query
The Org Scan query in the 1.AWS_OrgScan job has been preconfigured to run with the default settings
-with the category of Collect Org Data. Follow the steps to set any desired customizations.
+with the category of Collect Org Data. To set any desired customizations, complete the following steps.
**Step 1 –** Navigate to the **AWS** > **0.Collection** > **1.AWS_OrgScan** > **Configure** node and
select the **Queries** node.
diff --git a/docs/accessanalyzer/12.0/solutions/aws/collection/2.aws_s3scan.md b/docs/accessanalyzer/12.0/solutions/aws/collection/2.aws_s3scan.md
index 18ede10066..ceea86a2da 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/collection/2.aws_s3scan.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/collection/2.aws_s3scan.md
@@ -23,7 +23,7 @@ The 2.AWS_S3Scan job has the following configurable query:
### Configure the S3 Scan Query
The S3 Scan query in the 2.AWS_S3 Scan job has been preconfigured to run with the default settings
-with the category of Collect S3. Follow the steps to set any desired customizations.
+with the category of Collect S3. To set any desired customizations, complete the following steps.
**Step 1 –** Navigate to the **AWS** > **0.Collection** > **2.AWS_S3Scan** > **Configure** node and
select the **Queries** node.
@@ -63,7 +63,7 @@ Navigate to the **AWS** > **0.Collection** > **2.AWS_S3Scan** > **Configure** no
**Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/collection/3.aws_iamscan.md b/docs/accessanalyzer/12.0/solutions/aws/collection/3.aws_iamscan.md
index 2729e78d91..5897d25572 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/collection/3.aws_iamscan.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/collection/3.aws_iamscan.md
@@ -23,7 +23,7 @@ The 3.AWS_IAMScan job has the following configurable query:
### Configure the IAM Scan Query
The IAM Scan query in the 3.AWS_IAMScan job has been preconfigured to run with the default settings
-with the category of Collect IAM Data. Follow the steps to set any desired customizations.
+with the category of Collect IAM Data. To set any desired customizations, complete the following steps.
**Step 1 –** Navigate to the **AWS** > **0.Collection** > **3.AWS_IAMScan** > **Configure** node and
select the **Queries** node.
@@ -54,7 +54,7 @@ View the analysis tasks by navigating to the **AWS** > **0.Collection** > **3.AW
**Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/collection/4.aws_s3sddscan.md b/docs/accessanalyzer/12.0/solutions/aws/collection/4.aws_s3sddscan.md
index 43a3fda53c..ddca91616d 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/collection/4.aws_s3sddscan.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/collection/4.aws_s3sddscan.md
@@ -22,8 +22,8 @@ The 4.AWS_S3SDDScan job has the following configurable query:
### Configure the AWS S3 Sensitive Data Scan Query
The AWS S3 Sensitive Data Scan query in the 4.AWS_S3SDDScan job has been preconfigured to run with
-the default settings with the category of Collect SDD Data. Follow the steps to set any desired
-customizations.
+the default settings with the category of Collect SDD Data. To set any desired
+customizations, complete the following steps.
**Step 1 –** Navigate to the **AWS** > **0.Collection** > **4.AWS_S3SDD Scan** > **Configure** node
and select the **Queries** node.
@@ -94,7 +94,7 @@ View the analysis tasks by navigating to the **AWS** > **0.Collection** > **4.AW
**Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/collection/overview.md b/docs/accessanalyzer/12.0/solutions/aws/collection/overview.md
index 490317e431..46511dedee 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/collection/overview.md
@@ -17,7 +17,7 @@ The 0.Collection Job Group is comprised of:
password policies and accounts within the organization
- [2.AWS_S3Scan Job](/docs/accessanalyzer/12.0/solutions/aws/collection/2.aws_s3scan.md) – Collects details about the AWS S3 buckets including details
about the objects in those buckets
-- [3.AWS_IAMScan Job](/docs/accessanalyzer/12.0/solutions/aws/collection/3.aws_iamscan.md) – Collects details about users, groups, policies, roles and
+- [3.AWS_IAMScan Job](/docs/accessanalyzer/12.0/solutions/aws/collection/3.aws_iamscan.md) – Collects details about users, groups, policies, roles, and
other IAM related identities
- [4.AWS_S3SDDScan Job](/docs/accessanalyzer/12.0/solutions/aws/collection/4.aws_s3sddscan.md) – Collects details about S3 objects containing sensitive
data
diff --git a/docs/accessanalyzer/12.0/solutions/aws/groups/aws_groupmembers.md b/docs/accessanalyzer/12.0/solutions/aws/groups/aws_groupmembers.md
index 610c63c0fb..0f7bf71e97 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/groups/aws_groupmembers.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/groups/aws_groupmembers.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **3.Groups** > **AWS_GroupMembers** > **Configure** no
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/groups/aws_nopolicygroups.md b/docs/accessanalyzer/12.0/solutions/aws/groups/aws_nopolicygroups.md
index 664280a88c..9cb7f7ed98 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/groups/aws_nopolicygroups.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/groups/aws_nopolicygroups.md
@@ -14,7 +14,7 @@ Navigate to the **AWS** > **3.Groups** > **AWS_NoPolicyGroups** > **Configure**
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -35,4 +35,4 @@ produces the following preconfigured report:
| Report | Description | Default Tags | Report Element |
| ----------------------- | ----------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Groups With No Policies | This report identifies groups that do not have a policy assigned. | None | This report is comprised of the following elements: - Stacked Bar Chart – Displays top accounts by no policy group counts
- Table – Shows no policy groups by accounts
- Table – Provides details on no policy groups
|
+| Groups With No Policies | This report identifies groups that don't have a policy assigned. | None | This report is comprised of the following elements: - Stacked Bar Chart – Displays top accounts by no policy group counts
- Table – Shows no policy groups by accounts
- Table – Provides details on no policy groups
|
diff --git a/docs/accessanalyzer/12.0/solutions/aws/groups/aws_stalegroups.md b/docs/accessanalyzer/12.0/solutions/aws/groups/aws_stalegroups.md
index 21f1fbfba4..312883107d 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/groups/aws_stalegroups.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/groups/aws_stalegroups.md
@@ -11,14 +11,14 @@ definition for staleness is set by default to 60 days. This can be configured.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
The AWS_StaleGroups job has the following configurable parameter:
-- Days without login to consider an account stale
+- Days without log in to consider an account stale
See the
[Customizable Analysis Tasks for the AWS_StaleGroups Job](#customizable-analysis-tasks-for-the-aws_stalegroups-job)
@@ -30,7 +30,7 @@ Navigate to the **AWS** > **3.Groups** > **AWS_StaleGroups** > **Configure** nod
**Analysis** to view the analysis tasks.
:::warning
-Do not deselect the selected analysis tasks. The analysis tasks are preconfigured for
+Don't deselect the selected analysis tasks. The analysis tasks are preconfigured for
this job. Only modify the analysis tasks listed in the customizable analysis tasks section.
:::
@@ -42,7 +42,7 @@ The following analysis tasks are selected by default:
- Stale Group Details – Highlights the staleness of users in AWS groups. Creates the
AWS_StaleGroup_Details table accessible under the job’s Results node.
- - The number of days without login to consider an account stale can be customized. By default it
+ - The number of days without log in to consider an account stale can be customized. By default it
is set to 60. See the
[Customizable Analysis Tasks for the AWS_StaleGroups Job](#customizable-analysis-tasks-for-the-aws_stalegroups-job)
topic for additional information.
@@ -57,7 +57,7 @@ The default values for parameters that can be customized are:
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
| ------------------- | --------------------------- | ------------- | ----------------------------------------------- |
-| Stale Group Details | @StaleThreshold | 60 | Days without login to consider an account stale |
+| Stale Group Details | @StaleThreshold | 60 | Days without log in to consider an account stale |
See the
[Configure the Customizable Parameters in an Analysis Task](/docs/accessanalyzer/12.0/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md)
diff --git a/docs/accessanalyzer/12.0/solutions/aws/organizations/aws_accounts.md b/docs/accessanalyzer/12.0/solutions/aws/organizations/aws_accounts.md
index 5543d303d7..b7523198dd 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/organizations/aws_accounts.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/organizations/aws_accounts.md
@@ -17,7 +17,7 @@ Navigate to the **AWS** > **1.Organizations** > **AWS_Accounts** > **Configure**
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/organizations/aws_memberaccountusers.md b/docs/accessanalyzer/12.0/solutions/aws/organizations/aws_memberaccountusers.md
index a51e606fb4..b36a42e2cb 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/organizations/aws_memberaccountusers.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/organizations/aws_memberaccountusers.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# AWS_MemberAccountUsers Job
-The AWS_MemberAccountUsers job highlights users that are not located in the primary AWS Identity
+The AWS_MemberAccountUsers job highlights users that aren't located in the primary AWS Identity
Source, which is generally the Master AWS Account for the Organization.
## Analysis Tasks for the AWS_MemberAccountUsers Job
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **1.Organizations** > **AWS_MemberAccountUsers** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -36,4 +36,4 @@ produces the following preconfigured report:
| Report | Description | Default Tags | Report Element |
| -------------------- | -------------------------------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Member Account Users | This report highlights user accounts that are not contained in the AWS Master Account. | None | This report is comprised of the following elements: - Stacked Bar Chart – Displays top member account users by org
- Table – Shows member account users by Org
- Table – Provides details on member account users
|
+| Member Account Users | This report highlights user accounts that aren't contained in the AWS Master Account. | None | This report is comprised of the following elements: - Stacked Bar Chart – Displays top member account users by org
- Table – Shows member account users by Org
- Table – Provides details on member account users
|
diff --git a/docs/accessanalyzer/12.0/solutions/aws/organizations/overview.md b/docs/accessanalyzer/12.0/solutions/aws/organizations/overview.md
index 2dd6b8dddf..c29944cde4 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/organizations/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/organizations/overview.md
@@ -15,7 +15,7 @@ The 1.Organizations job jroup is comprised of:
- [AWS_Accounts Job](/docs/accessanalyzer/12.0/solutions/aws/organizations/aws_accounts.md) – Provides detailed information about the accounts that exist
in each AWS Organization. This job also determines the AWS Master Account for each Organization.
- The AWS Master Account can be set manually by adding a line for each Organization in the temporary
- table #IdentitySourceAccount in the analysis task parameters for this job.
-- [AWS_MemberAccountUsers Job](/docs/accessanalyzer/12.0/solutions/aws/organizations/aws_memberaccountusers.md) – Highlights users that are not located in
+ You can set the AWS Master Account manually by adding a line for each Organization in the
+ temporary table #IdentitySourceAccount in the analysis task parameters for this job.
+- [AWS_MemberAccountUsers Job](/docs/accessanalyzer/12.0/solutions/aws/organizations/aws_memberaccountusers.md) – Highlights users that aren't located in
the primary AWS Identity Source, which is generally the Master AWS Account for the Organization
diff --git a/docs/accessanalyzer/12.0/solutions/aws/overview.md b/docs/accessanalyzer/12.0/solutions/aws/overview.md
index 8f752dc53b..7a9943e901 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/overview.md
@@ -6,10 +6,10 @@ sidebar_position: 70
# AWS Solution
-Access Analyzer for AWS allows organizations to secure their data residing in Amazon Web Services
-(AWS) S3 platform, reducing their risk exposure through proactive, automated auditing and reporting
-of S3 permissions, sensitive data, and ultimately a consolidated view of user access rights across
-dozens of structured and unstructured data resources both on-premises and in the cloud.
+Access Analyzer for AWS helps organizations secure data stored in the Amazon Web Services (AWS) S3
+platform. It reduces risk exposure through proactive, automated auditing and reporting of S3
+permissions and sensitive data, giving you a consolidated view of user access rights across dozens
+of structured and unstructured data resources, both on-premises and in the cloud.
The AWS Solution is designed to provide information about data access such as:
@@ -17,11 +17,11 @@ The AWS Solution is designed to provide information about data access such as:
- Who is accessing your data
- What sensitive data is being stored and accessed
-The AWS Solution provides the ability to audit AWS IAM and S3. Access Analyzer uses the AWS solution
+The AWS Solution lets you audit AWS IAM and S3. Access Analyzer uses the AWS solution
to collect IAM users, groups, roles, and policies, as well as S3 permissions, content, and sensitive
-data from target AWS accounts. The solution requires a special Access Analyzer license. It can be
-focused to only conduct auditing of AWS IAM. Additionally, the Sensitive Data Discovery Add-On
-enables the solution to search AWS S3 content for sensitive data.
+data from target AWS accounts. The solution requires a special Access Analyzer license. You can focus it to audit only AWS IAM.
+Additionally, the Sensitive Data Discovery Add-On enables the solution to search AWS S3 content for
+sensitive data.
**Supported Platforms**
@@ -36,25 +36,25 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, a job configured to scan 8
+hosts at a time requires an extra 16 GB of RAM (8x2=16).
:::note
-The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
+Access Analyzer installs the appropriate JDK (Java) version for Sensitive Data Discovery on the
+server. The deployed JDK is prepackaged and doesn't require any configuration. Access Analyzer
+preconfigures it to work with the product, so never customize it through Java. It will not
conflict with other JDKs or Java Runtimes in the same environment.
:::
**Location**
-The AWS Solution requires a special Access Analyzer license. It can be installed from the Access
+The AWS Solution requires a special Access Analyzer license. You can install it from the Access
Analyzer Instant Job Wizard. See the [Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md)
topic for information on installing instant solutions from the Access Analyzer Library.
-Once it has been installed into the Jobs tree, navigate to the solution: **Jobs** > **AWS**.
+After you install it into the Jobs tree, navigate to the solution: **Jobs** > **AWS**.
## Job Groups
diff --git a/docs/accessanalyzer/12.0/solutions/aws/policies/aws_custommanagedpolicies.md b/docs/accessanalyzer/12.0/solutions/aws/policies/aws_custommanagedpolicies.md
index c1ed041844..bcac941c81 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/policies/aws_custommanagedpolicies.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/policies/aws_custommanagedpolicies.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **5.Policies** > **AWS_CustomManagedPolicies** > **Con
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/policies/aws_inlinepolicies.md b/docs/accessanalyzer/12.0/solutions/aws/policies/aws_inlinepolicies.md
index 7de42e513c..63a488ee30 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/policies/aws_inlinepolicies.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/policies/aws_inlinepolicies.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **5.Policies** > **AWS_InlinePolicies** > **Configure*
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/policies/aws_managedpolicies.md b/docs/accessanalyzer/12.0/solutions/aws/policies/aws_managedpolicies.md
index db57a58073..c011a1ee8c 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/policies/aws_managedpolicies.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/policies/aws_managedpolicies.md
@@ -14,7 +14,7 @@ Navigate to the **AWS** > **5.Policies** > **AWS_ManagedPolicies** > **Configure
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/policies/aws_sensitivepolicies.md b/docs/accessanalyzer/12.0/solutions/aws/policies/aws_sensitivepolicies.md
index c012690919..70acd181c8 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/policies/aws_sensitivepolicies.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/policies/aws_sensitivepolicies.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **5.Policies** > **AWS_SensitivePolicies** > **Configu
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/policies/aws_unusedmanagedpolicies.md b/docs/accessanalyzer/12.0/solutions/aws/policies/aws_unusedmanagedpolicies.md
index d2277734f1..e1f12c6328 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/policies/aws_unusedmanagedpolicies.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/policies/aws_unusedmanagedpolicies.md
@@ -7,12 +7,12 @@ sidebar_position: 50
# AWS_UnusedManagedPolicies Job
The AWS_UnusedManagedPolicies job provides details on customer managed policies that exist in the
-AWS Organization. Optionally, AWS managed policies can be included by changing the parameter for the
+AWS Organization. Optionally, include AWS managed policies by changing the parameter for the
analysis task.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -31,7 +31,7 @@ Navigate to the **AWS** > **5.Policies** > **AWS_UnusedManagedPolicies** > **Con
select **Analysis** to view the analysis tasks.
:::warning
-Do not deselect the selected analysis tasks. The analysis tasks are preconfigured for
+Don't deselect the selected analysis tasks. The analysis tasks are preconfigured for
this job. Only modify the analysis tasks listed in the customizable analysis tasks section.
:::
@@ -43,7 +43,7 @@ The following analysis tasks are selected by default:
- Unused Managed Policies – Policies not assigned to any group or user. Creates the
AWS_UnusedPolicies_Details table accessible under the job’s Results node.
- - Optionally, AWS managed policies can be included by setting the parameter to True. See the
+ - Optionally, include AWS managed policies by setting the parameter to True. See the
[Customizable Analysis Tasks for the AWS_UnusedManagedPolicies Job](#customizable-analysis-tasks-for-the-aws_unusedmanagedpolicies-job)
topic for additional information.
@@ -69,4 +69,4 @@ produces the following preconfigured report:
| Report | Description | Default Tags | Report Element |
| ----------------------- | --------------------------------------------------------------------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Unused Managed Policies | This report identifies policies that are not assigned to any group or user. | None | This report is comprised of the following elements: - Stacked Bar Chart – Displays unused managed policies by account
- Table – Shows unused managed policies by account
- Table – Provides details on unused managed policies
|
+| Unused Managed Policies | This report identifies policies that aren't assigned to any group or user. | None | This report is comprised of the following elements: - Stacked Bar Chart – Displays unused managed policies by account
- Table – Shows unused managed policies by account
- Table – Provides details on unused managed policies
|
diff --git a/docs/accessanalyzer/12.0/solutions/aws/policies/aws_userpolicies.md b/docs/accessanalyzer/12.0/solutions/aws/policies/aws_userpolicies.md
index d8f14e716b..4309176066 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/policies/aws_userpolicies.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/policies/aws_userpolicies.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **5.Policies** > **AWS_UserPolicies** > **Configure**
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/policies/overview.md b/docs/accessanalyzer/12.0/solutions/aws/policies/overview.md
index cafb7b530a..f53182bdfe 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/policies/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/policies/overview.md
@@ -22,8 +22,8 @@ The 5.Policies job group is comprised of:
- [AWS_SensitivePolicies Job](/docs/accessanalyzer/12.0/solutions/aws/policies/aws_sensitivepolicies.md) – Provides details on users, groups, and
roles as well as the policies granting them sensitive permissions
- [AWS_UnusedManagedPolicies Job](/docs/accessanalyzer/12.0/solutions/aws/policies/aws_unusedmanagedpolicies.md) – Provides details on customer
- managed policies that exist in the AWS Organization. Optionally, AWS managed policies can be
- included by changing the @IncludeAWSManaged parameter on the analysis task.
+ managed policies that exist in the AWS Organization. Optionally, include AWS managed policies
+ by changing the @IncludeAWSManaged parameter on the analysis task.
- [AWS_UserPolicies Job](/docs/accessanalyzer/12.0/solutions/aws/policies/aws_userpolicies.md) – Provides details outlining user policy assignment.
This includes where the policy is assigned, directly or at a group level, and if the policy
assignment has been duplicated.
diff --git a/docs/accessanalyzer/12.0/solutions/aws/recommended.md b/docs/accessanalyzer/12.0/solutions/aws/recommended.md
index 4691959fb1..b48abae736 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/recommended.md
@@ -6,9 +6,9 @@ sidebar_position: 10
# Recommended Configuration for the AWS Solution
-The AWS Solution is configured to inherit settings from the global Settings node. The Connection
-Profile must be assigned before job execution. Once it is assigned to the job group, it can be run
-directly or scheduled.
+The AWS Solution is configured to inherit settings from the global Settings node. You must assign
+the Connection Profile before job execution. After you assign it to the job group, you can run it
+directly or schedule it.
**Dependencies**
@@ -22,25 +22,25 @@ For AWS IAM Auditing:
[Target Amazon Web Service Requirements, Permissions, and Ports](/docs/accessanalyzer/12.0/requirements/aws/target.md)
topic for additional information on permissions
-Some of the 0.Collection job group queries can be scoped to target specific S3 Objects. However, it
-is necessary for the SA_AWS_Instances table to be populated before attempting to scope the queries.
-Therefore, the AWS_S3Scan job must be manually executed before attempting to scope the S3 queries.
+You can scope some of the 0.Collection job group queries to target specific S3 objects. However,
+populate the SA_AWS_Instances table before scoping the queries. Therefore, manually run the
+AWS_S3Scan job before scoping the S3 queries.
**Target Host**
-The AWS Data Collector identifies AWS instances via the created Roles and therefore does not require
-a host list to be assigned. No target host is required (assign Local Host).
+The AWS Data Collector identifies AWS instances via the created Roles and therefore doesn't require
+you to assign a host list. No target host is required (assign Local Host).
**Connection Profile**
The AWS Data Collector requires a specific set of permissions. The account used can be either a Web
-Services (JWT) account or an Amazon Web Services account. Once the account has been provisioned,
+Services (JWT) account or an Amazon Web Services account. After you provision the account,
create a custom Connection Profile containing the credentials for the targeted environment. See the
[Amazon Web Services for User Credentials](/docs/accessanalyzer/12.0/admin/settings/connection/create/aws.md) topic for
additional information.
The Connection Profile is assigned under the **AWS** > **Settings** > **Connection** node. It is set
-to **Use Default Profile**, as configured at the global Settings level. However, if this is not the
+to **Use Default Profile**, as configured at the global Settings level. However, if this isn't the
Connection Profile with the necessary permissions for targeting the AWS instances, click the
**Select one of the following user defined profiles** option and select the appropriate Connection
Profile.
@@ -50,15 +50,15 @@ on creating a Connection Profile.
**Access Token**
-Creating the Connection Profile requires having the **Access Key ID** and the **Secret Access Key**
-that was generated by the Amazon Web Services application. See the
+Creating the Connection Profile requires the **Access Key ID** and the **Secret Access Key**
+generated by the Amazon Web Services application. See the
[Configure AWS for Scans](/docs/accessanalyzer/12.0/requirements/aws/configurescans.md) topic for additional information.
**Schedule Frequency**
Schedule the AWS job group to run weekly or daily, depending on the amount of data in the
-environment. If there are frequent AWS changes within the target environment, then it can be
-executed more often. It is best to rerun it anytime AWS changes might have occurred.
+environment. If the target environment has frequent AWS changes, run it more often. Rerun it
+anytime AWS changes might have occurred.
**History Retention**
@@ -70,8 +70,8 @@ Not supported.
**Run Order**
-The jobs in the 0.Collection job group must be run first and in order. The other job groups can be
-run in any order, together or individually, after running the 0.Collection job group.
+Run the jobs in the 0.Collection job group first and in order. You can run the other job groups in
+any order, together or individually, after running the 0.Collection job group.
:::info
Run the solution at the top level.
@@ -80,35 +80,35 @@ Run the solution at the top level.
**Run at the Solution Level**
-The jobs in the AWS job group should be run together and in order by running the entire solution,
-instead of the individual jobs.
+Run the jobs in the AWS job group together and in order by running the entire solution, instead of
+the individual jobs.
**Run at the Job Group Level**
-For environments with a large amount of S3 data, it may be desirable to run the 3.AWS_S3Scan job and
-the 4.AWS_S3SDDScan job less frequently than the other jobs in the 0.Collection job group.
+For environments with a large amount of S3 data, run the 3.AWS_S3Scan job and the 4.AWS_S3SDDScan
+job less frequently than the other jobs in the 0.Collection job group.
**Query Configuration**
-The following queries in the 0.Collection job group require the created AWS Roles to be added to the
+The following queries in the 0.Collection job group require you to add the created AWS Roles to the
Login Roles page:
- [1.AWS_OrgScan Job](/docs/accessanalyzer/12.0/solutions/aws/collection/1.aws_orgscan.md)
- [2.AWS_S3Scan Job](/docs/accessanalyzer/12.0/solutions/aws/collection/2.aws_s3scan.md)
- [3.AWS_IAMScan Job](/docs/accessanalyzer/12.0/solutions/aws/collection/3.aws_iamscan.md)
-The following queries in the 0.Collection job group can be modified to limit the depth of the scan:
+You can modify the following queries in the 0.Collection job group to limit the depth of the scan:
- [2.AWS_S3Scan Job](/docs/accessanalyzer/12.0/solutions/aws/collection/2.aws_s3scan.md)
- [4.AWS_S3SDDScan Job](/docs/accessanalyzer/12.0/solutions/aws/collection/4.aws_s3sddscan.md)
**Analysis Configuration**
-This solution can be run with the default analysis configuration. However, the following parameters
-can be modified:
+You can run this solution with the default analysis configuration. However, you can modify the
+following parameters:
- The `@STALETHRESHOLD` parameter determines the number of days after which content is considered
- stale. It is set to default of 60 days. The `@STALETHRESHOLD` parameter can be customized in the
+ stale. It is set to default of 60 days. You can customize the `@STALETHRESHOLD` parameter in the
following analysis tasks:
- **2. Users** > **AWS_StaleUsers** > **Stale Users** Analysis Task
diff --git a/docs/accessanalyzer/12.0/solutions/aws/roles/aws_roles.md b/docs/accessanalyzer/12.0/solutions/aws/roles/aws_roles.md
index 7de716ee3d..75c48f1cf7 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/roles/aws_roles.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/roles/aws_roles.md
@@ -14,7 +14,7 @@ Navigate to the **AWS** > **4.Roles** > **AWS_Roles** > **Configure** node and s
to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/roles/aws_staleroles.md b/docs/accessanalyzer/12.0/solutions/aws/roles/aws_staleroles.md
index a483cd2f26..75ad4d7d0f 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/roles/aws_staleroles.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/roles/aws_staleroles.md
@@ -6,20 +6,20 @@ sidebar_position: 20
# AWS_StaleRoles Job
-The AWS_StaleRoles job provides details on roles that are considered stale. Highlighting roles that
-have not been used in more than 60 days and those that have never been used. The 60 day parameter is
+The AWS_StaleRoles job provides details on roles that are considered stale, highlighting roles that
+haven't been used in more than 60 days and those that have never been used. The 60 day parameter is
configurable.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
The AWS_StaleRoles job has the following configurable parameter:
-- Days without login to consider an account stale
+- Days without log in to consider an account stale
See the
[Customizable Analysis Tasks for the AWS_StaleRoles Job](#customizable-analysis-tasks-for-the-aws_staleroles-job)
@@ -31,7 +31,7 @@ Navigate to the **AWS** > **4.Roles** > **AWS_StaleRoles** > **Configure** node
**Analysis** to view the analysis tasks.
:::warning
-Do not deselect the selected analysis tasks. The analysis tasks are preconfigured for
+Don't deselect the selected analysis tasks. The analysis tasks are preconfigured for
this job. Only modify the analysis tasks listed in the customizable analysis tasks section.
:::
@@ -43,8 +43,8 @@ The following analysis tasks are selected by default:
- Stale Role Details – Highlights the roles in AWS that are considered stale. Creates the
AWS_StaleRole_Details table accessible under the job’s Results node.
- - The number of days without login to consider an account stale can be customized. By default it
- is set to 60. See the
+ - You can customize the number of days without a log in to consider an account stale. By default
+ it is set to 60. See the
[Customizable Analysis Tasks for the AWS_StaleRoles Job](#customizable-analysis-tasks-for-the-aws_staleroles-job)
topic for additional information.
@@ -57,7 +57,7 @@ The default values for parameters that can be customized are:
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
| ------------------ | --------------------------- | ------------- | ------------------------------------------------ |
-| Stale Role Details | @StaleThreshold | 60 | Days without login to consider an account stale. |
+| Stale Role Details | @StaleThreshold | 60 | Days without log in to consider an account stale. |
See the
[Configure the Customizable Parameters in an Analysis Task](/docs/accessanalyzer/12.0/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md)
diff --git a/docs/accessanalyzer/12.0/solutions/aws/roles/overview.md b/docs/accessanalyzer/12.0/solutions/aws/roles/overview.md
index 932202b662..6c649f7632 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/roles/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/roles/overview.md
@@ -13,6 +13,6 @@ The 4.Roles job group provides details on roles in the AWS IAM environment.
The 4.Roles job group is comprised of:
- [AWS_Roles Job](/docs/accessanalyzer/12.0/solutions/aws/roles/aws_roles.md) – Provides details on roles in the AWS IAM environment
-- [AWS_StaleRoles Job](/docs/accessanalyzer/12.0/solutions/aws/roles/aws_staleroles.md) – Provides details on roles that are considered stale.
- Highlighting roles that have not been used in more than 60 days and those that have never been
+- [AWS_StaleRoles Job](/docs/accessanalyzer/12.0/solutions/aws/roles/aws_staleroles.md) – Provides details on roles that are considered stale,
+ highlighting roles that haven't been used in more than 60 days and those that have never been
used.
diff --git a/docs/accessanalyzer/12.0/solutions/aws/s3content/aws_s3buckets.md b/docs/accessanalyzer/12.0/solutions/aws/s3content/aws_s3buckets.md
index c1f4db1a3e..eccdfda6fe 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/s3content/aws_s3buckets.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/s3content/aws_s3buckets.md
@@ -14,7 +14,7 @@ Navigate to the **AWS** > **7.S3 Content** > **AWS_S3Buckets** > **Configure** n
**Analysis** to view the analysis task.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/s3content/aws_s3buckettags.md b/docs/accessanalyzer/12.0/solutions/aws/s3content/aws_s3buckettags.md
index 245f17d910..c95d133731 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/s3content/aws_s3buckettags.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/s3content/aws_s3buckettags.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# AWS_S3BucketTags Job
-The AWS_S3BucketTags job identifies tags associated with AWS S3 Buckets. Tagging can be helpful to
-identify the storage class or purpose of a bucket and can be used in AWS IAM Policy assignments.
+The AWS_S3BucketTags job identifies tags associated with AWS S3 Buckets. Tagging can help identify
+the storage class or purpose of a bucket, and you can use tags in AWS IAM Policy assignments.
## Analysis Tasks for the AWS_S3BucketTagsJob
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **7.S3 Content** > **AWS_S3BucketTags** > **Configure*
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/s3content/overview.md b/docs/accessanalyzer/12.0/solutions/aws/s3content/overview.md
index eb05d44b4f..b75e89bd6b 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/s3content/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/s3content/overview.md
@@ -15,5 +15,5 @@ The 7.S3 Content job group is comprised of:
- [AWS_S3Buckets Job](/docs/accessanalyzer/12.0/solutions/aws/s3content/aws_s3buckets.md) – Provides a summary of AWS S3 buckets including total
object size and counts
- [AWS_S3BucketTags Job](/docs/accessanalyzer/12.0/solutions/aws/s3content/aws_s3buckettags.md) – Identifies tags associated with AWS S3 Buckets.
- Tagging can be helpful to identify the storage class or purpose of a bucket and can be used in AWS
+ Tagging can help identify the storage class or purpose of a bucket, and you can use tags in AWS
IAM Policy assignments.
diff --git a/docs/accessanalyzer/12.0/solutions/aws/s3permissions/aws_brokeninheritance.md b/docs/accessanalyzer/12.0/solutions/aws/s3permissions/aws_brokeninheritance.md
index 45288e202d..12ba39f98a 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/s3permissions/aws_brokeninheritance.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/s3permissions/aws_brokeninheritance.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **6.S3 Permissions** > **AWS_BrokenInheritance** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/s3permissions/aws_effectivepermissions.md b/docs/accessanalyzer/12.0/solutions/aws/s3permissions/aws_effectivepermissions.md
index 51a7fbe19c..5014e3f031 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/s3permissions/aws_effectivepermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/s3permissions/aws_effectivepermissions.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **6.S3 Permissions** > **AWS_EffectivePermissions** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/s3permissions/aws_openbuckets.md b/docs/accessanalyzer/12.0/solutions/aws/s3permissions/aws_openbuckets.md
index e4703ed5a8..bb2816b376 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/s3permissions/aws_openbuckets.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/s3permissions/aws_openbuckets.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **6.S3 Permissions** > **AWS_OpenBuckets** > **Configu
**Analysis** to view the analysis task.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/sensitivedata/aws_sensitivedata.md b/docs/accessanalyzer/12.0/solutions/aws/sensitivedata/aws_sensitivedata.md
index 9d3b828e38..e586a57591 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/sensitivedata/aws_sensitivedata.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/sensitivedata/aws_sensitivedata.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **8.S3 Sensitive Data** > **AWS_SensitiveData** > **Co
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/sensitivedata/aws_sensitivedata_permissions.md b/docs/accessanalyzer/12.0/solutions/aws/sensitivedata/aws_sensitivedata_permissions.md
index de4f813c6d..9d6fa1eca8 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/sensitivedata/aws_sensitivedata_permissions.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/sensitivedata/aws_sensitivedata_permissions.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **8.S3 Sensitive Data** > **AWS_SensitiveData_Permissi
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/users/aws_accesskeys.md b/docs/accessanalyzer/12.0/solutions/aws/users/aws_accesskeys.md
index b1fe3e687e..e4695b637c 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/users/aws_accesskeys.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/users/aws_accesskeys.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **2.Users** > **AWS_AccessKeys** > **Configure** node
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/users/aws_mfastatus.md b/docs/accessanalyzer/12.0/solutions/aws/users/aws_mfastatus.md
index fb673f096b..93197355f8 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/users/aws_mfastatus.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/users/aws_mfastatus.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **2.Users** > **AWS_MFAStatus** > **Configure** node a
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/users/aws_rootaccounts.md b/docs/accessanalyzer/12.0/solutions/aws/users/aws_rootaccounts.md
index 5e3cc53de7..a1235037a0 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/users/aws_rootaccounts.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/users/aws_rootaccounts.md
@@ -15,7 +15,7 @@ Navigate to the **AWS** > **2.Users** > **AWS_RootAccounts** > **Configure** nod
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/aws/users/aws_staleusers.md b/docs/accessanalyzer/12.0/solutions/aws/users/aws_staleusers.md
index 061f8a17aa..9292328cd8 100644
--- a/docs/accessanalyzer/12.0/solutions/aws/users/aws_staleusers.md
+++ b/docs/accessanalyzer/12.0/solutions/aws/users/aws_staleusers.md
@@ -11,7 +11,7 @@ used, highlighting those over specified number of days (default 60) or that have
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -30,7 +30,7 @@ Navigate to the **AWS** > **2.Users** > **AWS_StaleUsers** > **Configure** node
**Analysis** to view the analysis tasks.
:::warning
-Do not deselect the selected analysis tasks. The analysis tasks are preconfigured for
+Don't deselect the selected analysis tasks. The analysis tasks are preconfigured for
this job. Only modify the analysis tasks listed in the customizable analysis tasks section.
:::
@@ -42,7 +42,7 @@ The following analysis tasks are selected by default:
- Stale Users – Identifies user accounts that have not been logged in to in the last 60 days.
Creates the AWS_StaleUser_Details table accessible under the job’s Results node.
- - The number of days can be customized from the default value of 60. See the
+ - You can customize the number of days from the default value of 60. See the
[Customizable Analysis Tasks for the AWS_StaleUsers Job](#customizable-analysis-tasks-for-the-aws_staleusers-job)
topic for additional information.
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_deletions.md b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_deletions.md
index 3ca24b514a..7c7c8742fa 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_deletions.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_deletions.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Forensics** > **Box_Deletions** > **Con
select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_downloads.md b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_downloads.md
index 130d18d9de..5cdb9604b6 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_downloads.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_downloads.md
@@ -15,7 +15,7 @@ Navigate to **Box** > **1.Activity** > **Forensics** > **Box_Downloads** > **Con
select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_externaluseractivity.md b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_externaluseractivity.md
index a504f231c2..9dbf63cb62 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_externaluseractivity.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_externaluseractivity.md
@@ -17,7 +17,7 @@ Navigate to **Box** > **1.Activity** > **Forensics** > **Box_ExternalUserActivit
node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_externalusercollaborations.md b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_externalusercollaborations.md
index c83dd9d657..6cd5ec3138 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_externalusercollaborations.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_externalusercollaborations.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Forensics** > **Box_ExternalUserCollabo
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_permissionchanges.md b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_permissionchanges.md
index 78eb34d876..6cb9341975 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_permissionchanges.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_permissionchanges.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Box_PermissionChanges Job
-The Box_PermissionChannges Job provides details on permission changes that have occurred over the
+The Box_PermissionChanges Job provides details on permission changes that have occurred over the
past 30 days.
## Analysis Tasks for the Box_PermissionChanges Job
@@ -15,7 +15,7 @@ Navigate to **Box** > **1.Activity** > **Forensics** > **Box_PermissionChanges**
node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_sharing.md b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_sharing.md
index 6ad9614d8d..37bd780b36 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_sharing.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_sharing.md
@@ -14,7 +14,7 @@ Navigate to **Box** > **1.Activity** > **Forensics** > **Box_Sharing** > **Confi
select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/overview.md b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/overview.md
index 225d40e890..ead4e8db5e 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/forensics/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/forensics/overview.md
@@ -23,7 +23,7 @@ The Forensics Job Group is comprised of:
user activity which has occurred over the past 30 days
- [Box_ExternalUserCollaborations Job](/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_externalusercollaborations.md) – Identifies collaboration
invites sent to external users. These collaborations should be reviewed to ensure sensitive data
- is not being shared outside of your organization.
+ isn't being shared outside of your organization.
- [Box_PermissionChanges Job](/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_permissionchanges.md) – Provides details on permission changes
that have occurred over the past 30 days
- [Box_Sharing Job](/docs/accessanalyzer/12.0/solutions/box/activity/forensics/box_sharing.md) – Provides details on sharing activity that has occurred over
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/overview.md b/docs/accessanalyzer/12.0/solutions/box/activity/overview.md
index eba6e719e1..e518d609aa 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/overview.md
@@ -6,9 +6,8 @@ sidebar_position: 30
# 1.Activity Job Group
-The **Box** > **1.Activity** Job Group identifies long term trends of activity providing insight
-into user activity, usage statistics, and suspicious behavior identifies long-term trends of
-activity providing insight into user activity, usage statistics, and suspicious behavior.
+The **Box** > **1.Activity** Job Group identifies long-term trends of activity, providing insight
+into user activity, usage statistics, and suspicious behavior.
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_failedlogins.md b/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_failedlogins.md
index bd75e92241..8760dbc54c 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_failedlogins.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_failedlogins.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Suspicious Activity** > **Box_FailedLog
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_firsttimefolderaccess.md b/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_firsttimefolderaccess.md
index 153df09f1e..f320c2ea01 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_firsttimefolderaccess.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_firsttimefolderaccess.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Box** > **1.Activity** > **Suspic
**Box_FirstTimeFolderAccess** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_unusualdownloadactivity.md b/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_unusualdownloadactivity.md
index 479253fa70..7f93de2f8a 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_unusualdownloadactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_unusualdownloadactivity.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Suspicious Activity** > **Box_UnusualDo
**Configure** node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -33,4 +33,4 @@ produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Unusual Download Activity | This report provides insight into download activity that deviates from the normal range of expected downloads. This is determined by using historical data for each file. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 most recent unusual download activity
- Table – Provides details on unusual download activity
|
+| Unusual Download Activity | This report provides insight into download activity that deviates from the normal range of expected downloads. This is determined by using historical data for each file. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 most recent unusual download activity
- Table – Provides details on unusual download activity
|
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_unusualuseractivity.md b/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_unusualuseractivity.md
index 61309f287d..bf34360a48 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_unusualuseractivity.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_unusualuseractivity.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Suspicious Activity** > **Box_UnusualUs
**Configure** node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -33,4 +33,4 @@ pre-configured report:
| Report | Description | Default Tags | Report Elements |
| --------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Unusual User Activity | This report provides insight into user activity that deviates from the normal range of expected activity. This is determined by using historical data for each user. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 most recent unusual user activity
- Table – Provides details on unusual user activity
|
+| Unusual User Activity | This report provides insight into user activity that deviates from the normal range of expected activity. This is determined by using historical data for each user. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 most recent unusual user activity
- Table – Provides details on unusual user activity
|
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_weekendactivity.md b/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_weekendactivity.md
index cb69070467..e93326fd52 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_weekendactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/suspiciousactivity/box_weekendactivity.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Suspicious Activity** > **Box_WeekendAc
**Configure** node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/usagestatistics/box_folders_mostactive.md b/docs/accessanalyzer/12.0/solutions/box/activity/usagestatistics/box_folders_mostactive.md
index 9854b4a062..4bccd46f99 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/usagestatistics/box_folders_mostactive.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/usagestatistics/box_folders_mostactive.md
@@ -15,7 +15,7 @@ Navigate to **Box** > **1.Activity** > **Usage Statistics** > **Box_Folders_Most
**Configure** node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/usagestatistics/box_folders_stale.md b/docs/accessanalyzer/12.0/solutions/box/activity/usagestatistics/box_folders_stale.md
index f0f75c479b..6f9162e240 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/usagestatistics/box_folders_stale.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/usagestatistics/box_folders_stale.md
@@ -16,7 +16,7 @@ Navigate to **Box** > **1.Activity** > **Usage Statistics** > **Box_Folders_Stal
node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/activity/usagestatistics/box_users_mostactive.md b/docs/accessanalyzer/12.0/solutions/box/activity/usagestatistics/box_users_mostactive.md
index 14f0f5d183..73de4e74b6 100644
--- a/docs/accessanalyzer/12.0/solutions/box/activity/usagestatistics/box_users_mostactive.md
+++ b/docs/accessanalyzer/12.0/solutions/box/activity/usagestatistics/box_users_mostactive.md
@@ -15,7 +15,7 @@ Navigate to **Box** > **1.Activity** > **Usage Statistics** > **Box_Users_MostAc
**Configure** node and select **Analysis** to view analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/box_access.md b/docs/accessanalyzer/12.0/solutions/box/box_access.md
index d551bdf8ac..c18531149b 100644
--- a/docs/accessanalyzer/12.0/solutions/box/box_access.md
+++ b/docs/accessanalyzer/12.0/solutions/box/box_access.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# Box_Access Job
The Box_Access Job analyzes access granted to users and groups in an organization's Box environment
-in order to report on effective access rights, file-level permissions, and inactive access rights
+to report on effective access rights, file-level permissions, and inactive access rights
that can be revoked.
## Analysis Tasks for the Box_Access Job
@@ -16,7 +16,7 @@ Navigate to **Box** > **Box_Access** > **Configure** node and select **Analysis*
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/box_groupmembership.md b/docs/accessanalyzer/12.0/solutions/box/box_groupmembership.md
index 75d0ac1ce8..1b0d003349 100644
--- a/docs/accessanalyzer/12.0/solutions/box/box_groupmembership.md
+++ b/docs/accessanalyzer/12.0/solutions/box/box_groupmembership.md
@@ -15,7 +15,7 @@ Navigate to **Box** > **Box_GroupMembership** > **Configure** node and select **
analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/collection/1-box_access_scans.md b/docs/accessanalyzer/12.0/solutions/box/collection/1-box_access_scans.md
index 5225f3a691..ddb96dc6f0 100644
--- a/docs/accessanalyzer/12.0/solutions/box/collection/1-box_access_scans.md
+++ b/docs/accessanalyzer/12.0/solutions/box/collection/1-box_access_scans.md
@@ -1,25 +1,24 @@
# 1-Box_Access Scans Job
-The 1-Box_Access Scans Job collects the data which will be further analyzed in order to provide
-details on Box access rights, policies, configurations, and content.
+The 1-Box_Access Scans Job collects data for further analysis, providing details on Box access
+rights, policies, configurations, and content.
## Queries for the 1-Box_Access Scans Job
The Scan Query uses the Box Data Collector to target all Box hosts and has been preconfigured to use
-the Scan Box Permissions Category. If this query is not configured but has the access token, a full
-scan of all folders at full depth is performed. Optionally, configure the query to limit the depth
+the Scan Box Permissions Category. If this query isn't configured but has the access token, the job
+performs a full scan of all folders at full depth. Optionally, configure the query to limit the depth
of the scan.
The 1-Box_Access Scans Job has the following queries:
-- Scan Query – Collects access data which will be further analyzed in order to provide details on
- Box access rights, policies, configurations, and content
+- Scan Query – Collects access data for further analysis, providing details on Box access rights,
+ policies, configurations, and content
-Prior to the first execution, it is necessary to authenticate to the targeted Box environment. This
-is done on the Authenticate page of the Scan query. Additionally, the following default
-configurations are commonly customized:
+Before the first execution, authenticate to the targeted Box environment on the Authenticate page of
+the Scan query. Additionally, the following default configurations are commonly customized:
- Exclusions page:
@@ -34,49 +33,49 @@ instructions.
### Configure the 1-Box_Access Scans Job
-The 1-Box_Access Scans Job contains the Scan Query. Follow the steps to configure the query.
+The 1-Box_Access Scans Job contains the Scan Query. To configure the query, complete the following steps.
**Step 1 –** Navigate to the **Box** > **0.Collection** > **1-Box_Access Scans** > **Configure**
node and select **Queries**.
-**Step 1 –** In the Query Selection view, select the Scan Query and click **Query Properties**. The
+**Step 2 –** In the Query Selection view, select the Scan Query and click **Query Properties**. The
Query Properties window opens.
-**Step 2 –** Select the **Data Source** tab, and click **Configure**. The Box Data Collector Wizard
+**Step 3 –** Select the **Data Source** tab, and click **Configure**. The Box Data Collector Wizard
opens.
-**Step 3 –** On the Exclusions Page:
+**Step 4 –** On the Exclusions Page:
- Add folders to be excluded
- Add folders to be included (scope scan to only these folders)
-**Step 4 –** On the Additional Scoping page:
+**Step 5 –** On the Additional Scoping page:
- Optionally, select this option to limit the depth of the scan across the targeted Box account
-**Step 5 –** On the Scope By User Page:
+**Step 6 –** On the Scope By User Page:
- Optionally, limit the scope of the scan to specified users by providing a CSV file
-**Step 6 –** The Authenticate page is where the connection to the target Box environment is
-configured. Click **Authorize** to launch the BoxLogin window and generate an authorization code.
-This code allows Access Analyzer to report on the Box Enterprise.
+**Step 7 –** On the Authenticate page, configure the connection to the target Box environment. Click
+**Authorize** to launch the BoxLogin window and generate an authorization code. This code allows
+Access Analyzer to report on the Box Enterprise.
:::note
-Authentication to the target Box environment only needs to be completed once, prior to the
-first scan and only in one of the scan jobs.
+You only need to complete authentication to the target Box environment once, before the first scan
+and only in one of the scan jobs.
:::
-**Step 7 –** Navigate to the Summary page, click **Finish** to save any setting modifications or
+**Step 8 –** Navigate to the Summary page, click **Finish** to save any setting modifications or
click **Cancel** if no changes were made. Then click **OK** to close the Query Properties window.
The 1-Box_Access Scans Job will execute according to the connection settings configuration.
diff --git a/docs/accessanalyzer/12.0/solutions/box/collection/1-box_activity_scans.md b/docs/accessanalyzer/12.0/solutions/box/collection/1-box_activity_scans.md
index 26bc5e3fb1..d932e8a9a2 100644
--- a/docs/accessanalyzer/12.0/solutions/box/collection/1-box_activity_scans.md
+++ b/docs/accessanalyzer/12.0/solutions/box/collection/1-box_activity_scans.md
@@ -1,7 +1,7 @@
# 1-Box_Activity Scans Job
-The 1-Box_Activity Scans Job collects the data which will be further analyzed in order to provide
-visibility into user activity events within Box.
+The 1-Box_Activity Scans Job collects data for further analysis, providing visibility into user
+activity events within Box.
## Queries for the 1-Box_Activity Scans Job
@@ -12,13 +12,12 @@ the Scan Box Permissions Category.
The 1-Box_Activity Scans Job has the following queries:
-- Activity Scan – Collects activity data which will be further analyzed in order to provide
- visibility into user activity events within Box.
+- Activity Scan – Collects activity data for further analysis, providing visibility into user
+ activity events within Box.
-Prior to the first execution, it is necessary to authenticate to the targeted Box environment if
-this has not already been done when configuring the 1-Box_Access Scans Job. This is done on the
-Authenticate page of the Activity Scan query. Additionally, the following default configurations are
-commonly customized:
+Before the first execution, authenticate to the targeted Box environment on the Authenticate page of
+the Activity Scan query, unless you already completed this step when you configured the
+1-Box_Access Scans Job. Additionally, the following default configurations are commonly customized:
- Exclusions page:
@@ -33,8 +32,8 @@ for instructions.
### Configure the 1-Box_Activity Scans Job
-The 1-Box_Activity Scans Job contains the Activity Scan Query. Follow the steps to configure the
-query.
+The 1-Box_Activity Scans Job contains the Activity Scan Query. To configure the
+query, complete the following steps.
**Step 1 –** Navigate to the **Box** > **0.Collection** > **1-Box_Activity Scans** > **Configure**
node and select **Queries**.
@@ -79,13 +78,13 @@ opens.
-**Step 9 –** The Authenticate page is where the connection to the target Box environment is
-configured. Click **Authorize** to launch the BoxLogin window and generate an authorization code.
-This code allows Access Analyzer to report on the Box Enterprise.
+**Step 9 –** On the Authenticate page, configure the connection to the target Box environment. Click
+**Authorize** to launch the BoxLogin window and generate an authorization code. This code allows
+Access Analyzer to report on the Box Enterprise.
:::note
-Authentication to the target Box environment only needs to be completed once, prior to the
-first scan and only in one of the scan jobs.
+You only need to complete authentication to the target Box environment once, before the first scan
+and only in one of the scan jobs.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/collection/2-box_import.md b/docs/accessanalyzer/12.0/solutions/box/collection/2-box_import.md
index dcc939b73b..d5aac34f11 100644
--- a/docs/accessanalyzer/12.0/solutions/box/collection/2-box_import.md
+++ b/docs/accessanalyzer/12.0/solutions/box/collection/2-box_import.md
@@ -6,9 +6,9 @@ sidebar_position: 10
# 2-Box_Import Job
-The 2-Box_Import Job takes the data that has been collected from the 1-Box_Access Scans Job and the
-1-Box_Activity Scans Job and imports it to the Access Analyzer database to be analyzed in order to
-provide detailed reports on Box access rights, policies, configurations, activities, and content.
+The 2-Box_Import Job takes the data collected from the 1-Box_Access Scans Job and the
+1-Box_Activity Scans Job and imports it into the Access Analyzer database for analysis, providing
+detailed reports on Box access rights, policies, configurations, activities, and content.
## Queries for the 2-Box_Import Job
@@ -19,6 +19,6 @@ Permissions Category.
The 2-Box_Import Job has the following query:
-- Import - Takes the data that has been collected from Box and imports it to the Access Analyzer
- database to be analyzed in order to provide detailed reports on Box access rights, policies,
- configurations, activities, and content.
+- Import - Takes the data collected from Box and imports it into the Access Analyzer database for
+ analysis, providing detailed reports on Box access rights, policies, configurations, activities,
+ and content.
diff --git a/docs/accessanalyzer/12.0/solutions/box/collection/overview.md b/docs/accessanalyzer/12.0/solutions/box/collection/overview.md
index 5aea99df88..4b00c46471 100644
--- a/docs/accessanalyzer/12.0/solutions/box/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/box/collection/overview.md
@@ -6,17 +6,17 @@ sidebar_position: 20
# 0.Collection Job Group
-The 0.Collection Job Group collects data which will be further analyzed in order to provide details
-on Box access rights, policies, configurations, activities, and content.
+The 0.Collection Job Group collects data for further analysis, providing details on Box access
+rights, policies, configurations, activities, and content.
The 0.Collection Job Group is comprised of:
-- [1-Box_Access Scans Job](/docs/accessanalyzer/12.0/solutions/box/collection/1-box_access_scans.md) – Collects the data which will be further analyzed
- in order to provide details on Box access rights, policies, configurations, and content
-- [1-Box_Activity Scans Job](/docs/accessanalyzer/12.0/solutions/box/collection/1-box_activity_scans.md) – Collects the data which will be further
- analyzed in order to provide visibility into user activity events within Box
-- [2-Box_Import Job](/docs/accessanalyzer/12.0/solutions/box/collection/2-box_import.md) – Takes the data that has been collected from Box and imports
- it to the Access Analyzer database to be analyzed in order to provide detailed reports on Box
- access rights, policies, configurations, activities, and content
+- [1-Box_Access Scans Job](/docs/accessanalyzer/12.0/solutions/box/collection/1-box_access_scans.md) – Collects data for further analysis, providing
+ details on Box access rights, policies, configurations, and content
+- [1-Box_Activity Scans Job](/docs/accessanalyzer/12.0/solutions/box/collection/1-box_activity_scans.md) – Collects data for further analysis, providing
+ visibility into user activity events within Box
+- [2-Box_Import Job](/docs/accessanalyzer/12.0/solutions/box/collection/2-box_import.md) – Takes the data collected from Box and imports it into the
+ Access Analyzer database for analysis, providing detailed reports on Box access rights, policies,
+ configurations, activities, and content
diff --git a/docs/accessanalyzer/12.0/solutions/box/content/box_filemetrics.md b/docs/accessanalyzer/12.0/solutions/box/content/box_filemetrics.md
index 793a7917de..f0532634cb 100644
--- a/docs/accessanalyzer/12.0/solutions/box/content/box_filemetrics.md
+++ b/docs/accessanalyzer/12.0/solutions/box/content/box_filemetrics.md
@@ -20,7 +20,7 @@ Navigate to **Box** > **2.Content** > **Box_FileMetrics** > **Configure** node a
**Analysis** to view analysis tasks.
:::warning
-Most of these analysis tasks should never be modified and never be deselected.
+Don't modify or deselect most of these analysis tasks.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/content/box_foldermetrics.md b/docs/accessanalyzer/12.0/solutions/box/content/box_foldermetrics.md
index f2444ed92a..2525499e5e 100644
--- a/docs/accessanalyzer/12.0/solutions/box/content/box_foldermetrics.md
+++ b/docs/accessanalyzer/12.0/solutions/box/content/box_foldermetrics.md
@@ -22,7 +22,7 @@ Navigate to **Box** > **2.Content** > **Box_FolderMetrics** > **Configure** node
**Analysis** to view analysis tasks.
:::warning
-Most of these analysis tasks should never be modified and never be deselected.
+Don't modify or deselect most of these analysis tasks.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/box/overview.md b/docs/accessanalyzer/12.0/solutions/box/overview.md
index d9c2032cec..766f964421 100644
--- a/docs/accessanalyzer/12.0/solutions/box/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/box/overview.md
@@ -21,9 +21,8 @@ for additional information.
**Location**
-The Box Solution requires a special Access Analyzer license. It can be installed from the Instant
-Job Wizard. Once it has been installed into the Jobs tree, navigate to the solution: **Jobs** >
-**Box**.
+The Box Solution requires a special Access Analyzer license. Install it from the Instant Job
+Wizard. After you install it into the Jobs tree, navigate to the solution: **Jobs** > **Box**.
@@ -39,16 +38,15 @@ an organization's Box environment.
The Box Solution has the following job groups and jobs:
-- [0.Collection Job Group](/docs/accessanalyzer/12.0/solutions/box/collection/overview.md) – Collects the data which will be further
- analyzed in order to provide details on Box access rights, policies, configurations, activities,
- and content
+- [0.Collection Job Group](/docs/accessanalyzer/12.0/solutions/box/collection/overview.md) – Collects data for further analysis, providing
+ details on Box access rights, policies, configurations, activities, and content
- [1.Activity Job Group](/docs/accessanalyzer/12.0/solutions/box/activity/overview.md) – Identifies long term trends of activity providing
insight into user activity, usage statistics, and suspicious behavior by analyzing enterprise
events within the Box environment
- [2.Content Job Group](/docs/accessanalyzer/12.0/solutions/box/content/overview.md) – Analyzes and summarizes the content of the Box
environment, highlighting users with the most content as well as what type of content exists
- [Box_Access Job](/docs/accessanalyzer/12.0/solutions/box/box_access.md) – Analyzes access granted to users and groups in an organization's
- Box environment in order to report on effective access rights, file-level permissions, and
+ Box environment to report on effective access rights, file-level permissions, and
inactive access rights that can be revoked
- [Box_GroupMembership Job](/docs/accessanalyzer/12.0/solutions/box/box_groupmembership.md) – Expands group membership in an organization's
Box environment
diff --git a/docs/accessanalyzer/12.0/solutions/box/recommended.md b/docs/accessanalyzer/12.0/solutions/box/recommended.md
index 57021c0fe9..7818e065ef 100644
--- a/docs/accessanalyzer/12.0/solutions/box/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/box/recommended.md
@@ -6,11 +6,11 @@ sidebar_position: 10
# Recommended Configurations for the Box Solution
-The jobs that run analysis tasks in the Box Solution requires the host list to be assigned.
+The jobs that run analysis tasks in the Box Solution require you to assign a host list.
**Dependencies**
-- The .Active Directory Inventory Job Group must be successfully run prior to running this Job Group
+- The .Active Directory Inventory Job Group must be successfully run before running this Job Group
- 2-Box_Import Job – Imports data collected by the 1-Box_Access Scans Job and 1-Box_Activity Scans
Job
@@ -20,29 +20,29 @@ The jobs that run analysis tasks in the Box Solution requires the host list to b
Within host inventory, the Box hosts will return a HostStatus of **Offline**.
-If multiple Enterprise_IDs are to be scanned, it is necessary to duplicate the jobs within the
-0.Collection Job Group for each target host. Since the 2-Box_Import Job must always be run after the
-1-Box_Access Scans Job and 1-Box_Activity Scans Job, it is a best practice to set up sub-job groups
-for each target named to identify the target, for example EMEA Box. Copying the jobs will append a
-number to the job’s name. Once authorization codes have been generated for each 1-Box_Access Scans
-Job and 1-Box_Activity Scans Job, then the solution can be scheduled to run as desired.
+To scan multiple Enterprise_IDs, duplicate the jobs within the 0.Collection Job Group for each
+target host. Since the 2-Box_Import Job must always run after the 1-Box_Access Scans Job and
+1-Box_Activity Scans Job, set up sub-job groups for each target as a best practice, named to
+identify the target, for example, EMEA Box. Copying the jobs will append a number to the job's
+name. After you generate authorization codes for each 1-Box_Access Scans Job and 1-Box_Activity
+Scans Job, you can schedule the solution to run as desired.
**Connection Profile**
-The Box Solution requires a specific credential for the Connection Profile which has access to the
-SA Installer location. It is also necessary to authenticate to the target Box environment, which is
-done through the Box Data Collector query configuration. An Enterprise Admin account (or Co-Admin
-account with permission to **Run new reports and access existing reports** enabled) credential is
-needed to generate an authorization code in the form of an Access Token. This can be done through
-the query configuration either in the 1-Box_Access Scans Job’ Authentication wizard page or the
-1-Box_Activity Scans Job’s Authentication wizard page of the Box Data Collector Wizard. See the
+The Box Solution requires a specific credential for the Connection Profile that has access to the
+SA Installer location. You also need to authenticate to the target Box environment through the Box
+Data Collector query configuration. You need an Enterprise Admin account (or a Co-Admin account
+with the **Run new reports and access existing reports** permission enabled) to generate an
+authorization code in the form of an Access Token. Configure this through the query configuration
+in either the 1-Box_Access Scans Job's Authentication wizard page or the 1-Box_Activity Scans Job's
+Authentication wizard page of the Box Data Collector Wizard. See the
[Box Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/box/overview.md) topic for additional information.
**Access Token**
The Access Token is valid for 60 days. If Box scans are running on a regular schedule, then the
Access Token automatically refreshes once an hour. However, if it has been more than 60 days since
-the last scan, it is necessary to regenerate the Access Token.
+the last scan, regenerate the Access Token.
**Schedule Frequency**
@@ -56,7 +56,7 @@ This solution can be run with the default query configuration. However, the foll
- 1-Box_Access Scans Scan query
- 1-Box_Activity Scans Activity Scan query
-The Box_Import Job's Import query is preconfigured to run a full import and should not be modified.
+The Box_Import Job's Import query is preconfigured to run a full import and shouldn't be modified.
**Analysis Configuration**
@@ -77,15 +77,14 @@ can be modified:
depth.
**Step 3 –** In the 1-Box_Access Scans Job, configure the Scan query to generate an authentication
-code to authenticate to the targeted Box environment. This step only needs to be run prior to the
-first scan.
+code to authenticate to the targeted Box environment. Run this step only before the first scan.
**Step 4 –** (Optional) Modify analysis task parameters for the reporting jobs.
**Step 5 –** Schedule the Box Job Group to run as desired.
:::note
-The 0.Collection > 2-Box_Import Job must be run after the 1-Box_Access Scans Job and
+The 0.Collection > 2-Box_Import Job must run after the 1-Box_Access Scans Job and
1-Box_Activity Scans Job because it imports the data collected by the scan jobs.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/azuresql/collection-azuresql/1-azuresql_permissionscan.md b/docs/accessanalyzer/12.0/solutions/databases/azuresql/collection-azuresql/1-azuresql_permissionscan.md
index c95bcac63a..438a1353c4 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/azuresql/collection-azuresql/1-azuresql_permissionscan.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/azuresql/collection-azuresql/1-azuresql_permissionscan.md
@@ -41,10 +41,10 @@ job.
**Step 4 –** To query for specific databases/instances, navigate to the
[SQL Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/sql/overview.md) page. The default query target
is All databases. The default query scope is Only select database objects and click Retrieve. The
-Available database objects will be populated. Databases and instances can be added in the following
+wizard populates the available database objects. Add databases and instances in the following
ways:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Optionally, use the Add Custom Filter button to create and apply a custom filter.
diff --git a/docs/accessanalyzer/12.0/solutions/databases/azuresql/overview.md b/docs/accessanalyzer/12.0/solutions/databases/azuresql/overview.md
index 1ced28a936..504aa98eae 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/azuresql/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/azuresql/overview.md
@@ -28,9 +28,8 @@ thread requires a minimum of 2 additional GB of RAM per host. For example, a job
:::note
Access Analyzer installs the appropriate JDK (Java) version for Sensitive Data Discovery on the
-server. The JDK deployed is prepackaged and doesn't require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
-conflict with other JDKs or Java Runtimes in the same environment.
+server. This JDK comes prepackaged and preconfigured for Access Analyzer, so don't customize it
+through Java. It will not conflict with other JDKs or Java Runtimes in the same environment.
:::
**Location**
diff --git a/docs/accessanalyzer/12.0/solutions/databases/azuresql/recommended.md b/docs/accessanalyzer/12.0/solutions/databases/azuresql/recommended.md
index f3691ef491..d070f88c47 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/azuresql/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/azuresql/recommended.md
@@ -38,7 +38,7 @@ schedule it.
**Targeted Hosts**
-The 0.Collection Job Group has been set to run against the following default dynamic host list:
+By default, the 0.Collection Job Group runs against the following dynamic host list:
- All targeted Azure SQL Tenants
diff --git a/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_configuration.md b/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_configuration.md
index 367f1b7e8a..76ec1cb5fd 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_configuration.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_configuration.md
@@ -21,11 +21,11 @@ The query is:
## Recommended Configuration for the Configuration Query
-Prior to running an Db2 0.Collection query, you must establish a connection to the appropriate IBM
-Db2 server. As long as that connection is set up first, it is recommended that no configuration
-changes be made to the 0.Collection jobs before they run.
+Before running a Db2 0.Collection query, you must establish a connection to the appropriate IBM
+Db2 server. As long as you set up that connection first, don't make configuration
+changes to the 0.Collection jobs before they run.
-It is also recommended that the connection only be established for the 1-Db2 SensitiveDataScan Job.
-Once the connection is established, it applies to all jobs in the 0.Collection job group. It does
+Establish the connection only for the 1-Db2 SensitiveDataScan Job. After you establish the
+connection, it applies to all jobs in the 0.Collection job group. It does
not apply to any other job groups. For additional information on establishing a database connection,
see [1-Db2_SensitiveDataScan](/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_sensitivedatascan.md).
diff --git a/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_permissionscan.md b/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_permissionscan.md
index d8649d52b5..43cef3a667 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_permissionscan.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_permissionscan.md
@@ -13,7 +13,7 @@ This job collects Db2 database level permissions from all the targeted Db2 datab
The 2-Db2_PermissionScan Job uses the SQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -25,12 +25,12 @@ The query is:
## Recommended Configuration for the Db2 Permission Query
-Prior to running an Db2 0.Collection query, you must establish a connection to the appropriate IBM
-Db2 server. As long as that connection is set up first, it is recommended that no configuration
-changes be made to the 0.Collection jobs before they run.
+Before running a Db2 0.Collection query, you must establish a connection to the appropriate IBM
+Db2 server. As long as you set up that connection first, don't make configuration
+changes to the 0.Collection jobs before they run.
-It is also recommended that the connection only be established for the 1-Db2 SensitiveDataScan Job.
-Once the connection is established, it applies to all jobs in the 0.Collection job group. It does
+Establish the connection only for the 1-Db2 SensitiveDataScan Job. After you establish the
+connection, it applies to all jobs in the 0.Collection job group. It does
not apply to any other job groups. For additional information on establishing a database connection,
see [1-Db2_SensitiveDataScan](/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_sensitivedatascan.md).
@@ -40,7 +40,7 @@ Navigate to the **Databases** > **0.Collection** > **Db2** > **2-Db2_PermissionS
**Configure** node and select Analysis to view the Analysis Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_sensitivedatascan.md b/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_sensitivedatascan.md
index da106e0f67..7ba50d6a71 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_sensitivedatascan.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/db2/collection/db2_sensitivedatascan.md
@@ -21,14 +21,14 @@ The query is:
## Recommended Configuration for the SensitiveDataScan Query
-It is only necessary to set up the connection for the 1-Db2 SensitiveDataScan Job. Once the
+You only need to set up the connection for the 1-Db2 SensitiveDataScan Job. After the
connection is established, custom configurations apply to all other job queries within the
-0.Collection job group. Follow the steps to customize configurations.
+0.Collection job group. To customize configurations, complete the following steps.
**Step 1 –** Navigate to the Databases > 0.Collection > Db2 > 1-Db2_SensitiveDataScan > Configure
node and select Queries.
-**Step 2 –** In the Query Selection view, select the SensitiveDataScan query click on Query
+**Step 2 –** In the Query Selection view, select the SensitiveDataScan query click Query
Properties. The Query Properties window appears.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard opens
@@ -40,7 +40,7 @@ with Sensitive Data Collection category selected.
-**Step 5 –** To modify sensitive data scan options, select the desired scan options. See the
+**Step 5 –** To modify sensitive data scan options, select the scan options you want. See the
[SQL: Options](/docs/accessanalyzer/12.0/admin/datacollector/sql/options.md) page for additional information.
:::warning
@@ -54,7 +54,7 @@ may significantly increase scan time.
-**Step 7 –** To modify criteria, click on **Use the following selected criteria:** and select your
+**Step 7 –** To modify criteria, click **Use the following selected criteria:** and select your
choices. By default, the Sensitive Data Scan job is set to **Use Global Criteria**.
:::note
@@ -72,7 +72,7 @@ topic for additional information.
**Step 9 –** Click **Connections** to open the Manage Connections window.
:::note
-SQL databases must be added to the query before they can be scanned. Before you can add a
+You must add SQL databases to the query before you can scan them. Before you can add a
query, you must establish a connection to the database.
:::
@@ -82,15 +82,15 @@ query, you must establish a connection to the database.
**Step 10 –** In the Manage Connections window, enter the following information:
- Instance Label — Custom name of the instance
-- Database System — A drop down containing all available database servers. Select the Db2LUW server
+- Database System — A dropdown containing all available database servers. Select the Db2LUW server
to configure Db2 queries.
- Service Name — Custom name of the service
- Host — Name or IP address of the host where the database is located. Host list is IBM DB2
- Port Number — Port number for the selected database
- Default Database — Default Database
-**Step 11 –** After completing the above information fields, click **Test Connection** to validate
-the new connection. Once validated, click **Create New Connection** to finalize the connection.
+**Step 11 –** After completing the information fields, click **Test Connection** to validate
+the new connection. After it's validated, click **Create New Connection** to finalize the connection.
**Step 12 –** Navigate to the Filter page. Select Only select database objects or **All database
objects**. Collection queries are configured by default to target Only select database objects.
@@ -103,14 +103,14 @@ For more information on filtering, see the
**Step 13 –** Click Retrieve. The Available database objects box will populate.
-**Step 14 –** Add the Databases and instances to be audited. Databases and instances can be added in
+**Step 14 –** Add the Databases and instances to be audited. You can add databases and instances in
the following ways:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Optionally use the Add Custom Filter button to create and apply a custom filter.
-Selected database objects to be audited will display.
+The database objects you selected appear.
**Step 15 –** Click **Next** and navigate to the Summary page, click Finish to save any setting
modifications or click Cancel if no changes were made. Then click OK to close the Query Properties
@@ -124,7 +124,7 @@ Navigate to the **Databases** > **0.Collection** > **Db2** > **1-Db2_SensitiveDa
**Configure** node and select **Analysis** to view the Analysis Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/db2/db2_databasesizing.md b/docs/accessanalyzer/12.0/solutions/databases/db2/db2_databasesizing.md
index 307d516291..c2b6a129e1 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/db2/db2_databasesizing.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/db2/db2_databasesizing.md
@@ -18,7 +18,7 @@ Navigate to the **Jobs** > **Databases** > **Db2** > **Configuration** > **Db2_
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/db2/overview.md b/docs/accessanalyzer/12.0/solutions/databases/db2/overview.md
index 7217dda46f..6ed3de666c 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/db2/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/db2/overview.md
@@ -22,30 +22,29 @@ for additional information.
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, a job configured to scan 8 hosts
+at a time requires an extra 16 GB of RAM (8x2=16).
:::note
-The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
-conflict with other JDKs or Java Runtimes in the same environment.
+Access Analyzer installs the appropriate JDK (Java) version for Sensitive Data Discovery on the
+server. This JDK comes prepackaged and preconfigured for Access Analyzer, so don't customize it
+through Java. It will not conflict with other JDKs or Java Runtimes in the same environment.
:::
**Location**
-The Db2 Solution requires a special Access Analyzer license. It can be installed from the Access
-Analyzer Instant Job Wizard. Once it has been installed in the Jobs tree, navigate to the solution:
+The Db2 Solution requires a special Access Analyzer license. You can install it from the Access
+Analyzer Instant Job Wizard. After you install it in the Jobs tree, navigate to the solution:
Jobs > **Databases** > **Db2**.
-The 0.Collection Job Group collects the data. The Db2 Solution Set Collection group is designed to
-collect high level summary information from targeted Db2 Database Servers. This information is used
-by other jobs in the Db2 Solution for further analysis and producing respective reports.
+The 0.Collection Job Group collects the data. The Db2 Solution Set Collection group collects high
+level summary information from targeted Db2 Database Servers. Other jobs in the Db2 Solution use
+this information for further analysis and to produce respective reports.
-The Database Solution license includes all supported database platforms supported by Access
-Analyzer. Additionally, Sensitive Data Discovery enables the solution to search database content for
+The Database Solution license covers all database platforms that Access Analyzer supports.
+Additionally, Sensitive Data Discovery enables the solution to search database content for
sensitive data.
## Db2 Job Group Overview
@@ -59,8 +58,8 @@ Permissions.
The following comprises the Db2 solution:
- [0.Collection Job Group](/docs/accessanalyzer/12.0/solutions/databases/db2/collection/overview.md) — Collects high level summary information from
- targeted Db2 Servers. This information is used by other jobs in the Db2 Solution Set for further
- analysis and producing respective report.
+ targeted Db2 Servers. Other jobs in the Db2 Solution Set use this information for further
+ analysis and to produce respective reports.
- [Configuration > Db2_DatabaseSizing Job](/docs/accessanalyzer/12.0/solutions/databases/db2/db2_databasesizing.md) — Provides insight into Db2 server
configuration settings
diff --git a/docs/accessanalyzer/12.0/solutions/databases/db2/permissions/db2_directpermissions.md b/docs/accessanalyzer/12.0/solutions/databases/db2/permissions/db2_directpermissions.md
index b3f5d03e91..2ea7604b0c 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/db2/permissions/db2_directpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/db2/permissions/db2_directpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Databases** > **Db2** > **Permissions** > **Db2_Dir
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/db2/permissions/db2_effectivepermissions.md b/docs/accessanalyzer/12.0/solutions/databases/db2/permissions/db2_effectivepermissions.md
index cb9bb3abbf..5a620aa067 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/db2/permissions/db2_effectivepermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/db2/permissions/db2_effectivepermissions.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Databases** > **Db2** > **Permissions** >
Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/db2/recommended.md b/docs/accessanalyzer/12.0/solutions/databases/db2/recommended.md
index 9a55c8b076..297af6fada 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/db2/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/db2/recommended.md
@@ -6,10 +6,10 @@ sidebar_position: 10
# Recommended Configuration for the Db2 Solution
-The Db2 Solution has been configured to inherit down from the **Db2** > **Settings** node. However,
+The Db2 Solution inherits settings from the **Db2** > **Settings** node. However,
it is best practice to assign the host list and the Connection Profile at the data collection level,
-the 0.Collection Job Group. Once these are assigned to the job group, it can be run directly or
-scheduled.
+the 0.Collection Job Group. After you assign these to the job group, you can run it directly or
+schedule it.
**Dependencies**
@@ -25,7 +25,7 @@ scheduled.
- IBM .NET Driver NuGet
:::note
- All necessary clients and drivers can be found on IBM Support's
+ IBM Support provides all necessary clients and drivers on its
[Download initial version 11.5 clients and drivers](https://www.ibm.com/support/pages/download-initial-version-115-clients-and-drivers)
page.
:::
@@ -33,28 +33,29 @@ scheduled.
- .Instance Discovery Job Group run successfully
-**Targeted Host(s)**
+**Targeted Hosts**
-The Db2 Job Group has been configured to inherit the host list assignment from the collection group
+The Db2 Job Group inherits the host list assignment from the collection group
level.
-The host list assignment should be assigned under the **Databases** > **0.Collection** > **Db2** >
+Assign the host list under the **Databases** > **0.Collection** > **Db2** >
**Settings** > **Host List Assignment** node. The Local host box is checked by default.
**Connection Profile**
The SQL Data Collector requires a specific set of permissions. See the Permissions section for
necessary permissions. The account used can be either an Active Directory account or a SQL account.
-Once the account has been provisioned, create a custom Connection Profile containing the credentials
+After you provision the account, create a custom Connection Profile containing the credentials
for the targeted environment. See the
[SQL Custom Connection Profile & Default Dynamic Host List](/docs/accessanalyzer/12.0/admin/datacollector/sql/configurejob.md)
topic for additional information.
-The Connection Profile should be assigned under the Databases > 0.Collection > Db2 > Settings >
-Connection node. It is set to Use the Default Profile, as configured at the global settings level.
+Assign the Connection Profile under the Databases > 0.Collection > Db2 > Settings >
+Connection node. By default, the connection node uses the Default Profile configured at the global
+settings level.
However, since this may not be the Connection Profile with the necessary permissions for the
assigned hosts, click the radio button for the Select one of the following user defined profiles
-option and select the appropriate Connection Profile drop-down menu.
+option and select the appropriate Connection Profile dropdown menu.
See the [Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) topic for additional
information.
@@ -65,8 +66,8 @@ This job group can be scheduled to run as desired.
**Run Order**
-The 0.Collection Jobs must be run first and in order. The other Db2 sub-job groups can be run in any
-order, together or individually, after running the 0.Collection Job Group.
+Run the 0.Collection Jobs first and in order. You can run the other Db2 sub-job groups in any
+order, together, or individually, after running the 0.Collection Job Group.
:::info
Run the solution at the top level.
@@ -76,7 +77,7 @@ Run the solution at the top level.
**Workflow**
1. Install IBM Db2 Server Client and required clients and drivers
-2. Configure and assign host list and connection profile(s)
+2. Configure and assign host list and connection profiles
3. Define the connection information
4. Schedule the .Instance Discovery job group and 0.Collection job group to run as desired
5. Review the reports generated by the 0.Collection job group
diff --git a/docs/accessanalyzer/12.0/solutions/databases/db2/sensitivedata/db2_sensitivedata.md b/docs/accessanalyzer/12.0/solutions/databases/db2/sensitivedata/db2_sensitivedata.md
index 5468dffa69..e943540a26 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/db2/sensitivedata/db2_sensitivedata.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/db2/sensitivedata/db2_sensitivedata.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Databases** > **Db2** > **Sensitive Data** > **Db2_
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/db2/sensitivedata/db2_sensitivedatapermissions.md b/docs/accessanalyzer/12.0/solutions/databases/db2/sensitivedata/db2_sensitivedatapermissions.md
index add81a9fe4..e65030af0b 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/db2/sensitivedata/db2_sensitivedatapermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/db2/sensitivedata/db2_sensitivedatapermissions.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Databases** > **Db2** > **Sensitive Data** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mongodb/collection/mongodb_configuration.md b/docs/accessanalyzer/12.0/solutions/databases/mongodb/collection/mongodb_configuration.md
index 8bec09b0a5..31ddf1803b 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mongodb/collection/mongodb_configuration.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mongodb/collection/mongodb_configuration.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# MongoDB_Configuration Job
-The MongoDB_Configuration job is designed to collect MongoDB server instance and database
+The MongoDB_Configuration job collects MongoDB server instance and database
configuration settings for use in the following analysis jobs and respective reports.
## Queries for the MongoDB_Configuration Job
@@ -14,7 +14,7 @@ configuration settings for use in the following analysis jobs and respective rep
The MongoDB_Configuration Job uses the NoSQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mongodb/collection/mongodb_sensitivedatascan.md b/docs/accessanalyzer/12.0/solutions/databases/mongodb/collection/mongodb_sensitivedatascan.md
index e9b8d5a666..1119da4e34 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mongodb/collection/mongodb_sensitivedatascan.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mongodb/collection/mongodb_sensitivedatascan.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# MongoDB_SensitiveDataScan Job
-The MongoDB_SensitiveDataScan Job is designed to discover sensitive data in MongoDB databases based
+The MongoDB_SensitiveDataScan Job discovers sensitive data in MongoDB databases based
on pre-defined or user-defined search criteria.
## Queries for the MongoDB_SensitiveDataScan Job
@@ -26,7 +26,7 @@ The query is:
## Configure the MongoDB SDD Query
The MongoDB SDD Query is preconfigured to run using the default settings for the Sensitive Data
-Collection category. Follow the steps to customize configurations.
+Collection category. To customize configurations, complete the following steps.
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **MongoDB** >
**MongoDB_SensitiveDataScan** > **Configure** node and select Queries.
@@ -37,7 +37,7 @@ The Query Properties window opens.
**Step 3 –** Select the Data Source tab, and click Configure. The NoSQL Data Collector Wizard opens.
:::warning
-Do not make changes to wizard pages not listed in these steps. They have been
+Don't make changes to wizard pages not listed in these steps. They have been
pre-configured for this job.
:::
@@ -47,7 +47,7 @@ page.
-**Step 5 –** Select the desired scan options.
+**Step 5 –** Select the scan options you want.
**Step 6 –** Navigate to the [NoSQL: Criteria](/docs/accessanalyzer/12.0/admin/datacollector/nosql/criteria.md)
page.
@@ -56,7 +56,7 @@ page.
**Step 7 –** To modify criteria, navigate to the
[NoSQL: Criteria](/docs/accessanalyzer/12.0/admin/datacollector/nosql/criteria.md) page. By default, the Sensitive
-Data Scan job is configured to scan for criteria configured in the Global Criteria settings. See the
+Data Scan job scans for criteria in the Global Criteria settings. See the
[Sensitive Data Criteria Editor](/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/overview.md)
topic for additional information.
@@ -71,7 +71,7 @@ may significantly increase scan time.
-**Step 9 –** MongoDB databases must be added to the query before they can be scanned. Click
+**Step 9 –** You must add MongoDB databases to the query before you can scan them. Click
**Connections** to open the Manage Connections window.
@@ -99,7 +99,7 @@ Connections window.
**Step 13 –** On the Filter page, click Retrieveto populate the Servers pane with the databases and
collections.
-**Step 14 –** (Optional) Right click on an object in the list to include or exclude it from the
+**Step 14 –** (Optional) Right click an object in the list to include or exclude it from the
sensitive data scan, or build /edit a pattern to create a custom filter. See the
[NoSQL: Filter](/docs/accessanalyzer/12.0/admin/datacollector/nosql/filter.md) topic for additional information.
@@ -117,7 +117,7 @@ Navigate to the Databases > > 0.Collection > MongoDB > MongoDB_SensitiveDataScan
and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mongodb/collection/overview.md b/docs/accessanalyzer/12.0/solutions/databases/mongodb/collection/overview.md
index c8c3ce09da..ba33778906 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mongodb/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mongodb/collection/overview.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# 0.Collection Job Group
-The MongoDB Solution Collection group is designed to collect high level summary information from
-targeted MongoDB Servers. This information is used by other jobs in the MongoDB Solution Set for
-further analysis and producing respective reports.
+The MongoDB Solution Collection group collects high level summary information from
+targeted MongoDB Servers. Other jobs in the MongoDB Solution Set use this information for
+further analysis and to produce respective reports.
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mongodb/mongodb_database_sizing.md b/docs/accessanalyzer/12.0/solutions/databases/mongodb/mongodb_database_sizing.md
index 8f2bab2745..be375c45cd 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mongodb/mongodb_database_sizing.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mongodb/mongodb_database_sizing.md
@@ -10,7 +10,7 @@ Navigate to the **Jobs > Databases > MongoDB > Configuration > MongoDB_Databa
node and select Analysis to view the Analysis Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mongodb/mongodb_sensitivedata.md b/docs/accessanalyzer/12.0/solutions/databases/mongodb/mongodb_sensitivedata.md
index 5edfd6721a..3e128eed57 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mongodb/mongodb_sensitivedata.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mongodb/mongodb_sensitivedata.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Sensitive Data > MongoDB_SensitiveData Job
-The Sensitive Data Job Group is designed to provide insight into where sensitive data exists and who
+The Sensitive Data Job Group provides insight into where sensitive data exists and who
has access to it across all the targeted MongoDB databases.
@@ -22,7 +22,7 @@ Navigate to the MongoDB > **Databases** > **Sensitive Data**> MongoDB_SensitiveD
and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mongodb/overview.md b/docs/accessanalyzer/12.0/solutions/databases/mongodb/overview.md
index adba9623df..1c3e20e0da 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mongodb/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mongodb/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# MongoDB Solution
Data privacy and security is quickly evolving to be on equal footing with traditional security
-measures focused on the network, hardware, or software the data is contained within. Organizations
+measures focused on the network, hardware, or software that contains the data. Organizations
aligning to concepts like Data-Centric Audit and Protection (DCAP) as defined by Gartner, or the
requirements of strict compliance regulations like EU GDPR, are looking to implement processes that
help them understand where sensitive data is stored, who or what is leveraging their privileges to
@@ -15,15 +15,15 @@ access the data, and how each database has been configured.
As part of Stealthbits comprehensive Data Access Governance suite for structured and unstructured
data, Access Analyzer for MongoDB automates the process of understanding where MongoDB databases
-exist and provides an overview of the MongoDB environment in order to answer questions around data
+exist and provides an overview of the MongoDB environment to answer questions around data
access:
- Who has access to your data?
- Where is sensitive data being stored?
-With visibility into every corner of MongoDB, organizations can proactively highlight and prioritize
+With visibility into all areas of MongoDB, organizations can proactively highlight and prioritize
risks to sensitive data. Additionally, organizations can automate manual, time-consuming, and
-expensive processes associated with compliance, security, and operations to easily adhere to best
+expensive processes associated with compliance, security, and operations to adhere to best
practices that keep MongoDB Server safe and operational.
**Supported Platforms**
@@ -41,33 +41,33 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount
+of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, a job
+configured to scan 8 hosts at a time requires an extra 16 GB of RAM (8x2=16).
-By default, the job is configured to use 10 threads, which can be adjusted based on available
+By default, the job uses 10 threads. You can adjust this based on available
resources on the Access Analyzer server.
:::note
-The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
+Access Analyzer installs the appropriate JDK (Java) version for Sensitive Data Discovery on the
+server. This JDK comes prepackaged and preconfigured for Access Analyzer, so don't customize it
+through Java. It will not
conflict with other JDKs or Java Runtimes in the same environment.
:::
**Location**
-The Structured Sensitive Data Discovery License is required to run the MongoDB Solution. The MongoDB
-Solution can be installed from the Access Analyzer Instant Job Wizard. Once it has been installed
-into the Jobs tree, navigate to the solution: Jobs > **Databases** > MongoDB.
+The Structured Sensitive Data Discovery License is required to run the MongoDB Solution. You can
+install it from the Access Analyzer Instant Job Wizard. After you install it
+in the Jobs tree, navigate to the solution: Jobs > **Databases** > MongoDB.
The 0.Collection Job Group scans MongoDB instances on the target hosts, and collects
configuration and sensitive data. The other job groups analyze the collected data and generate
reports.
-The Database Solution license includes all supported database platforms supported by Access
-Analyzer. Additionally, Sensitive Data Discovery enables the solution to search database content for
+The Database Solution license covers all database platforms that Access Analyzer supports.
+Additionally, Sensitive Data Discovery enables the solution to search database content for
sensitive data.
## Job Groups
@@ -80,8 +80,8 @@ visibility into MongoDB Sensitive Data.
The following job groups comprise the MongoDB Solution:
- [ 0.Collection Job Group](/docs/accessanalyzer/12.0/solutions/databases/mongodb/collection/overview.md) — Collects high level summary information from
- targeted MongoDB Servers. This information is used by other jobs in the MongoDB Solution Set for
- further analysis and producing respective reports.
+ targeted MongoDB Servers. Other jobs in the MongoDB Solution Set use this information for
+ further analysis and to produce respective reports.
- [Analysis Tasks for the MongoDB_Database_Sizing Job](/docs/accessanalyzer/12.0/solutions/databases/mongodb/mongodb_database_sizing.md) — Provides insight
into MongoDB server configuration settings
- [Sensitive Data > MongoDB_SensitiveData Job](/docs/accessanalyzer/12.0/solutions/databases/mongodb/mongodb_sensitivedata.md) — Provides insight into
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mongodb/recommended.md b/docs/accessanalyzer/12.0/solutions/databases/mongodb/recommended.md
index 5133bdb0ce..dc827cea1e 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mongodb/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mongodb/recommended.md
@@ -6,37 +6,38 @@ sidebar_position: 10
# Recommended Configuration for the MongoDB Solution
-The MongoDB Solution has been configured to inherit down from the MongoDB > Settings node. However,
+The MongoDB Solution inherits settings from the MongoDB > Settings node. However,
it is best practice to assign the host list and the Connection Profile at the data collection level,
-the 0.Collection Job Group. Once these are assigned to the job group, it can be run directly or
-scheduled.
+the 0.Collection Job Group. After you assign these to the job group, you can run it directly or
+schedule it.
**Dependencies**
-- Query must be configured with list of target database clusters / instances
+- The query must be configured with a list of target database clusters or instances
Some of the 0.Collection Job Group queries can be scoped to target specific databases/instances.
-However, it is necessary to add the databases to the query first.
+However, add the databases to the query first.
-**Targeted Host(s)**
+**Targeted Hosts**
-The 0.Collection Job Group must be set to run against a custom host list containing the MongoDB
+You must set the 0.Collection Job Group to run against a custom host list containing the MongoDB
database instances / clusters.
**Connection Profile**
The NoSQL Data Collector requires a specific set of permission. See the Permissions section for
necessary permissions. The account used can be either an Active Directory account or a SQL account.
-Once the account has been provisioned, create a custom Connection Profile containing the credentials
+After you provision the account, create a custom Connection Profile containing the credentials
for the targeted environment. See the
[NoSQL Custom Connection Profile & Host List](/docs/accessanalyzer/12.0/admin/datacollector/nosql/configurejob.md)
topic for additional information.
-The Connection Profile should be assigned under the MongoDB > 0.Collection > Settings > Connection
-node. It is set to Use the Default Profile, as configured at the global settings level. However,
+Assign the Connection Profile under the MongoDB > 0.Collection > Settings > Connection
+node. By default, the connection node uses the Default Profile configured at the global settings
+level. However,
since this may not be the Connection Profile with the necessary permissions for the assigned hosts,
click the radio button for the Select one of the following user defined profiles option and select
-the appropriate Connection Profile drop-down menu.
+the appropriate Connection Profile dropdown menu.
See the [Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) topic for additional
information.
@@ -50,8 +51,8 @@ daily.
**Run Order**
-The 0.Collection Jobs must be run first and in order. The other MongoDB Solution sub-job groups can
-be run in any order, together or individually, after running the 0.Collection Job Group.
+Run the 0.Collection Jobs first and in order. You can run the other MongoDB Solution sub-job groups
+in any order, together, or individually, after running the 0.Collection Job Group.
:::info
Run the solution at the top level.
@@ -65,7 +66,7 @@ Run the solution at the top level.
[NoSQL Custom Connection Profile & Host List](/docs/accessanalyzer/12.0/admin/datacollector/nosql/configurejob.md)
topic for additional information.
2. Set the Host list for the 0.Collection Job Group with the servers containing the target
- databases. Additionally, the database clusters / instances must be added to the Filter page in
+ databases. Additionally, add the database clusters or instances to the Filter page in
the query configuration. See the
[NoSQL Custom Connection Profile & Host List](/docs/accessanalyzer/12.0/admin/datacollector/nosql/configurejob.md)
topic for additional information.
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_configuration.md b/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_configuration.md
index e2fb9c50c2..7d5ee5748b 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_configuration.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_configuration.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# MySQL_Configuration Job
-The MySQL_Configuration Job is designed to collect MySQL server instance and database configuration
+The MySQL_Configuration Job collects MySQL server instance and database configuration
settings for use in the following analysis jobs and respective reports.
## Queries for the MySQL_Configuration Job
@@ -14,7 +14,7 @@ settings for use in the following analysis jobs and respective reports.
The MySQL_Configuration Job uses the SQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_sensitivedatascan.md b/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_sensitivedatascan.md
index 347c36f38e..91a5778306 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_sensitivedatascan.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_sensitivedatascan.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# MySQL_SensitiveDataScan Job
-The MySQL_SensitiveDataScan Job is designed to discover sensitive data in MySQL databases based on
+The MySQL_SensitiveDataScan Job discovers sensitive data in MySQL databases based on
pre-defined or user-defined search criteria.
## Queries for the MySQL_SensitiveDataScan Job
@@ -24,25 +24,25 @@ The query is:
### Configure the SensitiveDataScan Query
The MySQL_SensitiveDataScan Job is preconfigured to run using the default settings for the Sensitive
-Data Collection category. Follow the steps to customize configurations.
+Data Collection category. To customize configurations, complete the following steps.
**Step 1 –** Navigate to the Databases > 0.Collection > MySQL > MySQL_SensitiveDataScan > Configure
node and select Queries.
-**Step 2 –** In the Query Selection view, select the Sensitive Data Scan query click on Query
+**Step 2 –** In the Query Selection view, select the Sensitive Data Scan query click Query
Properties. The Query Properties window appears.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for this
+Don't make changes to other wizard pages as they have been pre-configured for this
job.
:::
-**Step 4 –** To modify sensitive data scan options, select the desired scan options. See the
+**Step 4 –** To modify sensitive data scan options, select the scan options you want. See the
[SQL: Options](/docs/accessanalyzer/12.0/admin/datacollector/sql/options.md) page for additional information.
:::note
@@ -56,13 +56,13 @@ may significantly increase scan time.
**Step 5 –** To modify criteria, navigate to the
[SQL: Criteria](/docs/accessanalyzer/12.0/admin/datacollector/sql/criteria.md) page. By default, the Sensitive
-Data Scan job is configured to scan for criteria configured in the Global Criteria settings. See the
+Data Scan job scans for criteria in the Global Criteria settings. See the
[Sensitive Data Criteria Editor](/docs/accessanalyzer/12.0/sensitivedatadiscovery/criteriaeditor/overview.md)
topic for additional information.
-**Step 6 –** MySQL databases must be added to the query before they can be scanned. Navigate to the
+**Step 6 –** You must add MySQL databases to the query before you can scan them. Navigate to the
**Filter** page and click **Connections** to open the Manage Connections window.
@@ -77,12 +77,12 @@ information:
Exit the Manage Connections window to return to the Filter page.
-**Step 8 –** On the Filter page, the query is configured by default to target Only select database
+**Step 8 –** By default, the query targets Only select database
objects. Click Retrieve. The Available database objects box will populate. The default filter will
-scan all MySQL Databases returned, excluding the listed system schemas and tables in red. Databases
-and instances can be added in the following ways:
+scan all MySQL Databases returned, excluding the listed system schemas and tables in red. You can
+add databases and instances in the following ways:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Use the Add Custom Filter button to create and apply a custom filter.
@@ -97,7 +97,7 @@ Navigate to the **Databases** > **0.Collection** > **MySQL** > **MySQL_Sensitive
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_tableprivileges.md b/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_tableprivileges.md
index b49f4032f4..ce05b3f52e 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_tableprivileges.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_tableprivileges.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# MySQL_TablePrivileges Job
-The MySQL_TablePrivileges job is designed to collect MySQL table privileges from all the targeted
+The MySQL_TablePrivileges job collects MySQL table privileges from all the targeted
servers.
## Queries for the MySQL_TablePrivileges Job
@@ -14,7 +14,7 @@ servers.
The MySQL_TablePrivileges Job uses the SQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -30,7 +30,7 @@ Navigate to the **Databases** > **0.Collection** > **MySQL** > **MySQL_TablePriv
**Configure** node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/overview.md b/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/overview.md
index 52a23c193f..571dac6f11 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/overview.md
@@ -6,19 +6,19 @@ sidebar_position: 20
# 0.Collection Job Group
-The MySQL Solution Collection group is designed to collect high level summary information from
-targeted MySQL Servers. This information is used by other jobs in the MySQL Solution Set for further
-analysis and producing respective reports.
+The MySQL Solution Collection group collects high level summary information from
+targeted MySQL Servers. Other jobs in the MySQL Solution Set use this information for further
+analysis and to produce respective reports.
The jobs in the 0.Collection Job Group are:
-- [MySQL_Configuration Job](/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_configuration.md) – Designed to collect MySQL server instance and
+- [MySQL_Configuration Job](/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_configuration.md) – Collects MySQL server instance and
database configuration settings for use in the following analysis jobs and respective reports
-- [MySQL_SensitiveDataScan Job](/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_sensitivedatascan.md) – Designed to discover sensitive data in
+- [MySQL_SensitiveDataScan Job](/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_sensitivedatascan.md) – Discovers sensitive data in
MySQL databases based on pre-defined or user-defined search criteria
-- [MySQL_TablePrivileges Job](/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_tableprivileges.md) – Designed to collect MySQL table privileges
+- [MySQL_TablePrivileges Job](/docs/accessanalyzer/12.0/solutions/databases/mysql/collection/mysql_tableprivileges.md) – Collects MySQL table privileges
from all the targeted servers.
**Workflow**
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mysql/mysql_databasesizing.md b/docs/accessanalyzer/12.0/solutions/databases/mysql/mysql_databasesizing.md
index f42fe03855..84a1491f76 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mysql/mysql_databasesizing.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mysql/mysql_databasesizing.md
@@ -20,7 +20,7 @@ Navigate to the **Jobs > Databases > MySQL > Configuration > MySQL_DatabaseSi
and select Analysis to view the Analysis Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mysql/overview.md b/docs/accessanalyzer/12.0/solutions/databases/mysql/overview.md
index b5f110c45c..941b2b64cb 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mysql/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mysql/overview.md
@@ -15,18 +15,18 @@ access the data, and how each database has been configured.
As part of Stealthbits comprehensive Data Access Governance suite for structured and unstructured
data, Access Analyzer for MySQL automates the process of understanding where MySQL databases exist
-and provides an overview of the MySQL environment in order to answer questions around data access:
+and provides an overview of the MySQL environment to answer questions around data access:
- Who has access to your data?
- Where is sensitive data being stored?
With visibility into every corner of MySQL, organizations can proactively highlight and prioritize
risks to sensitive data. Additionally, organizations can automate manual, time-consuming, and
-expensive processes associated with compliance, security, and operations to easily adhere to best
+expensive processes associated with compliance, security, and operations to adhere to best
practices that keep MySQL Server safe and operational.
The MySQL Solution requires a special Access Analyzer license. The Database Solution license
-includes all supported database platforms supported by Access Analyzer. Additionally, Sensitive Data
+includes all database platforms supported by Access Analyzer. Additionally, Sensitive Data
Discovery enables the solution to search database content for sensitive data.
By default, the job is configured to use 10 threads, which can be adjusted based on available
@@ -48,29 +48,29 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
+If running Sensitive Data Discovery (SDD) scans, increase the minimum amount
of RAM. Each thread requires a minimum of 2 additional GB of RAM per host.For example, if the job is
configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
:::note
The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
+server. The JDK deployed is prepackaged and preconfigured to work with Access Analyzer, requires no
+additional configuration, and should never be customized through Java. It doesn't
conflict with other JDKs or Java Runtimes in the same environment.
:::
**Location**
-The Structured Sensitive Data Discovery License is required to run the MySQL Solution. It can be
-installed from the Access Analyzer Instant Job Wizard. Once it has been installed into the Jobs
+The Structured Sensitive Data Discovery License is required to run the MySQL Solution. Install it
+from the Access Analyzer Instant Job Wizard. After you install it into the Jobs
tree, navigate to the solution: Jobs > **Databases** > MySQL.
The 0.Collection Job Group discovers configuration settings and Sensitive Data in MySQL Instances on
the target hosts. The other job groups analyze and report on the data collected by the 0.Collection
Job Group.
-The Database Solution license includes all supported database platforms supported by Access
+The Database Solution license includes all database platforms supported by Access
Analyzer. Additionally, Sensitive Data Discovery enables the solution to search database content for
sensitive data.
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mysql/recommended.md b/docs/accessanalyzer/12.0/solutions/databases/mysql/recommended.md
index aec5405ad2..4db41b64c0 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mysql/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mysql/recommended.md
@@ -8,16 +8,16 @@ sidebar_position: 10
The MySQL Solution has been configured to inherit down from the MySQL > Settings node. However, it
is best practice to assign the host list and the Connection Profile at the data collection level,
-0.Collection Job Group. Once these are assigned to the job group, it can be run directly or
-scheduled.
+0.Collection Job Group. After you assign these to the job group, you can run it directly or
+schedule it.
**Dependencies**
- For AWS RDS and Aurora instances, right-click a job in the **MySQL** > **0.Collection** folder and
open the properties window. Select the **Performance** tab and ensure that the **Skip Hosts that
- do not respond to PING**checkbox is not selected.
+ don't respond to PING**checkbox isn't selected.
-**Targeted Host(s)**
+**Targeted Hosts**
- The 0.Collection Job Group must be set to run against a custom host list containing the
MySQL database instances / clusters.
@@ -32,9 +32,9 @@ credentials configured in the Connection Profile must be able to access the MySQ
permissions and creating a SQL custom connection profile.
The Connection Profile is set to Use the Default Profile, as configured at the global settings
-level. However, since this may not be the Connection Profile with the necessary permissions for the
-assigned hosts, click the radio button for the Select one of the following user defined profiles
-option and select the appropriate Connection Profile drop-down menu.
+level. However, if this isn't the Connection Profile with the necessary permissions for the
+assigned hosts, select the **Select one of the following user defined profiles** option and choose
+the appropriate profile from the Connection Profile dropdown menu.
**Schedule Frequency**
@@ -42,7 +42,7 @@ Daily
**Run Order**
-The 0.Collection Job Group must be run first before running the other jobs and job groups.
+Run the 0.Collection Job Group before running the other jobs and job groups.
:::info
Run the solution at the top level: MySQL Job Group
@@ -59,12 +59,12 @@ topic for additional information.
**Analysis Configuration**
This solution should be run with the default analysis configurations. These analysis tasks are
-preconfigured and should not be modified or deselected.
+preconfigured and shouldn't be modified or deselected.
Disabling obsolete or run-desired jobs allows the solution to run more efficiently. To disable a job
-or job group, right-click on the item and select Disable Job.
+or job group, right-click the item and select Disable Job.
:::info
-Do not delete any jobs. Instead, jobs should be disabled.
+Don't delete any jobs. Instead, disable them.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mysql/sensitivedata/mysql_sensitivedata.md b/docs/accessanalyzer/12.0/solutions/databases/mysql/sensitivedata/mysql_sensitivedata.md
index 9f59902c25..101dc6e958 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mysql/sensitivedata/mysql_sensitivedata.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mysql/sensitivedata/mysql_sensitivedata.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs > MySQL > Sensitive Data > MySQL_SensitiveData > Conf
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/mysql/sensitivedata/mysql_sensitivedatapermissions.md b/docs/accessanalyzer/12.0/solutions/databases/mysql/sensitivedata/mysql_sensitivedatapermissions.md
index 0c266a7e4a..d865bf1342 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/mysql/sensitivedata/mysql_sensitivedatapermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/mysql/sensitivedata/mysql_sensitivedatapermissions.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs > MySQL > Sensitive Data > MySQL_SensitiveDataPermissi
and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_activity.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_activity.md
index 1163363d53..a73b53bd7e 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_activity.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_activity.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_Activity** > **Configure*
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_logons.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_logons.md
index 226457cc86..d9d470f729 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_logons.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_logons.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_Logons** > **Configure**
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_permissionchanges.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_permissionchanges.md
index ee20bc5f4c..85f953fc8c 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_permissionchanges.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_permissionchanges.md
@@ -16,7 +16,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_PermissionChanges** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_schemachanges.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_schemachanges.md
index 31139d1687..703225e852 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_schemachanges.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_schemachanges.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_SchemaChanges** > **Confi
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_sensitivedataactivity.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_sensitivedataactivity.md
index b330434183..7c03a8dcf1 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_sensitivedataactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_sensitivedataactivity.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_SensitiveDataActivity** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_suspiciousactivity.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_suspiciousactivity.md
index db5a4e0c4e..ae9a677be3 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_suspiciousactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_suspiciousactivity.md
@@ -7,7 +7,7 @@ sidebar_position: 60
# Oracle_SuspiciousActivity Job
The Oracle_SuspiciousActivity job is designed to provide insight into suspicious behavior based on
-user activity that does not conform to normal database activity.
+user activity that doesn't conform to normal database activity.
## Analysis Tasks for the Oracle_SuspiciousActivity Job
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_SuspiciousActivity** > **
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_unusualactivity.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_unusualactivity.md
index 6f65dc4c86..912771eb4e 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_unusualactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_unusualactivity.md
@@ -16,7 +16,7 @@ Navigate to the **Oracle** > **2.Activity** > **Oracle_UnusualActivity** > **Con
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/overview.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/overview.md
index dfc10f172f..433caeb473 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/overview.md
@@ -29,7 +29,7 @@ The jobs in the 2.Activity Job Group are:
provide detailed information about all the DML (UPDATE, INSERT, DELETE, TRUNCATE) against objects
containing sensitive data
- [Oracle_SuspiciousActivity Job](/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_suspiciousactivity.md) – This job is designed to provide
- insight into suspicious behavior based on user activity that does not conform to normal database
+ insight into suspicious behavior based on user activity that doesn't conform to normal database
activity
- [Oracle_UnusualActivity Job](/docs/accessanalyzer/12.0/solutions/databases/oracle/activity/oracle_unusualactivity.md) – This job is designed to analyze user
activity based on the audited actions and identify any outliers based on a modified z-score.
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/0-oracle_servers.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/0-oracle_servers.md
index 184a41f7b5..5e9a3c882c 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/0-oracle_servers.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/0-oracle_servers.md
@@ -14,7 +14,7 @@ running on the targeted servers.
The Server Discovery query uses the PowerShell Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -22,9 +22,9 @@ Do not modify the query. The query is preconfigured for this job.
- Oracle Servers – Returns a list of Oracle servers from the specified host list
-Regarding Oracle instance discovery, there may be errors running the query that are not reported. An
+Regarding Oracle instance discovery, there may be errors running the query that aren't reported. An
additional log to store the issues has been added for instance discoveries named
-`Oracle_Server_log_[target_hostname]`. This file can be found in
+`Oracle_Server_log_[target_hostname]`. This file is in
`%sainstalldir%\Jobs\GROUP_ORACLE_0.Collection\GROUP_1.Discovery\JOB_Oracle_Servers\OUTPUT`. See the
[PowerShell Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/powershell/overview.md) topic for
additional information.
@@ -35,7 +35,7 @@ Navigate to the **Databases** > **0.Collection** > **Oracle** > **0-Oracle_Serve
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/1-oracle_permissionsscan.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/1-oracle_permissionsscan.md
index ca5e015983..48c1670a87 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/1-oracle_permissionsscan.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/1-oracle_permissionsscan.md
@@ -20,19 +20,19 @@ The PermissionsScan query uses the SQL Data Collector for the following query:
### Configure the 1-Oracle_PermissionsScan Query
The 1-Oracle_PermissionsScan Job is preconfigured to run using the default settings for the
-Permissions Collection category in the SQL Data Collector. Follow the steps to customize
-configurations:
+Permissions Collection category in the SQL Data Collector. To customize
+configurations, complete the following steps:
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **Oracle** >
**1-Oracle_PermissionsScan** > **Configure** node and select Queries.
-**Step 2 –** In the Query Selection view, select the PermissionScan query and click on Query
+**Step 2 –** In the Query Selection view, select the PermissionScan query and click Query
Properties. The Query Properties window opens.
**Step 3 –** Select the Data Source tab and click Configure. The SQL Data Collector wizard opens.
:::warning
-Do not make changes to wizard pages not listed in these steps. They have been
+Don't make changes to wizard pages not listed in these steps. They have been
pre-configured for this job.
:::
@@ -44,7 +44,7 @@ query target is All Databases. The default query scope is Only select database o
Retrieve. The Available database objects section will be populated. Databases and instances can be
added in the following ways:
-- Select the desired database objects and click Add
+- Select the database objects you want and click Add
- Use the Import CSV button to import a list from a CSV file, if desired
- Optionally, use the Add Custom Filter button to create and apply a custom filter
@@ -59,7 +59,7 @@ Navigate to the **Databases** > **0.Collection** > **Oracle** > **1-Oracle_Permi
**Configure** node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/2-oracle_sensitivedatascan.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/2-oracle_sensitivedatascan.md
index 93405988c7..dd3f05e1ee 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/2-oracle_sensitivedatascan.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/2-oracle_sensitivedatascan.md
@@ -22,8 +22,8 @@ The SensitiveDataScan Query uses the SQL Data Collector for the following query:
### Configure the 2-Oracle_SensitiveDataScan Query
The 2-Oracle_SensitiveDataScan job is preconfigured to run using the default settings for the
-Sensitive Data Collection category in the SQL Data Collector. Follow the steps to customize
-configurations:
+Sensitive Data Collection category in the SQL Data Collector. To customize
+configurations, complete the following steps:
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **Oracle** >
**2-Oracle_SensitiveDataScan** > **Configure** node and select **Queries**.
@@ -35,7 +35,7 @@ Properties**. The Query Properties window opens.
opens.
:::warning
-Do not make changes to wizard pages not listed in these steps. They have been
+Don't make changes to wizard pages not listed in these steps. They have been
pre-configured for this job.
:::
@@ -57,7 +57,7 @@ query target is **All Databases**. The default query scope is **Only select data
Click **Retrieve**. The Available database objects section will be populated. Databases and
instances can be added in the following ways:
-- Select the desired database objects and click **Add**
+- Select the database objects you want and click **Add**
- Use the **Import CSV** button to import a list from a CSV file, if desired
- Optionally, use the **Add Custom Filter** button to create and apply a custom filter
@@ -72,7 +72,7 @@ Navigate to the **Databases** > **0.Collection** > **Oracle** > **2-Oracle_Sensi
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/3-oracle_activityscan.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/3-oracle_activityscan.md
index 2d38213b56..2e233240bd 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/3-oracle_activityscan.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/3-oracle_activityscan.md
@@ -27,19 +27,19 @@ The ActivityScan Query uses the SQL Data Collector for the following query:
### Configure the 3-Oracle_ActivityScan Query
The 3-Oracle_ActivityScan Job is preconfigured to run using the default settings for the Server
-Audit Events Collection category in the SQL Data Collector. Follow the steps to customize
-configurations:
+Audit Events Collection category in the SQL Data Collector. To customize
+configurations, complete the following steps:
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **Oracle** >
**3-Oracle_ActivityScan** > **Configure** node and select Queries.
-**Step 2 –** In the Query Selection view, select the ActivityScan query and click on Query
+**Step 2 –** In the Query Selection view, select the ActivityScan query and click Query
Properties. The Query Properties window opens.
**Step 3 –** Select the Data Source tab and click Configure. The SQL Data Collector wizard opens.
:::warning
-Do not make changes to wizard pages not listed in these steps. They have been
+Don't make changes to wizard pages not listed in these steps. They have been
pre-configured for this job.
:::
@@ -56,7 +56,7 @@ query target is All Databases. The default query scope is Only select database o
Retrieve. The Available database objects section will be populated. Databases and instances can be
added in the following ways:
-- Select the desired database objects and click Add
+- Select the database objects you want and click Add
- Use the Import CSV button to import a list from a CSV file, if desired
- Optionally, use the Add Custom Filter button to create and apply a custom filter
@@ -71,7 +71,7 @@ Navigate to the **Databases** > **0.Collection** > **Oracle** > **3-Oracle_Activ
**Configure** node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/4-oracle_defaultpasswordusers.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/4-oracle_defaultpasswordusers.md
index 5edc63e7ac..322b1b6eb9 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/4-oracle_defaultpasswordusers.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/4-oracle_defaultpasswordusers.md
@@ -21,19 +21,19 @@ The 4-Oracle_DefaultPasswordUsers Job uses the SQL Data Collector for the follow
### Configure the 4-Oracle_DefaultPasswordUsers Query
The 4-Oracle_DefaultPasswordUsers Job is preconfigured to run using the default settings for the
-Permissions Collection category in the SQL Data Collector. Follow the steps to customize
-configurations:
+Permissions Collection category in the SQL Data Collector. To customize
+configurations, complete the following steps:
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **Oracle** >
**4-Oracle_DefaultPasswordUsers** > **Configure** node and select Queries.
-**Step 2 –** In the Query Selection view, select the Users with Default Passwords query and click on
+**Step 2 –** In the Query Selection view, select the Users with Default Passwords query and click
Query Properties. The Query Properties window opens.
**Step 3 –** Select the Data Source tab and click Configure. The SQL Data Collector wizard opens.
:::warning
-Do not make changes to wizard pages not listed in these steps. They have been
+Don't make changes to wizard pages not listed in these steps. They have been
pre-configured for this job.
:::
@@ -45,7 +45,7 @@ query target is All Databases. The default query scope is Only select database o
Retrieve. The Available database objects section will be populated. Databases and instances can be
added in the following ways:
-- Select the desired database objects and click Add
+- Select the database objects you want and click Add
- Use the Import CSV button to import a list from a CSV file, if desired
- Optionally, use the Add Custom Filter button to create and apply a custom filter
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/5-oracle_configuration.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/5-oracle_configuration.md
index 1a8cac971d..90667e5011 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/5-oracle_configuration.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/collection/5-oracle_configuration.md
@@ -23,18 +23,18 @@ The queries are:
### Configure the 5-Oracle_Configuration Queries
The 5-Oracle_Configuration Job is preconfigured to run using the default settings for the Custom
-Oracle Query category in the SQL Data Collector. Follow the steps to customize configurations:
+Oracle Query category in the SQL Data Collector. To customize configurations, complete the following steps:
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **Oracle** >
**5-Oracle_Configuration Job** > **Configure** node and select Queries.
-**Step 2 –** In the Query Selection view, select one of the queries and click on Query Properties.
+**Step 2 –** In the Query Selection view, select one of the queries and click Query Properties.
The Query Properties window opens.
**Step 3 –** Select the Data Source tab and click Configure. The SQL Data Collector wizard opens.
:::warning
-Do not make changes to wizard pages not listed in these steps. They have been
+Don't make changes to wizard pages not listed in these steps. They have been
pre-configured for this job.
:::
@@ -46,7 +46,7 @@ query target is All Databases. The default query scope is Only select database o
Retrieve. The Available database objects section will be populated. Databases and instances can be
added in the following ways:
-- Select the desired database objects and click Add
+- Select the database objects you want and click Add
- Use the Import CSV button to import a list from a CSV file, if desired
- Optionally, use the Add Custom Filter button to create and apply a custom filter
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_databaselinks.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_databaselinks.md
index 469c473e41..d4b9bd3b2e 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_databaselinks.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_databaselinks.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Oracle_DatabaseLinks Job
The Oracle_DatabaseLinks Job contains a report that provides information on Database Links where the
-listed Oracle Server is able to execute remote commands.
+listed Oracle Server can execute remote commands.
## Analysis Tasks for the Oracle_DatabaseLinks Job
@@ -15,7 +15,7 @@ Navigate to the **Jobs > Databases > Oracle > 4.Configuration > Oracle_Databas
Job >Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -32,4 +32,4 @@ the following preconfigured report:
| Report | Description | Default Tags | Report Elements |
| -------------- | -------------------------------------------------------------------------------------------------------- | ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Database Links | This report highlights Database Links where the listed Oracle Server is able to execute remote commands. | None | This report is comprised of three elements: - Bar Chart – Provides information on top five database links by instance
- Bar Chart – Provides information on database links by instance (GB)
- Table – Provides details on database links
|
+| Database Links | This report highlights Database Links where the listed Oracle Server can execute remote commands. | None | This report is comprised of three elements: - Bar Chart – Provides information on top five database links by instance
- Bar Chart – Provides information on database links by instance (GB)
- Table – Provides details on database links
|
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_databasesizing.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_databasesizing.md
index 2f73f29d50..b3fce67bac 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_databasesizing.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_databasesizing.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs > Databases > Oracle > 4.Configuration > Oracle_Databas
Job >Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_datadictionaryprotection.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_datadictionaryprotection.md
index b165d80f29..90645b53e9 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_datadictionaryprotection.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_datadictionaryprotection.md
@@ -17,7 +17,7 @@ Navigate to the **Jobs > Databases > Oracle > 4.Configuration > Oracle_DataDic
Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_instancenameissues.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_instancenameissues.md
index b72d93fbaf..fa8e6c17e4 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_instancenameissues.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_instancenameissues.md
@@ -8,7 +8,7 @@ sidebar_position: 40
The Oracle_InstanceNameIssues Job discovers if names used for Oracle database instances conform to
Oracle recommended best practices. The job also checks to see if Oracle SIDs conform to DISA STIG
-V-61413 – Oracle instance name or SID should not contain Oracle version numbers.
+V-61413 – Oracle instance name or SID shouldn't contain Oracle version numbers.
## Analysis Tasks for the Oracle_InstanceNameIssues Job
@@ -16,7 +16,7 @@ Navigate to the **Jobs > Databases > Oracle > 4.Configuration > Oracle_InstanceN
Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_remoteosauthentication.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_remoteosauthentication.md
index 9553e90132..804e6abef3 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_remoteosauthentication.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_remoteosauthentication.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs > Databases > Oracle > 4.Configuration > Oracle_RemoteOSA
Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/overview.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/overview.md
index 1b2fd42408..e4574c5bd1 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/overview.md
@@ -14,7 +14,7 @@ related to Oracle Database Instance configuration settings.
The jobs in the 4.Configuration Job Group are:
- [Oracle_DatabaseLinks Job](/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_databaselinks.md) – Contains a report that provides information
- on Database Links where the listed Oracle Server is able to execute remote commands
+ on Database Links where the listed Oracle Server can execute remote commands
- [Oracle_DatabaseSizing Job](/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_databasesizing.md) – Provides details on tablespace file sizes
and overall tablespace sizes
- [Oracle_DataDictionaryProtection Job](/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_datadictionaryprotection.md) – This job is designed
@@ -24,6 +24,6 @@ The jobs in the 4.Configuration Job Group are:
- [Oracle_InstanceNameIssues Job](/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_instancenameissues.md) – This job is designed to find out
if the names used for the Oracle database instances conform to Oracle recommended best practices.
The job also checks to see if the Oracle SID conforms to DISA STIG V-61413 – Oracle instance name
- or SID should not contain Oracle version numbers.
+ or SID shouldn't contain Oracle version numbers.
- [Oracle_RemoteOSAuthentication Job](/docs/accessanalyzer/12.0/solutions/databases/oracle/configuration/oracle_remoteosauthentication.md) – This job is designed to
find out if remote OS authentication is enabled for the targeted Oracle database servers
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/overview.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/overview.md
index adcd506425..6155417ad9 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/overview.md
@@ -15,7 +15,7 @@ access the data, and how each database has been configured.
This solution is a comprehensive part of the Data Access Governance suite for structured and
unstructured data. Access Analyzer for Oracle automates the process of understanding where Oracle
-databases exist and provides an overview of the Oracle environment in order to answer questions
+databases exist and provides an overview of the Oracle environment to answer questions
around data access:
- Who HAS access to your data?
@@ -25,11 +25,11 @@ around data access:
With visibility into every corner of Oracle® server and the Windows® operating system it relies
upon, organizations can proactively highlight and prioritize risks to sensitive data. Additionally,
organizations can automate manual, time-consuming, and expensive processes associated with
-compliance, security, and operations to easily adhere to best practices that keep Oracle Server safe
+compliance, security, and operations to adhere to best practices that keep Oracle Server safe
and operational.
The Oracle Solution requires a special Access Analyzer license. The Database Solution license
-includes all supported database platforms supported by Access Analyzer. Additionally, Sensitive Data
+includes all database platforms supported by Access Analyzer. Additionally, Sensitive Data
Discovery enables the solution to search database content for sensitive data.
**Supported Platforms**
@@ -46,22 +46,22 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
+If running Sensitive Data Discovery (SDD) scans, increase the minimum amount
of RAM. Each thread requires a minimum of 2 additional GB of RAM per host.For example, if the job is
configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
:::note
The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
+server. The JDK deployed is prepackaged and preconfigured to work with Access Analyzer, requires no
+additional configuration, and should never be customized through Java. It doesn't
conflict with other JDKs or Java Runtimes in the same environment.
:::
**Location**
-The Oracle Solution requires a special Access Analyzer license. It can be installed from the Access
-Analyzer Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to the
+The Oracle Solution requires a special Access Analyzer license. Install it from the Access
+Analyzer Instant Job Wizard. After you install it into the Jobs tree, navigate to the
solution: **Jobs** > **Databases** > **0.Collection** > **Oracle** for the 0.Collection job group
for Oracle.
@@ -69,7 +69,7 @@ The 0.Collection Job Group discovers Oracle Instances on the target hosts. The o
**Jobs** > **Databases** > **Oracle** analyze and report on the data collected by the 0.Collection
Job Group.
-The Database Solution license includes all supported database platforms supported by Access
+The Database Solution license includes all database platforms supported by Access
Analyzer. Additionally, Sensitive Data Discovery enables the solution to search database content for
sensitive data.
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_domainuserpermissions.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_domainuserpermissions.md
index 5018b8750a..9b73735953 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_domainuserpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_domainuserpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **3.Permissions** > **Oracle_DomainUserPermissions*
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_objectpermissions.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_objectpermissions.md
index 0c3f0db586..51ee092f25 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_objectpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_objectpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **3.Permissions** > **Oracle_ObjectPermissions** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_publicpermissions.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_publicpermissions.md
index ed682eed47..4e51f9f958 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_publicpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_publicpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **3.Permissions** > **Oracle_PublicPermissions** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_serverpermissions.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_serverpermissions.md
index 21cfd975de..f3b2413d0b 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_serverpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_serverpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **3.Permissions** > **Oracle_ServerPermissions** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_sysschemapermissions.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_sysschemapermissions.md
index c911f09063..ffa54c4f56 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_sysschemapermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/permissions/oracle_sysschemapermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **3.Permissions** > **Oracle_SysSchemaPermissions**
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/recommended.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/recommended.md
index 977a1c8ec2..ea47f70b1a 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/recommended.md
@@ -6,10 +6,10 @@ sidebar_position: 10
# Recommended Configuration
-The Oracle Solution has been configured to inherit down from the Oracle > Settings node. However, it
-is best practice to assign the host list and the Connection Profile at the data collection level,
-0.Collection Job Group. Once these are assigned to the job group, it can be run directly or
-scheduled.
+By default, the Oracle Solution inherits from the Oracle > Settings node. However, it's best
+practice to assign the host list and the Connection Profile at the data collection level,
+0.Collection Job Group. After you assign these to the job group, you can run it directly or
+schedule it.
**Dependencies**
@@ -18,19 +18,18 @@ scheduled.
databases
Some of the queries in the **Jobs** > **Databases** > **0.Collection** > **Oracle Job Group** can be
-scoped to target specific databases and/or instances. However, it is necessary for the
-SA_SQL_Instances table to be populated before attempting to scope the queries. Therefore, the
-0-Oracle_Servers job must be executed before attempting to scope the rest of the 0.Collection Job
-Group queries.
+scoped to target specific databases and/or instances. However, you must populate the
+SA_SQL_Instances table before you scope the queries. Therefore, run the 0-Oracle_Servers job before
+you scope the rest of the 0.Collection Job Group queries.
-**Targeted Host(s)**
+**Targeted Hosts**
The 0.Collection Job Group must be set to run against the following dynamic host list:
- Oracle Servers
Default dynamic host lists are populated from hosts in the Host Master Table which meet the host
-inventory criteria for the list. Ensure the appropriate host list(s) have been populated through
+inventory criteria for the list. Ensure the appropriate host lists have been populated through
host inventory results.
**Connection Profile**
@@ -38,20 +37,19 @@ host inventory results.
The SQL Data Collector requires a specific set of permissions. The account used can be either an
Active Directory account or an Oracle account.
-For a Windows-integrated Oracle instance it is possible to use one Active Directory credential that
+For a Windows-integrated Oracle instance, you can use one Active Directory credential that
has permissions on both the Oracle database and the server. This will not generally be the case in
most customer environments, but it is possible.
-If the required permissions are assigned to one Active Directory credential, once the account has
-been provisioned, create a custom Connection Profile containing the credentials for the targeted
-environment. See the [SQL Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/sql/overview.md) topic for
+After you provision an Active Directory account with the required permissions, create a custom
+Connection Profile containing the credentials for the targeted environment. See the [SQL Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/sql/overview.md) topic for
additional information on permissions and creating a SQL custom connection profile.
Alternatively, create a connection profile with both the Oracle database credentials and the server
credentials for the targeted host.
-A Connection Profile with the applicable permissions should be assigned under each jobs Connection
-node as follows:
+Assign a Connection Profile with the applicable permissions under each job's Connection node as
+follows:
- Both the Oracle database credentials and the Server credentials for the targeted host (or the
previously provisioned AD credentials) for:
@@ -66,7 +64,7 @@ node as follows:
The Connection Profile is set to Use the Default Profile, as configured at the global settings
level. However, since this may not be the Connection Profile with the necessary permissions for the
assigned hosts, click the radio button for the Select one of the following user defined profiles
-option and select the appropriate Connection Profile drop-down menu.
+option and select the appropriate Connection Profile dropdown menu.
See the [Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) topic for additional
information.
@@ -121,13 +119,13 @@ SQL Data Collector configurations can be modified if desired:
**Analysis Configuration**
This solution should be run with the default analysis configurations. These analysis tasks are
-preconfigured and should not be modified or deselected!
+preconfigured and shouldn't be modified or deselected.
Remember, disabling obsolete or un-desired jobs allows the solution to run more efficiently. To
-disable a job or job group, right-click on the item and select Disable Job.
+disable a job or job group, right-click the item and select Disable Job.
:::info
-Do not delete any jobs. Instead, jobs should be disabled.
+Don't delete jobs. Instead, disable them.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/sensitivedata/oracle_sensitivedata.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/sensitivedata/oracle_sensitivedata.md
index 43983547c6..dd430dd7f9 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/sensitivedata/oracle_sensitivedata.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/sensitivedata/oracle_sensitivedata.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle > 5.Sensitve Data > Oracle_SensitveData > Configure** n
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/sensitivedata/oracle_sensitivedatapermissions.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/sensitivedata/oracle_sensitivedatapermissions.md
index 308a9bb6d7..9ea224d59b 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/sensitivedata/oracle_sensitivedatapermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/sensitivedata/oracle_sensitivedatapermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle > 5.Sensitive Data > Oracle_SensitiveDataPermissions >
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_passwordissues.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_passwordissues.md
index 33169449ec..f03b5470a2 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_passwordissues.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_passwordissues.md
@@ -15,7 +15,7 @@ passwords.
The Oracle_PasswordIssues Job uses the PowerShell Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -33,7 +33,7 @@ Navigate to the **Jobs** > **Oracle** > **1.Users and Roles** > **Oracle_Passwor
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_rolemembers.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_rolemembers.md
index f927578638..76f50a8036 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_rolemembers.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_rolemembers.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **1.Users and Roles** > **Oracle_RoleMembers** > Co
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_systemadministrators.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_systemadministrators.md
index 4a7d0dd74e..634f126fe4 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_systemadministrators.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_systemadministrators.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **1.Users and Roles** > **Oracle_SystemAdministrato
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_users.md b/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_users.md
index 5820ee8274..82bb025d61 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_users.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/oracle/usersroles/oracle_users.md
@@ -15,7 +15,7 @@ Navigate to the **Oracle** > **1.Users and Roles** > **Oracle_Users** > **Config
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/overview.md b/docs/accessanalyzer/12.0/solutions/databases/overview.md
index 4c5ebf1fc2..6c035e0cdd 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/overview.md
@@ -23,7 +23,7 @@ reports that provide visibility into various aspects of supported databases:
order to answer questions around data access.
- [PostgreSQL Solution](/docs/accessanalyzer/12.0/solutions/databases/postgresql/overview.md) – Access Analyzer for PostgreSQL automates the
process of understanding where PostgreSQL databases exist and provides an overview of the
- PostgreSQL environment in order to answer questions around data access.
+ PostgreSQL environment to answer questions around data access.
- [Redshift Solution](/docs/accessanalyzer/12.0/solutions/databases/redshift/overview.md) – Redshift Solution Set is a comprehensive set of
pre-configured audit jobs and reports that provide visibility into various aspects of Redshift:
Data Collection, Configuration, and Sensitive Data.
@@ -32,8 +32,8 @@ reports that provide visibility into various aspects of supported databases:
configuration, sensitive data, and overall security assessment for both the SQL 0.Collection Job
Group and Azure SQL 0.Collection Job Group.
-The Database Solution license includes all supported database platforms supported by Access
-Analyzer. Additionally, Sensitive Data Discovery enables the solution to search database content for
+The Database Solution license includes all database platforms supported by Access Analyzer.
+Additionally, Sensitive Data Discovery enables the solution to search database content for
sensitive data.
The following table identifies the type of audit functionality for each supported database platform:
@@ -48,7 +48,7 @@ The following table identifies the type of audit functionality for each supporte
| PostgreSQL | | \*Partially Supported | | Fully Supported | \*\*Partially Supported |
| Redshift | | \*Partially Supported | | Fully Supported | \*\*Partially Supported |
-In the above table:
+In this table:
- \*Partially Supported, "Permission Audit" means the permissions as solely collected at the table
level.
diff --git a/docs/accessanalyzer/12.0/solutions/databases/postgresql/collection/pgsql_configuration.md b/docs/accessanalyzer/12.0/solutions/databases/postgresql/collection/pgsql_configuration.md
index 6f5b04797f..308ab2d1db 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/postgresql/collection/pgsql_configuration.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/postgresql/collection/pgsql_configuration.md
@@ -14,7 +14,7 @@ PostgreSQL servers.
The PgSQL_Configuration Job uses the SQL Data Collector.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/postgresql/collection/pgsql_sensitivedatascan.md b/docs/accessanalyzer/12.0/solutions/databases/postgresql/collection/pgsql_sensitivedatascan.md
index 2d20e518a9..4e5abba40e 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/postgresql/collection/pgsql_sensitivedatascan.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/postgresql/collection/pgsql_sensitivedatascan.md
@@ -24,18 +24,18 @@ The query is:
### Configure the SensitiveDataScan Query
The PgSQL_SensitiveDataScan Job is preconfigured to run using the default settings for the Sensitive
-Data Collection category. Follow the steps to customize configurations.
+Data Collection category. To customize configurations, complete the following steps.
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **PostgreSQL** >
**PgSQL_SensitiveDataScan** > **Configure** node and select Queries.
-**Step 2 –** In the Query Selection view, select the **PostgreSQL** query click on Query Properties.
+**Step 2 –** In the Query Selection view, select the **PostgreSQL** query click Query Properties.
The Query Properties window appears.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for this
+Don't make changes to other wizard pages as they have been pre-configured for this
job.
:::
@@ -43,8 +43,8 @@ job.
**Step 4 –** To modify sensitive data scan options, navigate to the
-[SQL Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/sql/overview.md) page. Select the desired scan
-options.
+[SQL Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/sql/overview.md) page. Select the scan
+options you want.
:::note
The Sensitive Data Scan Settings are pre-configured for optimal performance for a
@@ -64,8 +64,8 @@ topic for additional information.
-**Step 6 –** PostgreSQL databases must be added to the query before they can be scanned. Navigate to
-the **Filter** page and click **Connections** to open the Manage Connections window.
+**Step 6 –** Add PostgreSQL databases to the query before you scan them. Navigate to the
+**Filter** page and click **Connections** to open the Manage Connections window.
@@ -83,9 +83,9 @@ Exit the Manage Connections window to return to the Filter page.
**Step 8 –** On the Filter page, the query is configured by default to target Only select database
objects. Click Retrieve. The Available database objects box will populate. The default filter will
scan all PostgreSQL databases returned, excluding the listed system or default schemas and tables in
-red. Databases and instances can be added in the following ways:
+red. Add databases and instances in the following ways:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Use the Add Custom Filter button to create and apply a custom filter.
@@ -100,7 +100,7 @@ Navigate to the **Databases** > **0.Collection** > **PostgreSQL** > **PgSQL_Sen
**Configure** node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/postgresql/collection/pgsql_tableprivileges.md b/docs/accessanalyzer/12.0/solutions/databases/postgresql/collection/pgsql_tableprivileges.md
index edbb748270..57acfb9b73 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/postgresql/collection/pgsql_tableprivileges.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/postgresql/collection/pgsql_tableprivileges.md
@@ -14,7 +14,7 @@ targeted servers.
The PgSQL_TablePrivileges Job uses the SQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -30,7 +30,7 @@ Navigate to the **Databases** > **0.Collection** > **PostgreSQL** > **PgSQL_Tabl
**Configure** node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/postgresql/overview.md b/docs/accessanalyzer/12.0/solutions/databases/postgresql/overview.md
index 3840fbafc7..a7c139d0b1 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/postgresql/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/postgresql/overview.md
@@ -6,16 +6,15 @@ sidebar_position: 50
# PostgreSQL Solution
-Data privacy and security is quickly evolving to be on equal footing with traditional security
-measures focused on the network, hardware, or software the data is contained within. Organizations
-aligning to concepts like Data-Centric Audit and Protection (DCAP) as defined by Gartner, or the
-requirements of strict compliance regulations like EU GDPR, are looking to implement processes that
-help them understand where sensitive data is stored, who or what is leveraging their privileges to
-access the data, and how each database has been configured.
+Data privacy is becoming as important as traditional security measures focused on the network,
+hardware, or software that stores the data. Organizations that align with concepts like
+Data-Centric Audit and Protection (DCAP), as defined by Gartner, or with strict compliance
+regulations like the EU GDPR, want to understand where sensitive data is stored, who has access to
+it, and how each database is configured.
As part of Netwrix comprehensive Data Access Governance suite for structured and unstructured data,
Access Analyzer for PostgreSQL automates the process of understanding where PostgreSQL databases
-exist and provides an overview of the PostgreSQL environment in order to answer questions around
+exist and provides an overview of the PostgreSQL environment to answer questions around
data access:
- Who has access to your data?
@@ -23,8 +22,8 @@ data access:
With visibility into every corner of PostgreSQL, organizations can proactively highlight and
prioritize risks to sensitive data. Additionally, organizations can automate manual, time-consuming,
-and expensive processes associated with compliance, security, and operations to easily adhere to
-best practices that keep PostgreSQL Server safe and operational.
+and expensive processes associated with compliance, security, and operations to adhere to best
+practices that keep PostgreSQL Server safe and operational.
**Supported Platforms**
@@ -41,16 +40,16 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if the job is configured to
+scan 8 hosts at a time, it requires an extra 16 GB of RAM (8 x 2 = 16).
By default, the job is configured to use 10 threads, which can be adjusted based on available
resources on the Access Analyzer server.
:::note
The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
+server. The JDK deployed is prepackaged and doesn't require any configuration; it has been
preconfigured to work with Access Analyzer and should never be customized through Java. It will not
conflict with other JDKs or Java Runtimes in the same environment.
:::
@@ -59,15 +58,15 @@ conflict with other JDKs or Java Runtimes in the same environment.
**Location**
The Structured Sensitive Data Discovery License is required to run the PostgreSQL Solution. It can
-be installed from theAccess Analyzer Instant Job Wizard. Once it has been installed into the Jobs
+be installed from theAccess Analyzer Instant Job Wizard. After it has been installed into the Jobs
tree, navigate to the solution: Jobs > **Databases** > PostgreSQL.
The 0.Collection Job Group performs sensitive data discovery and collects information on database
configurations on the target hosts. The other job groups analyze and report on the data collected by
the 0.Collection Job Group.
-The Database Solution license includes all supported database platforms supported by Access
-Analyzer. Additionally, Sensitive Data Discovery enables the solution to search database content for
+The Database Solution license includes all database platforms supported by Access Analyzer.
+Additionally, Sensitive Data Discovery enables the solution to search database content for
sensitive data.
## Job Groups
diff --git a/docs/accessanalyzer/12.0/solutions/databases/postgresql/pgsql_databasesizing.md b/docs/accessanalyzer/12.0/solutions/databases/postgresql/pgsql_databasesizing.md
index 783ffdc1c0..9efa9f27d9 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/postgresql/pgsql_databasesizing.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/postgresql/pgsql_databasesizing.md
@@ -21,7 +21,7 @@ Navigate to the **Jobs > Databases > PostgreSQL > Configuration > PgSQL_Databa
node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/postgresql/recommended.md b/docs/accessanalyzer/12.0/solutions/databases/postgresql/recommended.md
index da349a7e38..fae27a4ac4 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/postgresql/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/postgresql/recommended.md
@@ -6,19 +6,19 @@ sidebar_position: 10
# Recommended Configuration for the PostgreSQL Solution
-The jobs in the PostgreSQL Solution has been configured to inherit down from the **PostgreSQL** >
-**Settings** node. However, it is best practice to assign the host list and the Connection Profile
-at the data collection level, 0.Collection Job Group. Once these are assigned to the job group, it
-can be run directly or scheduled.
+By default, the jobs in the PostgreSQL Solution inherit from the **PostgreSQL** > **Settings** node.
+However, it's best practice to assign the host list and the Connection Profile at the data
+collection level, 0.Collection Job Group. After you assign these to the job group, you can run it
+directly or schedule it.
**Dependencies**
- **.Active Directory Inventory** Job Group run successfully
- For AWS RDS and Aurora instances, right-click a job in the **PostgreSQL** > **0.Collection**
folder and open the properties window. Select the **Performance** tab and ensure that the **Skip
- Hosts that do not respond to PING**checkbox is not selected.
+ Hosts that don't respond to PING**checkbox isn't selected.
-**Targeted Host(s)**
+**Targeted Hosts**
- The 0.Collection Job Group must be set to run against a custom host list containing the
PostgreSQL database instances / clusters.
@@ -35,7 +35,7 @@ permissions and creating a SQL custom connection profile.
The Connection Profile is set to **Use the Default Profile**, as configured at the global settings
level. However, since this may not be the Connection Profile with the necessary permissions for the
assigned hosts, click the radio button for the **Select one of the following user defined profiles**
-option and select the appropriate Connection Profile drop-down menu.
+option and select the appropriate Connection Profile dropdown menu.
**Schedule Frequency**
@@ -60,12 +60,12 @@ topic for additional information.
**Analysis Configuration**
This solution should be run with the default analysis configurations. These analysis tasks are
-preconfigured and should not be modified or deselected!
+preconfigured and shouldn't be modified or deselected.
Disabling obsolete or run-desired jobs allows the solution to run more efficiently. To disable a job
-or job group, right-click on the item and select **Disable Job**.
+or job group, right-click the item and select **Disable Job**.
:::info
-Do not delete any jobs. Instead, jobs should be disabled.
+Don't delete jobs. Instead, disable them.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedata.md b/docs/accessanalyzer/12.0/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedata.md
index c5c668aa0c..93b3a7abe6 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedata.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedata.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs > Databases > PostgreSQL > Sensitive Data > PgSQL_Sens
node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedatapermissions.md b/docs/accessanalyzer/12.0/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedatapermissions.md
index a091d58cbc..ca8b08a6cc 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedatapermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/postgresql/sensitivedata/pgsql_sensitivedatapermissions.md
@@ -17,7 +17,7 @@ Data > PgSQL_SensitiveDataPermissions > Configure** node and select Analysis t
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/overview.md b/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/overview.md
index 79e4e2e17c..9c3dfb2166 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# 0.Collection Job Group
The Redshift Solution Collection group collects high level summary information from targeted
-Redshift Servers. Other jobs in the Redshift Solution Set use this information for further analysis
+Redshift Servers. Other jobs in the Redshift Solution Set use this information for further analysis
and for producing respective reports.
diff --git a/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_configuration.md b/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_configuration.md
index 76ae3a75fa..3ae493956e 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_configuration.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_configuration.md
@@ -13,7 +13,7 @@ The Redshift_Configuration job returns additional configuration settings from Re
The Redshift_Configuration Job uses the SQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_sensitivedatascan.md b/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_sensitivedatascan.md
index 565f1ea3dd..2173a38c4d 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_sensitivedatascan.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_sensitivedatascan.md
@@ -22,14 +22,14 @@ The query is:
## Recommended Configuration for the SensitiveDataScan Query
The Redshift_SensitiveDataScan Job is preconfigured to run using the default settings for the
-Sensitive Data Collection category. It is necessary only to set up the connection for the Redshift-
-SensitiveDataScan Job. Once the connection is established, it applies to any other 0.Collection job
-query. Follow the steps to customize configurations.
+Sensitive Data Collection category. You only need to set up the connection for the
+Redshift_SensitiveDataScan Job once. After you establish the connection, it applies to any other
+0.Collection job query. To customize configurations, complete the following steps.
**Step 1 –** Navigate to the **Databases** > **0.Collection** > **Redshift** >
**Redshift_SensitiveDataScan** > **Configure** node and select Queries.
-**Step 2 –** In the Query Selection view, select the Redshift Sensitive Data Scan query click on
+**Step 2 –** In the Query Selection view, select the Redshift Sensitive Data Scan query click
Query Properties. The Query Properties window appears.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard opens
@@ -41,7 +41,7 @@ with Sensitive Data Collection category selected.
-**Step 5 –** To modify sensitive data scan options, select the desired scan options. See the
+**Step 5 –** To modify sensitive data scan options, select the scan options you want. See the
[SQL: Options](/docs/accessanalyzer/12.0/admin/datacollector/sql/options.md) page for additional information.
:::note
@@ -55,7 +55,7 @@ may significantly increase scan time.
-**Step 7 –** To modify criteria, click on **Use the following selected criteria:** and select your
+**Step 7 –** To modify criteria, click **Use the following selected criteria:** and select your
choices. By default, the Sensitive Data Scan job is set to **Use Global Criteria**. Also by default,
the following System Criteria have been selected:
@@ -80,8 +80,8 @@ topic for additional information.
**Step 9 –** Click **Connections** to open the Manage Connections window.
:::note
-SQL databases must be added to the query before they can be scanned. Before you can add a
-query, you must establish a connection to the database.
+Add SQL databases to the query before you scan them. Before you add a query, establish a
+connection to the database.
:::
@@ -111,10 +111,9 @@ For more information on filtering, see the
**Step 13 –** Click Retrieve. The Available database objects box will populate.
-**Step 14 –** Add the Databases and instances to be audited. Databases and instances can be added in
-the following ways:
+**Step 14 –** Add the databases and instances to audit, using any of the following methods:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Optionally use the Add Custom Filter button to create and apply a custom filter.
@@ -129,12 +128,12 @@ The 1-Db2_SensitsveDataScan Job is now ready to run with the customized settings
## Analysis Tasks for the Redshift_SensitiveDataScan
Navigate to the \_**\_Databases > 0.Collection >**Redshift >\_\_ **Redshift_SensitiveDataScan** >
-**Configure** node and select **Analysis** to view the Analysis Tasks. The Analysis tasks do not
+**Configure** node and select **Analysis** to view the Analysis Tasks. The Analysis tasks don't
require any configuration as they just populate the reports with the collected information and do
not collect data themselves.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_tableprivileges.md b/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_tableprivileges.md
index a8cadb210a..07fdcb7938 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_tableprivileges.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_tableprivileges.md
@@ -14,7 +14,7 @@ targeted servers.
The Redshift_TablePrivileges Job uses the SQL Data Collector for queries.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -30,7 +30,7 @@ Navigate to the **Databases** > **0.Collection** > **Redshift** > **Redshift_Tab
**Configure** node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/redshift/overview.md b/docs/accessanalyzer/12.0/solutions/databases/redshift/overview.md
index 3ef9402c24..f9c7aa9219 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/redshift/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/redshift/overview.md
@@ -26,16 +26,16 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if the job is configured to
+scan 8 hosts at a time, it requires an extra 16 GB of RAM (8 x 2 = 16).
By default, the job is configured to use 10 threads, which can be adjusted based on available
resources on the Access Analyzer server.
:::note
The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
+server. The JDK deployed is prepackaged and doesn't require any configuration; it has been
preconfigured to work with Access Analyzer and should never be customized through Java. It will not
conflict with other JDKs or Java Runtimes in the same environment.
:::
@@ -44,14 +44,14 @@ conflict with other JDKs or Java Runtimes in the same environment.
**Location**
The Redshift Solution requires a special Access Analyzer license. It can be installed from the
-Access Analyzer Instant Job Wizard. Once it has been installed in the **Jobs** tree, navigate to the
+Access Analyzer Instant Job Wizard. After it has been installed in the **Jobs** tree, navigate to the
solution: **Jobs** > **Databases** > **Redshift Solution**.
The 0.Collection Job Group discovers SQL instances on the target hosts, and collects the data. The
other job groups analyze the collected data and generate reports.
-The Database Solution license includes all supported database platforms supported by Access
-Analyzer. Additionally, Sensitive Data Discovery enables the solution to search database content for
+The Database Solution license includes all database platforms supported by Access Analyzer.
+Additionally, Sensitive Data Discovery enables the solution to search database content for
sensitive data.
## Redshift Job Group
@@ -66,7 +66,7 @@ The following job groups comprise the Redshift Job Group:
- [0.Collection Job Group](/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/overview.md) — Collects high level summary information from
targeted Redshift Servers. Other jobs in the Redshift Solution Set use this information for
further analysis and producing respective report. This Job Group is comprised of the following
- jobs(s)
+ jobss
- [Redshift_Configuration Job](/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_configuration.md)
- [Redshift_SensitiveDataScan Job](/docs/accessanalyzer/12.0/solutions/databases/redshift/collection/redshift_sensitivedatascan.md)
@@ -78,7 +78,7 @@ The following job groups comprise the Redshift Job Group:
- [Sensitive Data Job Group](/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/overview.md) — Provides insight into where sensitive
data exists and who has access to it across all the targeted Redshift databases.This Job Group is
- comprised of the following job(s):
+ comprised of the following jobs:
- [Redshift_SensitiveData Job](/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/redshift_sensitivedata.md)
- [Redshift_SensitiveDataPermissions Job](/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/redshift_sensitivedatapermissions.md)
diff --git a/docs/accessanalyzer/12.0/solutions/databases/redshift/recommended.md b/docs/accessanalyzer/12.0/solutions/databases/redshift/recommended.md
index d7fcfa492b..d53703be5e 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/redshift/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/redshift/recommended.md
@@ -8,35 +8,35 @@ sidebar_position: 10
The Redshift Solution is configured to inherit settings from the global Settings node. However, it
is best practice to assign the host list and the Connection Profile at the data collection level,
-the 0.Collection Job Group. Once these are assigned to the job group, it can be run directly or
+the 0.Collection Job Group. After these are assigned to the job group, it can be run directly or
scheduled.
**Dependencies**
-This job group does not have dependencies.
+This job group doesn't have dependencies.
-**Targeted Host(s)**
+**Targeted Hosts**
The Redshift Job Group has been configured to inherit the host list assignment from the collection
group level.
-The host list assignment should be assigned under the **Redshift** > **0.Collection** >
+Assign the host list under the **Redshift** > **0.Collection** >
**Settings** > **Host List Assignment** node. The **Local host** box is checked by default.
**Connection Profile**
The SQL Data Collector requires a specific set of permissions. See the Permissions section for
necessary permissions. The account used can be either an Active Directory account or a SQL account.
-Once the account has been provisioned, create a custom Connection Profile containing the credentials
+After the account has been provisioned, create a custom Connection Profile containing the credentials
for the targeted environment. See the
[SQL Custom Connection Profile & Default Dynamic Host List](/docs/accessanalyzer/12.0/admin/datacollector/sql/configurejob.md)
topic for additional information.
-The Connection Profile should be assigned under the **Redshift** > **0.Collection** > **Settings** >
+Assign the Connection Profile under the **Redshift** > **0.Collection** > **Settings** >
**Connection** node. It is set to **Use the Default Profile**, as configured at the global settings
level. However, since this may not be the Connection Profile with the necessary permissions for the
assigned hosts, click the radio button for the **Select one of the following user defined profiles**
-option and select the appropriate Connection Profile drop-down menu.
+option and select the appropriate Connection Profile dropdown menu.
See the [Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) topic for additional
information.
diff --git a/docs/accessanalyzer/12.0/solutions/databases/redshift/redshift_databasesizing.md b/docs/accessanalyzer/12.0/solutions/databases/redshift/redshift_databasesizing.md
index 37e6098645..5d271f4a89 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/redshift/redshift_databasesizing.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/redshift/redshift_databasesizing.md
@@ -6,12 +6,12 @@ sidebar_position: 30
# Configuration > Redshift_DatabaseSizing Job
-This group provides insight into details about the Redshift environment and potential
+This group provides details about the Redshift environment and potential
vulnerabilities related to instance configuration settings.
-The job(s) in the Configuration Job Group are:
+The jobs in the Configuration Job Group are:
- Redshift_DatabaseSizing Job — Provides details about Redshift databases and overall database size.
@@ -21,7 +21,7 @@ Navigate to the **Jobs** > **Databases**> **Redshift** > **Configuration** >
**Redshift_DatabaseSizing** > **Configure** node and select **Analysis** to view the Analysis Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/overview.md b/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/overview.md
index 54092a3875..6dad9a1ec3 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/overview.md
@@ -5,7 +5,7 @@ targeted Redshift databases.
-The job(s) in the Sensitive Data Job Group are:
+The jobs in the Sensitive Data Job Group are:
- [Redshift_SensitiveData Job](/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/redshift_sensitivedata.md) - Provides information on all the data
that was discovered in the targeted Redshift database servers based on the selected scan criteria
diff --git a/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/redshift_sensitivedata.md b/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/redshift_sensitivedata.md
index 08eb3c26f5..55e711c678 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/redshift_sensitivedata.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/redshift_sensitivedata.md
@@ -9,7 +9,7 @@ Navigate to the **Jobs** > **Databases** > **Redshift** > **Sensitive Data** >
**Redshift_SensitiveData** > **Configure** node and select **Analysis** to view the Analysis Tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/redshift_sensitivedatapermissions.md b/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/redshift_sensitivedatapermissions.md
index 176f13b7e9..b87e82282c 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/redshift_sensitivedatapermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/redshift/sensitive_data/redshift_sensitivedatapermissions.md
@@ -11,7 +11,7 @@ Data > Redshift_SensitiveDataPermissions > Configure** node and select Analysi
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_activity.md b/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_activity.md
index 33e0271e31..741f2cd876 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_activity.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_activity.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 2.Activity > SQL_Activity > Configure node
to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_logons.md b/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_logons.md
index cabdca740b..31dd8c3bdd 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_logons.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_logons.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 2.Activity > SQL_Logons > Configure node
to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_permissionchanges.md b/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_permissionchanges.md
index 97787e34ca..52c8c0c607 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_permissionchanges.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_permissionchanges.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 2.Activity > SQL_PermissionChanges > Conf
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_sensitivedataactivity.md b/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_sensitivedataactivity.md
index 9c757a37a5..13e146e29f 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_sensitivedataactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_sensitivedataactivity.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 2.Activity > SQL_SensitiveDataActivity > C
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_unusualactivity.md b/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_unusualactivity.md
index ea2add9018..32b96b1462 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_unusualactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/activity/sql_unusualactivity.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 2.Activity > SQL_UnusualActivity > Config
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/collection/0-sql_instancediscovery.md b/docs/accessanalyzer/12.0/solutions/databases/sql/collection/0-sql_instancediscovery.md
index a22f604e2f..09f1787d90 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/collection/0-sql_instancediscovery.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/collection/0-sql_instancediscovery.md
@@ -24,7 +24,7 @@ Navigate to the **Databases** > **0.Collection** > **SQL** > **0-SQL_InstanceDis
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/collection/1-sql_permissionsscan.md b/docs/accessanalyzer/12.0/solutions/databases/sql/collection/1-sql_permissionsscan.md
index a8a2d69cfc..3ba9c41653 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/collection/1-sql_permissionsscan.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/collection/1-sql_permissionsscan.md
@@ -23,18 +23,18 @@ The 1-SQL_PermissionsScan Job uses the SQL Data Collector for the following quer
### Configure the PermissionsScan Query
The 1-SQL_PermissionScan Job is preconfigured to run using the default settings within the
-Permissions Collection category. Follow the steps to customize configurations.
+Permissions Collection category. To customize configurations, complete the following steps.
**Step 1 –** Navigate to the **Databases** > 0.Collection > SQL > 1-SQL_PermissionsScan > Configure
node and select Queries.
-**Step 2 –** In the Query Selection view, select the PermissionsScan query and click on Query
+**Step 2 –** In the Query Selection view, select the PermissionsScan query and click Query
Properties. The Query Properties window appears.
**Step 3 –** Select the Data Source tab and click Configure. The SQL Data Collector Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for this
+Don't make changes to other wizard pages as they have been pre-configured for this
job.
:::
@@ -47,7 +47,7 @@ is All databases. The default query scope is Only select database objects and cl
Available database objects will be populated. Databases and instances can be added in the following
ways:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Optionally, use the Add Custom Filter button to create and apply a custom filter.
@@ -62,7 +62,7 @@ Navigate to the **Databases** > 0.Collection > SQL > 1-SQL_PermissionsScan > Con
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -71,8 +71,8 @@ preconfigured for this job.
The default analysis tasks are:
-- Remove Old AIC Resources — Removes AIC resources using the old path that did not include the
- schema
+- Remove Old AIC Resources — Removes Access Information Center (AIC) resources using the old path
+ that didn't include the schema
- AIC Import – Hosts — Imports SQL hosts to the AIC
- AIC Import – Instance Permissions Node — Imports a node for instance permissions for each instance
- AIC Import – Databases — Imports each database in the SQL instances
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/collection/2-sql_sensitivedatascan.md b/docs/accessanalyzer/12.0/solutions/databases/sql/collection/2-sql_sensitivedatascan.md
index 5d99b45c9f..19fbe23561 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/collection/2-sql_sensitivedatascan.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/collection/2-sql_sensitivedatascan.md
@@ -34,25 +34,25 @@ The SensitiveDataScan Job uses the SQL Data Collector for the following query:
### Configure the SensitiveDataScan Query
The 2-SQL_SensitiveDataScan Job is preconfigured to run using the default settings for the Sensitive
-Data Collection category. Follow the steps to customize configurations.
+Data Collection category. To customize configurations, complete the following steps.
**Step 1 –** Navigate to the **Databases** > 0.Collection > SQL > 2-SQL_SensitiveDataScan >
Configure node and select Queries.
-**Step 2 –** In the Query Selection view, select the SensitiveDataScan query click on Query
+**Step 2 –** In the Query Selection view, select the SensitiveDataScan query click Query
Properties. The Query Properties window appears.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for this
+Don't make changes to other wizard pages as they have been pre-configured for this
job.
:::
-**Step 4 –** Select the desired scan options. Navigate to the
+**Step 4 –** Select the scan options you want. Navigate to the
[SQL: Options](/docs/accessanalyzer/12.0/admin/datacollector/sql/options.md) page for additional information.
:::note
@@ -85,7 +85,7 @@ System Criteria have been selected:
default to target Only select database objects. Click Retrieve. The Available database objects box
will populate. Databases and instances can be added in the following ways:
-- Select the desired database objects and click Add.
+- Select the database objects you want and click Add.
- Use the Import CSV button to import a list from a CSV file, if desired.
- Optionally use the Add Custom Filter button to create and apply a custom filter.
@@ -100,7 +100,7 @@ Navigate to the **Databases** > 0.Collection > SQL > 2-SQL_SensitiveDataScan >
select Analysis to view the analysis task.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/collection/3-sql_activityscan.md b/docs/accessanalyzer/12.0/solutions/databases/sql/collection/3-sql_activityscan.md
index 48bc6b61d2..ca54a77e89 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/collection/3-sql_activityscan.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/collection/3-sql_activityscan.md
@@ -30,18 +30,18 @@ The ActivityScan Job uses the SQL Data Collector for the following query:
### Configure the ActivityScan Query
The 3-SQL_ActivityScan Job is preconfigured to run using the default settings within the Server
-Audits Events Collection category. Follow the steps to customize configurations.
+Audits Events Collection category. To customize configurations, complete the following steps.
**Step 1 –** Navigate to the **Databases** > 0.Collection > SQL > 3-SQL_ActivityScan > Configure
node and select Queries.
-**Step 2 –** In the Query Selection view, click on Query Properties. The Query Properties window
+**Step 2 –** In the Query Selection view, click Query Properties. The Query Properties window
appears.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -49,8 +49,8 @@ purpose of this job.
**Step 4 –** To modify scan options, navigate to the
-[SQL Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/sql/overview.md) page. Select the desired scan
-options. The query is preconfigured with the following default settings:
+[SQL Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/sql/overview.md) page. Select the scan options
+you want. The query is preconfigured with the following default settings:
- Collect only events since last scan – Collects activity recorded since the previous scan
- Number of days you want to keep events in the database – The default setting is 15 days
@@ -64,7 +64,7 @@ options. The query is preconfigured with the following default settings:
by default to target Only select database objects. Click Retrieve. The Available database objects
will be populated. Databases and instances can be added in the following ways:
-Select the desired database objects and click Add.
+Select the database objects you want and click Add.
Use the Import CSV button to import a list from a CSV file.
@@ -81,7 +81,7 @@ Navigate to the **Databases** > 0.Collection > SQL > 3-SQL_ActivityScan > Config
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/collection/4-sql_serverlogons.md b/docs/accessanalyzer/12.0/solutions/databases/sql/collection/4-sql_serverlogons.md
index faa36ef0bd..8e0b0a463f 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/collection/4-sql_serverlogons.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/collection/4-sql_serverlogons.md
@@ -15,7 +15,7 @@ The AppnLogSQL Query uses the SMARTLog Data Collector and has been preconfigured
Windows Event Log Type.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/collection/5-sql_serversettings.md b/docs/accessanalyzer/12.0/solutions/databases/sql/collection/5-sql_serversettings.md
index 11d821fd13..6de3270d37 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/collection/5-sql_serversettings.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/collection/5-sql_serversettings.md
@@ -35,19 +35,19 @@ The 5-SQL_ServerSettings Job uses the SQL Data Collector for the following queri
### Configure the Configuration Query
The 5-SQL_ServerSettings Job’s Configuration Query is configured to run with the default settings
-with the Configuration Properties category. Follow the steps to customize configurations.
+with the Configuration Properties category. To customize configurations, complete the following steps.
**Step 1 –** Navigate to the **Databases** > 0.Collection > SQL > 5-SQL_ServerSettings > Configure
node and select Queries.
-**Step 2 –** In the Query Selection view, select the Configuration Query and click on Query
+**Step 2 –** In the Query Selection view, select the Configuration Query and click Query
Properties. The Query Properties window will appear.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard will
open.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -60,7 +60,7 @@ by default to target All instances. Change the query scope to Only select instan
Retrieve. The Available server audits will be populated. Databases and instances can be added in the
following ways:
-- Select the desired instances and click Add.
+- Select the instances you want and click Add.
- Use the Import CSV button to import a list from a CSV file.
- (Optional) Use the Add Custom Filter button to create and apply a custom filter.
@@ -73,20 +73,20 @@ The 5-SQL_ServerSettings Job is now ready to run with the customized settings.
The 5-SQL_ServerSettingsJob > Server Query has been preconfigured to run with the default settings
with the category of Server Properties. However, the query can be scoped to target specific
-databases/instances on the Filters page of the SQL Data Collector Wizard. Follow these steps to
-modify the query configuration.
+databases/instances on the Filters page of the SQL Data Collector Wizard. To modify the query
+configuration, complete the following steps.
**Step 1 –** Navigate to the **Databases** > 0.Collection > SQL > 5-SQL_ServerSettings > Configure
node and select Queries.
-**Step 2 –** In the Query Selection view, select the Server query click on Query Properties. The
+**Step 2 –** In the Query Selection view, select the Server query click Query Properties. The
Query Properties window will appear.
**Step 3 –** Select the Data Source tab, and click Configure. The SQL Data Collector Wizard will
open.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -99,7 +99,7 @@ by default to target All instances. Change the query scope to Only select instan
Retrieve. The Available server audits will be populated. Databases and instances can be added in the
following ways:
-- Select the desired instances and click Add.
+- Select the instances you want and click Add.
- Use the Import CSV button to import a list from a CSV file.
- Optionally use the Add Custom Filter button to create and apply a custom filter.
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/overview.md b/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/overview.md
index 4a59eacd54..3feda1d7d0 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/overview.md
@@ -15,18 +15,18 @@ The jobs in the 4.Configuration Job Group are:
- [SQL_Authentication Job](/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_authentication.md) – This job identifies authentication settings on
targeted SQL and Azure SQL servers that allow SQL server authentication in addition to Windows
- authentication. Microsoft recommends that the SQL and Azure SQL servers should be generally
- configured to utilize Windows authentication versus SQL authentication.
+ authentication. Microsoft recommends configuring SQL and Azure SQL servers to use Windows
+ authentication instead of SQL authentication.
- [SQL_BestPractices Job](/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_bestpractices.md) – This job is designed to analyze SQL and Azure SQL
server configuration settings and report on any findings that deviate from recommended Microsoft
Best Practices when it comes to creating, maintaining, and securing SQL servers
- [SQL_CMDShell Job](/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_cmdshell.md) – This job is designed to report if the `xp_cmdshell `stored
procedure is enabled or disabled. Since `xp_cmdshell` allows a user to execute operating system
- commands when connected to the SQL or Azure SQL server, it can be used to launch malicious
+ commands when connected to the SQL or Azure SQL server, attackers can use it to launch malicious
attacks. Microsoft recommends that the `xp_cmdshell` stored procedure be disabled.
- [SQL_DatabaseSizing Job](/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_databasesizing.md) – Provides details on database file sizes and
overall database sizes
- [SQL_LinkedServers Job](/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_linkedservers.md) – Identifies Linked Servers or remote database
servers on which the identified SQL and Azure SQL server can execute commands. Some of the common
- remote OLE DB providers include IBM DB2, Oracle, Access and Excel. Typically, linked servers are
+ remote OLE DB providers include IBM DB2, Oracle, Access, and Excel. Typically, linked servers are
used to handle distributed queries in SQL and Azure SQL server.
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_authentication.md b/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_authentication.md
index 62d27f5dc7..3c25f174f0 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_authentication.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_authentication.md
@@ -8,8 +8,8 @@ sidebar_position: 10
The SQL_Authentication Job identifies authentication settings on targeted SQL and Azure SQL servers
that allow SQL server authentication in addition to Windows authentication. Microsoft recommends
-that SQL and Azure SQL servers should be generally configured to utilize Windows authentication
-versus SQL server authentication.
+configuring SQL and Azure SQL servers to use Windows authentication instead of SQL server
+authentication.
## Analysis Tasks for the SQL_Authentication Job
@@ -17,7 +17,7 @@ Navigate to the **Databases** > SQL > 4.Configuration > SQL_Authentication > Con
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -36,4 +36,4 @@ produces the following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SQL Authentication | This report identifies authentication settings on the targeted servers, and highlights those with SQL Authentication enabled. Additionally, the number of SQL logins on a given instance, and whether or not the 'sa' login exists, are indicated. Best practices recommend that SQL instances be integrated login only, and that the 'sa' principal be renamed or removed. | None | This report is comprised of two elements: - Pie Chart – Displays instances with integrated security only
- Table – Displays integrated security details by instance
|
+| SQL Authentication | This report identifies authentication settings on the targeted servers, and highlights those with SQL Authentication enabled. It also indicates the number of SQL logins on a given instance and whether the 'sa' login exists. Best practices recommend using integrated login only for SQL instances and renaming or removing the 'sa' principal. | None | This report is comprised of two elements: - Pie Chart – Displays instances with integrated security only
- Table – Displays integrated security details by instance
|
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_bestpractices.md b/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_bestpractices.md
index b016d44de9..06fb1b2a4a 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_bestpractices.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_bestpractices.md
@@ -16,7 +16,7 @@ Navigate to the **Databases** > SQL > 4.Configuration > SQL_BestPractices > Con
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_cmdshell.md b/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_cmdshell.md
index 68762c3a7f..590a937092 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_cmdshell.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_cmdshell.md
@@ -7,8 +7,8 @@ sidebar_position: 30
# SQL_CMDShell Job
The SQL_CMDShell Job reports on whether the `xp_cmdshell` stored procedure is enabled or disabled.
-Since `xp_cmdshell` allows users to execute operating system commands when connected to the SQL or
-the Azure SQL server, it can be used to launch malicious attacks. Microsoft recommends that the
+`xp_cmdshell` lets users execute operating system commands when connected to the SQL or
+the Azure SQL server, which attackers can use to launch malicious attacks. Microsoft recommends that the
`xp_cmdshell` stored procedure be disabled.
## Analysis Tasks for the SQL_CMDShell Job
@@ -17,7 +17,7 @@ Navigate to the **Databases** > SQL > 4.Configuration > SQL_CMDShell > Configure
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_databasesizing.md b/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_databasesizing.md
index 33e77d121c..bf43a08a50 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_databasesizing.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_databasesizing.md
@@ -14,7 +14,7 @@ Navigate to the **Databases** > Jobs > SQL > 4.Configuration > SQL_DatabaseSizi
node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_linkedservers.md b/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_linkedservers.md
index 434cc29664..fdc3e3f8e9 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_linkedservers.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/configuration/sql_linkedservers.md
@@ -8,7 +8,7 @@ sidebar_position: 50
The SQL_LinkedServers Job identifies Linked Servers or remote database servers on which the
identified SQL and Azure SQL servers can execute commands. Some of the common remote
-OLE DB providers include IBM DB2, Oracle, Access and Excel. Typically, linked servers are used to
+OLE DB providers include IBM DB2, Oracle, Access, and Excel. Typically, linked servers are used to
handle distributed queries in SQL and Azure SQL server .
## Analysis Tasks for the SQL_LinkedServers Job
@@ -17,7 +17,7 @@ Navigate to the **Databases** > Jobs > SQL > 4.Configuration > SQL_LinkedServers
and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
pre-configured for this job.
:::
@@ -34,4 +34,4 @@ following preconfigured report:
| Report | Description | Default Tags | Report Elements |
| -------------- | ----------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Linked Servers | This report highlights Linked Servers where the listed SQL Server is able to execute remote commands. | None | This report is comprised of three elements: - Bar Chart – Provides information on top five linked servers by instance
- Table – Provides details on linked servers by instance
- Table – Provides details on linked servers
|
+| Linked Servers | This report highlights Linked Servers where the listed SQL Server can execute remote commands. | None | This report is comprised of three elements: - Bar Chart – Provides information on top five linked servers by instance
- Table – Provides details on linked servers by instance
- Table – Provides details on linked servers
|
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/overview.md b/docs/accessanalyzer/12.0/solutions/databases/sql/overview.md
index cc56a1f1ed..c7ba5bba47 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/overview.md
@@ -31,8 +31,8 @@ thread requires a minimum of 2 additional GB of RAM per host. For example, a job
:::note
The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and doesn't require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
+server. The JDK deployed is prepackaged and doesn't require any configuration. Netwrix preconfigures
+it to work with Access Analyzer, and you shouldn't customize it through Java. It will not
conflict with other JDKs or Java Runtimes in the same environment.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/overview.md b/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/overview.md
index e01fa62183..4d707cf76c 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/overview.md
@@ -14,7 +14,7 @@ level across all targeted SQL and Azure SQL servers.
The jobs in the 3.Permissions Job Group are:
- [SQL_ControlServer Job](/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_controlserver.md) – This job will provide information on control
- server permissions. Users with control server permissions allow users to command full control of a
+ server permissions. Users with control server permissions can command full control of a
SQL and Azure SQL server instances
- [SQL_DirectPermissions Job](/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_directpermissions.md) – This job will provide information about
the permissions granted to users at the schema, database, and server levels
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_controlserver.md b/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_controlserver.md
index f764aba89f..69e8dd651b 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_controlserver.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_controlserver.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Permissions > SQL_ControlServer > Confi
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_directpermissions.md b/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_directpermissions.md
index 45f49c09f7..136bd40f45 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_directpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_directpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Permissions > SQL_DirectPermissions > Co
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_domainuserpermissions.md b/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_domainuserpermissions.md
index 21f177e387..276a543f5b 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_domainuserpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_domainuserpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Permissions > SQL_DomainUserPermissions
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_publicpermissions.md b/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_publicpermissions.md
index 7867519f23..9d2c92aed3 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_publicpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_publicpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 5.Permissions > SQL_PublicPermissions > C
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -29,7 +29,7 @@ The default analysis tasks are:
- Public Permissions Summary – Creates the SA_SQLServer_PublicPermissions_DatabaseSummary table
accessible under the job’s Results node
- Public Permissions Summary – Highlights permissions that have been granted to the public role on
- objects that are not-default SQL or Azure SQL server objects
+ objects that aren't-default SQL or Azure SQL server objects
- Public Permissions Instance Summary (Non-Default) – Summarizes non-default SQL and Azure SQL
server public permissions by instance
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_serverpermissions.md b/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_serverpermissions.md
index 63941d4521..29b15e2675 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_serverpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/sql_serverpermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Permissions > SQL_ServerPermissions > C
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/recommended.md b/docs/accessanalyzer/12.0/solutions/databases/sql/recommended.md
index dd5433e622..7b5bcda339 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/recommended.md
@@ -19,13 +19,13 @@ Group. After you assign these to the job group, you can run it directly or sched
**Dependencies**
- .Active Directory Inventory Job Group run successfully
-- For Activity Auditing – SQL Server Audit Specifications to be configured on the target databases
+- For Activity Auditing – SQL Server Audit Specifications configured on the target databases
- Audit destination must be a binary file
- See the Microsoft
[Create a Server Audit and Database Audit Specification](https://docs.microsoft.com/en-us/sql/relational-databases/security/auditing/create-a-server-audit-and-database-audit-specification)
article for additional information.
-- For the SQL_SecurityAssessment Job – One or more of the following jobs or job groups must be run
- to produce results:
+- For the SQL_SecurityAssessment Job – To produce results, run one or more of the following jobs
+ or job groups:
- [0.Collection > SQL Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/collection/overview.md)
- [1.Users and Roles Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/overview.md)
- [3.Permissions Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/permissions/overview.md)
@@ -62,9 +62,9 @@ topic for additional information.
Assign the Connection Profile under the SQL > 0.Collection > Settings > Connection node.
It is set to Use the Default Profile, as configured at the global settings level. However, since
-this may not be the Connection Profile with the necessary permissions for the assigned hosts, click
-the radio button for the Select one of the following user defined profiles option and select the
-appropriate Connection Profile dropdown menu.
+this may not be the Connection Profile with the necessary permissions for the assigned hosts, select
+the Select one of the following user defined profiles option, then choose the appropriate profile
+from the Connection Profile dropdown menu.
See the [Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) topic for additional
information.
@@ -72,7 +72,7 @@ information.
**Schedule Frequency**
Schedule the SQL Job Group to run based on the types of auditing and the scope of the target
-environment. The general recommendation is to run the solution daily.
+environment. Run the solution daily.
**Run Order**
@@ -93,8 +93,8 @@ Prerequisites:
target SQL Server Databases. Audit destination for the configured server or database audit must be
a binary file.
- The 5-SQL_ServerSettings Job contains the Orphaned Users query which returns users that are
- orphaned for each database. The query uses the sp_Change_users_login procedure which requires the
- db_owner fixed database to be assigned to the Access Analyzer User. See the
+ orphaned for each database. The query uses the sp_Change_users_login procedure which requires assigning the
+ db_owner fixed database to the Access Analyzer User. See the
[sp_change_users_login (Transact-SQL)](https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-change-users-login-transact-sql?view=sql-server-ver15)
Microsoft article for additional information.
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/sensitivedata/sql_sensitivedata.md b/docs/accessanalyzer/12.0/solutions/databases/sql/sensitivedata/sql_sensitivedata.md
index 32a8038815..92317d0fd5 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/sensitivedata/sql_sensitivedata.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/sensitivedata/sql_sensitivedata.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 5.Sensitve Data > SQL_SensitiveData > Con
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/sensitivedata/sql_sensitivedatapermissions.md b/docs/accessanalyzer/12.0/solutions/databases/sql/sensitivedata/sql_sensitivedatapermissions.md
index a30e2c1bbb..785332edf6 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/sensitivedata/sql_sensitivedatapermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/sensitivedata/sql_sensitivedatapermissions.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 5.Sensitve Data > SQL_SensitiveDataPermi
node and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/sql_securityassessment.md b/docs/accessanalyzer/12.0/solutions/databases/sql/sql_securityassessment.md
index 3b5a56a83b..b09429c754 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/sql_securityassessment.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/sql_securityassessment.md
@@ -13,7 +13,7 @@ and NO FINDINGS categories based on severity.
**Special Dependencies**
-One or more of the following jobs or job groups must be run to produce results:
+To produce results, run one or more of the following jobs or job groups:
- [0.Collection > SQL Job Group](/docs/accessanalyzer/12.0/solutions/databases/sql/collection/overview.md)
- [SQL_PasswordIssues Job](/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_passwordissues.md)
@@ -23,7 +23,7 @@ One or more of the following jobs or job groups must be run to produce results:
- [Privileged Accounts Job Group](/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/overview.md)
- [Privileged Accounts Job Group](/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/overview.md)
-Only information collected from jobs/groups being run will produce findings.
+Only information from jobs or job groups that ran produces findings.
### Analysis Task for the SQL_SecurityAssessment Job
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_databaseprinciples.md b/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_databaseprinciples.md
index ee5f11be55..dc4f295070 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_databaseprinciples.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_databaseprinciples.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Users and Roles > SQL_DatabasePrinciple
and select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_passwordissues.md b/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_passwordissues.md
index f0d2526e92..3ba48507ae 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_passwordissues.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_passwordissues.md
@@ -15,7 +15,7 @@ weak passwords.
The Collect Weak Passwords Job uses the PowerShell Data Collector for the following query:
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -32,7 +32,7 @@ Navigate to the Jobs > **Databases** > SQL > 3.Users and Roles > SQL_PasswordIs
and select Analysis to view the analysis tasks.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified and or
+Most of these analysis tasks are preconfigured and shouldn't be modified and or
deselected unless otherwise specified.
:::
@@ -49,7 +49,7 @@ The default analysis tasks are:
[Configure the Customizable Parameters in an Analysis Task](/docs/accessanalyzer/12.0/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md)
topic for additional information on modifying analysis parameters.
- Shared Passwords – Highlights SQL Server Logins with shared password hashes
-- No Password – Inserts users that do not have a password set into the details table
+- No Password – Inserts users that don't have a password set into the details table
- Summarize the Weak Password Results – Summarizes the data that has been collected by the weak
passwords job
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_rolemembers.md b/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_rolemembers.md
index edd02763c2..5b8c63a015 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_rolemembers.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_rolemembers.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Users and Roles > SQL_RoleMembers > Conf
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_serverprincipals.md b/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_serverprincipals.md
index 16ae55744f..7f2ead1e61 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_serverprincipals.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_serverprincipals.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Users and Roles > SQL_ServerPrincipals
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_sqllogins.md b/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_sqllogins.md
index 10392eba35..a23206cf80 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_sqllogins.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_sqllogins.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Users and Roles > SQL_SQLLogins > Config
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_sysadmins.md b/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_sysadmins.md
index 4ea55eed3c..c74a1864ea 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_sysadmins.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/sql/usersroles/sql_sysadmins.md
@@ -15,7 +15,7 @@ Navigate to the **Databases** > SQL > 3.Users and Roles > SQL_SysAdmins > Config
Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task(s). The analysis task(s) are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/databases/update-schema.md b/docs/accessanalyzer/12.0/solutions/databases/update-schema.md
index 556b073957..b86c5a29fc 100644
--- a/docs/accessanalyzer/12.0/solutions/databases/update-schema.md
+++ b/docs/accessanalyzer/12.0/solutions/databases/update-schema.md
@@ -45,6 +45,6 @@ The shared patches applied by this job create the following objects in the stora
| `SA_DatabaseUsageMode` | Table | Lookup table for database usage modes (Oracle Service, Oracle SID, Redshift, Azure Managed Instance, Azure Stand Alone, etc.) |
| `SA_SQL_GetFriendlyName` | Function | Converts a host name, instance name, and port number from the `SA_SQL_Instances` table into a single display name |
-In addition to the shared patches above, each supported database platform (SQL Server, Oracle,
+In addition to the shared patches listed in the previous table, each supported database platform (SQL Server, Oracle,
MySQL, PostgreSQL, Db2 LUW, Azure SQL) registers its own set of vendor-specific schema patches
that are also applied by this job.
diff --git a/docs/accessanalyzer/12.0/solutions/dropbox/collection/1-dropbox_permissions_scan.md b/docs/accessanalyzer/12.0/solutions/dropbox/collection/1-dropbox_permissions_scan.md
index a26740d7fe..edb6052b02 100644
--- a/docs/accessanalyzer/12.0/solutions/dropbox/collection/1-dropbox_permissions_scan.md
+++ b/docs/accessanalyzer/12.0/solutions/dropbox/collection/1-dropbox_permissions_scan.md
@@ -10,7 +10,7 @@ The 1-Dropbox_Permissions Scan job collects data from the Dropbox environment on
sharing policies, configurations, and content.
:::warning
-This job should not be run if running sensitive data scans against the Dropbox Business
+This job shouldn't be run if running sensitive data scans against the Dropbox Business
environment.
:::
@@ -28,8 +28,8 @@ The query for the 1-Dropbox_Permissions Scan job is:
### Configure the Dropbox Access Query
-Follow the steps to either generate the access token needed for the Connection Profile (only done
-prior to first execution) or to set any desired customizations.
+To either generate the access token needed for the Connection Profile (only done
+before first execution) or to set any desired customizations, complete the following steps.
**Step 1 –** Navigate to the **Jobs** > **Dropbox** > **0.Collection** > **1-Dropbox_Permissions
Scan** > **Configure** node and select **Queries**.
@@ -42,13 +42,13 @@ Data Collector Wizard opens.
-**Step 4 –** T Use the Scan Options page ito generate the access token prior to the first execution
+**Step 4 –** T Use the Scan Options page ito generate the access token before the first execution
of the job group.
- Remember to copy the access token, either from the textbox or using the **Copy to Clipboard**
- button, and use it in the Connection Profile assigned to the Dropbox Solution. Once the access
- token has been generated and copied, if no customizations are to be made, click **Cancel** to
- close the Dropbox Access Auditor Data Collector wizard.
+ button, and use it in the Connection Profile assigned to the Dropbox Solution. After you generate
+ and copy the access token, click **Cancel** to close the Dropbox Access Auditor Data Collector
+ wizard if you don't need to make any customizations.
- See the [DropboxAccess: Scan Options](/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/scanoptions.md)
topic for full instructions on generating the access token
@@ -64,4 +64,4 @@ collect permissions at the file level. When finished with this page, click **Nex
**Step 7 –** On the Summary page, click **Finish** to save any setting modifications or click
**Cancel** if no changes were made. Then click **OK** to close the Query Properties window.
-If changes were made, the 1-Dropbox_Permissions Scan job has now been customized.
+If you made changes, you've now customized the 1-Dropbox_Permissions Scan job.
diff --git a/docs/accessanalyzer/12.0/solutions/dropbox/collection/1-dropbox_sdd_scan.md b/docs/accessanalyzer/12.0/solutions/dropbox/collection/1-dropbox_sdd_scan.md
index d0c8da422a..737b46d6da 100644
--- a/docs/accessanalyzer/12.0/solutions/dropbox/collection/1-dropbox_sdd_scan.md
+++ b/docs/accessanalyzer/12.0/solutions/dropbox/collection/1-dropbox_sdd_scan.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# 1-Dropbox_SDD Scan Job
The 1-Dropbox_SDD Scan job collects data from the Dropbox environment on access rights, sharing
-policies, configurations, content and sensitive data.
+policies, configurations, content, and sensitive data.
## Queries for the 1-Dropbox_SDD Scan Job
@@ -22,8 +22,8 @@ The query for the 1-Dropbox_SDD Scan job is:
### Configure the Sensitive Data Scan Query
-Follow the steps to either generate the access token needed for the Connection Profile (only done
-prior to first execution) or to set any desired customizations.
+To either generate the access token needed for the Connection Profile (only done
+before first execution) or to set any desired customizations, complete the following steps.
**Step 1 –** Navigate to the **Jobs** > **Dropbox** > **0.Collection** > **1-Dropbox_SDD Scan** >
**Configure** node and select **Queries**.
@@ -71,4 +71,4 @@ topic for additional information.
**Step 7 –** On the Completion Page, click **Finish** to save any setting modifications or click
**Cancel** if no changes were made. Then click **OK** to close the Query Properties window.
-If changes were made, the 1-Dropbox_SDD Scan job has now been customized.
+If you made changes, you've now customized the 1-Dropbox_SDD Scan job.
diff --git a/docs/accessanalyzer/12.0/solutions/dropbox/collection/2-dropbox_permissions_bulk_import.md b/docs/accessanalyzer/12.0/solutions/dropbox/collection/2-dropbox_permissions_bulk_import.md
index 1c6e00f127..300215f7a8 100644
--- a/docs/accessanalyzer/12.0/solutions/dropbox/collection/2-dropbox_permissions_bulk_import.md
+++ b/docs/accessanalyzer/12.0/solutions/dropbox/collection/2-dropbox_permissions_bulk_import.md
@@ -10,7 +10,7 @@ The 2-Dropbox_Permissions Bulk Import job imports the data collected by the 1-Dr
Scan job to the Access Analyzer database for use by the analysis tasks.
:::warning
-This job should not be run if running sensitive data scans against the Dropbox Business
+This job shouldn't be run if running sensitive data scans against the Dropbox Business
environment.
:::
@@ -27,6 +27,6 @@ The query for the 2-Dropbox_Permissions Bulk Import job is:
- Dropbox Bulk Import – Imports data collected by the 1-Dropbox_Permissions Scan job to the Access
Analyzer database
-There are no customization options available for this job. The Summary page of the Dropbox Access
-Auditor Data Collector wizard can be viewed at the **Jobs** > **Dropbox** > **0.Collection** >
+There are no customization options available for this job. View the Summary page of the Dropbox
+Access Auditor Data Collector wizard at the **Jobs** > **Dropbox** > **0.Collection** >
**2-Dropbox_Permissions Bulk Import** > **Configure** > **Queries** node.
diff --git a/docs/accessanalyzer/12.0/solutions/dropbox/collection/2-dropbox_sdd_bulk_import.md b/docs/accessanalyzer/12.0/solutions/dropbox/collection/2-dropbox_sdd_bulk_import.md
index 2536018f38..de9438a3e5 100644
--- a/docs/accessanalyzer/12.0/solutions/dropbox/collection/2-dropbox_sdd_bulk_import.md
+++ b/docs/accessanalyzer/12.0/solutions/dropbox/collection/2-dropbox_sdd_bulk_import.md
@@ -21,6 +21,6 @@ The query for the 2-Dropbox_SDD Bulk Import job is:
- DropboxSDD Bulk Import – Imports data collected by the Dropbox 1-SDD Scan Job into the Access
Analyzer database
-There are no customization options available for this job. The Summary page of the Dropbox Access
-Auditor Data Collector wizard can be viewed at the **Jobs** > **Dropbox** > **0.Collection** >
+There are no customization options available for this job. View the Summary page of the Dropbox
+Access Auditor Data Collector wizard at the **Jobs** > **Dropbox** > **0.Collection** >
**2-Dropbox_SDD Bulk Import** > **Configure** > **Queries** node.
diff --git a/docs/accessanalyzer/12.0/solutions/dropbox/collection/overview.md b/docs/accessanalyzer/12.0/solutions/dropbox/collection/overview.md
index 7be92240b8..a60e09886e 100644
--- a/docs/accessanalyzer/12.0/solutions/dropbox/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/dropbox/collection/overview.md
@@ -18,29 +18,29 @@ The 0.Collection job group is comprised of:
scanning the target Dropbox site
- [1-Dropbox_SDD Scan Job](/docs/accessanalyzer/12.0/solutions/dropbox/collection/1-dropbox_sdd_scan.md) – This job is responsible for scanning sensitive
data in the target Dropbox site. The Sensitive Data Discovery Add-On is required to run this job.
- The Dropbox sensitive data Discovery Reports in the Access Information Center are also populated
- by this data. See the Resource Audits Overview topic in the
+ This data also populates the Dropbox sensitive data Discovery Reports in the Access Information
+ Center. See the Resource Audits Overview topic in the
[Netwrix Access Information Center Documentation](https://helpcenter.netwrix.com/category/accessinformationcenter)
for additional information.
- [2-Dropbox_Permissions Bulk Import Job](/docs/accessanalyzer/12.0/solutions/dropbox/collection/2-dropbox_permissions_bulk_import.md) – This job is
responsible for importing the collected data into the Access Analyzer database
- [2-Dropbox_SDD Bulk Import Job](/docs/accessanalyzer/12.0/solutions/dropbox/collection/2-dropbox_sdd_bulk_import.md) – This job is responsible for
importing the collected sensitive data into the Access Analyzer database. The Sensitive Data
- Discovery Add-On is required to run this job. The Dropbox sensitive data Discovery Reports in the
- Access Information Center are also populated by this data. See the Resource Audits Overview topic
+ Discovery Add-On is required to run this job. This data also populates the Dropbox sensitive data
+ Discovery Reports in the Access Information Center. See the Resource Audits Overview topic
in the
[Netwrix Access Information Center Documentation](https://helpcenter.netwrix.com/category/accessinformationcenter)
for additional information.
The relationship between the scan and bulk import jobs requires the following considerations:
-- A scan job executed from an Access Analyzer Console must be followed by the corresponding bulk
- import job from the same Access Analyzer Console version
-- Two scan jobs processing the same information, for example two 1-Dropbox_Permissions Scan jobs,
- cannot be executed consecutively against the same target host. The corresponding bulk import job,
- for example 2-Dropbox_Permissions Bulk Import job, must be executed in between.
-- For the Dropbox Solution, the bulk import jobs require the same connection profile as used in the
- corresponding scan jobs
+- You must run the corresponding bulk import job, from the same Access Analyzer Console version,
+ immediately after a scan job executed from an Access Analyzer Console
+- You can't execute two scan jobs that process the same information, for example two
+ 1-Dropbox_Permissions Scan jobs, consecutively against the same target host. You must execute the
+ corresponding bulk import job, for example the 2-Dropbox_Permissions Bulk Import job, in between.
+- For the Dropbox Solution, the bulk import jobs require the same connection profile that the
+ corresponding scan jobs use
:::info
When running the sensitive data jobs, disable the permissions jobs, and vice
@@ -49,8 +49,8 @@ versa.
:::tip
-Remember, prior to running the Dropbox Solution for the first time, it is necessary to generate an
-access token to be used in the Connection Profile. This only needs to be done once. See the
+Remember, before running the Dropbox Solution for the first time, generate an
+access token to use in the Connection Profile. You only need to do this once. See the
[Configure the Dropbox Access Query](1-dropbox_permissions_scan.md#configure-the-dropbox-access-query)
topic for additional information.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_access.md b/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_access.md
index d6a885116e..11cb9716ca 100644
--- a/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_access.md
+++ b/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_access.md
@@ -21,7 +21,7 @@ View the analysis tasks by navigating to the **Jobs** > **Dropbox** > **1.Access
pbox_Access** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_content.md b/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_content.md
index fb94ade45e..e0002d2b01 100644
--- a/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_content.md
+++ b/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_content.md
@@ -16,8 +16,8 @@ The Dropbox_Content job is located in the 4.Content job group.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
-parameters used by analysis tasks in the job. See the
+Use the Configuration section on a Job's overview page to modify any customizable parameters used
+by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -35,7 +35,7 @@ View the analysis tasks by navigating to the **Jobs** > **Dropbox** > **4.Conten
**Dropbox_Content** > **Configure** node and select **Analysis**.
:::warning
-Most of the analysis tasks should not be modified or deselected. The analysis tasks are
+Most of the analysis tasks shouldn't be modified or deselected. The analysis tasks are
preconfigured for this job.
:::
@@ -66,8 +66,8 @@ Dropbox_Content job produces the following pre-configured reports.
### Customizable Analysis Tasks for the Dropbox_Content Job
The time frame used to define stale content is set by default to 365 days. This can be modified
-within the **Determines stale data by owner** analysis task. The customizable parameter feature
-enables you to easily set this value.
+within the **Determines stale data by owner** analysis task. Use the customizable parameter feature
+to set this value.
| Customizable Parameter Name | Default Value | Value Indicates |
| --------------------------- | ------------- | --------------------------------------------------------------------------------------------- |
diff --git a/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_groupmembership.md b/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_groupmembership.md
index a0127d6b2a..56921c3897 100644
--- a/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_groupmembership.md
+++ b/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_groupmembership.md
@@ -20,7 +20,7 @@ View the analysis tasks by navigating to the **Jobs** > **Dropbox** > **3.Group
**Dropbox_GroupMembership** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_sensitivedata.md b/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_sensitivedata.md
index d6fe1a48c5..8a20273792 100644
--- a/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_sensitivedata.md
+++ b/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_sensitivedata.md
@@ -22,7 +22,7 @@ View the analysis tasks by navigating to the **Jobs** > **Dropbox** > **5.Sensit
**Dropbox_SensitiveData** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -46,5 +46,5 @@ the Dropbox_SensitiveData job produces the following pre-configured reports.
| Report | Description | Default Tags | Report Elements |
| -------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Enterprise Summary | This report identifies the type and amount of sensitive content found on Dropbox. | None | This report is comprised of two elements: - Pie Chart – Displays criteria summary by match count
- Table – Provides criteria summary by match count
|
-| Folder Details | This report identifies the location of sensitive data, and flags whether or not this data is accessible through open access. | None | This report is comprised of three elements: - Bar Chart – Displays top sensitive folders by file count
- Table – Provides top sensitive folders by file count
- Table – Provides top sensitive folder details by match count
|
+| Folder Details | This report identifies the location of sensitive data, and flags whether this data is accessible through open access. | None | This report is comprised of three elements: - Bar Chart – Displays top sensitive folders by file count
- Table – Provides top sensitive folders by file count
- Table – Provides top sensitive folder details by match count
|
| Sensitive Data Permissions | This report identifies the sensitive data locations and associated permissions. | None | This report is comprised of three elements: - Bar Chart – Displays sensitive data permission summary by file count
- Table – Provides sensitive data permission summary by file count
- Table – Provides sensitive data permissions by match count
|
diff --git a/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_sharing.md b/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_sharing.md
index 9671440993..7e842f40c6 100644
--- a/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_sharing.md
+++ b/docs/accessanalyzer/12.0/solutions/dropbox/dropbox_sharing.md
@@ -9,9 +9,9 @@ sidebar_position: 40
The Dropbox_Sharing job provides insight into the sharing of resources within the targeted Dropbox
environment. It is dependent on data collected by the 0.Collection job group. This job processes
analysis tasks and generates a report on which resources are being shared and under which policy the
-sharing occurs. Best practices often dictate that these resources should be carefully monitored due
-to the amount of access to the data. If these resources contain privileged data, the access should
-be reevaluated or the sensitive resources relocated.
+sharing occurs. Best practices recommend closely monitoring these resources due
+to the amount of access to the data. If these resources contain privileged data, reevaluate the
+access or relocate the sensitive resources.
@@ -23,7 +23,7 @@ View the analysis tasks by navigating to the **Jobs** > **Dropbox** > **2.Sharin
**Dropbox_Sharing** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/dropbox/overview.md b/docs/accessanalyzer/12.0/solutions/dropbox/overview.md
index 9286ca99a7..5327b0a37e 100644
--- a/docs/accessanalyzer/12.0/solutions/dropbox/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/dropbox/overview.md
@@ -35,13 +35,13 @@ topic for additional information.
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if the job is configured to
+scan 8 hosts at a time, the job requires an extra 16 GB of RAM (8x2=16).
:::note
The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
+server. The JDK deployed is prepackaged and doesn't require any configuration; it has been
preconfigured to work with Access Analyzer and should never be customized through Java. It will not
conflict with other JDKs or Java Runtimes in the same environment.
:::
@@ -49,9 +49,8 @@ conflict with other JDKs or Java Runtimes in the same environment.
**Location**
-The Dropbox Solution requires a special Access Analyzer license. It can be installed from the
-Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to the solution:
-**Jobs** > **Dropbox**.
+The Dropbox Solution requires a special Access Analyzer license. Install it from the Instant Job
+Wizard. After you install it into the Jobs tree, navigate to the solution: **Jobs** > **Dropbox**.
The 0.Collection job group collects the data. The other job groups run analyses on the collected
data and generate reports.
@@ -59,8 +58,7 @@ data and generate reports.
## Job Groups
The Dropbox Solution offers an overview of an organization’s Dropbox environment by scanning the
-targeted Dropbox site. It is comprised of jobs which collect, analyze, and report on data. The data
-collection is conducted by the DropboxAccess Data Collector. See the
+targeted Dropbox site. It is comprised of jobs which collect, analyze, and report on data. The DropboxAccess Data Collector collects the data. See the
[Standard Reference Tables & Views for the DropboxAccess Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/standardtables.md)
topic for database table information.
diff --git a/docs/accessanalyzer/12.0/solutions/dropbox/recommended.md b/docs/accessanalyzer/12.0/solutions/dropbox/recommended.md
index d7320121cc..3d016a4075 100644
--- a/docs/accessanalyzer/12.0/solutions/dropbox/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/dropbox/recommended.md
@@ -6,24 +6,25 @@ sidebar_position: 10
# Recommended Configurations for the Dropbox Solution
-The Dropbox Solution requires the host list to be assigned and the Connection Profile configured
-before job execution. Once these are assigned to the job group, it can be run directly or scheduled.
+The Dropbox Solution requires you to assign the host list and configure the Connection Profile
+before job execution. After you assign these to the job group, you can run it directly or schedule
+it.
**Targeted Hosts**
The Dropbox solution has been configured to inherit the host list assignment from the collection job
group level.
-The host list assignment should be assigned under the **Dropbox** > **0.Collection** >
-**Settings** > **Host List Assignment** node. Select the **Local host** option.
+Assign the host list under the **Dropbox** > **0.Collection** > **Settings** > **Host List
+Assignment** node. Select the **Local host** option.
**Connection Profile**
The DropboxAccess Data Collector requires a specific set of permissions to generate an access token
which is used to configure the Connection Profile for Dropbox. The access token is generated in the
Dropbox Access Auditor Data Collector Wizard on the Scan Options page (accessed through the
-**1-Dropbox_Permissions Scan** job’s **Queries** node). The access token only needs to be generated
-once, prior to running the job group for the first time. Then it is used as the credential in the
+**1-Dropbox_Permissions Scan** job’s **Queries** node). You only need to generate the access token
+once, before running the job group for the first time. Then it is used as the credential in the
Connection Profile. See the
[DropboxAccess: Scan Options](/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/scanoptions.md) topic for
additional information.
@@ -33,21 +34,21 @@ group level. The Connection Profile should be assigned under the **Dropbox** > *
**Settings** > **Connection** node. It is set to **Use the Default Profile**, as configured at the
global settings level. However, since this may not be the Connection Profile with the necessary
permissions for Dropbox, select the **Select one of the following user defined profiles** option and
-select the appropriate Connection Profile from the drop-down menu. See the
+select the appropriate Connection Profile from the dropdown menu. See the
[Custom Dropbox Connection Profile & Host List](/docs/accessanalyzer/12.0/admin/datacollector/dropboxaccess/configurejob.md)
topic for additional information on configuring the Dropbox credential. The Dropbox bulk import jobs
-requires the same connection profile as used in the corresponding Dropbox scan jobs
+require the same connection profile that the corresponding Dropbox scan jobs use.
See the [Connection](/docs/accessanalyzer/12.0/admin/settings/connection/overview.md) topic for additional information
on creating Connection Profiles.
**Schedule Frequency**
-The Dropbox solution can be scheduled to run as desired.
+Schedule the Dropbox solution to run as desired.
**History Retention**
-Not supported and should be turned off.
+History retention isn't supported for the Dropbox Solution. Turn it off.
**Multi Console Support**
@@ -55,7 +56,7 @@ Not supported.
**Run Order**
-The 0.Collection jobs must be run first and in order. Run the **1-Dropbox_Permissions Scan** job and
+Run the 0.Collection jobs first and in order. Run the **1-Dropbox_Permissions Scan** job and
then the **2-Dropbox_Permissions Bulk Import** job. For the sensitive data jobs, run the
**1-Dropbox_SDD Scan** job and then the **2-Dropbox_SDD Bulk Import** job.
@@ -65,7 +66,7 @@ versa.
:::
-After running the 0.Collection jobs, the other Dropbox solution job groups can be run in any order.
+After running the 0.Collection jobs, you can run the other Dropbox solution job groups in any order.
Best practice is to run at the solution level.
**Query Configuration**
@@ -80,12 +81,12 @@ information.
This solution should be run with the default analysis configuration.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this solution.
:::
-Though the analysis tasks should not be deselected the time frame used to define staleness can be
+Though the analysis tasks shouldn't be deselected the time frame used to define staleness can be
modified:
- Stale content set to default of 365 days
@@ -98,7 +99,7 @@ modified:
The jobs contained in the solution use custom SQL scripts to render views on collected data. SQL
views are used to populate report element tables and graphs. Changing or modifying the group, job,
-or table names will result in no data displayed within the Access Information Center.
+or table names causes the Access Information Center to display no data.
**Workflow**
@@ -110,11 +111,11 @@ Scan** job).
**Step 2 –** Run the **2-Dropbox_Permissions Bulk Import** job (for sensitive data, run the
**2-Dropbox_SDD Bulk Import** job).
-**Step 3 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 3 –** Run the corresponding analysis and reporting sub-job groups you want.
:::tip
-Remember, prior to running the Dropbox solution for the first time, it is necessary to generate an
-access token to be used in the Connection Profile. This only needs to be done once. See the
+Remember, before running the Dropbox solution for the first time, generate an
+access token to use in the Connection Profile. You only need to do this once. See the
[Configure the Dropbox Access Query](collection/1-dropbox_permissions_scan.md#configure-the-dropbox-access-query)
topic for additional information.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_circularnesting.md b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_circularnesting.md
index 092369a474..a8f42c6ab3 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_circularnesting.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_circularnesting.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_CircularNesting**
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_duplicategroups.md b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_duplicategroups.md
index 1c138602ef..401464bd9f 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_duplicategroups.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_duplicategroups.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_DuplicateGroups**
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_emptygroups.md b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_emptygroups.md
index 268871e27f..e82be477bf 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_emptygroups.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_emptygroups.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_EmptyGroups** > *
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_groupdirsync.md b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_groupdirsync.md
index 9d6da1dc9b..ee4ca26af8 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_groupdirsync.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_groupdirsync.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_GroupDirSync** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_largestgroups.md b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_largestgroups.md
index be816e8322..215618da3d 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_largestgroups.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_largestgroups.md
@@ -6,9 +6,9 @@ sidebar_position: 50
# AAD_LargestGroups Job
-The AAD_LargestGroups Job identifies groups with large effective member counts. These groups may
-cause administrative overhead and burden in being able to easily understand who is getting access to
-resources, or how much access is being granted to resources through these groups.
+The AAD_LargestGroups Job identifies groups with large effective member counts. These groups can
+create administrative overhead, making it hard to see who has access to resources and how much
+access these groups grant.
## Analysis Tasks for the AAD_LargestGroups Job
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_LargestGroups** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_nestedgroups.md b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_nestedgroups.md
index f2bc2567eb..6f62a70f0a 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_nestedgroups.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_nestedgroups.md
@@ -7,9 +7,9 @@ sidebar_position: 60
# AAD_NestedGroups Job
The AAD_NestedGroups Job identifies nested groups within Microsoft Entra ID and provides details
-such as the levels of nesting. While Microsoft Entra ID provides the ability to nest certain types
-of groups within other groups, Microsoft recommends nesting does not go beyond two levels in order
-to avoid difficulties in understanding effective membership and access.
+such as the levels of nesting. While Microsoft Entra ID lets you nest certain types
+of groups within other groups, Microsoft recommends nesting doesn't go beyond two levels to avoid
+difficulties in understanding effective membership and access.
## Analysis Tasks for the AAD_NestedGroups Job
@@ -17,7 +17,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_NestedGroups** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_probableowners.md b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_probableowners.md
index 5aff291057..9c39393cac 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_probableowners.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_probableowners.md
@@ -6,9 +6,9 @@ sidebar_position: 70
# AAD_ProbableOwners Job
-The AAD_ProbableOwners Job determines potential owners for Microsoft Entra ID Groups which can be
-used to perform automated membership reviews and enable self-service group management and membership
-requests.
+The AAD_ProbableOwners Job determines potential owners for Microsoft Entra ID groups. Use these
+results to perform automated membership reviews and enable self-service group management and
+membership requests.
## Analysis Tasks for the AAD_ProbableOwners Job
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_ProbableOwners**
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_stalegroups.md b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_stalegroups.md
index 5d5c862d55..f8477859d2 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_stalegroups.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_stalegroups.md
@@ -17,7 +17,7 @@ Navigate to the **Jobs** > **Entra ID** > **1.Groups** > **AAD_StaleGroups** > *
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -38,4 +38,4 @@ following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Stale Effective Membership (Stale Groups) | This report identifies groups with stale effective membership. A stale user is defined as someone who has not logged into the domain in over 30 days or is currently disabled. | None | This report is comprised of three elements: - Chart – Displays group membership
- Table – Provides group membership details
- Tables – Provides stale groups organization summary
|
+| Stale Effective Membership (Stale Groups) | This report identifies groups with stale effective membership. A stale user is defined as someone who has not logged into the domain in over 30 days or is disabled. | None | This report is comprised of three elements: - Chart – Displays group membership
- Table – Provides group membership details
- Tables – Provides stale groups organization summary
|
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/groups/overview.md b/docs/accessanalyzer/12.0/solutions/entraid/groups/overview.md
index 266cb0938d..ccbb137453 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/groups/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/groups/overview.md
@@ -24,15 +24,14 @@ The jobs in the 1.Groups Job Group are:
- [AAD_GroupDirSync Job](/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_groupdirsync.md) – Summarizes on-premises Active Directory syncing in
the audited Microsoft Entra ID environment
- [AAD_LargestGroups Job](/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_largestgroups.md) – Identifies groups with large effective member
- counts. These types of groups may cause administrative overhead and burden in being able to easily
- understand who is getting access to resources, or how much access is being granted to resources
- through these groups.
+ counts. These types of groups can create administrative overhead, making it hard to see who has
+ access to resources and how much access these groups grant.
- [AAD_NestedGroups Job](/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_nestedgroups.md) – Identifies nested groups within Microsoft Entra ID
- and provides details such as the levels of nesting. While Microsoft Entra ID provides the ability
- to nest certain types of groups within other groups, Microsoft recommends nesting does not go
- beyond two levels in order to avoid difficulties in understanding effective membership and access.
+ and provides details such as the levels of nesting. While Microsoft Entra ID lets you nest
+ certain types of groups within other groups, Microsoft recommends nesting doesn't go
+ beyond two levels to avoid difficulties in understanding effective membership and access.
- [AAD_ProbableOwners Job](/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_probableowners.md) – Determines potential owners for Microsoft Entra
- ID Groups which can be used to perform automated membership reviews and enable self-service group
+ ID groups. Use these results to perform automated membership reviews and enable self-service group
management and membership requests
- [AAD_StaleGroups Job](/docs/accessanalyzer/12.0/solutions/entraid/groups/aad_stalegroups.md)– Identifies Microsoft Entra ID groups that contain
potentially stale users. Users are considered stale if they have never logged onto the domain,
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/overview.md b/docs/accessanalyzer/12.0/solutions/entraid/overview.md
index 53367cebff..9147aba68b 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/overview.md
@@ -24,7 +24,7 @@ for additional information.
The Entra ID Solution requires a special Access Analyzer license. It can be installed from the
Instant Job Wizard, see the [Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md) topic for
-additional information. Once it has been installed into the Jobs tree, navigate to the solution:
+additional information. After it's installed into the Jobs tree, navigate to the solution:
**Jobs** > **Entra ID**.
The .Entra ID Inventory Job Group collects the data. The Entra ID Job Groups run analysis and
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/recommended.md b/docs/accessanalyzer/12.0/solutions/entraid/recommended.md
index 3c022bc153..456cb324aa 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/recommended.md
@@ -21,15 +21,15 @@ information.
**Targeted Hosts**
-The Entra ID Solution does not require a target host because the jobs use data collected from the
+The Entra ID Solution doesn't require a target host because the jobs use data collected from the
.Entra ID Inventory Job Group and the .Active Directory Inventory Job Group. However, Access
-Analyzer jobs do not execute successfully without a host list assigned. Assign the host list under
+Analyzer jobs don't execute successfully without a host list assigned. Assign the host list under
the **Entra ID** > **Settings** > **Host Lists Assignment** node. Check the **Local host** box and
click **Save**.
**Connection Profile**
-Since the Entra ID Solution is not collecting any data, a specific connection profile is not
+Since the Entra ID Solution isn't collecting any data, a specific connection profile isn't
necessary. Therefore, the default setting **Use the Default Profile** is sufficient for this
solution.
@@ -51,10 +51,10 @@ information.
The following is the recommended workflow:
-**Step 1 –** Assign the Local host at the solution level as described above.
+**Step 1 –** Assign the Local host at the solution level as described previously.
-**Step 2 –** Run the .Entra ID Inventory Job Group. If on-premises directory syncing information is
-desired, run the .Active Directory Inventory Job Group.
+**Step 2 –** Run the .Entra ID Inventory Job Group. If you want on-premises directory syncing
+information, run the .Active Directory Inventory Job Group.
**Step 3 –** Schedule the solution to run as desired with consideration to the run schedules of the
solutions collecting data.
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/users/aad_directmembership.md b/docs/accessanalyzer/12.0/solutions/entraid/users/aad_directmembership.md
index bd5cdd4e76..1145929de8 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/users/aad_directmembership.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/users/aad_directmembership.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# AAD_DirectMembership Job
-The AAD_DirectMembership Job identifies Microsoft Entra ID users who do not have any group
+The AAD_DirectMembership Job identifies Microsoft Entra ID users who don't have any group
membership. This condition may indicate unnecessary user accounts that are suitable candidates for
review and cleanup.
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Entra ID** > **2.Users** > **AAD_DirectMembership**
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/users/aad_disabledusers.md b/docs/accessanalyzer/12.0/solutions/entraid/users/aad_disabledusers.md
index b62779946a..11d551206d 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/users/aad_disabledusers.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/users/aad_disabledusers.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# AAD_DisabledUsers Job
The AAD_DisabledUsers Job identifies disabled user accounts within Microsoft Entra ID. These
-accounts should be reviewed and cleaned up in order to increase security and reduce complexity.
+accounts should be reviewed and cleaned up to increase security and reduce complexity.
## Analysis Tasks for the AAD_DisabledUsers Job
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **2.Users** > **AAD_DisabledUsers** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/users/aad_staleusers.md b/docs/accessanalyzer/12.0/solutions/entraid/users/aad_staleusers.md
index 72b425fe40..cea18537e1 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/users/aad_staleusers.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/users/aad_staleusers.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# AAD_StaleUsers Job
The AAD_StaleUsers Job identifies potentially stale users based on a variety of factors. These
-accounts should be reviewed and cleaned up in order to increase security and reduce complexity.
+accounts should be reviewed and cleaned up to increase security and reduce complexity.
## Analysis Tasks for the AAD_StaleUsers Job
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **2.Users** > **AAD_StaleUsers** > **C
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -34,4 +34,4 @@ following pre-configured report.
| Report | Description | Default Tags | Report Elements |
| ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Stale Users | This report identifies user accounts which have not logged into the domain for an extended amount of time or are currently disabled. A user account is considered stale if the last logon is over 30 days ago or is currently disabled. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays users by domain
- Table – Provides details on users
- Tables – Provides details on users by domain
|
+| Stale Users | This report identifies user accounts which have not logged into the domain for an extended amount of time or are disabled. A user account is considered stale if the last logon is over 30 days ago or is disabled. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays users by domain
- Table – Provides details on users
- Tables – Provides details on users by domain
|
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/users/aad_userattributecompletion.md b/docs/accessanalyzer/12.0/solutions/entraid/users/aad_userattributecompletion.md
index 3d287aea16..f95116f5ac 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/users/aad_userattributecompletion.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/users/aad_userattributecompletion.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **Entra ID** > **2.Users** > **AAD_UserAttributeCompl
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/users/aad_userdirsync.md b/docs/accessanalyzer/12.0/solutions/entraid/users/aad_userdirsync.md
index 40764372a1..caa8c98170 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/users/aad_userdirsync.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/users/aad_userdirsync.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **Entra ID** > **2.Users** > **AAD_UserDirSync** > **
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraid/users/overview.md b/docs/accessanalyzer/12.0/solutions/entraid/users/overview.md
index 96608e6cf6..811f4b3b72 100644
--- a/docs/accessanalyzer/12.0/solutions/entraid/users/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/entraid/users/overview.md
@@ -17,10 +17,10 @@ The jobs in the 2.Users Job Group are:
not have any group membership. This condition may indicate unnecessary user accounts that are
suitable candidates for review and cleanup.
- [AAD_DisabledUsers Job](/docs/accessanalyzer/12.0/solutions/entraid/users/aad_disabledusers.md) – Identifies disabled user accounts within Microsoft
- Entra ID. These accounts should be reviewed and cleaned up in order to increase security and
+ Entra ID. These accounts should be reviewed and cleaned up to increase security and
reduce complexity.
- [AAD_StaleUsers Job](/docs/accessanalyzer/12.0/solutions/entraid/users/aad_staleusers.md)– Identifies potentially stale users based on a variety of
- factors. These accounts should be reviewed and cleaned up in order to increase security and reduce
+ factors. These accounts should be reviewed and cleaned up to increase security and reduce
complexity.
- [AAD_UserAttributeCompletion Job](/docs/accessanalyzer/12.0/solutions/entraid/users/aad_userattributecompletion.md)– Identifies which attributes are
present within User fields in Microsoft Entra ID, and which ones are blank for a majority of
diff --git a/docs/accessanalyzer/12.0/solutions/entraidinventory/1-aad_scan.md b/docs/accessanalyzer/12.0/solutions/entraidinventory/1-aad_scan.md
index 3e81a76e00..465cfb7d37 100644
--- a/docs/accessanalyzer/12.0/solutions/entraidinventory/1-aad_scan.md
+++ b/docs/accessanalyzer/12.0/solutions/entraidinventory/1-aad_scan.md
@@ -35,14 +35,14 @@ The 1-AAD_Scan job uses the AzureADInventory and Entra Data Collectors for the f
### Configure the AAD_Inventory Query
The 1-AAD_Scan job is configured to run with the default settings with the category of Scan Entra
-ID. Follow the steps to customize configurations.
+ID. To customize configurations:
**Step 1 –** Navigate to the **.Entra ID Inventory** > **1-AAD_Scan** > **Configure** node and
select **Queries**.
-**Step 2 –** In the Query Selection view, click on **Query Properties** to open the Query Properties
+**Step 2 –** In the Query Selection view, click **Query Properties** to open the Query Properties
window.
@@ -94,7 +94,7 @@ Navigate to the **.Entra ID Inventory** > **1-AAD_Scan** > **Configure** node an
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraidinventory/2-aad_exceptions.md b/docs/accessanalyzer/12.0/solutions/entraidinventory/2-aad_exceptions.md
index f89f17123f..c534e4df49 100644
--- a/docs/accessanalyzer/12.0/solutions/entraidinventory/2-aad_exceptions.md
+++ b/docs/accessanalyzer/12.0/solutions/entraidinventory/2-aad_exceptions.md
@@ -16,7 +16,7 @@ Navigate to the **.Entra ID Inventory** > **2-AAD_Exceptions** > **Configure** n
modified.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified and not be
+Most of these analysis tasks are preconfigured and shouldn't be modified or
deselected. There are a few which are deselected by default, as they are for troubleshooting
purposes.
:::
@@ -89,8 +89,7 @@ topic for an explanation of Exception Types.
Customizable parameters enable Access Analyzer users to set the values used to classify user and
group objects during this job’s analysis. The parameters can be customized and are listed in a
-section at the bottom of the SQL Script Editor. Follow the steps to customize an analysis task’s
-parameters.
+section at the bottom of the SQL Script Editor. To customize an analysis task’s parameters:
:::warning
Modifying these parameters affects solutions with .Entra ID Inventory Job Group
@@ -113,7 +112,7 @@ Configuration**. The SQL Script Editor opens.
**Step 4 –** Double-click in a field in the Value column and enter a custom value.
:::warning
-Do not change any parameters where the Value states **Created during execution**.
+Don't change any parameters where the Value states **Created during execution**.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/entraidinventory/recommended.md b/docs/accessanalyzer/12.0/solutions/entraidinventory/recommended.md
index 06ceaa3430..f2e1189ec7 100644
--- a/docs/accessanalyzer/12.0/solutions/entraidinventory/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/entraidinventory/recommended.md
@@ -12,7 +12,7 @@ to the job group, it can be run directly or scheduled.
**Dependencies**
-This job group does not have dependencies.
+This job group doesn't have dependencies.
**Targeted Hosts**
@@ -22,7 +22,7 @@ All Microsoft Entra Tenants.
The Connection Profile is assigned under **.Entra ID Inventory** > **Settings** > **Connection**. It
is set to **Use the Default Profile**, as configured at the global **Settings** level. However, if
-this is not the Connection Profile with the necessary permissions for targeting the Microsoft Entra
+this isn't the Connection Profile with the necessary permissions for targeting the Microsoft Entra
tenants, select the **Select one of the following user defined profiles** option and select the
appropriate Connection Profile. See the
[Microsoft Entra ID Connection Profile & Host List](/docs/accessanalyzer/12.0/admin/datacollector/azureadinventory/configurejob.md)
@@ -47,14 +47,14 @@ often. It is best to rerun it anytime Entra ID changes might have occurred.
**Run at the Solution Level**
-The jobs in the .Entra ID Inventory Job Group should be run together and in order by running the
-entire solution, instead of the individual jobs.
+Run the jobs in the .Entra ID Inventory Job Group together and in order by running the entire
+solution, instead of the individual jobs.
**Query Configuration**
-Run the solution with the default query configuration for best results. While it is recommended to
-make no changes to the [1-AAD_Scan Job](/docs/accessanalyzer/12.0/solutions/entraidinventory/1-aad_scan.md), a possible modification might be to scope
-the query to not collect login activity.
+Run the solution with the default query configuration for best results. It's best to leave the
+[1-AAD_Scan Job](/docs/accessanalyzer/12.0/solutions/entraidinventory/1-aad_scan.md) unchanged, but a possible modification is to scope
+the query to skip collecting sign-in activity.
**Analysis Configuration**
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_activesync.md b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_activesync.md
index 1b9e4dd22d..7c4025065f 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_activesync.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_activesync.md
@@ -18,7 +18,7 @@ View the analysis tasks by navigating to the **Exchange** > **2. CAS Metrics** >
**EX_ActiveSync** > **Configure** node and select **Analysis**.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified or
+Most of these analysis tasks are preconfigured and shouldn't be modified or
deselected. There are some that are deselected by default, as they are for troubleshooting purposes.
:::
@@ -50,7 +50,7 @@ The following analysis task deletes table data from the analysis jobs. This anal
remain cleared unless specifically needed:
:::warning
-Do not select the **00. Deletes all History** option. This analysis task is for
+Don't select the **00. Deletes all History** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
@@ -72,7 +72,7 @@ the following pre-configured reports:
| Report | Description | Default Tags | Report Elements |
| ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Device Types (Device Population) | This report identifies what device models are currently being used with ActiveSync, and the average load they put on the environment each day. | None | This report is comprised of two elements: - Bar Chart – Displays most popular devices
- Table – Provides details on most popular devices
|
+| Device Types (Device Population) | This report identifies what device models are being used with ActiveSync, and the average load they put on the environment each day. | None | This report is comprised of two elements: - Bar Chart – Displays most popular devices
- Table – Provides details on most popular devices
|
| Server Traffic (Top Servers by Average Daily Traffic) | This report ranks CAS servers by volume of ActiveSync traffic. | None | This report is comprised of two elements: - Bar Chart – Displays top users by average daily traffic
- Table – Provides details on top users by average daily traffic
|
| Top Users (Top Users by Average Daily Traffic) | This report shows the top users of ActiveSync. | None | This report is comprised of two elements: - Bar Chart – Displays top users by average daily traffic
- Table – Provides details on top users by average daily traffic
|
| User Devices (User Phones) | This report identifies all devices which have been associated with a User, and the time frames when they were used. | None | This report is comprised of one element: - Table – Provides details on user devices
|
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_aspolicies.md b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_aspolicies.md
index e959d2671f..05169fed8e 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_aspolicies.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_aspolicies.md
@@ -26,7 +26,7 @@ The following query is included in the EX_ASPolicies Job.
The ExchangePS Data Collector can be scoped if desired.
-Follow the steps to scope the ExchangePS Data Collector:
+To scope the ExchangePS Data Collector:
**Step 1 –** Navigate to job’s **Configure** node and select **Queries**.
@@ -37,28 +37,28 @@ Properties**. The Query Properties window opens.
Wizard opens.
:::warning
-Do not modify other wizard pages. The wizard pages are pre-configured for this job.
+Don't modify other wizard pages. The wizard pages are pre-configured for this job.
:::
-**Step 4 –** Navigate to the Scope page, and select the desired scoping method from those available.
+**Step 4 –** Navigate to the Scope page, and select the scoping method you want from those available.
See the [ExchangePS: Scope](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scope.md) topic for additional
information.
- Scope by Database – Select the **Scope by Database Target Host: Local Host** option. Then, click
- **Next** and identify the desired databases on the Scope by Databases page. See the
+ **Next** and identify the databases you want on the Scope by Databases page. See the
[ExchangePS: Scope by DB](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopedatabases.md) topic for
additional information.
- Scope by Mailbox – Select the **Scope by Mailbox Target Host: Local Host** option. Then, click
- **Next** and identify the desired mailboxes on the Scope by Mailboxes page. See the
+ **Next** and identify the mailboxes you want on the Scope by Mailboxes page. See the
[ExchangePS: Scope by Mailboxes](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopemailboxes.md) topic
for additional information.
- Scope by Server – Select the **Scope by Server Target Host: Exchange MB Server** option. The job
returns results for specific servers selected in job’s **Configure** > **Hosts** node.
- Scope by Public Folder – Select the **Scope by Public Folder** option. Then, click **Next** and
- identify the desired mailboxes on the Scope by Public Folders page. See the
+ identify the mailboxes you want on the Scope by Public Folders page. See the
[ExchangePS: Scope by Public Folders](/docs/accessanalyzer/12.0/admin/datacollector/exchangeps/scopepublicfolders.md) topic
for additional information.
- _Remember,_ the scoping options available vary based on the pre-defined query configurations.
@@ -73,7 +73,7 @@ View the analysis tasks by navigating to the **Exchange** > **2. CAS Metrics** >
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_iislogs.md b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_iislogs.md
index 4bb6eda1a6..544587cd31 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_iislogs.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_iislogs.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# 0.Collection > EX_IISLogs Job
-The 0.Collection > EX_IISLogs Job provides data collection to be utilized in the ActiveSync, Outlook
+The 0.Collection > EX_IISLogs Job provides data collection to be used in the ActiveSync, Outlook
Web Access, and Outlook Anywhere Reports. This job goes out to each server that contains the
IIS Logs and parses the log to return the data to the Access Analyzer database.
@@ -36,7 +36,7 @@ modified on the Target Log page of the SMART Log DC Wizard. See the
[SMARTLog Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/smartlog/overview.md) topic for additional
information.
-Follow the steps to modify the query configuration.
+To modify the query configuration:
**Step 1 –** Navigate to the **Exchange** > **2. CAS Metrics** > **0. Collection** >
**EX_IISLogs** > **Configure** node and select **Queries**.
@@ -47,7 +47,7 @@ opens.
**Step 3 –** Select the **Data Source** tab, and click **Configure**. The SMART Log DC Wizard opens.
:::warning
-Do not modify other wizard pages. The other wizard pages are pre-configured for this
+Don't modify other wizard pages. The other wizard pages are pre-configured for this
job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_owatraffic.md b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_owatraffic.md
index 289d37db36..083bef26e9 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_owatraffic.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_owatraffic.md
@@ -18,7 +18,7 @@ View the analysis tasks by navigating to the **Exchange** > **2. CAS Metrics** >
Access** > **EX_OWATraffic** > **Configure** node and select **Analysis**.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified ordeselected.
+Most of these analysis tasks are preconfigured and shouldn't be modified ordeselected.
There is one that is deselected by default, as it is for troubleshooting purposes.
:::
@@ -46,7 +46,7 @@ The following analysis task deletes table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **00. Delete all History** option. This analysis task is for
+Don't select the **00. Delete all History** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_rpctraffic.md b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_rpctraffic.md
index af0bcbff75..5aff79b1cb 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_rpctraffic.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_rpctraffic.md
@@ -19,7 +19,7 @@ View the analysis tasks by navigating to the **Exchange** > **2. CAS Metrics** >
Anywhere** > **EX_RPCTraffic** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -47,7 +47,7 @@ The following analysis tasks deletes table data from data collection and analysi
analysis tasks should remain cleared unless specifically needed:
:::warning
-Do not select the **00. Delete all History** option. This analysis task is for
+Don't select the **00. Delete all History** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/overview.md b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/overview.md
index 4f773c431b..22bc918d5d 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# 2.CAS Metrics Job Group
-The 2. CAS Metrics Job Group is comprised of data collection, analysis and reports that focus on
+The 2. CAS Metrics Job Group is comprised of data collection, analysis, and reports that focus on
remote connections (Outlook Web Access, ActiveSync, and Outlook Anywhere Access) occurring within
your organization. This job group goes out to each server that contains the IIS Logs and parses the
logs to return the data to the Access Analyzer database.
@@ -15,7 +15,7 @@ logs to return the data to the Access Analyzer database.
The jobs in the 2.CAS Metrics Job Group are:
-- [0.Collection > EX_IISLogs Job](/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_iislogs.md) – Provides data collection to be utilized in the
+- [0.Collection > EX_IISLogs Job](/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/ex_iislogs.md) – Provides data collection to be used in the
ActiveSync, Outlook Web Access, and Outlook Anywhere Reports. This job group goes out to each
server that contains the IIS Logs and parses the logs to return the data to the Access
Analyzer database.
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/recommended.md b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/recommended.md
index fe03b7c152..4e910d204c 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/recommended.md
@@ -60,7 +60,7 @@ Run this Job Group at 2:00 AM.
**History Retention**
-History retention should not be enabled on this job group. History is kept through analysis tasks.
+History retention shouldn't be enabled on this job group. History is kept through analysis tasks.
Modify the following analysis tasks to customize the amount of history which is kept.
| Job Name | Analysis Task Name | Default History |
@@ -84,12 +84,12 @@ No other queries should be modified.
The 2. CAS Metrics Job Group should be run with the default analysis configurations.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified or
+Most of these analysis tasks are preconfigured and shouldn't be modified or
deselected. There are some that are deselected by default, as they are for troubleshooting purposes.
:::
-The following analysis tasks should not be deselected, but their parameters can be modified:
+The following analysis tasks shouldn't be deselected, but their parameters can be modified:
- **ActiveSync** > **EX_ActiveSync** Job – **07. SET HISTORY RETENTION** Analysis Task
- **Outlook Anywhere** > **EX_RPCTraffic** Job – **05. SET HISTORY RETENTION** Analysis Task
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/ex_dbinfo.md b/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/ex_dbinfo.md
index 364e39f368..4f16b34cae 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/ex_dbinfo.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/ex_dbinfo.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# 1.Local > EX_DBInfo Job
-The EX_DBInfo job utilizes Exchange PowerShell to gather 2010/2013 Mailbox Size information.
+The EX_DBInfo job uses Exchange PowerShell to gather 2010/2013 Mailbox Size information.
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/ex_pfinfo.md b/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/ex_pfinfo.md
index 0fb7196ea1..84564fd0e6 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/ex_pfinfo.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/ex_pfinfo.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# 2.PF > EX_PFInfo Job
-The EX_PFInfo job utilizes MAPI to gather Public Folder Database Information focusing on database
+The EX_PFInfo job uses MAPI to gather Public Folder Database Information focusing on database
sizing, growth, and trends.
@@ -18,7 +18,7 @@ The EX_PFInfo job is located in the 2.PF job group.
The EX_PFInfo Job uses the Exchange2K Data Collector for the query.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/overview.md b/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/overview.md
index 692a6f50fd..ea72783600 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/overview.md
@@ -13,7 +13,7 @@ database sizing, growth, and trends.
The jobs in the 0.Collection Job Group are:
-- [1.Local > EX_DBInfo Job](/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/ex_dbinfo.md) – Utilizes Exchange PowerShell to gather 2010/2013 Mailbox
+- [1.Local > EX_DBInfo Job](/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/ex_dbinfo.md) – uses Exchange PowerShell to gather 2010/2013 Mailbox
Size Information
-- [2.PF > EX_PFInfo Job](/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/ex_pfinfo.md) – Utilizes MAPI to gather Public Folder Database Information
+- [2.PF > EX_PFInfo Job](/docs/accessanalyzer/12.0/solutions/exchange/databases/collection/ex_pfinfo.md) – uses MAPI to gather Public Folder Database Information
focusing on database sizing, growth, and trends
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/databases/ex_dbsizing.md b/docs/accessanalyzer/12.0/solutions/exchange/databases/ex_dbsizing.md
index 35038c13ac..719aafc1a8 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/databases/ex_dbsizing.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/databases/ex_dbsizing.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **3. Databases** > *
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -44,7 +44,7 @@ The following analysis task deletes table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **00. Deletes all Stored Data** option. This analysis task is for
+Don't select the **00. Deletes all Stored Data** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
@@ -60,7 +60,7 @@ following pre-configured reports:
| Report | Description | Default Tags | Report Elements |
| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Database Details (Storage Group Details) | This report provides the details of Mailbox Stores grouped by Server, then Storage Group. This report helps administrators locate Storage Groups that may be growing out of control. If a storage group with very few users is extremely large, further investigation may be required. | None | This report is comprised of two elements: - Bar Chart – Displays database sizes
- Table – Provides details on database sizes
|
-| Database Growth Statistics | This report displays the top 10 Databases that grew over the last 30 days in pure MB. This report is filtered on the Rank Column for Top 10 and may be modified to fit any desired Top outcome. | None | This report is comprised of four elements: - Stacked Bar Chart – Displays store size growth
- Stacked Bar Chart – Displays WhiteSpace growth
- Table – Provides details on store size growth
- Table – Provides details on WhiteSpace growth
|
+| Database Details (Storage Group Details) | This report provides the details of Mailbox Stores grouped by Server, then Storage Group. This report helps administrators locate Storage Groups with unchecked growth. If a storage group with very few users is extremely large, investigate further. | None | This report is comprised of two elements: - Bar Chart – Displays database sizes
- Table – Provides details on database sizes
|
+| Database Growth Statistics | This report displays the top 10 Databases that grew over the last 30 days in pure MB. This report filters on the Rank column for the top 10 results, but you can modify it to show a different top number. | None | This report is comprised of four elements: - Stacked Bar Chart – Displays store size growth
- Stacked Bar Chart – Displays WhiteSpace growth
- Table – Provides details on store size growth
- Table – Provides details on WhiteSpace growth
|
| Historical Database Information | This report shows the history of the store size, white space, mailbox count, and hard drive space on all targeted servers. | None | This report is comprised of one element: - Table – Displays details on historical store information
|
-| Mailbox Counts by Database | This report graphically displays the number of Mailboxes by Database. It provides an overall picture of the Exchange Mailbox Environment. Having a clear break down of the number of mailboxes per database allows for better planning of architecture in the future. | None | This report is comprised of two elements: - Bar Chart – Displays mailbox counts by database
- Table – Provides details on mailbox counts by database
|
+| Mailbox Counts by Database | This report graphically displays the number of Mailboxes by Database. It provides an overall picture of the Exchange Mailbox Environment. A clear breakdown of mailbox counts per database helps you plan future architecture. | None | This report is comprised of two elements: - Bar Chart – Displays mailbox counts by database
- Table – Provides details on mailbox counts by database
|
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/databases/ex_dbtrending.md b/docs/accessanalyzer/12.0/solutions/exchange/databases/ex_dbtrending.md
index 6f1fccff1e..5bc274b434 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/databases/ex_dbtrending.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/databases/ex_dbtrending.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **3. Databases** > *
**Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -39,4 +39,4 @@ the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Capacity Planning | This report displays the growth rate trend of your private stores and the growth rate trend of your public stores. The trend is projected for two months. These reports help identify bad trends in growth on Exchange servers for hard drive space usage is key in avoiding running out of space. | None | This report is comprised of two elements: - Line Chart – Displays private store trend
- Line Chart – Displays public store trend
|
+| Capacity Planning | This report displays the growth rate trend of your private stores and the growth rate trend of your public stores. The trend is projected for two months. These reports help identify bad growth trends on Exchange servers, since managing hard drive space usage is key to avoiding running out of space. | None | This report is comprised of two elements: - Line Chart – Displays private store trend
- Line Chart – Displays public store trend
|
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/databases/overview.md b/docs/accessanalyzer/12.0/solutions/exchange/databases/overview.md
index 0a35c89fee..7424964f51 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/databases/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/databases/overview.md
@@ -22,7 +22,7 @@ The following comprise the 3. Databases Job Group:
The 3. Databases Job Group uses a MAPI-based data collector, Exchange2K. Therefore, it requires both
Access Analyzer MAPI CDO and Microsoft Exchange MAPI CDO to be installed on the Access Analyzer
-Console server. Once these have been installed, the **Settings** > **Exchange** node must be
+Console server. After these are installed, the **Settings** > **Exchange** node must be
configured for proper connection to the Exchange server.
See the [Exchange](/docs/accessanalyzer/12.0/admin/settings/exchange.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/databases/recommended.md b/docs/accessanalyzer/12.0/solutions/exchange/databases/recommended.md
index 706566b6ca..bfbc7bbe0f 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/databases/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/databases/recommended.md
@@ -56,7 +56,7 @@ Run this Job Group at 3:00 AM.
**History Retention**
-History retention should not be enabled on this job group. History is kept through analysis tasks.
+History retention shouldn't be enabled on this job group. History is kept through analysis tasks.
Modify the following analysis tasks to customize the amount of history which is kept:
| Job Name | Analysis Task Name | Default History |
@@ -82,7 +82,7 @@ deselected. There are some that are deselected by default, as they are for troub
:::
-The following analysis task should not be deselected, but the parameters can be modified:
+The following analysis task shouldn't be deselected, but the parameters can be modified:
- **EX_DBSizing** Job – **SET HISTORY RETENTION** Analysis Task
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/ex_dlcleanup.md b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/ex_dlcleanup.md
index c20d1bfb83..47d705181f 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/ex_dlcleanup.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/ex_dlcleanup.md
@@ -16,7 +16,7 @@ View the analysis task by navigating to the **Exchange** > **6. Distribution Lis
**EX_DLCleanup** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/ex_groupexpansion.md b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/ex_groupexpansion.md
index 11d3d97525..5b354cbdbb 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/ex_groupexpansion.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/ex_groupexpansion.md
@@ -18,7 +18,7 @@ View the analysis tasks by navigating to the **Exchange** > **6. Distribution Li
Membership** > **EX_GroupExpansion** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_circularnesting.md b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_circularnesting.md
index d2b0071b75..d063b207b4 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_circularnesting.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_circularnesting.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **6. Distribution Li
Analysis** > **EX_CircularNesting** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_emptygroups.md b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_emptygroups.md
index fe9661aec6..ac3a062430 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_emptygroups.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_emptygroups.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **6. Distribution Li
Analysis** > **EX_EmptyGroups** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_largestgroups.md b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_largestgroups.md
index da59184b01..568e747d9a 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_largestgroups.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_largestgroups.md
@@ -14,7 +14,7 @@ View the analysis task by navigating to the **Exchange** > **6. Distribution Lis
Analysis** > **EX_LargestGroups** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_nestedgroups.md b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_nestedgroups.md
index 37f75161e0..ecc41a92da 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_nestedgroups.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_nestedgroups.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **6. Distribution Li
Analysis** > **EX_NestedGroups** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_stalegroups.md b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_stalegroups.md
index 7fdda5586e..98aec367c3 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_stalegroups.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/membershipanalysis/ex_stalegroups.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **6. Distribution Li
Analysis** > **EX_StaleGroups** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/recommended.md b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/recommended.md
index 899adaf8bf..3602c9cb54 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/distributionlists/recommended.md
@@ -25,7 +25,7 @@ The following job groups need to be successfully run:
**Schedule Frequency**
This job group has been designed to run daily after the .Active Directory Inventory Job Group has
-been run, to analyze distribution list membership. This job group does not collect data. It uses the
+been run, to analyze distribution list membership. This job group doesn't collect data. It uses the
data collection from the .Active Directory Inventory Job Group.
:::info
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/ex_useroverview.md b/docs/accessanalyzer/12.0/solutions/exchange/ex_useroverview.md
index ccdb4051c3..4297da22c0 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/ex_useroverview.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/ex_useroverview.md
@@ -15,7 +15,7 @@ environment.
**Dependencies**
-The following job groups need to be successfully run prior to this job:
+The following job groups need to be successfully run before this job:
- **.Active Directory Inventory** Job Group
- **.Entra ID Inventory** Job Group
@@ -27,8 +27,7 @@ The following job groups need to be successfully run prior to this job:
**Schedule Frequency**
-It is recommended to run this job daily after running its dependencies, but it can be scheduled to
-run as desired.
+Run this job daily after its dependencies run, but you can schedule it at another time if needed.
## Analysis Tasks for the EX_Mailflow_UserOverview Job
@@ -36,7 +35,7 @@ View the analysis task by navigating to the **Exchange** > **EX_UserOverview** >
and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/appletstatuscheck.md b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/appletstatuscheck.md
index 6ac184610b..3a6b0472be 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/appletstatuscheck.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/appletstatuscheck.md
@@ -14,7 +14,7 @@ Exchange servers.
The .AppletStatusCheck Job uses the Script Data Collector.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/ex_metricscollection.md b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/ex_metricscollection.md
index ab0ff8c5e0..b7e66a0406 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/ex_metricscollection.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/ex_metricscollection.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# EX_MetricsCollection Job
-The EX_MetricsCollection Job is comprised of multiple queries that utilize the ExchangeMetrics Data
+The EX_MetricsCollection Job is comprised of multiple queries that use the ExchangeMetrics Data
Collector to process and collect the message tracking logs on the Exchange servers in the
environment. These queries collect server, domain, user, and distribution list traffic including but
not limited to: sent, received, journal, NDRs, and transports messages. These queries are configured
@@ -45,7 +45,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_MetricsCollection** > **Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -78,7 +78,7 @@ The following analysis task deletes table data from data collection and analysis
task should remain deselected unless specifically needed:
:::warning
-Do not select the **00. Deletes all Stored Data** option. This analysis task is for
+Don't select the **00. Deletes all Stored Data** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
@@ -92,8 +92,8 @@ troubleshooting and cleanup only. Data will be deleted from the database.
The **08. SET HISTORY RETENTION** analysis task controls the retention period for the job’s data.
This is why the Data Retention Period options at the global, job group, or job Properties settings
-are not supported for the job group. The number of months can be modified. If desired, the parameter
-can be set to a specified number of days. Follow these steps to modify the history retention period.
+aren't supported for the job group. The number of months can be modified. If desired, the parameter
+can be set to a specified number of days. To modify the history retention period:
**Step 1 –** Navigate to the job’s **Configure** node and select **Analysis**.
@@ -128,21 +128,21 @@ Skip to Step 5.
**Step 5 –** Click **Save and Close**. The SQL Script Editor closes.
-The modified history retention period is now applied during future job executions.
+Access Analyzer applies the modified history retention period to future job executions.
## Troubleshooting Data Collection
-There might be times when it is necessary to purge the data either through dropping the tables from
-the database or truncating the data within the tables. This option is provided through ananalysis
-task that is not selected by default. Only one analysis task within a job should be enabled when the
-desire is to purge that database.
+There might be times when you need to purge the data either through dropping the tables from
+the database or truncating the data within the tables. An analysis task that isn't selected by
+default provides this option. Enable only one analysis task within a job when you want to purge
+that database.
:::warning
This analysis task deletes information collected or produced by jobs in this solution.
:::
-Follow these steps to troubleshoot data collection:
+To troubleshoot data collection:
**Step 1 –** Navigate to the job’s **Configure** node and select **Analysis**.
@@ -159,9 +159,9 @@ Remember, only one task should be selected.
**Step 3 –** In the Navigation pane, right-click the **Analysis** node and select **Execute
Analyses**.
-**Step 4 –** After the analysis task has been executed, return to the Analysis Selection view.
-Deselect the analysis task which was executed and reselect the default analysis tasks (if any had
-been cleared in Step 2).
+**Step 4 –** After you execute the analysis task, return to the Analysis Selection view. Deselect
+the analysis task you executed and reselect the default analysis tasks (if you cleared any in
+Step 2).
-The selected purge of data and tables has taken place, and the analysis tasks have been reset to the
-default state.
+Access Analyzer purges the selected data and tables and resets the analysis tasks to their default
+state.
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/ex_metricsdetails.md b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/ex_metricsdetails.md
index 7d5089e351..074517de4d 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/ex_metricsdetails.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/ex_metricsdetails.md
@@ -9,8 +9,8 @@ sidebar_position: 30
The EX_MetricsDetails Job collects daily user-to-user Traffic. Walk through this jobs query to
configure the internal domains to collect the sender to recipient traffic from. By default, the
query is configured to collect the previous 1 day of Message Tracking Logs and has @netwrix.com
-configured as the domain. If the domains are not configured in the query, then most likely data
-collection does not return.
+configured as the domain. If the domains aren't configured in the query, then most likely data
+collection doesn't return.
## Queries for the EX_MetricsDetails Job
@@ -31,7 +31,7 @@ The following query is included in the EX_MetricsDetails Job:
The Activity Metrics Query has been preconfigured to run with the ExchangeMetrics Data Collector to
collect user traffic per day. The domains must be configured for data collection to return data.
-Follow the steps to configure the Activity Metrics Query.
+To configure the Activity Metrics Query:
**Step 1 –** Navigate to the **Exchange** > **1. HUB Metrics** > **0. Collection** >
**EX_MetricsDetails** > **Configure** node and select **Queries**.
@@ -43,7 +43,7 @@ Properties**. The Query Properties window opens.
Collector Wizard opens.
:::warning
-Do not modify other wizard pages. The wizard pages are pre-configured for this job.
+Don't modify other wizard pages. The wizard pages are pre-configured for this job.
:::
@@ -65,7 +65,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_MetricsDetails** > **Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -87,7 +87,7 @@ The following analysis task clears table data from data collection and analysis
task should remain deselected unless specifically needed:
:::warning
-Do not select the **00. DROP HISTORY** option. This analysis task is for
+Don't select the **00. DROP HISTORY** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/overview.md b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/overview.md
index f3820c46a6..949d990c3e 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/overview.md
@@ -15,7 +15,7 @@ The jobs in the 0.Collection Job Group are:
- [.AppletStatusCheck Job](/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/appletstatuscheck.md) – Checks the health and status of the applet
deployed to the target Exchange servers
-- [EX_MetricsCollection Job](/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/ex_metricscollection.md) – Comprised of multiple queries that utilize
+- [EX_MetricsCollection Job](/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/collection/ex_metricscollection.md) – Comprised of multiple queries that use
the Exchange Metrics Data Collect to process and collect the message tracking logs on the Exchange
servers in the environment. These queries collect server, domain, user, and distribution list
traffic including but not limited to sent, received, journal, NDRs, and transports message. These
@@ -28,6 +28,6 @@ The jobs in the 0.Collection Job Group are:
This job's query needs to be configured to the internal domains from which to collect
the sender to recipient traffic. By default, the query is configured to collect the previous 1
day of Message Tracking Logs and has @netwrix.com configured as the domain. If the domains are
- not configured in the query, then most likely data collection does not return.
+ not configured in the query, then most likely data collection doesn't return.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_deliverytimes.md b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_deliverytimes.md
index d51bd9c869..9f69f7c2e0 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_deliverytimes.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_deliverytimes.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_DeliveryTimes** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_dlmetrics.md b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_dlmetrics.md
index bf3c170293..c6a243cc97 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_dlmetrics.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_dlmetrics.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_domainmetrics.md b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_domainmetrics.md
index ad3286f10d..1d48d192d0 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_domainmetrics.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_domainmetrics.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_DomainMetrics** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_hourlymetrics.md b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_hourlymetrics.md
index 292cbbac66..a3cc4ef405 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_hourlymetrics.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_hourlymetrics.md
@@ -15,13 +15,13 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_HourlyMetrics** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_messagesize.md b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_messagesize.md
index f6210bdbb6..aa2431ddf0 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_messagesize.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_messagesize.md
@@ -14,7 +14,7 @@ View the analysis task by navigating to the **Exchange** > **1. HUB Metrics** >
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_servermetrics.md b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_servermetrics.md
index a0a7b46083..012f7e29a8 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_servermetrics.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_servermetrics.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_ServerMetrics** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_usermetrics.md b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_usermetrics.md
index 102fee40b0..f62aaba917 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_usermetrics.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_usermetrics.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **1. HUB Metrics** >
**EX_UserMetrics** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/overview.md b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/overview.md
index 2afe653761..fa4bc38c22 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/overview.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# 1.HUB Metrics Job Group
-The 1. HUB Metrics Job Group is comprised of data collection, analysis and reports that focus on
-mail-flow activity occurring within your organization. This job group goes out to each server that
-contains the Message Tracking Logs and parse the log to return the data to the Access Analyzer
+The 1. HUB Metrics Job Group is comprised of data collection, analysis, and reports that focus on
+mail-flow activity occurring within your organization. This job group connects to each server that
+contains the Message Tracking Logs and parses the log to return the data to the Access Analyzer
database.
@@ -27,6 +27,6 @@ The following job groups and jobs comprise the 1. HUB Metrics Job Group:
- [EX_MessageSize Job](/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_messagesize.md) – Provides information around size of messages sent and
received
- [EX_ServerMetrics Job](/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_servermetrics.md) – Provides visibility into server mail-flow
- statistics, such as, sent, received, journaling, transport and NDR counts and sizes
+ statistics, such as, sent, received, journaling, transport, and NDR counts and sizes
- [EX_UserMetrics Job](/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/ex_usermetrics.md) – Provides information around each user’s mail-flow in the
organization
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/recommended.md b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/recommended.md
index 0152ff06ff..4ef99d2b6c 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/recommended.md
@@ -54,7 +54,7 @@ Run this job group at 1:00 AM.
**History Retention**
-History retention should not be enabled on this job group. History is kept through analysis tasks.
+History retention shouldn't be enabled on this job group. History is kept through analysis tasks.
Modify the following analysis tasks to customize the amount of history which is kept:
| Job Name | Analysis Task Name | Default History |
@@ -82,13 +82,13 @@ following exceptions:
The 1. HUB Metrics Job Group should be run with the default analysis configurations.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified or
+Most of these analysis tasks are preconfigured and shouldn't be modified or
deselected. There are a few which are deselected by default, as they are for troubleshooting
purposes.
:::
-The following analysis tasks should not be deselected, but their parameters can be modified:
+The following analysis tasks shouldn't be deselected, but their parameters can be modified:
- **0. Collection** > **EX_MetricsCollection** Job – **08. SET HISTORY RETENTION** Analysis Task
- **0. Collection** > **EX_MetricsDetails** Job – **02. SET HISTORY RETENTION** Analysis Task
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/ex_features.md b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/ex_features.md
index 157cef2013..fa49cda48a 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/ex_features.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/ex_features.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# Features > EX_Features Job
The EX_Features job is comprised of data collection and a report that provides information around
-which features have been enabled or disabled on Mailboxes, such as ActiveSync, IMAP, POP and more.
+which features have been enabled or disabled on Mailboxes, such as ActiveSync, IMAP, POP, and more.
:::info
Schedule the Features Job Group to run weekly on any desired recurrence.
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/logons/ex_mailboxlogons.md b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/logons/ex_mailboxlogons.md
index 1470aa3a06..6fe2c39f67 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/logons/ex_mailboxlogons.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/logons/ex_mailboxlogons.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **4. Mailboxes** > *
**EX_MailboxLogons** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -45,7 +45,7 @@ The following analysis task deletes table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **00. Delete All Historical Data** option. This analysis task is for
+Don't select the **00. Delete All Historical Data** option. This analysis task is for
troubleshooting and cleanup only. Data will be deleted from the database.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/logons/overview.md b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/logons/overview.md
index f29eecb31d..0ed7ee57fd 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/logons/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/logons/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Logons Job Group
-The Logons Job Group provides collection of Native Mailbox Access Auditing logs from Exchange to
-provide reporting around mailbox logon activity.
+The Logons Job Group collects Native Mailbox Access Auditing logs from Exchange to provide reporting
+around mailbox logon activity.
:::info
Schedule the Logons Job Group to run daily at 7 PM.
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/overview.md b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/overview.md
index 484cba06b9..2c18d14298 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/overview.md
@@ -20,10 +20,10 @@ These jobs are compatible with the Office 365 environment.
- [Features > EX_Features Job](/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/ex_features.md) – Comprised of data collection and a report that
provides information around which features have been enabled or disabled on mailboxes, such as
- ActiveSync, IMAP, POP and more
+ ActiveSync, IMAP, POP, and more
- [Logons Job Group](/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/logons/overview.md) – Provides collection of Native Mailbox Access Auditing
logs from Exchange to provide reporting around mailbox logon activity
-- [Permissions Job Group](/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/overview.md) – Comprised of data collection, analysis and
+- [Permissions Job Group](/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/overview.md) – Comprised of data collection, analysis, and
reports that focus on access granted to each mailbox in the environment including, Mailbox Rights,
Active Directory Permissions, Delegation, and Folder Permissions
- [Sizing Job Group](/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/sizing/overview.md) – Provides data collection, analyses, and reports which
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/collection/ex_sendas.md b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/collection/ex_sendas.md
index 45fe9090fe..d16ce41ee9 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/collection/ex_sendas.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/collection/ex_sendas.md
@@ -38,7 +38,7 @@ View the analysis task by navigating to the **Exchange** > **4. Mailboxes** > **
**0.Collection** > **EX_SendAs** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/ex_admingroups.md b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/ex_admingroups.md
index b45a90eb87..f048e84a07 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/ex_admingroups.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/ex_admingroups.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **4. Mailboxes** > *
**EX_AdminGroups** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/ex_mailboxaccess.md b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/ex_mailboxaccess.md
index 09c26dc90d..18ec959717 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/ex_mailboxaccess.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/ex_mailboxaccess.md
@@ -16,7 +16,7 @@ View the analysis tasks by navigating to the **Exchange** > **4. Mailboxes** > *
**EX_MailboxAccess** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -52,7 +52,7 @@ The following analysis tasks are selected by default:
- 12.Send As Summary – Creates the SA_EX_MailboxAccess_SendAsSummary table accessible under the
job’s Results node
-The following analysis tasks is selected to export data to the AIC:
+The following analysis task is selected to export data to the Access Information Center (AIC):
- 13.AIC Import - Export Exchange Permissions – Exports delegates, Send AS rights, mailbox
permissions, and Active Directory rights to the Access Information Center
@@ -73,5 +73,5 @@ the following pre-configured reports:
| Delegation (Delegates) | This report identifies users where Delegate/Send on Behalf Of rights have been assigned and which objects the users have been given rights to. | None | This report is comprised of two elements: - Bar Chart – Displays top users by number of delegates
- Table – Provides details on top users by number of delegates
|
| Full Control Access (Mailboxes with Full Control) | This report identifies users with the largest amount of Full Control rights assigned to other individuals. | None | This report is comprised of two elements: - Bar Chart – Displays top users with full control granted
- Table – Provides details on top users with full control granted
|
| Incorrect Default And Anon Permissions | This report identifies where Default or Anonymous have any role assignment other than **None** or **Free/Busy time**. | None | This report is comprised of three elements: - Bar Chart – Displays top users with incorrect default/anon permissions
- Table – Provides details on top users with incorrect default/anon permissions
- Table – Provides role details
|
-| Missing Anonymous Permissions | This report identifies folders where Anonymous permissions are not assigned. | None | This report is comprised of one element: - Table – Provides details on missing anonymous permissions
|
+| Missing Anonymous Permissions | This report identifies folders where Anonymous permissions aren't assigned. | None | This report is comprised of one element: - Table – Provides details on missing anonymous permissions
|
| Send As (Send-As Rights) | This report identifies which users have the highest number of users with Send-As rights to their mailbox. | None | This report is comprised of three elements: - Stacked Bar Chart – Displays top users by send as rights granted
- Table – Provides details on top users by send as right granted
- Table – Provides additional details
|
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/overview.md b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/overview.md
index d74fae1059..9e021caed8 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/permissions/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Permissions Job Group
-The Permissions job group is comprised of data collection, analysis and reports that focus on access
+The Permissions job group is comprised of data collection, analysis, and reports that focus on access
granted to each mailbox in the environment including, Mailbox Rights, Active Directory Permissions,
Delegation, and Folder Permissions.
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/recommended.md b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/recommended.md
index ef26b86bb1..2c78c8a52a 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/recommended.md
@@ -8,7 +8,7 @@ sidebar_position: 10
**Dependencies**
-This job group requires the following items to be enabled:
+This job group requires you to enable the following items:
- Exchange Access Auditing is enabled in the Exchange environment
@@ -16,7 +16,7 @@ This job group requires the following items to be enabled:
[Enable Exchange Mailbox Access Auditing](/docs/accessanalyzer/12.0/requirements/exchange/support/powershell.md#enable-exchange-mailbox-access-auditing)
topic for additional information.
-The following job groups need to be successfully run:
+Successfully run the following job groups first:
- **.Active Directory Inventory** Job Group
- **.Entra ID Inventory** Job Group
@@ -38,11 +38,11 @@ on-premises to run against:
- Local host
This Job Group can target a custom host list for Exchange Online instead of targeting Exchange
-on-premises. However, do not try to target both types of environments.
+on-premises. However, don't try to target both types of environments.
**Connection Profile**
-A Connection Profile must be set directly on the collection jobs within each sub-job group:
+Set a Connection Profile directly on the collection jobs within each sub-job group:
- **Features** > **EX_Features** Job
- **Logons** > **0.Collection** > **EX_MailboxActivity** Job
@@ -62,7 +62,7 @@ topic for additional information.
**Schedule Frequency**
-It is not recommended to run these jobs at the 4. Mailboxes job group level. The Logons sub-job
+Don't run these jobs at the 4. Mailboxes job group level. The Logons sub-job
group and Sizing job group have been designed to run daily. The Features sub-job group and
Permissions job group have been designed to run weekly. See the table for recommended times:
@@ -75,7 +75,7 @@ Permissions job group have been designed to run weekly. See the table for recomm
**History Retention**
-History retention should not be enabled on this job group. History is kept through analysis tasks.
+Don't enable history retention on this job group. History is kept through analysis tasks.
Modify the following analysis tasks to customize the amount of history which is kept:
| Job Name | Analysis Task Name | Default History |
@@ -85,7 +85,7 @@ Modify the following analysis tasks to customize the amount of history which is
**Query Configuration**
-The 4. Mailboxes job group is designed to be run with the default query configurations. However, the
+Run the 4. Mailboxes job group with the default query configurations. However, the
following queries can be modified:
- **Features** > **EX_Features** Job – **User Mailbox Settings** Query
@@ -96,20 +96,20 @@ following queries can be modified:
- **Permissions** > **0. Collection** > **EX_SendAs** Job – **Send AS - Rights** Query
- **Sizing** > **0. Collection** > **EX_MBSize** Job – **Mailbox Counts and Sizes** Query
-No other queries should be modified.
+Don't modify other queries.
**Analysis Configuration**
-The 4. Mailboxes job group should be run with the default analysis configurations.
+Run the 4. Mailboxes job group with the default analysis configurations.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified or
+Most of these analysis tasks are preconfigured and shouldn't be modified or
deselected. There are some tasks that are deselected by default, as they are for troubleshooting
purposes.
:::
-The following analysis tasks should not be deselected, but their parameters can be modified:
+The following analysis tasks shouldn't be deselected, but their parameters can be modified:
- **Logons** > **EX_MailboxLogons** Job – **03.SET HISTORY RETENTION** Analysis Task
- **Sizing** > **EX_MailboxSizes** Job – **02.SET HISTORY RETENTION** Analysis Task
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/sizing/ex_mailboxsizes.md b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/sizing/ex_mailboxsizes.md
index e6f9401410..4818ae9b01 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/sizing/ex_mailboxsizes.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/sizing/ex_mailboxsizes.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **4. Mailboxes** > *
**EX_MailboxSizes** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -47,8 +47,8 @@ The following analysis task deletes table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **00.Delete All Data** option. This analysis task is for
-troubleshooting and cleanup only. Data will be deleted from the database:
+Don't select the **00.Delete All Data** option. This analysis task is for
+troubleshooting and cleanup only. Selecting it deletes data from the database:
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/sizing/ex_stalemailboxes.md b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/sizing/ex_stalemailboxes.md
index ba1f1c93be..f4255b480e 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/sizing/ex_stalemailboxes.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/sizing/ex_stalemailboxes.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **4. Mailboxes** > *
**EX_StaleMailboxes** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -35,5 +35,5 @@ produces the following pre-configured reports:
| Report | Description | Default Tags | Report Elements |
| --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Orphaned Mailboxes | Orphaned Mailboxes do not have an Active Directory account associated with them, and generally can be safely deleted. | None | This report is comprised of three elements: - Bar Chart – Displays orphan mailbox storage
- Table – Provides details on all orphaned mailboxes
- Table – Provides details on orphan mailbox storage
|
+| Orphaned Mailboxes | Orphaned Mailboxes don't have an Active Directory account associated with them, and generally can be safely deleted. | None | This report is comprised of three elements: - Bar Chart – Displays orphan mailbox storage
- Table – Provides details on all orphaned mailboxes
- Table – Provides details on orphan mailbox storage
|
| Stale Users (Mailboxes associated with Stale AD Accounts) | This report shows mailboxes which are tied to stale user accounts. | None | This report is comprised of three elements: - Bar Chart – Displays stale user mailboxes
- Table – Provides details stale user mailboxes
- Table – Provides additional details on stale user mailboxes
|
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/sizing/ex_storesizes.md b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/sizing/ex_storesizes.md
index 93ed8d1a0c..4378471169 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/sizing/ex_storesizes.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/sizing/ex_storesizes.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **4. Mailboxes** >
**Sizing** > **EX_StoreSizes** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow.md b/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow.md
index 98aff0077f..45d1e5c774 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow.md
@@ -14,7 +14,7 @@ The EX_Mailflow job is located in the **Mailflow** > **0. Collection** job group
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -44,7 +44,7 @@ The following queries are included in the EX_Mailflow job:
- LocalDomains – Collects domains local to the Office 365 environment
:::warning
- Do not modify this query. The query is preconfigured for this job.
+ Don't modify this query. The query is preconfigured for this job.
:::
@@ -56,7 +56,7 @@ The following queries are included in the EX_Mailflow job:
The ExchangePS Data Collector configured with the Mail Flow Metrics category can be scoped to
specific report dates. By default, the MailFlow Query is set to report on the Last 7 Days.
-Follow the steps to modify the query configuration:
+To modify the query configuration:
**Step 1 –** Navigate to the **Exchange** > **8. Exchange Online** > **0. Collection** >
**EX_Mailflow** > **Configure** node and select **Queries**.
@@ -68,7 +68,7 @@ Properties window opens.
Wizard opens.
:::warning
-Do not modify other wizard pages. The wizard pages are pre-configured for this job.
+Don't modify other wizard pages. The wizard pages are pre-configured for this job.
:::
@@ -94,7 +94,7 @@ View the analysis tasks by navigating to the **Exchange** > **8. Exchange Online
Collection** > **EX_Mailflow** > **Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -120,8 +120,8 @@ The following analysis task deletes table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **00. Deletes all Stored Data** option. This analysis task is for
-troubleshooting and cleanup only. Data will be deleted from the database.
+Don't select the **00. Deletes all Stored Data** option. This analysis task is for
+troubleshooting and cleanup only. Selecting it deletes data from the database.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_dl.md b/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_dl.md
index da59f4a13f..74ece60563 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_dl.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_dl.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **8. Exchange Online
**EX_Mailflow_DL** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_domain.md b/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_domain.md
index 338496649d..2f8f247f14 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_domain.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_domain.md
@@ -11,7 +11,7 @@ coming from. This job is set to analyze the last 30 days.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -30,7 +30,7 @@ View the analysis task by navigating to the **Exchange** > **8. Exchange Online*
**EX_Mailflow_Domain** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_mailbox.md b/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_mailbox.md
index 1011be02a6..c9e26a25e7 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_mailbox.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_mailbox.md
@@ -11,7 +11,7 @@ This job is set to analyze the last 30 days.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -31,7 +31,7 @@ View the analysis tasks by navigating to the **Exchange** > **8. Exchange Online
**EX_Mailflow_Mailbox** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_orgoverview.md b/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_orgoverview.md
index caeab5b77c..dc731c74b8 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_orgoverview.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/online/mailflow/ex_mailflow_orgoverview.md
@@ -11,7 +11,7 @@ This job is set to analyze the last 30 days.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/online/recommended.md b/docs/accessanalyzer/12.0/solutions/exchange/online/recommended.md
index b4a733cbc2..2a5667e48a 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/online/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/online/recommended.md
@@ -8,7 +8,7 @@ sidebar_position: 10
**Dependencies**
-The following Access Analyzer job groups need to be successfully run:
+Successfully run the following Access Analyzer job groups first:
- .Active Directory Inventory
- .Entra ID Inventory
@@ -16,7 +16,7 @@ The following Access Analyzer job groups need to be successfully run:
**Targeted Hosts**
The Mailflow job group uses Remote PowerShell through the ExchangePS Data Collector and the
-PowerShell Data Collector. The host list needs to be set to one of the following:
+PowerShell Data Collector. Set the host list to one of the following:
- Local Host
- Custom Host List for Exchange Online
@@ -44,7 +44,7 @@ topic for additional information.
**Schedule Frequency**
-This job group has been designed to run daily.
+Run this job group daily.
:::info
Run this job group at 1:00 AM.
@@ -53,21 +53,21 @@ Run this job group at 1:00 AM.
**Query Configuration**
-The 8. Exchange Online job group is designed to be run with the default query configurations.
+Run the 8. Exchange Online job group with the default query configurations.
However, the following queries can be modified:
- **Mailflow** > **0. Collection** > **EX_Mailflow** Job – **MailFlow** Query
- **EX_ASPolicies** Job – **Exchange Settings** Query
-No other queries should be modified.
+Don't modify other queries.
**Analysis Configuration**
-The 8. Exchange Online job group should be run with the default analysis configurations. Most of
+Run the 8. Exchange Online job group with the default analysis configurations. Most of
these analysis tasks are preconfigured and should never be modified or deselected. There are some
that are deselected by default, as they are for troubleshooting purposes.
-The following analysis tasks should not be deselected, but their parameters can be modified:
+The following analysis tasks shouldn't be deselected, but their parameters can be modified:
- **Mailflow** > **0. Collection** > **EX_Mailflow** Job – **03. SET HISTORY RETENTION** Analysis
Task
@@ -80,7 +80,7 @@ The following analysis tasks should not be deselected, but their parameters can
**Step 1 –** Set the host on the EX_Mailflow job.
-- The **Mailflow** > **0. Collection** > **EX_Mailflow** job needs to be set to run against one of
+- Set the **Mailflow** > **0. Collection** > **EX_Mailflow** job to run against one of
the following:
- Local Host
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/overview.md b/docs/accessanalyzer/12.0/solutions/exchange/overview.md
index 974e189a9c..3f315bc879 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/overview.md
@@ -35,22 +35,22 @@ topics for additional information.
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host.For example, if the job is
-configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if the job scans 8 hosts at a
+time, it requires an extra 16 GB of RAM (8 x 2 = 16).
:::note
-The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
-conflict with other JDKs or Java Runtimes in the same environment.
+Access Analyzer installs the appropriate JDK (Java) version for Sensitive Data Discovery on the
+server. This JDK is prepackaged, requires no configuration, and comes preconfigured to work with
+Access Analyzer. Don't customize it through Java. It doesn't conflict with other JDKs or Java
+Runtimes in the same environment.
:::
**Location**
The Exchange Solution requires a special Access Analyzer license. It can be installed from the
-Access Analyzer Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to the
+Access Analyzer Instant Job Wizard. After it's installed into the Jobs tree, navigate to the
solution: **Jobs** > **Exchange**.
Each job group within the solution collects data, analyzes the data, and reports on the target
@@ -66,21 +66,21 @@ The Exchange Solution is divided into categories based upon what is being audite
The following job groups comprise the Exchange Solution:
-- [1.HUB Metrics Job Group](/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/overview.md) – Comprised of data collection, analysis and
+- [1.HUB Metrics Job Group](/docs/accessanalyzer/12.0/solutions/exchange/hubmetrics/overview.md) – Comprised of data collection, analysis, and
reports that focus on mail-flow activity occurring within your organization. This job group goes
out to each server that contains the Message Tracking Logs and parses the log to return the data
to the Access Analyzer database.
-- [2.CAS Metrics Job Group](/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/overview.md) – Comprised of data collection, analysis and
+- [2.CAS Metrics Job Group](/docs/accessanalyzer/12.0/solutions/exchange/casmetrics/overview.md) – Comprised of data collection, analysis, and
reports that focus on remote connections (Outlook Web Access, ActiveSync, and Outlook Anywhere
Access) occurring within your organization. This job group goes out to each server that contains
the IIS Logs and parses the log to return the data to the Access Analyzer database.
-- [3.Databases Job Group](/docs/accessanalyzer/12.0/solutions/exchange/databases/overview.md) – Comprised of data collection, analysis and
+- [3.Databases Job Group](/docs/accessanalyzer/12.0/solutions/exchange/databases/overview.md) – Comprised of data collection, analysis, and
reports that focus on database sizing, growth, and trends
- [4.Mailboxes Job Group](/docs/accessanalyzer/12.0/solutions/exchange/mailboxes/overview.md) – Comprised of data collection, analyses, and
reports around mailbox features, logons, permissions, and sizing
:::warning
- It is not recommended to run this job group at this job group level.
+ Don't run this job group at this job group level.
:::
@@ -106,6 +106,6 @@ The following job groups comprise the Exchange Solution:
impact analysis on the environment. This job depends upon multiple job groups.
The MAPI-based data collectors require both Access Analyzer MAPI CDO and Microsoft Exchange MAPI CDO
-to be installed on the Access Analyzer Console server. Once these have been installed, configure the
+on the Access Analyzer Console server. After you install them, configure the
**Settings** > **Exchange** node for proper connection to the Exchange server. See the
[Exchange](/docs/accessanalyzer/12.0/admin/settings/exchange.md) topic for additional information.
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/content/pf_content.md b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/content/pf_content.md
index b94d7fdf5b..4bab951b15 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/content/pf_content.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/content/pf_content.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **5. Public Folders*
**PF_Content** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/content/pf_contentscans.md b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/content/pf_contentscans.md
index e727363058..07507cb943 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/content/pf_contentscans.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/content/pf_contentscans.md
@@ -34,7 +34,7 @@ View the analysis task by navigating to the **Exchange** > **5. Public Folders**
**Collection** > **PF_ContentScans** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/growthsize/pf_folderscans.md b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/growthsize/pf_folderscans.md
index 1cf8518637..b32414171f 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/growthsize/pf_folderscans.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/growthsize/pf_folderscans.md
@@ -34,7 +34,7 @@ View the analysis task by navigating to the **Exchange** > **5. Public Folders**
Size** > **Collection** > **PF_FolderScans** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/growthsize/pf_foldersize.md b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/growthsize/pf_foldersize.md
index 54a65f642d..726cc124ce 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/growthsize/pf_foldersize.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/growthsize/pf_foldersize.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **Exchange** > **5. Public Folders*
Size** > **PF_FolderSize** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -41,8 +41,8 @@ The following analysis task clears table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **00. Delete all Historical Data** option. This analysis task is for
-troubleshooting and cleanup only. Data will be deleted from the database.
+Don't select the **00. Delete all Historical Data** option. This analysis task is for
+troubleshooting and cleanup only. Selecting it deletes data from the database.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/ownership/pf_folderownership.md b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/ownership/pf_folderownership.md
index 238c266f27..3edad19274 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/ownership/pf_folderownership.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/ownership/pf_folderownership.md
@@ -41,8 +41,8 @@ The following queries are included in the PF_FolderOwnership job:
### Scope the ExchangePublicFolder Data Collector for the PF_FolderOwnership Job
-The ExchangePublicFolder Data Collector can be scoped if desired. Follow the steps to modify the
-query configuration.
+The ExchangePublicFolder Data Collector can be scoped if desired. To modify the
+query configuration:
:::note
These instructions include information on modifying the calculation used to determine
@@ -60,7 +60,7 @@ Properties window opens.
Data Collector Wizard opens.
:::warning
-Do not modify other wizard pages. The wizard pages are pre-configured for this job.
+Don't modify other wizard pages. The wizard pages are pre-configured for this job.
:::
@@ -73,8 +73,8 @@ using the following settings:
- Default Public Folders – Select this option to access folders directly with client
applications such as Microsoft Outlook. In its default configuration, Exchange System Manager
- displays these folders when a public folder tree is expanded.
- - System Public Folders – Select this option to access folders that cannot be directly accessed.
+ displays these folders when you expand a public folder tree.
+ - System Public Folders – Select this option to access folders that can't be directly accessed.
Client applications, such as Microsoft Outlook, use these folders to store information such as
free and busy data, offline address lists, and organizational forms. Other folders hold
configuration information that is used by custom applications or by Exchange itself. The
@@ -122,7 +122,7 @@ View the analysis task by navigating to the **Exchange** > **5. Public Folders**
**Collection** > **PF_FolderOwnership** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/ownership/pf_owners.md b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/ownership/pf_owners.md
index 7c9a4cf63e..284388c241 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/ownership/pf_owners.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/ownership/pf_owners.md
@@ -17,7 +17,7 @@ View the analysis tasks by navigating to the **Exchange** > **5. Public Folders*
**PF_Owners** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/permissions/pf_entitlements.md b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/permissions/pf_entitlements.md
index a1226739f8..1cfdbe8c2f 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/permissions/pf_entitlements.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/permissions/pf_entitlements.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **5. Public Folders*
**Permissions** > **PF_Entitlements** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -34,7 +34,7 @@ The following analysis tasks are selected by default:
under the job’s Results node
- 04.Unresolved SIDs – Creates the SA_PF_Entitlements_UnresolvedSIDDetails table, accessible under
the job’s Results node
-- AIC Import - PF Entitlements – Imports public folder entitlements to the Access Information Center
+- AIC Import - PF Entitlements – Imports public folder entitlements to the Access Information Center (AIC)
In addition to the tables and views created by the analysis tasks, the PF_Entitlements job produces
the following pre-configured reports:
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/permissions/pf_entitlementscans.md b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/permissions/pf_entitlementscans.md
index 262e9072b2..1cde137ebf 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/permissions/pf_entitlementscans.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/permissions/pf_entitlementscans.md
@@ -35,7 +35,7 @@ View the analysis tasks by navigating to the **Exchange** > **5. Public Folders*
**Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/pf_overview.md b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/pf_overview.md
index 5da366c95a..7f0982c22b 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/pf_overview.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/pf_overview.md
@@ -16,7 +16,7 @@ View the analysis tasks by navigating to the **Exchange** > **5. Public Folders*
**PF_Overview** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/recommended.md b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/recommended.md
index c52da88b7f..50c345a767 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/publicfolders/recommended.md
@@ -78,7 +78,7 @@ Run this job group on Fridays at 8:00 PM.
**History Retention**
-History retention should not be enabled on this job group. History is kept through analysis tasks.
+History retention shouldn't be enabled on this job group. History is kept through analysis tasks.
Modify the following analysis task to customize the amount of history which is kept:
| Job Name | Analysis Task Name | Default History |
@@ -109,7 +109,7 @@ deselected. There are some that are deselected by default, as they are for troub
:::
-The following analysis tasks should not be deselected, but their parameters can be modified:
+The following analysis tasks shouldn't be deselected, but their parameters can be modified:
- **Growth and Size** > **PF_FolderSize** Job – **02.SET HISTORY RETENTION** Analysis Task
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/recommended.md b/docs/accessanalyzer/12.0/solutions/exchange/recommended.md
index c597fa772b..25e85ca707 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/recommended.md
@@ -21,20 +21,20 @@ relevant topic for specific information on job group settings and recommended sc
## ExchangePS Data Collector & Client Access Server
A Client Access Server (CAS) name is required for the ExchangePS Data Collector. When targeting
-Exchange 2013 or 2016, it is possible for the **Settings** > **Exchange** node to have been
-configured with a web address instead of a CAS.
+Exchange 2013 or 2016, the **Settings** > **Exchange** node might be configured with a web address
+instead of a CAS.
- Exchange 2010 Servers – Uses the CAS server set in the global configuration (**Settings** >
**Exchange** node)
- Exchange 2013 & 2016 – May require a CAS name set in the ExchangePS Data Collector configuration:
- - If the **Settings** > **Exchange** node was configured for **MAPI over HTTP**, then a CAS
- server name was supplied and that is used by the ExchangePS Data Collector
+ - If the **Settings** > **Exchange** node was configured for **MAPI over HTTP**, the
+ ExchangePS Data Collector uses the CAS server name you supplied
- If the **Settings** > **Exchange** node was configured for **MAPI over HTTPS**, then the
global configuration has a web address instead of an actual server. Therefore, each query
requires the CAS server to be set as the specific server on the Category page.
-Follow the steps to supply a CAS name for data collection.
+To supply a CAS name for data collection:
**Step 1 –** Navigate to the job’s **Configure** node and select **Queries**.
@@ -45,8 +45,8 @@ opens.
Wizard opens.
:::warning
-Unless otherwise indicated within the job group section, do not make changes to other
-wizard pages as they have been pre-configured for the purpose of the job.
+Unless otherwise indicated within the job group section, don't make changes to other
+wizard pages as they have been pre-configured for the job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/collection/ex_mailbox_sdd.md b/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/collection/ex_mailbox_sdd.md
index e3c3243922..c6f1210817 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/collection/ex_mailbox_sdd.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/collection/ex_mailbox_sdd.md
@@ -36,7 +36,7 @@ The following query is included in the EX_Mailbox_SDD job:
The Exchange Sensitive Data Discovery query has been preconfigured to run with the EWSMailbox Data
Collector to scan for sensitive data.
-Follow the steps to configure the scope of the EWSMailbox Data Collector:
+To configure the scope of the EWSMailbox Data Collector:
**Step 1 –** Navigate to the **Exchange** > **7. Sensitive Data** > **0. Collection** >
**EX_Mailbox_SDD** > **Configure** node and select **Queries**.
@@ -48,7 +48,7 @@ click **Query Properties**. The Query Properties window opens.
Wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -64,7 +64,7 @@ information.
**Step 5 –** To retrieve available mailboxes, click **Retrieve** on the Scope Select page. Select
-the desired mailboxes and click **Add**. See the
+the mailboxes you want and click **Add**. See the
[EWSMailbox: Scope Select](/docs/accessanalyzer/12.0/admin/datacollector/ewsmailbox/scopeselect.md) topic for
additional information.
@@ -76,7 +76,7 @@ Sensitive data matches can be limited to reduce storage space. See the
additional information.
:::note
-By default, discovered sensitive data strings are not stored in the Access Analyzer
+By default, discovered sensitive data strings aren't stored in the Access Analyzer
database.
:::
@@ -125,7 +125,7 @@ View the analysis task by navigating to the **Exchange** > **7.Sensitive Data**
**EX_Mailbox_SDD** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -134,4 +134,4 @@ preconfigured for this job.
The following analysis task is selected by default:
-- AIC Import - Exchange SSD – Imports Exchange sensitive data to the Access Information Center
+- AIC Import - Exchange SDD – Imports Exchange sensitive data to the Access Information Center (AIC)
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/collection/ex_publicfolder_sdd.md b/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/collection/ex_publicfolder_sdd.md
index ca9f69936a..5ebf51a486 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/collection/ex_publicfolder_sdd.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/collection/ex_publicfolder_sdd.md
@@ -46,7 +46,7 @@ Data Collector to scan for sensitive data.
Collector Wizard opens.
:::warning
-Do not modify other wizard pages. The wizard pages are pre-configured for this job.
+Don't modify other wizard pages. The wizard pages are pre-configured for this job.
:::
@@ -58,7 +58,7 @@ Sensitive data matches can be limited to reduce storage space. See the
for additional information.
:::note
-By default, discovered sensitive data strings are not stored in the Access Analyzer
+By default, discovered sensitive data strings aren't stored in the Access Analyzer
database.
:::
@@ -88,7 +88,7 @@ additional information.
**Step 7 –** To select which properties are gathered based on category, navigate to the Results
-page. See the
+page. See the
[EWSPublicFolder: Results](/docs/accessanalyzer/12.0/admin/datacollector/ewspublicfolder/results.md) topic for
additional information.
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/ex_sddresults.md b/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/ex_sddresults.md
index 8cf62002f4..5701c0c9fa 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/ex_sddresults.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/ex_sddresults.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Exchange** > **7. Sensitive Data*
**EX_SDDResults** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -41,8 +41,8 @@ The following analysis task deletes table data from data collection and analysis
task should remain cleared unless specifically needed:
:::warning
-Do not select the **Deletes all Stored Data** option. This analysis task is for
-troubleshooting and cleanup only. Data will be deleted from the database.
+Don't select the **Deletes all Stored Data** option. This analysis task is for
+troubleshooting and cleanup only. It deletes data from the database.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/overview.md b/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/overview.md
index fd8a10c31e..67f747eaa4 100644
--- a/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/exchange/sensitivedata/overview.md
@@ -24,7 +24,7 @@ These jobs are compatible with the Office 365 environment.
types of sensitive data that was located within Exchange mailboxes and public folders within the
environment
-The 7. Sensitive Data job group is comprised of jobs that utilize the EWSMailbox and EWSPublicFolder
+The 7. Sensitive Data job group is comprised of jobs that use the EWSMailbox and EWSPublicFolder
Data Collectors to locate sensitive data found in mailboxes and public folders in the Exchange
environment. It also contains analysis and reporting jobs to order and analyze the data returned by
the queries. See the [Exchange](/docs/accessanalyzer/12.0/admin/settings/exchange.md) topic for additional
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/forensics/fs_deletions.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/forensics/fs_deletions.md
index 5c0e0e39a5..01c8e4d091 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/forensics/fs_deletions.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/forensics/fs_deletions.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
**FS_Deletions** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -57,7 +57,7 @@ following pre-configured report:
A Notification analysis task sends email notification to recipients when the job is executed. It
requires the global **Notification** settings to be configured (**Settings** > **Notifications**)
for SMTP server information, but it uses the recipient list provided through the analysis task.
-Follow the steps to configure a notification analysis task.
+To configure a notification analysis task:
**Step 1 –** Navigate to the job’s **Configure** node and select **Analysis**.
@@ -65,7 +65,7 @@ Follow the steps to configure a notification analysis task.
**Analysis Configuration** . The Notification Data Analysis Module wizard opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -77,8 +77,8 @@ purpose of this job.
**Step 4 –** In the Recipients section, provide the email addresses or distribution lists (fully
-qualified address) for those who are to receive this notification. Multiple addresses can be
-provided. You can use the following options:
+qualified address) for the recipients. You can provide multiple addresses. You can use the
+following options:
- Add – Add an email address to the E-mail field
- Remove – Remove an email address from the Recipients list
@@ -92,22 +92,21 @@ provided. You can use the following options:
-**Step 5 –** In the Message section, edit the **Subject**. It is not recommended to remove any
-parameters. Then, customize the email content in the textbox to provide an explanation of the
-notification to the recipients.
+**Step 5 –** In the Message section, edit the **Subject**. Don't remove any parameters. Then,
+customize the email content in the textbox to provide an explanation of the notification to the
+recipients.
**Step 6 –** Navigate to the Summary page. Click **Finish** to save any setting modifications or
click **Cancel** if no changes were made. The Notification Data Analysis Module wizard closes.
-**Step 7 –** This Notification analysis task is now configured to send emails to the provided
-recipient list. In the Analysis Selection view, select this task so that notifications can be sent
-automatically during the execution of the job.
+**Step 7 –** The Notification analysis task now sends emails to the provided recipient list. In the
+Analysis Selection view, select this task so the job sends notifications automatically when it runs.
:::tip
Remember, all of the analysis tasks should remain in the default order indicated by the numbering.
-Do not deselect any of the SQLscripting analysis tasks.
+Don't deselect any of the SQLscripting analysis tasks.
:::
-Once the Notification analysis task is configured and enabled alerts are sent when the trigger has
-been identified by this job.
+After you configure and enable the Notification analysis task, the job sends alerts when it
+identifies the trigger.
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/forensics/fs_permissionchanges.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/forensics/fs_permissionchanges.md
index 45813af258..98c1eea5ba 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/forensics/fs_permissionchanges.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/forensics/fs_permissionchanges.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
**FS_PermissionChanges** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/fs_leastprivilegedaccess.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/fs_leastprivilegedaccess.md
index d39f0ac766..46c040e94d 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/fs_leastprivilegedaccess.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/fs_leastprivilegedaccess.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# Least Privileged Access > FS_LeastPrivilegedAccess Job
The FS_LeastPrivilegedAccess job is designed to report on activity event information that can assist
-in identifying least privilege from targeted file servers. It identifies where trustees are not
+in identifying least privilege from targeted file servers. It identifies where trustees aren't
leveraging their permissions to resources from targeted file servers. Requires **Access Auditing**
component data collection.
@@ -21,7 +21,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Access** > **FS_LeastPrivilegedAccess** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -54,5 +54,5 @@ produces the following pre-configured reports:
| Report | Description | Default Tags | Report Elements |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Overprovisioning Risk by Share | This report identifies shares with the largest amount of unutilized entitlements and assigns a risk rating to each one. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of two elements: - Pie Chart – Displays shares by overprovisioning risk
- Table – Provides details on shares by overprovisioning risk
|
-| Overprovisioning Summary | This report shows the percentage of all entitlements which are being used. An entitlement refers to one user's access to one folder. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of two elements: - Pie Chart – entitlements by level of usage
- Table – Provides details on entitlements
|
-| Remediation | If all members of a group are not using their full access, then modification to group permissions on the share will be suggested here. | None | This report is comprised of one element: - Table – Provides details on recommended changes to permissions
|
+| Overprovisioning Summary | This report shows the percentage of all entitlements in use. An entitlement refers to one user's access to one folder. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of two elements: - Pie Chart – entitlements by level of usage
- Table – Provides details on entitlements
|
+| Remediation | If all members of a group aren't using their full access, this report suggests changes to group permissions on the share. | None | This report is comprised of one element: - Table – Provides details on recommended changes to permissions
|
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/security/fs_adminactvity.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/security/fs_adminactvity.md
index c3754e9a5a..0b29404eaf 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/security/fs_adminactvity.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/security/fs_adminactvity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
**FS_AdminActivity** > **Configure** node and select Analysis.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -45,4 +45,4 @@ the following pre-configured reports:
| Administrator Activity Details | This report shows the details of administrator activity on file shares. | None | This report is comprised of one element: - Table – Provides details on last 30 days of administrator activity
|
| Administrator Activity Overview | This report identifies the types of actions administrators are performing across your network. | None | This report is comprised of two elements: - Pie Chart – Displays last 30 days of administrator activity
- Table – Provides details on types of actions
|
| Most Active Administrators | This report ranks administrators by number of shares they have activity in. | None | This report is comprised of two elements: - Bar Chart – Displays last 30 days of administrator activity
- Table – Provides details on administrator activity
|
-| Suspicious Admin Activity | This report highlights all administrator reads in shares where they do not have access. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of one element: - Table – Provides details on last 30 days of administrator activity
|
+| Suspicious Admin Activity | This report highlights all administrator reads in shares where they don't have access. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of one element: - Table – Provides details on last 30 days of administrator activity
|
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/security/fs_highriskactivity.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/security/fs_highriskactivity.md
index 9dccb9f90b..bc52c322aa 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/security/fs_highriskactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/security/fs_highriskactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
**FS_HighRiskActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -37,4 +37,4 @@ produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| High Risk Activity | High Risk Activity is any action performed by a user who has access to a particular resource only through a High Risk Trustee (for example, Everyone, Authenticated Users, or Domain Users). Unless action is taken, these users will lose access once the open access is remediated. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of three elements: - Pie Chart – Displays last 30 days of activity
- Table – Provides details on activity by user
- Table – Provides details on activity by share
|
+| High Risk Activity | High Risk Activity is any action performed by a user who has access to a particular resource only through a High Risk Trustee (for example, Everyone, Authenticated Users, or Domain Users). Unless you take action, these users lose access when you remediate the open access. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of three elements: - Pie Chart – Displays last 30 days of activity
- Table – Provides details on activity by user
- Table – Provides details on activity by share
|
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/security/fs_localuseractivity.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/security/fs_localuseractivity.md
index 3381209398..e6b38dc0cf 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/security/fs_localuseractivity.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/security/fs_localuseractivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
**FS_LocalUserActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_deniedactivity.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_deniedactivity.md
index 9a8d2023a8..e08a3250ed 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_deniedactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_deniedactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_DeniedActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_highesthourlyactivity.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_highesthourlyactivity.md
index 8976e492cb..b03329321f 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_highesthourlyactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_highesthourlyactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_HighestHourlyActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_hourlyshareactivity.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_hourlyshareactivity.md
index 740e08aa60..31d430b9f7 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_hourlyshareactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_hourlyshareactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_HourlyShareActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_modifiedbinaries.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_modifiedbinaries.md
index 4db2a8a819..745869a37e 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_modifiedbinaries.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_modifiedbinaries.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_ModifiedBinaries** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_peergroupactivity.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_peergroupactivity.md
index 3549087fb2..7b671ce075 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_peergroupactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_peergroupactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_PeerGroupActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_ransomware.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_ransomware.md
index 39f800dbfc..2c66ad1f90 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_ransomware.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_ransomware.md
@@ -6,10 +6,9 @@ sidebar_position: 60
# FS_Ransomware Job
-The FS_Ransomware job is comprised of analysis and reports which use the data collected by the
-**0.Collection** job group to provide information on periods of time in which users are responsible
-for an abnormally high number of updates. This can be indicative of ransomware. Additionally,
-activity involving files which are known as ransomware artifacts is highlighted.
+The FS_Ransomware job uses the data collected by the **0.Collection** job group to identify periods
+when users make an abnormally high number of updates, which can indicate ransomware. It also
+highlights activity involving known ransomware artifacts.
## Analysis Tasks for the FS_Ransomeware Job
@@ -17,7 +16,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_Ransomware** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_sensitivedataactivity.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_sensitivedataactivity.md
index 8ddbbf1334..bccc55714c 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_sensitivedataactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_sensitivedataactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_SensitiveDataActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_stalefileactivity.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_stalefileactivity.md
index d5819ebad5..999d04901b 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_stalefileactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_stalefileactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_StaleFileActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_usershareactivity.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_usershareactivity.md
index 27e3b48479..c57a8b973b 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_usershareactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_usershareactivity.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_UserShareActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_weekendactivity.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_weekendactivity.md
index 5d295c5ba7..b4c984eec7 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_weekendactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/suspiciousactivity/fs_weekendactivity.md
@@ -17,7 +17,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Activity** > **FS_WeekendActivity** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_groupusage.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_groupusage.md
index 3d69cc9333..70d9486da7 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_groupusage.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_groupusage.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Statistics** > **FS_GroupUsage** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_mostactiveservers.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_mostactiveservers.md
index 4a195f256e..615326daa8 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_mostactiveservers.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_mostactiveservers.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Statistics** > **FS_MostActiveServers** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_mostactiveusers.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_mostactiveusers.md
index 2d26861f81..5597182f28 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_mostactiveusers.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_mostactiveusers.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Statistics** > **FS_MostActiveUsers** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_staleshares.md b/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_staleshares.md
index b03dc71b1f..f07c944fd1 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_staleshares.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/activity/usagestatistics/fs_staleshares.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **FileSystem** > **5.Activity** > *
Statistics** > **FS_StaleShares** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/adhocaudits/fs_shareaudit.md b/docs/accessanalyzer/12.0/solutions/filesystem/adhocaudits/fs_shareaudit.md
index f9e248e258..9c5d6bb905 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/adhocaudits/fs_shareaudit.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/adhocaudits/fs_shareaudit.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the FileSystem > Ad Hoc Audits > FS_Sha
node and select Analysis.
:::warning
-Do not modify or deselect the last three selected analysis tasks. The analysis tasks
+Don't modify or deselect the last three selected analysis tasks. The analysis tasks
are preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/adhocaudits/fs_trusteepermissions.md b/docs/accessanalyzer/12.0/solutions/filesystem/adhocaudits/fs_trusteepermissions.md
index 00ce7c1bf7..61a7494561 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/adhocaudits/fs_trusteepermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/adhocaudits/fs_trusteepermissions.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the FileSystem > Ad Hoc Audits > FS_Tru
Configure node and select Analysis.
:::warning
-Do not modify or deselect the second selected analysis task. The analysis task is
+Don't modify or deselect the second selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -38,4 +38,4 @@ produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ------------------------- | ------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Trustee Permissions Audit | This report provides an overview of the access sprawl across the environment for the select trustee(s). | None | This report is comprised of two elements: - Bar Chart – Displays summary of trustees
- Table – Provides details on trustee permissions
|
+| Trustee Permissions Audit | This report provides an overview of the access sprawl across the environment for the select trustees. | None | This report is comprised of two elements: - Bar Chart – Displays summary of trustees
- Table – Provides details on trustee permissions
|
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/adhocaudits/overview.md b/docs/accessanalyzer/12.0/solutions/filesystem/adhocaudits/overview.md
index 1ba94793f9..262fffc3bb 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/adhocaudits/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/adhocaudits/overview.md
@@ -9,7 +9,7 @@ sidebar_position: 100
The Ad Hoc Audits Job Group is designed to report on resources and trustees that have been provided
by the user from targeted file servers.
-The Ad Hoc Audits Job Group tables and reports are blank if the CSV file is not modified to contain
+The Ad Hoc Audits Job Group tables and reports are blank if the CSV file isn't modified to contain
the required information before job execution.
:::info
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/delete/fs_deletefiles.md b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/delete/fs_deletefiles.md
index abe42051f5..c3d83a6fe2 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/delete/fs_deletefiles.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/delete/fs_deletefiles.md
@@ -11,7 +11,7 @@ previously quarantined and can be deleted.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -30,7 +30,7 @@ Navigate to the **FileSystem** > **Cleanup** > **4. Delete** > **FS_DeleteFiles*
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -64,7 +64,7 @@ Navigate to the **FileSystem** > **Cleanup** > **4. Delete** > **FS_DeleteFiles*
node and select **Actions** to view the action tasks.
:::warning
-Do not enable the action unless it is required. Disable the action after execution to
+Don't enable the action unless it is required. Disable the action after execution to
prevent making unintended and potentially harmful changes to Active Directory.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/delete/fs_deletefiles_status.md b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/delete/fs_deletefiles_status.md
index 706a39d97a..d13683311a 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/delete/fs_deletefiles_status.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/delete/fs_deletefiles_status.md
@@ -16,7 +16,7 @@ Navigate to the **FileSystem** > **Cleanup** > **4. Delete** > **FS_DeleteFiles_
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/fs_cleanupassessment.md b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/fs_cleanupassessment.md
index 5e29df3fee..985b2e5212 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/fs_cleanupassessment.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/fs_cleanupassessment.md
@@ -35,7 +35,7 @@ have completed.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -58,7 +58,7 @@ Navigate to the **FileSystem** > **Cleanup** > **1. Cleanup Assessment** >
**FS_CleanupAssessment** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -140,7 +140,7 @@ Data Collector Wizard opens.
the **Collect tags/keywords from file metadata properties** option.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/fs_cleanupprogress.md b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/fs_cleanupprogress.md
index cf8ee551c5..4acaae00b8 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/fs_cleanupprogress.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/fs_cleanupprogress.md
@@ -15,7 +15,7 @@ Navigate to the **FileSystem** > **Cleanup** > **FS_CleanupProgress** > **Config
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/notify/fs_notifyowners.md b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/notify/fs_notifyowners.md
index 71e9cf1cc1..d1100f6889 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/notify/fs_notifyowners.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/notify/fs_notifyowners.md
@@ -16,7 +16,7 @@ Navigate to the **FileSystem** > **Cleanup** > **2. Notify** > **FS_NotifyOwners
node and select **Actions** to view the action tasks.
:::warning
-Do not enable the action unless it is required. Disable the action after execution to
+Don't enable the action unless it is required. Disable the action after execution to
prevent making unintended and potentially harmful changes to Active Directory.
:::
@@ -27,7 +27,7 @@ The following action task is deselected by default.
- Notify Owners – Notifies share owners using SendMail module
-Prior to running the FS_NotifyOwners job, it is necessary to select the **Notify Owners** task and
+Before running the FS_NotifyOwners job, select the **Notify Owners** task and
configure the properties for the SendMail action module. See the
[Configure the FS_NotifyOwners Action](#configure-the-fs_notifyowners-action) topic for additional
information.
@@ -37,12 +37,12 @@ information.
The recipients and the text of the email can be customized on the Properties page within the Send
Mail Action Module Wizard. The
[1. Cleanup Assessment > FS_CleanupAssessment Job](/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/fs_cleanupassessment.md) must be run before
-the Send Mail Action Module Wizard can be opened. Follow these steps to customize the Notify Owners
-action task.
+the Send Mail Action Module Wizard can be opened. To customize the Notify Owners
+action task:
**Step 1 –** Navigate to the job’s **Configure** node and select **Actions**.
-**Step 2 –** In the Action Selection view, select the desired action task and click **Action
+**Step 2 –** In the Action Selection view, select the action task you want and click **Action
Properties** to view the Action Properties page.
**Step 3 –** Click **Configure Action** to open the Send Mail Action Module Wizard.
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/notify/fs_notifyowners_status.md b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/notify/fs_notifyowners_status.md
index 3a2c8f99b7..781c3badda 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/notify/fs_notifyowners_status.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/notify/fs_notifyowners_status.md
@@ -16,7 +16,7 @@ Navigate to the **FileSystem** > **Cleanup** > **2. Notify** > **FS_NotifyOwners
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/overview.md b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/overview.md
index 6ef4d927c7..7b702a08da 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/overview.md
@@ -35,8 +35,8 @@ The Cleanup job group includes the following job groups and jobs:
Many jobs in this group include one or more pre-built actions designed to apply operations to the
data tables generated by the job’s analysis tasks. These actions perform the cleanup operations. By
-default, the actions do not execute as part of the job group. You must select the actions you want
-to run prior to execution. See the [Action Modules](/docs/accessanalyzer/12.0/admin/action/overview.md) topic for
+default, the actions don't execute as part of the job group. You must select the actions you want
+to run before execution. See the [Action Modules](/docs/accessanalyzer/12.0/admin/action/overview.md) topic for
additional information.
## Recommended Configurations for the FS Cleanup Job Group
@@ -47,7 +47,7 @@ The Cleanup job group has the following recommended configuration settings.
The Cleanup job group has the following prerequisites:
-- Successfully execute the **.Active Directory Inventory** job group prior to running this job group
+- Successfully execute the **.Active Directory Inventory** job group before running this job group
- The **File System Actions** license must be installed
- Successfully execute the **FileSystem** > **0.Collection** job group with the following options
enabled:
@@ -64,7 +64,7 @@ dependencies. See the relevant topic for the job or job group for information ab
**Target Host**
-This job group does not collect data. No target host is required.
+This job group doesn't collect data. No target host is required.
**Schedule Frequency**
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_quarantinedata.md b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_quarantinedata.md
index e45883e953..56e2134b83 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_quarantinedata.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_quarantinedata.md
@@ -14,13 +14,13 @@ Navigate to the **FileSystem** > **Cleanup** > **3. Quarantine** > **FS_Quaranti
**Configure** node and select **Actions** to view the action tasks.
:::warning
-Do not enable the actions unless they are required. Disable the actions after execution
+Don't enable the actions unless they are required. Disable the actions after execution
to prevent making unintended and potentially harmful changes to Active Directory.
:::
:::warning
-Do not modify the action tasks. The action tasks are preconfigured for this job.
+Don't modify the action tasks. The action tasks are preconfigured for this job.
:::
@@ -31,5 +31,5 @@ The following action tasks are deselected by default:
- Give domain user full control – Gives a specified domain user full control over stale files
- Break inherited permissions – Breaks inherited permissions
-Prior to running the FS_QuarantineData job, it is necessary to select the **Give domain user full
+Before running the FS_QuarantineData job, select the **Give domain user full
control** or **Break inherited permissions** task to perform an action.
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_quarantinedata_status.md b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_quarantinedata_status.md
index 4f641a3107..1295fb62b1 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_quarantinedata_status.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_quarantinedata_status.md
@@ -15,7 +15,7 @@ Navigate to the **FileSystem** > **Cleanup** > **3. Quarantine** > **FS_Quaranti
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance.md b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance.md
index d2f704fdbe..d91544292a 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance.md
@@ -14,7 +14,7 @@ Navigate to the **FileSystem** > **Cleanup** > **3. Quarantine** > **FS_RestoreI
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -32,13 +32,13 @@ Navigate to the **FileSystem** > **Cleanup** > **3. Quarantine** > **FS_RestoreI
**Configure** node and select **Actions** to view the action tasks.
:::warning
-Do not enable the action unless it is required. Disable the action after execution to
+Don't enable the action unless it is required. Disable the action after execution to
prevent making unintended and potentially harmful changes to Active Directory.
:::
:::warning
-Do not modify the action task. The action task is preconfigured for this job.
+Don't modify the action task. The action task is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance_status.md b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance_status.md
index 8af2597e1f..35e6d2f130 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance_status.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/cleanup/quarantine/fs_restoreinheritance_status.md
@@ -16,7 +16,7 @@ Navigate to the **FileSystem** > **Cleanup** > **3. Quarantine** >
tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/collection/0-create_schema.md b/docs/accessanalyzer/12.0/solutions/filesystem/collection/0-create_schema.md
index 19203ed329..73da320190 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/collection/0-create_schema.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/collection/0-create_schema.md
@@ -8,11 +8,11 @@ sidebar_position: 10
The 0-Create Schema job within the 0.Collection job group creates and updates the schema for the
tables, views, and functions used by the rest of the File System Solution. This job needs to run
-prior to the other jobs in the 0.Collection job group for both new installations and upgrades. The
-job can be scheduled with any of the collections. Do not delete the job from the job tree.
+before the other jobs in the 0.Collection job group for both new installations and upgrades. The
+job can be scheduled with any of the collections. Don't delete the job from the job tree.
:::info
-This job does not need to be moved. Leave it to run as part of the 0.Collection
+This job doesn't need to be moved. Leave it to run as part of the 0.Collection
job group.
:::
@@ -23,7 +23,7 @@ View the analysis task by navigating to the **FileSystem** > **0.Collection** >
Schema** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/collection/0-fs_nasuni.md b/docs/accessanalyzer/12.0/solutions/filesystem/collection/0-fs_nasuni.md
index 711d744de9..9fd5803b21 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/collection/0-fs_nasuni.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/collection/0-fs_nasuni.md
@@ -6,13 +6,13 @@ sidebar_position: 30
# 0-FS_Nasuni Job
-The 0-FS_Nasuni job is required in order to target Nasuni Edge Appliances. The job can be added from
+The 0-FS_Nasuni job is required to target Nasuni Edge Appliances. The job can be added from
the Access Analyzer Instant Job Library. See the
[Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md) topic to add this instant job to
the 0.Collection job group.
:::warning
-It is necessary to rename the job after it has been added to the 0.Collection job group
+Rename the job after it has been added to the 0.Collection job group
from **FS_Nasuni** to **0-FS_Nasuni**, so that it runs immediately after the 0-Create Schema job.
:::
@@ -32,7 +32,7 @@ The queries for the 0-FS_Nasuni job use the PowerShell Data collector to gather
volume data, and share data from the Nasuni environment.
:::warning
-Do not modify the queries. The queries are preconfigured for this job.
+Don't modify the queries. The queries are preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/collection/0-fsdfs_system_scans.md b/docs/accessanalyzer/12.0/solutions/filesystem/collection/0-fsdfs_system_scans.md
index 63a62bb1fa..bc85e1b770 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/collection/0-fsdfs_system_scans.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/collection/0-fsdfs_system_scans.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# 0-FSDFS System Scans Job
-The 0-FSDFS System Scans job enumerates a list of all root and link targets in the distributed file
-system and creating a dynamic host list that will be used by the components.
+The 0-FSDFS System Scans job enumerates all root and link targets in the distributed file system
+and creates a dynamic host list for the components to use.
## Query for the 0-FSDFS System Scans Job
@@ -15,7 +15,7 @@ The DFS System Scan Query uses the FSAA Data Collector and has been preconfigure
Scan Category.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
@@ -29,7 +29,7 @@ View the analysis tasks by navigating to the **FileSystem** > **0.Collection** >
Scans** > **Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/collection/1-fsac_system_scans.md b/docs/accessanalyzer/12.0/solutions/filesystem/collection/1-fsac_system_scans.md
index 00932ab84c..3f1750dcc9 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/collection/1-fsac_system_scans.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/collection/1-fsac_system_scans.md
@@ -56,7 +56,7 @@ purpose of this job.
**Step 4 –** The Applet Settings page applies to the applet and proxy mode scans which you select
-on the Scan Server Level Page. If employing proxy servers, see the
+on the Scan Server Selection page. If employing proxy servers, see the
[FSAA: Applet Settings](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/appletsettings/appletsettings.md) topic for configuration
instructions.
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/collection/1-seek_system_scans.md b/docs/accessanalyzer/12.0/solutions/filesystem/collection/1-seek_system_scans.md
index 9aa94e6a58..b85011479c 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/collection/1-seek_system_scans.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/collection/1-seek_system_scans.md
@@ -39,7 +39,7 @@ The following default configurations are commonly customized:
- Set to **Store discovered sensitive data**
- Set to scan typical documents
-- SDD Criteria Settings page:
+- SDD (Sensitive Data Discovery) Criteria Settings page:
- Set to the following System Criteria:
@@ -76,7 +76,7 @@ purpose of this job.
**Step 4 –** The Applet Settings page applies to the applet and proxy mode scans which you select
-on the Scan Server Level page. If employing proxy servers, see the
+on the Scan Server Selection page. If employing proxy servers, see the
[FSAA: Applet Settings](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/appletsettings/appletsettings.md) topic for configuration
instructions.
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-fsaa_bulk_import.md b/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-fsaa_bulk_import.md
index db03016aaf..538e90d7ab 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-fsaa_bulk_import.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-fsaa_bulk_import.md
@@ -18,7 +18,7 @@ access/permission auditing Bulk import category.
- Bulk import – Imports scan data into SQL Server
- - Typically, this query is not modified. See the
+ - Typically, this query isn't modified. See the
[FileSystemAccess Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/overview.md) topic for
information on when this query should be modified.
@@ -28,7 +28,7 @@ View the analysis tasks by navigating to the **FileSystem** > **0.Collection** >
Import** > **Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-fsac_bulk_import.md b/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-fsac_bulk_import.md
index 6102576187..805cdf198a 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-fsac_bulk_import.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-fsac_bulk_import.md
@@ -18,6 +18,6 @@ activity Bulk import category.
- Bulk Import – Imports data into SQL Server
- - Typically this query is not modified. See the
+ - Typically this query isn't modified. See the
[FileSystemAccess Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/overview.md) topic for
information on when this query should be modified.
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-seek_bulk_import.md b/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-seek_bulk_import.md
index acf10d45ea..240238d9b3 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-seek_bulk_import.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-seek_bulk_import.md
@@ -18,6 +18,6 @@ data Bulk import category.
- Bulk Import – Imports data into SQL server
- - Typically this query is not modified. See the
+ - Typically this query isn't modified. See the
[FileSystemAccess Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/overview.md) topic for
information on when this query should be modified.
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/collection/3-fsaa_exceptions.md b/docs/accessanalyzer/12.0/solutions/filesystem/collection/3-fsaa_exceptions.md
index a89afa028f..8ae598bdc5 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/collection/3-fsaa_exceptions.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/collection/3-fsaa_exceptions.md
@@ -6,19 +6,19 @@ sidebar_position: 100
# 3-FSAA Exceptions Job
-The 3-FSAA Exceptions job does not use the FSAA Data Collector. Instead it runs analysis on the data
+The 3-FSAA Exceptions job doesn't use the FSAA Data Collector. Instead it runs analysis on the data
returned by the Access Auditing collection jobs to identify potential security concerns.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
The 3-FSAA Exceptions job has the following customizable parameter:
-- Well Known high risk SIDS – Add any additional custom SIDS, but do not remove the default SIDS.
+- Well Known high risk SIDS – Add any additional custom SIDS, but don't remove the default SIDS.
See the
[Analysis Tasks for the 3-FSAA Exceptions Job](#analysis-tasks-for-the-3-fsaa-exceptions-job) topic
@@ -30,8 +30,8 @@ View the analysis tasks by navigating to the **FileSystem** > **0.Collection** >
Exceptions** > **Configure** node and select **Analysis**.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified and or
-deselected. While it is possible to deselect particular tasks as specified, it is not recommended.
+Most of these analysis tasks are preconfigured and shouldn't be modified and or
+deselected. You can deselect particular tasks as specified, but it isn't recommended.
:::
@@ -40,20 +40,20 @@ deselected. While it is possible to deselect particular tasks as specified, it i
The following analysis tasks are selected by default:
- Open resources – Any folders that are openly accessible through file shares. Can be deselected if
- open resource information is not desired.
+ open resource information isn't desired.
- - Well known high risk SIDS have been set in the `#SIDS` parameter. Do not remove these, but
- additional custom SIDS can be added. See the
+ - Well known high risk SIDS have been set in the `#SIDS` parameter. Don't remove these, but you
+ can add additional custom SIDS. See the
[Configure the Customizable Parameters in an Analysis Task](/docs/accessanalyzer/12.0/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md)
topic for additional information.
- Disabled users – Any folders where disabled users have been granted access
- - Can be deselected if disabled user information is not desired
+ - Can be deselected if disabled user information isn't desired
-- Stale users – Any folders where stale users have been granted access. Stale users are user who
+- Stale users – Any folders where stale users have been granted access. Stale users are users who
have not logged in for more than 120 days.
- - Can be deselected if stale user information is not desired
+ - Can be deselected if stale user information isn't desired
- Reindex Exception IDs – Displays views within the **Results** node of the Access Analyzer Console
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/collection/3-fsac_exceptions.md b/docs/accessanalyzer/12.0/solutions/filesystem/collection/3-fsac_exceptions.md
index ca565fdf69..d759131f84 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/collection/3-fsac_exceptions.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/collection/3-fsac_exceptions.md
@@ -10,7 +10,7 @@ The 3-FSAC Exceptions job is designed to analyze collected access information fo
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -25,7 +25,7 @@ View the analysis tasks by navigating to the **FileSystem** > **0.Collection** >
Exceptions** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -44,7 +44,7 @@ The following analysis tasks are selected by default:
- Ransomware – Spikes in updates by user
- Unusual user stale data activity – Spikes in stale data activity by user
-While it is possible to deselect particular tasks as specified, it is not recommended. The following
+You can deselect particular tasks as specified, but it isn't recommended. The following
analysis tasks are deselected by default:
- Show view – Displays the SA_FSAC_ExceptionsView within the Results node of the Access Analyzer
@@ -54,7 +54,7 @@ analysis tasks are deselected by default:
### Customizable Analysis Tasks for the 3-FSAC Exceptions Job
-Customizable parameters enable users to set the values used for classification during the job’s
+Use customizable parameters to set the values used for classification during the job’s
analysis. The 3-FSAC Exceptions job contains the following customizable parameters:
| Analysis Task | Customizable Parameter Name | Default Value | Value Indicates |
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/collection/fs_azuretenantscan.md b/docs/accessanalyzer/12.0/solutions/filesystem/collection/fs_azuretenantscan.md
index 917690bd99..398af9af42 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/collection/fs_azuretenantscan.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/collection/fs_azuretenantscan.md
@@ -13,7 +13,7 @@ Files scans.
You can add this job from the Access Analyzer Instant Job Library. See the
[Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md) topic for additional information.
-Before running the FS_AzureTenantScan job, you must ensure all the below prerequisites have been
+Before running the FS_AzureTenantScan job, you must ensure all the following prerequisites are
met, and that the required host list and connection profile have been assigned to the job.
## Prerequisites
@@ -32,12 +32,12 @@ The FS_AzureTenantScan job has the following prerequisites:
- Storage Account
:::note
- The custom role cannot be created at the storage account level via the web UI, but
+ The custom role can't be created at the storage account level via the web UI, but
it can be assigned here.
:::
-Follow the steps to create the role assignment.
+To create the role assignment:
**Step 1 –** Go to [Azure Portal](https://portal.azure.com/), and select **Resource Groups** from
the navigation menu.
@@ -79,7 +79,7 @@ The Azure Tenant Scan query uses the FSAA Data Collector and has been preconfigu
Scan and import category.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/collection/overview.md b/docs/accessanalyzer/12.0/solutions/filesystem/collection/overview.md
index 1551be934a..5464298c8a 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/collection/overview.md
@@ -46,7 +46,7 @@ considerations:
- A system scans job executed from a Access Analyzer Console must be followed by the corresponding
bulk import job from the same Access Analyzer Console with the same version of Access Analyzer
-- Two system scans processing the same information, for example two 1-FSAA System Scans jobs, cannot
+- Two system scans processing the same information, for example two 1-FSAA System Scans jobs, can't
be executed consecutively against the same target host. The corresponding bulk import job, for
example 2-FSAA Bulk Import job, must be executed in between.
@@ -54,7 +54,7 @@ The system scans job collects the data and creates a Tier-2 database, or SQLite
local host, target host, or proxy host (according to the Applet Gathering Settings configured). The
corresponding bulk import job gathers the information from the Tier-2 database, and pulls it into
the Tier-1 database, or Access Analyzer SQL backend database, thus completing the collection
-process. The collection does not include a bulk import job, as it streams the collected data
+process. The collection doesn't include a bulk import job, as it streams the collected data
directly into the Tier-1 database.
## File System Access Auditing
@@ -72,7 +72,7 @@ The 0.Collection jobs that comprise this auditing component are:
- [2-FSAA Bulk Import Job](/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-fsaa_bulk_import.md) – Imports collected access information from the
targeted file servers
- - The 2-FSAA Bulk Import job does not need to be run when streaming is enabled
+ - The 2-FSAA Bulk Import job doesn't need to be run when streaming is enabled
- [3-FSAA Exceptions Job](/docs/accessanalyzer/12.0/solutions/filesystem/collection/3-fsaa_exceptions.md) – Analyzes collected access information for
exceptions
@@ -101,7 +101,7 @@ for additional information.
It is more efficient to streamline the collection jobs to those desired. Remember, it is a best
practice to scope the 0.Collection job group to only include the collection components desired by
disabling the undesired collection jobs. Disabling them allows the solution to run more efficiently.
-It is not recommended to delete any jobs. The required collection jobs are listed for the following
+It isn't recommended to delete any jobs. The required collection jobs are listed for the following
workflow.
**Workflow (for Access Auditing only)**
@@ -112,9 +112,9 @@ The recommended workflow for Access Auditing only is as follows:
**Step 2 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -123,10 +123,10 @@ The recommended workflow for Access Auditing only is as follows:
**Step 3 –** Run the **3-FSAA Exceptions** job.
-**Step 4 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 4 –** Run the corresponding analysis and reporting sub-job groups you want.
:::note
-Please see the [Recommended Configuration for the File System Solution](/docs/accessanalyzer/12.0/solutions/filesystem/recommended.md)
+See the [Recommended Configuration for the File System Solution](/docs/accessanalyzer/12.0/solutions/filesystem/recommended.md)
topic before continuing with this workflow.
:::
@@ -163,7 +163,8 @@ The 0.Collection jobs that comprise the DFS auditing component are:
- When run successfully, the 0-FSDFS System Scans job automatically creates a dynamic host list
called **DFS HOST LIST**. This is added to the Host Management node. You should assign this
- **DFS HOST LIST** to other 0.Collection jobs as outlined in the recommended workflows below.
+ **DFS HOST LIST** to other 0.Collection jobs as outlined in the recommended workflows in this
+ section.
The components depend on data collected by these jobs to collect within a file system using DFS
mappings.
@@ -171,7 +172,7 @@ mappings.
It is more efficient to streamline the collection jobs to those desired. Remember, it is a best
practice to scope the 0.Collection job group to only include the collection components desired by
disabling the undesired collection jobs. Disabling them allows the solution to run more efficiently.
-It is not recommended to delete any jobs. The required collection jobs are listed for each of the
+It isn't recommended to delete any jobs. The required collection jobs are listed for each of the
following optional workflows.
:::warning
@@ -189,9 +190,9 @@ destinations.
**Step 3 –** If necessary, run the **2-FSAA Bulk Import** job (with the **DFS HOST LIST** assigned):
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -201,7 +202,7 @@ destinations.
**Step 4 –** Run the **3-FSAA Exceptions** job (not specifically needed for DFS Auditing, but
recommended for **0.Collection** job group).
-**Step 5 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 5 –** Run the corresponding analysis and reporting sub-job groups you want.
Recommended Workflow 2 (for AccessAuditing with DFS Auditing and Activity Auditing)
@@ -216,9 +217,9 @@ only).
**Step 5 –** If necessary, run the **2-FSAA Bulk Import** job (with the **DFS HOST LIST** assigned):
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -231,7 +232,7 @@ only).
**Step 8 –** Run the **3-FSAC Exceptions** job.
-**Step 9 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 9 –** Run the corresponding analysis and reporting sub-job groups you want.
Recommended Workflow 3 (for AccessAuditing with DFS Auditing, Activity, and Sensitive Data Discovery
Auditing)
@@ -249,9 +250,9 @@ only).
**Step 6 –** If necessary, run the **2-FSAA Bulk Import** job (with the **DFS HOST LIST** assigned):
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -262,9 +263,9 @@ only).
**Step 8 –** If necessary, run the **2-SEEK Bulk Import** job (with the **DFS HOST LIST** assigned):
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -276,10 +277,10 @@ only).
**Step 10 –** Run the **3-FSAC Exceptions** job.
-**Step 11 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 11 –** Run the corresponding analysis and reporting sub-job groups you want.
:::note
-Please see the [Recommended Configuration for the File System Solution](/docs/accessanalyzer/12.0/solutions/filesystem/recommended.md)
+See the [Recommended Configuration for the File System Solution](/docs/accessanalyzer/12.0/solutions/filesystem/recommended.md)
topic before continuing with these workflows.
:::
@@ -305,12 +306,12 @@ for additional information.
:::
-Once the Activity Monitor is installed, the monitored host configuration tells it what to monitor
+After the Activity Monitor is installed, the monitored host configuration tells it what to monitor
and how long to retain the activity log files. The monitoring agent writes one log per day of
activity for the host. Then, the FSAA Data Collector gathers the log files to report on file system
activity for the targeted host. While the Activity Monitor can be configured to create multiple
-outputs, Access Analyzer can only collect one log file per host. Therefore, after the monitored host
-has been configured, it is necessary to identify the log file for Access Analyzer. See the
+outputs, Access Analyzer can only collect one log file per host. Therefore, after you configure the
+monitored host, identify the log file for Access Analyzer. See the
[Identify a Log File](#identify-a-log-file) topic for additional information.
The data retention period needs to be coordinated between the Activity Monitor and Access Analyzer.
@@ -355,7 +356,7 @@ for additional information.
It is more efficient to streamline the collection jobs to those desired. Remember, it is a best
practice to scope the 0.Collection job group to only include the collection components desired by
disabling the undesired collection jobs. Disabling them allows the solution to run more efficiently.
-It is not recommended to delete any jobs. The required collection jobs are listed for each of the
+It isn't recommended to delete any jobs. The required collection jobs are listed for each of the
following optional workflows.
**Recommended Workflow 1 (for Access and Activity Auditing)**
@@ -369,9 +370,9 @@ only).
**Step 4 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -384,7 +385,7 @@ only).
**Step 7 –** Run the **3-FSAC Exceptions** job.
-**Step 8 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 8 –** Run the corresponding analysis and reporting sub-job groups you want.
Recommended Workflow 2 (for Access, Activity, and Sensitive Data Discovery Auditing)
@@ -399,9 +400,9 @@ only).
**Step 5 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -412,9 +413,9 @@ only).
**Step 7 –** If necessary, run the **2-SEEK Bulk Import** job:
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -426,7 +427,7 @@ only).
**Step 9 –** Run the **3-FSAC Exceptions** job.
-**Step 10 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 10 –** Run the corresponding analysis and reporting sub-job groups you want.
Recommended Workflow 3 (for Access, Activity, DFS, and Sensitive Data Discovery Auditing)
@@ -443,9 +444,9 @@ only).
**Step 6 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -456,9 +457,9 @@ only).
**Step 8 –** If necessary, run the **2-SEEK Bulk Import** job:
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -470,9 +471,9 @@ only).
**Step 10 –** Run the **3-FSAC Exceptions** job.
-**Step 11 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 11 –** Run the corresponding analysis and reporting sub-job groups you want.
-Optional Workflow (for Activity Auditing data collection only )
+Optional Workflow (for Activity Auditing data collection only)
While activity data can be collected independently, the Activity reports require the Access Auditing
components.
@@ -486,10 +487,10 @@ only).
**Step 4 –** Run the **3-FSAC Exceptions** job.
-**Step 5 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 5 –** Run the corresponding analysis and reporting sub-job groups you want.
:::note
-Please see the [Recommended Configuration for the File System Solution](/docs/accessanalyzer/12.0/solutions/filesystem/recommended.md)
+See the [Recommended Configuration for the File System Solution](/docs/accessanalyzer/12.0/solutions/filesystem/recommended.md)
topic before continuing with these workflows.
:::
@@ -498,8 +499,8 @@ topic before continuing with these workflows.
While the Activity Monitor can have multiple configurations per host, Access Analyzer can only read
one of them. Therefore, after the Activity Monitor has been configured to monitor a host, it is
-necessary to indicate when that configuration is for Access Analyzer. Follow these steps to identify
-the Log file to be read by Access Analyzer.
+necessary to indicate when that configuration is for Access Analyzer. To identify
+the Log file to be read by Access Analyzer:
**Step 1 –** Within the Activity Monitor Console on the **Monitored Hosts** tab, select the desired
configuration and click **Edit**.
@@ -526,7 +527,8 @@ with `SEEK`. The tables and views are prefixed with `FSDLP`. See the
topic for additional information on the data collected.
Customized search criteria can be created with the Criteria Editor accessible through the SDD
-Criteria Settings page of the File System Access Auditor Data Collector Wizard. See the
+(Sensitive Data Discovery) Criteria Settings page of the File System Access Auditor Data Collector
+Wizard. See the
[Configure the (SEEK) File System Scan Query](1-seek_system_scans.md#configure-the-seek-file-system-scan-query)
topic for additional information.
@@ -540,15 +542,14 @@ for additional information.
**Option to Enable Last Access Timestamp**
-The Last Access Timestamp (LAT) is disabled by default in Windows. This means the LAT does not get
+The Last Access Timestamp (LAT) is disabled by default in Windows. This means the LAT doesn't get
updated by any applications reading the file. As soon as the LAT feature is enabled in Windows, any
attempt to read file contents updates the LAT. It stores the time of the last read operation.
Since files are read during the Sensitive Data Discovery Auditing scan, when the feature is enabled
-in Windows the scan causes each file's LAT to update each time the file is scanned. Therefore, there
-is a feature within the job XML file which enables the scan to call a special API in order to keep
-each file's LAT from updating when it's scanned. This feature can be enabled by adding
-`` tag to the XML. See the [1-SEEK System Scans Job](/docs/accessanalyzer/12.0/solutions/filesystem/collection/1-seek_system_scans.md)
+in Windows the scan causes each file's LAT to update each time the file is scanned. Therefore, the
+job XML file includes a feature that calls a special API to keep each file's LAT from updating when
+scanned. Enable this feature by adding the `` tag to the XML. See the [1-SEEK System Scans Job](/docs/accessanalyzer/12.0/solutions/filesystem/collection/1-seek_system_scans.md)
topic for additional information and instructions.
This feature works for all scan modes when targeting Windows machines.
@@ -566,7 +567,7 @@ The 0.Collection jobs that comprise this auditing component are:
- [2-SEEK Bulk Import Job](/docs/accessanalyzer/12.0/solutions/filesystem/collection/2-seek_bulk_import.md) – Imports collected sensitive data information
from the targeted file servers
- - The 2-SEEK Bulk Import job does not need to be run when streaming is enabled
+ - The 2-SEEK Bulk Import job doesn't need to be run when streaming is enabled
The following job group and jobs in the File System solution depend on data collected by these jobs
to generate reports:
@@ -584,7 +585,7 @@ for additional information.
It is more efficient to streamline the collection jobs to those desired. Remember, it is a best
practice to scope the 0.Collection job group to only include the collection components desired by
disabling the undesired collection jobs. Disabling them allows the solution to run more efficiently.
-It is not recommended to delete any jobs. The required collection jobs are listed for the following
+It isn't recommended to delete any jobs. The required collection jobs are listed for the following
workflows.
Recommended Workflow 1 (for Access and Sensitive Data Discovery Auditing data collection)
@@ -601,9 +602,9 @@ the Activity Auditing components.
**Step 3 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -612,9 +613,9 @@ the Activity Auditing components.
**Step 4 –** If necessary, run the **2-SEEK Bulk Import** job:
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -624,7 +625,7 @@ the Activity Auditing components.
**Step 5 –** Run the **3-FSAA Exceptions** job.
-**Step 6 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 6 –** Run the corresponding analysis and reporting sub-job groups you want.
Recommended Workflow 2 (for Access, Activity, and Sensitive Data Discovery Auditing)
@@ -639,9 +640,9 @@ only).
**Step 5 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -652,9 +653,9 @@ only).
**Step 7 –** If necessary, run the **2-SEEK Bulk Import** job:
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -666,7 +667,7 @@ only).
**Step 9 –** Run the **3-FSAC Exceptions** job.
-**Step 10 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 10 –** Run the corresponding analysis and reporting sub-job groups you want.
Recommended Workflow 3 (for Access, Activity, DFS, and Sensitive Data Discovery Auditing)
@@ -683,9 +684,9 @@ only).
**Step 6 –** If necessary, run the **2-FSAA Bulk Import** job:
-- If streaming is not enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
+- If streaming isn't enabled in the **1-FSAA System Scans** job, run the **2-FSAA Bulk Import**
job.
-- If streaming is enabled in the **1-FSAA System Scans** job, do not run **2-FSAA Bulk Import** job.
+- If streaming is enabled in the **1-FSAA System Scans** job, don't run **2-FSAA Bulk Import** job.
:::info
It is best practice to disable undesired Bulk Import jobs.
@@ -696,9 +697,9 @@ only).
**Step 8 –** If necessary, run the **2-SEEK Bulk Import** job:
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -710,7 +711,7 @@ only).
**Step 10 –** Run the **3-FSAC Exceptions** job.
-**Step 11 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 11 –** Run the corresponding analysis and reporting sub-job groups you want.
Optional Workflow (for Sensitive Data Discovery Auditing data collection only)
@@ -721,9 +722,9 @@ Activity Auditing components.
**Step 2 –** If necessary, run the **2-SEEK Bulk Import** job.
-- If streaming is not enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
+- If streaming isn't enabled in the **1-SEEK System Scans** job, run the **2-SEEK Bulk Import**
job.
-- If streaming is enabled in the **1-SEEK System Scans** job, do not run the **2-SEEK Bulk Import**
+- If streaming is enabled in the **1-SEEK System Scans** job, don't run the **2-SEEK Bulk Import**
job.
:::info
@@ -731,10 +732,10 @@ Activity Auditing components.
:::
-**Step 3 –** Run the desired corresponding analysis and reporting sub-job groups.
+**Step 3 –** Run the corresponding analysis and reporting sub-job groups you want.
:::note
-Please see the [Recommended Configuration for the File System Solution](/docs/accessanalyzer/12.0/solutions/filesystem/recommended.md)
+See the [Recommended Configuration for the File System Solution](/docs/accessanalyzer/12.0/solutions/filesystem/recommended.md)
topic before continuing with these workflows.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/content/fs_filetypes.md b/docs/accessanalyzer/12.0/solutions/filesystem/content/fs_filetypes.md
index f5a2296411..64f5c5f256 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/content/fs_filetypes.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/content/fs_filetypes.md
@@ -18,7 +18,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_FileTypes** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/content/fs_stalecontent.md b/docs/accessanalyzer/12.0/solutions/filesystem/content/fs_stalecontent.md
index 16cac3ed34..faa5d7aaaa 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/content/fs_stalecontent.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/content/fs_stalecontent.md
@@ -19,7 +19,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_StaleContent** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/content/sizing/fs_emptyresources.md b/docs/accessanalyzer/12.0/solutions/filesystem/content/sizing/fs_emptyresources.md
index 9b58b5f1ab..9a1106bca2 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/content/sizing/fs_emptyresources.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/content/sizing/fs_emptyresources.md
@@ -14,7 +14,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_EmptyResources** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/content/sizing/fs_largestresources.md b/docs/accessanalyzer/12.0/solutions/filesystem/content/sizing/fs_largestresources.md
index 9af5fa6c4c..8cb8044b7e 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/content/sizing/fs_largestresources.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/content/sizing/fs_largestresources.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_LargestResources** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/content/sizing/fs_smallestresources.md b/docs/accessanalyzer/12.0/solutions/filesystem/content/sizing/fs_smallestresources.md
index 2cc3b9e696..a4001be897 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/content/sizing/fs_smallestresources.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/content/sizing/fs_smallestresources.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_SmallestResources** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/content/tags/fs_aiplabels.md b/docs/accessanalyzer/12.0/solutions/filesystem/content/tags/fs_aiplabels.md
index 0d55c7e93d..44bd5f22fc 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/content/tags/fs_aiplabels.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/content/tags/fs_aiplabels.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# FS_AIPLabels Job
-The FS_AIPLabels job is designed to report on resources classified by AIP labels from targeted file
-servers.
+The FS_AIPLabels job is designed to report on resources classified by Azure Information Protection
+(AIP) labels from targeted file servers.
## Analysis Tasks for the FS_AIPLabels Job
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_AIPLabels** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/content/tags/fs_filetags.md b/docs/accessanalyzer/12.0/solutions/filesystem/content/tags/fs_filetags.md
index 1d0e190d1d..98dbce0528 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/content/tags/fs_filetags.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/content/tags/fs_filetags.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **4.Content** > **
**FS_FileTags** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_domainuseracls.md b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_domainuseracls.md
index 34ca01c872..7b6cfcc6b4 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_domainuseracls.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_domainuseracls.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_DomainUserACLs** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -34,8 +34,8 @@ The following analysis tasks are selected by default:
- **4. Direct Resources** – Creates an interim processing table in the database for use by downstream
analysis and report generation
-In addition to the tables and views created by the analysis tasks which displays all direct user
-permissions, the FS_DomainUserACLs job produces the following pre-configured report:
+The tables and views created by the analysis tasks display all direct user permissions. In
+addition, the FS_DomainUserACLs job produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ---------------- | -------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_highriskacls.md b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_highriskacls.md
index 213b0f8b35..9e3569a83c 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_highriskacls.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_highriskacls.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_HighRiskACLs** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_localusersandgroups.md b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_localusersandgroups.md
index 9fb9d0fe4b..6676cbef3e 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_localusersandgroups.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_localusersandgroups.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_LocalUsersAndGroups** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_missingfullcontrol.md b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_missingfullcontrol.md
index c127695be8..106fba31a3 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_missingfullcontrol.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_missingfullcontrol.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# FS_MissingFullControl Job
The FS_MissingFullControl job is designed to report on resources from targeted file servers that
-have no Full Control rights granted to it.
+have no Full Control rights granted to them.
## Analysis Tasks for the FS_MissingFullControl Job
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_MissingFullControl** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -34,4 +34,4 @@ produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Missing Full Control Rights | This report identifies folders within the environment which currently do not have any trustee with Full Control rights, adding to administrative burden. | None | This report is comprised of three elements: - Bar Chart – Displays shares with missing full control rights
- Table – Provides details on folder
- Table – Provides details on shares with missing full control rights
|
+| Missing Full Control Rights | This report identifies folders within the environment which don't have any trustee with Full Control rights, adding to administrative burden. | None | This report is comprised of three elements: - Bar Chart – Displays shares with missing full control rights
- Table – Provides details on folder
- Table – Provides details on shares with missing full control rights
|
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_nestedshares.md b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_nestedshares.md
index c0700f5e1f..89455136d1 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_nestedshares.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_nestedshares.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# FS_NestedShares Job
-The FS_NestedShares job is is designed to report on nested shares that have been granted direct
+The FS_NestedShares job is designed to report on nested shares that have been granted direct
permissions from targeted file servers.
## Analysis Tasks for the FS_NestedShares Job
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_NestedShares** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_sidhistory.md b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_sidhistory.md
index 335b7b4794..b9d924ba21 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_sidhistory.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_sidhistory.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_SIDHistory** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -39,4 +39,4 @@ the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| -------------------- | ------------------------------------------------------------------------------ | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SID History Overview | This report identifies any applied ACE which utilizes a trustee's SID history. | None | This report is comprised of three elements: - Bar Chart – Displays the top 5 hosts by affected folders
- Table – Provides details on permissions
- Table – Provides details on trustees
|
+| SID History Overview | This report identifies any applied ACE which uses a trustee's SID history. | None | This report is comprised of three elements: - Bar Chart – Displays the top 5 hosts by affected folders
- Table – Provides details on permissions
- Table – Provides details on trustees
|
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_unresolvedsids.md b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_unresolvedsids.md
index 0377993df6..cebd9cb533 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_unresolvedsids.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_unresolvedsids.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **FileSystem** > **2.Direct Permiss
**FS_UnresolvedSIDs** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/overview.md b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/overview.md
index 311da511f9..4a9dbf6b68 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/overview.md
@@ -20,7 +20,7 @@ The 2.Direct Permissions job group is comprised of:
- [FS_LocalUsersAndGroups Job](/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_localusersandgroups.md) – Reports on local users and groups that
have been granted direct permissions on resources from targeted file servers
- [FS_MissingFullControl Job](/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_missingfullcontrol.md) – Reports on resources from targeted file
- servers that have no Full Control rights granted to it
+ servers that have no Full Control rights granted to them
- [FS_NestedShares Job](/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_nestedshares.md) – Reports on nested shares that have been granted direct
permissions from targeted file servers
- [FS_SIDHistory Job](/docs/accessanalyzer/12.0/solutions/filesystem/directpermissions/fs_sidhistory.md) – Reports on trustees that have a historical SID that has
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/filesystemoverview.md b/docs/accessanalyzer/12.0/solutions/filesystem/filesystemoverview.md
index eef311d39d..79e1759230 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/filesystemoverview.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/filesystemoverview.md
@@ -9,8 +9,8 @@ sidebar_position: 130
The FileSystemOverview job provides insight into all targeted file servers. It is dependent on data
collected by the [File System Access Auditing](collection/overview.md#file-system-access-auditing)
components and the components of the [0.Collection Job Group](/docs/accessanalyzer/12.0/solutions/filesystem/collection/overview.md). It also
-depends on the running of the sub-job groups within the solution. If only select sub-job groups have
-been run, there will be blank sections in the overview report.
+depends on the running of the sub-job groups within the solution. If you run only select sub-job
+groups, the overview report has blank sections.
@@ -23,7 +23,7 @@ View the analysis tasks by navigating to the **FileSystem** > **FileSystemOvervi
node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/fs_brokeninheritance.md b/docs/accessanalyzer/12.0/solutions/filesystem/fs_brokeninheritance.md
index 2f5fe990b6..203de256e4 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/fs_brokeninheritance.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/fs_brokeninheritance.md
@@ -15,7 +15,7 @@ The FS_BrokenInheritance job is located in the 3.Broken Inheritance job group.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -38,7 +38,7 @@ View the analysis tasks by navigating to the **FileSystem** > **3.Broken Inherit
**FS_BrokenInheritance** > **Configure** node and select **Analysis**.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified and or
+Most of these analysis tasks are preconfigured and shouldn't be modified and or
deselected. There are some that are deselected by default, as they are for troubleshooting purposes.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/fs_dlpresults.md b/docs/accessanalyzer/12.0/solutions/filesystem/fs_dlpresults.md
index 41555515cc..3b9f922da7 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/fs_dlpresults.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/fs_dlpresults.md
@@ -21,7 +21,7 @@ View the analysis tasks by navigating to the **FileSystem** > **7.Sensitive Data
**FS_DLPResults** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -54,4 +54,4 @@ the following pre-configured reports:
| File Ownership (Sensitive Data Ownership) | This report identifies the top 3 potential owners of files which have been found to contain sensitive content. | None | This report is comprised of one element: - Table – Provides details on top owners per file
|
| Sensitive Data Access | This report shows who is accessing sensitive data. Emphasis is placed on activity within the last 30 days. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of two elements: - Bar Chart – Displays sensitive data access by top users
- last 30 days
- Table – Provides details on sensitive data access
|
| Sensitive Security Groups | This report identifies groups which are used to provide access to sensitive data. Changes to membership should be closely monitored. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of two elements: - Bar Chart – Top groups by access to sensitive files
- Table – Provides details on group access to sensitive files
|
-| Share Details (Shares with Sensitive Content) | This report identifies the location of sensitive data, and flags whether or not this data is accessible through open access. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of three elements: - Bar chart – Displays top shares by sensitive file count
- Table – Provides details on files
- Table – Provides details on top shares by sensitive file count
|
+| Share Details (Shares with Sensitive Content) | This report identifies the location of sensitive data, and flags whether this data is accessible through open access. | GDPR SOX HIPAA PCI-DSS GLBA ITAR FERPA FISMA ISO27001 | This report is comprised of three elements: - Bar chart – Displays top shares by sensitive file count
- Table – Provides details on files
- Table – Provides details on top shares by sensitive file count
|
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/fs_openaccess.md b/docs/accessanalyzer/12.0/solutions/filesystem/fs_openaccess.md
index d2ae30332b..9cf6af3094 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/fs_openaccess.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/fs_openaccess.md
@@ -8,7 +8,7 @@ sidebar_position: 30
The FS_OpenAccess job is designed to report on Open Access information from targeted file servers.
The definition of Open Access is when a security principal, such as Everyone, Authenticated Users,
-or Domain Users, have permissions on a resource.
+or Domain Users, has permissions on a resource.
@@ -20,7 +20,7 @@ View the analysis tasks by navigating to the **FileSystem** > **1.Open Access**
**FS_OpenAccess** > **Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/fs_probableowner.md b/docs/accessanalyzer/12.0/solutions/filesystem/fs_probableowner.md
index eb5387dcba..1272908bcc 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/fs_probableowner.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/fs_probableowner.md
@@ -22,7 +22,7 @@ View the analysis tasks by navigating to the FileSystem > 6.Probable Owner > FS_
Configure node and select Analysis.
:::warning
-Do not modify or deselect the first and third selected analysis tasks. The analysis
+Don't modify or deselect the first and third selected analysis tasks. The analysis
tasks are preconfigured for this job.
:::
@@ -41,8 +41,8 @@ The following analysis tasks are selected by default:
`@maxlevel` parameter set to Value0.
- Value0 = root share, Value1 = 1 folder deep, Value2 = 2 folders deep, etc.
- Set the variable #FILTERED_TRUSTEES to a CSV file that contains one row for each SID to be
- excluded. When the job is run, SIDs specified in the #FILTERED_TRUSTEES variable are excluded
- from the analysis and not reported as probable owners.
+ excluded. When you run the job, it excludes SIDs specified in the #FILTERED_TRUSTEES variable
+ from the analysis and doesn't report them as probable owners.
- See the
[Configure the Customizable Parameters in an Analysis Task](/docs/accessanalyzer/12.0/admin/jobs/job/configure/analysis/analysiscustomizableparameters.md)
topic for additional information.
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/fs_securityassessment.md b/docs/accessanalyzer/12.0/solutions/filesystem/fs_securityassessment.md
index 7b543fe7c8..08fb8c4489 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/fs_securityassessment.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/fs_securityassessment.md
@@ -25,12 +25,12 @@ information from targeted file servers. It is dependent upon the following jobs:
- [7.Sensitive Data > FS_DLPResults Job](/docs/accessanalyzer/12.0/solutions/filesystem/fs_dlpresults.md)
-If only select sub-job groups have been run, there are blank sections in the overview report.
+If you run only select sub-job groups, the overview report has blank sections.
The FS_SecurityAssessment job is comprised of analysis and reports which use the data collected by
-the 0.Collection job group and analyzed by the jobs listed above.
+the 0.Collection job group and analyzed by the jobs listed previously.
## Analysis Task for the FS_SecurityAssessment Job
@@ -38,7 +38,7 @@ View the analysis tasks by navigating to the **FileSystem** > **FS_SecurityAsses
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/overview.md b/docs/accessanalyzer/12.0/solutions/filesystem/overview.md
index 9317265d84..bba0990f84 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/overview.md
@@ -12,10 +12,10 @@ identification, governance workflows including entitlement reviews and self-serv
sensitive data discovery and classification, open access remediation, least-privilege access
transformation, and file activity monitoring.
-File systems and NAS devices contain the vast majority of an organization’s data. Each day, more
-data is created and stored in the nooks and crannies of the environment, beyond the sight of the
-people charged with managing it and keeping it safe. The File System Solution is designed to gather
-information from file systems and shared folders in order to answer questions around data access:
+File systems and NAS devices contain the vast majority of an organization’s data. Each day,
+organizations create and store more data across the environment, often outside the visibility of
+the people responsible for managing it and keeping it safe. The File System Solution is designed to gather
+information from file systems and shared folders to answer questions around data access:
- Who has access to your data?
- Who is accessing your data?
@@ -48,22 +48,22 @@ There is a limit of 100 file system hosts that can be scanned simultaneously.
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
-of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount of RAM. Each thread
+requires a minimum of 2 additional GB of RAM per host. For example, if you configure the job to
+scan 8 hosts at a time, it requires an extra 16 GB of RAM (8x2=16).
:::note
-The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
-conflict with other JDKs or Java Runtimes in the same environment.
+Access Analyzer installs the appropriate JDK (Java) version for Sensitive Data Discovery on the
+server. This JDK is prepackaged and doesn't require configuration. Netwrix preconfigures it to
+work with Access Analyzer, so don't customize it through Java. It doesn't conflict with other JDKs
+or Java Runtimes in the same environment.
:::
**Location**
The File System Solution requires a special Access Analyzer license. It can be installed from the
-Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to the solution:
+Instant Job Wizard. After it's installed into the Jobs tree, navigate to the solution:
**Jobs** > **FileSystem**.
The [0.Collection Job Group](/docs/accessanalyzer/12.0/solutions/filesystem/collection/overview.md) collects the data. The other job groups run
@@ -81,24 +81,24 @@ function. See the [Job Groups](#job-groups) topic for additional information.
The File System Solution offers information on multiple aspects of an organization’s file system
infrastructure. This solution is comprised of eleven job groups and an overview job which collect,
-analyze, and report on data as well as run action tasks for environmental remediation. The data
-collection is conducted by the FileSystemAccess (FSAA) Data Collector. See the
+analyze, and report on data as well as run action tasks for environmental remediation. The
+FileSystemAccess (FSAA) Data Collector conducts the data collection. See the
[Standard Reference Tables & Views for the FSAA Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/standardtables.md)
section for database table information.
Each type of auditing depends on specific jobs within the 0.Collection Job Group to collect the data
-and its corresponding analysis and reporting job groups. The Access Auditing components represent
-the core of the File System Solution and are required by the other auditing options, with the
-exception of the Sensitive Data Discovery Auditing component which can be run independently. The
-data collection query options for each type are explained within the 0.Collection Job Group section.
-Additionally, the corresponding analysis and reporting job groups are listed for each auditing type.
+and its corresponding analysis and reporting job groups. The Access Auditing components form the
+core of the File System Solution. The other auditing options require them, except Sensitive Data
+Discovery Auditing, which you can run independently. The data collection query options for each
+type are explained within the 0.Collection Job Group section. Additionally, the corresponding
+analysis and reporting job groups are listed for each auditing type.
-If intending to run three or all auditing types, see each auditing type section within the
+If you intend to run three or all auditing types, see each auditing type section within the
0.Collection Job Group section for information on query options and requirements. It is recommended
-to first run the 0.Collection Job Group components in the default order for the desired auditing
-types to ensure successful data collection, and then to run the desired sub-groups for reports.
+to first run the 0.Collection Job Group components in the default order for the auditing
+types you want to ensure successful data collection, and then to run the sub-groups you want for reports.
See the [Recommended Configuration for the File System Solution](/docs/accessanalyzer/12.0/solutions/filesystem/recommended.md) topic for
additional information on run frequency and job group settings.
@@ -144,7 +144,7 @@ of the following jobs:
- [FS_SecurityAssessment Job](/docs/accessanalyzer/12.0/solutions/filesystem/fs_securityassessment.md) – Designed to provide a security assessment
of all relevant information from targeted file servers
-When targeting Nasuni Edge Appliances, it is necessary to add a job from the Instant Job Library
+When targeting Nasuni Edge Appliances, add a job from the Instant Job Library
(FS_Nasuni Job) which uses the PowerShell Data collector to gather system information, volume data,
and share data from the Nasuni environment. This job should be added to the 0.Collection Job Group
and should be renamed (0-FS_Nasuni) to run immediately after the 0-Create Schema Job. See the
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/recommended.md b/docs/accessanalyzer/12.0/solutions/filesystem/recommended.md
index 440b9af36d..3102f81789 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/recommended.md
@@ -20,10 +20,9 @@ additional information.
**Dependencies**
-- The .Active Directory Inventory job group needs to be executed before running the File System
- solution
-- The .Entra ID Inventory job group needs to be executed before running the File System solution
- (for targeting Azure Files only)
+- Run the .Active Directory Inventory job group before you run the File System solution
+- Run the .Entra ID Inventory job group before you run the File System solution (for targeting
+ Azure Files only)
- File System Proxy deployed to targeted proxy servers (for proxy scanning architecture only)
- Activity Monitor deployed, configured, and services running (for Activity Auditing only)
@@ -41,8 +40,8 @@ want to scan.
If you target Nasuni Edge Appliances, assign the 0-FS_Nasuni Job a custom host list
containing all on-premise Nasuni Edge Appliances and cloud filers.
-If using multiple proxy servers, these should also be configured within a different custom-created
-host list. Then assign the proxy servers host list on the
+If you use multiple proxy servers, configure them within a different custom-created host list. Then
+assign the proxy servers host list on the
[FSAA: Applet Settings](/docs/accessanalyzer/12.0/admin/datacollector/fsaa/appletsettings/appletsettings.md) page of the File System
Access Auditor Data Collector Wizard within the following jobs in the 0.Collection Job Group
according to the type of auditing being conducted:
@@ -94,17 +93,17 @@ permissions for the supported target platforms. See the
for the necessary permission for collecting activity data. Then create a custom Connection Profile
containing the appropriate credentials for the targeted environment.
-The Connection Profile should be assigned under the **FileSystem** > **0.Collection** job’s
-Properties window on the **Connection** tab. It is set to Use the Default Profile, as configured at
+Assign the Connection Profile under the **FileSystem** > **0.Collection** job’s Properties window,
+on the **Connection** tab. It is set to Use the Default Profile, as configured at
the global settings level. However, since this may not be the Connection Profile with the necessary
permissions for the assigned hosts, click the radio button for the **Select one of the following
user defined profiles** option and select the appropriate Connection Profile dropdown menu.
:::tip
-Remember, if targeting Nasuni Edge Appliances, the 0-FS_Nasuni Job needs to be assigned a custom
-Connection Profile containing the **API Access Key** and **Passcode** for each on-premise Nasuni
-Edge Appliance and cloud filer in the target environment. Nasuni API key names are case sensitive.
-When providing them, enter them in the exact same case as generated.
+Remember, if you target Nasuni Edge Appliances, assign the 0-FS_Nasuni Job a custom Connection
+Profile containing the **API Access Key** and **Passcode** for each on-premise Nasuni Edge
+Appliance and cloud filer in the target environment. Nasuni API key names are case sensitive.
+Enter them in the exact same case as generated.
:::
@@ -117,24 +116,24 @@ dependent on the size of the target environment. The FileSystem Solution can be
weekly or as desired depending on the types of auditing being conducted and the scope of the target
environment.
-For example, it may be desired in large environments to run Activity Auditing collection jobs on a
-daily basis, but to only run Access Auditing and Sensitive Data Discovery Auditing collection jobs
-on a weekly basis followed by the analysis and reporting job groups.
+For example, in large environments, you might want to run Activity Auditing collection jobs daily,
+but run Access Auditing and Sensitive Data Discovery Auditing collection jobs only weekly, followed
+by the analysis and reporting job groups.
**Run Order**
-Whatever schedule frequency may be configured, it is also recommended to streamline the collection
+Whatever schedule frequency you configure, it is also recommended to streamline the collection
jobs to those desired. The jobs in the 0.Collection Job Group must be run in order for the auditing
type. Run …System Scans jobs and then the corresponding …Bulk Import jobs according to the desired
workflow.
-The other File System Solution sub-job groups can be run together or individually in any order,
-after running the 0.Collection Job Group. The FileSystemOverview Job pulls information from both the
+You can run the other File System Solution sub-job groups together or individually, in any order,
+after you run the 0.Collection Job Group. The FileSystemOverview Job pulls information from both the
0.Collection Job Group and the other sub-job groups, and the report may contain blank sections if
only select sub-job groups are run.
:::info
-If only conducting one or two types of auditing, scope the solution by disabling
+If you're only conducting one or two types of auditing, scope the solution by disabling
the undesired collection jobs. Disabling them allows the solution to run more efficiently. It isn't
recommended to delete any jobs. See the
[Disable or Enable a Job](/docs/accessanalyzer/12.0/admin/jobs/job/disableenable.md) topic for additional information.
@@ -256,7 +255,7 @@ Though the analysis tasks shouldn't be deselected, the following parameters can
- The .Active Directory Inventory Solution defines large groups, deeply nested groups, stale users,
and users with large tokens. These parameters can be customized and are applicable to any
- solution, including File System, which incorporate this analyzed data into further analysis.
+ solution, including File System, which incorporates this analyzed data into further analysis.
- Customize within **.Active Directory Inventory** > **3-AD_Exceptions** Job analysis tasks
@@ -296,7 +295,7 @@ within an analysis task.
The jobs contained in the group use custom SQL scripts to render views on collected data. SQL views
populate report element tables and graphs. Changing or modifying the group, job, or
-table names result in no data displayed within the reports or the AIC.
+table names results in no data displayed within the reports or the AIC.
:::tip
Remember, it is recommended to scope the 0.Collection Job Group to only include the collection
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroupaicimport.md b/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroupaicimport.md
index 27c5c931a0..ab494f9a49 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroupaicimport.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroupaicimport.md
@@ -6,23 +6,22 @@ sidebar_position: 20
# FS_ResourceBasedGroupAICImport Job
-The FS_ResorceBasedGroupsAICImport Job imports resources and access groups from the
-FS_ResoureBasedGroup Job into the Netwrix Access Information Center. This job assigns ownership in
-the Access Information Center and then assigns resource groups. This step is required if it is
-desired to change access through entitlement reviews, self-service, or for publishing resources to
-IAM.
+The FS_ResourceBasedGroupsAICImport Job imports resources and access groups from the
+FS_ResourceBasedGroups Job into the Netwrix Access Information Center. This job assigns ownership in
+the Access Information Center and then assigns resource groups. This step is required if you want
+to change access through entitlement reviews, self-service, or publishing resources to IAM.
## Recommended Configurations for the FS_ResourceBasedGroupsAICImport Job
**Dependencies**
-- The **FS_ResourceBasedGroups** job must be successfully run prior to running this job
-- The **.Active Directory Inventory** > **1-AD_Scan** job must be successfully run prior to running
+- The **FS_ResourceBasedGroups** job must be successfully run before running this job
+- The **.Active Directory Inventory** > **1-AD_Scan** job must be successfully run before running
this job
- The **File System** > **0.Collection** > **1-FSAA System Scans** job must be successfully run
- prior to running this job
-- The **File System** > **0.Collection** > **2-FSAA Bulk Import** job must be successfully run prior
- to running this job
+ before running this job
+- The **File System** > **0.Collection** > **2-FSAA Bulk Import** job must be successfully run before
+ running this job
**Targeted Hosts**
@@ -63,11 +62,11 @@ Not supported
## Run the FS_ResourceBasedGroupsAICImportJob
Now that the target environment follows a Resource Based Groups model, the new resources can be
-imported into the Access Information Center. Follow the steps to import the new resources into the
-AIC Ownership Workflow.
+imported into the Access Information Center. To import the new resources into the
+AIC Ownership Workflow:
:::warning
-It is important to run the .Active Directory Inventory Job Group and **File System** >
+Run the .Active Directory Inventory Job Group and **File System** >
**0. Collection** Job Group again so that the AD and permissions changes are captured by Access
Analyzer.
:::
@@ -78,8 +77,8 @@ Job Group again.
**Step 2 –** Right click the **FS_ResourceBasedGroupsAICImport** job and select **Run Job**.
-The newly created resource based groups are imported to the AIC. The Owner and Access Groups have
-been assigned to the resources by the import process. The AIC can now be used to manage these
+The newly created resource based groups are imported to the AIC. The import process assigns the
+Owner and Access Groups to the resources. The AIC can now be used to manage these
resources through Entitlement Reviews, Ad hoc owner changes, and the Self Service access portal.
## Review the New Resource Based Groups in the AIC
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroups.md b/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroups.md
index 8b4d5a76b2..446c274b21 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroups.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroups.md
@@ -19,7 +19,7 @@ group implementation.
**Step 3 –** (Optional) Configure a Host List for the job at the job level.
:::note
-If a host list is not configured, this job will analyze and commit actions on every File
+If a host list isn't configured, this job will analyze and commit actions on every File
System server known to Access Analyzer. To scope the actions to target specific servers, configure a
host list at the job level to target only those servers.
:::
@@ -31,7 +31,7 @@ host list at the job level to target only those servers.
- Verify that all actions are disabled
:::warning
- Do not make configuration changes to the analysis tasks after reviewing and
+ Don't make configuration changes to the analysis tasks after reviewing and
approving the Change Modeling report
:::
@@ -50,7 +50,7 @@ host list at the job level to target only those servers.
**Step 6 –** Execute File System actions:
-- Allow an appropriate grace period for token refresh prior to executing File System action tasks,
+- Allow an appropriate grace period for token refresh before executing File System action tasks,
for example one week
- Disable the Active Directory action tasks
- Enable the File System action tasks
@@ -71,14 +71,14 @@ host list at the job level to target only those servers.
based groups. See the [FS_TraverseGroups Job](/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_traversegroups.md) topic for additional
information.
-**Step 9 –** (Optional) Import resources and access groups from the FS_ResoureBasedGroup Job into
+**Step 9 –** (Optional) Import resources and access groups from the FS_ResourceBasedGroups Job into
the Netwrix Access Information Center. See the
[FS_ResourceBasedGroupAICImport Job](/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroupaicimport.md) topic for additional
information.
## Model Intended Changes
-Prior to executing the actions to apply changes, the proposed changes can be modeled and reviewed to
+Before you execute the actions to apply changes, you can model and review the proposed changes to
determine if the parameters are configured as desired.
### Configure the Analyze Group Permissions Analysis Task
@@ -108,52 +108,52 @@ information.
| Analyze Group Permissions | @add_admin_groups | 1 | Add full control admin groups. 1=true. 0=false. |
| Analyze Group Permissions | @admin_groups | | ObjectSIDs of admin groups to add to every share if @add_admin_groups = 1 |
| Analyze Group Permissions | #folders | | List of folders to assign RBG to. Overrides @levels_down. |
-| Analyze Group Permissions | @activity_filter | 1000 | Filter out users with last activity older than X days ago. Will filter out users who have not accessed the folder within the specified threshold. If activity records show the user has never accessed the folder, users will still be included in resource based groups. |
+| Analyze Group Permissions | @activity_filter | 1000 | Filters out users with last activity older than the specified number of days. If activity records show the user has never accessed the folder, the job still includes the user in resource based groups. |
### Execute the Analysis Tasks
Execute the analysis tasks to generate the Change Modeling report and review the proposed changed
-prior to executing the actions to apply the changes.
+before executing the actions to apply the changes.
| Report | Description | Default Tags | Report Elements |
| --------------- | ---------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Change Modeling | This report shows proposed changes of access for the targeted folders. | None | This report is comprised of three elements: - Pie Chart – Displays a proposed access changes summary
- Table – Provides details on proposed access changes by share
- Table – Provides details on access modification
|
-The Change Modeling report should be used to gain acceptance on the following areas before
-implementing the changes:
+Use the Change Modeling report to gain acceptance on the following areas before implementing the
+changes:
- Group Naming Conventions
- Cases of Changed Access
Access changes occur in the following cases:
-- The user is granted full access, but is not a member of the administrator group specified in the
+- The user is granted full access, but isn't a member of the administrator group specified in the
analysis parameters
- The user is granted less access, but is a member of the administrator group specified in the
analysis parameters
- The user has not used access within the timeframe configured in the analysis parameters
-Follow the steps to model the proposed changes.
+To model the proposed changes:
-**Step 1 –** Make sure all of the analysis tasks are enabled.
+**Step 1 –** ensure all of the analysis tasks are enabled.
:::warning
-Prior to executing the analysis tasks, make sure that all action tasks are disabled.
+Before executing the analysis tasks, ensure that all action tasks are disabled.
The purpose at this point is only to model the intended changes.
:::
-**Step 2 –** In the Configure node, select **Actions** and make sure that all of the action tasks
+**Step 2 –** In the Configure node, select **Actions** and ensure that all of the action tasks
are disabled.
-**Step 3 –** Right click on the **Resource Based Groups** folder and select **Run Group**. This will
+**Step 3 –** Right click the **Resource Based Groups** folder and select **Run Group**. This will
generate the Change Modeling report.
- Wait for the queued jobs to execute.
**Step 4 –** In the **FS_ResourceBasedGroups** node, navigate to **Results** > **Change Modeling**
-to review the proposed changes prior to executing the actions to apply the changes.
+to review the proposed changes before executing the actions to apply the changes.
The Change Modeling report has been created for review. Ensure the modeled changes are approved
before continuing with implementing them.
@@ -161,15 +161,15 @@ before continuing with implementing them.
## Configure & Execute Active Directory Action Tasks
:::warning
-Do not modify the analysis tasks after the Change Modeling report has been reviewed and
+Don't modify the analysis tasks after the Change Modeling report has been reviewed and
approved. The approved modeled changes are implemented through the execution of the action tasks.
:::
The Active Directory action tasks create and populate resource based groups. The Create Groups and
-Update Members action tasks must be updated to specify a Target OU for group creation prior to
-enabling and executing the actions. It should also be verified that these action tasks are targeting
-the same domain controller.
+Update Members action tasks must be updated to specify a Target OU for group creation before
+enabling and executing the actions. Also verify that these action tasks target the same domain
+controller.
View the action tasks by navigating to the **Jobs** > **FileSystem** > **Resourced Based Groups** >
**FS_ResourceBasedGroups** > **Configure** node and select **Actions**.
@@ -181,7 +181,7 @@ There are the following two Active Directory action tasks:
- Create Groups – Creates resource based groups
- Update Members – Adds members to the resource based groups based on permissions
-It is recommended to review the tables used by the actions prior to executing the actions. The
+It is recommended to review the tables used by the actions before executing the actions. The
actions act upon the data within the following tables:
- FS_ResourceBasedGroups_GroupsToCreate
@@ -192,7 +192,7 @@ job’s Results node. The FS_ResourceBasedGroups Job will run analysis tasks aga
### Configure & Enable the Create Groups Action Task
-Follow the steps to configure the Create Groups action task.
+To configure the Create Groups action task:
**Step 1 –** Select the action and click **Action Properties**.
@@ -216,7 +216,7 @@ The Create Groups action is configured.
### Configure & Enable the Update Members Action Task
-Follow the steps to configure the Create Groups action task.
+To configure the Create Groups action task:
**Step 1 –** Select the action task and click **Action Properties**.
@@ -241,30 +241,30 @@ The Update Members action is configured.
### Execute Active Directory Action Tasks
-Make sure that the File System actions are deselected and execute the Active Directory action tasks.
+Ensure that the File System actions are deselected and execute the Active Directory action tasks.
The Create Groups action creates the resource based groups. The Update Members action populates
those groups.
Enabled action tasks can be manually executed at the Actions node. Action tasks can be scheduled
only at the job level.
-Follow the steps to execute the AD actions.
+To execute the AD actions:
:::warning
-Do not modify the analysis tasks after the Change Modeling report has been reviewed and
+Don't modify the analysis tasks after the Change Modeling report has been reviewed and
approved. The approved modeled changes are implemented through the execution of the action tasks.
:::
:::info
-Disable the analysis tasks. It is not necessary to collect the data again.
+Disable the analysis tasks. It isn't necessary to collect the data again.
:::
**Step 1 –** On the Action Selection page, enable the **Create Groups** and **Update Members**
actions.
-**Step 2 –** Right-click on the **Resource Based Groups** folder and select **Run Group**.
+**Step 2 –** Right-click the **Resource Based Groups** folder and select **Run Group**.
- Wait for the queued jobs to execute.
@@ -273,13 +273,13 @@ The resource based groups are created and populated.
## Execute File System Action Tasks
:::warning
-Prior to executing the File System action tasks, allow a grace period, for example one
+Before executing the File System action tasks, allow a grace period, for example one
week. This is important for token refresh to occur as users log off and log on again.
:::
The File System actions modify folder permissions and break inheritance. The Modify Permissions and
-Break Inheritance actions modules do not require any configuration.
+Break Inheritance actions modules don't require any configuration.
View the action tasks by navigating to the **Jobs** > **FileSystem** > **Resourced Based Groups** >
**FS_ResourceBasedGroups** > **Configure** node and select **Actions**.
@@ -289,20 +289,20 @@ View the action tasks by navigating to the **Jobs** > **FileSystem** > **Resourc
There are the following two File System action tasks:
- Modify Permissions – Modifies folder permissions
-- Break Inheritance – Breaks inheritance and remove all previous permissions
+- Break Inheritance – Breaks inheritance and removes all previous permissions
-It is recommended to review the tables used by the actions prior to executing the actions. The
+It is recommended to review the tables used by the actions before executing the actions. The
actions act upon the data within the following table:
- FS_ResourceBasedGroups_GroupsToCreate
-The actions populate the Modify Permissions and Break Inheritance tables, which can viewed under the
-job’s Results node. The FS_ResourceBasedGroups Job will run analysis tasks against these tables.
+The actions populate the Modify Permissions and Break Inheritance tables, which can be viewed under
+the job’s Results node. The FS_ResourceBasedGroups Job will run analysis tasks against these tables.
-Follow the steps to execute the FS actions.
+To execute the FS actions:
:::warning
-Do not modify the analysis tasks after the Change Modeling report has been reviewed and
+Don't modify the analysis tasks after the Change Modeling report has been reviewed and
approved. The approved modeled changes are implemented through the execution of the action tasks.
:::
@@ -312,7 +312,7 @@ actions.
**Step 2 –** Enable the **Modify Permissions** and **Break Inheritance** actions.
-**Step 3 –** Right-click on the **Resource Based Groups** folder and select **Run Group**.
+**Step 3 –** Right-click the **Resource Based Groups** folder and select **Run Group**.
- Wait for the queued jobs to execute.
@@ -329,15 +329,15 @@ purposes.
| Action History | This report shows all actions taken on each share for audit trail purposes. | None | This report is comprised of one element: - Table – This table provides details on the actions taken on each share
|
-Follow the steps to analyze and report on action history.
+To analyze and report on action history:
:::warning
-Disable all of the action tasks prior to generating the Action History report.
+Disable all of the action tasks before generating the Action History report.
:::
**Step 1 –** On the Action Selection page, disable the **Modify Permissions** and **Break
-Inheritance** actions. Make sure all of the action tasks are disabled.
+Inheritance** actions. Ensure all of the action tasks are disabled.
**Step 2 –** On the Analysis Selection page, enable the **Create view for action status** and
**Summarize Access Changes** analysis tasks.
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_traversegroups.md b/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_traversegroups.md
index 760ee6d33d..2f2c8d1e0c 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_traversegroups.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_traversegroups.md
@@ -6,10 +6,10 @@ sidebar_position: 30
# FS_TraverseGroups Job
-The **FS_TraverseGroups** Job can be used to create and apply permissions for traverse groups based
-on previous resource based groups. This job would be used in the case where the folder to which
-resource based groups permissions are applied is not the root share folder, or at the root of the
-share. This job prevents users from losing the ability to navigate through the directory structure
+Use the **FS_TraverseGroups** Job to create and apply permissions for traverse groups based
+on previous resource based groups. Use this job if the folder with resource based group permissions
+applied isn't the root share folder, or isn't at the root of the share. This job prevents users
+from losing the ability to navigate through the directory structure
if the folder is nested. The FS_TraverseGroups Job must be installed from the Instant Job library.
See the [Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md) topic for additional
information.
@@ -18,7 +18,7 @@ information.
**Dependencies**
-- The **FS_ResourceBasedGroups** job must be successfully run prior to running this job
+- The **FS_ResourceBasedGroups** job must be successfully run before running this job
**Targeted Hosts**
@@ -44,7 +44,7 @@ Not supported
**Step 2 –** Configure a Host List for the job at the job level.
:::note
-If a host list is not configured, this job will analyze and commit actions on every File
+If a host list isn't configured, this job will analyze and commit actions on every File
System server known to Access Analyzer. To scope the actions to target specific servers, configure a
host list at the job level to target only those servers.
:::
@@ -67,7 +67,7 @@ host list at the job level to target only those servers.
**Step 5 –** Execute File System action task.
-- Allow an appropriate grace period for token refresh prior to executing File System action task,
+- Allow an appropriate grace period for token refresh before executing File System action task,
for example one week
- Disable the Active Directory action task
- Enable the Modify Permissions action task
@@ -83,7 +83,7 @@ host list at the job level to target only those servers.
## Configure & Execute Analysis Tasks
-Prior to executing the action tasks, configure and execute the analysis tasks.
+Before executing the action tasks, configure and execute the analysis tasks.
### Configure the Create Groups Analysis Task
@@ -115,21 +115,21 @@ For instructions on configuring analysis parameters, see the
### Execute Analysis Tasks
-Once the Create Groups analysis task has been configured, execute the analysis tasks. The analysis
-tasks are selected by default. Follow the steps to execute the analysis tasks.
+After you configure the Create Groups analysis task, execute the analysis tasks. The analysis
+tasks are selected by default. To execute the analysis tasks:
-**Step 1 –** Make sure all of the analysis tasks are enabled.
+**Step 1 –** Ensure all of the analysis tasks are enabled.
:::warning
-Prior to executing the analysis tasks, make sure that all action tasks are disabled.
+Before executing the analysis tasks, ensure that all action tasks are disabled.
The purpose at this point is only to create the required traversal tables.
:::
-**Step 2 –** In the Configure node, select **Actions** and make sure that all of the action tasks
+**Step 2 –** In the Configure node, select **Actions** and ensure that all of the action tasks
are disabled.
-**Step 3 –** Right click on the **FS_TraverseGroups** job and select **Run Job**. This will generate
+**Step 3 –** Right click the **FS_TraverseGroups** job and select **Run Job**. This will generate
the Change Modeling report.
- Wait for the queued jobs to execute.
@@ -139,9 +139,9 @@ The analysis tasks create the required traversal tables accessible under the job
## Configure & Execute Active Directory Action Task
The Active Directory action tasks create and populate resource based groups. The Create Groups
-action tasks must be updated to specify a Target OU for group creation prior to enabling and
-executing the actions. It should also be verified that the action tasks are targeting the same
-domain controller. View the actions by navigating to the place in the Jobs tree where the Traverse
+action tasks must be updated to specify a Target OU for group creation before enabling and
+executing the actions. Also verify that the action tasks target the same domain controller. View
+the actions by navigating to the place in the Jobs tree where the Traverse
Groups job was installed from the Instant Jobs library. Then go to the **FS_TraverseGroups** >
**Configure** node and select **Actions**. The Create Groups action task must be configured to
specify the OU for group creation.
@@ -159,7 +159,7 @@ There are the following action tasks:
- Create Groups – Create groups and add resource based groups
- Modify Permissions – Add list groups
-It is recommended to review the tables used by the actions prior to executing the actions. For
+It is recommended to review the tables used by the actions before executing the actions. For
instructions on configuring action tables, see the
[Configure & Enable the Create Groups Action Task](#configure--enable-the-create-groups-action-task)
topic. The actions act upon the data within the following tables:
@@ -172,7 +172,7 @@ tasks against these tables.
### Configure & Enable the Create Groups Action Task
-Follow the steps to configure the Create Groups action task.
+To configure the Create Groups action task:
**Step 1 –** Select the action and click **Action Properties**.
@@ -192,12 +192,12 @@ groups is the same domain controller used in the Update Members action task.
### Execute Active Directory Action Task
The Create Groups action creates the resource based groups. Enabled action tasks can be manually
-executed at the Actions node. Action tasks can be scheduled only at the job level. Follow the steps
-to create the resource based groups.
+executed at the Actions node. Action tasks can be scheduled only at the job level. To create the
+resource based groups:
**Step 1 –** On the Action Selection page, enable the **Create Groups** action task.
-**Step 2 –** Right-click on the **FS_TraverseGroups** job and select **Run Job**.
+**Step 2 –** Right-click the **FS_TraverseGroups** job and select **Run Job**.
- Wait for the queued job to execute
@@ -205,11 +205,11 @@ The resource based groups are created and populated.
## Execute File System Action Task
-Once the Create Groups action has been executed, the Modify Permissions action can be executed.
-Follow the steps to execute the action.
+After you execute the Create Groups action, you can execute the Modify Permissions action.
+To execute the action:
:::warning
-Prior to executing the File System action tasks, allow a grace period, for example one
+Before executing the File System action tasks, allow a grace period, for example one
week. This is important for token refresh to occur as users log off and log on again.
:::
@@ -218,7 +218,7 @@ week. This is important for token refresh to occur as users log off and log on a
**Step 2 –** Enable the **Modify Permissions** action task.
-**Step 3 –** Right-click on the **FS_TraverseGroups** job and select Run Job.
+**Step 3 –** Right-click the **FS_TraverseGroups** job and select Run Job.
- Wait for the queued job to execute.
@@ -227,23 +227,23 @@ with the configured permissions. All other permissions will have been removed fr
## Generate the List Traverse Group Changes Report
-The Generate the List Traverse Group Changes report displays a list of changes made in the
-environment by the action modules.
+The List Traverse Group Changes report displays a list of changes made in the environment by the
+action modules.
| Report | Description | Default Tags | Report Elements |
| --------------------------- | ---------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| List Traverse Group Changes | This report shows a list of changes made in the environment by the action modules. | None | This report is comprised of one elements: - Table – This table provides details on the changes made to the environment by the action modules
|
+| List Traverse Group Changes | This report shows a list of changes made in the environment by the action modules. | None | This report is comprised of one element: - Table – This table provides details on the changes made to the environment by the action modules
|
- Follow the steps to analyze and report on action history.
+To analyze and report on action history:
:::warning
-Disable all of the action tasks prior to generating the List Traverse Group Changes
+Disable all of the action tasks before generating the List Traverse Group Changes
report.
:::
-**Step 1 –** On the Action Selection page, disable the **Modify Permissions** action task. Make sure
+**Step 1 –** On the Action Selection page, disable the **Modify Permissions** action task. Ensure
all of the action tasks are disabled.
**Step 2 –** On the Analysis Selection page, enable the **Create Groups** and both **Show Table**
diff --git a/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/overview.md b/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/overview.md
index 1fa5e8565a..81490dae70 100644
--- a/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/overview.md
@@ -14,7 +14,7 @@ inheritance.
## Prerequisites
-Action modules are available with a special Access Analyzer license. In order to use the Resource
+Action modules are available with a special Access Analyzer license. To use the Resource
Based Groups workflow, the following Access Analyzer licensing components are required:
- File System Feature
@@ -22,7 +22,7 @@ Based Groups workflow, the following Access Analyzer licensing components are re
- File System Actions Add-on
- Active Directory Actions Add-on
-The following job groups must be successfully run prior to using this workflow:
+The following job groups must be successfully run before using this workflow:
- .Active Directory Inventory Job Group
- FileSystem > 0.Collection Job Group
@@ -35,7 +35,7 @@ it can be installed from the Instant Job Wizard.
-Once it has been installed into the Jobs tree, navigate to the solution: **Jobs** > **FileSystem** >
+After it's installed into the Jobs tree, navigate to the solution: **Jobs** > **FileSystem** >
**Resource Based Groups**.
The FS_TraverseGroups Job and the FS_ResourceBasedGroupsAICImport Job must be installed from the
@@ -51,13 +51,13 @@ based groups model.
The following jobs comprise the Resource Based Groups Job Group:
-- [FS_ResourceBasedGroups Job](/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroups.md) – This job will transform permission on
+- [FS_ResourceBasedGroups Job](/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroups.md) – This job will transform permissions on
specified folders to a resource based groups model
-- [FS_TraverseGroups Job](/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_traversegroups.md) – (Optional) This job can be used to create and
+- [FS_TraverseGroups Job](/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_traversegroups.md) – (Optional) Use this job to create and
apply permissions for traverse groups based on previous resource based groups. The
- FS_TraverseGroupsJob must be added from the Instant Job Library in order to be used.
+ FS_TraverseGroupsJob must be added from the Instant Job Library to be used.
- [FS_ResourceBasedGroupAICImport Job](/docs/accessanalyzer/12.0/solutions/filesystem/resourcebasedgroups/fs_resourcebasedgroupaicimport.md) – (Optional) This job
- imports resources and access groups from the FS_ResoureBasedGroup Job into the Netwrix Access
+ imports resources and access groups from the FS_ResourceBasedGroups Job into the Netwrix Access
Information Center. The FS_ResourceBasedGroupsAICImport Job must be added from the Instant Job
Library to be used.
@@ -65,8 +65,8 @@ The following jobs comprise the Resource Based Groups Job Group:
**Dependencies**
-- The **.Active Directory Inventory** Job Group must be successfully run prior to running this job
-- The **FileSystem** > **0.Collection** Job Group must be successfully run prior to running this job
+- The **.Active Directory Inventory** Job Group must be successfully run before running this job
+- The **FileSystem** > **0.Collection** Job Group must be successfully run before running this job
**Targeted Hosts**
@@ -87,10 +87,10 @@ Not supported
## Scheduling the Resource Based Groups Job Group
-Netwrix recommends that the job be run by a scheduled task with an unlimited timeout to ensure the
-job will not be aborted when an interactive session is ended due to logoff (a logoff based on
-inactivity is common in enterprise environments). Netwrix also recommends that the job only be
-scheduled for discrete one-time runs so that results may be reviewed after each execution. See the
+Netwrix recommends running the job as a scheduled task with an unlimited timeout, so the job isn't
+aborted if an interactive session ends due to logoff (a logoff based on inactivity is common in
+enterprise environments). Netwrix also recommends scheduling the job only for discrete one-time
+runs so you can review results after each execution. See the
[Schedule Jobs](/docs/accessanalyzer/12.0/admin/schedule/overview.md#schedule-jobs) topic for additional information.
Throughout this document reference to executing a job refers to either manual execution or scheduled
diff --git a/docs/accessanalyzer/12.0/solutions/nisinventory/nis_scan.md b/docs/accessanalyzer/12.0/solutions/nisinventory/nis_scan.md
index 95dede68c0..cba6c6cf7d 100644
--- a/docs/accessanalyzer/12.0/solutions/nisinventory/nis_scan.md
+++ b/docs/accessanalyzer/12.0/solutions/nisinventory/nis_scan.md
@@ -27,7 +27,7 @@ This query must be modified. See the
### Configure the NIS Scan Query
The NIS Scan job has been preconfigured to run with the default settings with the category of **Scan
-NIS Users and Groups**. However, it is necessary to configure the targeted NIS domain. Follow the
+NIS Users and Groups**. However, you must configure the targeted NIS domain. Follow the
steps to set the target NIS domain and any desired customizations.
**Step 1 –** Navigate to the **.NIS Inventory** > **NIS Scan** > **Configure** node and select
@@ -40,7 +40,7 @@ opens.
opens.
:::warning
-Do not make changes to other wizard pages as they have been pre-configured for the
+Don't make changes to other wizard pages as they have been pre-configured for the
purpose of this job.
:::
@@ -48,7 +48,7 @@ purpose of this job.
**Step 4 –** On the NIS Settings page, enter the **NIS Domain Name** for the targeted NIS domain.
-This step is required prior to running this query. See the
+This step is required before running this query. See the
[NIS: NIS Settings](/docs/accessanalyzer/12.0/admin/datacollector/nis/settings.md) topic for additional information.
- Optional: Test the connection to the domain using the Sample NIS Server section of the page
@@ -69,7 +69,7 @@ View the analysis tasks by navigating to the **.NIS Inventory** > **NIS Scan** >
and select **Analysis**.
:::warning
-Most of these analysis tasks are preconfigured and should not be modified or
+Most of these analysis tasks are preconfigured and shouldn't be modified or
deselected. There is one that is deselected by default, as it is for troubleshooting purposes.
:::
@@ -87,7 +87,7 @@ the database:
:::warning
This analysis task is for troubleshooting and cleanup only. Data will be deleted from
-the database. Do not execute this task with the other analysis tasks, as that results in the
+the database. Don't execute this task with the other analysis tasks, as that results in the
deletion of data that was just collected.
:::
@@ -113,7 +113,7 @@ task.
SQL database.
:::warning
-Do not forget to clear the Drop NIS Tables analysis task and reselect all of the other
+Don't forget to clear the Drop NIS Tables analysis task and reselect all of the other
analysis tasks.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/nisinventory/overview.md b/docs/accessanalyzer/12.0/solutions/nisinventory/overview.md
index 714000e995..7c8e0f8a52 100644
--- a/docs/accessanalyzer/12.0/solutions/nisinventory/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/nisinventory/overview.md
@@ -28,17 +28,17 @@ when auditing NFS shares. This information can also be used in the Unix Solution
**Location**
The .NIS Inventory Solution is a core component of all Access Analyzer installations. It can be
-installed from the Access Analyzer Instant Job Wizard..
+installed from the Access Analyzer Instant Job Wizard.
-Once it has been installed into the Jobs tree, navigate to the solution: **Jobs** > **.NIS
-Inventory**. This group has been named in such a way to keep it at the top of the Jobs tree.
+After it's installed into the Jobs tree, navigate to the solution: **Jobs** > **.NIS
+Inventory**. This group's name keeps it at the top of the Jobs tree.
## NIS Scan Job
-The .NIS Inventory Solution contains a single job. This job is configured to use the NIS Data
-Collector and then runs analysis on the collected data.
+The .NIS Inventory Solution contains a single job. This job uses the NIS Data Collector and then
+runs analysis on the collected data.
diff --git a/docs/accessanalyzer/12.0/solutions/nisinventory/recommended.md b/docs/accessanalyzer/12.0/solutions/nisinventory/recommended.md
index f2de10583b..9bdcace1b8 100644
--- a/docs/accessanalyzer/12.0/solutions/nisinventory/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/nisinventory/recommended.md
@@ -11,11 +11,11 @@ directly or scheduled.
**Dependencies**
-This job group does not have dependencies.
+This job group doesn't have dependencies.
**Targeted Hosts**
-The host list assignment should be assigned under the **.NIS Inventory** > **NIS Scan** > **Hosts**
+Assign the host list under the **.NIS Inventory** > **NIS Scan** > **Hosts**
node. Select the custom host list containing the NIS servers or manually add the host in the
**Individual hosts** section. See the
[Unix Connection Profile & Host List](/docs/accessanalyzer/12.0/admin/datacollector/nis/configurejob.md) topic for
@@ -23,9 +23,9 @@ additional information.
**Connection Profile**
-The Connection Profile should be assigned in the **.NIS Inventory** > **NIS Scan** > **Job
-Properties** window on the **Connection** tab. It is set to **Use the Default Profile**, as
-configured at the global settings level. However, if this is not the Connection Profile with the
+Assign the Connection Profile in the **.NIS Inventory** > **NIS Scan** > **Job
+Properties** window, on the **Connection** tab. It is set to **Use the Default Profile**, as
+configured at the global settings level. However, if this isn't the Connection Profile with the
necessary permissions for targeting the NIS servers, select the **Select one of the following user
defined profiles** option and select the appropriate Connection Profile. See the
[Unix Connection Profile & Host List](/docs/accessanalyzer/12.0/admin/datacollector/nis/configurejob.md) topic for
@@ -55,11 +55,11 @@ analysis task is deselected by default, as it is for troubleshooting purposes on
**History Retention**
-History retention is not supported and should be turned off.
+History retention isn't supported and should be turned off.
**Multi-console Support**
-Multi-console is not supported.
+Multi-console isn't supported.
**Workflow**
diff --git a/docs/accessanalyzer/12.0/solutions/overview.md b/docs/accessanalyzer/12.0/solutions/overview.md
index de5c48350e..8622a69a02 100644
--- a/docs/accessanalyzer/12.0/solutions/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# Solutions
-The predefined job groups and jobs for the various Access Analyzer solutions can be found within the
-Access Analyzer Instant Job Library, according to the license owned by the organization.
+The Access Analyzer Instant Job Library contains the predefined job groups and jobs for the various
+Access Analyzer solutions, according to the license owned by the organization.
## Understanding Instant Solutions
@@ -19,11 +19,11 @@ These solutions are broken down by the top-level job group that comprises the so
| .Entra ID Inventory | The .Entra ID Inventory Solution is designed to inventory, analyze, and report on Microsoft Entra ID. It provides essential user and group membership details to the Entra ID Solution. Key information includes managers, email addresses, and direct memberships. Collected data helps an organization identify toxic conditions like nested groups, circular nesting, disabled users, and duplicate groups. The user and group information assists with understanding probable group ownership, group memberships, largest groups, user status, attribute completion, and synchronization status between on-premises Active Directory and Microsoft Entra ID. This solution also provides information on Microsoft Entra roles. This includes role definitions, role assignments, security principals, scope (management groups, subscriptions, and resources), and effective role permissions.
**Core Solution** |
| .NIS Inventory | The .NIS Inventory Solution is designed to provide essential user and group membership information from a NIS domain, mapping these principals to Windows-style SIDs. This provides valuable information to the File Systems Solution when auditing NFS shares.
**Core Solution** |
| Active Directory | The Active Directory Solution is designed to provide the information every administrator needs regarding Active Directory configuration, operational management, troubleshooting, analyzing effective permissions, and tracking who is making what changes within your organization.
**Requires Active Directory Licensed Feature** |
-| Active Directory Permissions Analyzer | The Active Directory Permissions Analyzer Solution is designed to easily and automatically determine effective permissions applied to any and all Active Directory objects, at any scope, allowing for the most authoritative view available of who has access to what in Active Directory.
**Requires Active Directory Permissions Analyzer Licensed Feature** |
-| AnyID Connectors | The AnyID Connectors Solution allows you to quickly find where data for identities are stored, reducing the response time to Data Subject Access Requests (DSARs). Integration with third party repositories allows you to perform exact data matching for profiles such as employees, customers, students, or patients across any data repository. |
+| Active Directory Permissions Analyzer | The Active Directory Permissions Analyzer Solution is designed to automatically determine effective permissions applied to any and all Active Directory objects, at any scope, allowing for the most authoritative view available of who has access to what in Active Directory.
**Requires Active Directory Permissions Analyzer Licensed Feature** |
+| AnyID Connectors | Use the AnyID Connectors Solution to quickly find where data for identities are stored, reducing the response time to Data Subject Access Requests (DSARs). Use integration with third party repositories to perform exact data matching for profiles such as employees, customers, students, or patients across any data repository. |
| Amazon Web Services | Access Analyzer for AWS allows organizations to secure their data residing in Amazon Web Services (AWS) S3 platform, reducing their risk exposure through proactive, automated auditing and reporting of S3 permissions, sensitive data, and ultimately a consolidated view of user access rights across dozens of structured and unstructured data resources both on-premises and in the cloud. |
-| Box | The Box solution set contains jobs to provide visibility into Box access rights, policies, configurations, activities, and more, ensuring you never lose sight or control of your critical assets residing in Box.
**Requires Box Collection Licensed Feature** |
-| Databases | Access Analyzer Databases Solution Set is a comprehensive set of pre-configured audit jobs and reports that provide visibility into various aspects of supported databases. - Azure SQL – The Azure SQL Solution Set is a comprehensive set of pre-configured audit jobs and reports that provide visibility into various aspects of Azure SQL : Users and Roles, Sensitive Data Discovery, Object Permissions, Configuration, and User Activity.
- Db2 – The Db2 Solution Set is a comprehensive set of pre-configured audit jobs and reports that provides visibility into various aspects of a Db2 Databases: Sensitive Data Discovery and Object Permissions.
- Instance Discovery – The Instance Discovery Solution discovers instances on supported database servers.
- MongoDB Solution – The MongoDB Solution automates the process of understanding where MongDB databases exist and provides an overview of the MongoDB environment in order to answer questions around data access. With visibility into every corner of MongoDB and the operating system it relies upon, organizations can proactively highlight and prioritize risks to sensitive data. Additionally, organizations can automate manual, time-consuming, and expensive processes associated with compliance, security, and operations to easily adhere to best practices that keep MongoDB Server safe and operational.
- MySQL Solution – The MySQL Solution automates the process of understanding where SQL databases exist and provides an overview of the MySQL environment in order to answer questions around data access. With visibility into every corner of Microsoft SQL Server and the Windows operating system it relies upon, organizations can proactively highlight and prioritize risks to sensitive data. Additionally, organizations can automate manual, time-consuming, and expensive processes associated with compliance, security, and operations to easily adhere to best practices that keep SQL Server safe and operational.
- Oracle Solution – The Oracle Solution delivers comprehensive permissions, activity, and sensitive data auditing and reporting for Oracle databases. Through the power of Access Analyzer, users can automate Oracle instance discovery, understand who has access to their Oracle databases, the level of permission they have, and who is leveraging their access privileges, identify the location of sensitive information, measure adherence to best practices, and generate workflows and reports to satisfy security, compliance, and operational requirements.
- PostgreSQL Solution – Access Analyzer PostgreSQL Solution Set is a set of pre-configured audit jobs and reports that provides visibility into PostgreSQL Sensitive Data.
- Redshift – Access Analyzer Redshift Solution Set is a set of pre-configured audit jobs and reports that provides visibility into Redshift Sensitive Data.
- SQL Solution – The SQL Solution is an auditing, compliance, and governance solution for Microsoft SQL Server database. Key capabilities include effective access calculation, sensitive data discovery, security configuration assessment, and database activity monitoring.
**Requires SQL Licensed Feature** |
+| Box | The Box solution set contains jobs to provide visibility into Box access rights, policies, configurations, activities, and more, so you always have visibility and control over your critical assets in Box.
**Requires Box Collection Licensed Feature** |
+| Databases | Access Analyzer Databases Solution Set is a comprehensive set of pre-configured audit jobs and reports that provide visibility into various aspects of supported databases. - Azure SQL – The Azure SQL Solution Set is a comprehensive set of pre-configured audit jobs and reports that provide visibility into various aspects of Azure SQL : Users and Roles, Sensitive Data Discovery, Object Permissions, Configuration, and User Activity.
- Db2 – The Db2 Solution Set is a comprehensive set of pre-configured audit jobs and reports that provides visibility into various aspects of a Db2 Databases: Sensitive Data Discovery and Object Permissions.
- Instance Discovery – The Instance Discovery Solution discovers instances on supported database servers.
- MongoDB Solution – The MongoDB Solution automates the process of understanding where MongDB databases exist and provides an overview of the MongoDB environment to answer questions around data access. With visibility across all of MongoDB and the operating system it relies upon, organizations can proactively highlight and prioritize risks to sensitive data. Additionally, organizations can automate manual, time-consuming, and expensive processes associated with compliance, security, and operations to adhere to best practices that keep MongoDB Server safe and operational.
- MySQL Solution – The MySQL Solution automates the process of understanding where SQL databases exist and provides an overview of the MySQL environment to answer questions around data access. With visibility across all of MySQL and the operating system it relies upon, organizations can proactively highlight and prioritize risks to sensitive data. Additionally, organizations can automate manual, time-consuming, and expensive processes associated with compliance, security, and operations to adhere to best practices that keep MySQL safe and operational.
- Oracle Solution – The Oracle Solution delivers comprehensive permissions, activity, and sensitive data auditing and reporting for Oracle databases. Using Access Analyzer, users can automate Oracle instance discovery, understand who has access to their Oracle databases, the level of permission they have, and who is leveraging their access privileges, identify the location of sensitive information, measure adherence to best practices, and generate workflows and reports to satisfy security, compliance, and operational requirements.
- PostgreSQL Solution – Access Analyzer PostgreSQL Solution Set is a set of pre-configured audit jobs and reports that provides visibility into PostgreSQL Sensitive Data.
- Redshift – Access Analyzer Redshift Solution Set is a set of pre-configured audit jobs and reports that provides visibility into Redshift Sensitive Data.
- SQL Solution – The SQL Solution is an auditing, compliance, and governance solution for Microsoft SQL Server database. Key capabilities include effective access calculation, sensitive data discovery, security configuration assessment, and database activity monitoring.
**Requires SQL Licensed Feature** |
| Dropbox | The Dropbox Solution is an auditing, compliance, and governance solution for Dropbox for Business. Key capabilities include effective access calculation, sensitive data discovery, file content inspection, inactive access and stale data identification, and entitlement collection for integration with Identity & Access Management (IAM) processes.
**Requires Dropbox Collection Licensed Feature** |
| Entra ID | The Entra ID Solution is a comprehensive set of audit jobs and reports that provide the information regarding Microsoft Entra ID configuration, operational management, and troubleshooting. The jobs within this group help pinpoint potential areas of administrative and security concerns related to Microsoft Entra ID users and groups, including syncing with on-premises Active Directory.
**Requires Entra ID Licensed Feature** |
| Exchange | The Exchange Solution provides auditing and reporting on multiple aspects of the Exchange environment to assist with identifying risk, understanding usage, and decreasing bloat. Areas of focus include Audit and Compliance, Maintenance and Cleanup, Metrics and Capacity, Operations and Health, Public Folders and Configuration Baseline.
**Requires Exchange Licensed Feature** |
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/forensics/sp_deletions.md b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/forensics/sp_deletions.md
index 306a94931e..505141cab8 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/forensics/sp_deletions.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/forensics/sp_deletions.md
@@ -14,7 +14,7 @@ Navigate to the **Jobs** > **SharePoint** > **7.Activity** > **Forensics** > **S
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/forensics/sp_permissionchanges.md b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/forensics/sp_permissionchanges.md
index 73c99f3fba..d4e952ecb6 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/forensics/sp_permissionchanges.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/forensics/sp_permissionchanges.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **7.Activity** > **Forensics** >
**SP_PermissionChanges** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -34,4 +34,4 @@ produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Permission Changes | This report identifies SharePoint permission changes based on activity events and determines whether or not that permission change is considered a high security risk. | None | This report is comprised of two elements: - Bar Chart – Displays permission change activity in the past seven days
- Table – Provides permission change details
|
+| Permission Changes | This report identifies SharePoint permission changes based on activity events and determines whether that permission change is considered a high security risk. | None | This report is comprised of two elements: - Bar Chart – Displays permission change activity in the past seven days
- Table – Provides permission change details
|
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/forensics/sp_sensitivedataactivity.md b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/forensics/sp_sensitivedataactivity.md
index 510f7cbfbc..f22140dbe7 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/forensics/sp_sensitivedataactivity.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/forensics/sp_sensitivedataactivity.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **SharePoint** > **7.Activity** > **Forensics** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/overview.md b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/overview.md
index 9ce3205f35..4a86c87801 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 90
# 7.Activity Job Group
The 7.Activity job group generates summary and detail reports of SharePoint activity on the
-specified sites. These reports can be used for identifying file, folder, and user related activity
+specified sites. Use these reports to identify file, folder, and user related activity
across your SharePoint environment.
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/usagestatistics/sp_inactivesites.md b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/usagestatistics/sp_inactivesites.md
index 509d093d49..240d42d9ba 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/usagestatistics/sp_inactivesites.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/usagestatistics/sp_inactivesites.md
@@ -14,7 +14,7 @@ Navigate to the **Jobs** > **SharePoint** > **7.Activity** > **Usage Statistics*
**SP_InactiveSites** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/usagestatistics/sp_mostactivesites.md b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/usagestatistics/sp_mostactivesites.md
index b803fd70f8..63b1530682 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/usagestatistics/sp_mostactivesites.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/usagestatistics/sp_mostactivesites.md
@@ -14,7 +14,7 @@ Navigate to the **Jobs** > **SharePoint** > **7.Activity** > **Usage Statistics*
**SP_MostActiveSites** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -31,4 +31,4 @@ produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Most Active Sites – Last 30 Days | This report identifies the top five most active sites for the past 30 days. [Reads], [Updates], [Deletes], [Permission Changes] fields reflect the number of unique operations of each type that was performed on the site for this time frame. Unique Resources Accessed, number of active user performing operations on the site, as well as whether or not the active site contains sensitive information. | None | This report is comprised of two elements: - Bar Chart – Displays information on most active sites by event count
- Table – Provides details on most active sites by event count
|
+| Most Active Sites – Last 30 Days | This report identifies the top five most active sites for the past 30 days. [Reads], [Updates], [Deletes], [Permission Changes] fields reflect the number of unique operations of each type that was performed on the site for this time frame. This report also shows unique resources accessed, the number of active users performing operations on the site, and whether the active site contains sensitive information. | None | This report is comprised of two elements: - Bar Chart – Displays information on most active sites by event count
- Table – Provides details on most active sites by event count
|
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/usagestatistics/sp_mostactiveusers.md b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/usagestatistics/sp_mostactiveusers.md
index 1d92404bd7..d5a717e0ac 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/activity/usagestatistics/sp_mostactiveusers.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/activity/usagestatistics/sp_mostactiveusers.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **7.Activity** > **Usage Statistics*
**SP_MostActiveUsers** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/1-spseek_systemscans.md b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/1-spseek_systemscans.md
index 504817891c..107aa1922b 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/1-spseek_systemscans.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/1-spseek_systemscans.md
@@ -22,18 +22,18 @@ The query for the 1-SPSEEK SystemScans Job is:
### Configure the Query for the 1-SPSEEK_SystemScans Job
The 1-SPSEEK_SystemScans Job has been preconfigured to run with the default settings using the SPAA
-Data Collector category of Scan for Sensitive Content, which is not visible within the SharePoint
+Data Collector category of Scan for Sensitive Content, which isn't visible within the SharePoint
Access Auditor Data Collector Wizard when opened from within this job.
:::warning
-Users should not change scans in a way that would result in less data being returned on
+Users shouldn't change scans in a way that would result in less data being returned on
a subsequent scan (i.e. scanning fewer web applications, scanning fewer site collections, or a
shallower depth scan). Those resources not included in a subsequent scan are marked as deleted in
the Tier 2 database and subsequently removed from the Tier 1 database.
:::
-Follow the steps to set any desired customizations.
+To set any desired customizations:
**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** >
**1-SPSEEK_SystemScans** > **Configure** node and select **Queries**.
@@ -94,7 +94,7 @@ remove criteria as desired by either manually selecting criteria or using the **
for additional information.
:::warning
-Do not configure the options on the Results page.
+Don't configure the options on the Results page.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/2-spaa_systemscans.md b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/2-spaa_systemscans.md
index e69ac10724..026474e64d 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/2-spaa_systemscans.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/2-spaa_systemscans.md
@@ -22,20 +22,20 @@ The query for the 2-SPAA_SystemScans Job is:
### Configure 2-SPAA_SystemScans Job
The 2-SPAA_SystemScans Job has been preconfigured to run with the default settings using the SPAA
-Data Collector category of Scan SharePoint Access, which is not visible within the SharePoint Access
+Data Collector category of Scan SharePoint Access, which isn't visible within the SharePoint Access
Auditor Data Collector Wizard when opened from within this job.
:::warning
-Users should not change scans in a way that would result in less data being returned on
+Users shouldn't change scans in a way that would result in less data being returned on
a subsequent scan (i.e. scanning fewer web applications, scanning fewer site collections, or a
shallower depth scan). Those resources not included in a subsequent scan are marked as deleted in
the Tier 2 database and subsequently removed from the Tier 1 database.
:::
-Follow the steps to set any desired customizations.
+To set any desired customizations:
-**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **1-SPAA_SystemScans** >
+**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **2-SPAA_SystemScans** >
**Configure** node and select the **Queries** node.
**Step 2 –** In the Query Selection view, click **Query Properties**. The Query Properties window
@@ -69,7 +69,7 @@ desired and click **Next**.
use the default settings unless an agent scan mode is desired. Click **Next**.
:::warning
-Do not configure the options on the Results page.
+Don't configure the options on the Results page.
:::
@@ -78,4 +78,4 @@ Do not configure the options on the Results page.
**Step 9 –** On the Summary page, click **Finish** to save any setting modifications or click
**Cancel** if no changes were made. Then click **OK** to close the Query Properties window.
-If changes were made, the 1-SPAA_SystemScans Job has now been customized.
+If changes were made, the 2-SPAA_SystemScans Job has now been customized.
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/3-spac_systemscans.md b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/3-spac_systemscans.md
index af789c8452..38d82aac8f 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/3-spac_systemscans.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/3-spac_systemscans.md
@@ -12,11 +12,11 @@ in each structural level in the SharePoint farm.
## Queries for the 3-SPAC_SystemScans Job
The 3-SPAC_SystemScans Job has been preconfigured to run with the default settings using the SPAA
-Data Collector category of Scan SharePoint Activity, which is not visible within the SharePoint
+Data Collector category of Scan SharePoint Activity, which isn't visible within the SharePoint
Access Auditor Data Collector Wizard when opened from within this job.
:::warning
-Do not modify the query. The query is preconfigured for this job.
+Don't modify the query. The query is preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/4-spseek_bulkimport.md b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/4-spseek_bulkimport.md
index e10b4e1bb8..15cf135624 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/4-spseek_bulkimport.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/4-spseek_bulkimport.md
@@ -22,7 +22,7 @@ The query for the 4-SPSEEK Bulk Import Job is:
### Configure 4-SPSEEK_BulkImport Job
The 4-SPSEEK_BulkImport Job has been preconfigured to run with the default settings with the SPAA
-Data Collector category of **Bulk Import Sensitive Content Scan Results**, which is not visible
+Data Collector category of **Bulk Import Sensitive Content Scan Results**, which isn't visible
within the SharePoint Access Auditor Data Collector Wizard when opened from within this job. Follow
the steps to set any desired customizations.
@@ -38,16 +38,16 @@ displays.
**Step 4 –** On the
[SPAA: Bulk Import Settings](/docs/accessanalyzer/12.0/admin/datacollector/spaa/bulkimportsettings.md) page, the
-**Set Host Identifier** is not configured by default. Click **Next**.
+**Set Host Identifier** isn't configured by default. Click **Next**.
:::note
-Unless SQL Server Replication is used, it should not be necessary to adjust the **Host
+Unless SQL Server Replication is used, it shouldn't be necessary to adjust the **Host
Identifier** seed.
:::
:::warning
-Do not configure the options on the Results page.
+Don't configure the options on the Results page.
:::
@@ -81,6 +81,6 @@ The default analysis tasks are:
- **5. Create DLP views** – Creates the SA_SPDLP_MatchesView
- **6. Create exceptions view** – Creates the SA_SPAA_ExceptionsView
-The following analysis task is not selected by default, but can be enabled:
+The following analysis task isn't selected by default, but can be enabled:
- Display Match Hits – Displays the SA_SPDLP_MatchesHitsView within Access Analyzer.
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/5-spaa_bulkimport.md b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/5-spaa_bulkimport.md
index f4e8715dfc..8afba2c6c1 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/5-spaa_bulkimport.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/5-spaa_bulkimport.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# 5-SPAA_BulkImport Job
-This job is responsible for retrieving the SPAA Tier 2 database information and import it to the
+This job is responsible for retrieving the SPAA Tier 2 database information and importing it to the
Access Analyzer SQL database.
## Queries for the 5-SPAA_BulkImport Job
@@ -22,11 +22,11 @@ The query for the 5-SPAA_BulkImport Job is:
### Configure 5-SPAA_BulkImport Job
The 5-SPAA_BulkImport Job has been preconfigured to run with the default settings with the SPAA Data
-Collector category of Bulk Import Access Scan Results, which is not visible within the SharePoint
-Access Auditor Data Collector Wizard when opened from within this job. Follow the steps to set any
-desired customizations.
+Collector category of Bulk Import Access Scan Results, which isn't visible within the SharePoint
+Access Auditor Data Collector Wizard when opened from within this job. To set any
+desired customizations:
-**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **2-SPAA_BulkImport** >
+**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **5-SPAA_BulkImport** >
**Configure** node and select the **Queries** node.
**Step 2 –** In the Query Selection view, click **Query Properties**. The Query Properties window
@@ -38,16 +38,16 @@ displays.
**Step 4 –** On the
[SPAA: Bulk Import Settings](/docs/accessanalyzer/12.0/admin/datacollector/spaa/bulkimportsettings.md) page, the
-**Set Host Identifier** is not configured by default. Click **Next**.
+**Set Host Identifier** isn't configured by default. Click **Next**.
:::note
-Unless SQL Server Replication is used, it should not be necessary to adjust the **Host
+Unless SQL Server Replication is used, it shouldn't be necessary to adjust the **Host
Identifier** seed.
:::
:::warning
-Do not configure the options on the Results page.
+Don't configure the options on the Results page.
:::
@@ -60,7 +60,7 @@ If changes were made, the 5-SPAA_BulkImport Job has now been customized.
## Analysis Tasks for 5-SPAA_BulkImport Job
-Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **2-SPAA_BulkImport** > **Configure**
+Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **5-SPAA_BulkImport** > **Configure**
node and select **Analysis** to view the analysis tasks.
:::warning
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/6-spac_bulkimport.md b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/6-spac_bulkimport.md
index f8c4ab3d31..2dbd428e3c 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/6-spac_bulkimport.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/6-spac_bulkimport.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# 6-SPAC_BulkImport Job
-This job is responsible for retrieving the SPAC Tier 2 database information and import it to the
+This job is responsible for retrieving the SPAC Tier 2 database information and importing it to the
Access Analyzer SQL database.
## Queries for the 6-SPAC_BulkImport Job
@@ -22,11 +22,11 @@ The query for the 6-SPAC_BulkImport Job is:
### Configure the Query for the 6-SPAC_BulkImport Job
The 6-SPAC_BulkImport Job has been preconfigured to run with the default settings with the category
-of Bulk Import SharePoint Activity Scan Results, which is not visible within the SharePoint Access
-Auditor Data Collector Wizard when opened from within this job. Follow the steps to set any desired
-customizations.
+of Bulk Import SharePoint Activity Scan Results, which isn't visible within the SharePoint Access
+Auditor Data Collector Wizard when opened from within this job. To set any desired
+customizations:
-**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **2-SPAC_BulkImport** >
+**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **6-SPAC_BulkImport** >
**Configure** node and select **Queries**.
**Step 2 –** In the Query Selection view, click **Query Properties**. The Query Properties window
@@ -38,16 +38,16 @@ displays.
**Step 4 –** On the
[SPAA: Bulk Import Settings](/docs/accessanalyzer/12.0/admin/datacollector/spaa/bulkimportsettings.md) page, the
-**Set Host Identifier** is not configured by default. Click **Next**.
+**Set Host Identifier** isn't configured by default. Click **Next**.
:::note
-Unless SQL Server Replication is used, it should not be necessary to adjust the **Host
+Unless SQL Server Replication is used, it shouldn't be necessary to adjust the **Host
Identifier** seed.
:::
:::warning
-Do not configure the options on the Results page.
+Don't configure the options on the Results page.
:::
@@ -58,7 +58,7 @@ Do not configure the options on the Results page.
If changes were made, the 6-SPAC_BulkImport Job has now been customized.
-## Analysis Tasks for 2-SPAC_BulkImport Job
+## Analysis Tasks for 6-SPAC_BulkImport Job
Navigate to the **Jobs** > **SharePoint** > **0.Collection** > **6-SPAC_BulkImport** > **Configure**
node and select **Analysis** to view the analysis tasks.
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/7-spaa_exceptions.md b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/7-spaa_exceptions.md
index 9782560d31..572174bf7d 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/7-spaa_exceptions.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/7-spaa_exceptions.md
@@ -6,12 +6,12 @@ sidebar_position: 70
# 7-SPAA_Exceptions Job
-This job searches scanned data for resources that match high risk conditions and retrieving a
+This job searches scanned data for resources that match high risk conditions and retrieves a
summary of SharePoint exceptions per host.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -32,9 +32,9 @@ for additional information.
## Analysis Tasks 7-SPAA_Exceptions Job
-The 3-SPAA_Exceptions Job does not use the SPAA Data Collector. Instead it runs analysis on the data
-returned by the 2-SPAA_BulkImport Job. View the analysis tasks by navigating to the **Jobs** >
-**SharePoint** > **0.Collection** > **3-SPAA_Exceptions** > **Configure** node and select
+The 7-SPAA_Exceptions Job doesn't use the SPAA Data Collector. Instead it runs analysis on the data
+returned by the 5-SPAA_BulkImport Job. View the analysis tasks by navigating to the **Jobs** >
+**SharePoint** > **0.Collection** > **7-SPAA_Exceptions** > **Configure** node and select
**Analysis**.
:::warning
@@ -48,15 +48,15 @@ selected analysis tasks.
The default analysis tasks are:
- Open resources – Any site collections, sites, libraries, lists, or folders that are openly
- accessible. Can be deselected if open resource information is not desired.
+ accessible. Can be deselected if open resource information isn't desired.
- This analysis task contains a configurable parameter: `#opengroups`
- Disabled users – Any site collections, sites, libraries, lists, or folders where disabled users
- have been granted access. Can be deselected if disabled user information is not desired.
+ have been granted access. Can be deselected if disabled user information isn't desired.
- Stale users – Any site collections, sites, libraries, lists, or folders where stale users have
- been granted access. Stale users are user who have not logged in for more than 120 days. Can be
- deselected if stale user information is not desired.
+ been granted access. Stale users are users who have not logged in for more than 120 days. Can be
+ deselected if stale user information isn't desired.
- Unresolved SID – Matches SIDs to .Active Directory Inventory Job Group data to resolve for those
users using legacy SIDS or deleted users.
- Show view – Displays views within the Results node of the Access Analyzer Console.
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/overview.md b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/overview.md
index b0a2e7f504..54711cba9a 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/collection/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# 0.Collection Job Group
The **SharePoint** > **0.Collection** Job Group is designed to collect information from SharePoint
-farms using the SPAA Data Collector. The collected data is then available to other SharePoint
+farms using the SharePoint Access Auditing (SPAA) Data Collector. The collected data is then available to other SharePoint
Solution sub-job groups and the Access Information Center for analysis.
@@ -46,21 +46,21 @@ components:
[SharePoint Activity Auditing](#sharepoint-activity-auditing) topic for additional information.
- SharePoint Sensitive Data Discovery Auditing (SEEK) – The SharePoint Sensitive Data Discovery
Auditing (SEEK) component searches file content for sensitive data. It also collects permission
- information; therefore, it does not need to be run with the SPAA component. This component employs
+ information; therefore, it doesn't need to be run with the SPAA component. This component employs
the 1-SPSEEK_SystemScans Job, the 5-SPAA_BulkImport Job, the 4-SPSEEK_BulkImport Job, and the
7-SPAA_Exceptions Job. See the
[SharePoint Sensitive Data Discovery Auditing (SEEK)](#sharepoint-sensitive-data-discovery-auditing-seek)
topic for additional information.
-These jobs are numbered to keep them in the necessary run order. Not all jobs need be run. See the
+These jobs are numbered to keep them in the necessary run order. Not all jobs need to be run. See the
appropriate auditing section for specific job relationships and recommended workflows.
The relationship between system scans and bulk import jobs requires the following considerations:
-- A system scans job executed from a Access Analyzer Console must be followed by the corresponding
+- A system scans job executed from an Access Analyzer Console must be followed by the corresponding
bulk import job from the same Access Analyzer Console with the same version of Access Analyzer
- Two system scans processing the same information, for example two **2-SPAA_SystemScans** jobs,
- cannot be executed consecutively against the same target host. The corresponding bulk import job,
+ can't be executed consecutively against the same target host. The corresponding bulk import job,
for example. **5-SPAA_BulkImport**, must be executed in between.
The system scans job collects the data and creates a Tier-2 database, or SQLite database, on the
@@ -116,13 +116,13 @@ Runtime Details.
**Step 4 –** Run desired corresponding analysis and reporting sub-job groups.
-Please see the [Recommended Configuration for the SharePoint Solution](/docs/accessanalyzer/12.0/solutions/sharepoint/recommended.md) topic
+see the [Recommended Configuration for the SharePoint Solution](/docs/accessanalyzer/12.0/solutions/sharepoint/recommended.md) topic
before continuing with this workflow.
:::info
Scope the 0.Collection Job Group to only include the collection components
desired by disabling the undesired collection jobs. Disabling them allows the solution to run more
-efficiently. It is not recommended to delete any jobs. See the
+efficiently. It isn't recommended to delete any jobs. See the
[Disable or Enable a Job](/docs/accessanalyzer/12.0/admin/jobs/job/disableenable.md) topic for additional
information.
:::
@@ -137,9 +137,9 @@ and tables specifically incorporated into this component are prefaced with SPAC.
[Standard Reference Tables & Views for the SPAA Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/spaa/standardtables.md)
topic for additional information on the data collected.
-The Access Auditing components must be run in order to create the tables in the database for the
-SPAC component to use. Either the SPAA or SEEK Scan job, run to at least a 0-level scan depth (and
-the corresponding Bulk Import job) can be used to create these tables. Once an initial 0-level SPAA
+The Access Auditing components must be run to create the tables in the database for the
+SPAC component to use. Use either the SPAA or SEEK Scan job, run to at least a 0-level scan depth (and
+the corresponding Bulk Import job), to create these tables. After an initial 0-level SPAA
or SPSEEK scan job and corresponding Bulk Import have been run against a particular SharePoint On
Prem farm or SharePoint Online tenant, SPAA or SPSEEK Scan jobs can be run concurrently with SPAC
Scan and Bulk Import jobs as needed.
@@ -174,8 +174,8 @@ for additional information.
**Step 6 –** Run desired corresponding analysis and reporting sub-job groups.
:::note
-Once an initial 2-SPAA SystemScans job (scoped to at least 0-level depth) and the
-corresponding 5-SPAA Bulk Import job have been run, then the SPAA Scans can be run concurrently with
+After an initial 2-SPAA SystemScans job (scoped to at least 0-level depth) and the
+corresponding 5-SPAA Bulk Import job have been run, the SPAA Scans can be run concurrently with
SPAC Scans and Bulk Import jobs as desired.
:::
@@ -183,9 +183,9 @@ SPAC Scans and Bulk Import jobs as desired.
Recommended Workflow 2 (for Access, Sensitive Data Discovery & Activity Auditing)
:::warning
-The jobs must be run in the order shown. It is not possible to disable the
+The jobs must be run in the order shown. It isn't possible to disable the
1-SPAA_SystemScan and 2-SPAA_BulkImport jobs and run the 0.Collection Job Group because the
-remaining jobs are in the wrong order. Renaming the jobs is not an option.
+remaining jobs are in the wrong order. Renaming the jobs isn't an option.
:::
@@ -202,8 +202,8 @@ remaining jobs are in the wrong order. Renaming the jobs is not an option.
**Step 6 –** Run desired corresponding analysis and reporting sub-job groups.
:::note
-Once an initial 1-SPSEEK SystemScans job (scoped to at least 0-level depth) and the
-corresponding 4-SPSEEK Bulk Import job have been run, then the SPSEEK Scans jobs can be run
+After an initial 1-SPSEEK SystemScans job (scoped to at least 0-level depth) and the
+corresponding 4-SPSEEK Bulk Import job have been run, the SPSEEK Scans jobs can be run
concurrently with the SPAC Scans and the Bulk Import jobs as desired.
:::
@@ -217,7 +217,7 @@ concurrently with the SPAC Scans and the Bulk Import jobs as desired.
**Step 3 –** Run desired corresponding analysis and reporting sub-job groups.
:::note
-Please see the [Recommended Configuration for the SharePoint Solution](/docs/accessanalyzer/12.0/solutions/sharepoint/recommended.md)
+see the [Recommended Configuration for the SharePoint Solution](/docs/accessanalyzer/12.0/solutions/sharepoint/recommended.md)
topic before continuing with this workflow.
:::
@@ -225,7 +225,7 @@ topic before continuing with this workflow.
:::info
Scope the 0.Collection Job Group to only include the collection components
desired by disabling the undesired collection jobs. Disabling them allows the solution to run more
-efficiently. It is not recommended to delete any jobs. See the
+efficiently. It isn't recommended to delete any jobs. See the
[Disable or Enable a Job](/docs/accessanalyzer/12.0/admin/jobs/job/disableenable.md) topic for additional
information.
:::
@@ -287,9 +287,9 @@ Recommended Workflow 1 (for Access & Sensitive Data Discovery Auditing)
Recommended Workflow 2 (for Access, Sensitive Data Discovery & Activity Auditing)
:::warning
-The jobs must be run in the order shown. It is not possible to disable the
+The jobs must be run in the order shown. It isn't possible to disable the
2-SPAA_SystemScan and 5-SPAA_BulkImport jobs and run the 0.Collection Job Group because the
-remaining jobs are in the wrong order. Renaming the jobs is not an option.
+remaining jobs are in the wrong order. Renaming the jobs isn't an option.
:::
@@ -306,14 +306,14 @@ remaining jobs are in the wrong order. Renaming the jobs is not an option.
**Step 6 –** Run desired corresponding analysis and reporting sub-job groups.
:::note
-Once an initial 1-SPSEEK SystemScans job (scoped to at least 0-level depth) and the
-corresponding 4-SPSEEK Bulk Import job have been run, then the SPSEEK Scans can be run concurrently
+After an initial 1-SPSEEK SystemScans job (scoped to at least 0-level depth) and the
+corresponding 4-SPSEEK Bulk Import job have been run, the SPSEEK Scans can be run concurrently
with the SPAC Scans and the Bulk Import jobs as desired.
:::
:::note
-Please see the [Recommended Configuration for the SharePoint Solution](/docs/accessanalyzer/12.0/solutions/sharepoint/recommended.md)
+see the [Recommended Configuration for the SharePoint Solution](/docs/accessanalyzer/12.0/solutions/sharepoint/recommended.md)
topic before continuing with this workflow.
:::
@@ -321,7 +321,7 @@ topic before continuing with this workflow.
:::info
Scope the 0.Collection Job Group to only include the collection components
desired by disabling the undesired collection jobs. Disabling them allows the solution to run more
-efficiently. It is not recommended to delete any jobs. See the
+efficiently. It isn't recommended to delete any jobs. See the
[Disable or Enable a Job](/docs/accessanalyzer/12.0/admin/jobs/job/disableenable.md) topic for additional
information.
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/content/overview.md b/docs/accessanalyzer/12.0/solutions/sharepoint/content/overview.md
index daa03e7265..8def6f4a87 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/content/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/content/overview.md
@@ -6,11 +6,10 @@ sidebar_position: 60
# 4.Content Job Group
-This group provides insight into content stored across SharePoint farms in order to help more
-efficiently manage that content. It will provide information on the content taking up the most
-space, the content that has not been accessed for extended periods of time, and additional data
-describing SharePoint content and the configuration of the repositories such as lists and libraries
-which store that content.
+This group provides insight into content stored across SharePoint farms to help more
+efficiently manage that content. It will provide information about the largest content,
+content that hasn't been accessed in a long time, and additional data about SharePoint content
+and the configuration of repositories, such as lists and libraries, that store that content.
@@ -23,5 +22,5 @@ The 4.Content Job Group is comprised of:
- [SP_StaleFiles Job](/docs/accessanalyzer/12.0/solutions/sharepoint/content/sp_stalefiles.md) – Identifies files that have been modified in at least a
year across SharePoint farms. This aids administrators and users in cleaning up or archiving old
and unchanged files to help maintain a clean and healthy SharePoint environment. Report includes
- files, their last modified time, total file size, versions and version size, along with file owner
+ files, their last modified time, total file size, versions, and version size, along with file owner
and file editor information.
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/content/sp_largestfiles.md b/docs/accessanalyzer/12.0/solutions/sharepoint/content/sp_largestfiles.md
index b6b16f7b8b..872f09b549 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/content/sp_largestfiles.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/content/sp_largestfiles.md
@@ -17,7 +17,7 @@ Navigate to the **Jobs** > **SharePoint** > **4.Content** > **SP_LargestFiles**
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/content/sp_stalefiles.md b/docs/accessanalyzer/12.0/solutions/sharepoint/content/sp_stalefiles.md
index 1ea8574f7c..380bd046a0 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/content/sp_stalefiles.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/content/sp_stalefiles.md
@@ -9,12 +9,12 @@ sidebar_position: 20
The SP_StaleFiles Job identifies files that have not been modified in at least a year across
SharePoint farms. This aids administrators and users in cleaning up or archiving old and unchanged
files to help maintain a clean and healthy SharePoint environment. Report includes files, their last
-modified time, total file size, versions and version size, along with file owner and file editor
+modified time, total file size, versions, and version size, along with file owner and file editor
information.
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -33,7 +33,7 @@ Navigate to the **Jobs** > **SharePoint** > **4.Content** > **SP_StaleFiles** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job. Only the `@stale` parameter can be configured for the analysis task.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/overview.md b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/overview.md
index bcb6ed9433..b1efc193b8 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# 1.Direct Permissions Job Group
The **SharePoint** > **1.Direct Permissions** Job Group provides insight into how directly applied
-permissions are configured within the targeted SharePoint environment. It is dependent on data
+permissions are configured within the targeted SharePoint environment. It depends on data
collected by the [SharePoint Access Auditing](/docs/accessanalyzer/12.0/solutions/sharepoint/collection/overview.md#sharepoint-access-auditing)
or
[SharePoint Sensitive Data Discovery Auditing (SEEK)](/docs/accessanalyzer/12.0/solutions/sharepoint/collection/overview.md#sharepoint-sensitive-data-discovery-auditing-seek)
@@ -22,14 +22,14 @@ The 1.Direct Permissions Job Group is comprised of:
directly applied on permissions. Best practices dictate that groups should be used to provide
access to resources.
- [SP_EmptyDomainGroupPerms Job](/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_emptydomaingroupperms.md) – Identifies empty security groups
- with directly assigned permissions to resources, these groups should be deleted from SharePoint
+ with directly assigned permissions to resources. Delete these groups from SharePoint
farms, where found. Inadvertent changes to group membership may open up unwanted access.
- [SP_HighRiskPermissions Job](/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_highriskpermissions.md) – Identifies where Authenticated Users,
Everyone Except External Users, Anonymous Logon, or Domain users have been directly assigned
permissions
- [SP_SiteCollectionPerms Job](/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_sitecollectionperms.md) – Most content will inherit the
- permissions configured at the root of the site collection. Having an understanding of how those
- permissions are assigned is useful for gaining perspective on the overall SharePoint permission
+ permissions configured at the root of the site collection. Understanding how those
+ permissions are assigned gives you perspective on the overall SharePoint permission
configuration.
- [SP_StaleUsers Job](/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_staleusers.md) – Identifies locations where there are stale users directly
applied on SharePoint resources. These permissions can be safely removed.
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_domainusers.md b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_domainusers.md
index eb0af9d7fc..cb2f69e5ab 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_domainusers.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_domainusers.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **1.Direct Permissions** > **SP_Doma
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_emptydomaingroupperms.md b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_emptydomaingroupperms.md
index cc7f9c7eda..2abcdc330e 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_emptydomaingroupperms.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_emptydomaingroupperms.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# SP_EmptyDomainGroupPerms Job
The SP_EmptyDomainGroupPerms Job identifies empty security groups with directly assigned permissions
-to resources, these groups should be deleted from SharePoint farms, where found. Inadvertent changes
+to resources. Delete these groups from SharePoint farms, where found. Inadvertent changes
to group membership may open up unwanted access.
## Analysis Tasks for the SP_EmptyDomainGroupPerms Job
@@ -17,7 +17,7 @@ Navigate to the **Jobs** > **SharePoint** > **1.Direct Permissions** >
tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_highriskpermissions.md b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_highriskpermissions.md
index 0f5bc1d680..16d9a50712 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_highriskpermissions.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_highriskpermissions.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# SP_HighRiskPermissions Job
The SP_HighRiskPermissions Job identifies where Authenticated Users, Everyone Except External Users,
-Anonymous Logon, or Domain users have been directly assigned permissions
+Anonymous Logon, or Domain users have been directly assigned permissions.
## Analysis Tasks for the SP_HighRiskPermissions Job
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **1.Direct Permissions** > **SP_High
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_sitecollectionperms.md b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_sitecollectionperms.md
index 52b2c9b2d6..a446139172 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_sitecollectionperms.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_sitecollectionperms.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# SP_SiteCollectionPerms Job
-Most content will inherit the permissions configured at the root of the site collection. Having an
-understanding of how those permissions are assigned is useful for gaining perspective on the overall
+Most content will inherit the permissions configured at the root of the site collection. Understanding
+how those permissions are assigned gives you perspective on the overall
SharePoint permission configuration.
## Analysis Tasks for the SP_SiteCollectionPerms Job
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **SharePoint** > **1.Direct Permissions** > **SP_Site
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -41,4 +41,4 @@ report:
| Report | Description | Default Tags | Report Elements |
| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Direct Site Collection Permissions | Most content will inherit the permissions configured at the root of the site collection. Having an understanding of how those permissions are assigned is useful for gaining perspective on the overall SharePoint permission configuration. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 site collections by direct permissions
- Table – Provides details on site collections by direct permissions breakdown
|
+| Direct Site Collection Permissions | Most content will inherit the permissions configured at the root of the site collection. Understanding how those permissions are assigned gives you perspective on the overall SharePoint permission configuration. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 site collections by direct permissions
- Table – Provides details on site collections by direct permissions breakdown
|
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_staleusers.md b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_staleusers.md
index 9df86978c2..4380193058 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_staleusers.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_staleusers.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# SP_StaleUsers Job
-A stale user is defined as either currently disabled within Active Directory, or has not logged onto
+A stale user is a user account that's disabled in Active Directory or hasn't logged on to
the domain for over 90 days. This job will identify locations where there are stale users directly
applied on SharePoint resources. These permissions can be safely removed.
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **SharePoint** > **1.Direct Permissions** > **SP_Stal
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -37,4 +37,4 @@ users, the SP_StaleUsers Job produces the following pre-configured report:
| Report | Description | Default Tags | Report Elements |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Stale User Permissions | A stale user is defined as either currently disabled within Active Directory, or has not logged onto the domain for over 90 days. | None | This report is comprised of three elements: - Bar Chart – Displays top 5 users by affected resources
- Table – Provides details on top resource by stale user permissions
- Table – Provides details on top stale users by affected resources
|
+| Stale User Permissions | A stale user is a user account that's disabled in Active Directory or hasn't logged on to the domain for over 90 days. | None | This report is comprised of three elements: - Bar Chart – Displays top 5 users by affected resources
- Table – Provides details on top resource by stale user permissions
- Table – Provides details on top stale users by affected resources
|
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_unresolvedsids.md b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_unresolvedsids.md
index a6b75e2650..5c1d7551f0 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_unresolvedsids.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/directpermissions/sp_unresolvedsids.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **1.Direct Permissions** > **SP_Unre
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/overview.md b/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/overview.md
index 106bebefeb..4e7e6d21e9 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/overview.md
@@ -14,9 +14,9 @@ SharePoint environment.
The Effective Access Audits Job Group is comprised of:
- [Scoping > SP_TrusteeAccess Job](/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaccess.md) – Scopes a list of users to audit their
- access across the SharePoint environment. This can also be accomplished by looking users up in the
- Access Information Center. However, it is recommended to use this job in scenarios where a report
- on multiple users’ effective access at once needs to be generated.
+ access across the SharePoint environment. You can also look users up in the
+ Access Information Center. However, use this job when you need to generate a report
+ on multiple users’ effective access at once.
- [SP_TrusteeAudit Job](/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaudit.md) – Provides functionality similar to the Access
Information Center by allowing scoped audits of users’ access across the environment
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaccess.md b/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaccess.md
index b19b74019d..c8d55cf712 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaccess.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaccess.md
@@ -6,9 +6,9 @@ sidebar_position: 10
# Scoping > SP_TrusteeAccess Job
-The SP_TrusteeAccess job allows you to scope a list of users to audit their access across the
+Use the SP_TrusteeAccess job to scope a list of users to audit their access across the
SharePoint environment. You can also accomplish this by looking users up in the Access Information
-Center, however you want to utilize this job in scenarios where you want to generate a report on
+Center. However, use this job when you want to generate a report on
multiple users’ effective access at once.
:::note
@@ -37,10 +37,10 @@ The default query is:
### Configure CSV File for the Query for the SP_TrusteeAccess Job
-Follow the steps to specify trustees in the `UserScoping.csv` file.
+To specify trustees in the `UserScoping.csv` file:
**Step 1 –** Navigate to the **Jobs** > **SharePoint** > **Effective Access Audits** > **Scoping** >
-**SP_TrusteeAccess** Job and right-click on the job. Select **Explore Folder** and the job’s
+**SP_TrusteeAccess** Job and right-click the job. Select **Explore Folder** and the job’s
directory opens.
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaudit.md b/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaudit.md
index 8d878d7a92..50a354bdbf 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaudit.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/sp_trusteeaudit.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **SharePoint** > **Effective Access Audits** > **SP_T
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/overview.md b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/overview.md
index 43ee5e2317..8cf8b69d8a 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 100
# 8.M365 Job Group
The 8.M365 Job Group generates summary and detail reports of SharePoint Activity on the specified
-Teams sites. These reports can be used for identifying file, folder, and user related activity
+Teams sites. Use these reports to identify file, folder, and user related activity
across your SharePoint environment.
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_externalusers.md b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_externalusers.md
index 410040242f..5fc7e55657 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_externalusers.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_externalusers.md
@@ -6,16 +6,16 @@ sidebar_position: 10
# SP_ExternalUsers Job
-The SP_TeamsExternalUsers Job identifies activity of external users on all monitored SharePoint
+The SP_ExternalUsers Job identifies activity of external users on all monitored SharePoint
servers.
## Analysis Tasks for the SP_ExternalUsers Job
-Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_OneDrives** > **Configure** node and
+Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_ExternalUsers** > **Configure** node and
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -30,7 +30,7 @@ The default analysis task is:
- Summarize External User Activity – Creates the SP_ExternalUsersDetails table accessible under the
job's Results node
-In addition to the tables created by the analysis tasks, the SP_TeamsExternalUsers Job produces the
+In addition to the tables created by the analysis tasks, the SP_ExternalUsers Job produces the
following preconfigured report:
| Report | Description | Default Tags | Report Elements |
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_onedrives.md b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_onedrives.md
index 7990d08acb..5158a9a323 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_onedrives.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_onedrives.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_OneDrives** > **Co
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -44,4 +44,4 @@ preconfigured reports:
| ------------------------ | -------------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| One Drive Activity | This report displays activity information from OneDrives. | None | This report is comprised of three elements: - Bar Chart – Provides information on top OneDrives by Operation Count
- Table – Provides details on OneDriveSummary
- Table – Provides details on OneDrive Activity Details
|
| One Drive Sensitive Data | This report displays sensitive information from OneDrives. | None | This report is comprised of three elements: - Bar Chart – Provides information on top OneDrives by sensitive files
- Table – Provides details on sensitive data summary
- Table – Provides details on OneDrive file details
|
-| One Drive Sensitive Data | This report displays summary level information across all OneDrives. | None | This report is comprised of three elements: - Bar Chart – Provides information on OneDrive summary
- Table – Provides details on top OneDrives by GB
- Table – Provides details on top OneDrives by GB summary
- Table – Provides information on OneDrive details
|
+| One Drive Summary | This report displays summary level information across all OneDrives. | None | This report is comprised of three elements: - Bar Chart – Provides information on OneDrive summary
- Table – Provides details on top OneDrives by GB
- Table – Provides details on top OneDrives by GB summary
- Table – Provides information on OneDrive details
|
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_sharedlinks.md b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_sharedlinks.md
index 81db39bfee..d53caa829e 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_sharedlinks.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_sharedlinks.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_SharedLinks** > **
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -37,11 +37,11 @@ The default analysis tasks are:
SA_SP_SharingLinks_Creation_Detail_Last_7_Days, and
SA_SP_SharingLinks_Creation_Summary_Last_7_Days tables accessible under the job's Results node
-In addition to the tables created by the analysis tasks, the SP_Shared Links Job produces the
+In addition to the tables created by the analysis tasks, the SP_SharedLinks Job produces the
following preconfigured reports:
| Report | Description | Default Tags | Report Elements |
| -------------------- | ------------------------------------------------------------------------------------------------------------------ | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Anonymous Sharing | This report highlights instances where resources are anonymously shared via a shareable link in SharePoint Online. | None | This report is comprised of three elements: - Bar Chart – Provides information on the top site collections and anonymously shared files
- Table – Provides details anonymous sharing summary by site collection
- Table – Provides details on anonymously sharing details
|
-| Shared Link Activity | This report highlights instances of activity via shared links in SharePoint Online. | None | This report is comprised of three elements: - Bar Chart – Provides information on the shared link creation for the last 7 days OneDrive summary
- Table – Provides details on shared link creation summary for the last 7 days
- Table – Provides details on shared link activity
|
-| Shared Links | This report highlights instances of shared links in SharePoint Online. | None | This report is comprised of three elements: - Bar Chart Table– Provides information on the shared link summary
- Bar Chart– Provides details on top site collections by shared files
- Table – Provides details on site collection summary
- Table – Provides details on shared links
|
+| Anonymous Sharing | This report highlights instances where resources are anonymously shared via a shareable link in SharePoint Online. | None | This report is comprised of three elements: - Bar Chart – Provides information on the top site collections and anonymously shared files
- Table – Provides details on anonymous sharing summary by site collection
- Table – Provides details on anonymous sharing details
|
+| Shared Link Activity | This report highlights instances of activity via shared links in SharePoint Online. | None | This report is comprised of three elements: - Bar Chart – Provides information on the shared link creation for the last 7 days
- Table – Provides details on shared link creation summary for the last 7 days
- Table – Provides details on shared link activity
|
+| Shared Links | This report highlights instances of shared links in SharePoint Online. | None | This report is comprised of four elements: - Bar Chart – Provides information on the shared link summary
- Bar Chart – Provides details on top site collections by shared files
- Table – Provides details on site collection summary
- Table – Provides details on shared links
|
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_staleteamsites.md b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_staleteamsites.md
index f0911dfbde..28b44146e2 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_staleteamsites.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_staleteamsites.md
@@ -7,11 +7,11 @@ sidebar_position: 40
# SP_StaleTeamSites Job
The SP_StaleTeamSites Job identifies Teams that have not had activity for a number of days that can
-be set in the analysis (Set as 30 Days by Default).
+be set in the analysis (Set at 30 Days by Default).
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_teams.md b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_teams.md
index 8715ed4e7a..e76023aca6 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_teams.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_teams.md
@@ -15,7 +15,7 @@ Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_Teams** > **Config
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_teamsexternaluseractivity.md b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_teamsexternaluseractivity.md
index e5b9fc39ba..62c9e61493 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_teamsexternaluseractivity.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_teamsexternaluseractivity.md
@@ -16,7 +16,7 @@ Navigate to the **Jobs** > **SharePoint** > **8.M365** >
tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_teamssensitivedata.md b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_teamssensitivedata.md
index cec32e66a1..feb53b8958 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_teamssensitivedata.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/m365/sp_teamssensitivedata.md
@@ -14,7 +14,7 @@ Navigate to the **Jobs** > **SharePoint** > **8.M365** > **SP_TeamsSensitiveData
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/overview.md b/docs/accessanalyzer/12.0/solutions/sharepoint/overview.md
index 77bdaba692..e771583881 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/overview.md
@@ -44,14 +44,14 @@ additional information.
**Sensitive Data Discovery Considerations**
-If running Sensitive Data Discovery (SDD) scans, it will be necessary to increase the minimum amount
+If you run Sensitive Data Discovery (SDD) scans, increase the minimum amount
of RAM. Each thread requires a minimum of 2 additional GB of RAM per host. For example, if the job
-is configured to scan 8 hosts at a time , then an extra 16 GB of RAM are required (8x2=16).
+is configured to scan 8 hosts at a time, then an extra 16 GB of RAM are required (8x2=16).
:::note
-The appropriate JDK (Java) version for Sensitive Data Discovery is installed on the
-server. The JDK deployed is prepackaged and does not require any configuration; it has been
-preconfigured to work with Access Analyzer and should never be customized through Java. It will not
+Access Analyzer installs the appropriate JDK (Java) version for Sensitive Data Discovery on the
+server. The JDK is prepackaged, doesn't require any configuration, and is preconfigured to work with
+Access Analyzer. Never customize it through Java. It doesn't
conflict with other JDKs or Java Runtimes in the same environment.
:::
@@ -59,7 +59,7 @@ conflict with other JDKs or Java Runtimes in the same environment.
**Location**
The SharePoint Solution requires a special Access Analyzer license. It can be installed from the
-Access Analyzer Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to the
+Access Analyzer Instant Job Wizard. After it's installed into the Jobs tree, navigate to the
solution: **Jobs** > **SharePoint**.
The 0.Collection Job Group collects the data. The other job groups and the SP_Overview Job run
@@ -70,7 +70,7 @@ analysis on the collected data and generate reports.
This SharePoint solution offers information on multiple aspects of an organization’s SharePoint
on-premises and SharePoint Online environments. This solution is comprised of 10 sub-job groups and
an overview job which collect, analyze, and report on data. The data collection is conducted by the
-SharePointAccess (SPAA) Data Collector. See the corresponding
+SharePoint Access Auditing (SPAA) Data Collector. See the corresponding
[Standard Reference Tables & Views for the SPAA Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/spaa/standardtables.md)
topic for database table information.
@@ -85,15 +85,15 @@ The following types of auditing can be conducted with the SharePoint Solution:
Each type of auditing depends on specific jobs within the 0.Collection Job Group to collect the data
and its corresponding analysis/reporting job groups. The Access Auditing components represent the
core of the SharePoint Solution. However, the Sensitive Data Discovery Auditing components also
-collect the Access Auditing data; therefore it is not necessary to run both sets of collection jobs.
+collect the Access Auditing data; therefore it isn't necessary to run both sets of collection jobs.
The data collection query options for each type are explained within the 0.Collection Job Group
section. Additionally, the corresponding analysis/reporting job groups are listed for each auditing
type.
-If intending to run two or all auditing types, see each auditing type section within the
-0.Collection Job Group section for information on query options and requirements. It is recommended
-to first run the 0.Collection Job Group components in the default order for the desired auditing
-types to ensure successful data collection, and then to run the desired sub-groups for reports.
+If you intend to run two or all auditing types, see each auditing type section within the
+0.Collection Job Group section for information on query options and requirements. First run the
+0.Collection Job Group components in the default order for the auditing types you want, to ensure
+successful data collection, then run the sub-groups you want for reports.
See the [Recommended Configuration for the SharePoint Solution](/docs/accessanalyzer/12.0/solutions/sharepoint/recommended.md) topic for additional
information on frequency and job group settings.
@@ -103,7 +103,7 @@ the following job groups and jobs:
- [0.Collection Job Group](/docs/accessanalyzer/12.0/solutions/sharepoint/collection/overview.md) – Designed to collect high level summary
information from SharePoint servers. This information is used to populate the SMP Reports based
- around the SharePoint and is a requirement for the Access Information Center – SharePoint reports.
+ around SharePoint and is a requirement for the Access Information Center – SharePoint reports.
- This job group is available with the SharePoint license feature
@@ -113,20 +113,20 @@ the following job groups and jobs:
- [2.High Risk Sites > SP_OpenAccess Job](/docs/accessanalyzer/12.0/solutions/sharepoint/sp_openaccess.md) – Provides insight into any high-risk
repositories and high-risk data that may exist within an organization’s SharePoint environment.
High risk data is effectively open to the entire organization through modification of SharePoint
- permissions to apply well known security principles such as NT AUTHORITY\Authenticated Users,
+ permissions to apply well known security principals such as NT AUTHORITY\Authenticated Users,
Everyone, and Everyone Except External Users. This data must be monitored closely because of its
exposure.
- [3.Broken Inheritance > SP_BrokenInheritance Job](/docs/accessanalyzer/12.0/solutions/sharepoint/sp_brokeninheritance.md) – Keeping track of
- directly applied permissions at mass is not realistic, this job is responsible for performing data
+ directly applied permissions at scale isn't realistic. This job is responsible for performing data
analysis and generating SharePoint broken inheritance reports at the site level. This includes
looking at site broken inheritance and the trustees who are assigned to those sites where
inheritance is broken so that you can remove that access in favor of providing access via group
membership.
- [4.Content Job Group](/docs/accessanalyzer/12.0/solutions/sharepoint/content/overview.md) – Provides insight into content stored across
- SharePoint farms in order to help more efficiently manage that content. It will provide
- information on the content taking up the most space, the content that has not been accessed for
- extended periods of time, and additional data describing SharePoint content and the configuration
- of the repositories such as lists and libraries which store that content.
+ SharePoint farms to help more efficiently manage that content. It will provide
+ information about the largest content, content that hasn't been accessed in a long time, and
+ additional data about SharePoint content and the configuration of repositories, such as lists
+ and libraries, that store that content.
- [5.Probable Owner > SP_ProbableOwner Job](/docs/accessanalyzer/12.0/solutions/sharepoint/sp_probableowner.md) – Provides reports about probable
ownership. The goal of this report is to help you either identify who most likely owns the
SharePoint resource or at least someone who can tell you who does.
@@ -135,11 +135,11 @@ the following job groups and jobs:
- Requires Sensitive Data Discovery
-- [7.Activity Job Group](/docs/accessanalyzer/12.0/solutions/sharepoint/activity/overview.md)– Generates summary and detail reports of SharePoint
- activity on the specified sites. These reports can be used for identifying file, folder, and user
+- [7.Activity Job Group](/docs/accessanalyzer/12.0/solutions/sharepoint/activity/overview.md) – Generates summary and detail reports of SharePoint
+ activity on the specified sites. Use these reports to identify file, folder, and user
related activity across your SharePoint environment.
- [8.M365 Job Group](/docs/accessanalyzer/12.0/solutions/sharepoint/m365/overview.md) – Generates summary and detail reports of SharePoint Activity
- on the specified Teams sites. These reports can be used for identifying file, folder, and user
+ on the specified Teams sites. Use these reports to identify file, folder, and user
related activity across your SharePoint environment.
- [Effective Access Audits Job Group](/docs/accessanalyzer/12.0/solutions/sharepoint/effectiveaccessaudits/overview.md) – Returns reports
identifying specific trustees’ effective access across the entire SharePoint environment
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/recommended.md b/docs/accessanalyzer/12.0/solutions/sharepoint/recommended.md
index 9efbfdc602..a999da83cc 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/recommended.md
@@ -8,25 +8,25 @@ sidebar_position: 10
The SharePoint Solution has been configured to inherit down from the **SharePoint** > **Settings**
node. However, it is a best practice to assign the host list and the Connection Profile at the data
-collection level, 0.Collection Job Group. Once these are assigned to the job group, it can be run
+collection level, 0.Collection Job Group. After these are assigned to the job group, it can be run
directly or scheduled.
**Dependencies**
-- The **.Active Directory Inventory** Job Group needs to be executed prior to running the SharePoint
+- The **.Active Directory Inventory** Job Group needs to be executed before running the SharePoint
Solution against a SharePoint on-premises environment
-- The **.Entra ID Inventory** Job Group needs to be executed prior to running the SharePoint
+- The **.Entra ID Inventory** Job Group needs to be executed before running the SharePoint
Solution against a SharePoint Online environment
- For Agent-based scans, the SharePoint Agent must be installed on the application server (for
Access Auditing & Sensitive Data Discovery Auditing only)
-**Targeted Host(s)**
+**Targeted Hosts**
For the 0.Collection Job Group:
- Single SharePoint Application server hosting Central Administration per SharePoint farm
-The host list assignment should be assigned under the **SharePoint** > **0.Collection** >
+Assign the host list under the **SharePoint** > **0.Collection** >
**Settings** > **Host List Assignment** node. The list should be a custom-created list for the
SharePoint environments to be targeted. Select the checkbox for the custom-created host list.
@@ -42,17 +42,17 @@ The SPAA Data Collector requires a specific set of permissions. See the
[SharePoint Support](/docs/accessanalyzer/12.0/requirements/sharepoint/sharepoint/sharepoint.md) topics for the necessary permissions
for both on-premises and online target environments. Then create a custom Connection Profile
containing the appropriate credentials for the targeted environment. If a single Connection Profile
-contains both on-premises and online credentials, it is necessary for the online credentials to be
+contains both on-premises and online credentials, the online credentials must be listed
above the on-premises credentials in the Connection Profile credentials list.
The Connection Profile should be assigned under the **SharePoint** > **0.Collection** >
**Settings** > **Connection** node. It is set to **Use the Default Profile**, as configured at the
global settings level. However, since this may not be the Connection Profile with the necessary
permissions for the assigned hosts, select the **Select one of the following user defined profiles**
-option and select the appropriate Connection Profile from the drop-down menu.
+option and select the appropriate Connection Profile from the dropdown menu.
The jobs within the 5.Effective Access Audits Job Group import CSV files from the jobs’ directories
-using the TextSearch Data Collector. Therefore, it is necessary to assign a Connection Profile with
+using the TextSearch Data Collector. Therefore, assign a Connection Profile with
rights on the Access Analyzer Console server to access the CSV file saved in the job’s directory.
The Connection Profile can be set at either the **Effective Access Audits** > **Settings** >
**Connection** node (applies to both jobs) or in the job’s Properties window on the Connection tab.
@@ -65,21 +65,21 @@ The jobs in this job group can be scheduled to run as desired.
**Run Order**
-The 0.Collection Jobs must be run first and in order. RunSystem Scans jobs and then the Bulk Import
-jobs according to the desired workflow. The other SharePoint Solution sub-job groups can be run in
+The 0.Collection Jobs must be run first and in order. Run System Scans jobs and then the Bulk Import
+jobs according to the workflow you want. The other SharePoint Solution sub-job groups can be run in
any order, together or individually, after running the 0.Collection Job Group. It is recommended to
run at the sub-job group level. The SP_Overview Job pulls information from both the 0.Collection Job
Group and the other sub-job groups, and the report may contain blank sections if only select sub-job
groups are run.
-The Access Information Center requires the execution of the 2-SPAA_BulkImport Job default analysis
-tasks in order for permission/access reports to be accessible. For activity reports, the Access
-Information Center requires the execution of both the 2-SPAA Bulk Import Job default analysis tasks
-and the 2-SPAC Bulk Import Job default analysis tasks.
+The Access Information Center requires the 2-SPAA_BulkImport Job's default analysis
+tasks to run before permission/access reports are accessible. For activity reports, the Access
+Information Center requires the default analysis tasks of both the 2-SPAA Bulk Import Job
+and the 2-SPAC Bulk Import Job to run.
:::info
If only conducting one or two types of auditing, scope the solution by disabling
-the undesired collection jobs. Disabling them allows the solution to run more efficiently. It is not
+the undesired collection jobs. Disabling them allows the solution to run more efficiently. It isn't
recommended to delete any jobs. See the
[Disable or Enable a Job](/docs/accessanalyzer/12.0/admin/jobs/job/disableenable.md) topic for additional information.
:::
@@ -90,7 +90,7 @@ recommended to delete any jobs. See the
This solution can be run with the default query configuration. However, the most common
customizations include:
-- If using agent-based scanning, it is necessary to enable the agent services on the SharePoint
+- If using agent-based scanning, enable the agent services on the SharePoint
Access Auditor Data Collector Wizard pages:
- Agent Settings page, enable agent service scans:
@@ -152,26 +152,26 @@ This solution should be run with the default analysis configuration. Most of the
are preconfigured. There are a few which are deselected by default, as they are for troubleshooting
purposes.
-Though the analysis tasks should not be deselected, the following parameters can be modified:
+Though the analysis tasks shouldn't be deselected, the following parameters can be modified:
-- Stale File is defined by default to 365 days
+- Stale File defaults to 365 days
- Customize within the **4.Content** > **SP_StaleFiles** Job
-- Stale Teams is defined by default to 30 days
+- Stale Teams defaults to 30 days
- Customize within the **8.M365** > **SP_StaleTeamSites** Job
The .Active Directory Inventory Solution defines large groups, deeply nested groups, stale users,
and users with large tokens. These parameters can be customized and are applicable to any solution,
-including SharePoint, which incorporate this analyzed data into further analysis.
+including SharePoint, which incorporates this analyzed data into further analysis.
- Customize within .Active Directory Inventory > 3-AD_Exceptions Job analysis tasks
**Additional Considerations**
The Effective Access Audits Job Group is designed to work independently of the rest of the solution,
-but it is dependent upon the 0.Collection Job Group and the user-modified CSV files.
+but it depends on the 0.Collection Job Group and the user-modified CSV files.
**Additional Notes**
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/sp_brokeninheritance.md b/docs/accessanalyzer/12.0/solutions/sharepoint/sp_brokeninheritance.md
index f648b4fd6a..05e7324b24 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/sp_brokeninheritance.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/sp_brokeninheritance.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# 3.Broken Inheritance > SP_BrokenInheritance Job
-Keeping track of directly applied permissions at mass is not realistic, the SP_BrokenInheritance job
+Keeping track of directly applied permissions at scale isn't realistic. The SP_BrokenInheritance job
is responsible for performing data analysis and generating SharePoint broken inheritance reports at
the site level. This includes looking at site broken inheritance and the trustees who are assigned
to those sites where inheritance is broken so that you can remove that access in favor of providing
@@ -22,7 +22,7 @@ Navigate to the **Jobs** > **SharePoint** > **3.Broken Inheritance** > **SP_Brok
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -45,4 +45,4 @@ inheritance, the SP_BrokenInheritance Job produces the following pre-configured
| Report | Description | Default Tags | Report Elements |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Broken Inheritance | This job is responsible for performing data analysis and generating SharePoint direct permission reports at the site level. This includes looking at site broken inheritance and the trustees who are assigned to those sites where inheritance is broken. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 site collections by resources with permission changes
- Table – Provides a site collection summary
- Table – Provides broken inheritance details
|
+| Broken Inheritance | This job is responsible for performing data analysis and generating SharePoint broken inheritance reports at the site level. This includes looking at site broken inheritance and the trustees who are assigned to those sites where inheritance is broken. | None | This report is comprised of two elements: - Bar Chart – Displays top 5 site collections by resources with permission changes
- Table – Provides a site collection summary
- Table – Provides broken inheritance details
|
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/sp_openaccess.md b/docs/accessanalyzer/12.0/solutions/sharepoint/sp_openaccess.md
index e7c268a5bc..d095224987 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/sp_openaccess.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/sp_openaccess.md
@@ -16,10 +16,10 @@ its exposure.
The job group is comprised of the SP_OpenAccess Job. Minimizing your attack surface is the goal.
Open site collections can potentially provide access to privileged data, greatly increasing your
-vulnerability. The SP_OpenAccess Job will identify places in the environment where data is able to
-be accessed by a very large amount of employees.
+vulnerability. The SP_OpenAccess Job will identify places in the environment where data can
+be accessed by a very large number of employees.
-It is dependent on data collected by the
+It depends on data collected by the
[SharePoint Access Auditing](collection/overview.md#sharepoint-access-auditing) or
[SharePoint Sensitive Data Discovery Auditing (SEEK)](collection/overview.md#sharepoint-sensitive-data-discovery-auditing-seek)
components of the [0.Collection Job Group](/docs/accessanalyzer/12.0/solutions/sharepoint/collection/overview.md).
@@ -30,7 +30,7 @@ Navigate to the **Jobs** > **SharePoint** > **2.High Risk Sites** > **SP_OpenAcc
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/sp_overview.md b/docs/accessanalyzer/12.0/solutions/sharepoint/sp_overview.md
index a1a94fecc3..20ee3fd268 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/sp_overview.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/sp_overview.md
@@ -12,11 +12,11 @@ found during scans.
-It is dependent on data collected by the
+It depends on data collected by the
[SharePoint Access Auditing](collection/overview.md#sharepoint-access-auditing),
[SharePoint Sensitive Data Discovery Auditing (SEEK)](collection/overview.md#sharepoint-sensitive-data-discovery-auditing-seek),
and [SharePoint Activity Auditing](collection/overview.md#sharepoint-activity-auditing) components
-of the [0.Collection Job Group](/docs/accessanalyzer/12.0/solutions/sharepoint/collection/overview.md). It also depends on the running of the
+of the [0.Collection Job Group](/docs/accessanalyzer/12.0/solutions/sharepoint/collection/overview.md). It also depends on running the
sub-job groups within the solution. If only select sub-job groups have been run, there will be blank
sections of this overview report.
@@ -26,14 +26,14 @@ Navigate to the **Jobs** > **SharePoint** > **SP_Overview** > **Configure** node
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
-The default analysis tasks is:
+The default analysis task is:
- Generate Overview – Creates an interim processing table in the database for use by downstream
analysis and report generation
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/sp_probableowner.md b/docs/accessanalyzer/12.0/solutions/sharepoint/sp_probableowner.md
index 89f2ac39f4..471a90ee3c 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/sp_probableowner.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/sp_probableowner.md
@@ -6,8 +6,8 @@ sidebar_position: 70
# 5.Probable Owner > SP_ProbableOwner Job
-The SP_ProbableOwner Job aids in the identification of probable owners for Site Collections and
-Sites, which can be used for entitlement reviews. Probably Owner calculation is based on file
+The SP_ProbableOwner Job identifies probable owners for Site Collections and
+Sites, which you can use for entitlement reviews. Probable Owner calculation is based on file
ownership, management structure, and file activity. The goal of this report is to help you identify
who most likely owns the SharePoint resource or at least someone who can tell you who does.
@@ -21,7 +21,7 @@ Navigate to the **Jobs** > **SharePoint** > **5.Probable Owner** >
**SP_ProbableOwner** >**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/sharepoint/sp_sensitivedata.md b/docs/accessanalyzer/12.0/solutions/sharepoint/sp_sensitivedata.md
index 5f74bf9497..c5bd31254d 100644
--- a/docs/accessanalyzer/12.0/solutions/sharepoint/sp_sensitivedata.md
+++ b/docs/accessanalyzer/12.0/solutions/sharepoint/sp_sensitivedata.md
@@ -19,7 +19,7 @@ Navigate to the **Jobs** > **SharePoint** > **6.Sensitive Data** > **SP_Sensitiv
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/unix/overview.md b/docs/accessanalyzer/12.0/solutions/unix/overview.md
index 75f7245472..2f347a4dba 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/overview.md
@@ -28,7 +28,7 @@ for additional information.
**Location**
The Unix Solution requires a special Access Analyzer license. It can be installed from the Access
-Analyzer Instant Job Wizard. Once it has been installed into the Jobs tree, navigate to the
+Analyzer Instant Job Wizard. After it's installed into the Jobs tree, navigate to the
solution: **Jobs** > **Unix**.
## Job Groups
diff --git a/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/overview.md b/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/overview.md
index 7bf881a023..f3de1da06f 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/overview.md
@@ -14,7 +14,7 @@ critical files such as passwd, shadow, sudoers, hosts.deny, and more.
The jobs in the 2.Privileged Access job group are:
-- [ Sudoers Job Group](/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/sudoers/overview.md) – The jobs in this job group provide visibility into all
+- [Sudoers Job Group](/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/sudoers/overview.md) – The jobs in this job group provide visibility into all
rights granted via sudoers within audited Unix and Linux environments
- [UX_CriticalFiles Job](/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/ux_criticalfiles.md) – This job provides visibility into owners of critical
files within audited Unix and Linux environments such as passwd, shadow, sudoers, hosts.deny, and
diff --git a/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/sudoers/ux_sudoers.md b/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/sudoers/ux_sudoers.md
index 99676434f6..50b2fb667d 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/sudoers/ux_sudoers.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/sudoers/ux_sudoers.md
@@ -15,7 +15,7 @@ Navigate to the **Unix** > **2.Privileged Access** > **Sudoers** > **UX_Sudoers*
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/ux_criticalfiles.md b/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/ux_criticalfiles.md
index 90290258bc..0766555d7b 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/ux_criticalfiles.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/privilegedaccess/ux_criticalfiles.md
@@ -11,7 +11,7 @@ Linux environments such as passwd, shadow, sudoers, hosts.deny, and more.
## Queries for the UX_CriticalFiles Job
-The UX_CriticalFIles job uses the Unix Data Collector for the following query:
+The UX_CriticalFiles job uses the Unix Data Collector for the following query:
:::warning
The query is preconfigured for this job. Never modify the query.
@@ -30,7 +30,7 @@ Navigate to the **Unix** > **2.Privileged Access** > **UX_CriticalFiles** > **Co
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/unix/recommended.md b/docs/accessanalyzer/12.0/solutions/unix/recommended.md
index 0a95dabb67..c01df1c90a 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/recommended.md
@@ -14,10 +14,10 @@ directly or scheduled.
If applicable, the **.NIS Inventory** job group can be run to enable reporting on users and groups
from NIS environments.
-**Target Host(s)**
+**Target Hosts**
-All Unix Servers. Create a custom host list in Host Management that contains all Unix servers that
-are in scope to be auditing with the Unix solution.
+All Unix Servers. Create a custom host list in Host Management that contains all Unix servers you
+want to audit with the Unix solution.
The Unix job group has been configured to inherit the host list assignment from the solution level.
The host list assignment should be assigned under the **Unix** > **Settings** > **Host List
@@ -27,7 +27,7 @@ Assignment** node. Select the UNIX servers host list created previously.
Set a Connection Profile on the Unix job group with root permissions for Unix/Linux.
-If the Root permission is unavailable, a least privileged model can be used. See the
+If the Root permission is unavailable, you can use a least privileged model instead. See the
[Least Privilege Model](/docs/accessanalyzer/12.0/requirements/unix/target.md#least-privilege-model) topic for
permissions needed to target the supported platforms for data collection.
@@ -37,7 +37,7 @@ Schedule the Unix Solution or individual job groups to run as desired.
**History Retention**
-This is not supported in this job group and should be turned off.
+This isn't supported in this job group and should be turned off.
**Run at the Job Group Level**
@@ -57,7 +57,7 @@ The analysis tasks in this job group are preconfigured to run with the default c
**Step 1 –** Run a Host Discovery Query to create a host list with All Unix Servers, and assign that
host list under the **Unix** > **Settings** > **Host List Assignment** node.
-**Step 2 –** (Optional) If applicable, run the **.NIS Inventory** job group run to enable reporting
+**Step 2 –** (Optional) If applicable, run the **.NIS Inventory** job group to enable reporting
on users and groups from NIS environments.
**Step 3 –** Set a Connection Profile on the Unix job group.
diff --git a/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/overview.md b/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/overview.md
index daf3709a15..a6e58b6759 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/overview.md
@@ -16,6 +16,6 @@ The jobs in the 0.Collection job group are:
- [UX_NFSConfiguration Job](/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/ux_nfsconfiguration.md) – Collects NFS configuration information which
will be further analyzed to identify and categorize risk within audited Unix and Linux
environments
-- [UX_NFSConfiguration Job](/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/ux_nfsconfiguration.md) – Collects Samba configuration information which
+- [UX_SambaConfiguration Job](/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/ux_sambaconfiguration.md) – Collects Samba configuration information which
will be further analyzed to identify and categorize risk within audited Unix and Linux
environments
diff --git a/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/ux_nfsconfiguration.md b/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/ux_nfsconfiguration.md
index b4e61b14d8..7af14e4b13 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/ux_nfsconfiguration.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/ux_nfsconfiguration.md
@@ -31,7 +31,7 @@ Navigate to the **Unix** > **3.Sharing** > **0.Collection** > **UX_NFSConfigurat
**Configure** node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/ux_sambaconfiguration.md b/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/ux_sambaconfiguration.md
index deb07b5411..e9672573d9 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/ux_sambaconfiguration.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/sharing/collection/ux_sambaconfiguration.md
@@ -31,7 +31,7 @@ Navigate to the **Unix** > **3.Sharing** > **0.Collection** > **UX_SambaConfigur
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/unix/sharing/ux_nfs.md b/docs/accessanalyzer/12.0/solutions/unix/sharing/ux_nfs.md
index dd8848e23e..a26798aaf3 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/sharing/ux_nfs.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/sharing/ux_nfs.md
@@ -15,7 +15,7 @@ Navigate to the **Unix** > **3.Sharing** > **UX_NFS** > **Configure** node and s
to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/unix/sharing/ux_samba.md b/docs/accessanalyzer/12.0/solutions/unix/sharing/ux_samba.md
index 7c8bf01f4b..86bf9534b3 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/sharing/ux_samba.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/sharing/ux_samba.md
@@ -15,7 +15,7 @@ View the analysis tasks by navigating to the **Unix** > **3.Sharing** > **UX_Sam
node and select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -29,7 +29,7 @@ The default analysis tasks are:
- Highlights hosts with a large number of risky shares – Creates an interim processing table in the
database for use by downstream analysis and report generation
-In addition to the tables and views created by the analysis task, the UX_NFS job produces the
+In addition to the tables and views created by the analysis task, the UX_Samba job produces the
following pre-configured report:
| Report | Description | Default Tags | Report Elements |
diff --git a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/overview.md b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/overview.md
index 253b603662..ce6a694f9a 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/overview.md
@@ -14,7 +14,7 @@ to pinpoint potential areas of administrative concern.
The jobs in the 1.Users and Groups job group are:
- [0.Collection > UX_UsersAndGroups Job](/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_usersandgroups.md) – Collects user and group related
- information from /etc/shadow and their equivalents in order to provide details on user and group
+ information from /etc/shadow and their equivalents to provide details on user and group
conditions to help pinpoint areas of administrative concerns
- [UX_DuplicateGroups Job](/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_duplicategroups.md) – This job identifies duplicate groups within the
audited Unix or Linux environment. Duplicate groups contain the same group membership as one
diff --git a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_duplicategroups.md b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_duplicategroups.md
index 8754258ef4..55ca95c1ca 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_duplicategroups.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_duplicategroups.md
@@ -16,7 +16,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **UX_DuplicateGroups** > **C
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_emptygroups.md b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_emptygroups.md
index 60b746539c..8f4c216669 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_emptygroups.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_emptygroups.md
@@ -15,7 +15,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **UX_EmptyGroups** > **Confi
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_largegroups.md b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_largegroups.md
index 6efd61b2dd..ddeb90268d 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_largegroups.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_largegroups.md
@@ -12,7 +12,7 @@ resources, or how much access is being granted to resources through these groups
## Parameter Configuration
-The Configuration section on a Job's overview page allows you to easily modify any customizable
+Use the Configuration section on a Job's overview page to modify any customizable
parameters used by analysis tasks in the job. See the
[Parameter Configuration](/docs/accessanalyzer/12.0/admin/jobs/job/overview.md#parameter-configuration) topic for
instructions on how to edit parameters on a job overview page.
@@ -28,7 +28,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **UX_LargeGroups** > **Confi
select Analysis to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_localgroups.md b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_localgroups.md
index 941f9fbadb..5a0afc8aee 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_localgroups.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_localgroups.md
@@ -15,7 +15,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **UX_LocalGroups** > **Confi
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_localusers.md b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_localusers.md
index 24ab8e585e..9f0588d9f6 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_localusers.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_localusers.md
@@ -15,7 +15,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **UX_LocalUsers** > **Config
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_passwordsettings.md b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_passwordsettings.md
index e33e7c4378..6a74a5b976 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_passwordsettings.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_passwordsettings.md
@@ -15,7 +15,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **UX_PasswordSettings** > **
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_usersandgroups.md b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_usersandgroups.md
index 5ab286972f..1436f8e870 100644
--- a/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_usersandgroups.md
+++ b/docs/accessanalyzer/12.0/solutions/unix/usersgroups/ux_usersandgroups.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# 0.Collection > UX_UsersAndGroups Job
The UX_UsersAndGroups job collects user and group information from /etc/passwd, /etc/shadow, and
-their equivalents in order to provide details on user and group conditions to help pinpoint
+their equivalents to provide details on user and group conditions to help pinpoint
potential areas of administrative concern.
@@ -44,7 +44,7 @@ Navigate to the **Unix** > **1.Users and Groups** > **0.Collection** > **UX_User
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/applications/sg_installedapplications.md b/docs/accessanalyzer/12.0/solutions/windows/applications/sg_installedapplications.md
index e4c87739e2..b527629f3f 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/applications/sg_installedapplications.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/applications/sg_installedapplications.md
@@ -19,7 +19,7 @@ The query is preconfigured for this job. Never modify the query.
-The query for the SG_InstalledApplications job are:
+The query for the SG_InstalledApplications job is:
- Installed Applications – Targets all Windows servers known to Access Analyzer to determine
installed applications
@@ -30,7 +30,7 @@ Navigate to the **Windows** > **Applications** > **SG_InstalledApplications** >
and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/applications/sg_runatboot.md b/docs/accessanalyzer/12.0/solutions/windows/applications/sg_runatboot.md
index 47f32fdafb..fa95787586 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/applications/sg_runatboot.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/applications/sg_runatboot.md
@@ -31,7 +31,7 @@ Navigate to the **Windows** > **Applications** > **SG_RunAtBoot** > **Configure*
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/applications/sg_scheduledtasks.md b/docs/accessanalyzer/12.0/solutions/windows/applications/sg_scheduledtasks.md
index cf9e4cedd6..1616b0616b 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/applications/sg_scheduledtasks.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/applications/sg_scheduledtasks.md
@@ -30,7 +30,7 @@ Navigate to the **Windows** > **Applications** > **SG_ScheduledTasks** > **Confi
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/authentication/overview.md b/docs/accessanalyzer/12.0/solutions/windows/authentication/overview.md
index 33c680ab2f..b814a532de 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/authentication/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/authentication/overview.md
@@ -15,15 +15,15 @@ The jobs in the Authentication job group are:
- [SG_LSASettings Job](/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_lsasettings.md) – This job lists LSA settings on all targeted hosts. In
particular, the RunAsPPL, RestrictAnonymous, and ValidateKdcPacSignature keys are examined. If
- these keys are not set to 1, a host is vulnerable to mimikatz and other exploitation tools. See
+ these keys aren't set to 1, a host is vulnerable to mimikatz and other exploitation tools. See
the Microsoft
[Configuring Additional LSA Protection](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn408187(v=ws.11))
- article for additional ininformation.
+ article for additional information.
- [SG_SecuritySupportProviders Job](/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_securitysupportproviders.md) – This job identifies security
support providers on all targeted hosts, highlighting potentially malicious SSPs
- [SG_WDigestSettings Job](/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_wdigestsettings.md) – This job lists WDigest settings on all targeted
- hosts. In particular, the UseLogonCredentials key is examined. If the KB is not installed, and
- this key is not set properly for a given host, cleartext passwords will be stored in memory. See
+ hosts. In particular, the UseLogonCredentials key is examined. If the KB isn't installed, and
+ this key isn't set properly for a given host, the host stores cleartext passwords in memory. See
the
[Microsoft Security Advisory](https://support.microsoft.com/en-us/help/2871997/microsoft-security-advisory-update-to-improve-credentials-protection-a)
article for more information.
diff --git a/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_lsasettings.md b/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_lsasettings.md
index 7ec96d6971..b4ffb1d065 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_lsasettings.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_lsasettings.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# SG_LSASettings Job
-The SG_LASettings job lists settings on all targeted hosts. In particular, the RunAsPPL,
-RestrictAnonymous, and ValidateKdcPacSignature keys are examined. If these keys are not set to 1, a
+The SG_LSASettings job lists LSA settings on all targeted hosts. In particular, the RunAsPPL,
+RestrictAnonymous, and ValidateKdcPacSignature keys are examined. If these keys aren't set to 1, a
host is vulnerable to mimikatz and other exploitation tools. See the Microsoft
[Configuring Additional LSA Protection](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn408187(v=ws.11))
article for additional information.
@@ -34,7 +34,7 @@ Navigate to the **Windows** > **Authentication** > **SG_LSASettings** > **Config
select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -43,7 +43,7 @@ preconfigured for this job.
The default analysis tasks are:
-- TrackRunAsPPL changes – Creates the SG_LSASettings_RunAsPPLChangeTracking table accessible under
+- Track RunAsPPL changes – Creates the SG_LSASettings_RunAsPPLChangeTracking table accessible under
the job’s Results node
- List RunAsPPL setting details – Creates the SG_LSASettings_RunAsPPLDetails table accessible under
the job’s Results node
@@ -62,6 +62,6 @@ following pre-configured reports.
| Report | Description | Default Tags | Report Elements |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Additional LSA Protection | This report summarizes RunAsPPL registry settings on targeted hosts. This key governs whether or not additional LSA protection is enabled. See the Microsoft [Configuring Additional LSA Protection](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn408187(v=ws.11)) article for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays additional LSA protection by host
- Table – Provides additional LSA Protection Details
|
-| PAC Validation | This report indicates whether or not PAC Validation is enabled on all targeted hosts. This is governed by the ValidateKdcPacSignature key. Default behavior in the event of this key's absence depends on the Windows version installed. See the Microsoft [Understanding Microsoft Kerberos PAC Validation](https://learn.microsoft.com/en-gb/archive/blogs/openspecification/understanding-microsoft-kerberos-pac-validation) article for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays PAC validation status
- Table – Provides PAC validation details
|
-| Restrict Anonymous Access | This report summarizes RestrictAnonymous registry settings on targeted hosts. This key governs whether or not access over anonymous connections is enabled. See the Microsoft [Restrict Anonymous check](https://learn.microsoft.com/en-us/previous-versions/tn-archive/bb418944(v=technet.10)) article for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays anonymous access by host
- Table – Provides anonymous access details
|
+| Additional LSA Protection | This report summarizes RunAsPPL registry settings on targeted hosts. This key governs whether additional LSA protection is enabled. See the Microsoft [Configuring Additional LSA Protection](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn408187(v=ws.11)) article for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays additional LSA protection by host
- Table – Provides additional LSA Protection Details
|
+| PAC Validation | This report indicates whether PAC Validation is enabled on all targeted hosts. This is governed by the ValidateKdcPacSignature key. Default behavior if this key is absent depends on the Windows version installed. See the Microsoft [Understanding Microsoft Kerberos PAC Validation](https://learn.microsoft.com/en-gb/archive/blogs/openspecification/understanding-microsoft-kerberos-pac-validation) article for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays PAC validation status
- Table – Provides PAC validation details
|
+| Restrict Anonymous Access | This report summarizes RestrictAnonymous registry settings on targeted hosts. This key governs whether access over anonymous connections is enabled. See the Microsoft [Restrict Anonymous check](https://learn.microsoft.com/en-us/previous-versions/tn-archive/bb418944(v=technet.10)) article for additional information. | None | This report is comprised of two elements: - Pie Chart – Displays anonymous access by host
- Table – Provides anonymous access details
|
diff --git a/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_securitysupportproviders.md b/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_securitysupportproviders.md
index b3ed9e0791..f54c266b01 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_securitysupportproviders.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_securitysupportproviders.md
@@ -31,7 +31,7 @@ Navigate to the **Windows** > **Authentication** > **SG_SecuritySupportProviders
node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_wdigestsettings.md b/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_wdigestsettings.md
index 0d3622fc86..2628eaa55e 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_wdigestsettings.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/authentication/sg_wdigestsettings.md
@@ -7,8 +7,8 @@ sidebar_position: 30
# SG_WDigestSettings Job
The SG_WDigestSettings job lists WDigest settings on all targeted hosts. In particular, the
-UseLogonCredentials key is examined. If this key is not set properly for a given host, cleartext
-passwords will be stored in memory. See the
+UseLogonCredentials key is examined. If this key isn't set properly for a given host, the host
+stores cleartext passwords in memory. See the
[Microsoft Security Advisory](https://support.microsoft.com/en-us/help/2871997/microsoft-security-advisory-update-to-improve-credentials-protection-a)
article for more information.
@@ -36,7 +36,7 @@ Navigate to the **Windows** > **Authentication** > **SG_WDigestSettings** > **Co
select **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/openaccess/recommended.md b/docs/accessanalyzer/12.0/solutions/windows/openaccess/recommended.md
index 43a1433e24..17e17c635e 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/openaccess/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/openaccess/recommended.md
@@ -16,8 +16,8 @@ All Windows Servers
**Connection Profile**
-Configure a Connection Profile that is not part of the Domain Admin group. The report should be run
-with a non-privileged user account.
+Configure a Connection Profile that isn't part of the Domain Admin group. Run the report with a
+non-privileged user account.
**Schedule Frequency**
@@ -25,7 +25,7 @@ This job in this job group should be scheduled to run daily.
**Workflow**
-**Step 1 –** Configure a Connection Profile that is not part of the Domain Admin group.
+**Step 1 –** Configure a Connection Profile that isn't part of the Domain Admin group.
**Step 2 –** Assign All Windows Servers under Hosts List Assignment.
diff --git a/docs/accessanalyzer/12.0/solutions/windows/openaccess/sg_openfolders.md b/docs/accessanalyzer/12.0/solutions/windows/openaccess/sg_openfolders.md
index 61a28e899a..7c311d6e9b 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/openaccess/sg_openfolders.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/openaccess/sg_openfolders.md
@@ -19,15 +19,15 @@ The query for the SG_OpenFolders job is:
- OpenAccess – Checks for folders with open access
- (Optional) By default, the OpenAccess query used in this job has a search depth of 0 and will
- return share-level information. If needed, the subfolder depth can be increased in the query
+ return share-level information. If needed, you can increase the subfolder depth in the query
configuration. See the [Configure the OpenAccess Query](#configure-the-openaccess-query) topic
for additional information.
### Configure the OpenAccess Query
-The OpenAccess query has been preconfigured to run with the default settings. However, the subfolder
-depth can optionally be increased on the Options page in the System Info Data Collector Wizard.
-Follow the steps to customize the query. See the
+The OpenAccess query has been preconfigured to run with the default settings. However, you can
+optionally increase the subfolder depth on the Options page in the System Info Data Collector Wizard.
+To customize the query, see the
[SystemInfo Data Collector](/docs/accessanalyzer/12.0/admin/datacollector/systeminfo/overview.md) topic for
additional information.
@@ -45,7 +45,7 @@ Wizard opens.
**Step 4 –** Navigate to the Options page and select the **Enumerate subfolders within shared
folder** checkbox and then the **Limit returned subfolders depth to** checkbox.
-**Step 5 –** Select the desired subfolders depth level using the arrows. Click **Next**.
+**Step 5 –** Select the subfolders depth level you want using the arrows. Click **Next**.
**Step 6 –** On the Summary page, click **Finish** to save the changes.
@@ -57,7 +57,7 @@ Navigate to the **Windows** > **OpenAccess** > **SG_OpenFolders** > **Configure*
**Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/overview.md b/docs/accessanalyzer/12.0/solutions/windows/overview.md
index 8688269f74..d90e099926 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 160
# Windows Solution
The Windows Solution is designed to provide both high-level and granular views into any sized
-organization's infrastructure. Systems are a critical business asset. In order to optimally support
-and benefit the business, these systems must be running optimally and be fully secured. The Windows
+organization's infrastructure. Systems are a critical business asset. To optimally support
+and benefit the business, these systems must run efficiently and stay secure. The Windows
Solution allows organizations to quickly inventory, assess, and secure their Windows desktop and
server infrastructure from a central location. Key capabilities include privileged account
discovery, security configuration and vulnerability assessment, compliance reporting, and asset
@@ -29,7 +29,7 @@ topic for additional information.
The Windows Solution requires a special Access Analyzer license. It can be installed from the
Instant Job Wizard. See the [Instant Job Wizard](/docs/accessanalyzer/12.0/admin/jobs/instantjobs/overview.md) topic for
-additional information. Once it has been installed in the Jobs tree, navigate to the solution:
+additional information. After it's installed in the Jobs tree, navigate to the solution:
**Jobs** > **Windows**.
@@ -62,7 +62,7 @@ The jobs and job groups in the Windows Solution are:
- [Security Utilities Job Group](/docs/accessanalyzer/12.0/solutions/windows/securityutilities/overview.md) – This group provides a series of
security element checks across the audited environment
- [SG_SecurityAssessment Job](/docs/accessanalyzer/12.0/solutions/windows/sg_securityassessment.md) – This job performs checks against Windows
- security best practices in order to proactively identify critical security configurations that
+ security best practices to proactively identify critical security configurations that
leave the environment vulnerable to attack. The result is a report which provides a listing of
- findings by severity and category with corresponding details that can be used to prioritize and
+ findings by severity and category with corresponding details you can use to prioritize and
remediate security issues.
diff --git a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/overview.md b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/overview.md
index cbd491ff6f..7ba010bee7 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/overview.md
@@ -21,4 +21,4 @@ The jobs in the Local Administrators group are:
article for additional information.
- [SG_Sessions Job](/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/sg_sessions.md) – This job lists sessions and logged on users from all targeted
hosts. These active sessions and logged on users may have their hashes stored in memory on the
- target machine, which could be leveraged in a Pass the Hash attack.
+ target machine, which could be used in a Pass the Hash attack.
diff --git a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/sg_localadmins.md b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/sg_localadmins.md
index bf995d8560..dbf2529dbb 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/sg_localadmins.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/sg_localadmins.md
@@ -31,7 +31,7 @@ Navigate to the **Windows** > **Privileged Accounts** > **Local Administrators**
**SG_LocalAdmins** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/sg_microsoftlaps.md b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/sg_microsoftlaps.md
index bbdec1f7c5..9f0d8669cd 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/sg_microsoftlaps.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/sg_microsoftlaps.md
@@ -34,7 +34,7 @@ Navigate to the **Windows** > **Privileged Accounts** > **Local Administrators**
**SG_MicrosoftLAPS** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/sg_sessions.md b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/sg_sessions.md
index d6dc15df3f..6d1375687a 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/sg_sessions.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/localadministrators/sg_sessions.md
@@ -8,7 +8,7 @@ sidebar_position: 30
The SG_Sessions job lists sessions and logged on users from all targeted hosts. These active
sessions and logged on users may have their hashes stored in memory on the target machine, which
-could be leveraged in a Pass the Hash attack.
+could be used in a Pass the Hash attack.
## Queries for the SG_Sessions Job
diff --git a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/collection/overview.md b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/collection/overview.md
index 4e6e8431a4..2c5b5a9ba8 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/collection/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/collection/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 10
# Collection Job Group
The Collection job group collects group policy settings, local users, and local group membership
-information from Windows servers which will be further analyzed to provide insight into privileged
-users within the environment.
+information from Windows servers. It further analyzes this information to provide insight into
+privileged users within the environment.
diff --git a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/collection/sg_localmembership.md b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/collection/sg_localmembership.md
index fc51e9f1d9..48ffe4941f 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/collection/sg_localmembership.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/collection/sg_localmembership.md
@@ -29,7 +29,7 @@ Navigate to the **Windows** > **Privileged Accounts** > **Logon Rights** > **Col
**SG_LocalMembership** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/collection/sg_localusers.md b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/collection/sg_localusers.md
index 5f33fba205..c51325a14c 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/collection/sg_localusers.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/collection/sg_localusers.md
@@ -29,7 +29,7 @@ Navigate to the **Windows** > **Privileged Accounts** > **Logon Rights** > **Col
**SG_LocalUsers** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/overview.md b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/overview.md
index 4721bcc951..e742e83e3c 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/overview.md
@@ -13,8 +13,8 @@ The Logon Rights job group collects local policy information and reports on priv
The jobs and job groups in the Logon Rights job group are:
- [Collection Job Group](/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/collection/overview.md) – The jobs within this group collect group policy
- settings, local users, and local group membership from Windows servers which will be further
- analyzed to provide insight into privileged users within the environment
+ settings, local users, and local group membership from Windows servers. This group further
+ analyzes the data to provide insight into privileged users within the environment
- [SG_AccountPrivileges Job](/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/sg_accountprivileges.md) – This job highlights account privileges
across the audited environment, filtering out default privileges present on Windows servers
- [SG_LocalPolicies Job](/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/sg_localpolicies.md) – This job identifies privileged accounts across the
diff --git a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/sg_accountprivileges.md b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/sg_accountprivileges.md
index b47293fb0c..8d17703ac4 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/sg_accountprivileges.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/sg_accountprivileges.md
@@ -33,7 +33,7 @@ Navigate to the **Windows** > **Privileged Accounts** > **Logon Rights** >
**SG_AccountPrivileges** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/sg_localpolicies.md b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/sg_localpolicies.md
index 01036274ea..802621b9a7 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/sg_localpolicies.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/logonrights/sg_localpolicies.md
@@ -14,7 +14,7 @@ Navigate to the **Windows** > **Privileged Accounts** > **Logon Rights** > **SG_
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -39,6 +39,6 @@ following pre-configured reports.
| Report | Description | Default Tags | Report Elements |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Local Account Network Access | This report highlights whether or not the **Local accounts** and **Local account and member of Administrators group** principals can be used to access a given host across the network. | None | This report is comprised of two elements: - Stacked Bar Chart – Displays a local accounts access enterprise summary
- Table – Provides local account network access details
|
+| Local Account Network Access | This report highlights whether the **Local accounts** and **Local account and member of Administrators group** principals can access a given host across the network. | None | This report is comprised of two elements: - Stacked Bar Chart – Displays a local accounts access enterprise summary
- Table – Provides local account network access details
|
| Local Security Policies | This report identifies effective local security policy assignments. In particular, **Allow log on locally**, **Log on as a batch job**, **Allow log on through Remote Desktop Services**, and **Log on as a service** are considered. Special attention is paid to policies with a large number of trustee assignments. It displays Largest Policies by Number of Domain User Accounts in a graph format, and Trustee Details in a table format. | GDPR, SOX, HIPAA, PCI-DSS, GLBA, ITAR, FERPA, FISMA, ISO27001 | This report is comprised of three elements: - Stacked Bar Chart – Displays largest policies by number of domain user accounts
- Table – Provides details largest policies by number of domain user accounts
- Table – Provides trustee details
|
| Privileged Accounts | This report highlights user accounts with a large number of rights. | None | This report is comprised of two elements: - Stacked Bar Chart – Displays top trustees by logon rights
- Table – Provides details on all trustees
|
diff --git a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/recommended.md b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/recommended.md
index ff4d781aa5..1c48f99543 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/recommended.md
@@ -9,8 +9,8 @@ sidebar_position: 10
**Dependencies**
- SG_AccountPrivileges – To populate the Local Administrator column, which is hidden by default, the
- SG_LocalAdmins job must be run prior to running this job
-- The **Logon Rights** > **Collection** job group must be run prior to running the SG_LocalPolicies
+ SG_LocalAdmins job must be run before running this job
+- The **Logon Rights** > **Collection** job group must be run before running the SG_LocalPolicies
job
**Targeted Hosts**
@@ -36,7 +36,7 @@ Domain Admin privileges if targeting domain controllers.
- Assign the appropriate target host list under Hosts List Assignment for each job group
**Step 2 –** Prerequisite: Ensure that the .Active Directory Inventory job group has successfully
-run prior to running this job group.
+run before running this job group.
**Step 3 –** Schedule the Privileged Accounts job group or the individual job groups within the
Privleged Accounts job group to run as desired.
diff --git a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/sg_serviceaccounts.md b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/sg_serviceaccounts.md
index 03b0f86063..915cc5e9a2 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/sg_serviceaccounts.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/privilegedaccounts/sg_serviceaccounts.md
@@ -37,7 +37,7 @@ Navigate to the **Jobs** > **Windows** > **Privileged Accounts** > **Service Acc
**SG_ServiceAccounts** > **Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/recommended.md b/docs/accessanalyzer/12.0/solutions/windows/recommended.md
index 70696e9fb0..8697a0a535 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/recommended.md
@@ -8,7 +8,7 @@ sidebar_position: 10
**Dependencies**
-The .Active Directory Inventory job group needs to be executed prior to running the Windows
+The .Active Directory Inventory job group needs to be executed before running the Windows
Solution.
See individual sub-groups and jobs for the dependencies.
diff --git a/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/overview.md b/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/overview.md
index 7782f02abd..fb170b3aa4 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/overview.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# OpenPortScan Job Group
-The OpenPortScan job group reveals all open ports along with the associated executable on the
-targeted systems leveraging the jobs within this group. This is accomplished through remotely
-executing a netstat command on the target hosts and collecting the results for reporting.
+The OpenPortScan job group uses the jobs within this group to reveal all open ports along with
+the associated executable on the targeted systems. This is accomplished through remotely executing a
+netstat command on the target hosts and collecting the results for reporting.
diff --git a/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/remoteopenport.md b/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/remoteopenport.md
index 4e135604fa..127887c3c7 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/remoteopenport.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/remoteopenport.md
@@ -31,7 +31,7 @@ Navigate to the **Windows** > **Security Utilities** > **OpenPortScan** > **Remo
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/retrievenetstat.md b/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/retrievenetstat.md
index 0e12a759c8..8a3c514d66 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/retrievenetstat.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/retrievenetstat.md
@@ -31,7 +31,7 @@ Navigate to the **Windows** > **Security Utilities** > **OpenPortScan** > **Retr
**Configure** node and select **Analysis** to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
@@ -43,7 +43,7 @@ The default analysis tasks are:
- **1. NETSTAT Result** – Creates the SA_RetrieveNetstat_NETSTAT table accessible under the job’s
Results node
-In addition to the tables and views created by the analysis tasks, the EX_DeliveryTimes job produces
+In addition to the tables and views created by the analysis tasks, the RetrieveNetstat job produces
the following pre-configured report.
| Report | Description | Default Tags | Report Elements |
diff --git a/docs/accessanalyzer/12.0/solutions/windows/securityutilities/overview.md b/docs/accessanalyzer/12.0/solutions/windows/securityutilities/overview.md
index 8df9342680..fbc18d296b 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/securityutilities/overview.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/securityutilities/overview.md
@@ -14,9 +14,9 @@ and collects the results for reporting.
The jobs and job groups in the Security Utilities job group are:
-- [OpenPortScan Job Group](/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/overview.md) – Reveals all open ports along with the
- associated executable on the targeted systems leveraging the jobs within this group. This is
- accomplished through remotely executing a netstat command on the target hosts and collecting the
- results for reporting.
+- [OpenPortScan Job Group](/docs/accessanalyzer/12.0/solutions/windows/securityutilities/openportscan/overview.md) – Uses the jobs within this group to reveal all
+ open ports along with the associated executable on the targeted systems. This is accomplished
+ through remotely executing a netstat command on the target hosts and collecting the results for
+ reporting.
- [SG_PowerShellCommands Job](/docs/accessanalyzer/12.0/solutions/windows/securityutilities/sg_powershellcommands.md) – This job highlights instances where
suspicious PowerShell commands have been found in a host’s PowerShell log
diff --git a/docs/accessanalyzer/12.0/solutions/windows/securityutilities/recommended.md b/docs/accessanalyzer/12.0/solutions/windows/securityutilities/recommended.md
index 53cdc89888..f38d0e9d7d 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/securityutilities/recommended.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/securityutilities/recommended.md
@@ -8,12 +8,12 @@ sidebar_position: 10
**Dependencies**
-The RemoteOpenPort job must be must be successfully run prior to running the RetrieveNetstat job.
+The RemoteOpenPort job must be must be successfully run before running the RetrieveNetstat job.
**Targeted Hosts**
- OpenPortScan Job Group – There is no assigned host list for this job group. Configure a host list
- with any desired systems to be audited prior to running this job group. Both jobs in the
+ with any desired systems to be audited before running this job group. Both jobs in the
OpenPortScan job group need to be assigned the same target host list.
- SG_PowerShellCommands – All Windows Servers (No DCs)
@@ -30,7 +30,7 @@ This job group can be scheduled to run as desired.
**Step 1 –** Ensure that the configured Connection Profile has local administrator privileges and
Domain Admin privileges if targeting domain controllers.
-**Step 2 –** Configure target hosts prior to running this job group.
+**Step 2 –** Configure target hosts before running this job group.
**Step 3 –** Remotely execute a netstat command on the target hosts.
diff --git a/docs/accessanalyzer/12.0/solutions/windows/securityutilities/sg_powershellcommands.md b/docs/accessanalyzer/12.0/solutions/windows/securityutilities/sg_powershellcommands.md
index 596b6a1202..278823d683 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/securityutilities/sg_powershellcommands.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/securityutilities/sg_powershellcommands.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# SG_PowerShellCommands Job
-The SG_PowerShellCommands job lists suspicious PowerShell commands on all targeted hosts. The list
-of commands considered can be customized by configuring the Check PowerShell Log query.
+The SG_PowerShellCommands job lists suspicious PowerShell commands on all targeted hosts. You can
+customize the list of commands considered by configuring the Check PowerShell Log query.
## Queries for the SG_PowerShellCommands Job
@@ -25,7 +25,7 @@ The queries for the SG_PowerShellCommands job are:
- Check PowerShell log – Checks the PowerShell log
- - (Optional) This query can be configured. See the
+ - (Optional) You can configure this query. See the
[Configure the Check PowerShell log Query](#configure-the-check-powershell-log-query) topic
for additional information.
@@ -33,8 +33,8 @@ The queries for the SG_PowerShellCommands job are:
### Configure the Check PowerShell log Query
-The Check PowerShell log query has been preconfigured to run with the default settings. However, the
-new criteria can optionally be added on the Criteria page in the Smart Log Data Collector Wizard.
+The Check PowerShell log query has been preconfigured to run with the default settings. However, you
+can optionally add new criteria on the Criteria page in the Smart Log Data Collector Wizard.
**Step 1 –** Navigate to the **Jobs** > **Windows** > **Security Utilities** >
**SG_PowerShellCommands** > **Configure** node and select **Queries**. Select the **Check PowerShell
@@ -53,7 +53,7 @@ is accessible.
**Step 5 –** On the Criteria page, click the **press the button to add a new condition** box.
-**Step 6 –** Enter the desired conditions.
+**Step 6 –** Enter the conditions you want.
**Step 7 –** Click **Next** to navigate to the Summary page and click **Finish**.
@@ -65,7 +65,7 @@ View the analysis tasks by navigating to the **Windows** > **Security Utilities*
**SG_PowerShellCommands** > **Configure** node and selecting **Analysis**.
:::warning
-Do not modify or deselect the selected analysis tasks. The analysis tasks are
+Don't modify or deselect the selected analysis tasks. The analysis tasks are
preconfigured for this job.
:::
@@ -87,7 +87,7 @@ The optional analysis tasks is:
[Configure the Notify on Suspicious Commands Analysis Task](#configure-the-notify-on-suspicious-commands-analysis-task)
topic for additional information.
-In addition to the tables and views created by the analysis tasks, the EX_DeliveryTimes job produces
+In addition to the tables and views created by the analysis tasks, the SG_PowerShellCommands job produces
the following pre-configured report.
| Report | Description | Default Tags | Report Elements |
@@ -97,7 +97,7 @@ the following pre-configured report.
### Configure the Notify on Suspicious Commands Analysis Task
-Follow these steps to configure the notification analysis task.
+To configure the notification analysis task:
**Step 1 –** Navigate to the **Jobs** > **Windows** > **Security Utilities** >
**SG_PowerShellCommands** > **Configure** node and select **Analysis**.
@@ -107,14 +107,14 @@ task and click **Analysis Configuration**. The Notification Data Analysis Module
-**Step 3 –** Use the **Next** button to navigate to the SMTP page. Do not make changes to the
+**Step 3 –** Use the **Next** button to navigate to the SMTP page. Don't make changes to the
preceding pages.
**Step 4 –** In the Recipients section, provide the email addresses or distribution lists (fully
-qualified address) for those who are to receive this notification. Multiple addresses can be
-provided. You can use the following options:
+qualified address) for those who are to receive this notification. You can provide multiple
+addresses. You can use the following options:
- Add – Add an email address to the E-mail field
- Remove – Remove an email address from the Recipients list
@@ -123,12 +123,12 @@ provided. You can use the following options:
-**Step 5 –** In the Message section, edit the **Subject**. It is not recommended to remove any
-parameters. Then, customize the email content in the textbox to provide an explanation of the
-notification to the recipients.
+**Step 5 –** In the Message section, edit the **Subject**. Don't remove any parameters. Then,
+customize the email content in the textbox to provide an explanation of the notification to the
+recipients.
**Step 6 –** To save these configuration changes, use the **Next** to navigate to the Summary page.
-Do not make changes to any other pages. Click **Finish**. The Notification Data Analysis Module
+Don't make changes to any other pages. Click **Finish**. The Notification Data Analysis Module
window closes.
**Step 7 –** This notification analysis task is now configured to send emails. In the Analysis
diff --git a/docs/accessanalyzer/12.0/solutions/windows/sg_securityassessment.md b/docs/accessanalyzer/12.0/solutions/windows/sg_securityassessment.md
index f3054a90b5..015582e4c0 100644
--- a/docs/accessanalyzer/12.0/solutions/windows/sg_securityassessment.md
+++ b/docs/accessanalyzer/12.0/solutions/windows/sg_securityassessment.md
@@ -6,10 +6,10 @@ sidebar_position: 70
# SG_SecurityAssessment Job
-The SG_SecurityAssessment job performs checks against Windows security best practices in order to
+The SG_SecurityAssessment job performs checks against Windows security best practices to
proactively identify critical security configurations that leave the environment vulnerable to
attack. The result is a report which provides a listing of findings by severity and category with
-corresponding details that can be used to prioritize and remediate security issues.
+corresponding details you can use to prioritize and remediate security issues.
@@ -64,7 +64,7 @@ Navigate to the **Windows** > **SG_SecurityAssessment** > **Configure** node and
to view the analysis tasks.
:::warning
-Do not modify or deselect the selected analysis task. The analysis task is
+Don't modify or deselect the selected analysis task. The analysis task is
preconfigured for this job.
:::
diff --git a/docs/accessanalyzer/2601/configurations/application-settings.md b/docs/accessanalyzer/2601/configurations/application-settings.md
index b52fc75ff3..2fb8eb5235 100644
--- a/docs/accessanalyzer/2601/configurations/application-settings.md
+++ b/docs/accessanalyzer/2601/configurations/application-settings.md
@@ -19,7 +19,7 @@ This page is available to users with the **Administrator** role only.
| **Feature Flags** | Enable or disable product features and integrations |
| **Scanning** | Execution history retention for scans and identity syncs |
| **File Scanning** | File size limits and excluded extensions for SMB and SharePoint scans |
-| **Activity Monitor** | TCP listener behavior and enrollment token for NAM agent connections |
+| **Activity Monitor** | TCP listener behavior and enrollment token for Netwrix Activity Monitor (NAM) agent connections |
| **Branding** | Company name and support email displayed in the application |
## Feature Flags
@@ -31,7 +31,7 @@ Feature flags enable or disable specific product capabilities. Changes take effe
| **MIP Labeling** | Enabled | Enables Microsoft Information Protection (MIP) sensitivity label management for SMB file shares and SharePoint Online. When disabled, the label handling options on the Sensitive Data page are hidden and no labels are applied to or read from files during scans. |
:::note
-Disabling MIP Labeling does not remove existing labels from files. It stops Access Analyzer from applying or updating labels in future scans.
+Disabling MIP Labeling doesn't remove existing labels from files. It stops Access Analyzer from applying or updating labels in future scans.
:::
## File Scanning
@@ -39,7 +39,7 @@ Disabling MIP Labeling does not remove existing labels from files. It stops Acce
These settings control which files are included in content classification during sensitive data scans. Adjusting them can reduce scan duration in environments with large binary or media files.
:::note
-File metadata — name, size, permissions, and owner — is always collected regardless of file size or extension settings. These limits apply only to content classification during sensitive data scans.
+Access Analyzer always collects file metadata — name, size, permissions, and owner — regardless of file size or extension settings. These limits apply only to content classification during sensitive data scans.
:::
### SMB / CIFS
@@ -71,7 +71,7 @@ Reducing retention frees database storage. Increasing it extends the history ava
## Activity Monitor
-The Activity Monitor category contains settings for the built-in TCP listener and the enrollment token used when connecting Netwrix Activity Monitor (NAM) agents to Access Analyzer.
+The Activity Monitor category contains settings for the built-in TCP listener and the enrollment token used when connecting NAM agents to Access Analyzer.
### Enrollment Token
@@ -101,6 +101,6 @@ The remaining settings in the Activity Monitor category control TCP listener beh
## Resetting and cache behavior
-**Resetting to default:** Each setting has a reset action that restores the factory default value. Resetting one setting does not affect any other settings.
+**Resetting to default:** Each setting has a reset action that restores the factory default value. Resetting one setting doesn't affect any other settings.
-**Cache:** Application Settings are cached for up to 5 minutes. Changes take effect immediately on the instance that applied them. Other running instances pick up the change within 5 minutes. To force an immediate refresh across all instances, click **Refresh Cache** at the top of the page.
+**Cache:** Access Analyzer caches Application Settings for up to 5 minutes. Changes take effect immediately on the instance that applied them. Other running instances pick up the change within 5 minutes. To force an immediate refresh across all instances, click **Refresh Cache** at the top of the page.
diff --git a/docs/accessanalyzer/2601/configurations/logs.md b/docs/accessanalyzer/2601/configurations/logs.md
index fe3890fab4..f093db1b9b 100644
--- a/docs/accessanalyzer/2601/configurations/logs.md
+++ b/docs/accessanalyzer/2601/configurations/logs.md
@@ -6,7 +6,7 @@ sidebar_position: 90
# System Logs
-The System Logs page displays application-wide log entries generated by Access Analyzer services. Use it to monitor activity, investigate scan failures, and collect diagnostic information for support.
+The System Logs page displays application-wide log entries that Access Analyzer services generate. Use it to monitor activity, investigate scan failures, and collect diagnostic information for support.
Navigate to **Configuration** > **System Logs** to open the page.
@@ -24,7 +24,7 @@ Each log entry contains the following fields.
## Filter logs
-The toolbar above the log table provides five independent filters. All active filters are applied together — only entries matching all conditions are shown. Filter state is preserved in the page URL, so you can bookmark or share a filtered view.
+The toolbar above the log table provides five independent filters. All active filters combine — the table shows only entries matching all conditions. The page URL preserves filter state, so you can bookmark or share a filtered view.
**Search**
@@ -43,7 +43,7 @@ Select a severity level to show only entries at that level. The default shows al
**Component**
-Select one or more components to show entries from those services only. The component list is populated from services that have generated logs.
+Select one or more components to show entries from those services only. The component list includes services that have generated logs.
**Source**
@@ -55,7 +55,7 @@ Use the **From** and **To** fields to restrict entries to a specific time window
## Sort and paginate
-The log table is sorted by timestamp, newest first by default. Click the **Timestamp** column header to reverse the sort order.
+Access Analyzer sorts the log table by timestamp, newest first by default. Click the **Timestamp** column header to reverse the sort order.
Use the rows-per-page control to display 10, 25, 50, or 100 entries per page.
@@ -67,7 +67,7 @@ To export log entries for offline review or to provide to support:
2. Click the **Download** button in the toolbar.
3. Select **JSON** or **CSV** from the dropdown.
-The export file is named `system-logs-{timestamp}` and reflects all currently active filters. Exports are limited to 10,000 entries.
+Access Analyzer names the export file `system-logs-{timestamp}`; the file reflects all active filters. Access Analyzer limits exports to 10,000 entries.
CSV exports include the following columns: Timestamp, Level, Message, Trace ID, Span ID, and Attributes.
@@ -75,7 +75,7 @@ CSV exports include the following columns: Timestamp, Level, Message, Trace ID,
### Investigate a scan failure
-When a scan does not complete as expected:
+When a scan doesn't complete as expected:
1. Set the **Source** filter to the data source the scan was running against.
2. Set the **Level** filter to **Error**.
@@ -97,7 +97,7 @@ Use this approach to identify what was happening in the system around the time o
1. Open the **Component** dropdown.
2. Select the service you want to focus on.
-Multiple components can be selected at the same time to compare activity across services.
+You can select multiple components at the same time to compare activity across services.
### Collect logs for a support case
diff --git a/docs/accessanalyzer/2601/configurations/sensitive-data.md b/docs/accessanalyzer/2601/configurations/sensitive-data.md
index 3cced196f6..ccf5345e5f 100644
--- a/docs/accessanalyzer/2601/configurations/sensitive-data.md
+++ b/docs/accessanalyzer/2601/configurations/sensitive-data.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Sensitive Data
-The Sensitive Data configuration page defines which types of sensitive content Access Analyzer identifies during scans, whether to run optical character recognition (OCR) on images, and how Microsoft Information Protection (MIP) sensitivity labels are applied to matching files. These settings apply globally and serve as the default for all sensitive data scans.
+The Sensitive Data configuration page defines which types of sensitive content Access Analyzer identifies during scans, whether to run optical character recognition (OCR) on images, and how Access Analyzer applies Microsoft Information Protection (MIP) sensitivity labels to matching files. These settings apply globally and serve as the default for all sensitive data scans.
Navigate to **Configuration** > **Sensitive Data** to view and update the configuration.
@@ -17,7 +17,7 @@ The page has two sections:
## MIP configuration
-The MIP configuration section connects Access Analyzer to a Microsoft Entra ID tenant. When a tenant is connected, Access Analyzer retrieves the sensitivity labels defined in your organization's MIP policy and makes them available for mapping in the Sensitive Data Types table.
+The MIP configuration section connects Access Analyzer to a Microsoft Entra ID tenant. After you connect a tenant, Access Analyzer retrieves the sensitivity labels defined in your organization's MIP policy and makes them available for mapping in the Sensitive Data Types table.
### Select a tenant
@@ -98,7 +98,7 @@ You can assign a MIP label to each enabled data type. When Access Analyzer finds
4. Click **Save Configuration**.
:::note
-Enabling a data type and assigning a label are independent. A data type with no label assigned is still detected during scans — Access Analyzer identifies matching files but doesn't apply a MIP label to them.
+Enabling a data type and assigning a label are independent. Even without an assigned label, Access Analyzer still detects the data type during scans — it identifies matching files but doesn't apply a MIP label to them.
:::
## OCR
@@ -117,11 +117,11 @@ The **Label Settings** drawer controls whether Access Analyzer writes MIP sensit
These settings apply globally and can be overridden per-scan in the scan configuration.
:::note
-Label write-back applies to **File Server and SharePoint Online sensitive data scans only**. Entra ID and Active Directory scans do not support label application.
+Label write-back applies to **File Server and SharePoint Online sensitive data scans only**. Entra ID and Active Directory scans don't support label application.
:::
:::note
-Label write-back only occurs when **both** conditions are met: a MIP label is mapped to the detected data type in the Sensitive Data Types table, **and** the relevant option below is enabled. All options are off by default — by default, Access Analyzer detects and classifies files but does not write any labels to files.
+Label write-back only occurs when you meet **both** conditions: you map a MIP label to the detected data type in the Sensitive Data Types table, **and** you enable the relevant option in [Options](#options). All options are off by default — by default, Access Analyzer detects and classifies files but doesn't write any labels to files.
:::
### Options
@@ -130,10 +130,10 @@ Label write-back only occurs when **both** conditions are met: a MIP label is ma
When enabled, Access Analyzer removes the MIP label from a file if a subsequent scan finds the file no longer matches any enabled sensitive data type. Off by default.
**Allow overwriting existing labels**
-When enabled, Access Analyzer applies the mapped label to files that already have a MIP label assigned. When disabled, files that already carry any MIP label are skipped — only unlabeled files receive a label. Off by default.
+When enabled, Access Analyzer applies the mapped label to files that already have a MIP label assigned. When disabled, Access Analyzer skips files that already carry any MIP label — only unlabeled files receive a label. Off by default.
- **Allow downgrading labels** *(requires Allow overwriting existing labels to be on)*
- When enabled, Access Analyzer can replace a higher-priority label with a lower-priority one (for example, replacing "Confidential" with "General"). When disabled, only upgrades or equal-priority replacements are applied. This option is unavailable when **Allow overwriting existing labels** is off. Off by default.
+ When enabled, Access Analyzer can replace a higher-priority label with a lower-priority one (for example, replacing "Confidential" with "General"). When disabled, Access Analyzer applies only upgrades or equal-priority replacements. This option is unavailable when **Allow overwriting existing labels** is off. Off by default.
To configure label handling:
diff --git a/docs/accessanalyzer/2601/configurations/service-accounts/client-id-certificate.md b/docs/accessanalyzer/2601/configurations/service-accounts/client-id-certificate.md
index cbc7eded42..123216bd34 100644
--- a/docs/accessanalyzer/2601/configurations/service-accounts/client-id-certificate.md
+++ b/docs/accessanalyzer/2601/configurations/service-accounts/client-id-certificate.md
@@ -8,14 +8,14 @@ sidebar_position: 4
The Client ID/Certificate credential type authenticates with SharePoint Online using certificate-based authentication. Use this credential type when configuring SharePoint Online source groups.
-This requires a registered application in your Entra ID tenant. The certificate itself is generated by the source group wizard — you don't create or upload it here.
+This requires a registered application in your Entra ID tenant. The source group wizard generates the certificate itself — you don't create or upload it here.
## Create a Client ID/Certificate service account
1. Navigate to **Configuration** > **Service Accounts**.
2. Click **Add Service Account**.
3. In the **Name** field, enter a descriptive name for this service account.
-4. From the **Service account type** drop-down, select **Client ID/Certificate**.
+4. From the **Service account type** dropdown, select **Client ID/Certificate**.
@@ -33,8 +33,8 @@ This requires a registered application in your Entra ID tenant. The certificate
## Certificate
-The certificate is not entered in the service account form. When you set up a SharePoint Online source group, the wizard includes a **Generate and Download Certificate** step that creates the certificate and downloads it to your machine. You then upload the certificate to your registered Entra ID application in the Azure portal before testing the connection.
+You don't enter the certificate in the service account form. When you set up a SharePoint Online source group, the wizard includes a **Generate and Download Certificate** step that creates the certificate and downloads it to your machine. You then upload the certificate to your registered Entra ID application in the Azure portal before testing the connection.
-If you update the service account on an existing source group, the new account's certificate must be uploaded to the registered app before saving.
+If you update the service account on an existing source group, you must upload the new account's certificate to the registered app before saving.
For steps to register the application and upload the certificate, see [SharePoint Online Connector Requirements](../../connectors/sharepoint-online/overview.md).
diff --git a/docs/accessanalyzer/2601/configurations/service-accounts/client-id-secret.md b/docs/accessanalyzer/2601/configurations/service-accounts/client-id-secret.md
index ed14b2d54a..254fd2415c 100644
--- a/docs/accessanalyzer/2601/configurations/service-accounts/client-id-secret.md
+++ b/docs/accessanalyzer/2601/configurations/service-accounts/client-id-secret.md
@@ -8,14 +8,14 @@ sidebar_position: 3
The Client ID/Secret credential type authenticates with Microsoft Entra ID via the Microsoft Graph API. Use this credential type when configuring Entra ID source groups.
-This requires a registered application in your Entra ID tenant with the appropriate API permissions granted.
+This requires a registered application in your Entra ID tenant with the appropriate API permissions.
## Create a Client ID/Secret service account
1. Navigate to **Configuration** > **Service Accounts**.
2. Click **Add Service Account**.
3. In the **Name** field, enter a descriptive name for this service account.
-4. From the **Service account type** drop-down, select **Client ID/Secret**.
+4. From the **Service account type** dropdown, select **Client ID/Secret**.
diff --git a/docs/accessanalyzer/2601/configurations/service-accounts/overview.md b/docs/accessanalyzer/2601/configurations/service-accounts/overview.md
index ac39ff44b0..d8d8a0d429 100644
--- a/docs/accessanalyzer/2601/configurations/service-accounts/overview.md
+++ b/docs/accessanalyzer/2601/configurations/service-accounts/overview.md
@@ -31,6 +31,6 @@ You can create a service account in two ways:
## Editing service accounts
-Credential fields — passwords and client secrets — are never pre-populated when you edit an existing service account. You must re-enter them each time you save changes.
+Access Analyzer never pre-populates credential fields — passwords and client secrets — when you edit an existing service account. You must re-enter them each time you save changes.
Updating the service account on an existing source group replaces the credentials used for all future scans in that source group. Ensure the replacement account has the required permissions before saving.
diff --git a/docs/accessanalyzer/2601/configurations/service-accounts/ssh-username-key.md b/docs/accessanalyzer/2601/configurations/service-accounts/ssh-username-key.md
index 52824412a0..07bd38a7cd 100644
--- a/docs/accessanalyzer/2601/configurations/service-accounts/ssh-username-key.md
+++ b/docs/accessanalyzer/2601/configurations/service-accounts/ssh-username-key.md
@@ -13,7 +13,7 @@ The SSH Username/Key credential type authenticates using an SSH username and pri
1. Navigate to **Configuration** > **Service Accounts**.
2. Click **Add Service Account**.
3. In the **Name** field, enter a descriptive name for this service account.
-4. From the **Service account type** drop-down, select **SSH Username/Key**.
+4. From the **Service account type** dropdown, select **SSH Username/Key**.
diff --git a/docs/accessanalyzer/2601/configurations/service-accounts/username-password.md b/docs/accessanalyzer/2601/configurations/service-accounts/username-password.md
index 669b47733c..75b349dc07 100644
--- a/docs/accessanalyzer/2601/configurations/service-accounts/username-password.md
+++ b/docs/accessanalyzer/2601/configurations/service-accounts/username-password.md
@@ -6,14 +6,14 @@ sidebar_position: 2
# Username and Password
-The Username and Password credential type is used by Active Directory and file server source groups. Both require a domain account whose credentials Access Analyzer uses to connect and authenticate during scans.
+Active Directory and file server source groups use the Username and Password credential type. Both require a domain account whose credentials Access Analyzer uses to connect and authenticate during scans.
## Create a Username/Password service account
1. Navigate to **Configuration** > **Service Accounts**.
2. Click **Add Service Account**.
3. In the **Name** field, enter a descriptive name for this service account.
-4. From the **Service account type** drop-down, select **Username/Password**.
+4. From the **Service account type** dropdown, select **Username/Password**.
diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scan-executions.md b/docs/accessanalyzer/2601/configurations/source-groups/scan-executions.md
index 25364459e3..cb16302bb1 100644
--- a/docs/accessanalyzer/2601/configurations/source-groups/scan-executions.md
+++ b/docs/accessanalyzer/2601/configurations/source-groups/scan-executions.md
@@ -6,7 +6,7 @@ sidebar_position: 3
# Scan Executions
-A scan execution is a single run of a scan at a specific point in time. Each time Access Analyzer runs a scan — whether triggered by a schedule or manually — it creates a new scan execution record. Execution history is retained per source so you can review past run outcomes.
+A scan execution is a single run of a scan at a specific point in time. Each time Access Analyzer runs a scan — whether triggered by a schedule or manually — it creates a new scan execution record. Access Analyzer retains execution history per source so you can review past run outcomes.
Scan executions are distinct from scan configurations. The [scan configuration](scans.md) defines what to collect and when. The scan execution records what happened during a specific run.
@@ -24,24 +24,24 @@ Scan executions are distinct from scan configurations. The [scan configuration](
| **Completed** | The execution finished successfully. |
| **Stopped** | The execution was manually stopped before completing. Partial results may have been collected. |
| **Cancelled** | The execution was cancelled before it started or early in the run. No results were collected. |
-| **Failed** | The execution encountered an error and did not complete. Check the execution log for details. |
+| **Failed** | The execution encountered an error and didn't complete. Check the execution log for details. |
## Source group scan status
-The source groups list displays an aggregate scan status for each group. This is computed from the most recent scan execution across all sources in the group, using the following priority order:
+The source groups list displays an aggregate scan status for each group. Access Analyzer computes this from the most recent scan execution across all sources in the group, using the following priority order:
1. **Paused** — One or more sources has a paused execution, and none are running.
2. **Running** — One or more sources has an execution in a pending, running, pausing, resuming, stopping, or post-processing state.
3. **Failed** — One or more sources has a failed execution, and none are running or paused.
4. **Completed** — All sources have completed their most recent execution successfully.
-5. **Completed with errors** — One or more sources has a stopped or cancelled execution, and none meet the criteria above.
+5. **Completed with errors** — One or more sources has a stopped or cancelled execution, and none meet the preceding criteria.
6. **Not run yet** — No scan executions exist for any source in the group.
This means a group shows **Running** even if only one source is actively scanning, and it shows **Failed** only when no scans are still in progress.
## Blocked operations during active executions
-Several operations are blocked while a source has an execution in an active state (pending, running, pausing, paused, resuming, stopping, or post-processing):
+Access Analyzer blocks several operations while a source has an execution in an active state (pending, running, pausing, paused, resuming, stopping, or post-processing):
- **Deleting a source group** — Stop all active scans before deleting the group.
- **Removing a source from a group** — Stop the source's active scan before removing it.
diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scanners/best-practices.md b/docs/accessanalyzer/2601/configurations/source-groups/scanners/best-practices.md
index deee012cd1..8aab2b0e06 100644
--- a/docs/accessanalyzer/2601/configurations/source-groups/scanners/best-practices.md
+++ b/docs/accessanalyzer/2601/configurations/source-groups/scanners/best-practices.md
@@ -18,11 +18,11 @@ Common labeling patterns:
| Route by geographic region | `region=us-east`, `region=eu-west` |
| Dedicate scanners to high-sensitivity source groups | `tier=restricted` |
-Define a labeling scheme before deploying scanners and apply it consistently. Labels assigned to a source group are used by all scan executions in that group — you don't need to set them per source.
+Define a labeling scheme before deploying scanners and apply it consistently. All scan executions in a source group use the labels assigned to that group — you don't need to set them per source.
### Label matching behavior
-When a source group has multiple labels configured, a scan is routed to any scanner that matches **at least one** of those label pairs — not all of them. Design your label scheme with this in mind: a scanner carrying `region=us-east` will receive jobs from a source group labeled `region=us-east, tier=restricted` even if the scanner does not carry the `tier=restricted` label.
+When a source group has multiple labels configured, Access Analyzer routes a scan to any scanner that matches **at least one** of those label pairs — not all of them. Design your label scheme with this in mind: a scanner carrying `region=us-east` will receive jobs from a source group labeled `region=us-east, tier=restricted` even if the scanner doesn't carry the `tier=restricted` label.
For strict isolation, use a single label per source group or ensure scanners are labeled precisely to match only the intended groups.
@@ -35,15 +35,15 @@ Label keys and values entered in the Deploy Scanner wizard must follow these rul
| Key | Letters, digits, hyphens | 53 characters |
| Value | Letters, digits, hyphens, underscores, dots | 63 characters |
-Both key and value must start with a letter or digit. Labels are stored with a `dspm.netwrix.com/scanner-` prefix internally — you do not need to include this prefix when entering labels in the wizard.
+Both key and value must start with a letter or digit. Access Analyzer stores labels with a `dspm.netwrix.com/scanner-` prefix internally — you don't need to include this prefix when entering labels in the wizard.
:::note
-The label `scanner-default` is reserved for the built-in system scanner and can't be applied to custom scanners.
+Access Analyzer reserves the label `scanner-default` for the built-in system scanner; you can't apply it to custom scanners.
:::
## Plan for scanner redundancy
-Assign the same label to multiple scanners that cover the same environment. Scanners sharing a label form a pool — when a scan job is dispatched, Access Analyzer routes it to any available scanner in the pool. If one scanner is offline, unhealthy, or busy, the job routes to another scanner carrying the same label automatically.
+Assign the same label to multiple scanners that cover the same environment. Scanners sharing a label form a pool, and Access Analyzer routes each scan job to any available scanner in the pool. If one scanner is offline, unhealthy, or busy, the job routes to another scanner carrying the same label automatically.
A single scanner per label is a single point of failure. For production environments, deploy at least two scanners per label. This also distributes scan load across the pool when multiple source groups target the same label simultaneously.
@@ -63,7 +63,7 @@ A safe approach is to increase by 2–3 at a time and monitor scan completion ti
## Monitor scanner health
-Check the Scanners page regularly to review scanner health status. A scanner in Warning state is under resource pressure — disk, memory, or CPU — and scan performance may be degraded. A scanner in Error state has reported health issues and needs investigation before running additional scans.
+Check the Scanners page regularly to review scanner health status. A scanner in Warning state is under resource pressure — disk, memory, or CPU — and scan performance may degrade. A scanner in Error state has reported health issues and needs investigation before running additional scans.
Common causes of Warning and Error states:
diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scanners/deploy-scanner.md b/docs/accessanalyzer/2601/configurations/source-groups/scanners/deploy-scanner.md
index f01f6eeac3..3838a52a4c 100644
--- a/docs/accessanalyzer/2601/configurations/source-groups/scanners/deploy-scanner.md
+++ b/docs/accessanalyzer/2601/configurations/source-groups/scanners/deploy-scanner.md
@@ -11,7 +11,7 @@ Deploying a scanner registers a remote Linux host as a custom scanner node in Ac
## Before you begin
- Confirm the scanner host meets all [requirements](./requirements.md).
-- Create an **SSH Username / SSH Key** service account in Access Analyzer with access to the scanner host. You can also create it inline during the wizard — see step 7 below.
+- Create an **SSH Username / SSH Key** service account in Access Analyzer with access to the scanner host. You can also create it inline during the wizard — see step 7.
- Have the scanner host's public SSH host key ready. You can retrieve it by running the following command from any machine that can reach the host, replacing `` with the scanner's hostname or IP address:
```bash
@@ -30,15 +30,15 @@ Deploying a scanner registers a remote Linux host as a custom scanner node in Ac
6. In the **SSH Port** field, enter the SSH port if your scanner host uses a non-standard port. Defaults to `22` if left blank.
7. In the **Service Account** dropdown, select the SSH Username / SSH Key account that has access to the scanner host.
- - To create a new service account without leaving the wizard, click **+** next to the dropdown. The account type is pre-set to SSH Username / SSH Key. After saving, the new account is automatically selected and all other fields are preserved.
+ - To create a new service account without leaving the wizard, click **+** next to the dropdown. The wizard pre-sets the account type to SSH Username / SSH Key. After saving, it automatically selects the new account and preserves all other fields.
- To edit the selected account, click the pencil icon. The SSH key field is blank in edit mode — you must re-enter the private key before saving.
-8. Under **Labels**, add at least one label. You must add at least one label before the scanner can be deployed — the **Deploy** button remains disabled until a label is applied.
+8. Under **Labels**, add at least one label. You must add at least one label before you can deploy the scanner — the **Deploy** button remains disabled until you apply a label.
- Enter a key and a value, then click **Add**. The label appears as a chip.
- To add additional labels, repeat the process.
- To remove a label, click the **×** on its chip.
- - Label keys and values are automatically normalized to lowercase with spaces converted to hyphens.
+ - Access Analyzer automatically normalizes label keys and values to lowercase and converts spaces to hyphens.
:::tip
Previously used labels appear as chips you can click to pre-fill the key and value fields. This helps you apply consistent labels across multiple scanners.
@@ -52,7 +52,7 @@ Deploying a scanner registers a remote Linux host as a custom scanner node in Ac
Registration runs automatically and typically completes within five minutes. During registration, Access Analyzer:
-1. Runs a preflight check on the scanner host to verify all requirements are met (curl, bash, passwordless sudo, disk space, memory, and CPU).
+1. Runs a preflight check on the scanner host to verify it meets all requirements (curl, bash, passwordless sudo, disk space, memory, and CPU).
2. Downloads and installs k3s (a lightweight Kubernetes distribution) on the scanner host.
3. Joins the scanner host to the Access Analyzer Kubernetes cluster as a worker node.
4. Applies the labels you specified.
@@ -61,7 +61,7 @@ If registration takes longer than five minutes, check network connectivity and c
## After deployment
-The scanner appears immediately in the Scanners table. Its health status shows **Healthy** once the node has fully joined the cluster.
+The scanner appears immediately in the Scanners table. Its health status shows **Healthy** when the node has fully joined the cluster.
To use the scanner, assign it to a source group by selecting **Custom scanner** under **Scanner Location** when setting up or editing a source group, and matching its label. See [Set Up File Server Source Group](../../../gettingstarted/file-servers/set-up-source-group.md) or the equivalent guide for your connector.
diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scanners/manage-scanners.md b/docs/accessanalyzer/2601/configurations/source-groups/scanners/manage-scanners.md
index 57e3b4d3ac..f0461512dd 100644
--- a/docs/accessanalyzer/2601/configurations/source-groups/scanners/manage-scanners.md
+++ b/docs/accessanalyzer/2601/configurations/source-groups/scanners/manage-scanners.md
@@ -30,9 +30,9 @@ Each row in the table represents one registered scanner.
| Healthy | Green | The scanner node is reachable and operating normally |
| Warning | Yellow | The node is reachable but under resource pressure (disk, memory, or CPU) |
| Error | Red | The node is reachable but in an unhealthy state |
-| Offline | Gray | The node is not reachable from the Access Analyzer server |
+| Offline | Gray | The node isn't reachable from the Access Analyzer server |
-Scans may perform poorly on a scanner in Warning state — consider resolving the resource pressure before scheduling large scans. Investigate the scanner host when the status is Error. An Offline scanner cannot run scans — source groups that target it will not execute until the scanner comes back online or a different scanner with the matching label becomes available.
+Scans may perform poorly on a scanner in Warning state — consider resolving the resource pressure before scheduling large scans. Investigate the scanner host when the status is Error. An Offline scanner can't run scans — source groups that target it will not execute until the scanner comes back online or a different scanner with the matching label becomes available.
## Scan status
@@ -63,4 +63,4 @@ To delete a scanner:
2. Click the delete icon on the scanner row.
3. Confirm the deletion.
-A scanner can only be deleted when no scan jobs are running on it. If scans are in progress, wait for them to complete before deleting. The system scanner (built-in scanner on the Access Analyzer server) cannot be deleted.
+You can only delete a scanner when no scan jobs are running on it. If scans are in progress, wait for them to complete before deleting. You can't delete the system scanner (built-in scanner on the Access Analyzer server).
diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scanners/overview.md b/docs/accessanalyzer/2601/configurations/source-groups/scanners/overview.md
index 9b0ec2f071..a3ff3a1650 100644
--- a/docs/accessanalyzer/2601/configurations/source-groups/scanners/overview.md
+++ b/docs/accessanalyzer/2601/configurations/source-groups/scanners/overview.md
@@ -53,9 +53,9 @@ Labels let you:
- Route scans to geographically local scanners (`region=us-east`, `region=eu-west`)
- Dedicate scanners to high-sensitivity source groups (`tier=restricted`)
-At least one label is required on every custom scanner. Multiple scanners can share the same label — when a source group targets a label that multiple scanners carry, any of those scanners can run the job.
+Every custom scanner requires at least one label. Multiple scanners can share the same label — when a source group targets a label that multiple scanners carry, any of those scanners can run the job.
-The system scanner does not use labels. Selecting **System scanner** in a source group always uses the built-in scanner on the Access Analyzer server.
+The system scanner doesn't use labels. Selecting **System scanner** in a source group always uses the built-in scanner on the Access Analyzer server.
## Related pages
diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scanners/requirements.md b/docs/accessanalyzer/2601/configurations/source-groups/scanners/requirements.md
index 841765cb9d..dbb0260d36 100644
--- a/docs/accessanalyzer/2601/configurations/source-groups/scanners/requirements.md
+++ b/docs/accessanalyzer/2601/configurations/source-groups/scanners/requirements.md
@@ -10,7 +10,7 @@ These requirements apply to any Linux host you want to register as a custom scan
## Operating system
-Access Analyzer supports any Linux distribution as a scanner host. Ubuntu 20.04 LTS or later is recommended.
+Access Analyzer supports any Linux distribution as a scanner host. Netwrix recommends Ubuntu 20.04 LTS or later.
Access Analyzer registers the scanner by connecting over SSH and running an automated installation script. The script installs [k3s](https://k3s.io/) — a lightweight Kubernetes distribution — and joins the host to the Access Analyzer cluster as a worker node.
@@ -53,7 +53,7 @@ When you click **Deploy** in the Deploy Scanner wizard, Access Analyzer runs the
| 22 | TCP | Access Analyzer → Scanner | SSH connection during registration only |
| 6443 | TCP | Scanner → Access Analyzer | Kubernetes API — ongoing job dispatch |
-Port 22 is only required during the initial registration. After the scanner is registered, the scanner host connects outbound to the Access Analyzer server on port 6443 to receive and run scan jobs. Port 22 can be restricted or closed after registration is complete.
+Access Analyzer only requires port 22 during the initial registration. After registration completes, the scanner host connects outbound to the Access Analyzer server on port 6443 to receive and run scan jobs. You can restrict or close port 22 after registration completes.
:::note
The SSH port defaults to **22** but is configurable in the Deploy Scanner wizard. If your scanner host runs SSH on a non-standard port, enter it in the **SSH Port** field during deployment.
@@ -61,7 +61,7 @@ The SSH port defaults to **22** but is configurable in the Deploy Scanner wizard
### Internet access
-The registration script downloads the k3s installer from `https://get.k3s.io`. The scanner host must be able to reach this URL **during registration only**. After registration completes, internet access is not required for normal scan operation.
+The registration script downloads the k3s installer from `https://get.k3s.io`. The scanner host must be able to reach this URL **during registration only**. After registration completes, normal scan operation doesn't require internet access.
## Service account
@@ -71,7 +71,7 @@ Scanner deployment requires an **SSH Username / SSH Key** service account in Acc
- Use an **unencrypted** private key in PEM format
:::warning
-Passphrase-protected private keys are not supported. The registration script will fail if the key requires a passphrase. Use a key generated without a passphrase, or strip the passphrase before creating the service account.
+Access Analyzer doesn't support passphrase-protected private keys. The registration script will fail if the key requires a passphrase. Use a key generated without a passphrase, or strip the passphrase before creating the service account.
:::
See [SSH Username / SSH Key](../../service-accounts/ssh-username-key.md) to create this account. You can also create it inline from the Deploy Scanner wizard using the **+** button next to the Service Account field without navigating away.
diff --git a/docs/accessanalyzer/2601/configurations/source-groups/scans.md b/docs/accessanalyzer/2601/configurations/source-groups/scans.md
index 9fcb677e43..e2fd271f85 100644
--- a/docs/accessanalyzer/2601/configurations/source-groups/scans.md
+++ b/docs/accessanalyzer/2601/configurations/source-groups/scans.md
@@ -23,7 +23,7 @@ The scan types available depend on the source type:
Enumerates permissions, folder-level ACLs, sharing links, and access rights across File Server and SharePoint Online sources. Identifies who has access to what across your data sources.
-Access scans include a **concurrent** option that allows multiple file paths or objects within a single source to be scanned in parallel. Enable this when scanning large file servers or SharePoint sites to reduce total scan time.
+Access scans include a **concurrent** option that scans multiple file paths or objects within a single source in parallel. Enable this when scanning large file servers or SharePoint sites to reduce total scan time.
### Sensitive Data Scan
@@ -33,7 +33,7 @@ Sensitive Data Scans include a **concurrent** option that allows classification
### Active Directory Inventory
-Synchronizes users, groups, group memberships, and security-relevant attributes from Active Directory domains. The inventory is used to resolve identity information across all other scan types and to populate the Active Directory dashboard.
+Synchronizes users, groups, group memberships, and security-relevant attributes from Active Directory domains. Access Analyzer uses the inventory to resolve identity information across all other scan types and to populate the Active Directory dashboard.
### Users, Groups and Roles
@@ -43,27 +43,27 @@ Synchronizes users, groups, and role assignments from your Microsoft Entra ID (A
When you create a source group, the setup wizard collects scan parameters on page 3 and creates scan configurations that apply to all sources added to the group. Each scan configuration includes:
-- **Scan type** — the type of scan to run (see [Scan types](#scan-types) above)
+- **Scan type** — the type of scan to run (see [Scan types](#scan-types))
- **Concurrent** — whether to parallelize scanning within a single source (Access Scan and Sensitive Data Scan only)
-- **Scan location** — which scanner handles the scan (see [Scan location](#scan-location) below)
-- **Schedule** — when and how often the scan runs automatically (see [Schedule](#schedule) below)
+- **Scan location** — which scanner handles the scan (see [Scan location](#scan-location))
+- **Schedule** — when and how often the scan runs automatically (see [Schedule](#schedule))
- **Scan parameters** — source-type-specific settings such as scope, depth, and included paths. These vary by connector.
Individual sources can override the group-level scan configuration if their requirements differ from the group default.
## Scan location
-The **Scan location** setting determines which scanner component executes the scan. It is configured per scan type during source group creation.
+The **Scan location** setting determines which scanner component executes the scan. You configure it per scan type during source group creation.
| Location | Description | Applicable Source Types |
| --- | --- | --- |
| **System scanner** | The Access Analyzer service connects directly to the source. This is the default and requires no additional configuration. | Entra ID, SharePoint Online |
| **Scanner label** | Routes the scan to a registered edge scanner pool that matches the specified label. The edge scanner connects to the source on behalf of Access Analyzer. | Active Directory, File Server |
-For Active Directory and File Server source groups, selecting a scanner label routes all scans in that group to the matching edge scanner pool. If no edge scanners are registered with that label, the scan cannot run. See [Scanners](scanners/overview.md) for setup and label management.
+For Active Directory and File Server source groups, selecting a scanner label routes all scans in that group to the matching edge scanner pool. If no edge scanners carry that label, the scan can't run. See [Scanners](scanners/overview.md) for setup and label management.
:::note
-Entra ID and SharePoint Online source groups always use the system scanner. The scan location setting is not configurable for those source types.
+Entra ID and SharePoint Online source groups always use the system scanner. The scan location setting isn't configurable for those source types.
:::
## Schedule
@@ -75,7 +75,7 @@ The schedule determines when a scan runs automatically. You configure the schedu
| Option | Description |
| --- | --- |
| **Run scan now** | Starts the scan immediately when the source group is saved. No recurring schedule is set. |
-| **Run scan at** | Schedules a single one-time run at a specific date and time. The scan does not repeat after that run. |
+| **Run scan at** | Schedules a single one-time run at a specific date and time. The scan doesn't repeat after that run. |
| **Advanced** | Sets a recurring schedule using a cron expression. Use this for daily, weekly, or custom interval schedules. |
### Cron schedule format
@@ -101,8 +101,8 @@ Advanced scheduling uses standard 5-field cron syntax:
| `0 2 1 * *` | Monthly on the 1st at 2:00 AM |
| `0 */6 * * *` | Every 6 hours |
-Schedule times are evaluated in the server's local timezone.
+Access Analyzer evaluates schedule times in the server's local timezone.
:::note
-If no schedule is configured, the scan does not run automatically. Run it manually from the source groups list using the **Run** action.
+If you don't configure a schedule, the scan doesn't run automatically. Run it manually from the source groups list using the **Run** action.
:::
diff --git a/docs/accessanalyzer/2601/configurations/source-groups/source-groups.md b/docs/accessanalyzer/2601/configurations/source-groups/source-groups.md
index 52296d36e7..3a208b6b43 100644
--- a/docs/accessanalyzer/2601/configurations/source-groups/source-groups.md
+++ b/docs/accessanalyzer/2601/configurations/source-groups/source-groups.md
@@ -30,14 +30,14 @@ Use the search field to filter by name. You can sort by any column and filter by
1. Click **Add Source Group**.
2. Enter a **Name** and optional **Description**. Names must be unique (case-insensitive) and between 1 and 255 characters.
-3. Select the **Source Type**. This value is permanent — it can't be changed after the group is created.
+3. Select the **Source Type**. This value is permanent — you can't change it after you create the group.
4. Select or create a **Service Account**. The wizard filters available accounts to those compatible with the selected source type. To create a new account inline, click **+** next to the field.
5. For Active Directory and File Server groups, optionally add **Scanner Labels** to route scans to a specific scanner pool. See [Scanners](scanners/overview.md).
6. Add sources and configure scan parameters. You can also add sources later from the group detail view.
7. Click **Save**.
:::warning
-Changing the source type is not possible after a source group is created. If you need a different source type, create a new source group and delete the original.
+You can't change the source type after you create a source group. If you need a different source type, create a new source group and delete the original.
:::
## Edit a source group
@@ -50,7 +50,7 @@ Changing the source type is not possible after a source group is created. If you
- Status (Active or Inactive)
3. Click **Save**.
-The source type cannot be changed. If you update the service account, the new credentials apply to all future scans in the group — verify the replacement account has the required permissions before saving.
+You can't change the source type. If you update the service account, the new credentials apply to all future scans in the group — verify the replacement account has the required permissions before saving.
## Add sources to a group
@@ -84,7 +84,7 @@ To stop all running and pending scans in a group, click **Stop** in the actions
2. Confirm the deletion.
:::warning
-Deleting a source group permanently deletes all sources it contains. This action can't be undone.
+Deleting a source group permanently deletes all sources it contains. You can't undo this action.
:::
You can't delete a source group while any of its scans are in a pending, running, pausing, paused, resuming, stopping, or post-processing state. Stop all active scans before deleting.
diff --git a/docs/accessanalyzer/2601/configurations/users.md b/docs/accessanalyzer/2601/configurations/users.md
index 440698d7d3..7ceb78f36a 100644
--- a/docs/accessanalyzer/2601/configurations/users.md
+++ b/docs/accessanalyzer/2601/configurations/users.md
@@ -55,7 +55,7 @@ On first login, Access Analyzer prompts you to enroll an authenticator app for M
Keep the bootstrap account active as an emergency recovery account, but don't use it for routine user management. Create at least one named User Admin account during initial setup and use that account for ongoing administration.
:::
-For the full first-login walkthrough, see [Quick Install — Step 5](/docs/accessanalyzer/2601/install/quickinstall#step-6-sign-in).
+For the full first-login walkthrough, see [Quick Install — Step 6](/docs/accessanalyzer/2601/install/quickinstall#step-6-sign-in).
## Recommended initial setup
@@ -63,8 +63,8 @@ After installation, complete the following steps in order before handing the pro
| Step | Action | Notes |
| --- | --- | --- |
-| **1** | Sign in as `admin@dspm.local` | Uses the bootstrap User Admin account. Retrieve the password using the kubectl command above. |
-| **2** | Create at least one named **User Admin** | Provides a dedicated account for user management with no system configuration access. Use this account for ongoing user administration so that Administrator accounts aren't required for routine user changes. |
+| **1** | Sign in as `admin@dspm.local` | Uses the bootstrap User Admin account. Retrieve the password using the kubectl command in [Bootstrap admin account](#bootstrap-admin-account). |
+| **2** | Create at least one named **User Admin** | Provides a dedicated account for user management with no system configuration access. Use this account for ongoing user administration so that routine user changes don't require Administrator accounts. |
| **3** | Create at least one **Administrator** | Grants full access — system configuration and user management. This is typically the person responsible for setting up and maintaining the product. |
| **4** | Create **Viewer** accounts as needed | Optional. Add Viewer accounts for stakeholders who need read-only access to dashboards and reports. |
| **5** | Sign out of the bootstrap account | Do day-to-day work from named accounts. |
@@ -80,7 +80,7 @@ Use this procedure when Access Analyzer manages passwords directly.
1. Click **Add User**.
2. Enter a **Name**. Names must be between 2 and 100 characters.
3. Enter an **Email** address. Email addresses must be unique across all users (case-insensitive).
-4. Select a **Role**: **Administrator**, **User Admin**, or **Viewer**. The default is **Viewer** — the intentionally conservative default. Only assign Administrator or User Admin after confirming the user's responsibilities.
+4. Select a **Role**: **Administrator**, **User Admin**, or **Viewer**. The default is **Viewer**, an intentionally conservative choice. Only assign Administrator or User Admin after confirming the user's responsibilities.
5. Enter a **Password** and confirm it.
6. Click **Create User**.
@@ -96,12 +96,12 @@ Password requirements for local accounts:
### Add a user (Identity Provider)
-When your deployment is configured to use an external Identity Provider, you can pre-provision an account before the user's first sign-in. Access Analyzer creates the account record and links it to the user's IdP identity when they sign in for the first time.
+When you configure your deployment to use an external Identity Provider, you can pre-provision an account before the user's first sign-in. Access Analyzer creates the account record and links it to the user's IdP identity when they sign in for the first time.
1. Click **Add User**.
2. Enter a **Name**. Names must be between 2 and 100 characters.
3. Enter an **Email** address. The email must match the address the user has in your IdP exactly, including case.
-4. Select a **Role**: **Administrator**, **User Admin**, or **Viewer**. The default is **Viewer** — the intentionally conservative default. Only assign Administrator or User Admin after confirming the user's responsibilities.
+4. Select a **Role**: **Administrator**, **User Admin**, or **Viewer**. The default is **Viewer**, an intentionally conservative choice. Only assign Administrator or User Admin after confirming the user's responsibilities.
5. Click **Create User**.
No password is required. The account is ready for the user to sign in through your IdP.
@@ -124,7 +124,7 @@ What you can change depends on the account type:
| Identity Provider — pre-provisioned (hasn't signed in yet) | Name, Email, Role |
| Identity Provider — provisioned (has signed in at least once) | Role only |
-Name and email are locked for provisioned IdP accounts because those values come from the IdP token. To change them, update the user's profile in your IdP.
+Access Analyzer locks name and email for provisioned IdP accounts because those values come from the IdP token. To change them, update the user's profile in your IdP.
## Activate a user
diff --git a/docs/accessanalyzer/2601/connectors/activedirectory.md b/docs/accessanalyzer/2601/connectors/activedirectory.md
index fc76232824..481abb347c 100644
--- a/docs/accessanalyzer/2601/connectors/activedirectory.md
+++ b/docs/accessanalyzer/2601/connectors/activedirectory.md
@@ -45,4 +45,4 @@ Open the following ports on all domain controllers you want to scan:
## Next steps
-Once requirements are met, see [Set Up Active Directory Source Group](../gettingstarted/active-directory/set-up-source-group.md) to configure your first scan.
+After you meet the requirements, see [Set Up Active Directory Source Group](../gettingstarted/active-directory/set-up-source-group.md) to configure your first scan.
diff --git a/docs/accessanalyzer/2601/connectors/entra-id/app-registration-secret.md b/docs/accessanalyzer/2601/connectors/entra-id/app-registration-secret.md
index 8e52193448..998720b323 100644
--- a/docs/accessanalyzer/2601/connectors/entra-id/app-registration-secret.md
+++ b/docs/accessanalyzer/2601/connectors/entra-id/app-registration-secret.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Client Secret Configuration
-Access Analyzer authenticates to Microsoft Entra ID using a client secret. The client secret is generated within your registered Microsoft Entra ID application and provided to Access Analyzer when configuring the Entra ID connector.
+Access Analyzer authenticates to Microsoft Entra ID using a client secret. You generate the client secret within your registered Microsoft Entra ID application and provide it to Access Analyzer when configuring the Entra ID connector.
## Generate a client secret
@@ -25,15 +25,15 @@ Access Analyzer authenticates to Microsoft Entra ID using a client secret. The c
- **Description** — Enter a description for the secret
- **Expires** — Select an expiration period
-7. Click **Add**. The client secret value is displayed in the **Value** column.
+7. Click **Add**. Access Analyzer displays the client secret value in the **Value** column.
:::warning
-Copy the client secret value immediately. Once you navigate away from this page, the value can't be retrieved and you'll need to create a new secret.
+Copy the client secret value immediately. After you navigate away from this page, you can't retrieve the value and you'll need to create a new secret.
:::
## Assign roles to the app
-The registered application must be assigned to the **Global Administrator** role for Entra ID data collection.
+You must assign the registered application to the **Global Administrator** role for Entra ID data collection.
1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/).
@@ -51,4 +51,4 @@ The registered application must be assigned to the **Global Administrator** role
8. Search for and select your registered application.
-9. Click **Add**. The application is listed on the Assignments page.
+9. Click **Add**. Access Analyzer lists the application on the Assignments page.
diff --git a/docs/accessanalyzer/2601/connectors/entra-id/entra-requirements.md b/docs/accessanalyzer/2601/connectors/entra-id/entra-requirements.md
index cd4c6be7bf..aea5e67688 100644
--- a/docs/accessanalyzer/2601/connectors/entra-id/entra-requirements.md
+++ b/docs/accessanalyzer/2601/connectors/entra-id/entra-requirements.md
@@ -9,11 +9,11 @@ sidebar_position: 20
Access Analyzer connects to Microsoft Entra ID through a registered application using OAuth2 client credentials. You must register a dedicated Microsoft Entra ID application for Access Analyzer and grant it the required permissions before adding Entra ID as a data source.
:::note
-A user account with the **Global Administrator**, **Application Administrator**, or **Cloud Application Administrator** role is required to register an application and grant admin consent for permissions.
+You need a user account with the **Global Administrator**, **Application Administrator**, or **Cloud Application Administrator** role to register an application and grant admin consent for permissions.
:::
:::note
-The registered application must be assigned to the **Global Administrator** role for Entra ID data collection.
+You must assign the registered application to the **Global Administrator** role for Entra ID data collection.
:::
## Register an app in Microsoft Entra ID
@@ -51,7 +51,7 @@ The Overview page for the newly registered application opens. Copy the following
6. Click **Microsoft Graph**, then click the **Application permissions** tab.
-7. Select the required permissions (see table below).
+7. Select the required permissions (see [Required permissions](#required-permissions)).
8. Click **Add Permissions**.
diff --git a/docs/accessanalyzer/2601/connectors/file-servers/celerra.md b/docs/accessanalyzer/2601/connectors/file-servers/celerra.md
index 2af864e745..73229e8d4c 100644
--- a/docs/accessanalyzer/2601/connectors/file-servers/celerra.md
+++ b/docs/accessanalyzer/2601/connectors/file-servers/celerra.md
@@ -8,7 +8,7 @@ sidebar_position: 50
The Dell EMC Celerra connector reads file shares over SMB to collect share permissions, folder and file ACLs, and file contents for sensitive data classification. The connector doesn't require agent installation on the storage system.
-Dell EMC Celerra serves CIFS/SMB file shares through Data Movers. The CIFS service must be licensed and configured on each Data Mover you want to scan.
+Dell EMC Celerra serves CIFS/SMB file shares through Data Movers. You must license and configure the CIFS service on each Data Mover you want to scan.
## Supported versions
diff --git a/docs/accessanalyzer/2601/connectors/file-servers/cifs.md b/docs/accessanalyzer/2601/connectors/file-servers/cifs.md
index 19aa9567af..8cd41acaf7 100644
--- a/docs/accessanalyzer/2601/connectors/file-servers/cifs.md
+++ b/docs/accessanalyzer/2601/connectors/file-servers/cifs.md
@@ -38,4 +38,4 @@ For domain-based Distributed File System (DFS) namespaces, the scan targets the
## Sensitive Data Discovery
-Sensitive Data Discovery (SDD) is handled by the scanner infrastructure. No additional software is required on the target file server.
+The scanner infrastructure handles Sensitive Data Discovery (SDD). The target file server doesn't need additional software.
diff --git a/docs/accessanalyzer/2601/connectors/file-servers/dell-unity.md b/docs/accessanalyzer/2601/connectors/file-servers/dell-unity.md
index 42062d1235..fe36433953 100644
--- a/docs/accessanalyzer/2601/connectors/file-servers/dell-unity.md
+++ b/docs/accessanalyzer/2601/connectors/file-servers/dell-unity.md
@@ -8,7 +8,7 @@ sidebar_position: 40
The Dell Unity connector reads file shares over SMB to collect share permissions, folder and file ACLs, and file contents for sensitive data classification. The connector doesn't require agent installation on the storage system.
-Dell Unity serves CIFS/SMB shares through NAS servers. The CIFS protocol must be configured on each NAS server you want to scan.
+Dell Unity serves CIFS/SMB shares through NAS servers. You must configure the CIFS protocol on each NAS server you want to scan.
## Supported versions
diff --git a/docs/accessanalyzer/2601/connectors/file-servers/isilon-powerscale.md b/docs/accessanalyzer/2601/connectors/file-servers/isilon-powerscale.md
index bd212a1748..a1bca8dff4 100644
--- a/docs/accessanalyzer/2601/connectors/file-servers/isilon-powerscale.md
+++ b/docs/accessanalyzer/2601/connectors/file-servers/isilon-powerscale.md
@@ -8,7 +8,7 @@ sidebar_position: 30
The Dell Isilon / PowerScale connector reads file shares over SMB to collect share permissions, folder and file ACLs, and file contents for sensitive data classification. The connector doesn't require agent installation on the storage system.
-Dell Isilon / PowerScale (based on the OneFS operating system) organizes SMB shares within access zones. The SMB service must be enabled on each access zone you want to scan.
+Dell Isilon / PowerScale (based on the OneFS operating system) organizes SMB shares within access zones. You must enable the SMB service on each access zone you want to scan.
## Supported versions
diff --git a/docs/accessanalyzer/2601/connectors/file-servers/netapp.md b/docs/accessanalyzer/2601/connectors/file-servers/netapp.md
index ec02a17fee..9fb5a87116 100644
--- a/docs/accessanalyzer/2601/connectors/file-servers/netapp.md
+++ b/docs/accessanalyzer/2601/connectors/file-servers/netapp.md
@@ -8,7 +8,7 @@ sidebar_position: 20
The NetApp ONTAP connector reads file shares over SMB to collect share permissions, folder and file ACLs, and file contents for sensitive data classification. The connector doesn't require agent installation on the storage system.
-NetApp ONTAP serves CIFS/SMB shares through Storage Virtual Machines (SVMs). Each SVM has its own CIFS server that the connector connects to independently. The CIFS service must be licensed and enabled on each SVM you want to scan.
+NetApp ONTAP serves CIFS/SMB shares through Storage Virtual Machines (SVMs). Each SVM has its own CIFS server that the connector connects to independently. You must license and enable the CIFS service on each SVM you want to scan.
## Supported versions
@@ -38,4 +38,4 @@ To add a NetApp ONTAP SVM to Access Analyzer, see [Set Up File Server Source Gro
## Known behavior
-NetApp ONTAP may return invalid timestamp values on some systems due to a Year 2038 overflow issue in the ONTAP CIFS implementation. Access Analyzer detects and handles this automatically — affected timestamps are recorded as empty rather than causing a scan error.
+NetApp ONTAP may return invalid timestamp values on some systems due to a Year 2038 overflow issue in the ONTAP CIFS implementation. Access Analyzer detects this automatically and records affected timestamps as empty instead of causing a scan error.
diff --git a/docs/accessanalyzer/2601/connectors/file-servers/vnx.md b/docs/accessanalyzer/2601/connectors/file-servers/vnx.md
index aec64b98c6..d1d8de521a 100644
--- a/docs/accessanalyzer/2601/connectors/file-servers/vnx.md
+++ b/docs/accessanalyzer/2601/connectors/file-servers/vnx.md
@@ -8,14 +8,14 @@ sidebar_position: 60
The Dell EMC VNX connector reads file shares over SMB to collect share permissions, folder and file ACLs, and file contents for sensitive data classification. The connector doesn't require agent installation on the storage system.
-Dell EMC VNX serves CIFS/SMB file shares through Data Movers. The CIFS service must be licensed and configured on each Data Mover you want to scan.
+Dell EMC VNX serves CIFS/SMB file shares through Data Movers. You must license and configure the CIFS service on each Data Mover you want to scan.
## Supported versions
- VNX2 series (NAS code 8.x)
- VNX series (NAS code 7.x)
-VNX2 is the second-generation platform; VNX is the original series. Both use the same Data Mover architecture and are configured identically in Access Analyzer.
+VNX2 is the second-generation platform; VNX is the original series. Both use the same Data Mover architecture, and you configure them identically in Access Analyzer.
## Requirements
diff --git a/docs/accessanalyzer/2601/connectors/sharepoint-online/overview.md b/docs/accessanalyzer/2601/connectors/sharepoint-online/overview.md
index b0c4878e7c..2e8c60e2fa 100644
--- a/docs/accessanalyzer/2601/connectors/sharepoint-online/overview.md
+++ b/docs/accessanalyzer/2601/connectors/sharepoint-online/overview.md
@@ -32,4 +32,4 @@ When configuring the SharePoint Online source in Access Analyzer, you need the f
- **Application (client) ID**
- **Directory (tenant) ID**
-The certificate is generated by Access Analyzer during source group setup. You download it and upload it to your registered Microsoft Entra ID application before the connection can be tested.
+Access Analyzer generates the certificate during source group setup. You download it and upload it to your registered Microsoft Entra ID application before you can test the connection.
diff --git a/docs/accessanalyzer/2601/connectors/sharepoint-online/tenant-certificate-config.md b/docs/accessanalyzer/2601/connectors/sharepoint-online/tenant-certificate-config.md
index 8661d4f323..eea9bd85ae 100644
--- a/docs/accessanalyzer/2601/connectors/sharepoint-online/tenant-certificate-config.md
+++ b/docs/accessanalyzer/2601/connectors/sharepoint-online/tenant-certificate-config.md
@@ -28,6 +28,6 @@ Access Analyzer authenticates with SharePoint Online using certificate-based aut
9. Enter a description for the certificate.
-10. Click **Add**. The certificate is uploaded to the registered application.
+10. Click **Add** to upload the certificate to the registered application.
After uploading, return to the Access Analyzer source group wizard and click **Test Connection** to verify the authentication.
diff --git a/docs/accessanalyzer/2601/dashboards-reports/my-reports.md b/docs/accessanalyzer/2601/dashboards-reports/my-reports.md
index c0b0e171b0..d661678944 100644
--- a/docs/accessanalyzer/2601/dashboards-reports/my-reports.md
+++ b/docs/accessanalyzer/2601/dashboards-reports/my-reports.md
@@ -24,10 +24,10 @@ You can save any report that has the **Save Report** button in its toolbar. The
6. Review the **Current Filters** section to confirm the active filters are correct.
7. Click **Save Report**.
-After saving, Access Analyzer redirects you to **My Reports** where the new report appears in the list.
+After you save the report, Access Analyzer redirects you to **My Reports**, where the new report appears in the list.
:::note
-If no filters are applied when you click **Save Report**, the dialog indicates that no filters are active. You can still save the report, but it will open with the default unfiltered view.
+If you don't apply filters before clicking **Save Report**, the dialog indicates that no filters are active. You can still save the report, but it will open with the default unfiltered view.
:::
## Open a saved report
diff --git a/docs/accessanalyzer/2601/dashboards-reports/reports.md b/docs/accessanalyzer/2601/dashboards-reports/reports.md
index aae3642661..fc48660abf 100644
--- a/docs/accessanalyzer/2601/dashboards-reports/reports.md
+++ b/docs/accessanalyzer/2601/dashboards-reports/reports.md
@@ -25,7 +25,7 @@ For full details on these reports, see [File Server Reports](/docs/accessanalyze
| Report | Description |
| --- | --- |
-| **Broken Inheritance** | Lists shares and folders where permission inheritance has been broken, meaning the folder's ACL no longer follows its parent. Use this report to find locations where custom permission assignments may have introduced inconsistencies or unexpected access. |
+| **Broken Inheritance** | Lists shares and folders where permission inheritance is broken, meaning the folder's ACL no longer follows its parent. Use this report to find locations where custom permission assignments may have introduced inconsistencies or unexpected access. |
| **Domain User ACLs** | Shows share and folder permissions assigned directly to domain user accounts. Use this report to identify accounts with direct ACL entries that should be managed through groups instead. |
| **High Risk ACLs** | Identifies folders where broad trustees such as Everyone, Authenticated Users, or Domain Users appear in the access control list. Use this report to locate and remediate over-permissioned folders that expose data to wide audiences. |
| **Local Administrators** | Lists local administrator accounts and the hosts where they hold that privilege. Use this report to identify non-standard or unauthorized local administrator assignments across your file servers. |
@@ -46,7 +46,7 @@ For full details on these reports, see [File Server Reports](/docs/accessanalyze
| --- | --- |
| **Empty Shares** | Lists shares that contain no files. Use this report to identify shares that can be reviewed for decommissioning or consolidation. |
| **Largest Shares** | Ranks file shares by total size. Use this report to identify shares that consume the most storage and prioritize them for review or cleanup. |
-| **Nested Shares** | Identifies shares that are nested inside other shares, creating multiple access paths to the same data with potentially different permissions. Use this report to find and resolve configurations that complicate permission management and access auditing. |
+| **Nested Shares** | Identifies shares nested inside other shares, creating multiple access paths to the same data with potentially different permissions. Use this report to find and resolve configurations that complicate permission management and access auditing. |
| **Stale Content** | Identifies files and shares that haven't been accessed within a configurable threshold. Use this report to locate data that may be a candidate for archiving, deletion, or access review. |
### Sensitive Data
diff --git a/docs/accessanalyzer/2601/gettingstarted/active-directory/active-directory.md b/docs/accessanalyzer/2601/gettingstarted/active-directory/active-directory.md
index 82de776a1d..ce3c07fa51 100644
--- a/docs/accessanalyzer/2601/gettingstarted/active-directory/active-directory.md
+++ b/docs/accessanalyzer/2601/gettingstarted/active-directory/active-directory.md
@@ -10,7 +10,7 @@ Access Analyzer scans Active Directory to inventory users, groups, and group mem
## Prerequisites
-Before setting up an Active Directory source group, confirm that your environment meets the requirements below. The source group wizard connects to your domain controllers over LDAP or LDAPS, so the Access Analyzer server must be able to reach them on the network and a domain service account must be available with the appropriate read permissions.
+Before setting up an Active Directory source group, confirm that your environment meets the following requirements. The source group wizard connects to your domain controllers over LDAP or LDAPS, so the Access Analyzer server must be able to reach them on the network and a domain service account must be available with the appropriate read permissions.
### Service account
@@ -29,6 +29,6 @@ See [Username and Password](../../configurations/service-accounts/username-passw
### Before you begin
-- The fully qualified domain name (FQDN) of each domain controller you plan to add. IP addresses aren't supported — DIGEST-MD5 authentication requires a resolvable hostname and will fail if an IP address is provided.
+- The fully qualified domain name (FQDN) of each domain controller you plan to add. Access Analyzer doesn't support IP addresses — DIGEST-MD5 authentication requires a resolvable hostname and fails if you provide an IP address.
- A Username and Password service account created in Access Analyzer with Read access to the domain.
- Network connectivity from the Access Analyzer server to port 389 or 636 on each domain controller confirmed.
diff --git a/docs/accessanalyzer/2601/gettingstarted/active-directory/reports.md b/docs/accessanalyzer/2601/gettingstarted/active-directory/reports.md
index 0a091357f8..bf602f10d4 100644
--- a/docs/accessanalyzer/2601/gettingstarted/active-directory/reports.md
+++ b/docs/accessanalyzer/2601/gettingstarted/active-directory/reports.md
@@ -10,7 +10,7 @@ After the first Active Directory scan completes, the **AD Scan Summary** dashboa
## AD Scan Summary
-The dashboard is organized into four sections: a summary row at the top, a **Users** section, a **Groups** section, and an **All Risks** section.
+The dashboard has four sections: a summary row at the top, a **Users** section, a **Groups** section, and an **All Risks** section.
### Summary row
diff --git a/docs/accessanalyzer/2601/gettingstarted/active-directory/schema-reference.md b/docs/accessanalyzer/2601/gettingstarted/active-directory/schema-reference.md
index 7ae58d38c8..44a6fc5b0f 100644
--- a/docs/accessanalyzer/2601/gettingstarted/active-directory/schema-reference.md
+++ b/docs/accessanalyzer/2601/gettingstarted/active-directory/schema-reference.md
@@ -5,7 +5,7 @@ sidebar_position: 40
# Active Directory Schema Reference
-Access Analyzer stores Active Directory scan data in the `access_analyzer` ClickHouse database. The tables below are created when you set up an Active Directory source group and run a scan. Use this reference when querying scan data directly or integrating Access Analyzer data with external tools.
+Access Analyzer stores Active Directory scan data in the `access_analyzer` ClickHouse database. Access Analyzer creates these tables when you set up an Active Directory source group and run a scan. Use this reference when querying scan data directly or integrating Access Analyzer data with external tools.
:::note
All tables use the `ReplacingMergeTree` engine. Duplicate rows with the same primary key are deduplicated at merge time. Query the `_latest` views to return only the most recent version of each record.
@@ -13,7 +13,7 @@ All tables use the `ReplacingMergeTree` engine. Duplicate rows with the same pri
## Metadata columns
-All tables include the following columns populated by Access Analyzer during each scan:
+All tables include the following columns, which Access Analyzer populates during each scan:
| Column | Type | Description |
|--------|------|-------------|
@@ -108,9 +108,9 @@ Stores one row per user object discovered in an Active Directory scan.
| Column | Type | Description |
|--------|------|-------------|
| `ms_ds_allowed_to_act_on_behalf_of` | `Array(String)` | List of security descriptors for accounts permitted to delegate to this account using resource-based constrained delegation. |
-| `ms_ds_allowed_to_delegate_to` | `Array(String)` | List of SPNs this account is permitted to delegate to using constrained delegation. |
+| `ms_ds_allowed_to_delegate_to` | `Array(String)` | List of service principal names (SPNs) this account is permitted to delegate to using constrained delegation. |
| `ms_ds_supported_encryption_types` | `Nullable(Int32)` | Optional. Bitmask of Kerberos encryption types supported by this account. |
-| `service_principal_name` | `Array(String)` | List of service principal names (SPNs) registered to this account. |
+| `service_principal_name` | `Array(String)` | List of SPNs registered to this account. |
| `legacy_exchange_dn` | `Nullable(String)` | Optional. Legacy Exchange distinguished name, used for mail routing compatibility. |
| `ms_ds_user_account_control_computer` | `Nullable(Int32)` | Optional. Computer-specific `userAccountControl` flags stored on the user object in hybrid environments. |
@@ -203,9 +203,9 @@ Stores custom Active Directory attribute values collected for user objects durin
### Active Directory Effective Group Membership
-Stores the fully flattened, transitively resolved group membership graph. This table is populated by the `active_directory_effective_group_membership_mv` materialized view, which refreshes on a schedule after each scan. Each row represents one effective membership relationship at a given nesting depth.
+Stores the fully flattened, transitively resolved group membership graph. The `active_directory_effective_group_membership_mv` materialized view populates this table and refreshes on a schedule after each scan. Each row represents one effective membership relationship at a given nesting depth.
-**Engine:** `MergeTree` (not `ReplacingMergeTree`). The table is rebuilt on each refresh rather than deduplicated by version.
+**Engine:** `MergeTree` (not `ReplacingMergeTree`). Access Analyzer rebuilds the table on each refresh rather than deduplicating it by version.
**Primary key:** `(group_object_guid, member_object_guid)`
diff --git a/docs/accessanalyzer/2601/gettingstarted/active-directory/set-up-source-group.md b/docs/accessanalyzer/2601/gettingstarted/active-directory/set-up-source-group.md
index 83c7483472..4304eb9741 100644
--- a/docs/accessanalyzer/2601/gettingstarted/active-directory/set-up-source-group.md
+++ b/docs/accessanalyzer/2601/gettingstarted/active-directory/set-up-source-group.md
@@ -12,8 +12,8 @@ sidebar_position: 3
4. Select a service account from the **Service Account** dropdown, or click **+** to create one inline. Service accounts store the credentials Access Analyzer uses to connect to your domain controllers. See [Service Accounts](../../configurations/service-accounts/overview.md) for details.
5. Click **Add** under **Domain Controllers**, then select **Add Manually**.
6. Enter the following for each domain controller:
- - **Server Name / IP** — The FQDN of the domain controller (for example, `dc01.corp.example.com`). IP addresses aren't supported. To add multiple domain controllers, separate entries with a comma or press **Enter** after each one.
- - **Domain** — The DNS domain name (for example, `corp.example.com`). Applied to all entries above.
+ - **Server Name / IP** — The fully qualified domain name (FQDN) of the domain controller (for example, `dc01.corp.example.com`). Access Analyzer doesn't support IP addresses. To add multiple domain controllers, separate entries with a comma or press **Enter** after each one.
+ - **Domain** — The DNS domain name (for example, `corp.example.com`). Applies to all domain controllers you added in this step.
- **Port** — The LDAP port. Default is `389`. Use `636` for LDAPS.
7. Click **Add domain controller**, then click **Done**. Repeat steps 5–7 for each additional domain.
8. If your domain controllers use self-signed certificates on port 636, select **Ignore SSL errors**.
diff --git a/docs/accessanalyzer/2601/gettingstarted/entra-id/entra-id.md b/docs/accessanalyzer/2601/gettingstarted/entra-id/entra-id.md
index 07dd999590..0ff6b763f0 100644
--- a/docs/accessanalyzer/2601/gettingstarted/entra-id/entra-id.md
+++ b/docs/accessanalyzer/2601/gettingstarted/entra-id/entra-id.md
@@ -6,15 +6,15 @@ sidebar_position: 1
# Entra ID Scanning Overview
-Access Analyzer connects to Microsoft Entra ID to synchronize users, groups, role assignments, and Microsoft Information Protection (MIP) sensitivity labels from your tenant. MIP labels — defined in Microsoft Purview — are retrieved during the scan and made available in the Sensitive Data configuration, where you can map them to sensitive data types for use in file server and SharePoint Online scans.
+Access Analyzer connects to Microsoft Entra ID to synchronize users, groups, role assignments, and Microsoft Information Protection (MIP) sensitivity labels from your tenant. Access Analyzer retrieves MIP labels — defined in Microsoft Purview — during the scan and makes them available in the Sensitive Data configuration, where you can map them to sensitive data types for use in file server and SharePoint Online scans.
:::note
-MIP sensitivity labels are collected during the Entra ID sync and become available for use in **File Server** and **SharePoint Online** Sensitive Data scans. Run the Entra ID scan at least once before enabling MIP label detection in those source groups.
+Access Analyzer collects MIP sensitivity labels during the Entra ID sync, and they become available for use in **File Server** and **SharePoint Online** Sensitive Data scans. Run the Entra ID scan at least once before enabling MIP label detection in those source groups.
:::
## Prerequisites
-Before setting up an Entra ID source group, confirm that your environment meets the requirements below. The source group wizard connects to Microsoft Entra ID over HTTPS using a registered application's client credentials, so the Access Analyzer server must be able to reach the Microsoft identity platform and an app registration must be configured in your tenant with the required API permissions.
+Before setting up an Entra ID source group, confirm that your environment meets the following requirements. The source group wizard connects to Microsoft Entra ID over HTTPS using a registered application's client credentials, so the Access Analyzer server must be able to reach the Microsoft identity platform, and you must configure an app registration in your tenant with the required API permissions.
### Service account
diff --git a/docs/accessanalyzer/2601/gettingstarted/entra-id/reports.md b/docs/accessanalyzer/2601/gettingstarted/entra-id/reports.md
index 26cfa83f41..b829ef2d77 100644
--- a/docs/accessanalyzer/2601/gettingstarted/entra-id/reports.md
+++ b/docs/accessanalyzer/2601/gettingstarted/entra-id/reports.md
@@ -19,7 +19,7 @@ The dashboard is organized into three sections: a summary row at the top, an **I
| **Users** | Total number of user objects synced from the tenant. |
| **Groups** | Total number of group objects synced from the tenant. |
| **Roles** | Total number of Azure AD role definitions retrieved. |
-| **MIP Labels** | Total number of Microsoft Information Protection sensitivity labels retrieved from the tenant. |
+| **MIP Labels** | Total number of Microsoft Information Protection (MIP) sensitivity labels retrieved from the tenant. |
### Identities
@@ -34,9 +34,9 @@ The dashboard is organized into three sections: a summary row at the top, an **I
| Card | Description |
|------|-------------|
-| **Active Labels** | Number of sensitivity labels currently active in the tenant. |
+| **Active Labels** | Number of sensitivity labels active in the tenant. |
| **Label List** | Table listing all retrieved labels, including label name, classification level, and whether the label is active. |
:::note
-MIP labels retrieved here are made available in **Configuration** > **Sensitive Data**, where you can map them to sensitive data types for use in File Server and SharePoint Online scans.
+You can find the MIP labels retrieved here under **Configuration** > **Sensitive Data**, where you can map them to sensitive data types for use in File Server and SharePoint Online scans.
:::
diff --git a/docs/accessanalyzer/2601/gettingstarted/entra-id/scanning-options.md b/docs/accessanalyzer/2601/gettingstarted/entra-id/scanning-options.md
index 7de69e0ccf..85098ecc6d 100644
--- a/docs/accessanalyzer/2601/gettingstarted/entra-id/scanning-options.md
+++ b/docs/accessanalyzer/2601/gettingstarted/entra-id/scanning-options.md
@@ -8,10 +8,10 @@ sidebar_position: 2
| Scan type | Description |
| --- | --- |
-| **Users, Groups, and Roles** | Synchronizes users, groups, and role assignments from the Entra ID tenant. The first scan runs in full; subsequent scans collect only changes since the last run. MIP sensitivity labels are retrieved automatically as part of every scan. |
+| **Users, Groups, and Roles** | Synchronizes users, groups, and role assignments from the Entra ID tenant. The first scan runs in full; subsequent scans collect only changes since the last run. Access Analyzer automatically retrieves Microsoft Information Protection (MIP) sensitivity labels as part of every scan. |
## MIP label retrieval
-When an Entra ID source group runs, Access Analyzer automatically retrieves Microsoft Information Protection (MIP) sensitivity labels defined in the tenant. These labels are made available in the **Configuration** > **Sensitive Data** page, where you can map them to sensitive data types for use in file server and SharePoint Online scans.
+When an Entra ID source group runs, Access Analyzer automatically retrieves Microsoft Information Protection (MIP) sensitivity labels defined in the tenant. You can find these labels on the **Configuration** > **Sensitive Data** page, where you can map them to sensitive data types for use in file server and SharePoint Online scans.
There are no per-source-group configuration options for MIP label retrieval — it runs automatically as part of every scan. To configure how labels are applied to files, see [Sensitive Data Configuration](../../configurations/sensitive-data.md).
diff --git a/docs/accessanalyzer/2601/gettingstarted/entra-id/schema-reference.md b/docs/accessanalyzer/2601/gettingstarted/entra-id/schema-reference.md
index 42a6788f1c..e558b9fa2a 100644
--- a/docs/accessanalyzer/2601/gettingstarted/entra-id/schema-reference.md
+++ b/docs/accessanalyzer/2601/gettingstarted/entra-id/schema-reference.md
@@ -5,12 +5,12 @@ sidebar_position: 40
# Entra ID schema reference
-Access Analyzer stores Entra ID scan data in the `access_analyzer` ClickHouse database. The tables below are populated when you set up an Entra ID source group and run a scan. Use this reference when querying scan data directly or integrating Access Analyzer data with external tools.
+Access Analyzer stores Entra ID scan data in the `access_analyzer` ClickHouse database. Access Analyzer populates the following tables when you set up an Entra ID source group and run a scan. Use this reference when querying scan data directly or integrating Access Analyzer data with external tools.
-Entra ID data is stored in shared tables that serve multiple connector types. Each row is scoped to your tenant using the `tenancyReference` column, which corresponds to your Entra ID tenant.
+Access Analyzer stores Entra ID data in shared tables that serve multiple connector types. The `tenancyReference` column scopes each row to your tenant and corresponds to your Entra ID tenant.
:::note
-All tables use the `ReplacingMergeTree` engine. Duplicate rows with the same primary key are deduplicated at merge time. Use the `FINAL` keyword or query the available `_latest` views to return only the most recent version of each record.
+All tables use the `ReplacingMergeTree` engine, which deduplicates rows with the same primary key at merge time. Use the `FINAL` keyword or query the available `_latest` views to return only the most recent version of each record.
:::
## Metadata columns
@@ -110,7 +110,7 @@ Stores Microsoft Information Protection (MIP) sensitivity labels retrieved from
| `name` | `String` | Internal name of the label. |
| `displayName` | `String` | Display name shown to users in Microsoft 365 applications. |
| `description` | `Nullable(String)` | Optional. Description of the label's purpose. |
-| `isActive` | `Bool` | Whether the label is currently active in the tenant. |
+| `isActive` | `Bool` | Whether the label is active in the tenant. |
| `isDeleted` | `Bool` | Whether the label has been deleted. |
| `classificationLevel` | `Nullable(String)` | Optional. Classification level assigned to the label. |
| `priority` | `Int32` | Display order priority. Lower values appear first. |
@@ -118,5 +118,5 @@ Stores Microsoft Information Protection (MIP) sensitivity labels retrieved from
| `labelId` | `Nullable(String)` | Microsoft GUID for the label as defined in Microsoft Purview. |
:::note
-Labels stored here are the source data for MIP label mapping in **Configuration** > **Sensitive Data**. After mapping labels to sensitive data types, they are available for detection during File Server and SharePoint Online scans.
+Labels stored here are the source data for MIP label mapping in **Configuration** > **Sensitive Data**. After you map labels to sensitive data types, they are available for detection during File Server and SharePoint Online scans.
:::
diff --git a/docs/accessanalyzer/2601/gettingstarted/entra-id/set-up-source-group.md b/docs/accessanalyzer/2601/gettingstarted/entra-id/set-up-source-group.md
index 108570ef48..62e5af73db 100644
--- a/docs/accessanalyzer/2601/gettingstarted/entra-id/set-up-source-group.md
+++ b/docs/accessanalyzer/2601/gettingstarted/entra-id/set-up-source-group.md
@@ -30,7 +30,7 @@ sidebar_position: 3
## What happens next
-Access Analyzer creates the source group and begins syncing users, groups, and roles from your Entra ID tenant. If you selected **Now**, the scan starts immediately. MIP sensitivity labels are retrieved automatically as part of the scan.
+Access Analyzer creates the source group and begins syncing users, groups, and roles from your Entra ID tenant. If you selected **Now**, the scan starts immediately. Access Analyzer retrieves Microsoft Information Protection (MIP) sensitivity labels automatically as part of the scan.
To check scan progress, navigate to **Configuration** > **Scan Executions**.
diff --git a/docs/accessanalyzer/2601/gettingstarted/file-servers/file-servers.md b/docs/accessanalyzer/2601/gettingstarted/file-servers/file-servers.md
index a0640d0062..1eaab1b140 100644
--- a/docs/accessanalyzer/2601/gettingstarted/file-servers/file-servers.md
+++ b/docs/accessanalyzer/2601/gettingstarted/file-servers/file-servers.md
@@ -6,7 +6,7 @@ sidebar_position: 1
# File Server Scanning Overview
-Access Analyzer scans file servers over SMB to map share permissions, folder-level ACLs, and file ownership across your environment. It can also scan file contents to locate sensitive data and, if activity monitoring is configured, track file access events over time. Reports surface open access, broken inheritance, direct user permissions, and sensitive data exposure — giving security and compliance teams the visibility they need to reduce unnecessary access and meet data protection requirements.
+Access Analyzer scans file servers over SMB to map share permissions, folder-level ACLs, and file ownership across your environment. It can also scan file contents to locate sensitive data and, if you configure activity monitoring, track file access events over time. Reports surface open access, broken inheritance, direct user permissions, and sensitive data exposure — giving security and compliance teams the visibility they need to reduce unnecessary access and meet data protection requirements.
## Supported platforms
@@ -21,7 +21,7 @@ Access Analyzer scans any SMB-compatible file server. For platform-specific requ
## Prerequisites
-Before setting up a file server source group, confirm that your environment meets the requirements below. The source group wizard connects to your file servers over SMB, so the Access Analyzer server must be able to reach them on the network and a service account must be available with read access to the shares you want to scan.
+Before setting up a file server source group, confirm that your environment meets the following requirements. The source group wizard connects to your file servers over SMB, so the Access Analyzer server must be able to reach them on the network and a service account must be available with read access to the shares you want to scan.
### Service account
diff --git a/docs/accessanalyzer/2601/gettingstarted/file-servers/reports.md b/docs/accessanalyzer/2601/gettingstarted/file-servers/reports.md
index 1fe8e943ad..6cc8fd73ac 100644
--- a/docs/accessanalyzer/2601/gettingstarted/file-servers/reports.md
+++ b/docs/accessanalyzer/2601/gettingstarted/file-servers/reports.md
@@ -9,14 +9,14 @@ sidebar_position: 50
File Servers source groups include a set of pre-built reports that answer common security questions about permissions, sensitive data exposure, access patterns, and data content across your CIFS/SMB file shares. Reports are available under the Reports section after the first scan completes and update each time a scan runs.
:::note
-Activity reports (Activity Investigation and Sensitive Data Activity) require Netwrix Activity Monitor (NAM) to be configured and streaming events to Access Analyzer. See [Activity Monitor Integration](../../configurations/activity-monitor-integration.md) for setup instructions.
+Activity reports (Activity Investigation and Sensitive Data Activity) require you to configure Netwrix Activity Monitor (NAM) so it streams events to Access Analyzer. See [Activity Monitor Integration](../../configurations/activity-monitor-integration.md) for setup instructions.
:::
## Available reports
| Location | Report | Description |
|----------|--------|-------------|
-| Access / Broken Inheritance | Broken Inheritance | Lists shares and folders where permission inheritance has been broken, meaning the folder's ACL no longer follows its parent. Use this report to find locations where custom permission assignments may have introduced inconsistencies or unexpected access. |
+| Access / Broken Inheritance | Broken Inheritance | Lists shares and folders with broken permission inheritance, meaning the folder's ACL no longer follows its parent. Use this report to find locations where custom permission assignments may have introduced inconsistencies or unexpected access. |
| Access / Domain User ACLs | Domain User ACLs | Shows share and folder permissions assigned directly to domain user accounts. Use this report to identify accounts with direct ACL entries that should be managed through groups instead. |
| Access / High Risk ACLs | High Risk ACLs | Identifies folders where broad trustees such as Everyone, Authenticated Users, or Domain Users appear in the access control list. Use this report to locate and remediate over-permissioned folders that expose data to wide audiences. |
| Access / Local Administrators | Local Administrators | Lists local administrator accounts and the hosts where they hold that privilege. Use this report to identify non-standard or unauthorized local administrator assignments across your file servers. |
@@ -27,9 +27,9 @@ Activity reports (Activity Investigation and Sensitive Data Activity) require Ne
| Activity / Activity Investigation | Activity Investigation | Displays file system events filtered by date range, user, path, and event type. Use this report to trace the actions of a specific user or investigate changes to a specific file or folder. |
| Content / Empty Shares | Empty Shares | Lists shares that contain no files. Use this report to identify shares that can be reviewed for decommissioning or consolidation. |
| Content / Largest Shares | Largest Shares | Ranks file shares by total size. Use this report to identify shares that consume the most storage and prioritize them for review or cleanup. |
-| Content / Nested Shares | Nested Shares | Identifies shares that are nested inside other shares, creating multiple access paths to the same data with potentially different permissions. Use this report to find and resolve configurations that complicate permission management and access auditing. |
+| Content / Nested Shares | Nested Shares | Identifies shares that nest inside other shares, creating multiple access paths to the same data with potentially different permissions. Use this report to find and resolve configurations that complicate permission management and access auditing. |
| Content / Stale Content | Stale Content | Identifies files and shares that haven't been accessed within a configurable threshold. Use this report to locate data that may be a candidate for archiving, deletion, or access review. |
-| Sensitive Data / Sensitive Data Activity | Sensitive Data Activity | Shows file system events involving files that contain sensitive data, filtered by date range, event type, user, and classification taxonomy. Use this report to identify who is reading, modifying, or deleting sensitive files and to detect potential data exfiltration or misuse. |
+| Sensitive Data / Sensitive Data Activity | Sensitive Data Activity | Shows file system events involving files that contain sensitive data. You can filter results by date range, event type, user, and classification taxonomy. Use this report to identify who is reading, modifying, or deleting sensitive files and to detect potential data exfiltration or misuse. |
| Sensitive Data / Sensitive Data Overview | Sensitive Data Overview | Provides a high-level summary of sensitive data scan findings across CIFS/SMB file shares, including the number of files with matches, classification terms found, and distribution by host and share. Use this report as a starting point for understanding where sensitive data lives in your file server environment. |
| Sensitive Data / Share Audit | Share Audit | Shows share-level details in the context of sensitive data findings, including which shares contain files with sensitive data matches. Use this report to understand sensitive data distribution across shares and prioritize remediation. |
| Sensitive Data / Stale Data | Stale Data | Identifies files containing sensitive data that haven't been accessed recently. Use this report to find aging sensitive content that may no longer be actively used but still carries exposure risk. |
diff --git a/docs/accessanalyzer/2601/gettingstarted/file-servers/scanning-options.md b/docs/accessanalyzer/2601/gettingstarted/file-servers/scanning-options.md
index bd3c282d20..6fb261c24a 100644
--- a/docs/accessanalyzer/2601/gettingstarted/file-servers/scanning-options.md
+++ b/docs/accessanalyzer/2601/gettingstarted/file-servers/scanning-options.md
@@ -16,7 +16,7 @@ sidebar_position: 2
**Access**
- **Include Shares** — Select **All shares** to scan every share on the server, or **Custom selection** to specify which shares to include.
-- **Exclude Shares** — Enter share paths to skip. Wildcards are supported (for example, `\\fileserver\*\temp*`).
+- **Exclude Shares** — Enter share paths to skip. This field supports wildcards (for example, `\\fileserver\*\temp*`).
- **Hidden shares** — Select **Automatically enumerate hidden shares** to include hidden shares. Use **Exclude Hidden Shares** to skip specific ones (for example, `ADMIN$, C$, IPC$`).
- **File-level permissions** — Select **Include file-level permission data** to collect permissions at the individual file level in addition to folder level. This increases scan time.
- **Workers** — Sets the number of concurrent enumeration threads. Default is `3`; valid range is `1–20`. Increase to improve scan speed; decrease to reduce load on the file server.
diff --git a/docs/accessanalyzer/2601/gettingstarted/file-servers/schema-reference.md b/docs/accessanalyzer/2601/gettingstarted/file-servers/schema-reference.md
index 0c380f6b62..7f0b247ea4 100644
--- a/docs/accessanalyzer/2601/gettingstarted/file-servers/schema-reference.md
+++ b/docs/accessanalyzer/2601/gettingstarted/file-servers/schema-reference.md
@@ -5,15 +5,15 @@ sidebar_position: 40
# File Servers Schema Reference
-Access Analyzer stores File Server scan data in the `access_analyzer` ClickHouse database. The tables below are created when you set up a File Server source group and run a scan. Use this reference when querying scan data directly or integrating Access Analyzer data with external tools.
+Access Analyzer stores File Server scan data in the `access_analyzer` ClickHouse database. Setting up a File Server source group and running a scan creates the following tables. Use this reference when querying scan data directly or integrating Access Analyzer data with external tools.
:::note
-All tables use the `ReplacingMergeTree` engine. Duplicate rows with the same primary key are deduplicated at merge time. Query the `_latest` views to return only the most recent version of each record.
+All tables use the `ReplacingMergeTree` engine. The engine deduplicates rows with the same primary key at merge time. Query the `_latest` views to return only the most recent version of each record.
:::
## Metadata columns
-All tables include the following columns populated by Access Analyzer during each scan:
+All tables include the following columns, which Access Analyzer populates during each scan:
| Column | Type | Description |
|--------|------|-------------|
@@ -71,7 +71,7 @@ Stores the file system inventory collected during a scan — one row per file, d
### CIFS Permission
-Stores NTFS ACEs (access control entries) for files and directories — one row per trustee per path.
+Stores NTFS access control entries (ACEs) for files and directories — one row per trustee per path.
| Column | Type | Description |
|--------|------|-------------|
@@ -151,10 +151,10 @@ Stores sensitive data classification findings — one row per taxonomy term matc
### CIFS Sensitive Data MIP Labels
-Stores Microsoft Information Protection (MIP) sensitivity label decisions for files that contain sensitive data findings. Each row records the label action Access Analyzer determined for a file based on its classification results. MIP labels are sourced from an Entra ID source group configured in the same Access Analyzer instance — Access Analyzer uses that source group to resolve label definitions and apply or recommend label changes.
+Stores Microsoft Information Protection (MIP) sensitivity label decisions for files that contain sensitive data findings. Each row records the label action Access Analyzer determined for a file based on its classification results. Access Analyzer sources MIP labels from an Entra ID source group configured in the same Access Analyzer instance and uses that source group to resolve label definitions and apply or recommend label changes.
:::note
-This table uses `ReplacingMergeTree(decision_timestamp)` rather than `scanned_at`. The most recent decision per file (identified by `source_id`, `host`, `share_name`, and `path`) is kept at merge time.
+This table uses `ReplacingMergeTree(decision_timestamp)` rather than `scanned_at`. At merge time, the engine keeps the most recent decision per file (identified by `source_id`, `host`, `share_name`, and `path`).
:::
| Column | Type | Description |
@@ -163,7 +163,7 @@ This table uses `ReplacingMergeTree(decision_timestamp)` rather than `scanned_at
| `host` | `String` | Hostname of the file server. |
| `share_name` | `String` | Name of the share containing the file. |
| `path` | `String` | Full path of the file this label decision applies to. |
-| `mip_is_protected` | `Bool` | Whether the file is currently protected by MIP encryption. |
+| `mip_is_protected` | `Bool` | Whether the file is protected by MIP encryption. |
| `taxonomy_id` | `Nullable(UUID)` | Optional. Identifier of the taxonomy that triggered this label decision. |
| `action` | `Enum8('upgrade', 'keep', 'downgrade', 'clear', 'none')` | The label action Access Analyzer determined: `upgrade` applies a higher-sensitivity label, `downgrade` applies a lower-sensitivity label, `keep` leaves the current label unchanged, `clear` removes the label, and `none` indicates no action was taken. |
| `label_id` | `Nullable(UUID)` | Optional. UUID of the MIP sensitivity label selected by the action. |
@@ -187,7 +187,7 @@ This table uses `ReplacingMergeTree(decision_timestamp)` rather than `scanned_at
## Views
-Access Analyzer creates views that simplify common queries. Use views in preference to querying base tables directly.
+Access Analyzer creates views that simplify common queries. Use views instead of querying base tables directly.
| View | Base table | Description |
|------|------------|-------------|
diff --git a/docs/accessanalyzer/2601/gettingstarted/file-servers/set-up-source-group.md b/docs/accessanalyzer/2601/gettingstarted/file-servers/set-up-source-group.md
index 2301ca864b..14a5a50fba 100644
--- a/docs/accessanalyzer/2601/gettingstarted/file-servers/set-up-source-group.md
+++ b/docs/accessanalyzer/2601/gettingstarted/file-servers/set-up-source-group.md
@@ -20,7 +20,7 @@ sidebar_position: 3
- Toggle **Access** to enable scanning of file permissions and access controls.
- Under **Include Shares**, select **All shares** to scan every share on the server, or **Custom selection** to specify a list of shares to include.
- - Optionally, add share paths to the **Exclude Shares** field to skip specific locations. Wildcards are supported (for example, `\\fileserver\*\temp*`).
+ - Optionally, add share paths to the **Exclude Shares** field to skip specific locations. The field supports wildcards (for example, `\\fileserver\*\temp*`).
- Select **Automatically enumerate hidden shares** to include hidden shares in the scan. Use the **Exclude Hidden Shares** field to exclude specific hidden shares (for example, `ADMIN$, C$, IPC$`).
- Select **Include file-level permission data** to collect permissions at the file level in addition to folder level. This increases scan time.
- Set **Workers** to control the number of concurrent threads used during enumeration. The default is `3`. The valid range is `1–20`.
@@ -29,7 +29,7 @@ sidebar_position: 3
**Sensitive Data scan:**
- Toggle **Sensitive Data** to enable scanning of file contents for sensitive data patterns.
- - Configure share selection using the same options as the Access scan above.
+ - Configure share selection using the same options as the Access scan.
- Select **Inherit from Global Settings** to use the sensitive data types configured at the system level, or disable this option to configure types for this source group specifically.
- If configuring types directly, enable each sensitive data type you want to detect and assign a classification label.
- Select **Run OCR** to scan images, screenshots, and scanned documents for sensitive text using optical character recognition (OCR). This increases processing time.
diff --git a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/scanning-options.md b/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/scanning-options.md
index 0c2521924d..e3c0f3eab3 100644
--- a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/scanning-options.md
+++ b/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/scanning-options.md
@@ -19,10 +19,10 @@ sidebar_position: 2
| **Exclude site URLs** | Excludes specific site collections from the scan. Enter one URL per line. Exclusions take precedence over inclusions. |
| **Scan OneDrive** | When enabled, includes OneDrive personal site collections in the scan. Enabled by default. |
-The Access scan also reads Microsoft Information Protection (MIP) sensitivity labels from SharePoint item metadata and stores them alongside the permission data. Access Analyzer reads existing labels only — writing or modifying MIP labels on SharePoint Online items is not supported.
+The Access scan also reads Microsoft Information Protection (MIP) sensitivity labels from SharePoint item metadata and stores them alongside the permission data. Access Analyzer reads existing labels only — it doesn't support writing or modifying MIP labels on SharePoint Online items.
## Sensitive Data scan
The Sensitive Data scan reads file contents to detect and classify sensitive information. It runs after the Access scan completes and uses the file inventory collected during that scan.
-Sensitive data classification policies, MIP label mappings, and OCR settings are configured globally and apply to all source groups. To configure them, navigate to **Configuration** > **Sensitive Data**. See [Sensitive Data Configuration](../../configurations/sensitive-data.md) for details.
+You configure sensitive data classification policies, MIP label mappings, and optical character recognition (OCR) settings globally, and they apply to all source groups. To configure them, navigate to **Configuration** > **Sensitive Data**. See [Sensitive Data Configuration](../../configurations/sensitive-data.md) for details.
diff --git a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/schema-reference.md b/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/schema-reference.md
index b37dcaed99..77f65abea0 100644
--- a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/schema-reference.md
+++ b/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/schema-reference.md
@@ -5,15 +5,15 @@ sidebar_position: 40
# SharePoint Online schema reference
-Access Analyzer stores SharePoint Online scan data in the `access_analyzer` ClickHouse database. The tables below are created when you set up a SharePoint Online source group and run a scan. Use this reference when querying scan data directly or integrating Access Analyzer data with external tools.
+Access Analyzer stores SharePoint Online scan data in the `access_analyzer` ClickHouse database. Setting up a SharePoint Online source group and running a scan creates the following tables. Use this reference when querying scan data directly or integrating Access Analyzer data with external tools.
:::note
-All tables use the `ReplacingMergeTree` engine. Duplicate rows with the same primary key are deduplicated at merge time. Query the `_latest` views to return only the most recent version of each record.
+All tables use the `ReplacingMergeTree` engine. The engine deduplicates rows with the same primary key at merge time. Query the `_latest` views to return only the most recent version of each record.
:::
## Metadata columns
-All tables include the following columns populated by Access Analyzer during each scan:
+All tables include the following columns, which Access Analyzer populates during each scan:
| Column | Type | Description |
|--------|------|-------------|
@@ -35,13 +35,13 @@ Stores one row per scanned SharePoint item — sites, lists, document libraries,
| `site_id` | `String` | SharePoint identifier of the site collection. |
| `item_id` | `String` | Unique identifier of the item within the site. |
| `site_url` | `String` | Absolute URL of the site collection. |
-| `drive_id` | `String` | Microsoft Graph drive identifier for the document library that contains this item. Empty for sites and lists that do not have a drive. |
-| `drive_item_id` | `String` | Microsoft Graph drive item identifier. Empty for items that are not drive items. |
+| `drive_id` | `String` | Microsoft Graph drive identifier for the document library that contains this item. Empty for sites and lists that don't have a drive. |
+| `drive_item_id` | `String` | Microsoft Graph drive item identifier. Empty for items that aren't drive items. |
| `item_type` | `Enum8` | Type of SharePoint item. Values: `SITE`, `LIST`, `LIBRARY`, `LIST_ITEM`. |
| `name` | `String` | Display name of the item. |
| `file_extension` | `String` | File extension, including the leading period (for example, `.docx`). Empty for non-file items. |
| `relative_url` | `String` | Server-relative URL path of the item. |
-| `file_size` | `Nullable(Int64)` | Optional. File size in bytes. Null for items that are not files. |
+| `file_size` | `Nullable(Int64)` | Optional. File size in bytes. Null for items that aren't files. |
| `created_time` | `DateTime` | Timestamp when the item was created in SharePoint. |
| `created_by_id` | `String` | SharePoint user identifier of the user who created the item. |
| `created_by_email` | `String` | Email address of the user who created the item. |
@@ -79,12 +79,12 @@ Stores one row per permission assignment. Each row represents a single principal
| `principal_id` | `String` | Identifier of the user or group that holds the permission. |
| `principal_type` | `Enum8` | Type of the principal. Values: `USER`, `GROUP`, `SITE_USER`, `SITE_GROUP`. |
| `principal_name` | `String` | Display name of the principal. |
-| `principal_email` | `String` | Email address of the principal. Empty for groups that do not have an email address. |
+| `principal_email` | `String` | Email address of the principal. Empty for groups that don't have an email address. |
| `permission_type` | `Enum8` | How the permission was granted. Values: `DIRECT` (assigned directly to the item), `SHARED` (granted through a sharing link). |
| `permission_levels` | `Array(Enum8)` | Named permission levels assigned to the principal. Values: `OWNER`, `READ`, `WRITE`. |
| `effective_base_permissions` | `Array(Enum8)` | Full set of granular SharePoint base permissions the principal holds. Values include `VIEW_LIST_ITEMS`, `ADD_LIST_ITEMS`, `EDIT_LIST_ITEMS`, `DELETE_LIST_ITEMS`, `MANAGE_LISTS`, `MANAGE_PERMISSIONS`, `MANAGE_WEB`, and others as defined by the SharePoint permission model. |
| `normalized_permissions` | `FixedString(5)` | Compact bitmask representation of the permission levels. Used internally for permission comparison. |
-| `parent_site_id` | `String` | Identifier of the site collection from which this permission is inherited. Empty for permissions that are not inherited. |
+| `parent_site_id` | `String` | Identifier of the site collection from which this permission is inherited. Empty for permissions that aren't inherited. |
| `parent_item_id` | `String` | `item_id` of the item from which this permission is inherited. Empty for permissions assigned directly to this item. |
| `is_site_admin` | `Bool` | `true` if the principal is a site collection administrator. |
| `is_external_user` | `Bool` | `true` if the principal is a guest or external user. |
@@ -110,13 +110,13 @@ Stores one row per sharing link. A sharing link may grant access to one or more
|--------|------|-------------|
| `site_hostname` | `String` | Hostname of the site collection that contains the item. |
| `site_id` | `String` | SharePoint identifier of the site collection. |
-| `item_id` | `String` | Identifier of the item this link points to. |
-| `permission_id` | `String` | SharePoint permission identifier associated with this link. |
+| `item_id` | `String` | Identifier of the item the sharing link points to. |
+| `permission_id` | `String` | SharePoint permission identifier associated with the sharing link. |
| `share_id` | `String` | Unique identifier of the sharing link. |
| `link_type` | `Enum8` | Access level granted by the link. Values: `VIEW`, `EDIT`, `EMBED`, `REVIEW`. |
| `link_url` | `String` | Full URL of the sharing link. |
| `link_scope` | `Enum8` | Audience the link is accessible to. Values: `ANONYMOUS` (anyone with the link), `ORGANIZATION` (anyone in the organization), `USERS` (specific users only). |
-| `expires_on` | `DateTime` | Expiration timestamp of the link. A zero value indicates the link does not expire. |
+| `expires_on` | `DateTime` | Expiration timestamp of the link. A zero value indicates the link doesn't expire. |
| `is_password_protected` | `Bool` | `true` if the link requires a password to access. |
| `prevent_download` | `Bool` | `true` if the link prevents recipients from downloading the file. |
@@ -126,8 +126,8 @@ Stores one row per sharing link. A sharing link may grant access to one or more
| Related table | Join columns | Description |
|---|---|---|
-| `sharepoint_online_objects` | `site_hostname`, `site_id`, `item_id` | The item this link provides access to. |
-| `sharepoint_online_permissions` | `site_hostname`, `site_id`, `item_id`, `share_id` | Permissions granted through this link. |
+| `sharepoint_online_objects` | `site_hostname`, `site_id`, `item_id` | The item the sharing link provides access to. |
+| `sharepoint_online_permissions` | `site_hostname`, `site_id`, `item_id`, `share_id` | Permissions granted through the sharing link. |
---
@@ -156,7 +156,7 @@ Stores classification results from the sensitive data scan option. Each row repr
## Views
-Access Analyzer creates views that simplify common queries. Use views in preference to querying base tables directly.
+Access Analyzer creates views that simplify common queries. Use views instead of querying base tables directly.
| View | Base table | Description |
|------|------------|-------------|
diff --git a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/sharepoint-online.md b/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/sharepoint-online.md
index 517738c004..39a5e5b55f 100644
--- a/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/sharepoint-online.md
+++ b/docs/accessanalyzer/2601/gettingstarted/sharepoint-online/sharepoint-online.md
@@ -10,11 +10,11 @@ Access Analyzer scans SharePoint Online sites to map permissions, enumerate shar
## Prerequisites
-Before setting up a SharePoint Online source group, confirm that your environment meets the requirements below. The source group wizard connects to SharePoint Online over HTTPS using certificate-based authentication, so the Access Analyzer server must be able to reach the Microsoft identity platform and an app registration must be configured in your tenant. The certificate is generated by the wizard — you'll need the application's Client ID before you begin.
+Before setting up a SharePoint Online source group, confirm that your environment meets the following requirements. The source group wizard connects to SharePoint Online over HTTPS using certificate-based authentication, so the Access Analyzer server must be able to reach the Microsoft identity platform, and you must configure an app registration in your tenant. The wizard generates the certificate — you'll need the application's Client ID before you begin.
### Service account
-Access Analyzer uses a Client ID and Certificate service account to authenticate with SharePoint Online. Only the Client ID is entered when creating the service account — the certificate is generated automatically during source group setup when you click **Generate and Download Certificate**. You then upload the certificate to your registered Entra ID application before the connection can be tested.
+Access Analyzer uses a Client ID and Certificate service account to authenticate with SharePoint Online. You enter only the Client ID when creating the service account — Access Analyzer generates the certificate automatically during source group setup when you click **Generate and Download Certificate**. You then upload the certificate to your registered Entra ID application before you can test the connection.
See [Client ID/Certificate service account](../../configurations/service-accounts/client-id-certificate.md) to create the service account and [SharePoint Online Connector Requirements](../../connectors/sharepoint-online/overview.md) for instructions on registering the application.
@@ -34,7 +34,7 @@ See [Client ID/Certificate service account](../../configurations/service-account
- Network connectivity from the Access Analyzer server to port 443 confirmed.
:::note
-Access Analyzer reads MIP sensitivity labels on SharePoint Online files during Sensitive Data scans. Labels are collected and surfaced in scan results — no changes are made to labels on any scanned file.
+Access Analyzer reads Microsoft Information Protection (MIP) sensitivity labels on SharePoint Online files during Sensitive Data scans. It collects the labels and surfaces them in scan results, and it makes no changes to labels on any scanned file.
:::
:::note
diff --git a/docs/accessanalyzer/2601/install/identity-provider.md b/docs/accessanalyzer/2601/install/identity-provider.md
index f3719334fb..80c62fdb3b 100644
--- a/docs/accessanalyzer/2601/install/identity-provider.md
+++ b/docs/accessanalyzer/2601/install/identity-provider.md
@@ -24,14 +24,14 @@ When you configure `--idp-type`, the installer automatically:
1. Deploys Keycloak (v26.5.3) as part of the cluster
2. Waits for Keycloak to become healthy
3. Creates the IdP federation using the flags you provided
-4. Enables OIDC authentication in the Access Analyzer application
+4. Enables OpenID Connect (OIDC) authentication in the Access Analyzer application
## Before you begin
Confirm the following before running the installer with IdP flags:
-- The Access Analyzer cluster system requirements are met — see [Hardware and System Requirements](system/requirements.md)
-- TLS certificates are prepared and placed on the VM — see [TLS Certificate Requirements](system/certificates.md)
+- Your infrastructure meets the Access Analyzer cluster system requirements — see [Hardware and System Requirements](system/requirements.md)
+- You have prepared and placed TLS certificates on the VM — see [TLS Certificate Requirements](system/certificates.md)
- You have collected the required credentials from the customer's IdP or directory administrator (see [Identity Provider — Part 1](../configurations/identity-provider.md#part-1-configure-your-identity-provider))
- For LDAP/AD: the Access Analyzer server has network access to the LDAP server on port 636 (LDAPS) or 389 (LDAP)
- For a private CA certificate: you have the PEM file available on the server and will pass `--ca-bundle ` to the installer
@@ -39,7 +39,7 @@ Confirm the following before running the installer with IdP flags:
:::warning
`--hostname` is required and must:
-- Be a real DNS hostname (not an IP address — IPs will not work because the browser TLS handshake requires the hostname in the certificate's SAN).
+- Be a real DNS hostname (not an IP address — IPs will not work because the browser TLS handshake requires the hostname in the certificate's Subject Alternative Name (SAN)).
- Be lowercase, and match lowercase in the certificate SAN list. Keycloak derives its OIDC issuer URL from this value; a case mismatch between SAN and browser-normalized hostname produces HTTP 401 at sign-in.
- Resolve the same from client browsers and in-cluster pods. The installer configures the in-cluster rewrite automatically; the customer is responsible for the public DNS record or `/etc/hosts` entry that client browsers use.
- Avoid the `.local` and `.localhost` TLDs — both break in-cluster DNS resolution and silently break OIDC login flows.
@@ -154,7 +154,7 @@ END HIDDEN -->
## Configure Active Directory
:::tip
-For a step-by-step end-to-end walkthrough using environment variables (recommended for most customers), see the [Quick Install](quickinstall.md). The section below is the flag-level reference.
+For a step-by-step end-to-end walkthrough using environment variables (recommended for most customers), see the [Quick Install](quickinstall.md). This section is the flag-level reference.
:::
**Required flags:** `--idp-type ad`, `--idp-alias`, `--ldap-url`, `--ldap-bind-dn`, `--ldap-users-dn`
@@ -163,7 +163,7 @@ For a step-by-step end-to-end walkthrough using environment variables (recommend
**Prompted secret:** LDAP bind credential — entered interactively, never written to disk or logs
-If your domain controller's LDAPS certificate is signed by an internal CA not in the OS trust store (typical for on-prem AD), pass the root CA cert via `--ca-bundle`. Without it, Keycloak's LDAPS handshake to the DC will fail with a TLS trust error. The CA that signed the DC's LDAPS certificate may be different from the CA that signed your Access Analyzer server's TLS certificate — verify the DC's cert chain specifically. See [TLS Certificate Requirements](system/certificates.md) for details on assembling the CA bundle.
+If an internal CA not in the OS trust store (typical for on-prem AD) signs your domain controller's LDAPS certificate, pass the root CA cert via `--ca-bundle`. Without it, Keycloak's LDAPS handshake to the DC will fail with a TLS trust error. The CA that signed the DC's LDAPS certificate may be different from the CA that signed your Access Analyzer server's TLS certificate — verify the DC's cert chain specifically. See [TLS Certificate Requirements](system/certificates.md) for details on assembling the CA bundle.
```bash
export LICENSE_KEY='[YOUR_LICENSE_KEY]'
@@ -492,7 +492,7 @@ grep -A 20 "Configuring IdP federation" /var/log/dspm-installer.log
| Message | Likely cause |
| --- | --- |
-| `Failed to authenticate with Keycloak admin CLI` | Keycloak pod not ready; check pod status below |
+| `Failed to authenticate with Keycloak admin CLI` | Keycloak pod not ready; see [Check Keycloak pod health](#check-keycloak-pod-health) |
| `409 Conflict` from `kcadm.sh create` | An IdP with this alias already exists in Keycloak |
| `PKIX path building failed` in Keycloak logs (LDAP sign-ins fail silently) | CA bundle is missing the LDAPS DC's CA — see [TLS Certificate Requirements](system/certificates.md#multi-domain-and-multi-ca-environments) |
diff --git a/docs/accessanalyzer/2601/install/quickinstall.md b/docs/accessanalyzer/2601/install/quickinstall.md
index de2e028b0e..40ff1979c1 100644
--- a/docs/accessanalyzer/2601/install/quickinstall.md
+++ b/docs/accessanalyzer/2601/install/quickinstall.md
@@ -78,7 +78,7 @@ The installer offers three ways to provision the server's TLS certificate. Choos
| --- | --- | --- | --- |
| **Generate self-signed** | Installer generates a certificate automatically — no CA involvement | Quick evaluations and proof-of-concept installs. Not for production — browsers will show a security warning | Nothing — installer handles it |
| **Sign with AD Certificate Services** | Installer generates a certificate signing request (CSR) and submits it to your organization's Active Directory Certificate Services (AD CS), where your internal Enterprise CA signs it | Enterprise environments that already run AD CS and where the server can reach the CA | AD CS must be reachable from the server; an account with certificate enrollment rights |
-| **Bring your own certificate** | You provide a pre-existing certificate, private key, and CA bundle | Environments with a centralized PKI team, or where AD CS isn't available | Three PEM files — see [file requirements](#bring-your-own-certificate-file-requirements) |
+| **Bring your own certificate** | You provide a pre-existing certificate, private key, and CA bundle | Environments with a centralized Public Key Infrastructure (PKI) team, or where AD CS isn't available | Three PEM files — see [file requirements](#bring-your-own-certificate-file-requirements) |
#### Bring your own certificate file requirements
diff --git a/docs/accessanalyzer/2601/install/security.md b/docs/accessanalyzer/2601/install/security.md
index 40fc8a02d1..089088c18e 100644
--- a/docs/accessanalyzer/2601/install/security.md
+++ b/docs/accessanalyzer/2601/install/security.md
@@ -10,10 +10,10 @@ Follow these recommendations to harden your Access Analyzer deployment.
## License Key Protection
-Your Netwrix license key provides access to the OCI package registry. Treat it as a credential:
+Your Netwrix license key provides access to the Open Container Initiative (OCI) package registry. Treat it as a credential:
-- Do not commit license keys to version control
-- Do not store license keys in plaintext configuration files
+- Don't commit license keys to version control
+- Don't store license keys in plaintext configuration files
- Clear shell history after setting the `LICENSE_KEY` environment variable:
```bash
@@ -29,7 +29,7 @@ Your Netwrix license key provides access to the OCI package registry. Treat it a
## TLS / SSL
- Replace the default self-signed certificate with a certificate issued by a trusted CA for production use
-- Ensure outbound TLS verification is enabled by mounting your organization's CA bundle — see [SSL / TLS Configuration](/docs/accessanalyzer/2601/install/system/certificates)
+- Mount your organization's CA bundle to enable outbound TLS verification — see [SSL / TLS Configuration](/docs/accessanalyzer/2601/install/system/certificates)
## RBAC and Access Control
@@ -60,6 +60,6 @@ Your Netwrix license key provides access to the OCI package registry. Treat it a
## Kubernetes Security
-- Secrets at rest are encrypted by default (K3s `--secrets-encryption` flag)
-- Kubeconfig file permissions are set to `644` — restrict further if the VM is shared
+- K3s encrypts secrets at rest by default (`--secrets-encryption` flag)
+- By default, kubeconfig file permissions are `644` — restrict further if the VM is shared
- Regularly apply OS security patches to the host VM
diff --git a/docs/accessanalyzer/2601/install/system/certificates.md b/docs/accessanalyzer/2601/install/system/certificates.md
index 074062a270..9b92f976ca 100644
--- a/docs/accessanalyzer/2601/install/system/certificates.md
+++ b/docs/accessanalyzer/2601/install/system/certificates.md
@@ -29,14 +29,14 @@ All three files must be in PEM format. When you choose **Bring your own certific
## 2. Application TLS Private Key (`.key`)
- **Format**: PEM (`-----BEGIN PRIVATE KEY-----` or `-----BEGIN RSA PRIVATE KEY-----`).
-- **Must be readable by the OS user running the installer.** If you extracted the key using `sudo` or another elevated context, the file may be owned by `root` with `0600` permissions — the installer will fail to read it. After extraction, set ownership to the user running the installer:
+- **Must be readable by the OS user running the installer.** If you extracted the key using `sudo` or another elevated context, `root` may own the file with `0600` permissions — the installer will fail to read it. After extraction, set ownership to the user running the installer:
```bash
sudo chown : /opt/dspm-tls/.key
sudo chmod 644 /opt/dspm-tls/.key
```
-- **Never share or commit this file.** Once inside `/opt/dspm-tls/` with correct ownership, restrict access via directory permissions.
+- **Never share or commit this file.** After the file is inside `/opt/dspm-tls/` with correct ownership, restrict access via directory permissions.
## 3. CA Bundle (`ca-bundle.crt`)
diff --git a/docs/accessanalyzer/2601/install/system/kubernetes.md b/docs/accessanalyzer/2601/install/system/kubernetes.md
index 1f86412f14..2fdf2bf161 100644
--- a/docs/accessanalyzer/2601/install/system/kubernetes.md
+++ b/docs/accessanalyzer/2601/install/system/kubernetes.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Kubernetes and Operating System
-Access Analyzer uses K3s, a lightweight Kubernetes distribution, which is automatically deployed by the installer. No manual Kubernetes setup is required.
+Access Analyzer uses K3s, a lightweight Kubernetes distribution that the installer deploys automatically. You don't need to set up Kubernetes manually.
## Operating System
@@ -17,7 +17,7 @@ Access Analyzer uses K3s, a lightweight Kubernetes distribution, which is automa
| **Kernel version** | 5.15 or later |
:::note
-Other Linux distributions may work but are not officially tested or supported. Ubuntu 24.04 LTS is the recommended and validated platform.
+Other Linux distributions may work, but Netwrix doesn't officially test or support them. Ubuntu 24.04 LTS is the recommended and validated platform.
:::
## K3s Kubernetes
@@ -29,7 +29,7 @@ Other Linux distributions may work but are not officially tested or supported. U
| **Secrets encryption** | Enabled (at rest) |
| **Service name** | `k3s-dspm` |
-K3s is installed and managed automatically by the Access Analyzer installer. The `kubectl` command is available immediately after installation for cluster management.
+The Access Analyzer installer installs and manages K3s automatically. The `kubectl` command is available immediately after installation for cluster management.
## Kernel Features
@@ -50,4 +50,4 @@ The following kernel features must be available. The installer validates these a
| **Namespace** | `argocd` |
| **UI port** | 8090 (via port-forward) |
-ArgoCD is deployed automatically and manages the lifecycle of all Access Analyzer application components through GitOps.
+The installer deploys ArgoCD automatically, and ArgoCD manages the lifecycle of all Access Analyzer application components through GitOps.
diff --git a/docs/accessanalyzer/2601/install/system/network.md b/docs/accessanalyzer/2601/install/system/network.md
index d8989d78a7..ba5e27cba4 100644
--- a/docs/accessanalyzer/2601/install/system/network.md
+++ b/docs/accessanalyzer/2601/install/system/network.md
@@ -43,7 +43,7 @@ Access Analyzer uses these ports within the VM for service-to-service communicat
| 6379 | TCP | Redis | Cache and queue connections |
:::note
-All internal ports are bound to the local cluster network. Only port 443 (Traefik) is exposed externally for the web interface.
+The local cluster network keeps all internal ports contained. Traefik exposes only port 443 externally, for the web interface.
:::
## Connector Network Requirements
diff --git a/docs/accessanalyzer/2601/overview/keyconcepts.md b/docs/accessanalyzer/2601/overview/keyconcepts.md
index 02aa160256..e4e943fbb4 100644
--- a/docs/accessanalyzer/2601/overview/keyconcepts.md
+++ b/docs/accessanalyzer/2601/overview/keyconcepts.md
@@ -10,7 +10,7 @@ This page defines the core terminology used throughout Access Analyzer.
## Source Groups
-A **source group** is a named collection of related sources that share a common service account and configuration. Sources are the individual hosts or targets within a source group — for example, the specific file servers or domain controllers that Access Analyzer connects to and scans. Source groups are created through the **Connect Source** wizard, which handles source creation, scan configuration, and scheduling in a single workflow.
+A **source group** is a named collection of related sources that share a common service account and configuration. Sources are the individual hosts or targets within a source group — for example, the specific file servers or domain controllers that Access Analyzer connects to and scans. The **Connect Source** wizard creates source groups, handling source creation, scan configuration, and scheduling in a single workflow.
- **File Server** source groups can contain multiple servers (for example, all file servers in a department)
- **Active Directory** source groups can contain multiple domain controllers
@@ -28,7 +28,7 @@ A **service account** stores credentials used to authenticate with data sources
- **Client ID + Certificate** — SharePoint Online state-in-time scans. Access Analyzer generates the certificate; you upload the public key to your Azure app registration.
- **SSH Username / Key** — Edge scanners
-Service accounts are managed in **Configuration** > **Service Accounts** and can be shared across multiple sources.
+You manage service accounts in **Configuration** > **Service Accounts** and can share them across multiple sources.
## User Roles
@@ -37,27 +37,27 @@ Access Analyzer has three roles:
| Role | Responsibilities |
| --- | --- |
| **Administrator** | Full access: manages system configuration (sources, scans, connectors, service accounts, application settings) and user management (create accounts, assign roles, manage users). |
-| **User Admin** | User and role management only — creates accounts, assigns roles, and pre-provisions federated users. Cannot change system configuration. |
-| **Viewer** | Read-only access to data, reports, and dashboards. Cannot make changes. |
+| **User Admin** | User and role management only — creates accounts, assigns roles, and pre-provisions federated users. Can't change system configuration. |
+| **Viewer** | Read-only access to data, reports, and dashboards. Can't make changes. |
For a full walkthrough of role assignment, see the [Quick Install — Roles](/docs/accessanalyzer/2601/install/quickinstall#roles) section.
## Connectors
-A **connector** is the component that performs the actual work of communicating with a source. Each source type has a corresponding connector that handles:
+A **connector** is the component that communicates with a source. Each source type has a corresponding connector that handles:
- **Test connection** — Validates that credentials and network connectivity are correct
- **Access scan / sync** — Enumerates files, folders, permissions, or identities
-Connectors are executed as Kubernetes Jobs and managed by the Connector API.
+The Connector API executes and manages connectors as Kubernetes Jobs.
## Edge Scanners
-An **edge scanner** is a lightweight, containerized agent that Access Analyzer deploys on demand to perform distributed scanning of remote environments. Edge scanners remove the need for a traditional proxy server — they run as short-lived Kubernetes Jobs, execute their scan, and terminate. There is no persistent agent process and no manual deployment required.
+An **edge scanner** is a lightweight, containerized agent that Access Analyzer deploys on demand to perform distributed scanning of remote environments. Edge scanners remove the need for a traditional proxy server — they run as short-lived Kubernetes Jobs, execute their scan, and terminate. No persistent agent process exists, and you don't need to deploy them manually.
-Edge scanners are used for **Active Directory** and **File Server** sources. Entra ID and SharePoint Online connect directly from the Access Analyzer service and do not use edge scanners.
+Access Analyzer uses edge scanners for **Active Directory** and **File Server** sources. Entra ID and SharePoint Online connect directly from the Access Analyzer service and don't use edge scanners.
-Edge scanners are registered in **Configuration** > **Source Groups** > **Scanners** and are associated with a service account using **SSH Username / Key** credentials. Scanner labels can be used to route specific scan executions to dedicated scanner pools — for example, to isolate production scanning traffic from non-production environments.
+You register edge scanners in **Configuration** > **Source Groups** > **Scanners** and associate them with a service account using **SSH Username / Key** credentials. Use scanner labels to route specific scan executions to dedicated scanner pools — for example, to isolate production scanning traffic from non-production environments.
For configuration details and best practices, see [Overview of Scanners](/docs/accessanalyzer/2601/configurations/source-groups/scanners/overview).
@@ -68,9 +68,9 @@ A **scan** defines what to analyze and how. Access Analyzer supports several sca
- **Access scans** — Enumerate files, folders, and permissions on data sources to identify who has access to what
- **Sensitive data scans** — Classify file contents against detection patterns to find PII, credentials, PHI, and financial records
- **Identity sync scans** — Synchronize users, groups, and roles from IAM sources (Active Directory Inventory, Entra ID Users/Groups/Roles)
-- **Local Users and Groups scans** — Collect local account data from file servers (auto-created when an access scan is enabled)
+- **Local Users and Groups scans** — Collect local account data from file servers (created automatically when you enable an access scan)
-Scans can be run on demand or scheduled with a cron expression.
+You can run scans on demand or schedule them with a cron expression.
## Scan Executions
@@ -96,16 +96,16 @@ A **pattern** is a detection rule used during sensitive data scans. Patterns mat
- **PHI** — Protected health information
- **Financial Records** — Credit card numbers, bank accounts, financial data
-Patterns are organized into **taxonomies** — hierarchical groups of classification rules mapped to compliance frameworks (GDPR, CCPA, HIPAA, PCI DSS, GLBA, CMMC).
+Access Analyzer organizes patterns into **taxonomies** — hierarchical groups of classification rules mapped to compliance frameworks (GDPR, CCPA, HIPAA, PCI DSS, GLBA, CMMC).
## MIP Labels
-**MIP labels** are Microsoft Information Protection sensitivity labels that Access Analyzer reads from scanned files and surfaces alongside sensitive data findings. They are distinct from Sensitive Data Patterns — patterns detect content through classification rules, while MIP labels are labels already applied to files by Microsoft 365 users or automated policies.
+**Microsoft Information Protection (MIP) labels** are sensitivity labels that Access Analyzer reads from scanned files and surfaces alongside sensitive data findings. They are distinct from Sensitive Data Patterns — patterns detect content through classification rules, while Microsoft 365 users or automated policies already apply MIP labels directly to files.
- **File Server sources** — Access Analyzer reads MIP labels from scanned files and can apply labels to files based on scan findings.
-- **SharePoint Online sources** — Access Analyzer reads MIP labels from native SharePoint metadata. Label application is not supported for SharePoint Online.
+- **SharePoint Online sources** — Access Analyzer reads MIP labels from native SharePoint metadata. Label application isn't supported for SharePoint Online.
-Labels are synced from your Entra ID tenant. To make labels available, an Entra ID source group must exist and its **Users, Groups and Roles** scan must have run at least once. Once synced, labels are mapped to sensitive data types in **Configuration** > **Sensitive Data**.
+Access Analyzer syncs labels from your Entra ID tenant. To make labels available, an Entra ID source group must exist and its **Users, Groups and Roles** scan must have run at least once. Once synced, you map labels to sensitive data types in **Configuration** > **Sensitive Data**.
## Dashboards and Reports
@@ -113,7 +113,7 @@ Access Analyzer includes pre-built dashboards and reports that surface findings
### Dashboards
-Two summary dashboards are embedded in the Access Analyzer interface:
+Access Analyzer embeds two summary dashboards in its interface:
| Dashboard | What it shows |
| --- | --- |
@@ -122,7 +122,7 @@ Two summary dashboards are embedded in the Access Analyzer interface:
### Pre-built Reports
-Reports are organized by source type and category:
+Access Analyzer organizes reports by source type and category:
| Source | Categories |
| --- | --- |
diff --git a/docs/accessanalyzer/2601/overview/overview.md b/docs/accessanalyzer/2601/overview/overview.md
index d7d9f194a6..536f4c6d05 100644
--- a/docs/accessanalyzer/2601/overview/overview.md
+++ b/docs/accessanalyzer/2601/overview/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Overview
:::note Using an older version?
-This documentation covers **Access Analyzer 2601**, the latest release — a containerized, Linux-based deployment. If you are running a previous Windows-based installation, select your version below:
+This documentation covers **Access Analyzer 2601**, the latest release — a containerized, Linux-based deployment. If you are running a previous Windows-based installation, select your version from the following list:
- [Access Analyzer 12.0 documentation](https://docs.netwrix.com/docs/accessanalyzer/12_0)
- [Access Analyzer 11.6 documentation](https://docs.netwrix.com/docs/accessanalyzer/11_6)
@@ -17,7 +17,7 @@ This documentation covers **Access Analyzer 2601**, the latest release — a con
Netwrix Access Analyzer is an on-premises Data Security Posture Management (DSPM) platform that helps security and compliance teams discover where sensitive data lives, who has access to it, and where access risks exist across their environment.
-Organizations face a persistent challenge: sensitive data accumulates across file servers, cloud platforms, and identity systems faster than security teams can track it. Permissions expand over time, inheritance gets broken, and stale data sits untouched for years — all without anyone knowing. Access Analyzer addresses this by scanning your data sources and identity providers continuously, classifying what it finds, and surfacing the results in dashboards and reports your team can act on.
+Organizations face a persistent challenge: sensitive data accumulates across file servers, cloud platforms, and identity systems faster than security teams can track it. Permissions expand over time, inheritance breaks, and stale data sits untouched for years — all without anyone knowing. Access Analyzer addresses this by scanning your data sources and identity providers continuously, classifying what it finds, and surfacing the results in dashboards and reports your team can act on.
Access Analyzer connects to the following source types:
@@ -26,17 +26,17 @@ Access Analyzer connects to the following source types:
- **Active Directory** — Syncs users, groups, group memberships, and security risks from on-premises AD domains
- **Entra ID** — Syncs users, groups, and roles from your Microsoft 365 tenant, and collects Microsoft Information Protection (MIP) sensitivity labels applied across the tenant
-After each scan, results are stored in a high-performance analytics database and made available through embedded Metabase dashboards and reports. Security teams can filter by domain, file server, site, or classification type, and drill into specific findings without writing queries.
+After each scan, Access Analyzer stores results in a high-performance analytics database and makes them available through embedded Metabase dashboards and reports. Security teams can filter by domain, file server, site, or classification type, and drill into specific findings without writing queries.
:::note
-Scans are **read-only**. Access Analyzer does not modify files, permissions, or directory objects on any scanned source. No persistent agents are installed on file servers or domain controllers — edge scanners run as short-lived jobs and terminate after each scan.
+Scans are **read-only**. Access Analyzer doesn't modify files, permissions, or directory objects on any scanned source. Access Analyzer doesn't install persistent agents on file servers or domain controllers — edge scanners run as short-lived jobs and terminate after each scan.
:::
## Key Capabilities
| Capability | Description |
| --- | --- |
-| **Sensitive Data Discovery** | Classifies file content across file servers and SharePoint Online against built-in detection patterns for PII, PHI, credentials, and financial data. Findings are mapped to compliance frameworks including GDPR, HIPAA, PCI DSS, and CCPA. |
+| **Sensitive Data Discovery** | Classifies file content across file servers and SharePoint Online against built-in detection patterns for PII, PHI, credentials, and financial data. Access Analyzer maps findings to compliance frameworks including GDPR, HIPAA, PCI DSS, and CCPA. |
| **Access Risk Analysis** | Identifies open access, overly permissive ACLs, broken permission inheritance, and stale entitlements across file shares and SharePoint sites. Shows effective permissions for any user or group. |
| **Identity Inventory** | Continuously syncs users, groups, memberships, and roles from Active Directory and Entra ID. Tracks group nesting, stale accounts, and role assignments across your identity providers. |
| **File Activity Monitoring** | Ingests real-time file system and SharePoint activity events from Netwrix Activity Monitor. Powers activity reports and enables anomaly detection and sensitive data activity tracking. Requires a separate Netwrix Activity Monitor deployment. |
@@ -47,7 +47,7 @@ This section describes how Access Analyzer components are deployed and how data
Access Analyzer runs entirely within your Kubernetes cluster. All components — the web application, API server, analytics database, and connector jobs — deploy to a single `access-analyzer` namespace. No data leaves your infrastructure.
-The platform uses a scan-as-job model: when a scan is triggered, the Connector API creates an ephemeral Kubernetes Job for the connector type (CIFS, SharePoint, Active Directory, or Entra ID). The job runs, connects to the external source, collects data, and streams results to the data ingestion service, which bulk-inserts them into ClickHouse. When the job completes, it posts a webhook back to the Core API to finalize the scan execution record.
+The platform uses a scan-as-job model: triggering a scan causes the Connector API to create an ephemeral Kubernetes Job for the connector type (CIFS, SharePoint, Active Directory, or Entra ID). The job runs, connects to the external source, collects data, and streams results to the data ingestion service, which bulk-inserts them into ClickHouse. When the job completes, it posts a webhook back to the Core API to finalize the scan execution record.
```mermaid
graph TB
@@ -107,11 +107,11 @@ graph TB
**Connector API** — Go service that translates scan requests from the Core API into Kubernetes Job definitions. It creates connector Jobs, monitors their completion, and posts results back to the Core API via webhook.
-**Connector Jobs** — Ephemeral Kubernetes Jobs that run the actual scan work. Each connector type (CIFS, SharePoint, Active Directory, Entra ID) is a containerized Python handler. Jobs connect directly to their target source, collect data, and stream rows to the Data Ingestion service in batches. Jobs are created on demand and cleaned up after completion.
+**Connector Jobs** — Ephemeral Kubernetes Jobs that perform the scan work. Each connector type (CIFS, SharePoint, Active Directory, Entra ID) is a containerized Python handler. Jobs connect directly to their target source, collect data, and stream rows to the Data Ingestion service in batches. The Connector API creates Jobs on demand and cleans them up after completion.
**Data Ingestion** — Python service that receives batched rows from connector jobs and bulk-inserts them into ClickHouse. Provides write isolation — connectors never write to ClickHouse directly.
-**Metabase** — Embedded analytics platform pre-configured with Access Analyzer dashboards and reports. Connects to both PostgreSQL and ClickHouse via JDBC. Users access Metabase through the web app with no separate login required.
+**Metabase** — Embedded analytics platform pre-configured with Access Analyzer dashboards and reports. Connects to both PostgreSQL and ClickHouse via JDBC. Users access Metabase through the web app and don't need a separate login.
### Data Stores
diff --git a/docs/activitymonitor/10.0/admin/agents/activedirectory.md b/docs/activitymonitor/10.0/admin/agents/activedirectory.md
index 08f7ef01f1..7cb01c178e 100644
--- a/docs/activitymonitor/10.0/admin/agents/activedirectory.md
+++ b/docs/activitymonitor/10.0/admin/agents/activedirectory.md
@@ -8,20 +8,20 @@ sidebar_position: 40
Before deploying the Active Directory (AD) agent, ensure all
[AD Agent Server Requirements](/docs/activitymonitor/10.0/requirements/adagent/adagent.md) have been met. To effectively
-monitor Active Directory, it is necessary to deploy an AD agent to every domain controller,
-including the read only domain controllers. However, it is possible to deploy the agents in batches.
-Follow the steps to deploy the AD agents to the domain controllers in the target domain.
+monitor Active Directory, you must deploy an AD agent to every domain controller,
+including the read only domain controllers. However, you can deploy the agents in batches.
+To deploy the AD agents to the domain controllers in the target domain:
:::note
These steps are specific to deploying AD agents for monitoring Active Directory.
:::
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
-**Step 2 –** Click on the Install agents on Active Directory domain controllers link to deploy
+**Step 2 –** Click the Install agents on Active Directory domain controllers link to deploy
activity agents to multiple domain controllers.
:::note
@@ -32,7 +32,7 @@ The Activity Monitor will validate the entered Host Name or IP Address entered
-**Step 3 –** Specify the port that should be used by the new agent(s).
+**Step 3 –** Specify the port that should be used by the new agents.
@@ -50,10 +50,10 @@ is a member of BUILTIN\Administrators group on the domain. Then, click **Connect
-When the connection is successful, the Next button is enabled. Click Next to continue.
+When the connection succeeds, the system enables the Next button. Click Next to continue.
:::note
-An Administrator’s credentials are required to test the connection to the server. This is
+You must use administrator credentials to test the connection to the server. This is
the only way to enable the Next button.
:::
@@ -77,25 +77,23 @@ controllers to monitor all activity of the domain.
-**Step 8 –** Click the **Test** button to verify the connection to the domains selected. Once the
+**Step 8 –** Click the **Test** button to verify the connection to the domains selected. After the
connection is verified, click **Next** to continue.
**Step 9 –** On the Windows Agent Settings page, there are two settings to configure.
-- Add Windows file activity monitoring – Select the check box to add Windows file activity
- monitoring after installing the agent. By default a new agent install monitors nothing. If
- administrators want to monitor file activity on Windows servers, it is easier to enable it after
- installation of the agent. Windows file activity monitoring can be enabled and configured later in
- the console.
+- Add Windows file activity monitoring – Select the checkbox to add Windows file activity
+ monitoring after installing the agent. By default a new agent install monitors nothing. Enable
+ Windows file activity monitoring after agent installation if you need to monitor file activity on
+ Windows servers. You can also enable and configure it later in the console.
- Management Group – By default, the agent only accepts commands from members of the
- BUILTIN\Administrators group. Less privilege accounts can be configured to manage the agent with
- the Management Group setting. Keep in mind that only administrators can install, update and
+ BUILTIN\Administrators group. You can configure less privileged accounts to manage the agent with
+ the Management Group setting. Only administrators can install, update, and
uninstall the agent.
-**Step 10 –** Click **Finish**. The Add New Agent(s) window closes, and the activity agent is
-deployed to and installed on the target host.
+**Step 10 –** Click **Finish**. The Add New Agents window closes, and Activity Monitor deploys and installs the activity agent on the target host.
During the installation process, the status will be Installing. If there are any errors, the
Activity Monitor stops the installation and lists the errors in the Agent messages box.
diff --git a/docs/activitymonitor/10.0/admin/agents/linux.md b/docs/activitymonitor/10.0/admin/agents/linux.md
index 62aed309a3..952831c5d7 100644
--- a/docs/activitymonitor/10.0/admin/agents/linux.md
+++ b/docs/activitymonitor/10.0/admin/agents/linux.md
@@ -13,22 +13,20 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Manager
-Prior to adding a Windows host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Windows host to the Activity Monitor, the prerequisites for the target environment
must be met. See the [Linux Agent Server Requirements](/docs/activitymonitor/10.0/requirements/linuxagent.md) topic
for additional information.
## Deploy Linux Agent
-Follow the steps to deploy the agent to the Linux host.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
-
-
+
**Step 2 –** On the Install New Agent page, enter the server name for the Linux host. Click
**Next**.
@@ -40,7 +38,7 @@ is **4498**. Click **Next**.
-**Step 4 –** On the Credentials To Connect To The Server(s) page, connect to the Linux Server using
+**Step 4 –** On the Credentials To Connect To The Servers page, connect to the Linux Server using
either a **User name** and **Password**, or a Public Key.
The options for connecting with a Password are:
@@ -81,8 +79,8 @@ cat ~/.ssh/id_ecdsa.pub >> ~/.ssh/authorized_keys
```
:::note
-It is required to add public key to authorized keys for Activity Monitor. By default, a
-private key is generated at ~/.ssh/id_ecdsa location along with the public key (.pub file). A user
+You must add the public key to authorized keys for Activity Monitor. By default, a
+private key is generated at ~/.ssh/id_ecdsa location along with the public key (.pub file). You
can use a different file location. Copy the following command into a command prompt to generate a
private key for Activity Monitor to use:
:::
@@ -101,24 +99,22 @@ the failed connection.
**Step 6 –** On the Linux Agent Options page, select which user name to use to run the daemon. To
use root, leave the **Service user name** field blank. Click **Test** to test the connection.
-**Step 7 –** Click **Finish**. The Add New Agent(s) window closes, and the activity agent is
-deployed to and installed on the target host.
+**Step 7 –** Click **Finish**. The Add New Agents window closes, and Activity Monitor deploys and installs the activity agent on the target host.
During the installation process, the status will be **Installing**. If there are any errors,
Activity Monitor stops the installation and lists the errors in the **Agent messages** box.
-When the Linux agent installation is complete, the status changes to **Installed**. The Monitored
-Host is also configured, and the added Linux host is displayed in the monitored hosts table. See the
+When the Linux agent installation is complete, the status changes to **Installed**. The system configures the monitored host, and the added Linux host appears in the monitored hosts table. See the
[Monitored Hosts & Services Tab](/docs/activitymonitor/10.0/admin/monitoredhosts/overview.md) topic for additional information.
-Once a host has been added for monitoring, configure the desired outputs. See the
+Once a host has been added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic for additional information.
:::info
Activity Monitor Agent uses certificates to secure the connection between the Linux Agent and the Console / API Server.
-By default, the Agent uses an automatically generated self-signed certificate. The Console and the API Server do not enforce
+By default, the Agent uses an automatically generated self-signed certificate. The Console and the API Server don't enforce
validity checks on these self-signed agent certificates.
This self-signed certificate can be replaced with one issued by a Certification Authority. Once replaced, the Console and
diff --git a/docs/activitymonitor/10.0/admin/agents/multiple.md b/docs/activitymonitor/10.0/admin/agents/multiple.md
index 3aeb4ef293..499b19bc92 100644
--- a/docs/activitymonitor/10.0/admin/agents/multiple.md
+++ b/docs/activitymonitor/10.0/admin/agents/multiple.md
@@ -7,8 +7,7 @@ sidebar_position: 20
# Multiple Activity Agents Deployment
Before deploying the activity agent, ensure all Prerequisites are met, including those for NAS
-devices when applicable. Follow the steps to deploy the activity agent to a multiple Windows
-servers. See the [Activity Agent Server Requirements](/docs/activitymonitor/10.0/requirements/activityagent/activityagent.md) topic
+devices when applicable. See the [Activity Agent Server Requirements](/docs/activitymonitor/10.0/requirements/activityagent/activityagent.md) topic
for additional information.
:::note
@@ -17,7 +16,7 @@ environments.
:::
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
@@ -44,7 +43,7 @@ There are two methods for adding multiple hosts are:
**Manual Entry**
-Use **Manual Entry** to manually type the host names or IP addresses of the servers to be monitored.
+Use **Manual Entry** to manually enter the host names or IP addresses of the servers to be monitored.
@@ -76,9 +75,9 @@ For Import a List:
The Activity Monitor will monitor the Host Names or IP Address added to the **Install Agents on
Multiple Hosts** table. Click **Next**.
-
+
-**Step 5 –** On the Credentials To Connect To The Server(s) page, connect to the server using either
+**Step 5 –** On the Credentials To Connect To The Servers page, connect to the server using either
a **User name** and **password**, a Public Key, or a Client Certificate.
The options for connecting with a Password are:
@@ -86,7 +85,7 @@ The options for connecting with a Password are:
- User name
- Password
-
+
The options for connecting with a Public Key are:
@@ -107,7 +106,7 @@ Using an existing Client Certificate installs a new agent without using SSH.
**Step 6 –** Click **Connect** to test the connection. If the connection is successful, click
**Next**.
-The credentials are tested against each server added on the **Install Agent(s) on Multiple Hosts**
+The credentials are tested against each server added on the **Install Agents on Multiple Hosts**
page. If the connection is unsuccessful, see the status message that appears for information on the
failed connection. Activity agents are only successfully deployed for servers where the test status
returns Ok. Failed deployments can be retried through the Connection tab of the agent’s Properties
@@ -126,12 +125,11 @@ The default path is `C:\Program Files\Netwrix\Activity Monitor\Agent`. Click **N
monitoring after installation checkbox to enable monitoring all file system activity on the
targeted Windows server after installation.
- Management Group — By default, the agent only accepts commands from members from the
- BUILTIN\Administrators group. Less privileged accounts can be used to manage the agent with the
- Management group setting. Keep in mind that an administrator account must be used to install,
+ BUILTIN\Administrators group. You can configure less privileged accounts to manage the agent with the
+ Management group setting. You must use an administrator account to install,
upgrade, or uninstall an agent.
-**Step 9 –** Click Finish. The Add New Agent(s) window closes, and the activity agent is deployed to
-and installed on the target host.
+**Step 9 –** Click Finish. The Add New Agents window closes, and Activity Monitor deploys and installs the activity agent on the target host.
During the installation process, the status will be **Installing**. If there are any errors, the
Activity Monitor stops the installation for that host and lists the errors in the **Agent messages**
diff --git a/docs/activitymonitor/10.0/admin/agents/overview.md b/docs/activitymonitor/10.0/admin/agents/overview.md
index 3dc32240de..6856bc34c6 100644
--- a/docs/activitymonitor/10.0/admin/agents/overview.md
+++ b/docs/activitymonitor/10.0/admin/agents/overview.md
@@ -6,15 +6,15 @@ sidebar_position: 10
# Agents Tab
-The **Agents** tab is used to deploy activity agents and manage settings. This is the only tab
+Use the **Agents** tab to deploy activity agents and manage settings. This is the only tab
available until an agent is installed.
The Agents tab is comprised of a button bar, a table of servers hosting activity agents, and an
-Agent Messages box. The button bar allows users to take the following actions:
+Agent Messages box. The button bar provides the following actions:
-- Add Agent – Opens the Add New Agent(s) window to deploy the activity/AD agent to a single server
+- Add Agent – Opens the Add New Agents window to deploy the activity/AD agent to a single server
or to multiple servers at the same time. The following sections provide additional information:
- [Single Activity Agent Deployment](/docs/activitymonitor/10.0/admin/agents/single.md)
@@ -37,7 +37,7 @@ Agent Messages box. The button bar allows users to take the following actions:
- Install – Deploy or upgrade an activity agent to the selected host
- Upgrade – [When Agent Status is Outdated] Replaces outdated activity agent with current version
-- Update AD Module Installer – Allows you to select the newer AD Module installer. A confirmation
+- Update AD Module Installer – Select the newer AD Module installer. A confirmation
window then opens and identifies the new installer version. See the
[Update AD Module Installer](/docs/activitymonitor/10.0/install/upgrade/updateadagentinstaller.md) topic for additional
information.
@@ -46,7 +46,7 @@ Agent Messages box. The button bar allows users to take the following actions:
The table of servers hosting activity agents provides the following information:
- Server Name – Name or IP Address of the server hosting an activity agent
-- Status – Status of the deployed activity agent(s)
+- Status – Status of the deployed activity agents
:::note
If the AD agent has been deployed, a status of “outdated” could apply to either the
@@ -58,8 +58,8 @@ The table of servers hosting activity agents provides the following information:
- AD Module – Version of the deployed AD Module, used for Active Directory monitoring
- Domain – Name of the domain
- Messages – Count of the number of error and warning messages for the selected server
-- Archive Location – If archiving is enabled for the activity agent, displays the archive file path
-- Archive Size – If archiving is enabled for the activity agent, displays the archive size
+- Archive Location – Displays the archive file path when you enable archiving for the activity agent
+- Archive Size – Displays the archive size when you enable archiving for the activity agent
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/activedirectory.md b/docs/activitymonitor/10.0/admin/agents/properties/activedirectory.md
index fce945254a..a9db50ebcb 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/activedirectory.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/activedirectory.md
@@ -12,7 +12,7 @@ be enabled for agents on domain controllers.
-The Agent Settings allow users to control the AD agent’s properties:
+The Agent Settings let you control the AD agent’s properties:
- Harden the Agent – Protects the AD agent from being altered, stopped, or started from within the
local Service Control Manager
@@ -23,7 +23,7 @@ The Agent Settings allow users to control the AD agent’s properties:
This is a safety measure that disables monitoring if the environment changes as in
rare cases the instrumentation may cause LSASS crashes. Should the version change occur, a
warning will be shown next to the agent on the Agents page. The **Start pending AD Module** button
- allows you to force the agent to enable monitoring.
+ lets you force the agent to enable monitoring.
:::
@@ -32,7 +32,7 @@ The Agent Settings allow users to control the AD agent’s properties:
:::note
This provides more uniform data, but may have a performance impact on the machine
- where the AD agent is deployed, especially if that machine does not handle the name resolution
+ where the AD agent is deployed, especially if that machine doesn't handle the name resolution
locally.
:::
@@ -50,7 +50,7 @@ See the following sections for additional information:
## Configuring Threat Prevention to Send Active Directory Activity to Activity Monitor
-Once the activity agent is deployed to a domain controller with an existing Threat Prevention agent,
+After the activity agent is deployed to a domain controller with an existing Threat Prevention agent,
a connection can be secured between both agents. Follow these instructions to configure the policy
used for Active Directory Activity Monitoring from the Threat Prevention Admin Console.
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/additionalproperties.md b/docs/activitymonitor/10.0/admin/agents/properties/additionalproperties.md
index 600db09f0d..51a4bc3f2e 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/additionalproperties.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/additionalproperties.md
@@ -17,7 +17,7 @@ The Additional Properties tab for the Activity Agent has the following configura
- Comment – Create an annotation for the agent in the **Comment** text box. Annotations entered here
will appear in the Comment column in the table on the Agents tab.
-- Agent's Trace Level – Select a trace level for the agent log from the drop-down list:
+- Agent's Trace Level – Select a trace level for the agent log from the dropdown list:
- Same Level as the Console (uses the global level selected in the console)
- Trace (the most verbose) many collection points and can slow down
@@ -34,7 +34,7 @@ The Additional Properties tab for the Activity Agent has the following configura
- Error
- Fatal
-In certain situations, the trace logs are not enough to identify issues. Collect extended debugging
+In certain situations, the trace logs aren't enough to identify issues. Collect extended debugging
data (ETW) can be useful for problems related to the following:
- Not getting events
@@ -47,7 +47,7 @@ When this is needed, enable the **Collect extended debugging data (ETW) from the
the Trace level is activated** option to diagnose these problems.
:::warning
-Selecting this option collects a large amount of data. Therefore, it is important to
+Selecting this option collects a large amount of data. Therefore,
enable it only for short periods of time. Otherwise, the trace file may overflow with data.
:::
@@ -66,7 +66,7 @@ The Additional Properties tab for the Linux Agent has the following configuratio
- Comment – Create an annotation for the agent in the **Comment** text box. Annotations entered here
will appear in the Comment column in the table on the Agents tab.
-- Agent's Trace Level – Select a trace level for the agent log from the drop-down list:
+- Agent's Trace Level – Select a trace level for the agent log from the dropdown list:
- Same Level as the Console (uses the global level selected in the console)
- Trace (the most verbose) many collection points and can slow down
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/adusers.md b/docs/activitymonitor/10.0/admin/agents/properties/adusers.md
index 512720dcf5..8d9a307e12 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/adusers.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/adusers.md
@@ -12,22 +12,20 @@ Use the AD Users tab to customize Active Directory service queries and caching b
The configurable options are:
-- Domain Controllers (IPs and FQDNs) – IP addresses or FQDN of domain controllers. IP addresses or
- FQDN should be entered as separate addresses with space, comma (,), semicolon (;), or a multi-line
+- Domain Controllers (IPs and FQDNs) – IP addresses or FQDN of domain controllers. Enter IP addresses or
+ FQDNs as separate addresses with space, comma (,), semicolon (;), or a multi-line
list. Leave the box blank to use the default domain controller.
- Lookup timeout – Specify the time for look-up timeout in milliseconds. The default is 2000
milliseconds. If a query fails to complete in the specified interval then the product reports an
empty username or a previous result from the cache. The product continues to wait for a response
in the background so that further events can use the resolution result.
- Cache TTL for successful results –Specify the caching interval (time-to-live) for successful AD
- responses.The default is 10 hours. When an AD query returns a valid username or SID, the response
- is cached for the specified time. It is recommended to use large TTL values as the user
- information does not often change.
+ responses. The default is 10 hours. When an AD query returns a valid username or SID, the response
+ is cached for the specified time. Use large TTL values because user information doesn't often change.
- Cache TTL for failed results – Specify the caching interval (time-to-live) for failed AD
- responses. The default is 1 minute. When an AD query cannot resolve a SID or username, the failed
+ responses. The default is 1 minute. When an AD query can't resolve a SID or username, the failed
result is cached for the specified time. Caching of failed responses helps to reduce the load on
- domain controllers and improve performance of event processing. Short TTL values are recommended
- to make the product report accurate user information.
+ domain controllers and improve performance of event processing. Use short TTL values to make the product report accurate user information.
- Maximum cache size – Specify the maximum cache size for both successful and failed responses. The
default is 300000.
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/apiserver.md b/docs/activitymonitor/10.0/admin/agents/properties/apiserver.md
index 43c5ffc223..ea177c595d 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/apiserver.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/apiserver.md
@@ -13,7 +13,7 @@ activity.
-Check the Enable API access on this agent box to utilize the options on this tab:
+Check the Enable API access on this agent box to use the options on this tab:
- API server port (TCP): [number] (from 1000 to 65535) – Enter the API server port. The default
is 4494.
@@ -40,7 +40,7 @@ Click Add Application to open the Add or edit API client window.
configuration of monitored hosts/domain, enough to match the monitored hosts/services to their log
files.
- Read – Provides a read-only access to the list of the agents and their configuration settings;
- configuration of monitored domains; configuration of monitored hosts/services. The permission does not
+ configuration of monitored domains; configuration of monitored hosts/services. The permission doesn't
provide access to the saved passwords or other secrets.
- Policy change - Provides permissions required to update the AD Monitoring domain configuration
settings
@@ -57,9 +57,8 @@ The options below the API Application Access window are:
- Managing console/Use this console – Use this console button enters the host name of the Activity
Monitor Console within the textbox
-- IPv4 or IPv6 whitelist – IP Addresses of the remote hosts, which are allowed to connect to the API
- port, can be whitelisted by entering them in the box. IP Addresses should be entered as separate
- addresses with space, comma (,), semicolon (;), or a multi-line list. Leave the box blank to
+- IPv4 or IPv6 whitelist – Enter IP addresses of the remote hosts allowed to connect to the API
+ port. Separate addresses with space, comma (,), semicolon (;), or a multi-line list. Leave the box blank to
accept connections from any hosts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The Agent
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/archiving.md b/docs/activitymonitor/10.0/admin/agents/properties/archiving.md
index 7d4d7e0f60..e3b112dee9 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/archiving.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/archiving.md
@@ -23,7 +23,7 @@ is disabled by default.
- Disk Quota — Maximum disk space the agent is allowed to use on the server it is installed on (at
least 100MB) – Select the number of megabytes or gigabytes. The default is 5 GB.
- Archive log files on this computer – Select to archive the logs on the server hosting this
- activity agent. When archiving is enabled, this is the default selection. Click Configure to open
+ activity agent. When you enable archiving, the system defaults to this option. Click Configure to open
the Configure a network share on this computer window and provide the following information:
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/certificate.md b/docs/activitymonitor/10.0/admin/agents/properties/certificate.md
index ea5af4d73a..513f87481f 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/certificate.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/certificate.md
@@ -9,7 +9,7 @@ sidebar_position: 5
Activity Monitor Agent uses certificates to secure the connection between the Linux Agent and the Console / API Server;
between NAS devices and the Agent; between the Agent and REST API users.
-By default, the Agent uses an automatically generated self-signed certificate. The Console and the API Server do not enforce
+By default, the Agent uses an automatically generated self-signed certificate. The Console and the API Server don't enforce
validity checks on these self-signed agent certificates.
This self-signed certificate can be replaced with one issued by a Certification Authority. Once replaced, the Console and
@@ -57,7 +57,7 @@ This CSR file will contain the agent’s hostname, FQDN, static IP addresses, op
The CSR files generated in the previous step must be manually submitted by a user to their Certification Authority. This process must be performed manually, outside of the Activity Monitor, due to the varying workflows and policies inherent to different Certification Authorities.
This step yields a set of certificate files for the agents issued by the Certification Authority based on the CSRs. The CA certificate itself also needs to be collected.
-Make sure that the agent certificates have the `Server Authentication` purpose listed in the Extended Key Usage extension and have DER or PEM encoding.
+ensure that the agent certificates have the `Server Authentication` purpose listed in the Extended Key Usage extension and have DER or PEM encoding.
If you are using OpenSSL’s Micro CA, you can generate a certificate from a CSR file using the `x509 -req` command.
@@ -80,19 +80,19 @@ If your deployment includes multiple Console instances, each instance must be up
## Using Self-Signed Certificates
-The **Manage certificates** wizard can be used to switch to automatically generated self-signed certificates. The wizard presents two options:
+Use the **Manage certificates** wizard to switch to automatically generated self-signed certificates. The wizard presents two options:
1. **Use existing self-signed certificates**
2. **Generate new private key and self-signed certificate**
The first option attempts to locate and apply a previously generated self-signed certificate, if one exists, that was in use prior
-to application of a CA-issued certificate. If the certificate does not exist, a new one will be created.
+to application of a CA-issued certificate. If the certificate doesn't exist, a new one will be created.
This approach may be beneficial in deployments with multiple instances of the Console or API Server that still rely on this specific
self-signed certificate, so its restoration would reinstate their operational status.
The second option will generate a new private key and a corresponding self-signed certificate for the agent.
-In the event of a suspected compromise of the agent's private key, this option should be employed.
+If there is a suspected compromise of the agent's private key, use this option.
The **Apply Changes** button immediately applies the changes to the agents.
@@ -142,7 +142,7 @@ Parameters:
* `ca-file` - Path to the CA certificate file.
* `file` - Path to the agent's certificate file to apply.
-* `what-if` (optional) - If specified, the CA and agent certificates are validated, but the new certificate is not applied.
+* `what-if` (optional) - If specified, the CA and agent certificates are validated, but the new certificate isn't applied.
Use this option to check the certificates before applying.
### **Use Self-Signed Certificate**
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/connection.md b/docs/activitymonitor/10.0/admin/agents/properties/connection.md
index 3434ba242b..ea47476f7c 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/connection.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/connection.md
@@ -6,12 +6,12 @@ sidebar_position: 1
# Connection Tab
-The Connection tab allows users to modify the agent host server name and the credentials used for
+The Connection tab lets you modify the agent host server name and the credentials used for
installation and communication. The tab varies based on the type of agent selected.
## For Activity Agent
-The server name can be modified in the text box. Modifying the name value does not move the activity
+The server name can be modified in the text box. Modifying the name value doesn't move the activity
agent to a new server. The credentials can be updated or modified as well.
:::tip
@@ -37,14 +37,14 @@ This account must be:
- Membership in the local Administrators group
-If the user name is not specified, the currently logged in user's account will be used.
+If the user name isn't specified, the logged in user's account will be used.
**Less Privileged Permissions Option**
By default, the agent accepts commands only from members of the local Administrators group. You can
allow less privileged accounts to manage the agent with the **Management Group** option. Keep in
mind that you still need to be an administrator to install, upgrade, or uninstall the agent. The
-Management Group applies to the users of the console and API servers. The Management Group does not
+Management Group applies to the users of the console and API servers. The Management Group doesn't
restrict access to the agents, but grants access to its members in addition to existing members of
the local Administrators group.
@@ -52,17 +52,15 @@ The Specify account or group window is opened from a field where a Windows accou
-Follow the steps to use this window.
-
-**Step 1 –** Select the Domain from the drop-down menu.
+**Step 1 –** Select the Domain from the dropdown menu.
**Step 2 –** Enter the Account in the textbox.
-- Accounts can be entered in NTAccount format, UPN format, or SID format.
+- Enter accounts in NTAccount format, UPN format, or SID format.
- Use the ellipsis (…) button to open the Select Users, Computers, Service Accounts, or Groups
window to browse for an account.
-**Step 3 –** Then click Resolve. A message displays indicating whether or not the account could be
+**Step 3 –** Then click Resolve. A message displays indicating whether the account could be
resolved.
**Step 4 –** If successful, click OK.
@@ -75,7 +73,7 @@ Properties window closes.
## For Linux Agent
-The server name can be modified in the text box. Modifying the name value does not move the Linux
+The server name can be modified in the text box. Modifying the name value doesn't move the Linux
agent to a new server. The credentials can be updated or modified as well.
:::tip
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/dellceeoptions.md b/docs/activitymonitor/10.0/admin/agents/properties/dellceeoptions.md
index ee42ca935b..88d129ab84 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/dellceeoptions.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/dellceeoptions.md
@@ -7,7 +7,7 @@ sidebar_position: 70
# Dell CEE Options Tab
The Dell CEE Options tab provides options to configure Dell Common Event Enabler (CEE) settings for
-monitoring Dell devices. File activity monitoring leverages the Dell CEE to deliver activity events
+monitoring Dell devices. File activity monitoring uses the Dell CEE to deliver activity events
from Dell devices.
CEE supports two protocols to deliver events to Activity Monitor: RPC and HTTP. An agent can receive
@@ -31,8 +31,7 @@ The options are:
- Synchronous real-time delivery – Events are delivered immediately as they occur, one by one.
- Asynchronous bulk delivery (VCAPS) - Events are delivered in batches with a cadence based on a
- time period or a number of events. As this mode provides better throughput, it is recommended
- for heavily loaded servers. If selected, specify how often events are delivered by Dell CEE
+ time period or a number of events. This mode is recommended for heavily loaded servers as it provides better throughput. If selected, specify how often events are delivered by Dell CEE
using the following options:
- Every [number] seconds (from 60 to 600) - Default is 60 seconds
@@ -62,8 +61,8 @@ Properties window closes.
## Windows CEE Manual Configuration
-Windows CEE is configured with the windows registry and depends on the selected event delivery mode,
-AUDIT or VCAPS.
+Windows CEE configuration uses the windows registry and depends on the selected event delivery mode,
+AUDIT, or VCAPS.
For the synchronous real-time delivery mode (AUDIT), use the following steps.
@@ -72,7 +71,7 @@ For the synchronous real-time delivery mode (AUDIT), use the following steps.
**Step 2 –** Set the `Enabled` parameter to 1.
-**Step 3 –** If the `EndPoint` parameter is empty, set it to the string listed below. If it is not
+**Step 3 –** If the `EndPoint` parameter is empty, set it to one of the following strings. If it isn't
empty (i.e. some other 3rd party application is also receiving activity events from CEE), append the
following string to the existing `EndPoint` value, separating them with a semicolon.
@@ -89,7 +88,7 @@ For the asynchronous bulk delivery mode with a cadence based on a time period or
**Step 2 –** Set the `Enabled` parameter to 1.
-**Step 3 –** If the `EndPoint` parameter is empty, set it to the string listed below. If it is not
+**Step 3 –** If the `EndPoint` parameter is empty, set it to one of the following strings. If it isn't
empty (i.e. some other 3rd party application is also receiving activity events from CEE), append the
following string to the existing `EndPoint` value, separating them with a semicolon.
@@ -219,7 +218,7 @@ Here's an example for the asynchronous delivery (VCAPS):
```
-Make sure to set `Enabled` to `1` only in `Audit` or `VCAPS` if Activity Monitor is the only product
+ensure to set `Enabled` to `1` only in `Audit` or `VCAPS` if Activity Monitor is the only product
receiving activity from CEE. Otherwise, enable the modes according to all product requirements.
If you want to send activity to several 3rd party applications, separate them with semicolons.
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/diskquota.md b/docs/activitymonitor/10.0/admin/agents/properties/diskquota.md
index 695a8f4d98..75108a26f9 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/diskquota.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/diskquota.md
@@ -6,7 +6,7 @@ sidebar_position: 7
# Disk Quota Tab
-The **Disk Quota Tab** is used to limit the size of logs to save disk space.
+Use the **Disk Quota Tab** to limit the size of logs and save disk space.
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/dns.md b/docs/activitymonitor/10.0/admin/agents/properties/dns.md
index 5f116d918b..5bc257db44 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/dns.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/dns.md
@@ -15,7 +15,7 @@ The configurable options are:
- Enable local DNS cache service – Select this checkbox to enable the local DNS cache service. Leave
the option unchecked to disable the local DNS cache service. The DNS cache service proactively
updates data, keeping DNS records up to date and available for real-time event reporting. Use this
- option if your DNS infrastructure cannot handle the load (requests take hundreds of milliseconds)
+ option if your DNS infrastructure can't handle the load (requests take hundreds of milliseconds)
during peak hours.
- DNS servers (IPs) – IP addresses of the DNS servers to be used for look-ups. IP addresses should
be entered as separate addresses with space, comma (,), semicolon (;), or a multi-line list. Leave
@@ -31,15 +31,15 @@ The configurable options are:
the load on DNS servers but may result in stale data being reported.
If the DNS Cache service is used, the records are automatically updated when the TTL expires.
- Cache TTL for failed results – Specify the caching interval (time-to-live) for failed DNS
- responses. The default is 1 minute. When a DNS query cannot resolve an IP address or host-name,
+ responses. The default is 1 minute. When a DNS query can't resolve an IP address or host-name,
the failed result is cached for the specified time. Caching of failed responses helps to reduce
the load on DNS servers and improve performance of event processing.
If the DNS Cache service is used, the records are automatically updated when the TTL expires.
- Maximum cache size – Specify the maximum cache size. The default is 100000.
- Refresh throttle time – Specify the time interval between DNS queries that the DNS Cache service
uses to update expired records. The default is 1000 milliseconds.
- If the DNS Cache service is used, the records are automatically updated when the TTL expires. This
- option allows you to limit the number of DNS requests the service sends to update the cache. A
+ If the DNS Cache service is used, the records are automatically updated when the TTL expires. Use this
+ option to limit the number of DNS requests the service sends to update the cache. A
throttling period of 100 milliseconds will limit the update task to 10 requests per second.
- Parallelism – Specify how many DNS requests the DNS Cache service is allowed to send in parallel.
High values may overload DNS servers.
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/inactivityalerts.md b/docs/activitymonitor/10.0/admin/agents/properties/inactivityalerts.md
index bf22fbcd1b..0f3d64ad9d 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/inactivityalerts.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/inactivityalerts.md
@@ -35,10 +35,10 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:PORT format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:PORT format
in the text box. The server name can be short name, fully qualified name (FQDN), or IP Address, as
long as the organization’s environment can resolve the name format used.
-- Syslog protocol – Identify the **Syslog protocol** to be used for the alert. The drop-down menu
+- Syslog protocol – Identify the **Syslog protocol** to be used for the alert. The dropdown menu
includes:
- UDP
@@ -46,7 +46,7 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
- TLS
:::note
- The TCP and TLS protocols add the **Message framing** drop-down menu. **Message
+ The TCP and TLS protocols add the **Message framing** dropdown menu. **Message
framing** options include:
:::
@@ -61,7 +61,7 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
connection. A connection status message displays with either a green check mark or a red X
identifying the success of the sent test message. Messages vary by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -71,7 +71,7 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
-Custom templates can be created. Select the desired template or create a new template by modifying
+Custom templates can be created. Select the template you want or create a new template by modifying
an existing template within the Syslog Message Template window. The new message template is named
Custom.
@@ -84,7 +84,7 @@ configured interval. The alert is sent to the configured recipients on the Email
-- Syslog server in SERVER[:PORT] format – Type the **SMTP server name** with a SERVER:PORT format in
+- Syslog server in SERVER[:PORT] format – Enter the **SMTP server name** with a SERVER:PORT format in
the text box. The server name can be short name, fully qualified name (FQDN), or IP Address, as
long as the organization’s environment can resolve the name format used.
@@ -98,7 +98,7 @@ configured interval. The alert is sent to the configured recipients on the Email
- Message subject – Click the ellipsis (…) to open the Message Template window to customize the
- subject. Macros can be used to insert
+ subject. Use macros to insert variable values into the subject
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/netappfpolicyoptions.md b/docs/activitymonitor/10.0/admin/agents/properties/netappfpolicyoptions.md
index fca6569f53..71fee09cb4 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/netappfpolicyoptions.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/netappfpolicyoptions.md
@@ -15,7 +15,7 @@ The available options are:
- FPolicy server port (TCP): [number] (from 1000 to 65535) – Enter the FPolicy server port. The
default is 9999.
-- FPolicy authentication – Select from the following options in the drop-down list. For TLS server
+- FPolicy authentication – Select from the following options in the dropdown list. For TLS server
authentication, a Server certificate is required. For TLS, mutual authentication, a Server
certificate and Client certificate are required.
@@ -26,9 +26,8 @@ The available options are:
and import a certificate, and Client certificate to open the Trusted client or CA certificate
window to import a certificate
-- IPv4 or IPv6 whitelist – IP Addresses of the Clustered Data ONTAP nodes, which are allowed to
- connect to the FPolicy server, can be whitelisted by entering them in the box. IP Addresses should
- be entered as separate addresses with space, comma, semicolon, or a multi-line list. Leave the box
+- IPv4 or IPv6 whitelist – Enter IP addresses of the Clustered Data ONTAP nodes allowed to
+ connect to the FPolicy server. Separate addresses with space, comma, semicolon, or a multi-line list. Leave the box
blank to accept connections from any hosts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The Agent
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/networkproxy.md b/docs/activitymonitor/10.0/admin/agents/properties/networkproxy.md
index 2fece877f8..eca5ece2c4 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/networkproxy.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/networkproxy.md
@@ -24,9 +24,9 @@ The configurable options are:
- User name – Specify a user name for the proxy server
- User password – Specify a password for the user name
-- Bypass list – Specify the Bypass list. This is a list of URIs that do not use the proxy server
- when accessed. Multiple addresses can be entered separated by space, comma (,), semicolon (;), or
- as a multi-line list.
+- Bypass list – Specify the Bypass list. This is a list of URIs that don't use the proxy server
+ when accessed. Separate multiple addresses with space, comma (,), semicolon (;), or
+ on separate lines.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The Agent
Properties window closes.
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/nutanix.md b/docs/activitymonitor/10.0/admin/agents/properties/nutanix.md
index 5d2e676f48..a169de81c7 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/nutanix.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/nutanix.md
@@ -14,12 +14,12 @@ The available Agent server settings for Nutanix are:
- Agent server port (TCP) – Enter the TCP port that Nutanix will use to connect to the agent. The
agent will add the port to the firewall exclusions automatically. The default is 4501.
-- IPv4 or IPv6 allowlist – Specify the IP addresses of the Nutanix nodes, which are allowed to
- connect to the agent server port. Multiple addresses can be entered separated by space, comma (,),
- semicolon (;), or as a multi-line list. Leave the box blank to accept connections from any hosts.
+- IPv4 or IPv6 allowlist – Specify the IP addresses of the Nutanix nodes allowed to
+ connect to the agent server port. Separate multiple addresses with space, comma (,),
+ semicolon (;), or on separate lines. Leave the box blank to accept connections from any hosts.
:::note
- This setting is optional and it allows you to improve security by limiting the number
+ This setting is optional and improves security by limiting the number
of IP addresses allowed to connect.
:::
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/overview.md b/docs/activitymonitor/10.0/admin/agents/properties/overview.md
index 3a7cf198c2..01045413f6 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/overview.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/overview.md
@@ -28,6 +28,6 @@ tabs:
- [Qumulo Tab](/docs/activitymonitor/10.0/admin/agents/properties/qumulo.md) – Activity Agent only
- [Additional Properties Tab](/docs/activitymonitor/10.0/admin/agents/properties/additionalproperties.md)
-Select the desired agent and click **Edit** to open the agent’s Properties window.
+Select the agent you want and click **Edit** to open the agent’s Properties window.
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/panzura.md b/docs/activitymonitor/10.0/admin/agents/properties/panzura.md
index f20d618439..d2ec98d978 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/panzura.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/panzura.md
@@ -21,9 +21,8 @@ The available options are:
- Password – Enter a custom password or use the generated password. Click **Copy** to copy the
user name and password to the clipboard.
-- IPv4 or IPv6 allowlist – IP Addresses of the remote hosts, which are allowed to connect to the API
- port, can be whitelisted by entering them in the box. IP Addresses should be entered as separate
- addresses with space, comma (,), semicolon (;), or a multi-line list. Leave the box blank to
+- IPv4 or IPv6 allowlist – Enter IP addresses of the remote hosts allowed to connect to the API
+ port. Separate addresses with space, comma (,), semicolon (;), or a multi-line list. Leave the box blank to
accept connections from any hosts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The Agent
diff --git a/docs/activitymonitor/10.0/admin/agents/properties/qumulo.md b/docs/activitymonitor/10.0/admin/agents/properties/qumulo.md
index 3ae93edd46..87b334d08a 100644
--- a/docs/activitymonitor/10.0/admin/agents/properties/qumulo.md
+++ b/docs/activitymonitor/10.0/admin/agents/properties/qumulo.md
@@ -15,9 +15,9 @@ The available options are:
- Syslog port (TCP) – Enter the TCP port that Qumulo will use to connect to the agent. The agent
will add the port to the firewall exclusions automatically. The default is 4496. The range of
valid values is from 1000 to 65535.
-- IPv4 or IPv6 allowlist – Specify the IP addresses of the Qumulo nodes, which are allowed to
- connect to the agent server port. Multiple addresses can be entered separated by space, comma (,),
- semicolon (;), or as a multi-line list. Leave the box blank to accept connections from any hosts.
+- IPv4 or IPv6 allowlist – Specify the IP addresses of the Qumulo nodes allowed to
+ connect to the agent server port. Separate multiple addresses with space, comma (,),
+ semicolon (;), or on separate lines. Leave the box blank to accept connections from any hosts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The Agent
Properties window closes.
diff --git a/docs/activitymonitor/10.0/admin/agents/single.md b/docs/activitymonitor/10.0/admin/agents/single.md
index 11a2d675ba..97c29e2c03 100644
--- a/docs/activitymonitor/10.0/admin/agents/single.md
+++ b/docs/activitymonitor/10.0/admin/agents/single.md
@@ -8,8 +8,8 @@ sidebar_position: 10
Before deploying the activity agent, ensure all
[Activity Agent Server Requirements](/docs/activitymonitor/10.0/requirements/activityagent/activityagent.md) have been met,
-including those for NAS devices when applicable. Follow the steps to deploy the activity agent to a
-single Windows server.
+including those for NAS devices when applicable. To deploy the activity agent to a
+single Windows server:
:::note
These steps are specific to deploying activity agents for monitoring supported target
@@ -17,7 +17,7 @@ environments.
:::
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
@@ -29,9 +29,9 @@ a single server. Leave the field blank to deploy the agent on the local server.
**Step 3 –** On the Specify Port page, specify the port that should be used by the new agent. The
default port is 4498. Click **Next**.
-
+
-**Step 4 –** On the Credentials To Connect To The Server(s) page, select either Windows or Linux file
+**Step 4 –** On the Credentials To Connect To The Servers page, select either Windows or Linux file
monitoring. Then, enter the **User name** and **Password** to connect to the API Server.
@@ -51,16 +51,15 @@ default path is `C:\Program Files\Netwrix\Activity Monitor\Agent`. Click **Next*
- Windows Activity Monitoring — Check the Add Windows file activity monitoring after installation
checkbox to enable monitoring all file system activity on the targeted Windows server after
- installation. Alternatively, the Windows monitoring can be enabled later on the Monitored Hosts & Services
+ installation. You can also enable Windows monitoring later on the Monitored Hosts & Services
tab.
- Management Group — By default, the agent only accepts commands from members from the
- BUILTIN\Administrators group. Less privileged accounts can be used to manage the agent with the
- Management group setting. Keep in mind that an administrator account must be used to install,
- upgrade or uninstall an agent. The value must be a domain or local security group entered in the
+ BUILTIN\Administrators group. You can configure less privileged accounts to manage the agent with the
+ Management group setting. You must use an administrator account to install,
+ upgrade, or uninstall an agent. The value must be a domain or local security group entered in the
DOMAIN\groupname format.
-**Step 8 –** Click Finish. The Add New Agent(s) window closes, and the activity agent is deployed to
-and installed on the target host.
+**Step 8 –** Click Finish. The Add New Agents window closes, and Activity Monitor deploys and installs the activity agent on the target host.
During the installation process of the agent, the status will display Installing. If there are any
errors, the Activity Monitor stops the installation and lists the errors in the Agent messages box.
diff --git a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/authentication.md b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/authentication.md
index 9e6592f894..62c18310aa 100644
--- a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/authentication.md
+++ b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/authentication.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Authentication Tab
-The Authentication tab on a domain’s Configuration window allows users to configure communication
+Use the Authentication tab on a domain’s Configuration window to configure communication
with servers.
@@ -27,7 +27,7 @@ sub-tabs:
The Forged Privilege Account Certificate (PAC) analytic type identifies Kerberos tickets with a
modified PAC. By manipulating the PAC, a field in the Kerberos ticket that contains a user’s
-authorization data (in Active Directory this is group membership), an attacker is able to grant
+authorization data (in Active Directory this is group membership), an attacker can grant
themselves additional elevated privileges.
@@ -36,7 +36,7 @@ Double-click text box to enter specific **RIDs**. Click OK. The AD agent then co
PAC and user’s access token for a mismatch to trigger the incident.
:::note
-The Forged PAC analytic is monitoring for when the user is not a member of a group that is
+The Forged PAC analytic is monitoring for when the user isn't a member of a group that is
listed in the PAC section of the user’s Kerberos ticket. This analytic can be scoped to monitor
specific groups. To reduce the number of false positives, the AD agent only checks for a mismatch of
sensitive groups as selected in the policy Settings tab.
@@ -91,7 +91,7 @@ Underneath each section, there is an additional Address detail:
- Value – Must be provided in IP address format
-Double-click the text box beneath **Value** to enter the desired IP Addresses to include or exclude.
+Double-click the text box beneath **Value** to enter the IP addresses you want to include or exclude.
Press the Enter or Tab key to add another text box.
## IP Addresses (To)
@@ -106,7 +106,7 @@ Underneath each section, there is an additional Address detail:
Value – Must be provided in IP address format
-Double-click the text box beneath **Value** to enter the desired IP Addresses to include or exclude.
+Double-click the text box beneath **Value** to enter the IP addresses you want to include or exclude.
Press the Enter or Tab key to add another text box.
## Operations
@@ -122,14 +122,14 @@ failed events, or both:
- Failure – Monitors failed events
The **Monitor These Protocols** section is where authentication protocols to be monitored are
-selected for the policy. Check the box to select the authentication protocol(s) to be monitored:
+selected for the policy. Check the box to select the authentication protocols to be monitored:
- All
- Kerberos
- NTLM
:::warning
-If Login Type is enabled, authentication events will be received from Domain
+When you enable Login Type, the system receives authentication events from Domain
Controllers only.
:::
@@ -140,7 +140,7 @@ Local Interactive and/or Remote Interactive logins to the Domain Controllers:
- All - Report all authentication activity approved by the Domain Controller which includes any
local or RDP direct connections to the DC.
- - Local - Report only local login to the Domain Controller - ignore all else
+ - Local - Report only local log in to the Domain Controller - ignore all else
- Remote - Report only remote/RDP access to the Domain Controller - ignore all else
- Exclude failed authentications with previously valid (N-2) password – If enabled, allows to ignore
@@ -157,7 +157,7 @@ The Servers option targets servers to be included or excluded when filtering for
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another text box.
## Users
@@ -184,7 +184,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath **Type** to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath **Type** to enter the AD object you want to include or
exclude. Press the Enter or Tab key to add another text box. Check the box under **Subtree** to
include or exclude child contexts.
diff --git a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/changes.md b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/changes.md
index cbda892375..4fd05565a9 100644
--- a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/changes.md
+++ b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/changes.md
@@ -32,8 +32,8 @@ based on the new value.
-Double-click the text box beneath Name to enter the desired attribute to include or exclude.
-Double-click the text box beneath Value to enter the desired attribute value to reference. Choose
+Double-click the text box beneath Name to enter the attribute you want to include or exclude.
+Double-click the text box beneath Value to enter the attribute value you want to reference. Choose
the Operation to relate the Name and Value with. Press the **Enter** or **Tab** key to add another
textbox.
@@ -43,16 +43,16 @@ Name field must contain Active Directory attribute name.
Scoping the filter captures events when the new value matches with the supplied value. To scope the
-filter based on the new value of the attribute, use the Operation drop-down menu.
+filter based on the new value of the attribute, use the Operation dropdown menu.
- AnyValue – No scoping applied for this attribute
- EmptyValue – Blank attribute values
- Equal – Attribute values that are identical to the Value field
-- NotEqual – Attribute values that do not match the Value field
+- NotEqual – Attribute values that don't match the Value field
- LessThan – Attribute values below the supplied numeric value or before alphabetically
- GreaterThan – Attribute values above the supplied numeric value or after alphabetically
- Contains – Attribute values includes the user supplied string (numbers are treated as strings)
-- NotContain – Attribute values do not include the user supplied string (numbers are treated as
+- NotContain – Attribute values don't include the user supplied string (numbers are treated as
strings)
- Startswith – Attribute values start with the user supplied string
@@ -63,7 +63,7 @@ Directory or to exclude specific classes from being monitored.
-Double-click the text box beneath Name to enter the desired classes to include or exclude. Press the
+Double-click the text box beneath Name to enter the classes you want to include or exclude. Press the
**Enter** or **Tab** key to add another text box.
:::note
@@ -88,7 +88,7 @@ Underneath each section, there are additional Context details:
- Distinguished Name – Field must be specified in the form of `distinguishedName` attribute syntax,
e.g. `CN=Users,DC=Domain,DC=com`
-Double-click the text box beneath Distinguished Name to enter the desired context to include or
+Double-click the text box beneath Distinguished Name to enter the context you want to include or
exclude. Press the **Enter** or **Tab** key to add another text box. Check the box under Subtree to
include or exclude child contexts.
@@ -122,7 +122,7 @@ Underneath each section, there is an additional Address detail.
- Value – Must be provided in IP address format
-Double-click the text box beneath **Value** to enter the desired IP addresses to include or exclude.
+Double-click the text box beneath **Value** to enter the IP addresses you want to include or exclude.
Press **Enter** or **Tab** key to add another text box.
## Objects
@@ -137,7 +137,7 @@ Underneath each section, there is an additional Object detail.
- Distinguished Name – Field must be specified in the form of `distinguishedName` attribute syntax,
e.g. `CN=Users,DC=Domain,DC=com`
-Double-click the text box beneath Distinguished Name to enter the desired objects to include or
+Double-click the text box beneath Distinguished Name to enter the objects you want to include or
exclude. Press the **Enter** or **Tab** key to add another text box.
## Operations
@@ -167,7 +167,7 @@ The Servers Tab targets servers to be included or excluded when filtering for ch
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another text box.
## Users
@@ -194,7 +194,7 @@ The following details appear beneath both sections.
e.g. `CN=Users,DC=Domain,DC=com`. However, for objects with `sidType` type, it must be in the form
of WellKnownSidType Enum, e.g. `AnonymousSid` or `LocalSid`.
-Double-click the text box beneath **Distinguished Name** to enter the desired group types to include
-or exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath **Distinguished Name** to enter the group types you want to include
+or exclude. Double-click the text box beneath Type to enter the AD object you want to include or
exclude. Press the **Enter** or **Tab** key to add another text box. Check the box under Subtree to
include or exclude child contexts.
diff --git a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md
index 05af6502bb..91e0590ad8 100644
--- a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md
+++ b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md
@@ -12,14 +12,14 @@ from being monitored.
The filter options are grouped by AD Global Pre-Filters, and Authentication Global Pre-Filters.
-Check the boxes to activate the filters. To disable for diagnostic purposes, simply uncheck the
-option(s) and click OK. All Authentication Global Pre-Filters options require configuration before
+Check the boxes to activate the filters. To disable for diagnostic purposes, uncheck the
+options and click OK. All Authentication Global Pre-Filters options require configuration before
they can be enabled.
Enable all of the AD Global Pre-Filters options as well as the Exclude Logins from Machine Accounts
option in the Authentication Global Pre-Filters section.
-When activated, the AD Agent(s) filters out the event data according to configuration defined in the
+When activated, the AD Agents filters out the event data according to configuration defined in the
`filters.json` file located in the installation directory.
The configurable options in the Global Filters tab are:
@@ -47,7 +47,7 @@ considered ‘noise’ events. This option can be scoped to include any combinat
- lastLogonTimestamp
- AD User Logins with Bad Password – Excludes events with the following set of attributes where
- ‘objectClass’ does not equal computer:
+ ‘objectClass’ doesn't equal computer:
- badPwdCount
- badPasswordTime
@@ -87,8 +87,8 @@ The Exclude Logins from Machine Accounts collection is only accessible for confi
Global Filters tab.
:::note
-Only perpetrators with accounts ending in “$” are considered for this filter. Wild cards
-(\*) can be used for partial matches to account names.
+Only perpetrators with accounts ending in “$” are considered for this filter. Use wild cards
+(\*) for partial matches to account names.
:::
@@ -105,7 +105,7 @@ accounts include
“$” in their names so by default authentication traffic generated by these accounts is filtered out because they ‘look’ like machine accounts, which prior to Server 2012 were the only account names ending in “$”.
The ability to add a list of filter strings to the “Exclude Logins from Machine Accounts” global
filter provides a means to capture activity by gMSA type accounts as this activity is typically of
-interest where as true ‘machine accounts’ is not. By supplying either an explicit list of gMSA
+interest where as true ‘machine accounts’ isn't. By supplying either an explicit list of gMSA
account names, or if a naming convention has been adopted, a set of wild card strings such as
“gMSA\*” or “svc\*”, allows capturing authentication activity from such accounts while ignoring the
noisy ‘machine accounts’.
@@ -119,7 +119,7 @@ selected hosts link to open the Edit Hosts window.
The Exclude Authentication Events from selected hosts collection is only accessible for
configuration through the Global Filters tab. All three methods of identification for a host (IP
-Address, NETBIOS host name, or DNS host name) must be known in order to effectively exclude
+Address, NETBIOS host name, or DNS host name) must be known to effectively exclude
authentication from the host. Identify the host to be excluded in the textbox of the IP Address
column and press the Enter or Tab to add another row on the grid. Activity Monitor attempts to
discover the NETBIOS host name and the DNS host name associated with the supplied IP Address.
diff --git a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md
index 18b3805a24..4a47e73a13 100644
--- a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md
+++ b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# LDAP Monitor Tab
-The LDAP Monitor tab on a domain’s Configuration window allows users to scope monitoring by adding
+The LDAP Monitor tab on a domain’s Configuration window lets you scope monitoring by adding
filters for accounts by name or type.
@@ -20,8 +20,8 @@ sub-tabs:
- Servers
- Users
-Each filter tab acts like an “AND” statement for the filter. Any filter tab left blank is treated
-like an all for that filter set.
+Each filter tab acts like an “AND” statement for the filter. Leave any filter tab blank to
+monitor all items for that filter set.
## Host (From)
@@ -51,7 +51,7 @@ The Query section is where monitoring can be scoped to those LDAP queries that c
of the user-supplied string as a substring in BaseDN or in Query field of the LDAP Search request.
For the Query value, provide the user-supplied string in the text box.
-Double-click the text box beneath Value to enter the desired string. Press the Enter or Tab key to
+Double-click the text box beneath Value to enter a string. Press the Enter or Tab key to
add another text box.
Example Values:
@@ -63,7 +63,7 @@ The Result section is where monitoring can be scoped to those LDAP query results
least one of the user-supplied string as a substring. For the Result value, provide the
user-supplied string in the text box.
-Double-click the text box beneath Value to enter the desired string. Press the Enter or Tab key to
+Double-click the text box beneath Value to enter a string. Press the Enter or Tab key to
add another text box.
Example Value:
@@ -91,7 +91,7 @@ The Servers option targets servers to be included or excluded when filtering for
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another text box.
## Users
@@ -118,7 +118,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath Type to enter the AD object you want to include or
exclude. Press the Enter or Tab key to add another text box. Check the box under Subtree to include
or exclude child contexts.
diff --git a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md
index b1a7554c93..9da9910c4b 100644
--- a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md
+++ b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md
@@ -6,17 +6,15 @@ sidebar_position: 10
# Configure LDAP Monitoring for Netwrix Threat Manager
-Follow the steps to configure LDAP monitoring within Netwrix Activity Monitor for Netwrix Threat
-Manager.
:::note
-LDAP Monitoring is not enabled, it must be enabled in the Monitored Domains tab.
+LDAP Monitoring isn't enabled, it must be enabled in the Monitored Domains tab.
:::
-**Step 1 –** In the Activity Monitor, click on the **Monitored Domains** tab.
+**Step 1 –** In the Activity Monitor, click the **Monitored Domains** tab.
**Step 2 –** Select a domain and click **Edit**.
diff --git a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md
index f40854571c..d6145cb113 100644
--- a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md
+++ b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# LSASS Guardian Tab
-The LSASS Guardian tab allows users to modify settings that were populated with the information
+The LSASS Guardian tab lets you modify settings that were populated with the information
entered when the host was added to prevent, monitor, or block LSASS code injections.
@@ -19,8 +19,8 @@ sub-tabs:
- Servers
- Users
-Each filter tab acts like an "AND" statement for the filter. Any filter tab left blank is treated
-like an "ALL" for that filter set.
+Each filter tab acts like an "AND" statement for the filter. Leave any filter tab blank to
+monitor all items for that filter set.
:::info
Add exclusion process filters for legitimate processes that make changes to
@@ -37,7 +37,7 @@ The Operations option filters for successful events, failed events, or both.
The Open Process Flags section is where monitoring can be scoped for requested handles that would
maliciously impact LSASS processes.
-Check the box to select the process flag(s) to be monitored:
+Check the box to select the process flags to be monitored:
- PROCESS_VM_WRITE – Writes to memory in a process
- PROCESS_CREATE_THREAD – Creates a thread
@@ -49,13 +49,13 @@ malware applications, can be included/excluded from being monitored by the polic
-Double-click the text box beneath Name to enter the desired processes to include or exclude. Press
+Double-click the text box beneath Name to enter the processes you want to include or exclude. Press
the Enter or Tab key to add another text box.
:::note
-While a processes inclusion is a filter option, it is not recommended for monitoring
+While a processes inclusion is a filter option, it isn't recommended for monitoring
LSASS. Adding a process inclusion filter will limit the scope to only monitor that process. Unknown
-malicious processes would not be monitored in this case.
+malicious processes wouldn't be monitored in this case.
:::
@@ -68,7 +68,7 @@ The Servers option targets servers to be included or excluded when filtering for
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the textbox beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the textbox beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another textbox.
## Users
@@ -95,7 +95,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath Type to enter the AD object you want to include or
exclude. Press the Enter or Tab key to add another text box. Check the box under Subtree to include
or exclude child contexts.
diff --git a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/replication.md b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/replication.md
index 42990b4526..5f20cf5a8f 100644
--- a/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/replication.md
+++ b/docs/activitymonitor/10.0/admin/monitoreddomains/admonitoringconfiguration/replication.md
@@ -18,11 +18,11 @@ sub-tabs:
- Servers
- Users
-Each filter tab acts like an “AND” statement for the filter. Any filter tab left blank is treated
-like an ALL for that filter set.
+Each filter tab acts like an “AND” statement for the filter. Leave any filter tab blank to
+monitor all items for that filter set.
-Windows cannot detect if a sync request is coming from a legitimate domain controller. This option
-is designed to monitor requests from computers that are not ‘excluded’ by the policy. Therefore,
+Windows can't detect if a sync request is coming from a legitimate domain controller. This option
+is designed to monitor requests from computers that aren't ‘excluded’ by the policy. Therefore,
legitimate domain controllers should be identified in the event filters.
## Host (From) Filter
@@ -56,7 +56,7 @@ The Servers option targets servers to be included or excluded when filtering for
In both cases, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS Domain
name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another text box.
## Users Filter
@@ -83,7 +83,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath Type to enter the AD object you want to include or
exclude. Press the Enter or Tab key to add another textbox. Check the box under Subtree to include
or exclude child contexts.
diff --git a/docs/activitymonitor/10.0/admin/monitoreddomains/output/activedirectoryjson.md b/docs/activitymonitor/10.0/admin/monitoreddomains/output/activedirectoryjson.md
index c5a046c00b..110bc30cb3 100644
--- a/docs/activitymonitor/10.0/admin/monitoreddomains/output/activedirectoryjson.md
+++ b/docs/activitymonitor/10.0/admin/monitoreddomains/output/activedirectoryjson.md
@@ -49,11 +49,11 @@ into a JSON log file:
| QueryFilter | LDAP filter used in the operation |
| QueryIsSSL | Indicates if LDAP connection is secure or not |
| QueryObjectsReturned | Number of returned objects produced by the LDAP request |
-| Source | Indicates source of the operation. Currently can be: ‘Authentication’, ‘Active Directory’, ‘LSASS Guardian – Monitor’, ‘LDAP Monitor’, ‘AD Replication Monitoring’. |
+| Source | Indicates source of the operation. can be: ‘Authentication’, ‘Active Directory’, ‘LSASS Guardian – Monitor’, ‘LDAP Monitor’, ‘AD Replication Monitoring’. |
| Success | Indicates if original operation completed successfully or not |
| TargetHost | Contains host name to which authentication attempt took place. In case of failed Kerberos AS, this field contains name of the domain controller. |
| TargetHostIP | If resolved, contains IP address of the target host |
-| TargetProcess | Contains process name that is monitored. Currently this is only lsass.exe. |
+| TargetProcess | Contains process name that is monitored. this is only lsass.exe. |
| TgsReplyEncryptionType | Indicates encryption type used in reply part of the TGS Kerberos ticket. Possible values the same as for EncryptionType. |
| TimeLogged | UTC timestamp of the event |
| UserDN | If resolved, contains DN of the object triggered operation |
diff --git a/docs/activitymonitor/10.0/admin/monitoreddomains/output/output.md b/docs/activitymonitor/10.0/admin/monitoreddomains/output/output.md
index 6a12186d49..314c8c2e85 100644
--- a/docs/activitymonitor/10.0/admin/monitoreddomains/output/output.md
+++ b/docs/activitymonitor/10.0/admin/monitoreddomains/output/output.md
@@ -27,15 +27,13 @@ domain. The domain event outputs are:
## Add File Output
-Follow the steps to add a File output.
+**Step 1 –** On the Monitored Domains tab, select the domain you want and click **Add Output**.
-**Step 1 –** On the Monitored Domains tab, select the desired domain and click **Add Output**.
-
-**Step 2 –** Select **File** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **File** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
@@ -45,15 +43,13 @@ information.
## Add Syslog Output
-Follow the steps to add a Syslog output.
-
-**Step 1 –** On the Monitored Domains tab, select the desired domain and click **Add Output**.
+**Step 1 –** On the Monitored Domains tab, select the domain you want and click **Add Output**.
-**Step 2 –** Select **Syslog** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **Syslog** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
@@ -71,16 +67,14 @@ additional information.
:::
-Follow the steps to add a Netwrix Threat Manager output.
-
-**Step 1 –** On the Monitored Domains tab, select the desired domain and click **Add Output**.
+**Step 1 –** On the Monitored Domains tab, select the domain you want and click **Add Output**.
-**Step 2 –** Select **Netwrix Threat Manager** from the drop-down menu. The Add New
+**Step 2 –** Select **Netwrix Threat Manager** from the dropdown menu. The Add New
Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
diff --git a/docs/activitymonitor/10.0/admin/monitoreddomains/overview.md b/docs/activitymonitor/10.0/admin/monitoreddomains/overview.md
index 885fb2f732..5384084293 100644
--- a/docs/activitymonitor/10.0/admin/monitoreddomains/overview.md
+++ b/docs/activitymonitor/10.0/admin/monitoreddomains/overview.md
@@ -17,12 +17,12 @@ The Activity Monitor can be configured to monitor the following Active Directory
- Success and Failure on Logon
- LDAP Activity Monitoring
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Manager
-It also provides the ability to feed activity data to SIEM products.
+It also lets you feed activity data to SIEM products.
**Agents**
@@ -31,8 +31,8 @@ within the domain to be monitored.
**Tab**
-Once the AD Agent(s) installation is complete on a domain controller, the domain appear on the
-Monitored Domains tab. The tab is not visible within the console until at least one AD Agent has
+After the AD Agents installation is complete on a domain controller, the domain appear on the
+Monitored Domains tab. The tab isn't visible within the console until at least one AD Agent has
been deployed.
This tab is comprised of a button bar and a table of domains being monitored. The events stream
@@ -40,7 +40,7 @@ output needs to be designated to view data after an activity search has been per
## Button Bar
-The button bar allows users to take the following actions:
+The button bar provides the following actions:
@@ -79,4 +79,4 @@ view more information on various status conditions.
Click the **Down Arrow** to expand the Error Propagation section. The information listed is
-dependent on which domain is currently selected in the Monitored Domains table.
+dependent on which domain is selected in the Monitored Domains table.
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/add/azurefiles.md b/docs/activitymonitor/10.0/admin/monitoredhosts/add/azurefiles.md
index 04223b9586..c243cf78a1 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/add/azurefiles.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/add/azurefiles.md
@@ -6,16 +6,16 @@ sidebar_position: 11
# Add Azure Files Storage Accounts
-Prior to adding Azure Files storage accounts to the Activity Monitor, the prerequisites for the target environment
+Before adding Azure Files storage accounts to the Activity Monitor, the prerequisites for the target environment
must be met. See the [Azure Files Requirements](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/azure-files/azurefiles-activity.md)
topic for additional information.
-Follow the steps to add Azure Files storage accounts to be monitored.
+Use the following steps to add Azure Files storage accounts to be monitored:
1. On the **Monitored Hosts & Services** page, select **Add Host/Service**.
2. Select the agent that will be monitoring Azure Files, and then select **Next**.
3. Select **Azure Files**, specify the tenant’s domain name, and then select **Next**.
-4. On the **Connection** page, specify the Tenant ID (if it was not resolved automatically), Client ID, and Client Secret—values
+4. On the **Connection** page, specify the Tenant ID (if it wasn't resolved automatically), Client ID, and Client Secret—values
copied in the previous steps during application registration.
5. Select **Connect**.
The button will verify the connection to Azure, enumerate all storage accounts, and retrieve their settings visible to the registered application.
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/add/entraid.md b/docs/activitymonitor/10.0/admin/monitoredhosts/add/entraid.md
index 2337d1dc38..a392fc2647 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/add/entraid.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/add/entraid.md
@@ -34,13 +34,13 @@ AD) changes:
| Invited Users | MIM Service | MyApps | PIM |
| Self-Service Group Management | Self-service Password Management | Terms of Use | |
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding aMicrosoft Entra ID host to the Activity Monitor, the prerequisites for the target
+Before adding a Microsoft Entra ID host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[Microsoft Entra ID Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/entraid-activity.md) topic
for additional information.
@@ -53,7 +53,7 @@ monitoring the target environment.
## Add Azure Active Directory / Entra ID Host
-Follow the steps to add a Microsoft Entra ID host to be monitored.
+To add a Microsoft Entra ID host to be monitored, complete the following steps:
**Step 1 –** In the Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -118,26 +118,26 @@ Click **Next**.
**Step 8 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -148,7 +148,7 @@ Click **Finish**.
The added Microsoft Entra ID host is displayed in the monitored hosts/service table. Once a host has been
-added for monitoring, configure the desired outputs. See the
+added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic for additional information.
## Host Properties for Microsoft Entra ID
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/add/exchangeonline.md b/docs/activitymonitor/10.0/admin/monitoredhosts/add/exchangeonline.md
index 8f4b848a9d..ae881883f1 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/add/exchangeonline.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/add/exchangeonline.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Exchange Online
-Prior to adding an Exchange Online host to the Activity Monitor, the prerequisites for the target
+Before adding an Exchange Online host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[Exchange Online Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/exchange-activity.md)
topic for additional information.
@@ -19,7 +19,7 @@ monitoring the target environment.
## Add Exchange Online Host
-Follow the steps to add an Exchange Online host to be monitored.
+To add an Exchange Online host to be monitored:
**Step 1 –** In the Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -99,26 +99,26 @@ Click **Next**.
**Step 10 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -129,7 +129,7 @@ Click **Finish**.
The added Exchange Online host is displayed in the monitored hosts/service table. Once a host has been added
-for monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md)
+for monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md)
topic for additional information.
## Host Properties for Exchange Online
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/add/hitachi.md b/docs/activitymonitor/10.0/admin/monitoredhosts/add/hitachi.md
index fac32f537a..967bcc5b32 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/add/hitachi.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/add/hitachi.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,13 +22,13 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/10.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Hitachi host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Hitachi host to the Activity Monitor, the prerequisites for the target environment
must be met. See the
[Hitachi Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md) topic for
additional information.
@@ -41,8 +41,6 @@ monitoring the target environment.
## Add Hitachi NAS Host
-Follow the steps to add a Hitachi host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -70,7 +68,7 @@ Operations** to be monitored. Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the options you want:
- Report UNC paths – Adds a UNC Path column and a Rename UNC Path column in the generated TSV files
- This option corresponds to the REPORT_UNC_PATH parameter in the INI file. It is disabled by
@@ -123,26 +121,26 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -153,7 +151,7 @@ Click **Finish**.
The added Hitachi host is displayed in the monitored hosts/service table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Hitachi
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/add/nasuni.md b/docs/activitymonitor/10.0/admin/monitoredhosts/add/nasuni.md
index 3a37be2217..183724160f 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/add/nasuni.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/add/nasuni.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to Security Information and Event Management (SIEM) products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,13 +22,13 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/10.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Nasuni Edge Appliance host to the Activity Monitor, the prerequisites for the
+Before adding a Nasuni Edge Appliance host to the Activity Monitor, the prerequisites for the
target environment must be met. See the
[Nasuni Edge Appliance Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md) topic
for additional information.
@@ -41,8 +41,6 @@ monitoring the target environment.
## Add Nasuni Host
-Follow the steps to add a Nasuni Edge Appliance host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -62,7 +60,7 @@ Click **Next**.
**Step 4 –** On the Nasuni Options page, enter the **API Key Name** and the **API Key Value**. Click
Connect to validate the connection with the Nasuni device.
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -85,7 +83,7 @@ and **Link Operations** to be monitored. Additional options include:
:::warning
Enabling the Suppress subsequent Read operations in the same folder option can result
-in Read events not being monitored.
+in the product suppressing Read events.
:::
@@ -103,7 +101,7 @@ Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the options you want:
- Report account names – Adds an Account Name column in the generated TSV files
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -118,8 +116,8 @@ are the activity logs created by the activity agent on the proxy host. Select th
- Example CIFS activity – `\\ExampleHost\TestShare\DocTeam\Temp.txt`
- For NFS activity – `[HOST]:/[VOLUME]/[PATH]`
- Example NFS activity – `ExampleHost:/ExampleVolume/DocTeam/Temp.txt`
- - When the option is enabled, the added columns are populated when a file is accessed remotely
- through the UNC Path. These columns have also been added as Syslog macros.
+ - When the option is enabled, the system populates the added columns when a file is accessed remotely
+ through the UNC Path. These columns are also available as Syslog macros.
- Report operations with millisecond precision – Changes the timestamps of events being recorded in
the TSV log file for better ordering of events if multiple events occur within the same second
@@ -138,14 +136,14 @@ Output** page can be configured.
- Specify output file path – Specify the file path where log files are saved. Click the ellipses
button (**...**) to open the Windows Explorer to navigate to a folder destination. Click **Test**
to test if the path works.
-- Period to keep Log files – Log files will be deleted after the period entered number of days
- entered. The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
+- Period to keep Log files – The system deletes log files after the number of days you enter.
+ The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
set amount of Minutes, Hours, or Days.
- This log file is for Access Analyzer – Enable this option to have Access Analyzer collect this
monitored host configuration
:::info
- Identify the configuration to be read by Access Analyzer when integration is
+ Identify the configuration that Access Analyzer can read when integration is
available.
:::
@@ -162,26 +160,26 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
- mark or red will determine whether the test message has been sent or failed to send. Messages vary
+ mark or red indicates whether the test message was delivered or if delivery failed. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -192,7 +190,7 @@ Click **Finish**.
The added Nasuni host is displayed in the monitored hosts/services table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Nasuni
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/add/netapp.md b/docs/activitymonitor/10.0/admin/monitoredhosts/add/netapp.md
index 31596577c2..b9ab50ce60 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/add/netapp.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/add/netapp.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to Security Information and Event Management (SIEM) products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,13 +22,13 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/10.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a NetApp Data ONTAP host to the Activity Monitor, the prerequisites for the target
+Before adding a NetApp Data ONTAP host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[NetApp Data ONTAP Cluster-Mode Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md)
topic or the
@@ -43,7 +43,7 @@ monitoring the target environment.
## Add NetApp Host
-Follow the steps to add a NetApp Data ONTAP host to be monitored.
+To add a NetApp Data ONTAP host to be monitored, complete the following steps:
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -59,8 +59,7 @@ window opens.
textbox, enter the following information:
- Cluster-Mode devices – Enter the NetApp Filer/SVM
-- 7-Mode devices – Enter the NetApp DNS name. If using vFilers, then it is necessary to use the
- vFiler name here.
+- 7-Mode devices – Enter the NetApp DNS name. If using vFilers, use the vFiler name here.
Click **Next**.
@@ -76,10 +75,10 @@ how it is in NetApp's FPolicy configuration.
- NetApp Filer or SVM – Enter the name of the NetApp Filer or SVM. The name is case sensitive.
- Management LIF – _(Optional)_ If using Cluster Management LIF, a Management LIF can be specified
- if SVM Management LIF is not used (Vserver Tunneling)
+ if SVM Management LIF isn't used (Vserver Tunneling)
- User name – Enter the user name for the credentials to connect to the NetApp server
- User password – Enter the password for the credentials to connect to the NetApp server
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -100,7 +99,7 @@ Click **Next**.
-**Step 5 –** On the NetApp Mode FPolicy Configuration page, choose whether or not to automatically
+**Step 5 –** On the NetApp Mode FPolicy Configuration page, choose whether to automatically
configure FPolicy through Activity Monitor. If that is desired, check the Configure FPolicy option.
Any additional permissions required are listed. Be sure to select the appropriate file protocol to
configure the FPolicy.
@@ -123,7 +122,7 @@ Click **Next**.
:::info
For NetApp Cluster-Mode, create a tailored FPolicy manually. If manually
-configuring the FPolicy, do not select the ConfigureFPolicy checkbox.
+configuring the FPolicy, don't select the ConfigureFPolicy checkbox.
:::
@@ -137,7 +136,7 @@ minimum, the less privileged permissions. For Cluster-mode devices, the credenti
as ‘Employing the “Enable and connect FPolicy” Option’.
:::warning
-On the NetApp FPolicy Enable and Connect page, choose whether or not to Enable and
+On the NetApp FPolicy Enable and Connect page, choose whether to Enable and
connect FPolicy, which will “Ensure everything is active with periodic checks.”
:::
@@ -152,8 +151,7 @@ Additional permissions that are required if enabling **Enable and connect FPolic
**Important Notes**
:::info
-Enable this functionality. Without this option enabled, it is necessary to
-manually connect the FPolicy every time it is disconnected for any reason. For reliable, high
+Enable this functionality. Without this option enabled, manually connect the FPolicy every time it is disconnected for any reason. For reliable, high
availability file monitoring, use this option.
:::
@@ -184,7 +182,7 @@ properties > Operations tab.
If the Configure FPolicy option is enabled, then Activity Monitor updates the FPolicy according to
-these settings. If it was not enabled, then the manually configured FPolicy must be set to monitor
+these settings. If it wasn't enabled, then the manually configured FPolicy must be set to monitor
these operations. Only operations being monitored by the FPolicy are available to the activity
agent.
@@ -208,7 +206,7 @@ Click **Next**.
**Step 8 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the options you want:
- Report account names – Adds an Account Name column in the generated TSV files
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -222,9 +220,9 @@ are the activity logs created by the activity agent on the proxy host. Select th
- Example CIFS activity – `\\ExampleHost\TestShare\DocTeam\Temp.txt`
- For NFS activity – `[HOST]:/[VOLUME]/[PATH]`
- Example NFS activity – `ExampleHost:/ExampleVolume/DocTeam/Temp.txt`
- - When the option is enabled, the added columns are populated when a file is accessed remotely
- through the UNC Path. If a file is accessed locally, these columns are empty. These columns
- have also been added as Syslog macros.
+ - When the option is enabled, the system populates the added columns when a file is accessed remotely
+ through the UNC Path. If a file is accessed locally, these columns remain empty. These columns
+ are also available as Syslog macros.
- Report operations with millisecond precision – Changes the timestamps of events being recorded in
the TSV log file for better ordering of events if multiple events occur within the same second
- Access Analyzer 8.1+ is required for this feature
@@ -244,8 +242,8 @@ Output** page can be configured.
- Specify output file path – Specify the file path where log files are saved. Click the ellipses
button (**...**) to open the Windows Explorer to navigate to a folder destination. Click **Test**
to test if the path works.
-- Period to keep Log files – Log files will be deleted after the period entered number of days
- entered. The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
+- Period to keep Log files – The system deletes log files after the number of days you enter.
+ The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
set amount of Minutes, Hours, or Days.
- This log file is for Access Analyzer – Enable this option to have Netwrix Access Analyzer
collect this monitored host configuration
@@ -267,26 +265,26 @@ Click **Next**.
**Step 11 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
- mark or red will determine whether the test message has been sent or failed to send. Messages vary
+ mark or red indicates whether the test message was delivered or if delivery failed. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -297,23 +295,22 @@ Click **Finish**.
The added NetApp host is displayed in the monitored hosts/services table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
for additional information.
:::tip
-Remember, if automatic configuration of the FPolicy was selected, it is necessary to Configure
+Remember, if automatic configuration of the FPolicy was selected, configure
Privileged Access.
:::
## Configure Privileged Access
-If automatic configuration of the FPolicy is used for NetApp Data ONTAP Cluster-Mode devices, it is
-necessary to configure privileged access. Follow the steps to configure privileged access. Remember,
+If automatic configuration of the FPolicy is used for NetApp Data ONTAP Cluster-Mode devices, you must configure privileged access. To do so, complete the following steps. Remember,
this requires the provisioned user account to have full permissions, identified as the credentials
‘Employing the “Configure FPolicy” Option’.
-**Step 1 –** On to the Monitored Hosts & Services tab, select the desired host and click Edit. The host’s
+**Step 1 –** On to the Monitored Hosts & Services tab, select the host and click Edit. The host’s
Properties window opens.
@@ -326,7 +323,7 @@ This option is only available if the Configure FPolicy option is enabled.
:::
-Privileged access must be allowed and configured with appropriate credentials to leverage Access
+Privileged access must be allowed and configured with appropriate credentials to enable Access
Analyzer permission (FSAA) scans for this NetApp device
For information on the other options for this tab, see the [FPolicy Tab](/docs/activitymonitor/10.0/admin/monitoredhosts/properties/fpolicy.md)
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/add/nutanix.md b/docs/activitymonitor/10.0/admin/monitoredhosts/add/nutanix.md
index 8766a76737..14634178c1 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/add/nutanix.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/add/nutanix.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,13 +22,13 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/10.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Nutanix files host to the Activity Monitor, the prerequisites for the target
+Before adding a Nutanix files host to the Activity Monitor, the prerequisites for the target
environment must be met. See
[Nutanix Files Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md) for more
information.
@@ -52,15 +52,13 @@ activity delivery. Nutanix Files server connects to the agent using the TCP port
## Add Nutanix Host
-Follow the steps to add a Nutanix files host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click **Add**. The Add New Host
window opens.
**Step 2 –** On the Choose Agent page, select the Agent to monitor the file server from the
-drop-down list. Click **Next**.
+dropdown list. Click **Next**.
@@ -77,7 +75,7 @@ access.
:::
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -128,8 +126,8 @@ Output page.
- Specify output file path – Specify the file path where TSV log files are saved on the agent's
server. Click the ellipses button (...) to open the Windows Explorer to navigate to a folder
destination. Click **Test** to test if the path works.
-- Period to keep Log files –Log files will be deleted after the period entered as the number of days
- elapses. The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
+- Period to keep Log files – The system deletes log files after the number of days you enter elapses.
+ The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
set amount of Minutes, Hours, or Days. This setting applies to both the local files on the agent's
server and to the archived files.
- This log file is for Access Analyzer – Enable this option to have Access Analyzer collect this
@@ -150,7 +148,7 @@ Output page.
- Add header to Log files – Adds headers to TSV files. This is used to feed data into Splunk.
:::note
- Access Analyzer does not support log files with the header.
+ Access Analyzer doesn't support log files with the header.
:::
@@ -161,25 +159,25 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the Where To Log The Activity page, configure the
Syslog Output page.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the **Message framing** drop-down menu. See the
+ The TCP and TLS protocols add the **Message framing** dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -190,7 +188,7 @@ Click **Finish**.
The added Nutanix host is displayed in the monitored hosts/service table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Nutanix
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/add/panzura.md b/docs/activitymonitor/10.0/admin/monitoredhosts/add/panzura.md
index d6ac8b6044..56297fd4f8 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/add/panzura.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/add/panzura.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,14 +22,14 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/10.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Threat Prevention
- Netwrix Threat Manager
## Add Panzura Host
-Prior to adding a Panzura host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Panzura host to the Activity Monitor, the prerequisites for the target environment
must be met. See the [Panzura CloudFS Monitoring](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/panzura-activity.md) topic for
additional information.
@@ -39,7 +39,7 @@ monitoring the target environment.
:::
-Follow the steps to add a Panzura host to be monitored.
+To add a Panzura host to be monitored:
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -108,9 +108,9 @@ Click **Next**.
- Example CIFS activity – `\\ExampleHost\TestShare\DocTeam\Temp.txt`
- For NFS activity – `[HOST]:/[VOLUME]/[PATH]`
- Example NFS activity – `ExampleHost:/ExampleVolume/DocTeam/Temp.txt`
- - When the option is enabled, the added columns are populated when a file is accessed remotely
- through the UNC Path. If a file is accessed locally, these columns are empty. These columns
- have also been added as Syslog macros.
+ - When the option is enabled, the system populates the added columns when a file is accessed remotely
+ through the UNC Path. If a file is accessed locally, these columns remain empty. These columns
+ are also available as Syslog macros.
- Report operations with millisecond precision - Changes the timestamps of events being recorded in
the TSV log file for better ordering of events if multiple events occur within the same second.
- Access Analyzer 8.1+ is required to use this feature.
@@ -135,8 +135,8 @@ Output** page can be configured.
- Specify output file path – Specify the file path where TSV log files are saved on the agent's
server. Click the ellipses button (...) to open the Windows Explorer to navigate to a folder
destination. Click **Test** to test if the path works.
-- Period to keep Log files – Log files will be deleted after the period entered as the number of
- days elapses. The default is 10 days. Use the dropdown to specify whether to keep the Log files
+- Period to keep Log files – The system deletes log files after the number of days you enter elapses.
+ The default is 10 days. Use the dropdown to specify whether to keep the Log files
for a set amount of Minutes, Hours, or Days.
- This log file is for Access Analyzer – Enable this option to have Access Analyzer collect this
monitored host configuration
@@ -159,26 +159,26 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the **Message framing** drop-down menu. See the
+ The TCP and TLS protocols add the **Message framing** dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -189,7 +189,7 @@ Click **Finish**.
The added Panzura host is displayed in the monitored hosts/services table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Panzura
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/add/qumulo.md b/docs/activitymonitor/10.0/admin/monitoredhosts/add/qumulo.md
index fbb38b496b..1d4b0a8d45 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/add/qumulo.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/add/qumulo.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to Security Information and Event Management (SIEM) products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,13 +22,13 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/10.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Qumulo host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Qumulo host to the Activity Monitor, the prerequisites for the target environment
must be met. See the [Qumulo Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md)
topic for additional information.
@@ -40,7 +40,7 @@ monitoring the target environment.
## Add Qumulo Host
-Follow the steps to add a Qumulo host to be monitored.
+To add a Qumulo host to be monitored:
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click **Add**. The Add New Host
window opens.
@@ -48,7 +48,7 @@ window opens.
**Step 2 –** On the Choose Agent page, select the Agent to monitor the file server from the
-drop-down list. Click **Next**.
+dropdown list. Click **Next**.
@@ -59,7 +59,7 @@ name. Click **Next**.
**Step 4 –** On the Qumulo Options page, enter the user name and password.
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -92,8 +92,8 @@ Output page.
- Specify output file path – Specify the file path where TSV log files are saved on the agent's
server. Click the ellipses button (...) to open the Windows Explorer to navigate to a folder
destination. Click **Test** to test if the path works.
-- Period to keep Log files – Log files will be deleted after the period entered as the number of
- days elapses. The default is 10 days. Use the dropdown to specify whether to keep the Log files
+- Period to keep Log files – The system deletes log files after the number of days you enter elapses.
+ The default is 10 days. Use the dropdown to specify whether to keep the Log files
for a set number of Hours or Days.
- This log file is for Access Analyzer – Enable this option to have Access Analyzer collect this
monitored host configuration
@@ -113,7 +113,7 @@ Output page.
- Add header to Log files – Adds headers to TSV files. This is used to feed data into Splunk.
:::note
- Access Analyzer does not support log files with the header.
+ Access Analyzer doesn't support log files with the header.
:::
@@ -124,25 +124,25 @@ Click **Next**.
**Step 7 –** If Syslog Server is selected on the Where To Log The Activity page, configure the
Syslog Output page.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the **Message framing** drop-down menu. See the
+ The TCP and TLS protocols add the **Message framing** dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -152,8 +152,8 @@ Click **Finish**.
-The added Qumulo host is displayed in the monitored hosts/services table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
+The added Qumulo host is displayed in the monitored hosts/services table. After a host has been added for
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Qumulo
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/add/sharepoint.md b/docs/activitymonitor/10.0/admin/monitoredhosts/add/sharepoint.md
index 26d6d0640a..32625121a5 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/add/sharepoint.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/add/sharepoint.md
@@ -23,11 +23,11 @@ The Activity Monitor can be configured to monitor the following SharePoint chang
- Security principal is added to a security group
- Security principal is removed from a security group
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
-Prior to adding a SharePoint host to the Activity Monitor, the prerequisites for the target
+Before adding a SharePoint host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[SharePoint On-Premise Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/sharepoint-onprem-activity.md)
topic for additional information.
@@ -40,7 +40,7 @@ Remember, the Activity Agent must be deployed to the SharePoint Application serv
## Add SharePoint Host
-Follow the steps to add a SharePoint host to be monitored.
+Use the following steps to add a SharePoint host to be monitored:
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -58,7 +58,7 @@ Click **Next**.
**Step 4 –** On the SharePoint Options page, choose to audit all sites or scope the monitoring to
-specific site(s):
+specific sites:
- Enable auditing on selected site collections – Enabling this option will ensure that auditing is
enabled for all monitored site collections with periodic checks
@@ -118,26 +118,26 @@ Click **Next**.
**Step 8 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
- mark or red will determine whether the test message has been sent or failed to send. Messages vary
+ mark or red indicates whether the test message was delivered or if delivery failed. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -148,7 +148,7 @@ Click Finish.
The added SharePoint host is displayed in the monitored hosts/services table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for SharePoint
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/add/sharepointonline.md b/docs/activitymonitor/10.0/admin/monitoredhosts/add/sharepointonline.md
index ab02fafb6e..95b28ada97 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/add/sharepointonline.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/add/sharepointonline.md
@@ -23,11 +23,11 @@ The Activity Monitor can be configured to monitor the following SharePoint chang
- Security principal is added to a security group
- Security principal is removed from a security group
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
-Prior to adding a SharePoint Online host to the Activity Monitor, the prerequisites for the target
+Before adding a SharePoint Online host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[SharePoint Online Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/sharepoint-online-activity.md)
topic for additional information.
@@ -40,7 +40,7 @@ monitoring the target environment.
## Add SharePoint Online Host
-Follow the steps to add a SharePoint Online host to be monitored.
+To add a SharePoint Online host to be monitored, complete the following steps:
**Step 1 –** In the Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -50,7 +50,7 @@ window opens.
**Step 2 –** On the Choose Agent page, select the Agent to monitor SharePoint Online.
:::warning
-The domain name must match the SharePoint Online host name in order to properly
+The domain name must match the SharePoint Online host name to properly
integrate SharePoint Online activity monitoring with Access Analyzer.
:::
@@ -71,7 +71,7 @@ Instruction...** for steps on registering the Activity Monitor with Microsoft En
- Approve consent for the organization.
:::note
- Activity Monitor does not store credentials. The credentials are used to enable
+ Activity Monitor doesn't store credentials. The credentials are used to enable
API access using the Client ID and Secret.
:::
@@ -135,26 +135,26 @@ Click **Next**.
**Step 8 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
- mark or red will determine whether the test message has been sent or failed to send. Messages vary
+ mark or red indicates whether the test message was delivered or if delivery failed. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -165,7 +165,7 @@ Click **Finish**.
The added SharePoint Online host is displayed in the monitored hosts/services table. Once a host has been
-added for monitoring, configure the desired outputs. See the
+added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic for additional information.
## Host Properties for SharePoint Online
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/add/sqlserver.md b/docs/activitymonitor/10.0/admin/monitoredhosts/add/sqlserver.md
index 4e3825a655..07b4156d34 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/add/sqlserver.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/add/sqlserver.md
@@ -8,11 +8,11 @@ sidebar_position: 150
**Understanding SQL Server Activity Monitoring**
-The Activity Monitor provides the ability to feed activity data to other Netwrix products:
+The Activity Monitor lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
-Prior to adding a SQL Server host to the Activity Monitor, the prerequisites for the target
+Before adding a SQL Server host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[SQL Server Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/sqlserver-activity.md) topic for
additional information.
@@ -25,7 +25,7 @@ monitoring the target environment.
## Add MS SQL Server Host
-Follow the steps to add a SQL Server host to be monitored.
+To add a SQL Server host to be monitored:
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -38,7 +38,7 @@ click **Next**.
**Step 3 –** On the **Add Host** page, select **MS SQL Server** and enter the **Server name or
-address** for the SQL Server host., then click **Next**.
+address** for the SQL Server host, then click **Next**.
@@ -66,7 +66,7 @@ monitored. Click **Next**.
-**Step 7 –** On the SQL Server Logon Trigger page, copy and paste the SQL script into a New Query in
+**Step 7 –** On the SQL Server Logon Trigger page, copy, and paste the SQL script into a New Query in
the SQL database. Execute the query to create a logon trigger. Netwrix Activity Monitor will monitor
SQL logon events and obtain IP addresses for connections. The script is:
@@ -126,26 +126,26 @@ Output** page can be configured.
**Step 11 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
- mark or red will determine whether the test message has been sent or failed to send. Messages vary
+ mark or red indicates whether the test message was delivered or if delivery failed. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -156,7 +156,7 @@ Click **Finish**.
The added SQL Server host is displayed in the monitored hosts/services table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for SQL Server
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/add/windows.md b/docs/activitymonitor/10.0/admin/monitoredhosts/add/windows.md
index 6709876dc6..a2c5aeb2b1 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/add/windows.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/add/windows.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to Security Information and Event Management (SIEM) products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,27 +22,24 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/10.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Manager
-Prior to adding a Windows host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Windows host to the Activity Monitor, the prerequisites for the target environment
must be met. See the
[Windows File Server Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/windowsfs-activity.md)
topic for additional information.
:::tip
-Remember, the Activity Agent must be deployed to the server. It cannot be deployed to a proxy
+Remember, the Activity Agent must be deployed to the server. It can't be deployed to a proxy
server.
:::
## Add Agent's Windows Host
-Follow the steps to add a Windows host to be monitored, if it was not configured when the agent was
-deployed.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -54,7 +51,7 @@ server. Click **Next**.
**Step 3 –** On the Add Host page, select the Agent’s Windows host radio button. Remember, the agent
-must be deployed on the Windows file server to be monitored. If desired, add a **Comment**. Click
+must be deployed on the Windows file server you want to monitor. If desired, add a **Comment**. Click
**Next**.
@@ -95,7 +92,7 @@ in Read events not being monitored.
permission updates occurred resulting in reordered ACEs (Access Control Entries) but with no other
changes in the ACL (Access Control List). For example, if a user is removed in the security
settings of a file, and then the same user is added back with the same security permissions, the
- change is not logged.
+ change isn't logged.
- Suppress Inherited Permission Changes – Filters out events for inherited permission changes. This
option is provided to improve overall performance and reduce output activity log volume.
- Suppress Microsoft Office operations on temporary files – Filters out events for Microsoft Office
@@ -107,7 +104,7 @@ Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the target host. Select the desired options:
+are the activity logs created by the activity agent on the target host. Select the options you want:
- Report Account Names – Adds an Account Name column in the generated TSV files
- Report UNC paths – Adds a UNC Path column and a Rename UNC Path column in the generated TSV files
@@ -115,9 +112,9 @@ are the activity logs created by the activity agent on the target host. Select t
default. The UNC Path is in the following format:
- For CIFS activity – `\\[HOST]\[SHARE]\[PATH]`
- Example CIFS activity – `\\ExampleHost\TestShare\DocTeam\Temp.txt`
- - When the option is enabled, the added columns are populated when a file is accessed remotely
- through the UNC Path. If a file is accessed locally, these columns are empty. These columns
- have also been added as Syslog macros.
+ - When the option is enabled, the system populates the added columns when a file is accessed remotely
+ through the UNC Path. If a file is accessed locally, these columns remain empty. These columns
+ are also available as Syslog macros.
- Report operations with millisecond precision – Changes the timestamps of events being recorded in
the TSV log file for better ordering of events if multiple events occur within the same second
@@ -158,26 +155,26 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
- mark or red will determine whether the test message has been sent or failed to send. Messages vary
+ mark or red indicates whether the test message was delivered or if delivery failed. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -188,7 +185,7 @@ Click **Finish**.
The added Windows file server host is displayed in the monitored hosts/services table. Once a host has been
-added for monitoring, configure the desired outputs. See the
+added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md) topic for additional information.
## Host Properties for Windows File Server
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/output/filetsv.md b/docs/activitymonitor/10.0/admin/monitoredhosts/output/filetsv.md
index 5845383b96..808fbb8e33 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/output/filetsv.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/output/filetsv.md
@@ -9,9 +9,9 @@ sidebar_position: 10
The following information lists all of the columns generated by File Activity Monitor into a TSV log
file, along with descriptions.
-| Column Name(s) | Description |
+| Column Names | Description |
| ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Operation Time | Date timestamp of the event in UTC time Column format is dependent on "Report Operations with millisecond precision" option |
+| Operation Time | Date timestamp of the event in UTC time. Column format is dependent on "Report Operations with millisecond precision" option |
| Host | Host name of the monitored device |
| User Sid/Uid | Unique identifier for the File System user: - For CIFS activity – user SID - For NFS activity – UID |
| Operation Type | Type of operation for each event. Reports the following operations: - Add - Delete (Del) - Rename (Ren) - Network Share (SHARE) - Permission Change (Per) - Read (Rea) - Symlink or hardlink (LINK) - Update (Upd) |
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/output/linuxtsv.md b/docs/activitymonitor/10.0/admin/monitoredhosts/output/linuxtsv.md
index ec8b706a86..d436d13fc8 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/output/linuxtsv.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/output/linuxtsv.md
@@ -11,7 +11,7 @@ log file, along with descriptions.
| | |
| ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Operation Time | Date timestamp of the event in UTC time Column format is dependent on "Report Operations with millisecond precision" option |
+| Operation Time | Date timestamp of the event in UTC time. Column format is dependent on "Report Operations with millisecond precision" option |
| Host | Host name of the monitored device |
| User Sid/Uid | Unique identifier for the File System user: - For CIFS activity – user SID - For NFS activity – UID |
| Operation Type | Type of operation for each event. Reports the following operations: - Add - Delete (Del) - Rename (Ren) - Network Share (SHARE) - Permission Change (Per) - Read (Rea) - Symlink or hardlink (LINK) - Update (Upd) |
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md b/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md
index e5e1fe0ae6..ac7032bae0 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/output/output.md
@@ -22,7 +22,7 @@ The host event outputs are:
## Add Access Analyzer 26 Output
:::note
-Only File System, SharePoint Online, and Microsoft 365 Copilot events are supported by the Access Analyzer 26 output.
+The Access Analyzer 26 output supports only File System, SharePoint Online, and Microsoft 365 Copilot events.
:::
### Generate an Enrollment Token in Access Analyzer 26
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/output/sharepointjson.md b/docs/activitymonitor/10.0/admin/monitoredhosts/output/sharepointjson.md
index 212b8af530..29a15d0a9c 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/output/sharepointjson.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/output/sharepointjson.md
@@ -24,10 +24,10 @@ Activity Monitor into a JSON log file:
| WebApplication | Web application name | SharePoint – 80 |
| SiteId | Site Id (guid) | 7b2c8d23-a74f-4c3c-985d-2c7facb5ebae |
| SiteUrl | Site Url | http://sphost/sites/mysite |
-| WebTitle | Web title | my site |
+| WebTitle | Web title | Marketing Site |
| DocLocation | Location of an audited object at the time of the audited event | Lists/Comments/1\_.000 |
| ItemId | A Guid that the object whose event is represented by the entry | 2c4174dc-322d-47bc-a420-52968fc3ba6c |
-| ItemTitle | Title of the object | Welcome to my blog! |
+| ItemTitle | Title of the object | Welcome to the company blog! |
| ItemType | Type of the object: Document / ListItem / List / Folder / Web / Site | ListItem |
| EventType | An SPAuditEventType that represents the type of event | Update |
| EventSource | A value that indicates whether the event occurred as a result of user action in the SharePoint Foundation user interface (UI) or programmatically. Values: SharePoint / ObjectModel | SharePoint |
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/output/sharepointonlinejson.md b/docs/activitymonitor/10.0/admin/monitoredhosts/output/sharepointonlinejson.md
index f0e2f3a0ba..1c54384834 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/output/sharepointonlinejson.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/output/sharepointonlinejson.md
@@ -93,5 +93,5 @@ Activity Monitor by Sharing.
| -------------------------------- | ------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SharePointMetaData | Metadata about the document that contained the sensitive information | [https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#sharepointmetadata-complex-type](https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#httpsdocsmicrosoftcomen-usofficeoffice-365-management-apioffice-365-management-activity-api-schemasharepointmetadata-complex-type) |
| ExceptionInfo | Reasons why a policy no longer applies and any information about false positive or override | |
-| PolicyDetails | Policy(s) that triggered the event | [https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#policydetails-complex-type](https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#httpsdocsmicrosoftcomen-usofficeoffice-365-management-apioffice-365-management-activity-api-schemapolicydetails-complex-type) |
+| PolicyDetails | Policys that triggered the event | [https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#policydetails-complex-type](https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#httpsdocsmicrosoftcomen-usofficeoffice-365-management-apioffice-365-management-activity-api-schemapolicydetails-complex-type) |
| SensitiveInfoDetectionIsIncluded | Indicates whether the event contains the value of the sensitive data type | |
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/overview.md b/docs/activitymonitor/10.0/admin/monitoredhosts/overview.md
index 2cd95f6cb1..426110f634 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/overview.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/overview.md
@@ -81,7 +81,7 @@ you can add a user to Account Exclusions, set the retention period for log files
disable reporting of Directory Read operations.
To initiate bulk editing, select multiple hosts or outputs (`Ctrl+A` and `Ctrl+Shift+A` may help
-here), and click the **Edit** Edit button. The Properties window shows divergent settings as blank
+here), and click the **Edit** button. The Properties window shows divergent settings as blank
or in the unknown state or with the `<-Different-Values->` marker for the list-like settings. Leave
the `<-Different-Values->` marker to preserve the difference in each selected object, or delete it
to remove all divergent elements. When the window closes, only changed properties are saved to all
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/auditing.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/auditing.md
index cb8b0937ce..82cd9b0d03 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/auditing.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/auditing.md
@@ -6,14 +6,14 @@ sidebar_position: 10
# Auditing Tab
-The Auditing tab allows users to modify to modify the Isilon Options setting which was populated
+The Auditing tab lets you modify the Isilon Options setting which was populated
with the information entered when the Dell Isilon host is added to the Monitored Hosts & Services list.
The **Enable Protocol Access Auditing in OneFS if it is disabled** box allows the activity agent to
automatically enable and configure auditing on the Isilon cluster. If a manual configuration has
-been completed, do not enable these options. This option requires credentials for an Administrator
+been completed, don't enable these options. This option requires credentials for an Administrator
account on the Dell Isilon device and click Connect.
If the connection is successful, discovered access zones appear in the **Available** box. By
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/fpolicy.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/fpolicy.md
index 67cd872661..acdd5c58bc 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/fpolicy.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/fpolicy.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# FPolicy Tab
-The FPolicy tab allows users to modify FPolicy settings for NetApp devices, privileged access, and
+The FPolicy tab provides options to modify FPolicy settings for NetApp devices, privileged access, and
enabling/connecting to cluster nodes.
@@ -40,7 +40,7 @@ The Enable and Connect settings tab is enabled when the Enable and connect FPoli
selected.
:::note
-Adding nodes are not needed if set user is using a role that has Network Interface
+Adding nodes aren't needed if set user is using a role that has Network Interface
permissions.
:::
@@ -49,7 +49,7 @@ permissions.
Add a list of cluster nodes to connect to FPolicy by clicking Add, which opens the Add or Edit
Cluster Node window. Enter at least one cluster node in the textbox. Separate multiple nodes with
-either commas (,), semicolons (;), or spaces. Click OK and the node(s) is displayed in the **Node
+either commas (,), semicolons (;), or spaces. Click OK and the nodes is displayed in the **Node
name** list.
@@ -58,7 +58,7 @@ Click Discover to open the Connect to cluster window and retrieve nodes from the
Specify the Cluster-management LIF and then enter user credentials which will be used to retrieve a
list of the cluster nodes. This credential must have at least read-only rights to run the system
-node show command on the cluster. Click Get Nodes. If a successful connection is not achieved, the
+node show command on the cluster. Click Get Nodes. If a successful connection isn't achieved, the
message indicates the error. If a successful connection is achieved, the message indicates how many
cluster nodes were discovered. Click OK and all discovered nodes are displayed in the **Node name**
list.
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/hitachinas.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/hitachinas.md
index b4a8669b30..096e8e5b8a 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/hitachinas.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/hitachinas.md
@@ -6,12 +6,12 @@ sidebar_position: 50
# Hitachi NAS Tab
-Once a Hitachi host is added to the monitored hosts/services table, the configuration settings are edited
+After you add a Hitachi host to the monitored hosts/services table, edit the configuration settings
through the tabs in the host’s Properties window. The Hitachi NAS tab on a host’s Properties window
is specific to Hitachi hosts.
-The Hitachi NAS tab allows users to modify settings that were populated with the information entered
-when the Hitachi host was added. Additionally, the Path pooling interval can be configured. The Path
-pooling interval is set to 15 seconds by default.
+The Hitachi NAS tab lets you modify settings populated with information you entered
+when you added the Hitachi host. Additionally, you can configure the Path pooling interval. The Path
+pooling interval defaults to 15 seconds.
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/inactivityalerts.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/inactivityalerts.md
index 58714f76cb..e314bd6c6a 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/inactivityalerts.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/inactivityalerts.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# Inactivity Alerts Tab
-The Inactivity Alerts tab on a host's Properties window is used to configure alerts that are sent
+Use the Inactivity Alerts tab on a host's Properties window to configure alerts sent
when monitored hosts/services receive no events for a specified period of time.
@@ -29,7 +29,7 @@ Configure Syslog alerts using the Syslog Alerts Tab.
The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- Syslog protocol – Identify the Syslog protocol to be used for the alerts
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/logontrigger.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/logontrigger.md
index 88a3419986..d6d1868b70 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/logontrigger.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/logontrigger.md
@@ -6,7 +6,7 @@ sidebar_position: 70
# Logon Trigger Tab
-The Logon trigger tab on a SQL Server host's properties window is used to configure logon triggers
+The Logon trigger tab on a SQL Server host's properties window to configure logon triggers
for SQL activity monitoring.
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/mssqlserver.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/mssqlserver.md
index 024f263802..de6371be9a 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/mssqlserver.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/mssqlserver.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# MS SQL Server Tab
-The MS SQL Server tab on SQL Server host's properties window is used to configure properties for
+The MS SQL Server tab on SQL Server host's properties window to configure properties for
SQL activity monitoring on the host.
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/nasuni.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/nasuni.md
index ef629472fe..eb54ac219b 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/nasuni.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/nasuni.md
@@ -6,20 +6,20 @@ sidebar_position: 90
# Nasuni Tab
-After a Nasuni host is added to the monitored hosts/services table, the configuration settings are edited
+After you add a Nasuni host to the monitored hosts/services table, edit the configuration settings
using the tabs in the Properties window of the host.
-The **Nasuni** tab allows users to modify settings which were populated with the information entered
-when the Nasuni host was added.
+The **Nasuni** tab lets users modify settings populated with information you entered
+when you added the Nasuni host.
The configurable options are:
- Nasuni Filer – Enter the name of the filer
- Username – Enter the user name for the Nasuni account
- Password – Enter the password for the user name
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/netapp.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/netapp.md
index b9a2524fa0..594f763fc2 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/netapp.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/netapp.md
@@ -6,7 +6,7 @@ sidebar_position: 100
# NetApp Tab
-The NetApp tab on a host’s Properties window allows users to modify settings, which are populated
+The NetApp tab on a host’s Properties window lets you modify settings, populated
with the information entered when the NetApp host is added to the monitored hosts/services table.
@@ -14,7 +14,7 @@ with the information entered when the NetApp host is added to the monitored host
Modify the targeted NetApp device by specifying a NetApp device to be monitored for activity and
credentials to access it with the Data ONTAP API.
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/nutanix.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/nutanix.md
index 63fdbfdd61..c5de74af2e 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/nutanix.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/nutanix.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# Nutanix Tab
-The Nutanix tab allows users to modify settings after a Nutanix host has been configured. Once a
+Use the Nutanix tab to modify settings after you configure a Nutanix host. Once a
Nutanix host is added to the monitored hosts/services table, the configuration can be edited in the host
Properties.
@@ -17,7 +17,7 @@ The configurable options are:
- Nutanix Filer – Enter the name of the filer
- Username – Enter the user name for the Nutanix account with REST API access
- Password – Enter the password for the user name
-- Protocol – Select a protocol for the REST API access from the drop-down menu:
+- Protocol – Select a protocol for the REST API access from the dropdown menu:
- Auto Detect
- HTTPS
@@ -37,7 +37,7 @@ verification during a TLS session
- Click **OK** to close the window and save the modifications.
:::note
-Nutanix Files does not report events for activity originating from a server where the
+Nutanix Files doesn't report events for activity originating from a server where the
Activity Monitor Agent is installed.
:::
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/overview.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/overview.md
index 8e9016f21f..d4f641980a 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/overview.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/overview.md
@@ -6,12 +6,12 @@ sidebar_position: 20
# Host Properties Window
-Once a host has been added to the Monitored Hosts & Services list, the configuration settings can be modified
+After you add a host to the Monitored Hosts & Services list, you can modify the configuration settings
through the host’s Properties window.
-On the Monitored Hosts & Services tab, select the host and click Edit, or right-click on a host and select
+On the Monitored Hosts & Services tab, select the host and click Edit, or right-click a host and select
**Edit Host** from the right-click menu, to open the host’s Properties window. The tabs vary based
on the type of host selected:
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/panzura.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/panzura.md
index cd9b0d2dbc..5bd023ec9e 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/panzura.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/panzura.md
@@ -6,20 +6,20 @@ sidebar_position: 120
# Panzura Tab
-After a Panzura host is added to the monitored hosts/services table, the configuration settings are edited
+After you add a Panzura host to the monitored hosts/services table, edit the configuration settings
using the tabs in the Properties window of the host.
-The **Panzura** tab allows users to modify settings which were populated with the information
-entered when the Panzura host was added.
+Use the **Panzura** tab to modify settings populated with information you entered
+when the Panzura host was added.
The configurable options are:
- Panzura Filer – Enter the name of the filer
- Username – Enter the user name for the Panzura account
- Password – Enter the password for the user name
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/qumulo.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/qumulo.md
index abde3b5a15..1133c32784 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/qumulo.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/qumulo.md
@@ -6,7 +6,7 @@ sidebar_position: 130
# Qumulo Tab
-The Qumulo tab allows users to modify settings after a Qumulo host has been configured. Once a
+The Qumulo tab lets you modify settings after you configure a Qumulo host. Once a
Qumulo host is added to the monitored hosts/services table, the configuration can be edited in the host
Properties.
@@ -17,7 +17,7 @@ The configurable options are:
- Cluster name – Enter the name of the filer
- Username – Enter the user name for the Qumulo user
- Password – Enter the password for the user name
-- Protocol – Select one of the following protocols from the drop-down menu:
+- Protocol – Select one of the following protocols from the dropdown menu:
- Auto Detect
- HTTPS
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/sharepoint.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/sharepoint.md
index aba47f2739..a0184377ec 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/sharepoint.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/sharepoint.md
@@ -6,7 +6,7 @@ sidebar_position: 140
# SharePoint Tab
-The SharePoint tab on a host’s Properties window allows users to modify settings that are populated
+The SharePoint tab on a host’s Properties window lets you modify settings populated
with the information entered when the SharePoint host is added.
@@ -16,7 +16,7 @@ The configurable options are:
- Enable auditing on selected site collections - Check the box to enable auditing on selected site
collections. Enabling this option will ensure that auditing is enabled for all monitored site
collections with periodic checks.
-- Choose to audit all sites or scope the monitoring to specific site(s):
+- Choose to audit all sites or scope the monitoring to specific sites:
- Audit all sites – Leave textbox for URLs blank
- Scope to specific sites – List URLs for sites to be monitored in the textbox. List should be
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/tweakoptions.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/tweakoptions.md
index d0ae6d2035..758cbb7e30 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/tweakoptions.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/tweakoptions.md
@@ -6,7 +6,7 @@ sidebar_position: 150
# Tweak Options Tab
-The Tweak Options tab on a SQL Server host's properties window is used to configure extended events
+The Tweak Options tab on a SQL Server host's properties window to configure extended events
operations for SQL activity monitoring.
diff --git a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/unixids.md b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/unixids.md
index 2c2dfc3f86..88ad2d105e 100644
--- a/docs/activitymonitor/10.0/admin/monitoredhosts/properties/unixids.md
+++ b/docs/activitymonitor/10.0/admin/monitoredhosts/properties/unixids.md
@@ -9,7 +9,7 @@ sidebar_position: 160
The Unix IDs tab provides configuration options to translate Unix IDs (UID) to SIDs. This tab
applies to NetApp devices, Dell devices, and Nasuni Edge Appliances.
-When activity is performed on an NFS resource, UIDs are returned for that activity event. Depending
+When activity occurs on an NFS resource, the system returns UIDs for that activity event. Depending
on the operating system, the UID can be mapped to Active Directory accounts using the uidNumber
attribute in Active Directory. The activity agent resolves the Active Directory SID based on the UID
from the activity event.
@@ -24,7 +24,7 @@ The options are:
- This container and its descendants
- This container only
- Search - Search using the following specifications:
- - by an attribute – Specify an LDAP filter. This attribute cannot be empty.
+ - by an attribute – Specify an LDAP filter. This attribute can't be empty.
- with a custom filter – Use the %UID% macro for a Unix ID value
- Provide UID for test/Test – Test button performs a search in the specified container with the
scope and the filter, replacing %UID% with 0 for the test
diff --git a/docs/activitymonitor/10.0/admin/outputs/accessanalyzer26.md b/docs/activitymonitor/10.0/admin/outputs/accessanalyzer26.md
index 6daa41ed8e..4fad8b8b6e 100644
--- a/docs/activitymonitor/10.0/admin/outputs/accessanalyzer26.md
+++ b/docs/activitymonitor/10.0/admin/outputs/accessanalyzer26.md
@@ -6,10 +6,10 @@ sidebar_position: 41
# Access Analyzer 26 Tab
-Use the Access Analyzer 26 tab on an output Properties window to modify the connection between Activity Monitor and Netwrix Access Analyzer 26. These settings are initially configured when the output is added.
+Use the Access Analyzer 26 tab on an output Properties window to modify the connection between Activity Monitor and Netwrix Access Analyzer 26. Configure these settings initially when you add the output.
:::note
-Only File System, SharePoint Online, and Microsoft 365 Copilot events are supported by the Access Analyzer 26 output.
+Access Analyzer 26 supports only File System, SharePoint Online, and Microsoft 365 Copilot events.
:::
Select an Access Analyzer 26 output from the Monitored Hosts/Services tab and click **Edit** to open the output Properties window.
@@ -17,7 +17,7 @@ Select an Access Analyzer 26 output from the Monitored Hosts/Services tab and cl
The tab contains the following settings:
- Server in SERVER:PORT format – Server name of the Netwrix Access Analyzer 26 application server and
- the communication port being used between the applications. The format must be `SERVER:PORT`, e.g.
+ the communication port that the applications use. The format must be `SERVER:PORT`, e.g.
`AASRV01:4504`.
- The server name can be a short name, fully qualified domain name (FQDN), or IP address, as long as the agent can resolve it.
diff --git a/docs/activitymonitor/10.0/admin/outputs/accountexclusions/accountexclusions.md b/docs/activitymonitor/10.0/admin/outputs/accountexclusions/accountexclusions.md
index e1dd5785ae..6a6f789957 100644
--- a/docs/activitymonitor/10.0/admin/outputs/accountexclusions/accountexclusions.md
+++ b/docs/activitymonitor/10.0/admin/outputs/accountexclusions/accountexclusions.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Account Exclusions Tab
The Account Exclusions tab on an output Properties window is where monitoring scope by account name
-can be modified. These settings are initially configured when the output is added.
+you can modify. These settings are initially configured when the output is added.
Select an output from the Monitored Hosts & Services tab and click **Edit** to open the output Properties
window. The tab varies based on the type of host selected.
@@ -23,7 +23,7 @@ The tab contains the following settings:
information.
- Add Unix Account – Opens the Specify Unix Account window to add an account for exclusion. See the
[Specify Unix Account Window](/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifyunixaccount.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -31,7 +31,7 @@ The tab contains the following settings:
:::
-- Process group membership when filtering – Indicates if group memberships is processed when
+- Process group membership when filtering – Indicates whether group memberships are processed when
filtering accounts
The table lists accounts that are being excluded from monitoring, displaying columns for Account
@@ -51,7 +51,7 @@ The tab contains the following settings:
information.
- Add Unix Account – Opens the Specify Unix Account window to add an account for exclusion. See the
[Specify Unix Account Window](/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifyunixaccount.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -59,7 +59,7 @@ The tab contains the following settings:
:::
-- Process group membership when filtering – Indicates if group memberships is processed when
+- Process group membership when filtering – Indicates whether group memberships are processed when
filtering accounts
The table lists accounts that are being excluded from monitoring, displaying columns for Account
@@ -79,7 +79,7 @@ The tab contains the following settings:
information.
- Add Unix Account – Opens the Specify Unix Account window to add an account for exclusion. See the
[Specify Unix Account Window](/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifyunixaccount.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -87,7 +87,7 @@ The tab contains the following settings:
:::
-- Process group membership when filtering – Indicates if group memberships is processed when
+- Process group membership when filtering – Indicates whether group memberships are processed when
filtering accounts
The table lists accounts that are being excluded from monitoring, displaying columns for Account
@@ -107,7 +107,7 @@ The tab contains the following settings:
information.
- Add SharePoint Account – Opens the Specify account window to add an account for exclusion. See the
[Specify Account Window](/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifysharepointaccount.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -115,7 +115,7 @@ The tab contains the following settings:
:::
-- Process group membership when filtering – Indicates if group memberships is processed when
+- Process group membership when filtering – Indicates whether group memberships are processed when
filtering accounts
The table lists accounts that are being excluded from monitoring, displaying columns for Account
@@ -132,7 +132,7 @@ The tab contains the following settings:
- Add Sql User – Opens the Specify Sql User name window to add an account for exclusion. See the
[Specify Sql User Name Window](/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifysqluser.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -140,7 +140,7 @@ The tab contains the following settings:
:::
-- Process group membership when filtering – Indicates if group memberships is processed when
+- Process group membership when filtering – Indicates whether group memberships are processed when
filtering accounts
The table lists accounts that are being excluded from monitoring, displaying columns for Account
@@ -158,7 +158,7 @@ The tab contains the following settings:
- Add Windows Account – Opens the Specify account or group window to add an account for exclusion.
See the [Specify Account or Group Window](/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifywindowsaccount.md) topic for additional
information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -166,7 +166,7 @@ The tab contains the following settings:
:::
-- Process group membership when filtering – Indicates if group memberships is processed when
+- Process group membership when filtering – Indicates whether group memberships are processed when
filtering accounts
The table lists accounts that are being excluded from monitoring, displaying columns for Account
diff --git a/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifysharepointaccount.md b/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifysharepointaccount.md
index 0caf42a1e7..19e7e80ca2 100644
--- a/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifysharepointaccount.md
+++ b/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifysharepointaccount.md
@@ -6,13 +6,13 @@ sidebar_position: 10
# Specify Account Window
-The Specify account window is opened from a field where a SharePoint account is needed.
+The Specify account window opens from a field where a SharePoint account is needed.
There are two options for specifying an account:
-- SharePoint System Accounts – Check the boxes for the desired system accounts: SHAREPOINT\system,
+- SharePoint System Accounts – Check the boxes for the system accounts you want: SHAREPOINT\system,
-1, S-1-0-0 (Null SID)
- Custom – Enter the account in the textbox. Multiple accounts can be added using a semicolon (;).
diff --git a/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifysqluser.md b/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifysqluser.md
index f72a6d524d..3fc112607c 100644
--- a/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifysqluser.md
+++ b/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifysqluser.md
@@ -6,10 +6,10 @@ sidebar_position: 30
# Specify Sql User Name Window
-The Specify Sql User name window is opened from a field where a SQL Server account is needed.
+The Specify Sql User name window opens from a field where a SQL Server account is needed.
-Enter the SQL Server user name into the text box. Multiple user names can be added using a semicolon
+Enter the SQL Server user name into the text box. Multiple user names can be separated by a semicolon
(;), a comma (,), or a space. Then click OK. The Specify Sql User name window closes, and the
-account is added to the field where the window was opened.
+account is added to the field where the window opens.
diff --git a/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifyunixaccount.md b/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifyunixaccount.md
index 7f0a42eb62..735885537e 100644
--- a/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifyunixaccount.md
+++ b/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifyunixaccount.md
@@ -6,10 +6,10 @@ sidebar_position: 40
# Specify Unix Account Window
-The Specify Unix Account or group window is opened from a field where a Unix account is needed.
+The Specify Unix Account or group window opens from a field where a Unix account is needed.
-Type the UID for the desired account in the textbox. Multiple UIDs can be added using a semicolon
+Enter the UID for the account you want in the textbox. Multiple UIDs can be added using a semicolon
(;), a comma (,), or a space. Then click OK. The Specify Unix Account window closes, and the account
is added to the field where the window was opened.
diff --git a/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifywindowsaccount.md b/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifywindowsaccount.md
index 15e3fe7d08..17d63df809 100644
--- a/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifywindowsaccount.md
+++ b/docs/activitymonitor/10.0/admin/outputs/accountexclusions/specifywindowsaccount.md
@@ -6,13 +6,11 @@ sidebar_position: 20
# Specify Account or Group Window
-The Specify account or group window is opened from a field where a Windows account is needed.
+The Specify account or group window opens from a field where a Windows account is needed.
-Follow the steps to use this window.
-
-**Step 1 –** Select the Domain from the drop-down menu.
+**Step 1 –** Select the Domain from the dropdown menu.
**Step 2 –** Enter the Account in the textbox.
@@ -20,7 +18,7 @@ Follow the steps to use this window.
- Use the ellipsis (…) button to open the Select Users, Computers, Service Accounts, or Groups
window to browse for an account.
-**Step 3 –** Then click Resolve. A message displays indicating whether or not the account could be
+**Step 3 –** Then click Resolve. A message displays indicating whether the account could be
resolved.
**Step 4 –** If successful, click OK.
diff --git a/docs/activitymonitor/10.0/admin/outputs/additionalproperties.md b/docs/activitymonitor/10.0/admin/outputs/additionalproperties.md
index 453a16e4ee..65d6ff2999 100644
--- a/docs/activitymonitor/10.0/admin/outputs/additionalproperties.md
+++ b/docs/activitymonitor/10.0/admin/outputs/additionalproperties.md
@@ -7,7 +7,7 @@ sidebar_position: 120
# Additional Properties Tab
The Additional Properties tab on an output Properties window is where comments and displayed host
-name can be modified. These settings are initially configured when the output is added.
+name you can modify. These settings are initially configured when the output is added.
Select an output from the Monitored Hosts & Services tab and click **Edit** to open the output Properties
window.
@@ -32,7 +32,7 @@ Properties window closes.
**Integration with Netwrix Threat Prevention for NAS Monitoring**
-If a Threat Prevention Agent has been deployed to the same Windows proxy server where and activity
-agent is deployed to monitor NAS devices, then the **Comment** column in the monitored hosts/services table
-identifies the host as being “Managed by Threat Prevention”, and that output
-isn't editable through the Activity Monitor Console. Add another output if needed.
+If you deploy a Threat Prevention Agent to the same Windows proxy server where an activity
+agent monitors NAS devices, the **Comment** column in the monitored hosts/services table
+identifies the host as “Managed by Threat Prevention”, and that output
+you can't edit through the Activity Monitor Console. Add another output if needed.
diff --git a/docs/activitymonitor/10.0/admin/outputs/gidexclusions/addeditgid.md b/docs/activitymonitor/10.0/admin/outputs/gidexclusions/addeditgid.md
index 6071172afe..6452fb8412 100644
--- a/docs/activitymonitor/10.0/admin/outputs/gidexclusions/addeditgid.md
+++ b/docs/activitymonitor/10.0/admin/outputs/gidexclusions/addeditgid.md
@@ -6,9 +6,9 @@ sidebar_position: 10
# Add or Edit GID Window
-The Add or Edit GID window is opened from a field where a Linux group is needed.
+The Add or Edit GID window opens from a field where a Linux group is needed.
-Type the GID for the desired group in the textbox. Then click OK. The Add or Edit GID window closes,
+Enter the GID for the group you want in the textbox. Then click OK. The Add or Edit GID window closes,
and the group is added to the field where the window was opened.
diff --git a/docs/activitymonitor/10.0/admin/outputs/gidexclusions/gidexclusions.md b/docs/activitymonitor/10.0/admin/outputs/gidexclusions/gidexclusions.md
index 70cc5fd570..d042830288 100644
--- a/docs/activitymonitor/10.0/admin/outputs/gidexclusions/gidexclusions.md
+++ b/docs/activitymonitor/10.0/admin/outputs/gidexclusions/gidexclusions.md
@@ -18,7 +18,7 @@ The tab contains the following settings:
- Add – Opens the Add or Edit GID window to add a group for exclusion. See the
[Add or Edit GID Window](/docs/activitymonitor/10.0/admin/outputs/gidexclusions/addeditgid.md) topic for additional information.
-- Remove – Removes the selected group from exclusion. Confirmation is not requested.
+- Remove – Removes the selected group from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by group, use the **Cancel** button to discard the change.
diff --git a/docs/activitymonitor/10.0/admin/outputs/logfiles.md b/docs/activitymonitor/10.0/admin/outputs/logfiles.md
index 85996aa28f..a6a3dd5fd7 100644
--- a/docs/activitymonitor/10.0/admin/outputs/logfiles.md
+++ b/docs/activitymonitor/10.0/admin/outputs/logfiles.md
@@ -87,8 +87,7 @@ The tab contains the following settings:
server activity from Activity Monitor.
- Report account names – Indicates if an Account Name column is added in the activity log files
-- Add header to Log files – Indicates if headers are added in the activity log filesAdd header to
- Log files – Indicates if headers are added in the activity log files
+- Add header to Log files – Indicates if headers are added in the activity log files
:::note
This is needed to feed data into Splunk in a Syslog output. However, Netwrix Access
@@ -153,8 +152,7 @@ The tab contains the following settings:
:::
-- Add header to Log files – Indicates if headers are added in the activity log filesAdd header to
- Log files – Indicates if headers are added in the activity log files
+- Add header to Log files – Indicates if headers are added in the activity log files
:::note
This is needed to feed data into Splunk in a Syslog output. However, Netwrix Access
diff --git a/docs/activitymonitor/10.0/admin/outputs/operations/suppress.md b/docs/activitymonitor/10.0/admin/outputs/operations/suppress.md
index d3f4f6e0f3..8ff622d7c1 100644
--- a/docs/activitymonitor/10.0/admin/outputs/operations/suppress.md
+++ b/docs/activitymonitor/10.0/admin/outputs/operations/suppress.md
@@ -14,7 +14,7 @@ actions that have not been explicitly triggered by users.
One of the most prominent examples is the Windows File Explorer - the standard application for file
system browsing on the Windows family of operating systems. Over the years, File Explorer has had a
number of improvements and new features. File Explorer displays various information about files to
-provide a better user experience. This allows users to view file content without having to open
+provide a better user experience. With this functionality, users can view file content without having to open
them.
File Explorer displays icons for certain file types like executable (.exe) files. Depending on the
@@ -25,7 +25,7 @@ thumbnail of the files contained within the sub-folder on top of the sub-folder
additional functionality is executed automatically, mostly without the user's explicit action or
intention.
-As an example, a user may wish to open the MySampleReport.docx document located in the
+As an example, a user may want to open the MySampleReport.docx document located in the
MyTestDepartment folder. The user opens the folder, locates the file and double-clicks to open it.
From the user's perspective, only two actions were performed:
@@ -50,7 +50,7 @@ teams and IT auditing software. At the file system level, preview reads are perc
operations, like file copying or opening a file in an application. There exists no distinguishing
factor between explicit user activity and implicit actions by File Explorer. Whether it is a preview
read, opening the file in Notepad, or copying the file, all these operations are perceived as the
-same Read operation at the file system level. Therefore, it is not possible to reliably filter
+same Read operation at the file system level. Therefore, it isn't possible to reliably filter
unintentional activity without the risk of suppressing genuine user actions.
The Activity Monitor employs various techniques to minimize noise. These methods all rely on
diff --git a/docs/activitymonitor/10.0/admin/outputs/processexclusions/addeditprocess.md b/docs/activitymonitor/10.0/admin/outputs/processexclusions/addeditprocess.md
index 215dd6bc2f..dfec1078c6 100644
--- a/docs/activitymonitor/10.0/admin/outputs/processexclusions/addeditprocess.md
+++ b/docs/activitymonitor/10.0/admin/outputs/processexclusions/addeditprocess.md
@@ -14,7 +14,7 @@ output Properties window.
- Process name – Displays the name of the process to be excluded. You can enter a process name in
the textbox or select a process from the Running processes list.
- Filter – Indicates if the filter will be for **All events** or only **Read events**
-- Running Processes – Lists all processes currently running on the host
+- Running Processes – Lists all processes running on the host
Then click OK. The Add or Edit Path window closes, and the path is added to the filtering list for
the monitored host.
diff --git a/docs/activitymonitor/10.0/admin/outputs/processexclusions/processexclusions.md b/docs/activitymonitor/10.0/admin/outputs/processexclusions/processexclusions.md
index a4ad6d2283..86b36f63de 100644
--- a/docs/activitymonitor/10.0/admin/outputs/processexclusions/processexclusions.md
+++ b/docs/activitymonitor/10.0/admin/outputs/processexclusions/processexclusions.md
@@ -23,7 +23,7 @@ The tab contains the following settings and features:
- Add – Opens the Add or Edit Process window to add a new process to the list. See the
[Add or Edit Process Window](/docs/activitymonitor/10.0/admin/outputs/processexclusions/addeditprocess.md) topic for additional information.
-- Remove – Removes the selected path from the list. Confirmation is not requested.
+- Remove – Removes the selected path from the list. Confirmation isn't requested.
:::warning
If a process is removed by accident, use the **Cancel** button to discard the
diff --git a/docs/activitymonitor/10.0/admin/outputs/syslog/messagetemplate.md b/docs/activitymonitor/10.0/admin/outputs/syslog/messagetemplate.md
index 8ae30369bb..26794091c1 100644
--- a/docs/activitymonitor/10.0/admin/outputs/syslog/messagetemplate.md
+++ b/docs/activitymonitor/10.0/admin/outputs/syslog/messagetemplate.md
@@ -11,7 +11,7 @@ field on the Syslog tab of the output Properties window.
-You can select a preconfigured template from the drop-down menu or create a custom template. The
+You can select a preconfigured template from the dropdown menu or create a custom template. The
available preconfigured templates vary based on the type of domain/host selected.
## For Monitored Domains
@@ -30,7 +30,7 @@ Monitored Domains Syslog outputs have the following preconfigured Templates:
- V 2.0 for IBM QRadar SIEM 7.2.4
- V 2.0 for Splunk SIEM
-Custom templates can be created. Select the desired template or create a new template by modifying
+Custom templates can be created. Select the template you want or create a new template by modifying
an existing template within the Message Template window. The new message template will be named
Custom. Macro variables are also available to customize the Syslog message template.
@@ -102,7 +102,7 @@ Monitored Hosts/Services Syslog outputs have the following preconfigured Templat
- Netwrix Threat Manager (StealthDEFEND) – Use this template for Netwrix Threat Manager integration.
This is the only supported template for Threat Manager.
-Custom templates can be created. Select the desired template or create a new template by modifying
+Custom templates can be created. Select the template you want or create a new template by modifying
an existing template within the Message Template window. The new message template will be named
Custom. Macro variables are also available to customize the Syslog message template.
@@ -120,32 +120,32 @@ the Syslog message template:
| File Servers & NAS Devices | %ATTRIBUTE_NAME% | Rename events only: Fixed string: Filename |
| File Servers & NAS Devices | %ATTRIBUTE_VALUE% | Rename events only: New file path |
| File Servers & NAS Devices SharePoint | %BLOCKED_EVENT% | True if the operation was denied, False otherwise |
-| SharePoint SharePoint Online | %CLIENT_IP% | IP address of the user |
-| File Servers & NAS Devices SharePoint SharePoint Online | %COMPANY% | Fixed string: Netwrix |
+| SharePoint, SharePoint Online | %CLIENT_IP% | IP address of the user |
+| File Servers & NAS Devices, SharePoint, SharePoint Online | %COMPANY% | Fixed string: Netwrix |
| SharePoint Online | %CUSTOM_EVENT% | Custom Event information |
| SharePoint Online | %DEST_FILE_EXT% | New file extension of copied or moved file |
| SharePoint Online | %DEST_FILENAME% | Name of the file that is copied or moved |
| SharePoint Online | %DEST_RELATIVE_PATH% | URL of the destination folder where a folder is copied or moved |
| SharePoint Online | %DLP_EXCEPTION% | Reasons why a policy no longer applies and any information about false positive or override |
-| SharePoint Online | %DLP_POLICY% | Policy(s) that triggered the event |
+| SharePoint Online | %DLP_POLICY% | Policys that triggered the event |
| SharePoint Online | %DLP_SENSITIVE% | Indicates whether the event contains the value of the sensitive data type (true/false) |
-| SharePoint SharePoint Online | %DOC_LOCATION% | A relative URL of the file or document accessed by the user |
-| SharePoint SharePoint Online | %EVENT_DATA% | - For SharePoint, raw event data - Fore SharePoint Online, additional event data |
+| SharePoint, SharePoint Online | %DOC_LOCATION% | A relative URL of the file or document accessed by the user |
+| SharePoint, SharePoint Online | %EVENT_DATA% | - For SharePoint, raw event data - Fore SharePoint Online, additional event data |
| File Servers & NAS Devices | %EVENT_NAME% | Operation type: Read/Create/Update/Delete/Access Rights Change/ Rename/ ``. The same as %OPERATION% |
-| SharePoint SharePoint Online | %EVENT_SOURCE% | Originating source of the event (SharePoint or ObjectModel) |
+| SharePoint, SharePoint Online | %EVENT_SOURCE% | Originating source of the event (SharePoint or ObjectModel) |
| File Servers & NAS Devices | %EVENT_SOURCE_NAME% | Domain name |
-| SharePoint SharePoint Online | %EVENT_TYPE% | Event type |
+| SharePoint, SharePoint Online | %EVENT_TYPE% | Event type |
| File Servers & NAS Devices | %FILE_NAME% | File name |
| File Servers & NAS Devices | %FILE_PATH% | Full path |
| File Servers & NAS Devices | %FILE_SIZE% | Size of File |
| File Servers & NAS Devices | %FILE_TYPE% | File extension |
| SharePoint | %FULL_PATH% | Full Path |
-| File Servers & NAS Devices SharePoint SharePoint Online | %HOST% | Hostname of Agent |
+| File Servers & NAS Devices, SharePoint, SharePoint Online | %HOST% | Hostname of Agent |
| SharePoint Online | %ID% | Unique ID of the audit record |
-| File Servers & NAS Devices | %IO_TYPE% | Type of I/O: Filesystem/VSS |
+| File Servers & NAS Devices | %IO_TYPE% | Type of input/output: Filesystem/VSS |
| SharePoint | %ITEM_ID% | Item ID |
-| SharePoint SharePoint Online | %ITEM_TITLE% | Item title |
-| SharePoint SharePoint Online | %ITEM_TYPE% | Item type (File, Folder, Web, Site, Tenant, DocumentLibrary, Page) |
+| SharePoint, SharePoint Online | %ITEM_TITLE% | Item title |
+| SharePoint, SharePoint Online | %ITEM_TYPE% | Item type (File, Folder, Web, Site, Tenant, DocumentLibrary, Page) |
| SharePoint Online | %LIST_ID% | ID of the List |
| SharePoint Online | %LIST_ITEM_ID% | ID of the List Item |
| SharePoint Online | %LIST_NAME% | Name of the List |
@@ -170,40 +170,40 @@ the Syslog message template:
| File Servers & NAS Devices | %PERMISSIONS_SDDL_DESCRIPTION% | Windows events only: Permission change details in readable format |
| File Servers & NAS Devices | %PERMISSIONS_SDDL_DIFF% | Windows events only: Permission change details in SDDL format, '`` ``' |
| File Servers & NAS Devices | %PERPETRATOR% | User name |
-| File Servers & NAS Devices SharePoint SharePoint Online | %PRODUCT% | Fixed string: Activity Monitor |
-| File Servers & NAS Devices SharePoint SharePoint Online | %PRODUCT_VERSION% | Product Version |
-| File Servers & NAS Devices SharePoint SharePoint Online | %PROTOCOL% | Protocol type: CIFS/NFS/VSS/FTP/HDFS/HTTP/HTTPS/Unknown |
+| File Servers & NAS Devices, SharePoint, SharePoint Online | %PRODUCT% | Fixed string: Activity Monitor |
+| File Servers & NAS Devices, SharePoint, SharePoint Online | %PRODUCT_VERSION% | Product Version |
+| File Servers & NAS Devices, SharePoint, SharePoint Online | %PROTOCOL% | Protocol type: CIFS/NFS/VSS/FTP/HDFS/HTTP/HTTPS/Unknown |
| File Servers & NAS Devices | %PROTOCOL_VERSION% | NetApp Data ONTAP Cluster-Mode device events only: Protocol Version |
| File Servers & NAS Devices | %RENAMEUNCPATH% | Rename events only: New UNC path / New NFS export path |
| SharePoint Online | %RESULT_STATUS% | Succeeded, PartiallySucceeded, Failed, True, or False |
| SharePoint Online | %SCOPE% | online or onprem |
| SharePoint Online | %SHARING_ID% | Unique ID of the sharing operation |
-| SharePoint SharePoint Online | %SITE_ID% | ID of the Site |
+| SharePoint, SharePoint Online | %SITE_ID% | ID of the Site |
| SharePoint Online | %SITE_NAME% | Name of the Site |
-| SharePoint SharePoint Online | %SITE_URL% | URL of the Site |
+| SharePoint, SharePoint Online | %SITE_URL% | URL of the Site |
| SharePoint Online | %SOURCE% | Source (SharePoint, SharePointFileOperation, …) |
| SharePoint Online | %SOURCE_FILE_EXT% | File extension |
| SharePoint Online | %SOURCE_FILENAME% | File or folder name |
| SharePoint | %SOURCE_NAME% | Source Name |
| SharePoint Online | %SOURCE_RELATIVE_PATH% | URL of the folder that contains the file accessed by the user |
-| File Servers & NAS Devices SharePoint SharePoint Online | %SUCCESS% | True if the operation was allowed, False otherwise |
-| File Servers & NAS Devices SharePoint SharePoint Online | %SYSLOG_DATE% | Timestamp of event (server time, Syslog format: MMM dd HH:mm:ss) |
+| File Servers & NAS Devices, SharePoint, SharePoint Online | %SUCCESS% | True if the operation was allowed, False otherwise |
+| File Servers & NAS Devices, SharePoint, SharePoint Online | %SYSLOG_DATE% | Timestamp of event (server time, Syslog format: MMM dd HH:mm:ss) |
| File Servers & NAS Devices | %TAGS% | Operation Tags. Reports 'Copy' for events that are probable copies |
| SharePoint Online | %TARGET_NAME% | UPN or name of the target user or group that a resource was shared with |
| SharePoint Online | %TARGET_TYPE% | Type of target user or group that a resource was shared with (Member, Guest, Group, or Partner) |
-| File Servers & NAS Devices SharePoint SharePoint Online | %TIME_STAMP% | Timestamp of event (server time, format: yyyy-MM-dd HH:mm:ss.zzz) |
+| File Servers & NAS Devices, SharePoint, SharePoint Online | %TIME_STAMP% | Timestamp of event (server time, format: yyyy-MM-dd HH:mm:ss.zzz) |
| SharePoint Online | %TIME_STAMP_OFFSET% | Timestamp of event with timezone offset (server time, format: yyyy-MM-ddTHH:mm:ss.zz+HH:mm) |
-| File Servers & NAS Devices SharePoint SharePoint Online | %TIME_STAMP_UTC% | Timestamp of event (UTC, format: yyyy-MM-dd HH:mm:ss.zzz) |
+| File Servers & NAS Devices, SharePoint, SharePoint Online | %TIME_STAMP_UTC% | Timestamp of event (UTC, format: yyyy-MM-dd HH:mm:ss.zzz) |
| SharePoint Online | %TIME_STAMP_Z% | Timestamp of event (UTC, format: yyyy-MM-ddTHH:mm:ss.zzZ) |
| File Servers & NAS Devices | %UNCPATH% | UNC path / NFS export path |
| SharePoint Online | %UPDATE_TYPE% | Added, Removed, or Updated |
| SharePoint Online | %USER_AGENT% | User client or browser |
-| SharePoint SharePoint Online | %USER_ID% | - For SharePoint, ID of the SharePoint user - For SharePoint Online, UPN of the user who performed the operation |
-| SharePoint SharePoint Online | %USER_LOGIN% | - For SharePoint, SharePoint User Login / Encoded Claim - For SharePoint Online, An alternative ID of the user. "DlpAgent" for DLP events. |
-| SharePoint SharePoint Online | %USER_NAME% | SharePoint user name |
+| SharePoint, SharePoint Online | %USER_ID% | - For SharePoint, ID of the SharePoint user - For SharePoint Online, UPN of the user who performed the operation |
+| SharePoint, SharePoint Online | %USER_LOGIN% | - For SharePoint, SharePoint User Login / Encoded Claim - For SharePoint Online, An alternative ID of the user. "DlpAgent" for DLP events. |
+| SharePoint, SharePoint Online | %USER_NAME% | SharePoint user name |
| File Servers & NAS Devices SharePoint | %USER_SID% | User SID or UID |
| SharePoint Online | %USER_TYPE% | Type of the user performed the operation |
| SharePoint Online | %VERSION% | New version of the document/version of deleted document |
| SharePoint | %WEB_APPLICATION_NAME% | Title of the SharePoint Web Application |
-| SharePoint SharePoint Online | %WEB_TITLE% | Title of the Site Collection |
+| SharePoint, SharePoint Online | %WEB_TITLE% | Title of the Site Collection |
| SharePoint Online | %WORKLOAD% | Office 356 service where the activity occurred |
diff --git a/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md b/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md
index 691d67283c..9fe7999909 100644
--- a/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md
+++ b/docs/activitymonitor/10.0/admin/outputs/syslog/syslog.md
@@ -26,10 +26,10 @@ The tab contains the following settings:
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -42,7 +42,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -63,13 +63,13 @@ The tab contains the following settings:
organization’s environment can resolve the name format used.
- The default port for Netwrix Threat Manager is 10001.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- UPD is the only protocol supported for Threat Manager.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -82,7 +82,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -102,10 +102,10 @@ The tab contains the following settings:
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -115,7 +115,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -136,13 +136,13 @@ The tab contains the following settings:
organization’s environment can resolve the name format used.
- The default port for Netwrix Threat Manager is 10000.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- UPD is the only protocol supported for Threat Manager.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -156,7 +156,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -177,13 +177,13 @@ The tab contains the following settings:
organization’s environment can resolve the name format used.
- The default port for Netwrix Threat Manager is 10001.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- UPD is the only protocol supported for Threat Manager.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -194,7 +194,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
diff --git a/docs/activitymonitor/10.0/admin/search/activedirectory/activedirectory.md b/docs/activitymonitor/10.0/admin/search/activedirectory/activedirectory.md
index ebba9c4ec4..248aec75b8 100644
--- a/docs/activitymonitor/10.0/admin/search/activedirectory/activedirectory.md
+++ b/docs/activitymonitor/10.0/admin/search/activedirectory/activedirectory.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Active Directory Search Query
You can search domain activity that has been monitored and recorded to a File output. When you
-select **Active Directory** from the magnifying glass drop-down menu, a New Search tab opens with
+select **Active Directory** from the magnifying glass dropdown menu, a New Search tab opens with
the applicable query filters.
@@ -30,15 +30,15 @@ headers. Below the Search button is the [Export](/docs/activitymonitor/10.0/admi
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -53,11 +53,11 @@ configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
-- Event Source – Set which query categories will be used. The drop-down menu displays a checkbox
+- Event Source – Set which query categories will be used. The dropdown menu displays a checkbox
list of categories.
- Event Result – Filter the data for a specific event result: Any, Success, or Failure
- Event Block – Filter the data for a specific event result related to blocking: Any, Allowed, or
diff --git a/docs/activitymonitor/10.0/admin/search/activedirectory/activedirectory_1.md b/docs/activitymonitor/10.0/admin/search/activedirectory/activedirectory_1.md
index 6f9d307cd3..4aa47ff373 100644
--- a/docs/activitymonitor/10.0/admin/search/activedirectory/activedirectory_1.md
+++ b/docs/activitymonitor/10.0/admin/search/activedirectory/activedirectory_1.md
@@ -32,13 +32,13 @@ The results data grid columns display the following information for each event:
- Affected Object – Active Directory distinguished name for the affected object
- Affected Object SID – Security Identifier of the object/account affected by the event
- Affected Object Name – Name of the Affected Object
-- Protocol – Protocol(s) used for the monitored operation
+- Protocol – Protocols used for the monitored operation
- Query Filter – LDAP filter used in the operation
- Secured Query – Indicates if LDAP connection is secured or not
- Query Objects – Number of returned objects produced by the LDAP request
-- Process Name – Contains process name that is monitored. Currently this is only lsass.exe.
+- Process Name – Contains process name that is monitored. this is only lsass.exe.
- PID – Process Identifier generated for each active process
-- Old Name – Value prior to the monitored change
+- Old Name – Value before the monitored change
- New Name – Value after the monitored change
- Authentication Type – Indicates type of authentication event. Possible values: Kerberos, NTLM.
- Target Host – Name of the originating host
@@ -48,7 +48,7 @@ The results data grid columns display the following information for each event:
- NTLM Logon Type – Indicates type of protocol used to authenticate a connection between client and
server
- Ticket Encryption – Indicates encryption type used in request part of the Kerberos ticket
-- PAC – RID for the group that does not have access
+- PAC – RID for the group that doesn't have access
- SPN – Detects attempts to obtain a list of Service Principal Name values
- User Exists – Indicates if user exists
- N2 Password – Indicates if an invalid password matches the user’s password history
diff --git a/docs/activitymonitor/10.0/admin/search/entraid/entraid.md b/docs/activitymonitor/10.0/admin/search/entraid/entraid.md
index 882627c524..032e9a202b 100644
--- a/docs/activitymonitor/10.0/admin/search/entraid/entraid.md
+++ b/docs/activitymonitor/10.0/admin/search/entraid/entraid.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Microsoft Entra ID Search Query
You can search activity in Microsoft Entra ID (Azure AD) that has been monitored and recorded to a
-File output. When you select **Azure AD / Entra ID** from the magnifying glass drop-down menu, a New
+File output. When you select **Azure AD / Entra ID** from the magnifying glass dropdown menu, a New
Search tab opens with the applicable query filters.
@@ -31,15 +31,15 @@ headers. Below the Search button is the [Export](/docs/activitymonitor/10.0/admi
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -53,11 +53,11 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
-- Source – Set which query categories will be used. The drop-down menu displays a checkbox list of
+- Source – Set which query categories will be used. The dropdown menu displays a checkbox list of
categories.
- Event Result – Filter the data for a specific event result: Any, Success, or Failure
- Reason
diff --git a/docs/activitymonitor/10.0/admin/search/entraid/entraid_1.md b/docs/activitymonitor/10.0/admin/search/entraid/entraid_1.md
index b69a72c8b6..7a9e045ec5 100644
--- a/docs/activitymonitor/10.0/admin/search/entraid/entraid_1.md
+++ b/docs/activitymonitor/10.0/admin/search/entraid/entraid_1.md
@@ -26,12 +26,12 @@ The results data grid columns display the following information for each event:
- Application – Indicates the Application associated with the event
- Service – Indicates the Service associated with the event
- Category – Indicates the Category associated with the event. Categories returned from search
- queries can be configured using the Category filter drop-down.
+ queries can be configured using the Category filter dropdown.
- Operation - Indicates the Operation associated with the event. Operations returned from search
- queries can be configured using the Operation filter drop-down.
+ queries can be configured using the Operation filter dropdown.
- Type – Indicates the Type associated with the event. Types returned from search queries can be
- configured using the Type filter drop-down.
-- Target(s) – Indicates the Target(s) of the event
+ configured using the Type filter dropdown.
+- Targets – Indicates the Targets of the event
- Modified – Indicates modifications associated with the event
- Client App – Indicates the Client App associated with the event
- OS – Indicates the OS associated with the event
@@ -44,7 +44,7 @@ The results data grid columns display the following information for each event:
- Risk – Indicates the level of Risk associated with events
- Conditional Access – Indicates whether Conditional Access was applied to the event
- Conditional Policy – Indicates whether a Conditional Policy was applied to the event
-- Details – If applicable, provides additional information associated with the event that is not
+- Details – If applicable, provides additional information associated with the event that isn't
provided by the other Results columns
At the bottom of the search interface, additional information is displayed for selected events in
diff --git a/docs/activitymonitor/10.0/admin/search/exchangeonline/exchangeonline.md b/docs/activitymonitor/10.0/admin/search/exchangeonline/exchangeonline.md
index 37a650806f..5dc73708d0 100644
--- a/docs/activitymonitor/10.0/admin/search/exchangeonline/exchangeonline.md
+++ b/docs/activitymonitor/10.0/admin/search/exchangeonline/exchangeonline.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# Exchange Online Search Query
You can search Exchange Online activity that has been monitored and recorded to a File output. When
-you select **Exchange Online** from the magnifying glass drop-down menu, a New Search tab opens with
+you select **Exchange Online** from the magnifying glass dropdown menu, a New Search tab opens with
the applicable query filters.
@@ -29,15 +29,15 @@ headers. Below the Search button is the [Export](/docs/activitymonitor/10.0/admi
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -51,9 +51,9 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Source – Filter the data by the source type: All, Admin Audit, Mailbox Access, DLP, Sensitivity
Label, Other
diff --git a/docs/activitymonitor/10.0/admin/search/file/file.md b/docs/activitymonitor/10.0/admin/search/file/file.md
index d6ed62bfa9..5e5c609613 100644
--- a/docs/activitymonitor/10.0/admin/search/file/file.md
+++ b/docs/activitymonitor/10.0/admin/search/file/file.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# File Search Query
You can search Windows file server and NAS device activity that has been monitored and recorded to a
-File output. When you select **File** from the magnifying glass drop-down menu, a New Search tab
+File output. When you select **File** from the magnifying glass dropdown menu, a New Search tab
opens with the applicable query filters.
@@ -24,12 +24,12 @@ headers. Below the Search button is the [Export](/docs/activitymonitor/10.0/admi
Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -40,9 +40,9 @@ The sections have the following filters:
- Events time range – The time frame filter must be configured for every search query:
- - From – Set the date and timestamp for the start of the activity range. The drop-down menu
+ - From – Set the date and timestamp for the start of the activity range. The dropdown menu
opens a calendar.
- - To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+ - To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- File Path – Filter the data for a specific file path where activity has occurred
diff --git a/docs/activitymonitor/10.0/admin/search/linux/linux.md b/docs/activitymonitor/10.0/admin/search/linux/linux.md
index c48aa45ddb..4fd050cbf1 100644
--- a/docs/activitymonitor/10.0/admin/search/linux/linux.md
+++ b/docs/activitymonitor/10.0/admin/search/linux/linux.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Linux Search Query
You can search Linux file server and NAS device activity that has been monitored and recorded to a
-File output. When you select **Linux** from the magnifying glass drop-down menu, a New Search tab
+File output. When you select **Linux** from the magnifying glass dropdown menu, a New Search tab
opens with the applicable query filters.
@@ -24,12 +24,12 @@ headers. Below the Search button is the [Export](/docs/activitymonitor/10.0/admi
Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -40,9 +40,9 @@ The sections have the following filters:
- Events time range – The time frame filter must be configured for every search query:
- - From – Set the date and timestamp for the start of the activity range. The drop-down menu
+ - From – Set the date and timestamp for the start of the activity range. The dropdown menu
opens a calendar.
- - To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+ - To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- File Path – Filter the data for a specific file path where activity has occurred
diff --git a/docs/activitymonitor/10.0/admin/search/linux/linux_1.md b/docs/activitymonitor/10.0/admin/search/linux/linux_1.md
index b3c00584d8..d54eba95c1 100644
--- a/docs/activitymonitor/10.0/admin/search/linux/linux_1.md
+++ b/docs/activitymonitor/10.0/admin/search/linux/linux_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per Linux
agent. You can [Filter](/docs/activitymonitor/10.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/10.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option.
+column headers. The [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option is also available.
diff --git a/docs/activitymonitor/10.0/admin/search/m365copilot/m365copilot.md b/docs/activitymonitor/10.0/admin/search/m365copilot/m365copilot.md
index 3b9d3b527a..b5262bdb1b 100644
--- a/docs/activitymonitor/10.0/admin/search/m365copilot/m365copilot.md
+++ b/docs/activitymonitor/10.0/admin/search/m365copilot/m365copilot.md
@@ -24,8 +24,7 @@ Set the filters as desired and click **Search**. The application searches throug
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/10.0/admin/search/overview.md#filter) and
[Sort](/docs/activitymonitor/10.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the
-[Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option.
+headers. The [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option is also available.
## General Category
diff --git a/docs/activitymonitor/10.0/admin/search/overview.md b/docs/activitymonitor/10.0/admin/search/overview.md
index f52d47c288..e0f09b6149 100644
--- a/docs/activitymonitor/10.0/admin/search/overview.md
+++ b/docs/activitymonitor/10.0/admin/search/overview.md
@@ -19,22 +19,14 @@ Search results are pulled from the File output of the monitored host or domain.
To open the search feature, click the magnifying glass icon and select from the following options:
-- File – Search for monitored file activity on Windows servers and NAS devices. See the File Search
- Query topic for additional information.
-- Active Directory – Search for monitored domain activity. See the Active Directory Search Query
- topic for additional information.
-- Azure AD / Entra ID – Search for monitored tenant activity in Microsoft Entra ID (formerly Azure
- AD). See the Microsoft Entra ID Search Query topic for additional information.
-- SharePoint – Search for monitored SharePoint activity. See the SharePoint Search Query topic for
- additional information.
-- SharePoint Online – Search for monitored SharePoint Online activity. See the SharePoint Online
- Search Query topic for additional information.
-- Exchange Online – Search for monitored Exchange Online activity. See the Exchange Online Search
- Query topic for additional information.
-- SQL Server – Search for monitored SQL Server activity. See the SQL Server Search Query topic for
- additional information.
-- Linux – Search for monitored file activity on Linux servers. See the Linux Search Query topic for
- additional information.
+- File – Search for monitored file activity on Windows servers and NAS devices. See the File Search Query topic for additional information.
+- Active Directory – Search for monitored domain activity. See the Active Directory Search Query topic for additional information.
+- Azure AD / Entra ID – Search for monitored tenant activity in Microsoft Entra ID (formerly Azure AD). See the Microsoft Entra ID Search Query topic for additional information.
+- SharePoint – Search for monitored SharePoint activity. See the SharePoint Search Query topic for additional information.
+- SharePoint Online – Search for monitored SharePoint Online activity. See the SharePoint Online Search Query topic for additional information.
+- Exchange Online – Search for monitored Exchange Online activity. See the Exchange Online Search Query topic for additional information.
+- SQL Server – Search for monitored SQL Server activity. See the SQL Server Search Query topic for additional information.
+- Linux – Search for monitored file activity on Linux servers. See the Linux Search Query topic for additional information.
Queries that may be useful to an organization include the following:
@@ -46,11 +38,11 @@ Queries that may be useful to an organization include the following:
- What did user X do between days Y and Z?
- Administrator activity details?
-Follow the steps to use the search feature.
+To use the search feature:
**Step 1 –** Click the magnifying glass icon and select the source type.
-**Step 2 –** Set the desired filters and click **Search**.
+**Step 2 –** Set the filters you want and click **Search**.
**Step 3 –** Filter and Sort the results in the table as desired.
@@ -58,12 +50,12 @@ Follow the steps to use the search feature.
## Filter
-The drop-down menu for a column header in the search results data grid provides the option to filter
+The dropdown menu for a column header in the search results data grid provides the option to filter
the search results further.
-Choose between checking/unchecking the desired field values from the list of available values and
+Choose between checking/unchecking the field values you want from the list of available values and
typing in the search textbox. The Clear filter option removes all filters from the selected column.
A filter icon appears on the header where filters have been applied. Multiple columns can be
filtered in the search results data grid.
@@ -81,7 +73,7 @@ descending order.
-The drop-down menu on the column header has options to Sort A to Z or Sort Z to A for the selected
+The dropdown menu on the column header has options to Sort A to Z or Sort Z to A for the selected
column. Sorting can only occur for one column at a time.
:::note
@@ -95,5 +87,5 @@ The search results data grid can be exported to a CSV/JSON file.
-Once the search results are configured as desired, click the Export button located at the top left
+After the search results are configured as desired, click the Export button located at the top left
corner of the window. Set the name and location of the CSV/JSON file.
diff --git a/docs/activitymonitor/10.0/admin/search/sharepoint/sharepoint.md b/docs/activitymonitor/10.0/admin/search/sharepoint/sharepoint.md
index 358b126460..4c90e2f34c 100644
--- a/docs/activitymonitor/10.0/admin/search/sharepoint/sharepoint.md
+++ b/docs/activitymonitor/10.0/admin/search/sharepoint/sharepoint.md
@@ -7,7 +7,7 @@ sidebar_position: 60
# SharePoint Search Query
You can search SharePoint activity that has been monitored and recorded to a File output. When you
-select **SharePoint** from the magnifying glass drop-down menu, a New Search tab opens with the
+select **SharePoint** from the magnifying glass dropdown menu, a New Search tab opens with the
applicable query filters.
@@ -25,21 +25,21 @@ By default, the query is set to return all event activity for the past day. Conf
filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
-activity log files and returns the events that match the filters.You can
+activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/10.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/10.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option.
+headers. The [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option is also available.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -54,9 +54,9 @@ configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Event Type – Filter the data by the event type: All, CheckOut, CheckIn, View, Delete, Update,
ProfileChange, ChildDelete, SchemaChange, Undelete, Workflow, Copy, Move, AuditMaskChange, Search,
diff --git a/docs/activitymonitor/10.0/admin/search/sharepoint/sharepoint_1.md b/docs/activitymonitor/10.0/admin/search/sharepoint/sharepoint_1.md
index 8ca426f520..31fa3f235b 100644
--- a/docs/activitymonitor/10.0/admin/search/sharepoint/sharepoint_1.md
+++ b/docs/activitymonitor/10.0/admin/search/sharepoint/sharepoint_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per activity
agent. You can [Filter](/docs/activitymonitor/10.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/10.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option.
+column headers. The [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option is also available.
diff --git a/docs/activitymonitor/10.0/admin/search/sharepointonline/sharepointonline.md b/docs/activitymonitor/10.0/admin/search/sharepointonline/sharepointonline.md
index 229032cb6c..64c9087e78 100644
--- a/docs/activitymonitor/10.0/admin/search/sharepointonline/sharepointonline.md
+++ b/docs/activitymonitor/10.0/admin/search/sharepointonline/sharepointonline.md
@@ -7,7 +7,7 @@ sidebar_position: 70
# SharePoint Online Search Query
You can search SharePoint Online activity that has been monitored and recorded to a File output.
-When you select **SharePoint Online** from the magnifying glass drop-down menu, a New Search tab
+When you select **SharePoint Online** from the magnifying glass dropdown menu, a New Search tab
opens with the applicable query filters.
@@ -28,19 +28,19 @@ filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/10.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/10.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option.
+headers. The [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option is also available.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -54,13 +54,13 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
-- Source – Filter the data by the source type: All, File and Page, Folder, List, Sharing and Access
+- Source – Filter the data by the source type: All, File, and Page, Folder, List, Sharing, and Access
Request, Site Permissions, Site Administration, Synchronization, DLP, Sensitivity Label, Content
- Explorer, Other
+ Explorer, and Other
:::note
Disabling a source that is also a category will hide that category from the query
diff --git a/docs/activitymonitor/10.0/admin/search/sharepointonline/sharepointonline_1.md b/docs/activitymonitor/10.0/admin/search/sharepointonline/sharepointonline_1.md
index 166adaae90..c73610a378 100644
--- a/docs/activitymonitor/10.0/admin/search/sharepointonline/sharepointonline_1.md
+++ b/docs/activitymonitor/10.0/admin/search/sharepointonline/sharepointonline_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per activity
agent. You can [Filter](/docs/activitymonitor/10.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/10.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option.
+column headers. The [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option is also available.
diff --git a/docs/activitymonitor/10.0/admin/search/sqlserver/sqlserver.md b/docs/activitymonitor/10.0/admin/search/sqlserver/sqlserver.md
index 65859e85e9..b3fc61d2fe 100644
--- a/docs/activitymonitor/10.0/admin/search/sqlserver/sqlserver.md
+++ b/docs/activitymonitor/10.0/admin/search/sqlserver/sqlserver.md
@@ -7,7 +7,7 @@ sidebar_position: 80
# SQL Server Search Query
You can search SQL Server activity that has been monitored and recorded to a File output. When you
-select **SQL Server** from the magnifying glass drop-down menu, a New Search tab opens with the
+select **SQL Server** from the magnifying glass dropdown menu, a New Search tab opens with the
applicable query filters.
@@ -24,19 +24,19 @@ filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/10.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/10.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option.
+headers. The [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option is also available.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -50,9 +50,9 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Event Result – Filter the data for a specific event result: Any, Success, or Failure
- Reason
diff --git a/docs/activitymonitor/10.0/admin/search/sqlserver/sqlserver_1.md b/docs/activitymonitor/10.0/admin/search/sqlserver/sqlserver_1.md
index 9808e8cf89..123a7aa24e 100644
--- a/docs/activitymonitor/10.0/admin/search/sqlserver/sqlserver_1.md
+++ b/docs/activitymonitor/10.0/admin/search/sqlserver/sqlserver_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per activity
agent. You can [Filter](/docs/activitymonitor/10.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/10.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option.
+column headers. The [Export](/docs/activitymonitor/10.0/admin/search/overview.md#export) option is also available.
diff --git a/docs/activitymonitor/10.0/gettingstarted.md b/docs/activitymonitor/10.0/gettingstarted.md
index 2fdfa4cefc..0e734a39eb 100644
--- a/docs/activitymonitor/10.0/gettingstarted.md
+++ b/docs/activitymonitor/10.0/gettingstarted.md
@@ -7,12 +7,12 @@ sidebar_position: 10
# Getting Started
Once Netwrix Activity Monitor is installed, the following workflow enables organizations to quickly
-and easily get started with activity monitoring.
+get started with activity monitoring.
## Requirements
The Activity Monitor console needs to be installed on a server or workstation. After that agents are deployed to
-the target environment and configured to monitor activity. It is necessary to prepare the target
+the target environment and configured to monitor activity. Prepare the target
environment and configure the credentials used by the agents. Each supported environment has
different requirements. See the following topics for additional information:
@@ -32,7 +32,7 @@ different requirements. See the following topics for additional information:
## Install & Deploy Agents
-Once the prerequisites are accomplished, you are ready to install the application and deploy agents.
+After the prerequisites are accomplished, you are ready to install the application and deploy agents.
See the following topics for additional information:
- [Install Application](/docs/activitymonitor/10.0/install/application.md)
diff --git a/docs/activitymonitor/10.0/install/agents/agents.md b/docs/activitymonitor/10.0/install/agents/agents.md
index d228eeb630..7c686b11e0 100644
--- a/docs/activitymonitor/10.0/install/agents/agents.md
+++ b/docs/activitymonitor/10.0/install/agents/agents.md
@@ -60,8 +60,8 @@ For file storage, the agent's server should be located close to the monitored NA
:::
:::info
-For Dell devices, the **Dell Common Event Enabler (CEE)** must be installed on the same server as the agent (recommended) or
-on another Windows or Linux server. If installed remotely, the CEE must be configured manually to forward activity to the agent.
+For Dell devices, install the **Dell Common Event Enabler (CEE)** on the same server as the agent (recommended) or
+on another Windows or Linux server. If you install the CEE remotely, configure it manually to forward activity to the agent.
:::
To perform centralized agent maintenance from the application console server, WMI must be enabled on the Windows server where the agent is installed.
diff --git a/docs/activitymonitor/10.0/install/agents/manual.md b/docs/activitymonitor/10.0/install/agents/manual.md
index b7ac8d37fc..897a443846 100644
--- a/docs/activitymonitor/10.0/install/agents/manual.md
+++ b/docs/activitymonitor/10.0/install/agents/manual.md
@@ -8,8 +8,6 @@ sidebar_position: 10
The Netwrix Activity Monitor Agent can be deployed via the console or manually.
-Follow the steps to manually install the agent.
-
**Step 1 –** Navigate to the Activity Monitor Console installation path and locate the agent
installation package. The default location is:
@@ -25,8 +23,8 @@ installation package. The default location is:
-**Step 5 –** On the End-User License Agreement page, select the **I accept the terms in the License
-Agreement** option and click **Next**.
+**Step 5 –** On the End-User License Agreement page, accept the terms in the License
+Agreement and click **Next**.
@@ -67,7 +65,7 @@ The Activity Monitor Agent command line has the following parameters:
- `MANAGEMENT_GROUP`
- To specify the Activity Monitor Agent Management Group (This allows user to limit users in the
- specified group to manage agents, but does not allow users in specified group to install,
+ specified group to manage agents, but doesn't allow users in specified group to install,
upgrade, or uninstall agents).
- Default value: `BUILTIN\Administrators`
- Example: `MANAGEMENT_GROUP=CORP\ActivityMonitorGroup`
@@ -101,7 +99,7 @@ those for NAS devices when applicable.
:::note
These steps are specific to deploying activity agents for monitoring file systems,
-SharePoint, SQL Server, Azure and Office 365 environments. See the
+SharePoint, SQL Server, Azure, and Office 365 environments. See the
[Active Directory Agent Deployment](/docs/activitymonitor/10.0/admin/agents/activedirectory.md) section for
instruction on deploying the AD agent. See the
[Linux Agent Deployment](/docs/activitymonitor/10.0/admin/agents/linux.md) topic for instructions on deploying agents
@@ -109,11 +107,9 @@ to Linux servers.
:::
-Follow the steps to deploy the activity agent to a single Windows server.
-
**Step 1 –** Open the Activity Monitor Console.
-**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agent(s) window opens.
+**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agents window opens.
@@ -127,7 +123,7 @@ additional information. Click **Next**.
-**Step 5 –** On the Credentials to Connect to the Server(s) page, specify the credentials for the
+**Step 5 –** On the Credentials to Connect to the Servers page, specify the credentials for the
server to which the agent is deployed. See the
[Single Activity Agent Deployment](/docs/activitymonitor/10.0/admin/agents/single.md) topic for additional
information on credential options. Click **Connect**.
@@ -140,7 +136,7 @@ installed.
:::
-**Step 6 –** Regardless of the warning messages that the agent cannot be installed or upgraded,
+**Step 6 –** Regardless of the warning messages that the agent can't be installed or upgraded,
click **Next**. The console will automatically detect the agent as it is already installed.
@@ -154,7 +150,7 @@ click **Next**. The console will automatically detect the agent as it is already
:::note
The Activity Monitor Agent Management Group allows users in the specified group to manage
-agents, but does not allow users in specified group to install, upgrade, or uninstall agents.
+agents, but doesn't allow users in specified group to install, upgrade, or uninstall agents.
:::
diff --git a/docs/activitymonitor/10.0/install/agents/manualad.md b/docs/activitymonitor/10.0/install/agents/manualad.md
index 08a8f87329..1161b77c3c 100644
--- a/docs/activitymonitor/10.0/install/agents/manualad.md
+++ b/docs/activitymonitor/10.0/install/agents/manualad.md
@@ -8,8 +8,6 @@ sidebar_position: 30
The AD Module, powered by Threat Prevention, can only be installed on domain controllers.
-Follow the steps to manually deploy the AD Module.
-
**Step 1 –** From the Activity Monitor Console machine, copy the AD Agent executable (
`%ProgramFiles%\Netwrix\Activity Monitor\Console\Agents\SI Agent.exe`) to the domain controller where
you want to install the Agent. Then run the executable. The Netwrix Threat Prevention Windows Agent
@@ -26,8 +24,8 @@ by another Welcome page.
-**Step 4 –** On the End-User License Agreement page, check the **I accept the terms in the License
-Agreement** box and click **Next**.
+**Step 4 –** On the End-User License Agreement page, check the box to accept the terms in the License
+Agreement and click **Next**.
@@ -38,7 +36,7 @@ location.
-> > - Use the Look In field to select the desired installation folder.
+> > - Use the Look In field to select the installation folder you want.
> > - When the Folder name is as desired, click **OK**. The wizard returns to the Destination Folder
> > page.
> > - Click **Next**.
@@ -51,7 +49,7 @@ location.
**Step 6 –** Keep the default radio button selection, Managed by Threat Prevention.
:::note
-The CA Certificate Configuration page is not applicable to the Activity Monitor.
+The CA Certificate Configuration page isn't applicable to the Activity Monitor.
:::
@@ -77,7 +75,7 @@ product to enable communication with it.
- Start Agent Service
- The **Start Agent Service** option starts the Threat Prevention Windows Agent service
- after the installation is complete. If the Threat Prevention Windows Agent service is not
+ after the installation is complete. If the Threat Prevention Windows Agent service isn't
started at the time of installation, the Activity Monitor Agent will start as needed.
- Create Windows Firewall Rules
@@ -106,11 +104,9 @@ The AD Module (NTP Agent) is now installed on the server.
## Add the AD Agent to the Console
-Follow the steps to add the Activity Monitor Windows Agent (with the AD Module) to the Console:
-
**Step 1 –** Open the Activity Monitor Console.
-**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agent(s) window opens.
+**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agents window opens.
@@ -128,17 +124,17 @@ Follow the steps to add the Activity Monitor Windows Agent (with the AD Module)
**Step 6 –** On the Active Directory Connection page, specify the credentials for the domain or
-domain controller(s) where the agent is installed. Click **Connect** to verify connection to the
+domain controllers where the agent is installed. Click **Connect** to verify connection to the
domain. Click **Next**.
-**Step 7 –** Select the domain of the domain controller(s) where the agent is installed. Click
+**Step 7 –** Select the domain of the domain controllers where the agent is installed. Click
**Next**.
-**Step 8 –** Select the domain controller(s) where the agent is installed. Click **Test**.
+**Step 8 –** Select the domain controllers where the agent is installed. Click **Test**.
:::note
When clicking Test while adding the Agent to the Console, the connection may fail. When
@@ -148,7 +144,7 @@ installed.
:::
-**Step 9 –** Ignore the warning messages that the agent cannot be installed or upgraded and click
+**Step 9 –** Ignore the warning messages that the agent can't be installed or upgraded and click
**Next**.
@@ -157,7 +153,7 @@ installed.
:::note
The Activity Monitor Agent Management Group allows users in the specified group to manage
-agents, but does not allow users in specified group to install, upgrade, or uninstall agents.
+agents, but doesn't allow users in specified group to install, upgrade, or uninstall agents.
:::
diff --git a/docs/activitymonitor/10.0/install/agents/manuallinux.md b/docs/activitymonitor/10.0/install/agents/manuallinux.md
index 201322e2c4..3e7027f2ac 100644
--- a/docs/activitymonitor/10.0/install/agents/manuallinux.md
+++ b/docs/activitymonitor/10.0/install/agents/manuallinux.md
@@ -6,8 +6,6 @@ sidebar_position: 20
# Manually Install the Linux Agent
-Follow the steps to manually install the agent.
-
**Step 1 –** Transfer the rpm package to the Linux server.
For example, following is a pscp command:
@@ -68,16 +66,14 @@ This will be needed to add the agent to the console.
## Add the Linux Agent to the Console
Before deploying the Activity agent in a Linux environment, ensure all Prerequisites have been met.
-To effectively monitor activity on a Linux host, it is necessary to deploy an agent to the host.
-Follow the steps to deploy the agent to the Linux host. See the
+To effectively monitor activity on a Linux host, deploy an agent to the host.
+See the
[Linux Agent Server Requirements](/docs/activitymonitor/10.0/requirements/linuxagent.md) topic for additional
information.
-Follow the steps to add the agent to the console.
-
**Step 1 –** Open the Activity Monitor Console.
-**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agent(s) window opens.
+**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agents window opens.
@@ -109,7 +105,7 @@ installed.
**Step 6 –** On the Linux Agent Options page, select which user name to use to run the daemon. To
use root, leave the **Service user name** field blank. Click **Test** to test the connection.
-**Step 7 –** Click **Finish**. The Add New Agent(s) window closes, and the activity agent is
+**Step 7 –** Click **Finish**. The Add New Agents window closes, and the activity agent is
deployed to and installed on the target host.
:::note
diff --git a/docs/activitymonitor/10.0/install/application.md b/docs/activitymonitor/10.0/install/application.md
index 198a9c1965..4837b28924 100644
--- a/docs/activitymonitor/10.0/install/application.md
+++ b/docs/activitymonitor/10.0/install/application.md
@@ -10,8 +10,6 @@ Netwrix Activity Monitor comes with a 10-day trial license to start. If an organ
key has been acquired already, which should be provided by a Netwrix Representative, the file should
be saved in the same location where the Activity Monitor will be installed.
-Follow the steps to install the Netwrix Activity Monitor Console.
-
**Step 1 –** Run the NetwrixActivityMonitorSetup.msi executable to open the Netwrix Activity Monitor
Setup wizard.
@@ -21,8 +19,8 @@ Setup wizard.
-**Step 3 –** On the End User License Agreement page, check the I accept the terms in the License
-Agreement box and click Next.
+**Step 3 –** On the End User License Agreement page, check the checkbox to accept the license
+terms and click **Next**.
diff --git a/docs/activitymonitor/10.0/install/importlicensekey.md b/docs/activitymonitor/10.0/install/importlicensekey.md
index 95b19452f0..fc22a3b5fa 100644
--- a/docs/activitymonitor/10.0/install/importlicensekey.md
+++ b/docs/activitymonitor/10.0/install/importlicensekey.md
@@ -11,7 +11,7 @@ a Access Analyzer key can be done from the Activity Monitor Console. If the Acti
is installed on a server where Access Analyzer has already been installed, it reads the license
information from the Access Analyzer installation directory.
-Follow the steps to import a license key file.
+To import a license key file:
diff --git a/docs/activitymonitor/10.0/install/overview.md b/docs/activitymonitor/10.0/install/overview.md
index d0548e4774..3e3599db39 100644
--- a/docs/activitymonitor/10.0/install/overview.md
+++ b/docs/activitymonitor/10.0/install/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Installation
This topic describes the console installation and agent deployment the process for Activity Monitor.
-Prior to installing the application, ensure that all requirements have been met. See the
+Before installing the application, ensure that all requirements have been met. See the
[Requirements ](/docs/activitymonitor/10.0/requirements/overview.md) topic for additional information.
## Software Compatibility & Versions
diff --git a/docs/activitymonitor/10.0/install/upgrade/removeagent.md b/docs/activitymonitor/10.0/install/upgrade/removeagent.md
index 29ce1b0320..c060cdcf77 100644
--- a/docs/activitymonitor/10.0/install/upgrade/removeagent.md
+++ b/docs/activitymonitor/10.0/install/upgrade/removeagent.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Remove Agents
-On the Agents tab of the Activity Monitor Console, the Remove button allows users to remove the
+On the Agents tab of the Activity Monitor Console, click the Remove button to remove the
selected activity agent from the Agents list and/or uninstall the activity agent from the hosting
server.
diff --git a/docs/activitymonitor/10.0/install/upgrade/updateadagentinstaller.md b/docs/activitymonitor/10.0/install/upgrade/updateadagentinstaller.md
index 7cf2efcca3..65e545d8d7 100644
--- a/docs/activitymonitor/10.0/install/upgrade/updateadagentinstaller.md
+++ b/docs/activitymonitor/10.0/install/upgrade/updateadagentinstaller.md
@@ -20,8 +20,6 @@ license keys for purchased products. See the
topic for information on how to register for a Customer Portal account. Navigate to the Netwrix
Threat Prevention Download section for the 7.5. Download the Threat Prevention Agent binary.
-Then follow the steps to update the AD Module installer used by the Activity Monitor Console.
-
**Step 1 –** On the Agents tab, select **Update AD Module Installer**. The Select AD Module
installer package (SI Agent.exe) window opens.
diff --git a/docs/activitymonitor/10.0/install/upgrade/upgrade.md b/docs/activitymonitor/10.0/install/upgrade/upgrade.md
index b3663f8c8b..ce8fa4dece 100644
--- a/docs/activitymonitor/10.0/install/upgrade/upgrade.md
+++ b/docs/activitymonitor/10.0/install/upgrade/upgrade.md
@@ -13,7 +13,7 @@ other Netwrix products.
## Considerations
While it is strongly recommended to match the versions of both the console and the activity agent,
-activity agent(s) V9.0+ can be managed by Activity Monitor Console V10.0+. Older versions of activity
+activity agents V9.0+ can be managed by Activity Monitor Console V10.0+. Older versions of activity
agents will be limited in monitoring capability until upgraded.
The installation and configuration paths for Netwrix Activity Monitor have been updated from
@@ -23,10 +23,8 @@ for additional information.
## Activity Monitor Upgrade Procedure
-Follow the steps to upgrade from an older version of Netwrix Activity Monitor to Netwrix Activity Monitor 10.0.
-
:::info
-Uninstall of the existing Activity Monitor Console is not required.
+Uninstall of the existing Activity Monitor Console isn't required.
:::
**Step 1 –** Install the Activity Monitor 10.0 on the same machine where the older console resides
@@ -34,7 +32,7 @@ following the instructions in the [Install Application](/docs/activitymonitor/10
Launch the Activity Monitor Console and navigate to the Agents tab.
-**Step 2 –** Select the activity agent(s) to be upgraded. The Windows Ctrl-select option can be used
+**Step 2 –** Select the activity agents to be upgraded. The Windows Ctrl-select option can be used
to select multiple activity agents. Then click Upgrade.
:::info
@@ -44,6 +42,6 @@ Update the activity agents in batches to ensure continuity of monitoring.
The selected activity agents are updated to V10.0. If a Netwrix Threat Prevention Agent is also installed on
the Windows server for monitoring file systems, the Monitored Hosts & Services tab identifies the host as being
-“Managed by Threat Prevention”, and that ‘monitored host’ is not editable. However, multiple outputs
+“Managed by Threat Prevention”, and that ‘monitored host’ isn't editable. However, multiple outputs
can be configured for hosts. Add the Windows host to the Monitored Hosts & Services tab to monitor file system
for outputs to Access Analyzer, Threat Manager, and/or SIEM products.
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/activityagent.md b/docs/activitymonitor/10.0/requirements/activityagent/activityagent.md
index bbf3c28ccd..767324624a 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/activityagent.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/activityagent.md
@@ -60,19 +60,19 @@ See the [Activity Agent Ports](/docs/activitymonitor/10.0/requirements/activitya
## Supported File Storage Platforms
-The Activity Monitor provides the ability to monitor Windows and various NAS file servers.
+The Activity Monitor lets you monitor Windows and various NAS file servers.
:::note
-For monitoring NAS devices, the Activity Agent must be deployed to a Windows server that acts as a proxy for monitoring the target environment.
+For monitoring NAS devices, deploy the Activity Agent to a Windows server that acts as a proxy for monitoring the target environment.
:::
**Supported Windows File Servers Platforms**
-The Activity Monitor provides the ability to monitor Windows file servers:
+The Activity Monitor lets you monitor Windows file servers:
:::note
-To monitor a Windows file server, the Activity Agent must be deployed on the server being monitored.
+To monitor a Windows file server, deploy the Activity Agent on the server being monitored.
:::
@@ -144,7 +144,7 @@ target environment requirements.
See the [Hitachi Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md) topic for target
environment requirements.
-**Nasuni Nasuni Edge Appliances**
+**Nasuni Edge Appliances**
- 8.0+
@@ -180,7 +180,7 @@ environment requirements.
## Supported Microsoft Entra ID
-The Activity Monitor provides the ability to monitor Microsoft Entra ID:
+The Activity Monitor lets you monitor Microsoft Entra ID:
See the [Microsoft Entra ID Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/entraid-activity.md) topic
for target environment requirements.
@@ -188,7 +188,7 @@ for target environment requirements.
## Supported Exchange Online
-The Activity Monitor provides the ability to monitor Exchange Online:
+The Activity Monitor lets you monitor Exchange Online:
See the [Exchange Online Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/exchange-activity.md)
topic for target environment requirements.
@@ -196,7 +196,7 @@ topic for target environment requirements.
## Supported SharePoint Online
-The Activity Monitor provides the ability to monitor SharePoint Online:
+The Activity Monitor lets you monitor SharePoint Online:
See the
[SharePoint Online Activity Auditing Configuration](/docs/activitymonitor/10.0/requirements/activityagent/sharepoint-online-activity.md) topic
@@ -204,7 +204,7 @@ for target environment requirements.
## Supported SharePoint On-Premise Platforms
-The Activity Monitor provides the ability to monitor SharePoint On-Premise farms:
+The Activity Monitor lets you monitor SharePoint On-Premise farms:
:::note
For monitoring a SharePoint farm, the Activity Agent must be deployed to the SharePoint
@@ -222,11 +222,10 @@ topic for target environment requirements.
## Supported SQL Server Platforms
-The Activity Monitor provides the ability to monitor SQL Server:
+The Activity Monitor lets you monitor SQL Server:
:::note
-For monitoring SQL Server, it is recommended to install the Activity Agent must be
-deployed to a Windows server that acts as a proxy for monitoring the target environment.
+For monitoring SQL Server, deploy the Activity Agent to a Windows server that acts as a proxy for monitoring the target environment.
:::
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/activityagentports.md b/docs/activitymonitor/10.0/requirements/activityagent/activityagentports.md
index 48af04eac2..ac54fda6b3 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/activityagentports.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/activityagentports.md
@@ -15,7 +15,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
@@ -129,7 +129,7 @@ Agent server and the target NetApp Data ONTAP 7-Mode device:
Activity Monitor.
:::note
-If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
+If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
device must be configured manually. Also, the External Engine will not reconnect automatically in
the case of a server reboot or service restart.
:::
@@ -150,7 +150,7 @@ Agent server and the target NetApp Data ONTAP Cluster-Mode device:
Activity Monitor.
:::note
-If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
+If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
device must be configured manually. Also, the External Engine will not reconnect automatically in
the case of a server reboot or service restart.
:::
@@ -176,7 +176,7 @@ Agent server and the target Panzura device:
| Communication Direction | Protocol | Ports | Description |
| ------------------------------------------ | ------------- | ----- | ----------------------- |
| Activity Agent Server to Panzura | HTTPS | 443 | Panzura API |
-| Panzura filers to to Activity Agent Server | AMQP over TCP | 4497 | Panzura Event Reporting |
+| Panzura filers to Activity Agent Server | AMQP over TCP | 4497 | Panzura Event Reporting |
Protect the port with a username and password. The credentials will be configured in Panzura.
@@ -220,7 +220,7 @@ Agent server and the target SQL Server:
| ----------------------------------- | -------- | ----- | ----------------------- |
| SQL Server to Activity Agent Server | TCP | 1433 | Default SQL Server Port |
-If the Activity Monitor cannot connect to the SQL Server, ensure that SQL Server Browsing state is
+If the Activity Monitor can't connect to the SQL Server, ensure that SQL Server Browsing state is
**Running**.
## Integration with Netwrix Access Analyzer Additional Firewall Rules
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/entraid-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/entraid-activity.md
index 17e5aa1972..730c0250b5 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/entraid-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/entraid-activity.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Microsoft Entra ID Activity Auditing Configuration
-It is necessary to register Activity Monitor as a web application to the targeted Microsoft Entra ID
-(formerly Azure AD), in order for Activity Monitor to monitor the environment. This generates the
+Register Activity Monitor as a web application to the targeted Microsoft Entra ID
+(formerly Azure AD) so Activity Monitor can monitor the environment. This generates the
Client ID and Client Secret needed by the Activity Agent. See
[Microsoft Support](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-reporting-api-prerequisites-azure-portal)
for assistance in configuring the Microsoft Entra ID web application.
@@ -20,14 +20,14 @@ Microsoft Entra ID.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you have registered the application:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
+ It isn't possible to retrieve the value after saving the new key. It must be
copied first.
:::
@@ -46,7 +46,7 @@ The following permissions are required:
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
+To register Activity Monitor with Microsoft Entra ID:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -79,8 +79,7 @@ application. Now that the application has been registered, permissions need to b
## Grant Permissions to the Registered Application
-Follow the steps to set up permissions to enable the Activity Monitor to monitor data and collect
-logs from Microsoft Entra ID.
+To set up permissions to enable Activity Monitor to monitor data and collect logs from Microsoft Entra ID:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -116,7 +115,7 @@ be collected.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
+To find the registered application's Client ID:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -154,7 +153,7 @@ application’s Client Secret Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
+To find the tenant name where the registered application resides:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -174,8 +173,7 @@ application’s Client Secret Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
-value when saving the new key.
+To find the registered application's Client Secret, create a new key, and save its value when saving the new key:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -185,7 +183,7 @@ documentation for additional information.
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
+It isn't possible to retrieve the value after saving the new key. It must be copied
first.
:::
@@ -212,7 +210,7 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
+If this page is left before the key is copied, then the key isn't retrievable, and
this process will have to be repeated.
:::
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/exchange-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/exchange-activity.md
index e6e51d8d34..0e9d1836bf 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/exchange-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/exchange-activity.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Exchange Online Activity Auditing Configuration
-In order to collect logs and monitor Exchange Online activity using the Netwrix Activity Monitor, it
+to collect logs and monitor Exchange Online activity using the Netwrix Activity Monitor, it
needs to be registered with Microsoft® Entra ID® (formerly Azure AD).
:::note
@@ -25,14 +25,14 @@ See the Enable Auditing for Exchange Online topic for additional information.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+After you have registered the application, the following settings are needed from your tenant:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
+ It isn't possible to retrieve the value after saving the new key. It must be
copied first.
:::
@@ -53,8 +53,6 @@ The following settings are needed from your tenant once you have registered the
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -86,8 +84,6 @@ application. Now that the application has been registered, permissions need to b
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -133,8 +129,6 @@ be collected.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -174,8 +168,6 @@ Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -196,9 +188,6 @@ Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
-value when saving the new key.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -207,7 +196,7 @@ documentation for additional information.
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
+It isn't possible to retrieve the value after saving the new key. It must be copied
first.
:::
@@ -234,7 +223,7 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
+If this page is left before the key is copied, then the key isn't retrievable, and
this process will have to be repeated.
:::
@@ -250,14 +239,12 @@ additional information.
## Enable Auditing for Exchange Online
-Follow the steps to enable auditing for Exchange Online so the Activity Monitor can receive events.
-
**Step 1 –** In the Microsoft Purview compliance portal at
[https://compliance.microsoft.com](https://compliance.microsoft.com/), go to **Solutions** >
**Audit**. Or, to go directly to the Audit page at
[https://compliance.microsoft.com/auditlogsearch](https://compliance.microsoft.com/auditlogsearch).
-**Step 2 –** If auditing is not turned on for your organization, a banner is displayed prompting you
+**Step 2 –** If auditing isn't turned on for your organization, a banner is displayed prompting you
start recording user and admin activity.
**Step 3 –** Select the **Start recording** user and **admin activity** banner.
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/m365copilot-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/m365copilot-activity.md
index d3a4493f51..2b5fe22a75 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/m365copilot-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/m365copilot-activity.md
@@ -10,22 +10,20 @@ To collect logs and monitor Microsoft 365 Copilot activity, register the Netwrix
with Microsoft Entra ID (formerly Azure AD).
:::note
-A user account with the Global Administrator role is required to register an app with
-Microsoft Entra ID.
+Register the app from a user account with the Global Administrator role in Microsoft Entra ID.
:::
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant after you register the application:
+Gather the following settings from your tenant after you register the application:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It isn't possible to retrieve the value after saving the new key. It must be
- copied first.
+ You can't retrieve the value after saving the new key. Copy it first.
:::
@@ -85,7 +83,7 @@ window.
## Identify the Client ID and Tenant ID
-The Client ID and Tenant ID are available on the registered application's Overview page.
+Find the Client ID and Tenant ID on the registered application's Overview page.
**Step 1 –** Select the registered application in **Identity** > **Applications** > **App
registrations** > **All applications**.
@@ -96,8 +94,7 @@ them to a text file.
## Generate the Client Secret Key
:::warning
-It isn't possible to retrieve the value after saving the new key. It must be copied
-first.
+You can't retrieve the value after saving the new key. Copy it first.
:::
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/azure-files/azurefiles-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/azure-files/azurefiles-activity.md
index 535265481b..3bfd78283e 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/azure-files/azurefiles-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/azure-files/azurefiles-activity.md
@@ -19,31 +19,30 @@ There are several steps in preparing Azure Files for monitoring:
## Enable auditing for storage accounts
-Auditing in Azure Files is disabled by default. It must be enabled for each storage account to be monitored.
+Azure Files disables auditing by default. You must enable auditing for each storage account you want to monitor.
### Logs storage account
You must provide a storage account for audit data. The audit data is written as blobs named `insight-logs` to that storage account.
-It must be a different storage account — it cannot be the same account that hosts Azure Files.
+Use a different storage account from the one that hosts Azure Files.
-It is recommended to share such a *logs storage account* among multiple *files storage accounts*.
+Share a single *logs storage account* among multiple *files storage accounts*.
A single account can store nearly unlimited blobs and up to 5 PB of data, which is more than enough for audit logs.
-A shared account also helps stay within the Azure limit of 250–500 accounts per region per subscription.
+A shared account also helps you stay within the Azure limit of 250–500 accounts per region per subscription.
-However, for security reasons, you may choose to use separate *logs storage accounts* so that activity from different accounts is not mixed in the same blob storage.
+However, for security reasons, you may choose to use separate *logs storage accounts* so that activity from different accounts isn't mixed in the same blob storage.
-The *logs storage account* must be in the same Azure region as the monitored Azure Files storage account, but it does not need
-to be in the same resource group or subscription.
+Place the *logs storage account* in the same Azure region as the monitored Azure Files storage account, but it can be in a different resource group or subscription.
-Because the product does not require historical logs, it is recommended to configure an **Azure Lifecycle Management rule** for this storage account
+Because the product doesn't require historical logs, configure an **Azure Lifecycle Management rule** for this storage account
to control storage volume and cost (not documented here). Otherwise, the data will be stored indefinitely.
### Diagnostic setting
To enable auditing, you must enable the Diagnostic Setting for each Azure Files storage account to be monitored.
-This can be done for each storage account individually or in bulk using Azure Policy to set Diagnostic Settings
+Enable the Diagnostic Setting for each storage account individually or in bulk using Azure Policy to set Diagnostic Settings
at the management group, subscription, or resource group scope (not documented here).
1. Open the storage account in the Microsoft Azure portal.
@@ -52,7 +51,7 @@ at the management group, subscription, or resource group scope (not documented h
2. Click **Add diagnostic setting** to create a new auditing configuration or open an existing one.
3. Under the **Logs** section, select **audit**, **StorageRead**, **StorageWrite**, and **StorageDelete**.
- You can adjust these categories based on your needs; for example, unselect **StorageRead** if you are not interested in read activity.
+ You can adjust these categories based on your needs; for example, unselect **StorageRead** if you aren't interested in read activity.
4. Under the **Destination details** section, select **Archive to a storage account**, then choose the storage account prepared in Step 1.
@@ -64,24 +63,22 @@ It may take up to 90 minutes for the changes to take effect.
## Register an application in Azure
-Monitoring of Azure Files requires an application to be registered in the Azure portal, assigning it permissions to access the Graph API and
+To monitor Azure Files, register an application in the Azure portal and assign it permissions to access the Graph API and
RBAC roles to access storage accounts.
:::note
-A user account with the **Global Administrator** role is required to register an app and grant admin consent in Microsoft Azure.
+Use a user account with the **Global Administrator** role to register an app and grant admin consent in Microsoft Azure.
:::
If you already have an application registered for Activity Monitor for Entra ID, SharePoint Online, or Exchange Online, you can reuse that
registration for Azure Files by assigning additional RBAC roles.
-Follow these steps to register the application in Azure.
-
### Open Microsoft Azure portal
- Azure Public – https://portal.azure.com/
-- Azure for US Government GCC – https://portal.azure.com/
-- Azure for US Government GCC High – https://portal.azure.us/
-- Azure for US Government DoD – https://portal.azure.us/
+- Azure for United States Government GCC – https://portal.azure.com/
+- Azure for United States Government GCC High – https://portal.azure.us/
+- Azure for United States Government DoD – https://portal.azure.us/
- Azure Germany – https://portal.microsoftazure.de/
- Azure China by 21Vianet – https://portal.azure.cn/
@@ -97,7 +94,7 @@ Use the search box to locate the **App registrations** page, then select **New r
### Copy Application (client) ID and Tenant (directory) ID
-On the **Overview** page, copy the **Application (client) ID** and **Directory (tenant) ID** values and save them for later.
+From the **Overview** page, copy the **Application (client) ID** and **Directory (tenant) ID** values and save them for later.
### Create a new client secret
@@ -111,7 +108,7 @@ Be aware of the client secret's expiration date. You'll need to generate a new o
:::
:::warning
-Make sure you copy the **Value**, not the **Secret ID**.
+Ensure you copy the **Value**, not the **Secret ID**.
:::
### Grant API permissions
@@ -136,7 +133,7 @@ Assign the following roles to the registered application:
Allows enumeration of storage accounts and reading of their settings.
- `Storage Blob Data Reader` – the data plane role.
- Allows reading of audit data from the logs storage account(s).
+ Allows reading of audit data from the logs storage accounts.
You can assign these roles at different levels, which grant access to all storage accounts within the selected scope:
@@ -187,7 +184,7 @@ The last step is adding the Azure Files storage account to Activity Monitor.
1. On the **Monitored Hosts & Services** page, select **Add Host/Service**.
2. Select the agent that will be monitoring Azure Files, and then select **Next**.
3. Select **Azure Files**, specify the tenant’s domain name, and then select **Next**.
-4. On the **Connection** page, specify the Tenant ID (if it was not resolved automatically), Client ID, and Client Secret—values
+4. On the **Connection** page, specify the Tenant ID (if it wasn't resolved automatically), Client ID, and Client Secret—values
copied in the previous steps during application registration.
5. Select **Connect**.
The button will verify the connection to Azure, enumerate all storage accounts, and retrieve their settings visible to the registered application.
@@ -204,4 +201,4 @@ You can use this wizard multiple times to add newly created storage accounts—a
:::
8. Check the status of the added storage accounts on the **Monitored Hosts & Services** page.
-Address any audit setting misconfigurations or missing RBAC roles.
\ No newline at end of file
+Address any audit setting misconfigurations or missing RBAC roles.
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/celerra-vnx-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/celerra-vnx-activity.md
index 53551322d8..ee310d044c 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/celerra-vnx-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/celerra-vnx-activity.md
@@ -6,20 +6,20 @@ sidebar_position: 20
# Dell Celerra & Dell VNX Activity Auditing Configuration
-An Dell Celerra or VNX device can be configured to audit Server Message Block (SMB) protocol access
-events. All audit data can be forwarded to the Dell Common Event Enabler (CEE). The Activity Monitor
+Configure a Dell Celerra or VNX device to audit Server Message Block (SMB) protocol access
+events. Forward all audit data to the Dell Common Event Enabler (CEE). The Activity Monitor
listens for all events coming through the Dell CEE and translates all relevant information into
entries in the Log files or syslog messages.
-Complete the following checklist prior to configuring the Activity Monitor to monitor the host.
+Complete the following checklist before configuring the Activity Monitor to monitor the host.
Instructions for each item of the checklist are detailed within the following sections.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - DNS name of Celerra or VNX CIFS share(s) to be monitored
- - Data Mover or Virtual Data Mover hosting the share(s) to be monitored
+ - DNS name of Celerra or VNX CIFS shares to be monitored
+ - Data Mover or Virtual Data Mover hosting the shares to be monitored
- Account with access to the CLI
- Download the Dell CEE from:
@@ -38,10 +38,10 @@ Instructions for each item of the checklist are detailed within the following se
- Important:
- - Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE
+ - Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE
is installed
- - Dell CEE 8.4.2 through Dell CEE 8.6.1 are not supported for use with the VCAPS feature
- - Dell CEE requires .NET Framework 3.5 to be installed on the Windows proxy server
+ - Dell CEE 8.4.2 through Dell CEE 8.6.1 aren't supported for use with the VCAPS feature
+ - Install .NET Framework 3.5 on the Windows proxy server before installing Dell CEE
- See the [Install & Configure Dell CEE](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md) topic for instructions.
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md
index 1e26acd973..0fb12af656 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install & Configure Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -15,13 +15,11 @@ Remember, the latest version is the recommended version of Dell CEE.
:::info
-The Dell CEE package can be installed on the Windows server where the Activity
+Install the Dell CEE package on the Windows server where the Activity
Monitor agent will be deployed (recommended) or on any other Windows or Linux server.
:::
-Follow the steps to install the Dell CEE.
-
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -41,14 +39,13 @@ asynchronous bulk delivery (VCAPS) feature.
See the [CEE Debug Logs](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md#cee-debug-logs) section for information on
troubleshooting issues related to Dell CEE.
-After Dell CEE installation is complete, it is necessary to Connect Data Movers to the Dell CEE
+After Dell CEE installation is complete, connect Data Movers to the Dell CEE
Server.
## Configure Dell Registry Key Settings
-There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+In some cases, install Dell CEE on a different Windows server than the
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -58,12 +55,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
@@ -94,19 +91,19 @@ Mover.
administrative account should have a $ character in the terminal.
:::note
-Do not use a # charter.
+Don't use a # charter.
:::
**Step 2 –** Create or retrieve the `cepp.conf` file.
-If there is not a `cepp.conf` file on the Data Mover(s), use a text editor to create a new blank
+If there isn't a `cepp.conf` file on the Data Movers, use a text editor to create a new blank
file in the home directory named `cepp.conf`. The following is an example command if using the text
editor 'vi' to create a new blank file:
**$ vi cepp.conf**
-> If a `cepp.conf` file already exists, it can be retrieved from the Data Movers for modification
+> If a `cepp.conf` file already exists, retrieve it from the Data Movers for modification
> with the following command:
**$ server_file [DATA_MOVER_NAME] -get cepp.conf cepp.conf**
@@ -116,31 +113,31 @@ editor 'vi' to create a new blank file:
guide instructions on how to add parameters or edit the values or existing parameters.
:::note
-The information can be added to the file on one line or separate lines by using a space
+Add the information to the file on one line or separate lines by using a space
and a "\"" at the end of each line, except for the last line and the lines that contain global
options: `cifsserver`, `surveytime`, `ft`, and `msrpcuser`.
:::
-The Activity Monitor requires the following parameters to be set in the `cepp.conf` file:
+Set the following parameters in the `cepp.conf` file for the Activity Monitor:
- `pool name= `
- - This should equal the name assigned to the configuration container. This container is composed
- of the server(s) IP Address or FQDN where the Dell CEE is installed and where the list of
- events to be monitored is located. It can be named as desired but must be a pool name.
+ - Assign the name of the configuration container. This container is composed
+ of the servers IP Address or FQDN where the Dell CEE is installed and where the list of
+ events to be monitored is located. Name it as desired, but it must function as a pool name.
- `servers= `
- This should equal the IP Address or FQDN of the Windows server where the Dell CEE is
installed. If several servers are specified, separate them with the vertical bar (|) or a
colon (:).
- `postevents= `
- - The following events are required (separated with the vertical bar):
+ - Include the following events (separated with the vertical bar):
`CloseModified|CloseUnmodified|CreateDir|CreateFile|DeleteDir|DeleteFile|RenameDir|RenameFile|SetAclDir|SetAclFile `
- - If "Directory Read/List" operations are needed, append `OpenDir` to the list.
+ - To monitor "Directory Read/List" operations, append `OpenDir` to the list.
- `msrpcuser= `
- - This should equal the domain account used to run the Dell CEE Monitor and Dell CAVA services
- on the Windows server. This parameter is a security measure used to ensure events are only
- sent to the appropriate servers.
+ - Specify the domain account that runs the Dell CEE Monitor and Dell CAVA services
+ on the Windows server. This parameter ensures that events are sent only
+ to the appropriate servers.
All unspecified parameters use the default setting. For most configurations, the default
setting is sufficient.
@@ -175,7 +172,7 @@ The Activity Monitor requires the following parameters to be set in the `cepp.co
postevents=CloseModified|CloseUnmodified|CreateDir|CreateFile|DeleteDir|DeleteFile|RenameDir|RenameFile|SetAclDir|SetAclFile
-**Step 4 –** Move the `cepp.conf` file to the Data Mover(s) root file system. Run the following
+**Step 4 –** Move the `cepp.conf` file to the Data Movers root file system. Run the following
command:
**$ server_file [DATA_MOVER_NAME]-put cepp.conf cepp.conf**
@@ -186,7 +183,7 @@ file, but each configuration file can specify different events.
:::
-**Step 5 –** (This step is required only if using the `msrpcuser` parameter) Register the MSRPC user
+**Step 5 –** (Perform this step only if using the `msrpcuser` parameter) Register the MSRPC user
(see Step 3 for additional information on this parameter). Before starting CEPA for the first time,
the administrator must issue the following command from the Control Station and follow the prompts
for entering information:
@@ -201,7 +198,7 @@ Then verify the CEPA status using the following command:
**server_cepp [DATA_MOVER_NAME] -service –status**
-Once the `cepp.config` file has been configured, it is time to configure and enable monitoring with
+After the `cepp.config` file has been configured, you can configure and enable monitoring with
the Activity Monitor. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor)
for additional information.
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/validate.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/validate.md
index cb72c8dacc..052bf85ae8 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/validate.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/validate.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
-configuration must be validated to ensure events are being monitored.
+After the Activity Monitor agent is configured to monitor the Dell device, validate the automated
+configuration to ensure events are being monitored.
## Validate Dell CEE Registry Key Settings
@@ -19,12 +19,9 @@ topic for information on manually setting the registry key.
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
-configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
-to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
-deployed.
+configure the Dell CEE automatically if it is installed on the same server as the agent. In rare situations where the Dell CEE is installed on a different server than the Windows proxy servers where the Activity Monitor activity agent is deployed, you must configure it manually.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -90,7 +87,7 @@ Dell CEE Services are Running topic for additional information.
## Validate Dell CEE Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -103,8 +100,7 @@ The following services laid down by the Dell CEE installer should have Running a
## Dell CEE Debug Logs
-If an issue arises with communication between the Dell CEE and the Activity Monitor, the debug logs
-need to be enabled for troubleshooting purposes. Follow the steps.
+If communication between the Dell CEE and the Activity Monitor fails, enable the debug logs for troubleshooting purposes. Follow the steps.
**Step 6 –** In the Activity Monitor Console, change the **Trace level** value in the lower right
corner to Trace.
@@ -120,19 +116,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, add it.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, add it.
:::
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/cohesity-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/cohesity-activity.md
index 4be32074cc..0524e22713 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/cohesity-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/cohesity-activity.md
@@ -6,7 +6,7 @@ sidebar_position: 8
# Cohesity SmartFiles Activity Auditing Configuration
-The Netwrix Activity Monitor can be configured to monitor file activity on Cohesity SmartFiles
+Configure the Netwrix Activity Monitor to monitor file activity on Cohesity SmartFiles
devices. Activity Monitor reads activity from audit logs produced by the **File Services Audit
Logs** feature in Cohesity SmartFiles.
@@ -29,11 +29,11 @@ Monitoring Cohesity SmartFiles requires access by two methods:
optionally, to enable auditing.
- **SMB/CIFS** — to read audit logs.
-An API key is required for Cohesity API access. Unlike passwords, API keys bypass the Password
+Generate an API key for Cohesity API access. Unlike passwords, API keys bypass the Password
Policy and stay active for a set duration without expiring, which avoids disruption caused by
password rotation.
-The API key can be created directly from the Activity Monitor Console using the built-in
+Create the API key directly from the Activity Monitor Console using the built-in
instruction available at the API key step of the Add Host wizard — this is the recommended
approach. Alternatively, create the API key manually using the steps in the
[Create an API Key](#create-an-api-key) section.
@@ -104,8 +104,8 @@ wizard. Enter the username, password, a name for the key, and the duration in da
select **Create API Key**. The Console will generate the key automatically.
:::note
-The credentials entered in the Console are used only once to retrieve the API key and aren't
-saved or cached.
+The Console uses the credentials you enter only once to retrieve the API key and doesn't
+save or cache them.
:::
Alternatively, create the API key manually using the following curl or PowerShell commands. Replace
@@ -212,7 +212,7 @@ additional information.
By default, all clients in the Global Allowlist set at the cluster level can access audit logs.
Use the **Override Allowlist** option to restrict access to a specific subnet. SMB permissions
-on the view also control access for AD or local principals. Both settings can be managed on the
+on the view also control access for AD or local principals. Manage both settings on the
**System** > **Audit Logs** > **Log Settings** page.
**Override global IP allowlist**
@@ -243,7 +243,7 @@ The Activity Monitor Agent reads the audit logs via SMB.
### Enable Auditing for Views
-Auditing can be enabled or disabled per view.
+Enable or disable auditing per view.
**Step 1 –** Open the Cohesity web interface.
@@ -287,6 +287,6 @@ This delay is by design: Cohesity prioritizes active workloads over audit log fl
result, with the default configuration, audit logs are suitable for historical analysis but not
real-time monitoring.
-An internal configuration option exists in Cohesity that can reduce this latency by forcing audit
-logs to be written more frequently. If you need to reduce latency, contact Cohesity Support.
+An internal configuration option exists in Cohesity that reduces this latency by writing audit
+logs more frequently. If you need to reduce latency, contact Cohesity Support.
:::
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ctera-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ctera-activity.md
index e3adc627c7..959913e85b 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ctera-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ctera-activity.md
@@ -40,11 +40,9 @@ portal.
## Enable Auditing on CTERA Edge Filer
-The CTERA Edge Filer can generate audit log events for the SMB access. Audit events are stored in a
-local file and then forwarded to the CTERA Portal for further processing. The audit log is disabled
-by default and must be enabled.
-
-Follow the steps to enable SMB audit logs.
+The CTERA Edge Filer generates audit log events for SMB access. Each Edge Filer stores audit events in a
+local file and forwards them to the CTERA Portal for further processing. The audit log is disabled
+by default; you must enable it.
**Step 1 –** Log in to the Edge Filer web interface. In the Configuration view, select **Logs** >
**Audit Logs**.
@@ -64,10 +62,10 @@ create a share.
**Step 4 –** Adjust the **Keep closed files for** parameter. Otherwise, use the default value.
**Step 5 –** Check all events except the **Read Extended Attributes** event in Events to log list.
-If you do not require monitoring of _Directory Read/List_ operations, which typically generate a
+If you don't require monitoring of _Directory Read/List_ operations, which typically generate a
high volume of data, uncheck the **List Folder Read Data** event.
-**Step 6 –** Make sure that **Log permission changes in human readable format** is unchecked.
+**Step 6 –** ensure that **Log permission changes in human readable format** is unchecked.
**Step 7 –** Click **Save**.
@@ -86,8 +84,7 @@ The following services must be enabled and configured on the CTERA Portal:
- CTERA Edge Filer Syslog Service – Consolidates audit events from Edge Filers and sends them to the
Activity Monitor Agent and other consumers.
-Both services are disabled by default and must be enabled. The Messaging service must be enabled
-first.
+Both services are disabled by default. Enable the Messaging service first, then enable the Edge Filer Syslog service.
### Enable the Messaging Service
@@ -112,7 +109,7 @@ use as messaging servers. Click **Save**.
:::note
In a production environment, designate three servers as messaging servers. In a small or
test environment, CTERA supports using a single messaging server, typically the main database
-server. However, in all other cases, exactly three servers must be assigned as messaging servers.
+server. However, in all other cases, assign exactly three servers as messaging servers.
See the
[Managing the CTERA Messaging Service](https://kb.ctera.com/docs/managing-the-ctera-messaging-service-2)
article for additional information.
@@ -123,7 +120,7 @@ article for additional information.
and then to ACTIVE. Wait until the status is ACTIVE before proceeding to the next step.
:::note
-If the status does not change to ACTIVE, the log files need to be collected from
+If the status doesn't change to ACTIVE, collect the log files from
`/usr/local/lib/ctera/work/logs/services` directory.
See the
[CTERA Messaging Service Logs](https://kb.ctera.com/docs/setting-up-the-ctera-messaging-service-2#ctera-messaging-service-logs)
@@ -136,7 +133,7 @@ article for additional information.
Ensure the Enable the Messaging Service section is completed before proceeding to enable the Syslog
Service.
-The Edge Filer Syslog Service can be configured in two ways:
+Configure the Edge Filer Syslog Service in two ways:
- Automatically by the Activity Monitor using the API from CTERA Portal.
- Manually using the CTERA Portal web interface.
@@ -146,8 +143,6 @@ Monitor Agent will apply the settings and perform periodic checks to ensure cor
automatic configuration, use the **Enable Edge Filer Syslog auditing** option in the host properties
and specify credentials to access the CTERA Portal API.
-Follow the steps to configure the Edge Filer Syslog Service manually.
-
**Step 1 –** Configure monitoring of the CTERA Portal in the Activity Monitor Console.
**Step 2 –** Add a CTERA host on the Monitored Hosts & Services tab and specify the portal host name,
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md
index deade0c148..778fc860e7 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# Configure Access to HNAS Audit Logs on Activity Agent Server
-Follow the steps to configure access to the HNAS audit logs on the Windows server hosting the
-Activity Monitor activity agent.
+To configure access to the HNAS audit logs on the Windows server hosting the
+Activity Monitor activity agent:
**Step 1 –** On the Windows computer, go to Run and type `compmgmt.msc`.
@@ -22,7 +22,7 @@ Folders > Shares.
**Step 5 –** Select the Security tab and click Advanced.
**Step 6 –** In the Advanced Security Settings dialog box, select the Audit tab. Click Add or Edit
-to select the users and groups to be audited and add the desired user or group.
+to select the users and groups to be audited and add the user or group you want.
**Step 7 –** Select All for Type, and Full Control for Basic permissions.
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md
index 58f7a555eb..b196e4709b 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Configure Audit Logs on HNAS
-Follow the steps to configure access to the HNAS audit logs on the Hitachi device.
-
**Step 1 –** Open a browser and enter the IP Address for HNAS in the address bar to launch the
Hitachi Storage Navigator (SN). Enter the username and password.
@@ -33,7 +31,7 @@ auditing). In the Audit Log section, set the maximum log file size to a value of
is recommended to set it to 16 MB. In the Log roll over policy section, select New. The product does
not support the Wrap policy. Click OK to close.
-Once access has been configured on the Hitachi device, it is necessary to configure access to the
+Once access has been configured on the Hitachi device, configure access to the
HNAS audit logs on the Windows server. See the
[Configure Access to HNAS Audit Logs on Activity Agent Server](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md) topic for
additional information.
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md
index 57c227b08d..3cfb56f1c7 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md
@@ -11,7 +11,7 @@ multiple file systems. Auditing is enabled and configured per file system. This
to enable auditing on an HNAS and to configure the Activity Monitor to monitor activity coming from
the Hitachi device auditing.
-The Activity Monitor does not use the EVS or file system name to connect to HNAS. Therefore, all
+The Activity Monitor doesn't use the EVS or file system name to connect to HNAS. Therefore, all
that is required of the user for HNAS activity collection is the following:
- Logs path (UNC)
@@ -39,11 +39,11 @@ clients using other protocols would be costly in terms of system performance, be
operation would have to be audited as an open operation. **Therefore, when file system auditing is
enabled, by default, only clients connecting through the CIFS protocol are allowed access to the
file system.** Access by clients using other protocols, like NFS, can, however, be allowed. When
-such access is allowed, access to file system objects through these protocols is not audited.”
+such access is allowed, access to file system objects through these protocols isn't audited.”
:::note
File system auditing can be configured to deny access to clients connecting with protocols
-that cannot be audited (NFS). Please see the Hitachi
+that can't be audited (NFS). see the Hitachi
[Server and Cluster Administration Guide](https://support.hds.com/download/epcra/hnas0106.pdf) for
additional information.
:::
@@ -51,7 +51,7 @@ additional information.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Hitachi devices.
+Complete the following checklist before configuring activity monitoring of Hitachi devices.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: [Configure Audit Logs on HNAS](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md)**
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/installcee.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/installcee.md
index 39bfb11e36..3bbdf71c57 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/installcee.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -15,15 +15,15 @@ Remember, the latest version is the recommended version of Dell CEE.
:::info
-The Dell CEE package can be installed on the Windows server where the Activity
+Install the Dell CEE package on the Windows server where the Activity
Monitor agent will be deployed (recommended) or on any other Windows or Linux server.
:::
-Follow the steps to install the Dell CEE.
+To install the Dell CEE, complete the following steps:
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
-this component. It is recommended to use the most current version.
+this component. Use the most current version.
**Step 2 –** Follow the instructions in the Dell
[Using the Common Event Enabler on Windows Platforms](https://www.dell.com/support/home/en-us/product-support/product/common-event-enabler/docs)
@@ -44,9 +44,8 @@ issues related to Dell CEE.
## Configure Dell Registry Key Settings
-There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+In some cases, install Dell CEE on a different Windows server than the
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -56,12 +55,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/isilon-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/isilon-activity.md
index 75ad3013eb..17a6cf7bf4 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/isilon-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/isilon-activity.md
@@ -6,29 +6,29 @@ sidebar_position: 30
# Dell Isilon/PowerScale Activity Auditing Configuration
-Dell Isilon/PowerScale can be configured to audit Server Message Block (SMB) and NFS protocol access
-events on the Dell Isilon/PowerScale cluster. All audit data can be forwarded to the Dell Common
+Configure Dell Isilon/PowerScale to audit Server Message Block (SMB) and NFS protocol access
+events on the Dell Isilon/PowerScale cluster. Forward all audit data to the Dell Common
Event Enabler (CEE). The Activity Monitor listens for all events coming through the Dell CEE and
translates all relevant information into entries in the log files or syslog messages.
-Protocol auditing must be enabled and then configured on a per-access zone basis. For example, all
-SMB protocol events on a particular access zone can be audited, while only attempts to delete files
-on a different access zone can be audited.
+Enable and configure protocol auditing on a per-access zone basis. For example, audit all
+SMB protocol events on a particular access zone, or audit only attempts to delete files
+on a different access zone.
-The audit events are logged and stored on the individual OneFS nodes where the SMB/NFS client
-initiated the activity. The stored events are then forwarded by the node to the Dell CEE instance or
-concurrently to several instances. At this point, Dell CEE forwards the audit event to a defined
+OneFS nodes log and store audit events on the individual nodes where the SMB/NFS client
+initiated the activity. The nodes then forward the stored events to the Dell CEE instance or
+concurrently to several instances. Dell CEE forwards the audit event to a defined
endpoint, such as Activity Monitor agent.
-Complete the following checklist prior to configuring Activity Monitor to monitor the host.
+Complete the following checklist before configuring Activity Monitor to monitor the host.
Instructions for each item of the checklist are detailed within the following sections.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - DNS name of Isilon/PowerScale CIFS share(s) to be monitored
- - Access Zone(s) containing the CIFS shares to be monitored
+ - DNS name of Isilon/PowerScale CIFS shares to be monitored
+ - Access Zones containing the CIFS shares to be monitored
- Account with access to the OneFS UI or CLI
- Download the Dell CEE from:
@@ -46,7 +46,7 @@ activity will be evenly distributed between the pairs.
- Dell CEE should be installed on a Windows or a Linux server.
:::info
- Dell CEE can be installed on the same server as the Activity Agent, or on a
+ Install Dell CEE on the same server as the Activity Agent, or on a
different Windows or Linux server. If CEE is installed on the same server, the Activity Agent
can configure it automatically.
:::
@@ -54,9 +54,9 @@ activity will be evenly distributed between the pairs.
- Important:
- - Dell CEE 8.8 is the minimum supported version. It is recommended to use the latest available
+ - Dell CEE 8.8 is the minimum supported version. Use the latest available
version.
- - Dell CEE requires .NET Framework 3.5 to be installed on the Windows server
+ - Install .NET Framework 3.5 on the Windows server before installing Dell CEE
Checklist Item 3: Configure Auditing on the Dell Isilon/PowerScale Cluster
@@ -79,12 +79,12 @@ Checklist Item 3: Configure Auditing on the Dell Isilon/PowerScale Cluster
- Important:
- Value of the **Storage Cluster Name** field must exactly match the name entered for the
- monitored host in the Activity Monitor Console. If the Storage Cluster Name cannot be modified
+ monitored host in the Activity Monitor Console. If the Storage Cluster Name can't be modified
(for example, another 3rd party depends on it), you need to set the Host Aliases parameter in
the Activity Monitor Console. Otherwise, if for some reason the Storage Cluster Name must be
left empty, one can list OneFS cluster node names in the Host Aliases.
- - If the Storage Cluster Name is not empty, set the Host Aliases parameter to its value
+ - If the Storage Cluster Name isn't empty, set the Host Aliases parameter to its value
- If the Storage Cluster Name is empty, set the Host Aliases to a semicolon-separated list
of OneFS node names
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/manualconfiguration.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/manualconfiguration.md
index e9006d0363..5776b8a438 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/manualconfiguration.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/manualconfiguration.md
@@ -22,7 +22,7 @@ cluster, include all relevant zones.
Ensure that OneFS collects only events you are interested in. By default, OneFS may monitor things
like directory reads, which can take up a large amount of space. Configuring the OneFS events that
-need monitoring is not done through the Activity Monitor console. Configure OneFS event monitoring
+need monitoring isn't done through the Activity Monitor console. Configure OneFS event monitoring
using OneFS CLI with the isi audit modify command for each access zone. Enabling monitoring for only
what is needed for the environment will reduce the data load to the agent.
@@ -54,8 +54,8 @@ server hosting CEE. Use either of the following format:
:::info
-When deploying multiple Dell CEE instances at scale, it is recommended that an
-accommodating agent must be configured with each CEE instance. If multiple CEE instances send events
+When deploying multiple Dell CEE instances at scale, configure an
+accommodating agent with each CEE instance. If multiple CEE instances send events
to just one agent, it may create an overflow of data and overload the agent. Distributing the
activity stream into pairs will be the most efficient way of monitoring large data sets at scale.
:::
@@ -66,7 +66,7 @@ be an exact match to the name which is entered in the Activity Monitor for the *
list.
This name is used as a ‘tag’ on all events coming through the CEE. This name must exactly match what
-is in the Activity Monitor or it does not recognize the events.
+is in the Activity Monitor or it doesn't recognize the events.
:::info
Use the CIFS DNS name for Dell OneFS.
@@ -79,10 +79,10 @@ name entered here must exactly match what is used for Access Analyzer as a targe
:::
-If the Storage Cluster Name cannot be modified (for example, another third-party depends on it), you
+If the Storage Cluster Name can't be modified (for example, another third-party depends on it), you
need to set the Host Aliases parameter in the Activity Monitor Console:
-- If the Storage Cluster Name is not empty, set the Host Aliases parameter to its value
+- If the Storage Cluster Name isn't empty, set the Host Aliases parameter to its value
- If the Storage Cluster Name is empty, set the Host Aliases to a semicolon-separated list of OneFS
node names
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/validate.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/validate.md
index 2bd4def69e..e7da4848e2 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/validate.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/validate.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
+After the Activity Monitor agent is configured to monitor the Dell device, the automated
configuration must be validated to ensure events are being monitored.
## Validate Dell CEE Registry Key Settings
@@ -14,10 +14,10 @@ configuration must be validated to ensure events are being monitored.
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
+a different server than the Windows proxy servers where the Activity Monitor activity agent is
deployed.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -83,7 +83,7 @@ Dell CEE Services are Running topic for additional information.
## Validate Dell CEE Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -113,19 +113,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md
index a74a220d97..4a817d8222 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md
@@ -6,14 +6,14 @@ sidebar_position: 70
# Nasuni Edge Appliance Activity Auditing Configuration
-Generation of an API Access Key is required for Nasuni activity monitoring. The Nasuni Edge
-Appliance generates its own audit trail. An API Access Key is used by the Activity Monitor to form a
-network connection to the appliance. Nasuni will then stream event data to the activity agent. See
+Generate an API Access Key for Nasuni activity monitoring. The Nasuni Edge
+Appliance generates its own audit trail. The Activity Monitor uses the API Access Key to form a
+network connection to the appliance. Nasuni then streams event data to the activity agent. See
[Nasuni Support Documentation](https://www.nasuni.com/support/) for additional information.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Nasuni Edge Appliances.
+Complete the following checklist before configuring activity monitoring of Nasuni Edge Appliances.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Generate Nasuni API Access Key**
@@ -30,7 +30,7 @@ Instructions for each item of the checklist are detailed within the following to
## Nasuni Filer Management Interface
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Filer Management Interface.
+To generate a Nasuni API Access Key in the Nasuni Filer Management Interface:
**Step 1 –** Within the **Configuration** menu, under **USERS & SECURITY**, select API Access Keys.
The API Access Keys page opens.
@@ -43,8 +43,8 @@ The API Access Keys page opens.
**Step 5 –** In the Successfully Generated API Key window, copy the Key Passcode.
-Both the Key Name and the Key Passcode are required by the Activity Monitor in order to connect to
-the Nasuni Edge Appliance. Once the API Key has been generated, it is time to configure and enable
+Both the Key Name and the Key Passcode are required by the Activity Monitor to connect to
+the Nasuni Edge Appliance. After the API Key is generated, you can configure and enable
monitoring with the Activity Monitor console.
:::note
@@ -55,22 +55,22 @@ the exact same case as generated.
## Nasuni Management Console
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Management Console.
+To generate a Nasuni API Access Key in the Nasuni Management Console:
**Step 1 –** Click Filers and select API Keys from the menu on the left. The Filer API Access Key
Settings page opens.
**Step 2 –** Click New API Key button. The Add API Access Key window opens.
-**Step 3 –** From the Filer drop-down menu, select the desired Nasuni Edge Appliance. Then enter a
+**Step 3 –** From the Filer dropdown menu, select the Nasuni Edge Appliance you want to monitor. Then enter a
Name for the key; for example, the name of the application.
**Step 4 –** Click Add API Key.
**Step 5 –** A message appears which includes the Key Passcode; copy the Key Passcode.
-Both the Key Name and the Key Passcode are required by the Activity Monitor in order to connect to
-the Nasuni Edge Appliance. Once the API Key has been generated, it is time to configure and enable
+Both the Key Name and the Key Passcode are required by the Activity Monitor to connect to
+the Nasuni Edge Appliance. After the API Key is generated, you can configure and enable
monitoring with the Activity Monitor console.
:::note
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md
index eff70052ec..5d8faa98ec 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md
@@ -6,13 +6,13 @@ sidebar_position: 100
# Nutanix Files Activity Auditing Configuration
-The Netwrix Activity Monitor can be configured to monitor file activity on Nutanix Files devices.
+Configure the Netwrix Activity Monitor to monitor file activity on Nutanix Files devices.
-A user having REST API access must be created on the Nutanix Files server to monitor the files
-server using Activity Monitor. Additional configurations are done automatically by Activity Monitor
-using the Nutanix API with the help of this user.
+Create a user with REST API access on the Nutanix Files server to monitor the files
+server using Activity Monitor. Activity Monitor then automatically performs additional configurations
+using the Nutanix API with this user.
-Follow the steps to create a new user account with Nutanix Prism:
+To create a new user account with Nutanix Prism:
**Step 1 –** Open Nutanix Prism web portal.
@@ -37,7 +37,7 @@ Monitor.
:::note
-Nutanix Files does not report events for activity originating from a server where the
+Nutanix Files doesn't report events for activity originating from a server where the
Activity Monitor Agent is installed.
:::
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefirewall.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefirewall.md
index 6926d8d108..cb3c3c35a0 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefirewall.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefirewall.md
@@ -30,11 +30,11 @@ Monitor.
Both classic ONTAPI/ZAPI and the new REST API are supported. Starting with ONTAP 9.13.1, the product
uses REST API by default if it is available. HTTP and HTTPS protocols are supported. For HTTPS, two
-modes are supported: strict and ignore errors. For the strict mode, the product allows you to
-disable the host name validation in case the agent cannot resolve the FQDN of the LIF.
+modes are supported: strict and ignore errors. For the strict mode, you can
+disable the host name validation in case the agent can't resolve the FQDN of the LIF.
Enabling the API access varies depending on ONTAP version. The following sections list common steps
-on enabling the API access. Please refer to the NetApp documentation for more details.
+on enabling the API access. refer to the NetApp documentation for more details.
### Management-http Service
@@ -74,7 +74,7 @@ network interface service-policy add-service -service management-https -policy d
### Firewall Policy
-For ONTAP 9.5 and older, the following commands can be used to either create a new firewall policy
+For ONTAP 9.5 and older, use the following commands to either create a new firewall policy
or modify an existing policy if ONTAPI is blocked.
#### Create New Firewall HTTP Policy
@@ -148,15 +148,14 @@ Verify that the output is displayed as follows:
## FPolicy
The FPolicy framework enables the collection of audit events on the ONTAP side and their transfer to
-the agent(s) via the designated Data LIFs. Each LIF establishes its own connection with one or
+the agents via the designated Data LIFs. Each LIF establishes its own connection with one or
several agents and sends notifications as soon as the file transaction occurs. The FPolicy
connection is asynchronous and buffered; both ONTAP and Activity Monitor have techniques in place to
-make sure that connections are alive and working. The connection can be secured using TLS with
+ensure that connections are alive and working. The connection can be secured using TLS with
server or mutual authentication.
ONTAP cluster nodes connect to the agent on port 9999 by default. The port can be changed in the
-agent's settings. The agent adds this port to Windows Firewall exclusions automatically. Please
-ensure the port is not blocked by other firewalls between ONTAP and the agent.
+agent's settings. The agent adds this port to Windows Firewall exclusions automatically. Ensure the port isn't blocked by other firewalls between ONTAP and the agent.
### Data-fpolicy-client Service
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md
index b0ba05a883..235d9b56c5 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md
@@ -12,10 +12,10 @@ Storage Virtual Machines (SVM). FPolicy needs to be configured for each SVM.
There are two ways to configure FPolicy:
- Activity Monitor agent can facilitate the Automatic Configuration of FPolicy for the monitored SVM
- using the ONTAP API. This mode is simple, but does not allow you to exclude certain volumes or
+ using the ONTAP API. This mode is simple, but you can't exclude certain volumes or
shares of the SVM from being monitored. It also requires additional permissions to create and
modify FPolicy.
-- Another option is to Manually Configure FPolicy for each SVM. This mode allows you to fine tune
+- Another option is to Manually Configure FPolicy for each SVM. This mode lets you fine-tune
FPolicy by excluding certain volumes or shares from being monitored. It also reduces product
permissions.
@@ -80,8 +80,7 @@ locally on the Activity Monitor Console server.
### Create PEM File for Client Certificate
A certificate (Client Certificate) for the SVM needs to be copied to a PEM file. This is required
-for the TLS, mutual authentication option. Follow the steps to create the PEM file for the Client
-Certificate.
+for the TLS, mutual authentication option. To create the PEM file for the Client Certificate, use the following steps:
**Step 1 –** On the SVM , use the following command to show the security certificate details:
@@ -97,7 +96,7 @@ security certificate show -vserver testserver -type server instance
**Step 2 –** Copy the security certificate details into a text file and copy the public key to a PEM
file. The following variables from security details will be needed to set mutual-authentication
-during Part 6 of manual configuration and prior to automatic configuration:
+during Part 6 of manual configuration and before automatic configuration:
- SVM
- Common Name
@@ -118,7 +117,7 @@ dedicated volume for each SVM as a staging buffer before events are sent to the
Persistent Store requires the following parameters:
-- Volume name – If the volume does not exist, it will be created automatically (recommended).
+- Volume name – If the volume doesn't exist, it will be created automatically (recommended).
- Initial volume size – Specifies the starting size of the volume.
- Autosize mode – Options include Off, Grow, or Grow/Shrink.
@@ -142,7 +141,7 @@ To check that the SVM has assigned local tiers, use the following command:
**vserver show -vserver [SVM_NAME] -fields aggr-list**
-The command shows currently local tiers. If no tiers are assigned, "-" is displayed.
+The command shows the current local tiers. If you see "-", no tiers are assigned.
To assign local tiers to the SVM use the following command:
@@ -157,13 +156,13 @@ This command is available to cluster administrators at the admin privilege level
:::
-It is recommended to allow the volume to be created automatically. In this case, the FPolicy
+Allow the volume to be created automatically. In this case, the FPolicy
subsystem manages the volume, maintains the directory structure, and protects it from accidental
deletion by marking it as not mountable.
If you choose to create the volume manually, ensure the following:
-- The volume is not mounted and has no junction point.
+- The volume isn't mounted and has no junction point.
- The snapshot policy for the volume is set to none.
For additional and up-to-date recommendations on volumes for the Persistent Store, refer to the
@@ -172,7 +171,7 @@ NetApp documentation.
## Manually Configure FPolicy
This section describes how to manually configure FPolicy. Manual configuration of the FPolicy is
-recommended if the policy needs to be scoped to monitor select volumes or shares. It is necessary to
+recommended if the policy needs to be scoped to monitor select volumes or shares. You must
create several FPolicy components and then enable the FPolicy. See the sections corresponding to
each part of this list:
@@ -187,7 +186,7 @@ each part of this list:
- Part 3: Create FPolicy Events
- - An FPolicy event defines which protocol(s) to monitor and which file access events to monitor.
+ - An FPolicy event defines which protocols to monitor and which file access events to monitor.
- Part 4: Create Persistent Store (only if Persistent Store is used. RECOMMENDED)
@@ -213,7 +212,7 @@ each part of this list:
- Part 8: Enable the FPolicy
- - Once the FPolicy is enabled, the Activity Monitor Agent can be configured to monitor the SVM.
+ - After the FPolicy is enabled, the Activity Monitor Agent can be configured to monitor the SVM.
- Part 9: Connect FPolicy Server / Agent to Cluster Node (optional)
@@ -222,7 +221,7 @@ each part of this list:
### Part 1: Install Server Certificate on the SVM
-If using the TLS authentication options, it is necessary to install the Server Certificate on the
+If using the TLS authentication options, install the Server Certificate on the
SVM.
Use the following command to install the Server Certificate:
@@ -268,9 +267,9 @@ IMPORTANT:
proxy mode options.
- The following values are required:
- - `engine-name StealthAUDITEngine`, the names of the external engine object can be customized
+ - `engine-name StealthAUDITEngine` — you can customize the name of the external engine object
(see below).
- - `port 9999`, Port number can be customized, but it is recommended to use 9999.
+ - `port 9999` — while you can customize the port number, use 9999.
- `extern-engine-type asynchronous`
- `ssl-option no-auth`
- `send-buffer-size 6291456`, for ONTAP 9.10+ use `send-buffer-size 8388608`
@@ -323,10 +322,9 @@ Maximum Notification Retention Duration: 3m
External Engine Format: xml
```
-Relevant NetApp Documentation: To learn more about creating an external engine, please visit the
-NetApp website and read the
+Relevant NetApp Documentation: For information on creating an external engine, see the
[vserver fpolicy policy external-engine create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-external-engine-create.html)
-article.
+NetApp documentation.
### Part 3: Create FPolicy Event
@@ -346,7 +344,7 @@ IMPORTANT:
- For NFS shares – `StealthAUDITScreeningNfsV3, StealthAUDITScreeningNfsV4` for successful
events; `StealthAUDITScreeningFailedNfsV3, StealthAUDITScreeningFailedNfsV4` for failed
events.
- The names of the event objects can be customized (see Customization of FPolicy Object
+ You can customize the names of the event objects (see Customization of FPolicy Object
Names).
- `volume-operation true`
@@ -382,7 +380,7 @@ IMPORTANT:
- `read` – File read operations
- `first-read` – Limits notification to only first read operations for CIFS protocol. For
- ONTAP 9.2+, this filter can be used for both CIFS and NFS protocols.
+ ONTAP 9.2+, this filter works with both CIFS and NFS protocols.
- `rename`– File rename operations
- `rename_dir`– Directory rename operations
@@ -414,7 +412,7 @@ IMPORTANT:
- `write` – File write operations
- `first-write` – Limits notification to only first write operations for CIFS protocol. For
- ONTAP 9.2+, this filter can be used for both CIFS and NFS protocols.
+ ONTAP 9.2+, this filter works with both CIFS and NFS protocols.
- For failed/denied events, the list of supported file operations is limited to the following
values:
@@ -502,10 +500,9 @@ Ontap915::> fpolicy policy event show -vserver svm0 -event-name StealthAUDITScre
Send Failed File Operation Notifications: false
```
-Relevant NetApp Documentation: To learn more about creating an event, please visit the NetApp
-website and read the
+Relevant NetApp Documentation: For information on creating an event, see the
[vserver fpolicy policy event create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-event-create.html)
-article.
+NetApp documentation.
### Part 4: Create Persistent Store
@@ -532,12 +529,12 @@ IMPORTANT:
- `persistent-store` – The name of the Persistent Store object.
- The default name is `StealthAUDITPersistentStore`.
- The names of the event objects can be customized (see Customization of FPolicy Object
+ You can customize the names of the event objects (see Customization of FPolicy Object
Names).
- `volume` – The name of the volume used for event storage.
- - If the volume does not exist, it will be automatically created on an assigned local tier.
+ - If the volume doesn't exist, it will be automatically created on an assigned local tier.
This is recommended.
- `size` – The initial size of the volume. The format is `[KB|MB|GB]`.
@@ -592,8 +589,7 @@ this is also the user account credential to be added to the Access Analyzer Conn
IMPORTANT:
-- To monitor both CIFS and NFS protocols, two FPolicy Event were created. Multiple events can be
- included in the FPolicy policy.
+- To monitor both CIFS and NFS protocols, you create two FPolicy events. You can include multiple events in the FPolicy policy.
- The SVM used must be the SVM hosting the CIFS or NFS shares to be monitored.
- The External Engine, FPolicy Event, Persistent Store used in this command must be configuration
objects created in the preceding steps.
@@ -601,7 +597,7 @@ IMPORTANT:
The following values are required:
- `vserver` – The name of SVM.
- - `policy-name StealthAUDIT` – The name of the policy object can be customized (see
+ - `policy-name StealthAUDIT` – You can customize the name of the policy object (see
Customization of FPolicy Object Names).
- `engine` – The name of the External Engine created in Part 2: Create External Engine.
- `events` – A list of FPolicy Event objects created in Part 3: Create FPolicy Event.
@@ -681,10 +677,9 @@ User Name for Privileged Access: -
Persistent Store Name: -
```
-Relevant NetApp Documentation: To learn more about creating a policy, please visit the NetApp
-website and read the
+Relevant NetApp Documentation: For information on creating a policy, see the
[vserver fpolicy policy create](https://docs.netapp.com/us-en/ontap-cli/vserver-fpolicy-policy-create.html)
-article.
+NetApp documentation.
### Part 6: Create FPolicy Scope
@@ -695,10 +690,10 @@ variable [SVM_NAME] in the command with an asterisk (\*).
IMPORTANT:
- The SVM used must be the SVM hosting the CIFS or NFS shares to be monitored.
-- It is not necessary to specify both volumes and shares. One or the other is sufficient.
+- It isn't necessary to specify both volumes and shares. One or the other is sufficient.
- If you want to monitor everything, set the "`volumes-to-include`" value to "`*`".
-Use the following command to create the FPolicy scope by specifying volume(s):
+Use the following command to create the FPolicy scope by specifying volumes:
```
vserver fpolicy policy scope create -vserver [SVM_NAME] -policy-name StealthAUDIT -volumes-to-include [VOLUME_NAME],[VOLUME_NAME]
@@ -710,7 +705,7 @@ Example:
vserver fpolicy policy scope create -vserver testserver -policy-name StealthAUDIT -volumes-to-include samplevolume1,samplevolume2
```
-Use the following command to create the FPolicy scope by specifying share(s):
+Use the following command to create the FPolicy scope by specifying shares:
```
vserver fpolicy policy scope create -vserver [SVM_NAME] -policy-name StealthAUDIT -shares-to-include [SHARE_NAME],[SHARE_NAME]
@@ -745,14 +740,13 @@ File Extensions to Include: -
File Extensions to Exclude: -
```
-Relevant NetApp Documentation: To learn more about creating scope, please visit the NetApp website
-and read the
+Relevant NetApp Documentation: For information on creating scope, see the
[vserver fpolicy policy scope create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-scope-create.html)
-article.
+NetApp documentation.
### Part 7: Set TLS Authentication
-If using the TLS authentication options, it is necessary to set authentication for the type of
+If using the TLS authentication options, set authentication for the type of
authentication.
#### Set Server-Authentication
@@ -832,10 +826,9 @@ svm0 StealthAUDIT 10 on
DITEngine
```
-Relevant NetApp Documentation: To learn more about enabling a policy, please visit the NetApp
-website and read the
+Relevant NetApp Documentation: For information on enabling a policy, see the
[vserver fpolicy enable](https://docs.netapp.com/us-en/ontap-cli-9121//vserver-fpolicy-enable.html)
-article.
+NetApp documentation.
### Part 9: Connect FPolicy Server / Agent to Cluster Node
@@ -883,7 +876,7 @@ Starting ONTAP 9.15.1 and later versions, it is recommended to enable the Persis
that stores events on disk before they are sent to the Activity Monitor Agent. This reduces
client-side latency and increases resilience during network delays or bursts of activity. To enable
the Persistent Store, specify a volume name and size on the Persistent Store tab of the FPolicy page
-in the monitored host properties. The volume will be automatically created if it does not already
+in the monitored host properties. The volume will be automatically created if it doesn't already
exist. See the Persistent Store topic for additional information on the recommended volume size.
If using the TLS, mutual authentication option, you will need to create the PEM file for the Client
@@ -892,7 +885,7 @@ will also be necessary to set mutual authentication on the SVM.
### Set TLS Mutual-Authentication
-If using the TLS, mutual authentication options, it is necessary to set authentication.
+If using TLS mutual authentication options, set authentication.
Use the following command to set mutual-authentication:
@@ -928,10 +921,10 @@ Activity Monitor uses the following FPolicy object names by default:
- Failed NFS v4 Event name – `StealthAUDITScreeningFailedNfsV4`
- Persistent Store name – `StealthAUDITPersistentStore`
-These names can be customized in the monitored host's settings in the Activity Monitor. It can be
+You can customize these names in the monitored host's settings in the Activity Monitor. This is
useful in two scenarios:
- You want the names to match the company policies;
-- You want to configure FPolicy manually using your custom names, but also want to leverage the
+- You want to configure FPolicy manually using your custom names, but also want to use the
"Enable and Connect FPolicy" feature of the Activity Monitor, so that the product ensures that
FPolicy stays enabled and connected at all times.
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md
index d81005b60f..6916a7da9a 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md
@@ -6,7 +6,7 @@ sidebar_position: 90
# NetApp Data ONTAP Cluster-Mode Activity Auditing Configuration
-The Activity Monitor agent employed to monitor NetApp leverages NetApp ONTAP API, and the NetApp
+The Activity Monitor agent employed to monitor NetApp uses NetApp ONTAP API and the NetApp
FPolicy framework to monitor file system events. This includes both NetApp 7-Mode and Cluster-Mode
configurations. For more information about FPolicy read the
[What are the two parts of the FPolicy solution ](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html)
@@ -25,17 +25,17 @@ list of volumes, list of LIFs. Depending on the configuration, the agent can als
of FPolicy to ensure it is enabled; configure FPolicy and register or unregister itself.
The FPolicy framework enables the collection of audit events on the ONTAP side and their transfer to
-the agent(s) via the designated Data LIFs. Each LIF establishes its own connection with one or
+the agents via the designated Data LIFs. Each LIF establishes its own connection with one or
several agents and sends notifications as soon as the file transaction occurs. The FPolicy
connection is asynchronous and buffered; both ONTAP and Activity Monitor have techniques in place to
-make sure that connections are alive and working. The connection can be secured using TLS with
+ensure that connections are alive and working. The connection can be secured using TLS with
server or mutual authentication.
FPolicy may have a significant impact on file system throughput, and it is always a best practice to
monitor performance when enabling FPolicy.
:::info
-Create a tailored FPolicy which only collects the desired activity from the
+Create a tailored FPolicy which only collects the activity you want from the
environment to limit the scope and impact.
:::
@@ -43,13 +43,13 @@ environment to limit the scope and impact.
For scale-out and fault tolerance purposes, the product supports a range of deployment options. A
single agent can receive events from multiple SVMs. Or events from a single SVM can be distributed
among multiple agents. Or a set of SVMs can distribute events among a set of agents. The choice
-depends on the fault tolerance requirements and the expected event flow. As a rule of thumb, the
-_average_ load on a single agent should not exceed 5000 events per second.
+depends on the fault tolerance requirements and the expected event flow. Generally, the
+_average_ load on a single agent shouldn't exceed 5000 events per second.
Starting with ONTAP 9.15.1, the FPolicy Persistent Store provides resilience and predictable latency
during scenarios such as network delays or bursts of activity. The feature uses a dedicated volume
for each SVM as a staging buffer before events are sent to the agent. FPolicy will automatically
-create a volume if one does not already exist.
+create a volume if one doesn't already exist.
:::info
Enable the Persistent Store feature and allow it to create a volume
@@ -59,7 +59,7 @@ automatically.
## Configuration Checklist
-Complete the following checklist prior to configuring the activity monitoring of NetApp Data ONTAP
+Complete the following checklist before configuring the activity monitoring of NetApp Data ONTAP
Cluster-Mode devices. Instructions for each item of the checklist are detailed within the following
sections.
@@ -67,10 +67,10 @@ sections.
- Gather the following information:
- - Names of the SVM(s) to be monitored
+ - Names of the SVMs to be monitored
- FPolicy is configured for each SVM separately
- - This should be the SVM(s) hosting the CIFS or NFS shares(s) to be monitored
+ - This should be the SVMs hosting the CIFS or NFS sharess to be monitored
- Credentials to access ONTAP to provision a role and account.
- Desired functionality level:
@@ -91,7 +91,7 @@ sections.
- Limiting the FPolicy to specific file operations is an effective way to limit the
performance impact of FPolicy
- - IP Address of the server(s) where the Activity Monitor Agent is deployed
+ - IP Address of the servers where the Activity Monitor Agent is deployed
- API enabled in ONTAP: the classic ONTAPI/ZAPI or the new REST API
- The product supports the REST API for ONTAP 9.13.1 and above.
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/provisionactivity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/provisionactivity.md
index 4942af7276..b550120498 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/provisionactivity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/provisionactivity.md
@@ -26,7 +26,7 @@ The permissions needed depends on the functionality level:
- Least Privileged: ONLY Collect Events – This is the minimal functionality level. A user manually
configures FPolicy and ensures that it stays enabled and connected. The product only collects
- events. This functionality level is not recommended as it requires an additional solution that
+ events. This functionality level isn't recommended as it requires an additional solution that
tracks the state of FPolicy and fixes the problem should ONTAP disconnect or should the policy
become disabled.
- **_RECOMMENDED:_** Less Privileged: Enable/Connect Policy & Collect Events – With this level, the
@@ -103,7 +103,7 @@ security login rest-role create -role enterpriseauditorrest -api "/api/svm/svms"
```
:::note
-If the FPolicy account is configured with these permissions, it is necessary to manually
+If the FPolicy account is configured with these permissions, manually
configure the FPolicy. See the [Configure FPolicy](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md) topic for additional
information.
:::
@@ -127,7 +127,7 @@ permissions to collect events:
:::tip
Remember, this permission permits the Activity Monitor to enable the FPolicy. If the “Enable
- and connect FPolicy” option is employed but the permission is not provided, the agent will
+ and connect FPolicy” option is employed but the permission isn't provided, the agent will
encounter “Failed to enable policy” errors, but it will still be able to connect to the FPolicy.
Since this permission model requires a manual configuration of the FPolicy, then the need to
manually enable the FPolicy will be met.
@@ -192,7 +192,7 @@ security login rest-role create -role enterpriseauditorrest -api "/api/protocols
```
:::note
-If the FPolicy account is configured with these permissions, it is necessary to manually
+If the FPolicy account is configured with these permissions, manually
configure the FPolicy. See the [Configure FPolicy](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md) topic for additional
information.
:::
@@ -340,7 +340,7 @@ article.
## Part 2: Create Security Login
-Once the access control role has been created, apply it to a domain account. Ensure the following
+After the access control role has been created, apply it to a domain account. Ensure the following
requirements are met:
- The SVM used in the following command must be the same SVM used when creating the access control
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap7-aac/configurefpolicy.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap7-aac/configurefpolicy.md
index 459c4dd6bc..70d416a334 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap7-aac/configurefpolicy.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap7-aac/configurefpolicy.md
@@ -27,7 +27,7 @@ Manually Configure FPolicy (Recommended Option) – A tailored FPolicy
## Manually Configure FPolicy (Recommended Option)
This section describes how to manually configure FPolicy. Manual configuration of the FPolicy is
-recommended so that the policy can be scoped. It is necessary to create six FPolicy components and
+recommended so that the policy can be scoped. Create six FPolicy components and
then enable the FPolicy. See the sections corresponding to each part of this list:
- Part 1: Create FPolicy
@@ -43,8 +43,8 @@ vFiler. This is because FPolicy operates on the affected vFiler. Therefore, when
commands on a vFiler, the commands must be run from a vFiler context (e.g. via the vFiler run
command).
-Relevant NetApp Documentation: To learn more about configuring file policies, please visit the
-NetApp website and read
+Relevant NetApp Documentation: For details on configuring file policies, see the
+NetApp
[na_fpolicy – configure file policies](https://library.netapp.com/ecmdocs/ECMP1196890/html/man1/na_fpolicy.1.html)
article.
@@ -65,8 +65,8 @@ fpolicy create StealthAUDIT screen
### Part 2: Set FPolicy Required to Off
-If the `FPolicy Required` value is set to on, user requests are denied if an FPolicy server is not
-available to implement the policy. If it is set to off, user requests are allowed when it is not
+If the `FPolicy Required` value is set to on, user requests are denied if an FPolicy server isn't
+available to implement the policy. If it is set to off, user requests are allowed when it isn't
possible to apply the policy to the file because no FPolicy server is available.
IMPORTANT:
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap7-aac/ontap7-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap7-aac/ontap7-activity.md
index 50b6f54b21..2adbdcde68 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap7-aac/ontap7-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap7-aac/ontap7-activity.md
@@ -6,18 +6,17 @@ sidebar_position: 80
# NetApp Data ONTAP 7-Mode Activity Auditing Configuration
-The Activity Monitor agent employed to monitor NetApp leverages 128-bit encrypted Remote Procedure
+The Activity Monitor agent employed to monitor NetApp uses 128-bit encrypted Remote Procedure
Calls (RPC), NetApp ONTAP-API, and NetApp FPolicy to monitor file system events. This includes both
-NetApp 7-Mode and Cluster-Mode configurations. To learn more about FPolicy please visit the NetApp
-website and read the
+NetApp 7-Mode and Cluster-Mode configurations. For information on FPolicy, see the
[What FPolicy is](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html)
-article.
+NetApp article.
If the activity agent is stopped, a notification will be sent to the NetApp device to disconnect and
disable the associated FPolicy policy, but it will not be removed.
If the network connection is lost between the activity agent and the NetApp device, the NetApp
-device is configured with a default timeout to wait for a response. If a response is not received
+device is configured with a default timeout to wait for a response. If a response isn't received
from the Activity Agent within the timeout, then the NetApp device will disconnect and disable the
FPolicy policy. The Activity Agent will check every minute by default to see if the FPolicy policy
has been disabled and will enable it (if the auto-enable functionality is enabled for the agent).
@@ -29,7 +28,7 @@ No activity log file will be created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of NetApp Data ONTAP
+Complete the following checklist before configuring activity monitoring of NetApp Data ONTAP
7-Mode devices. Instructions for each item of the checklist are detailed within the following
topics.
@@ -37,7 +36,7 @@ topics.
- Gather the following information:
- Names of the vFiler™(s) to be monitored
- - DNS name of the CIFS shares(s) to be monitored
+ - DNS name of the CIFS sharess to be monitored
**Checklist Item 2: [Provision FPolicy Account](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md)**
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md
index f334e6dce4..9c9d2f44a7 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md
@@ -16,10 +16,9 @@ Provisioning this account is a three part process:
- Part 2: Create a Group & Assign Role
- Part 3: Add User to Group
-Relevant NetApp Documentation: To learn more about node access controls, please visit the NetApp
-website and read the
+Relevant NetApp Documentation: For information on node access controls, see the
[na_useradmin – Administers node access controls](https://library.netapp.com/ecmdocs/ECMP1511537/html/man1/na_useradmin.1.html)
-article.
+NetApp documentation.
## Part 1: Create Role with API/CLI Access
@@ -74,7 +73,7 @@ After the role is created, complete Part 2: Create a Group & Assign Role.
## Part 2: Create a Group & Assign Role
-Once the role has been created, it must be attached to a group. The following command needs to be
+After the role has been created, it must be attached to a group. The following command needs to be
run to create a group and assign the role to it.
```
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/panzura-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/panzura-activity.md
index 9495688395..635a7256a8 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/panzura-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/panzura-activity.md
@@ -67,13 +67,11 @@ The product will also ensure the settings are correct with periodic checks.
## Manual Configuration
-Follow these steps to enable auditing.
-
**Step 1 –** Navigate to **Audit Settings** > **Third Party Support**.
**Step 2 –** Enable the **Generate Third Party Logs** option.
-**Step 3 –** Enable the **Push to Subordinate(s)** option.
+**Step 3 –** Enable the **Push to Subordinates** option.
**Step 4 –** Enter **other** as the Vendor Name.
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/powerstore-aac/auditing.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/powerstore-aac/auditing.md
index b873219695..e60368626d 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/powerstore-aac/auditing.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/powerstore-aac/auditing.md
@@ -6,8 +6,6 @@ sidebar_position: 20
# Enable Auditing for Dell PowerStore
-Follow the steps to enable auditing on Dell PowerStore.
-
- Create an Event Publishing Pool
- Create an Event Publisher
- Enable Event Publishing for the NAS Server OR Enable or Disable Event Publishing for File System
@@ -18,8 +16,6 @@ white paper for additional information.
## Create an Event Publishing Pool
-Follow the steps tTo create a new event publishing pool.:
-
**Step 1 –** Select **Storage** > **NAS Servers** > **NAS Settings** > **Publishing Pools**.
**Step 2 –** Click **Create** and specify the name of the pool.
@@ -64,8 +60,6 @@ Follow the steps tTo create a new event publishing pool.:
## Create an Event Publisher
-Follow the steps tTo create a an event publisher.:
-
**Step 1 –** Select **Storage** > **NAS Servers** > **NAS Settings** > **Events Publishers**.
@@ -88,12 +82,10 @@ an internal circular buffer".
**Step 7 –** Click **Create Events Publisher**.
-The events publisher is created.
+You create the event publisher.
## Enable Event Publishing for the NAS Server
-Follow the steps tTo enable or disable event publishing for the NAS Server.:
-
**Step 1 –** Select **Storage** > **NAS Servers**.
@@ -107,13 +99,10 @@ Follow the steps tTo enable or disable event publishing for the NAS Server.:
**Step 4 –** You can enable the event publishing for all file systems on the NAS by checking the box
and selecting protocols.
-Dell PowerStore is enabled for auditing.
+You enable Dell PowerStore for auditing.
## Enable or Disable Event Publishing for File System
-Follow the steps toYou can enable or disable the feature for each file system individually. using
-the following:
-
**Step 1 –** Select **Storage** > **File Systems** > **[FILE SYSTEM]** > **Security & Events** >
**Events Publishing**.
@@ -121,4 +110,4 @@ the following:
**Step 2 –** Enable and select protocols needed.
-Dell PowerStore is enabled for auditing.
+You enable Dell PowerStore for auditing.
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md
index 1a44db4585..7465526941 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,7 +20,7 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
+To install the Dell CEE, complete the following steps:
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -41,8 +41,7 @@ asynchronous bulk delivery (VCAPS) feature.
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -52,12 +51,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/powerstore-aac/powerstore-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/powerstore-aac/powerstore-activity.md
index f22fcd23ad..fd8ee11d73 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/powerstore-aac/powerstore-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/powerstore-aac/powerstore-activity.md
@@ -20,12 +20,12 @@ activity log file is created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Dell PowerStore
+Complete the following checklist before configuring activity monitoring of Dell PowerStore
devices. Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment
+- Before beginning the deployment
- See the
[Dell PowerStore: File Capabilities](https://www.delltechnologies.com/asset/en-us/products/storage/industry-market/h18155-dell-powerstore-file-capabilities.pdf)
@@ -36,7 +36,7 @@ devices. Instructions for each item of the checklist are detailed within the fol
**Checklist Item 2: [Install Dell CEE](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md)**
-- Dell CEE should be installed on the Windows proxy server(s) where the Activity Monitor activity
+- Dell CEE should be installed on the Windows proxy servers where the Activity Monitor activity
agent will be deployed
:::info
@@ -47,7 +47,7 @@ devices. Instructions for each item of the checklist are detailed within the fol
- Important:
- Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE is
+ Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE is
installed
**Checklist Item 3: Dell PowerStore Device Configuration**
@@ -68,8 +68,8 @@ devices. Instructions for each item of the checklist are detailed within the fol
Checklist Item 5: Configure Dell CEE to Forward Events to the Activity Agent
:::note
-When Dell CEE is installed on Windows proxy server(s) where the Activity Monitor activity
-agent will be deployed, the following steps are not needed.
+When Dell CEE is installed on Windows proxy servers where the Activity Monitor activity
+agent will be deployed, the following steps aren't needed.
:::
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md
index e99c8b54a8..34465b5eb9 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md
@@ -32,8 +32,6 @@ advanced filtering of Microsoft Office activity also requires the JSON format.
The JSON format for audit events was introduced in Qumulo Core 6.0.1. The new format can be enabled
via an SSH session to the Qumulo cluster.
-Follow the steps to verify that audit event format and change the format, if needed.
-
**Step 1 –** Connect to the Qumulo cluster with SSH.
**Step 2 –** Execute the following command to log in:
@@ -53,5 +51,5 @@ __Step 4 –__ Execute the following command to change the format, if needed:
**qq audit_set_syslog_config --json**
-The change willshould be reflected in the __format__ field.
+The change should be reflected in the __format__ field.
```
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md
index 85e20d4141..deaed56f94 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,7 +20,7 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
+To install the Dell CEE, complete the following steps:
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -38,14 +38,13 @@ asynchronous bulk delivery (VCAPS) feature.
:::
-After Dell CEE installation is complete, it is necessary to complete the
+After Dell CEE installation is complete, complete the
[Unity Initial Setup with Unisphere](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md).
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -55,12 +54,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md
index 9845a39663..332884ca53 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md
@@ -6,12 +6,12 @@ sidebar_position: 20
# Unity Initial Setup with Unisphere
-Follow the steps to configure the initial setup for a Unity device with Unisphere.
+To configure the initial setup for a Unity device with Unisphere:
**Step 1 –** Edit the NAS Server > Protection and Events > Events Publishing > Select Pool settings:
-- Add CEPA server – This is the server where CEE is installed. It is recommended that this is also
- the server were the Activity Monitor activity agent is deployed.
+- Add CEPA server – This is the server where the Common Event Enabler (CEE) is installed. This should also be
+ the server where the Activity Monitor activity agent is deployed.
- Enable the following events for Post Events.
Required Unity events needed for CIFS Activity:
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/unity-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/unity-activity.md
index b30aacd471..2187d7a2df 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/unity-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/unity-activity.md
@@ -20,14 +20,14 @@ activity log file is created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Dell Unity devices.
-Instructions for each item of the checklist are detailed within the following topics.
+Complete the following checklist before configuring activity monitoring of Dell Unity devices.
+The following topics provide detailed instructions for each checklist item.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - Data Mover or Virtual Data Mover hosting the share(s) to be monitored
+ - Data Mover or Virtual Data Mover hosting the shares to be monitored
- Account with access to the CLI
- Download the Dell CEE from:
@@ -35,7 +35,7 @@ Instructions for each item of the checklist are detailed within the following to
**Checklist Item 2: [Install Dell CEE](/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md)**
-- Dell CEE should be installed on the Windows proxy server(s) where the Activity Monitor activity
+- Dell CEE should be installed on the Windows proxy servers where the Activity Monitor activity
agent will be deployed
:::info
@@ -46,9 +46,9 @@ Instructions for each item of the checklist are detailed within the following to
- Important:
- - Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE
+ - Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE
is installed
- - Dell CEE 8.4.2 through Dell CEE 8.6.1 are not supported for use with the VCAPS feature
+ - Dell CEE 8.4.2 through Dell CEE 8.6.1 aren't supported for use with the VCAPS feature
- Dell CEE requires .NET Framework 3.5 to be installed on the Windows proxy server
**Checklist Item 3: Dell Unity Device Configuration**
@@ -69,8 +69,8 @@ Instructions for each item of the checklist are detailed within the following to
Checklist Item 5: Configure Dell CEE to Forward Events to the Activity Agent
:::note
-When Dell CEE is installed on Windows proxy server(s) where the Activity Monitor activity
-agent will be deployed, the following steps are not needed.
+When Dell CEE is installed on Windows proxy servers where the Activity Monitor activity
+agent will be deployed, the following steps aren't needed.
:::
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md
index a7bbfb476b..f5f3473353 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
+After the Activity Monitor agent is configured to monitor the Dell device, the automated
configuration must be validated to ensure events are being monitored.
## Validate CEE Registry Key Settings
@@ -18,13 +18,9 @@ topic for information on manually setting the registry key.
:::
-After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
-configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
-to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
-deployed.
+After you deploy and configure the Activity Monitor activity agent to monitor the Dell device, it automatically configures the Dell CEE if the CEE is on the same server. If the Dell CEE is on a different server, configure it manually in the rare situations where you must deploy the CEE to a separate Windows proxy server.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -90,7 +86,7 @@ Dell CEE Services are Running topic for additional information.
## Validate Dell CEE Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -120,19 +116,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/sharepoint-online-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/sharepoint-online-activity.md
index 655a7680c6..66cf5effe7 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/sharepoint-online-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/sharepoint-online-activity.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# SharePoint Online Activity Auditing Configuration
-In order to collect logs and monitor SharePoint Online activity using the Netwrix Activity Monitor,
+to collect logs and monitor SharePoint Online activity using the Netwrix Activity Monitor,
it needs to be registered with Microsoft® Entra ID® (formerly Azure AD).
:::note
@@ -25,14 +25,14 @@ See the Enable Auditing for SharePoint Online topic for additional information.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you have registered the application:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
+ It isn't possible to retrieve the value after saving the new key. It must be
copied first.
:::
@@ -54,8 +54,6 @@ The following settings are needed from your tenant once you have registered the
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -87,8 +85,6 @@ application. Now that the application has been registered, permissions need to b
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -135,8 +131,6 @@ be collected.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -173,8 +167,6 @@ application’s Client Secret Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -193,9 +185,6 @@ application’s Client Secret Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
-value when saving the new key.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -204,7 +193,7 @@ documentation for additional information.
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
+It isn't possible to retrieve the value after saving the new key. It must be copied
first.
:::
@@ -231,7 +220,7 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
+If this page is left before the key is copied, then the key isn't retrievable, and
this process will have to be repeated.
:::
@@ -245,15 +234,12 @@ This is needed for adding a SharePoint Online host in the Activity Monitor.
## Enable Auditing for SharePoint Online
-Follow the steps to enable auditing for SharePoint Online so the Activity Monitor can receive
-events.
-
**Step 1 –** In the Microsoft Purview compliance portal at
[https://compliance.microsoft.com](https://compliance.microsoft.com/), go to **Solutions** >
**Audit**. Or, to go directly to the Audit page at
[https://compliance.microsoft.com/auditlogsearch](https://compliance.microsoft.com/auditlogsearch).
-**Step 2 –** If auditing is not turned on for your organization, a banner is displayed prompting you
+**Step 2 –** If auditing isn't turned on for your organization, a banner is displayed prompting you
start recording user and admin activity.
**Step 3 –** Select the **Start recording** user and **admin activity** banner.
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/sharepoint-onprem-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/sharepoint-onprem-activity.md
index fecb0fa571..ef11db2747 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/sharepoint-onprem-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/sharepoint-onprem-activity.md
@@ -44,7 +44,6 @@ select the events to be audited.
**Step 6 –** Click OK to save the changes.
-SharePoint will create the audit logs to be monitored by the Netwrix Activity Monitor and/or audited
-by Access Analyzer. See the Microsoft
+SharePoint will create the audit logs, which the Netwrix Activity Monitor monitors and/or Access Analyzer audits. See the Microsoft
[Configure audit settings for a site collection (SharePoint 2013/2016/2019)](https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2)
article for additional information.
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/sqlserver-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/sqlserver-activity.md
index f735298b95..5777b69bf9 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/sqlserver-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/sqlserver-activity.md
@@ -70,7 +70,7 @@ declare @s varchar(max)='';select @s=@s+(case when @s<>'' then char(13)+char(10)
## Logon Trigger (Optional)
The logon trigger is required to obtain IP Addresses of client connections. Run the following script
-in order to allow the Activity Monitor to report client IP Addresses.
+to allow the Activity Monitor to report client IP Addresses.
```
CREATE TRIGGER SBAudit_LOGON_Trigger ON ALL SERVER FOR LOGON AS BEGIN declare @str varchar(max)=cast(EVENTDATA() as varchar(max));raiserror(@str,1,1);END
diff --git a/docs/activitymonitor/10.0/requirements/activityagent/windowsfs-activity.md b/docs/activitymonitor/10.0/requirements/activityagent/windowsfs-activity.md
index eb33a09a0b..8860c029b6 100644
--- a/docs/activitymonitor/10.0/requirements/activityagent/windowsfs-activity.md
+++ b/docs/activitymonitor/10.0/requirements/activityagent/windowsfs-activity.md
@@ -6,11 +6,11 @@ sidebar_position: 80
# Windows File Server Activity Auditing Configuration
-In order for the Netwrix Activity Monitor to monitor Windows file server activity, an Activity Agent must be deployed to the server. It cannot be deployed to a proxy server. However, additional considerations are needed when targeting a Windows File System Clusters.
+In order for the Netwrix Activity Monitor to monitor Windows file server activity, an Activity Agent must be deployed to the server. It can't be deployed to a proxy server. However, additional considerations are needed when targeting a Windows File System Clusters.
## Windows File System Clusters
-In order to monitor a Windows File System Cluster, an Activity Agent needs to be deployed on all nodes that comprise the Windows File System Cluster. The credential used to deploy the Activity Agent must have the following permissions on the server:
+to monitor a Windows File System Cluster, an Activity Agent needs to be deployed on all nodes that comprise the Windows File System Cluster. The credential used to deploy the Activity Agent must have the following permissions on the server:
- Membership in the local Administrators group
- READ and WRITE access to the archive location for Archiving feature only
diff --git a/docs/activitymonitor/10.0/requirements/adagent/activity/activity.md b/docs/activitymonitor/10.0/requirements/adagent/activity/activity.md
index a3a2137c43..906a2adc8c 100644
--- a/docs/activitymonitor/10.0/requirements/adagent/activity/activity.md
+++ b/docs/activitymonitor/10.0/requirements/adagent/activity/activity.md
@@ -30,8 +30,7 @@ In this method, you will be deploying two agents:
- Next, deploy the AD Agent to all domain controllers in the target domain.
-Follow the steps to setup integration between Activity Monitor and Access Analyzer through an API
-server.
+To set up integration between Activity Monitor and Access Analyzer through an API server:
**Step 1 –** Deploy the Activity Agent to the API server.
@@ -41,7 +40,7 @@ The next step is to configure the agent deployed to the API server.
## Configure API Server Agent
-Follow the steps to configure the agent deployed to the API server.
+To configure the agent deployed to the API server:
**Step 1 –** On the Agents tab of the Activity Monitor Console, select the agent deployed to the
API server.
@@ -63,7 +62,7 @@ API server.
- Click **Copy** and save the Client Secret value to a text file.
:::warning
- It is not possible to retrieve the value after closing the Add or edit
+ It isn't possible to retrieve the value after closing the Add or edit
API client window. It must be copied first.
:::
@@ -73,9 +72,9 @@ API server.
if desired.
- Click **OK** to save the configuration and close the Add or edit API client window.
-- If the Activity Monitor Console server is not the API Server, then click **Use this console** to
+- If the Activity Monitor Console server isn't the API Server, then click **Use this console** to
grant the Activity Monitor the ability to manage the API server.
-- The IPv4 or IPv6 allowlist allows you to limit access to the API server data to specific hosts.
+- The IPv4 or IPv6 allowlist limits access to the API server data to specific hosts.
**Step 4 –** Click **OK** to save the configuration and close the Agent properties window.
@@ -83,7 +82,7 @@ The next step is to configure the agents deployed to the domain controllers.
## Configure Domain Controller Agent
-Follow the steps to configure the agent deployed to the domain controller.
+To configure the agent deployed to the domain controller:
**Step 1 –** On the Agents tab of the Activity Monitor Console, select an agent deployed to domain
controller.
@@ -94,9 +93,9 @@ controller.
- Select the **Enable Archiving for this agent** checkbox.
- Select the **Archive log files on a UNC path** option. Click the **...** button and navigate to
- the desired network share on the API server.
+ the network share you want on the API server.
- The **User name** and **User password** fields only need to be filled in if the account used to
- install the agent does not have access to this share.
+ install the agent doesn't have access to this share.
:::tip
Remember, The account used to install the agent on a domain controller is a Domain
@@ -110,19 +109,19 @@ controller.
**Step 5 –** Repeat Steps 1-4 for each agent deployed to domain controller.
-These agent are configured to save the Archive logs to the selected share.
+The agents now save the Archive logs to the selected share.
## Configure Monitored Domain Output
-Follow the steps configure the monitored domain output for Netwrix Access Analyzer.
+To configure the monitored domain output for Netwrix Access Analyzer:
**Step 1 –** Select the **Monitored Domains** tab.
-**Step 2 –** Select the desired domain and click **Add Output**. The Add New Ouptut window opens.
+**Step 2 –** Select the domain you want and click **Add Output**. The Add New Ouptut window opens.
**Step 3 –** Configure the following:
-- Configure the desired number of days for the **Period to keep Log files**. This is the number of
+- Configure the number of days you want for the **Period to keep Log files**. This is the number of
days the log files are kept on the API server configured in the sections above. This needs to be
set to a greater value than the days between Access Analyzer scans.
@@ -141,7 +140,7 @@ Access Analyzer now has access to the agent log files for this domain.
## Configure Connection Profile
-Follow the steps to configure the Connection Profile in Access Analyzer.
+To configure the Connection Profile in Access Analyzer:
:::tip
Remember, the Client ID and Client Secret were generated by the API server and copied to a text
@@ -171,7 +170,7 @@ name.
Group. Select the **Settings > Connection** node.
**Step 7 –** Select the **Select one of the following user defined profiles** option. Expand the
-drop-down menu and select the Connection Profile with this credential.
+dropdown menu and select the Connection Profile with this credential.
**Step 8 –** Click **Save** and then **OK** to confirm the changes to the job group settings.
@@ -179,8 +178,8 @@ The Connection Profile will now be used for AD Activity collection.
## Configure the AD_ActivityCollection Job
-The Access Analyzer requires additional configurations in order to collect domain activity data.
-Follow the steps to configure the **AD_ActivityCollection** Job.
+The Access Analyzer requires additional configurations to collect domain activity data.
+To configure the **AD_ActivityCollection** Job:
:::note
Ensure that the **.Active Directory Inventory** Job Group has been successfully run
@@ -251,20 +250,19 @@ logs.
### (Optional) Configure Import of AD Activity into Netwrix Access Information Center
AD Activity data can be imported into Netwrix Access Information Center by the
-**AD_ActivityCollection** Job. However, this is disabled by default. Follow the steps to enable the
-importing of AD activity data into the Access Information Center.
+**AD_ActivityCollection** Job. However, this is disabled by default. To enable the importing of AD activity data into the Access Information Center:
**Step 1 –** Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **0.Collection** >
**AD_ActivityCollection** Job.
**Step 2 –** On the job's Overview page, enable the import of AD Events.
-- Click on the **Enable to import AD events into the AIC** parameter.
+- Click the **Enable to import AD events into the AIC** parameter.
- On the Parameter Configuration window, select the **Enabled** checkbox and click **Save**.
**Step 3 –** On the job's Overview page, enable the import of authentication Events.
-- Click on the **Enable to import authentication events into the AIC** parameter.
+- Click the **Enable to import authentication events into the AIC** parameter.
- On the Parameter Configuration window, select the **Enabled** checkbox and click **Save**.
**Step 4 –** Optionally, modify the **List of attributes to track for Object Modified changes** and
diff --git a/docs/activitymonitor/10.0/requirements/adagent/activity/filearchive.md b/docs/activitymonitor/10.0/requirements/adagent/activity/filearchive.md
index 235cdfabfc..237d74fc5a 100644
--- a/docs/activitymonitor/10.0/requirements/adagent/activity/filearchive.md
+++ b/docs/activitymonitor/10.0/requirements/adagent/activity/filearchive.md
@@ -16,7 +16,7 @@ Deploy the AD Agent to each domain controller in the target domain.
## Configure Domain Controller Agent
-Follow the steps to configure the agent deployed to the domain controller.
+To configure the agent deployed to the domain controller:
:::note
These steps assume the network share where the activity log files will be archived already
@@ -35,7 +35,7 @@ controller.
- Select the **Archive log files on a UNC path** option. Click the ... button and navigate to the
desired network share.
- The **User name** and **User password** fields only need to be filled in if the account used to
- install the agent does not have access to this share.
+ install the agent doesn't have access to this share.
:::tip
Remember, The account used to install the agent on a domain controller is a Domain
@@ -52,7 +52,7 @@ controller.
**Step 5 –** Repeat Steps 1-4 for each agent deployed to domain controller pointing to the same
network share in Step 3 for each agent.
-These agent are configured to save the Archive logs to the selected share.
+The agents now save the Archive logs to the selected share.
## Configure Monitored Domain Output
@@ -60,11 +60,11 @@ Follow the steps configure the monitored domain output for Netwrix Access Analyz
**Step 1 –** Select the **Monitored Domains** tab.
-**Step 2 –** Select the desired domain and click **Add Output**. The Add New Ouptut window opens.
+**Step 2 –** Select the domain you want to monitor and click **Add Output**. The Add New Ouptut window opens.
**Step 3 –** Configure the following:
-- Configure the desired number of days for the **Period to keep Log files**. This is the number of
+- Configure the number of days for the **Period to keep Log files**. This is the number of
days the log files are kept on the API server configured in the sections above. This needs to be
set to a greater value than the days between Access Analyzer scans.
@@ -83,7 +83,7 @@ Access Analyzer now has access to the agent log files for this domain.
## Configure Connection Profile
-Follow the steps to configure the Connection Profile in Access Analyzer.
+To configure the Connection Profile in Access Analyzer:
**Step 1 –** On the Settings > Connection node of the Access Analyzer Console, select the Connection
Profile for the Active Directory solution. If you haven't yet created a Connection Profile or desire
@@ -110,7 +110,7 @@ a specific one for AD Activity, create a new one and provide a unique descriptiv
the **Settings > Connection** node.
**Step 7 –** Select the **Select one of the following user defined profiles** option. Expand the
-drop-down menu and select the Connection Profile with this credential.
+dropdown menu and select the Connection Profile with this credential.
**Step 8 –** Click **Save** and then **OK** to confirm the changes to the job group settings.
@@ -118,7 +118,7 @@ The Connection Profile will now be used for AD Activity collection.
## Configure the AD_ActivityCollection Job
-Access Analyzer requires additional configurations in order to collect domain activity data. Follow
+Access Analyzer requires additional configurations to collect domain activity data. Follow
the steps to configure the **AD_ActivityCollection** Job.
:::note
diff --git a/docs/activitymonitor/10.0/requirements/adagent/adagent.md b/docs/activitymonitor/10.0/requirements/adagent/adagent.md
index 0ec31eb9a1..f9f7dc4434 100644
--- a/docs/activitymonitor/10.0/requirements/adagent/adagent.md
+++ b/docs/activitymonitor/10.0/requirements/adagent/adagent.md
@@ -57,7 +57,7 @@ These depend on the amount of activity expected:
The disk space requirement covers the following:
- Agent Size – 150 MB
-- Agent Queues – In the event of a network outage, the agent will cache up to 40 GB of event data
+- Agent Queues – If there is a network outage, the agent will cache up to 40 GB of event data
- Diagnostic Logging – 1 GB
Old files are zipped, typical compression ratio is 20. Optionally, old files are moved from the
@@ -82,7 +82,7 @@ The following permission is required to install and manage the agent:
## Supported Active Directory Platforms
-The Activity Monitor provides the ability to monitor Active Directory:
+The Activity Monitor lets you monitor Active Directory:
:::note
For monitoring an Active Directory domain, the AD Agent must be installed on all domain
@@ -102,7 +102,7 @@ topic for target environment requirements.
The following products conflict with the agent:
:::warning
-Do not install these products on a server where an agent is deployed. Do NOT install an
+Don't install these products on a server where an agent is deployed. Don't install an
agent on a server where these products are installed.
:::
diff --git a/docs/activitymonitor/10.0/requirements/adagent/threatprevention.md b/docs/activitymonitor/10.0/requirements/adagent/threatprevention.md
index 9cc890344e..d454b8b6ec 100644
--- a/docs/activitymonitor/10.0/requirements/adagent/threatprevention.md
+++ b/docs/activitymonitor/10.0/requirements/adagent/threatprevention.md
@@ -19,8 +19,6 @@ Monitor can be configured with outputs for Access Analyzer and Threat Manager
:::
-Follow these steps to configure this integration.
-
:::info
It is a best practice to use the API Server option of the Activity Monitor for
this integration between Threat Prevention and Access Analyzer.
@@ -42,12 +40,12 @@ Threat Manager Configuration** on the menu. The Netwrix Threat Manager Configura
- App Token – Leave this field blank for integration with Activity Monitor
- Policies – The table displays all policies created in Threat Prevention along with a State icon
- indicating if the policy is active. Check the **Send** box for the desired policies monitoring the
+ indicating if the policy is active. Check the **Send** box for the policies you want monitoring the
target domain activity.
**Step 3 –** Click **Save**.
-All real-time event data from the selected policies are now being sent to Activity Monitor.
+Event data from the selected policies now flows to Activity Monitor in real-time.
Additional policies can be added to this data stream through the Netwrix Threat Manager
Configuration window or by selecting the **Send to Netwrix Threat Manager** option on the Actions
tab of the policy.
diff --git a/docs/activitymonitor/10.0/requirements/linuxagent.md b/docs/activitymonitor/10.0/requirements/linuxagent.md
index 3a77bb74e3..34ac5b1bcd 100644
--- a/docs/activitymonitor/10.0/requirements/linuxagent.md
+++ b/docs/activitymonitor/10.0/requirements/linuxagent.md
@@ -19,8 +19,8 @@ are:
## Target Requirements
:::note
-For monitoring a Linux file server, the The Linux Agent is deployed to Linux servers to be
-monitored. It cannot be deployed to a proxy server.
+For monitoring a Linux file server, the Linux Agent is deployed to Linux servers to be
+monitored. It can't be deployed to a proxy server.
:::
@@ -33,7 +33,7 @@ The following protocols are supported for the Linux agent:
- Network File System (Mounted Client-Side)
:::note
-Server-Side NFS protocol is not supported.
+Server-Side NFS protocol isn't supported.
:::
@@ -48,7 +48,7 @@ Analyzer to read the activity log files must have also have this permission.
:::info
Activity Monitor Agent uses certificates to secure the connection between the Linux Agent and the Console / API Server.
-By default, the Agent uses an automatically generated self-signed certificate. The Console and the API Server do not enforce
+By default, the Agent uses an automatically generated self-signed certificate. The Console and the API Server don't enforce
validity checks on these self-signed agent certificates.
This self-signed certificate can be replaced with one issued by a Certification Authority. Once replaced, the Console and
diff --git a/docs/activitymonitor/10.0/requirements/overview.md b/docs/activitymonitor/10.0/requirements/overview.md
index 2707562f3b..ee72e040e6 100644
--- a/docs/activitymonitor/10.0/requirements/overview.md
+++ b/docs/activitymonitor/10.0/requirements/overview.md
@@ -8,7 +8,7 @@ sidebar_position: 20
This topic describes the recommended configuration of the servers needed to install the application
in a production environment. Depending on the size of the organization, it is recommended to review
-your environment and requirements with a Netwrix engineer prior to deployment to ensure all
+your environment and requirements with a Netwrix engineer before deployment to ensure all
exceptions are covered.
## Architecture Overview
@@ -26,15 +26,15 @@ The following servers are required for installation of the application:
:::
-- **Agents** – There are three deployment scenarios that that differ in their requirements:
+- **Agents** – There are three deployment scenarios with different requirements:
- Activity monitoring of Windows file servers, Network Attached Storage (NAS) devices, Azure Files, Microsoft Entra ID, SharePoint On-premise,
- SharePoint Online, Exchange Online, and SQL Server. The agent is deployed on a Windows Server.
+ SharePoint Online, Exchange Online, and SQL Server. Deploy the agent on a Windows Server.
See the [Activity Agent Server Requirements](/docs/activitymonitor/10.0/requirements/activityagent/activityagent.md) topic
for additional information.
- - Active Directory monitoring – the agent is deployed to every domain controllers to monitor Active Directory
+ - Active Directory monitoring – Deploy the agent to every domain controller to monitor Active Directory
domains. See the [AD Agent Server Requirements](/docs/activitymonitor/10.0/requirements/adagent/adagent.md) topic for additional information.
- - Linux monitoring – the agent is deployed to Linux servers to be monitored. See the
+ - Linux monitoring – Deploy the agent to Linux servers to monitor them. See the
[Linux Agent Server Requirements](/docs/activitymonitor/10.0/requirements/linuxagent.md) topic for additional information.
**Target Environment Considerations**
diff --git a/docs/activitymonitor/10.0/restapi/resources/agent.md b/docs/activitymonitor/10.0/restapi/resources/agent.md
index 30ef470331..988a11ffed 100644
--- a/docs/activitymonitor/10.0/restapi/resources/agent.md
+++ b/docs/activitymonitor/10.0/restapi/resources/agent.md
@@ -16,8 +16,8 @@ sidebar_position: 10
| authenticationMethod | string | | The authentication method for connecting to the agent: Password, PublicKey |
| agentPort | int | | The port that is used by the agent. Default: 4498. |
| userName | string | | Account for connecting to the agent. |
-| password | string | X | Account password for connecting to the agent. Password is not exposed. |
-| privateKey | string | | The private key used when PublicKey authentication method is used. The private key is not exposed. |
+| password | string | X | Account password for connecting to the agent. Password isn't exposed. |
+| privateKey | string | | The private key used when PublicKey authentication method is used. The private key isn't exposed. |
| clientCertificate | string | | The agent's client certificate. |
| protocol | string | | The protocol used for connecting to the agent: GRPC |
| domain | string | | Domain name of the agent |
@@ -43,13 +43,13 @@ sidebar_position: 10
| archive.IsEnabled | bool | X | Whether the archiving feature is enabled |
| archive.path | string | X | UNC path of the archival location |
| archive.userName | string | X | An account to access the archival location. |
-| archive.password | string | X | User password to access the archival location. Password is not exposed. |
+| archive.password | string | X | User password to access the archival location. Password isn't exposed. |
| archive.maxLocalSize | string | X | Maximum space the agent is allowed to use on the local drives. |
| fpolicy.port | int | X | NetApp c-mode fpolicy port |
| fpolicy.auth | string | X | `NoAuth`, `Server`, `Mutual` |
| fpolicy.ipWhitelist | string[] | X | IP whitelist |
-| fpolicy.clientCertificate | string | X | The Client or CA certificate that is currently set. |
-| fpolicy.serverCertificate | string | X | The FPolicy Server certificate that is currently set. Server Certificate is not exposed. |
+| fpolicy.clientCertificate | string | X | The Client or CA certificate that is set. |
+| fpolicy.serverCertificate | string | X | The FPolicy Server certificate that is set. Server Certificate isn't exposed. |
| minLocalFreeSpace | string | X | Free disk threshold after which the agent stops writing data to the log files |
| cee.vcapsIsEnabled | bool | X | CEE Asynchronous bulk delivery (VCAPS) is enabled or disabled. |
| cee.vcapsInterval | int | X | Interval in seconds on how often events are delivered by CEE. |
@@ -68,7 +68,7 @@ sidebar_position: 10
| inactivityAlerts.email.server | string | X | The email SMTP server that is sent inactivity alerts. |
| inactivityAlerts.email.ssl | bool | X | Email SMTP Server SSL / TLS is enabled or disabled. |
| inactivityAlerts.email.userName | string | X | Email SMTP Server Username. |
-| inactivityAlerts.email.password | string | X | Email SMTP Server Password. Password is not exposed. |
+| inactivityAlerts.email.password | string | X | Email SMTP Server Password. Password isn't exposed. |
| inactivityAlerts.email.from | string | X | Email address of where the inactivity alert is from. |
| inactivityAlerts.email.to | string | X | Email address of where the inactivity alert is sent to. |
| inactivityAlerts.email.subject | string | X | Email message subject of the inactivity alert. |
@@ -76,7 +76,7 @@ sidebar_position: 10
| apiServerIsEnabled | bool | | API Server is enabled or disabled |
| apiServerPort | int | | API Server TCP/IP port |
| apiServerIpWhitelist | string[] | X | Whitelist of IPs allowed to connect to the API Server port. |
-| apiServerMgmtConsole | string | X | NETBIOS name of the Console machine that manages the agent list of the API Server (only available for agent(s) that are running the api server) |
+| apiServerMgmtConsole | string | X | NETBIOS name of the Console machine that manages the agent list of the API Server (only available for agents that are running the api server) |
| traceLevel | string | X | The logging trace level of the agent. |
| externalNicName | string | X | The selected network interface that is used for connections. If blank, the agent will auto-detect the network interface to use. |
| comment | string | | The agent's set comment. |
@@ -86,8 +86,8 @@ sidebar_position: 10
| networkProxy.useDefaultCredentials | bool | X | If enabled the proxy server authenticates as the agent's machine account. |
| networkProxy.bypassProxyOnLocal | bool | X | If enabled the agent will bypass the proxy server for local addresses. |
| networkProxy.userName | string | X | The Proxy Server Username |
-| networkProxy.password | string | X | The Proxy Server Password. Password is not exposed. |
-| networkProxy.bypassList | string[] | X | List of regular expressions that describe URIs that do not use the proxy server when accessed. |
+| networkProxy.password | string | X | The Proxy Server Password. Password isn't exposed. |
+| networkProxy.bypassList | string[] | X | List of regular expressions that describe URIs that don't use the proxy server when accessed. |
| dns.isEnabled | bool | X | Local DNS caching service is enabled or disabled. |
| dns.listenPort | int | X | Port used by the DNS caching service. |
| dns.parallelism | int | X | Parallelism level to use while processing DNS requests. |
@@ -100,7 +100,7 @@ sidebar_position: 10
| dns.clientWaitTimeout | TimeSpan | X | The amount of the DNS service is allowed to process a request before sending a not found response. If no results are received the lookup operation continues in the background. |
| dns.refreshThreshold | TimeSpan | X | An interval between expired items in the cache check. |
| dns.maxCacheSize | int | X | The max size of the dns service buffer file. |
-| dns.uselessAge | TimeSpan | X | The DNS service does not resolve names for events older then the set time period. |
+| dns.uselessAge | TimeSpan | X | The DNS service doesn't resolve names for events older then the set time period. |
| dns.maxAttemptsToResolve | int | X | Maximum attempts that the DNS service will use to resolve addresses. If 0 is set, the DNS service will resolve addresses infinitely. |
| dns.suffix | string | X | The DNS suffix identifies the domain name that is appended to an unqualified host name to obtain a fully qualified domain name (FQDN) suitable for a dns name query. |
| adUsers.domainControllers | string[] | X | List of Domain Controllers to be used for user lookups. If blank, the default behavior is used. |
@@ -111,7 +111,7 @@ sidebar_position: 10
| panzura.port | int | X | Agent port used for Panzura. |
| panzura.useCredentials | bool | X | Protection of Panzura port is enabled or disabled. |
| panzura.username | string | X | Panzura's MQ username used for port protection. |
-| panzura.password | string | X | Panzura's MQ password used for port protection. Password is not exposed. |
+| panzura.password | string | X | Panzura's MQ password used for port protection. Password isn't exposed. |
| panzura.ipWhitelist | string[] | X | Whitelist of IP addresses of Panzura nodes that are allowed to connect to the Agent's Panzura port. If blank, connections from any host are accepted. |
| nutanix.port | int | X | Agent port used for Nutanix. |
| nutanix.ipWhitelist | string[] | X | Whitelist of IP addresses of Nutanix nodes that are allowed to connect to the Agent's Nutanix port. If blank, connections from any host are accepted. |
diff --git a/docs/activitymonitor/10.0/restapi/resources/host.md b/docs/activitymonitor/10.0/restapi/resources/host.md
index 55a187f7e5..6a990827ba 100644
--- a/docs/activitymonitor/10.0/restapi/resources/host.md
+++ b/docs/activitymonitor/10.0/restapi/resources/host.md
@@ -13,7 +13,7 @@ sidebar_position: 30
| host | string | | Host name/Address as specified by a user |
| type | string | | `Windows`,`NetApp`,`Celerra`,`Isilon`,`Hitachi`,`SharePoint`,`Unity`,`Nasuni`, `Panzura`, `SharePointOnline`, `AzureAD`, `Linux`, `SqlServer` |
| userName | string | | An account to connect the host to |
-| password | string | X | Account password to connect the host to. Password is not exposed. |
+| password | string | X | Account password to connect the host to. Password isn't exposed. |
| autoConfigureAuditing | bool | | Automatically enable the auditing on the device, if supported |
| monitorAuditingStatus | bool | | Constantly verify that the auditing is enabled, fix if needed |
| hostAliases | string[] | | List of server names for NAS if they are different from the set name of the host. |
@@ -30,7 +30,7 @@ sidebar_position: 30
| inactivityAlerts.email.server | string | | The email or SMTP server or IP that is used to send host inactivity alerts. |
| inactivityAlerts.email.ssl | bool | | Email SMTP Server SSL / TLS is enabled or disabled. |
| inactivityAlerts.email.userName | string | | The email or SMTP server user name. |
-| inactivityAlerts.email.password | string | X | The email or SMTP server password. Password is not exposed. |
+| inactivityAlerts.email.password | string | X | The email or SMTP server password. Password isn't exposed. |
| inactivityAlerts.email.from | string | | Email address of where the inactivity alert is from. |
| inactivityAlerts.email.to | string | | Email address of where the inactivity alert is sent to. |
| inactivityAlerts.email.subject | string | | Email message subject of the inactivity alert. |
@@ -68,21 +68,21 @@ sidebar_position: 30
| spo.azure.tenantId | string | | The azure Tenant ID |
| spo.azure.tenantName | string | | The azure Tenant Name |
| spo.azure.clientId | string | | The azure Tenant Client ID. |
-| spo.azure.clientSecret | string | X | The azure Client Secret. Client Secret is not exposed. |
+| spo.azure.clientSecret | string | X | The azure Client Secret. Client Secret isn't exposed. |
| spo.azure.region | string | | The azure Region. |
| azureAd.azure.domain | string | | The Azure Active Directory domain being monitored. |
| azureAd.azure.azureCloud | string | | The selected Azure Cloud being used: "Azure", "Azure for US Government GCC", "Azure for Government GCC High", "Azure for US Government DoD", "Azure Germany", "Azure China by 21Vianet" |
| azureAd.azure.tenantId | string | | The azure Tenant ID |
| azureAd.azure.tenantName | string | | The azure Tenant Name |
| azureAd.azure.clientId | string | | The azure Tenant Client ID. |
-| azureAd.azure.clientSecret | string | X | The azure Client Secret. Client Secret is not exposed. |
+| azureAd.azure.clientSecret | string | X | The azure Client Secret. Client Secret isn't exposed. |
| azureAd.azure.region | string | | The azure Region. |
| exchangeOnline.azure.domain | string | | The Azure Active Directory domain being monitored for Exchange Online. |
| exchangeOnline.azure.azureCloud | string | | The selected Azure Cloud being used: "Azure", "Azure for US Government GCC", "Azure for Government GCC High", "Azure for US Government DoD", "Azure Germany", "Azure China by 21Vianet" |
| exchangeOnline.azure.tenantId | string | | The azure Tenant ID |
| exchangeOnline.azure.tenantName | string | | The azure Tenant Name |
| exchangeOnline.azure.clientId | string | | The azure Tenant Client ID. |
-| exchangeOnline.azure.clientSecret | string | X | The azure Client Secret. Client Secret is not exposed. |
+| exchangeOnline.azure.clientSecret | string | X | The azure Client Secret. Client Secret isn't exposed. |
| exchangeOnline.azure.region | string | | The azure Region. |
| sql.pollingInterval | string | | The interval for polling SQL log for new events. |
| sql.tweakOptions | string[] | | Extended Events tweaking options for SQL hosts. |
diff --git a/docs/activitymonitor/10.0/restapi/resources/output.md b/docs/activitymonitor/10.0/restapi/resources/output.md
index 5d881c9d1b..663a42b0fe 100644
--- a/docs/activitymonitor/10.0/restapi/resources/output.md
+++ b/docs/activitymonitor/10.0/restapi/resources/output.md
@@ -16,7 +16,7 @@ sidebar_position: 40
| domainId | string | | AD only: ID of the owning domain |
| domainUrl | string | | AD only: Link to the owning domain |
| logsUrl | string | | Link to the file output log files (for the local agent only, that has the API Server running) |
-| isEnabled | bool | | Whether or not the output is enabled. If disabled, no activity is forwarded to it. |
+| isEnabled | bool | | Whether the output is enabled. If disabled, no activity is forwarded to it. |
| type | string | | `LogFile`,`Syslog`,`Amqp` |
| logFile | FileOutput | | Log file settings |
| syslog | SyslogOutput | | Syslog settings |
@@ -64,7 +64,7 @@ sidebar_position: 40
| separator | string | | `Lf`,Cr, `CrLf`, `Nul`, `Rfc5425` |
| reportUncPath | bool | | Report UNC paths in addition to local/native paths |
| addCToPath | bool | | Prepend the path `C:\` and change the forward slashes to backslashes. |
-| template | string | | Text of the syslog template that is currently set to be used. |
+| template | string | | Text of the syslog template that is set to be used. |
## AmqpOutput
@@ -72,13 +72,13 @@ sidebar_position: 40
| --------- | ------ | ------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| server | string | | Hostname/address of the AMQP server or the Threat Manager server and the port in the SERVER:PORT format |
| userName | string | | User name for the AMQP connection, if needed. ForThreat Managerintegration, use an empty string. |
-| password | string | | Password / App Token for the AMQP connection. Password / App Token is not exposed. |
+| password | string | | Password / App Token for the AMQP connection. Password / App Token isn't exposed. |
| queue | string | | Message queue name to post events to. ForThreat Manager integration, use an empty string. |
| exchange | string | | Exchange name to post events to. For Threat Manager integration, use "StealthINTERCEPT" for domain outputs or "AM" for host outputs. |
| vhost | string | | Virtual Host name, if needed. ForThreat Managerintegration, use an empty string. |
| caCertificate| string | | Certificate Autority certificate to validate the TLS connection. |
| protocol | string | | `TCP` (default) or `TLS`. |
-| hostNameVerification | bool | | Whether or not verify the hostname during the TLS handshake. |
+| hostNameVerification | bool | | Whether to verify the hostname during the TLS handshake. |
## FileFilter
@@ -333,8 +333,8 @@ sidebar_position: 40
| isArchived | bool | | Determines whether the file is on a local drive of the agent or moved to the archival location. |
| type | string | | `Tsv`, `Json` |
| updatedAt | DateTime | | Last time the file was updated |
-| activityFrom | DateTime | | Activity events in the file are not younger than the date. |
-| activityTo | DateTime | | Activity events in the file are not older than the date. |
+| activityFrom | DateTime | | Activity events in the file aren't younger than the date. |
+| activityTo | DateTime | | Activity events in the file aren't older than the date. |
| outputId | string | | ID of the output that produced the file. |
| contentUrl | string | | Link to the file content. MIME type `application/x-msdownload` |
diff --git a/docs/activitymonitor/10.0/restapi/resources/resources.md b/docs/activitymonitor/10.0/restapi/resources/resources.md
index ba10f8fcc7..2a213b913f 100644
--- a/docs/activitymonitor/10.0/restapi/resources/resources.md
+++ b/docs/activitymonitor/10.0/restapi/resources/resources.md
@@ -8,7 +8,7 @@ sidebar_position: 20
The 10.0 API model consists of the following resources:
-- Agent – Represents an Activity Monitor Agent. API allows you to view existing agents and their
+- Agent – Represents an Activity Monitor Agent. Use the API to view existing agents and their
status, register, modify, or remove agents. You can list all the agents or the agents of a domain
(AD-monitoring agents on the domain controllers).
Children: Host, Domain
@@ -42,14 +42,14 @@ The 10.0 API model consists of the following resources:
- File - Represents a log file created by a File Output - an actual .tsv, .json, or .zip file stored on
the agent or on a network share. A file can be downloaded.
-- Policy - Represents an Active Directory nonitoring policy. The API allows you to create new
+- Policy - Represents an Active Directory nonitoring policy. Use the API to create new
policies, list, modify, and delete existing.
Data is transmitted as JSON objects or as JSON Merge Patch for PATCH requests. Dates are formatted
in UTC using the `YYYY-MM-DDTHH:MM:SS` DateTime format. Security-sensitive data like passwords,
-certificates, and access tokens are not returned by the GET requests but can be set using POST and
+certificates, and access tokens aren't returned by the GET requests but can be set using POST and
PATCH requests.
## API
@@ -271,7 +271,7 @@ Response Example:
**POST /api/v1/agents**
-Adds a new agent but does not install it. The host attribute must be unique.
+Adds a new agent but doesn't install it. The host attribute must be unique.
- Permission – Modify agents
- Response Body – Agent
@@ -642,7 +642,7 @@ Response Example:
**GET /api/v1/domains/«domainId»**
-Returns the domain by its ID, or a 404 error if it is not found or the client lacks sufficient
+Returns the domain by its ID, or a 404 error if it isn't found or the client lacks sufficient
permissions.
- Permission – Read or Access activity data
@@ -654,8 +654,8 @@ Response: Domain
**GET /api/v1/agents/«agentId»/domain**
-Returns a domain monitored by the specified agent, or a 404 error if the domain is not found, the
-client lacks the necessary permissions, or the agent is not monitoring AD activity.
+Returns a domain monitored by the specified agent, or a 404 error if the domain isn't found, the
+client lacks the necessary permissions, or the agent isn't monitoring AD activity.
This endpoint is useful to get `Output` settings specific to the agent. Domain outputs are logical,
they are described once and used by all the domain controllers to create actual files/syslog/amqp
@@ -672,7 +672,7 @@ Response: Domain
**GET /api/v1/domains/«domainId»/agents**
Returns the domain controllers (agents) monitoring the specified domain, or a 404 error if the
-domain is not found or the client lacks the necessary permissions.
+domain isn't found or the client lacks the necessary permissions.
- Permission – Read or Access activity data
- Response – Array of Agent
@@ -684,7 +684,7 @@ Response: Array of Agent
**GET /api/v1/domains/«domainId»/outputs**
Returns the configured outputs for the specified domain, or 404 if no rights for the domain or the
-domain was not found.
+domain wasn't found.
- Permission – Read or Access activity data
- Response – Array of Output
@@ -752,7 +752,7 @@ Response Example:
**GET /api/v1/domains/«domainId»/outputs/«outputId»**
-Returns the output for the specified domain, or a 404 error if the domain is not found or the client
+Returns the output for the specified domain, or a 404 error if the domain isn't found or the client
lacks the necessary permissions.
- Permission –Read or Access activity data
@@ -1106,7 +1106,7 @@ Response: Array of Status
**GET /api/v1/agents/«agentId»/hosts**
-Returns a list of hosts for the specified agent. If the agent is not found or the client lacks the
+Returns a list of hosts for the specified agent. If the agent isn't found or the client lacks the
necessary permissions, a 404 error is returned.
- Permission – Read or Access activity data
@@ -1369,7 +1369,7 @@ Response: 204
**GET /api/v1/hosts/«hostId»/outputs**
-Returns a list of outputs for the specified host. If the host is not found or the client lacks the
+Returns a list of outputs for the specified host. If the host isn't found or the client lacks the
necessary permissions, a 404 error is returned.
- Permission – Read or Access activity data
@@ -1417,7 +1417,7 @@ Request Body Structure:
**POST /api/v1/agents/«agentId»/hosts/«hostId»/outputs**
Adds a new output for the specified host on the specified agent only. The method may be useful to
-have agent-specific outputs but is not recommended.
+have agent-specific outputs but isn't recommended.
- Permission – Modify hosts
- Response – 201, Output
@@ -1452,7 +1452,7 @@ Request Body Structure:
**GET /api/v1/hosts/«hostId»/outputs/«outputId»**
-Returns the specified output of the host. If the host or output is not found, or the client lacks
+Returns the specified output of the host. If the host or output isn't found, or the client lacks
the necessary permissions, a 404 error is returned.
- Permission – Read or Access activity data
@@ -1586,7 +1586,7 @@ The following attributes can be modified:
- `windows.discardReorderedAcl`
- `windows.vssActivity`
- `windows.vssCreation`
-- `amqp.server` - must be a a vaild hostname or ip4/ip6 address.
+- `amqp.server` - must be a vaild hostname or ip4/ip6 address.
- `amqp.userName`
- `amqp.password`
- `amqp.vhost`
@@ -1674,7 +1674,7 @@ The following attributes can be modified:
- `windows.discardReorderedAcl`
- `windows.vssActivity`
- `windows.vssCreation`
-- `amqp.server` ¬ must be a a vaild hostname or ip4/ip6 address.
+- `amqp.server` ¬ must be a vaild hostname or ip4/ip6 address.
- `amqp.userName`
- amqp.password
- `amqp.vhost`
@@ -1870,7 +1870,7 @@ Required attributes:
**PATCH /api/v1/domains/«domainId»/policies/«policyId»**
-Modifies attributes of the policy. If XML is updated, ID and GUID attributes in the XML are ignored,
+Modifies attributes of the policy. If XML is updated, ID, and GUID attributes in the XML are ignored,
and existing values are preserved.
**Permission: Policy change**
diff --git a/docs/activitymonitor/10.0/restapi/security.md b/docs/activitymonitor/10.0/restapi/security.md
index 9697f539df..6dd6cea7a7 100644
--- a/docs/activitymonitor/10.0/restapi/security.md
+++ b/docs/activitymonitor/10.0/restapi/security.md
@@ -9,7 +9,7 @@ sidebar_position: 10
## Security
The REST-style API is exposed via TLS v1.2, with a self-signed certificate by default. The port is
-customizable, 4494 by default. The IP whitelist can be used to restrict access to the port.
+customizable, 4494 by default. Use the IP whitelist to restrict access to the port.
You can use the Activity Monitor Console to allow applications to access the API, change
permissions, or revoke access. The console generates unique Client ID and Secret for each
@@ -19,7 +19,7 @@ application.
OAuth 2.0 client-credentials grant is used for authentication. A pair of Client ID and Secret are
used to obtain an access token from the access token URL: `https://localhost:4494/api/v1/token`.
-Token expiration intervals are not configurable.
+Token expiration intervals aren't configurable.
| Type | Expires in |
| ------------- | ---------- |
@@ -28,10 +28,10 @@ Token expiration intervals are not configurable.
| Refresh Token | never |
It is considered a best practice to use short expiration periods for OAuth 2.0 tokens, like 1 hour
-for the access token. A shorter period allows you to revoke the access quicker if needed. In case of
+for the access token. Shorter expiration periods let you revoke access more quickly if needed. In case of
Activity Monitor, the Agent is both the authentication server and the resource server. Therefore, it
can validate the token on each and every access to a resource. So, for Activity Monitor long
-expiration periods do not make the protocol less secure.
+expiration periods don't make the protocol less secure.
A client is expected to pass the access token in the `Authorization` request header.
@@ -62,7 +62,7 @@ Activity Monitor 10.0 permissions:
| Permission | Description |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| Access activity data | Provides minimal access rights to list and download the log files. |
-| Read | Read-only access to all the information about all agents, domains, and hosts. Does not allow one to download the log files. |
+| Read | Read-only access to all the information about all agents, domains, and hosts. Doesn't allow one to download the log files. |
| Policy change | Add, modify, and delete the AD monitoring policies. |
| Modify host | Add, modify, enable, disable, and delete Hosts and their Outputs. |
| Modify agent | Add, modify, and delete agents. |
diff --git a/docs/activitymonitor/10.0/siem/qradar/app/app.md b/docs/activitymonitor/10.0/siem/qradar/app/app.md
index a6762fd75f..62bc5292a3 100644
--- a/docs/activitymonitor/10.0/siem/qradar/app/app.md
+++ b/docs/activitymonitor/10.0/siem/qradar/app/app.md
@@ -15,7 +15,7 @@ and a Settings interface for configuring the QRadar SEC token.
The User Investigation and Host Investigation dashboards only appear when a search is conducted.
This can be done by clicking a hyperlink within the Username or Destination IP columns of a table
-card. Alternatively, type the complete user name or host IP Address in the Search box on the right
+card. Alternatively, enter the complete user name or host IP Address in the Search box on the right
side of the navigation bar.
## Table Card Features
@@ -34,11 +34,11 @@ following features:
- Total number of entries “Showing” will adjust for the filtered total.
- Search can also apply to the Operation column, but only for exact matches.
-- Sort can be applied to one column at a time by clicking on the desired column header.
+- Sort can be applied to one column at a time by clicking on the column header you want.
- Show 10, 25, 100, or All entries in the table. Only visible entries can be exported.
-- Result data currently visible within the table page displayed can be exported from the dashboard:
+- Result data visible within the table page displayed can be exported from the dashboard:
- - Copy – Copy to clipboard in order to paste to another application
+ - Copy – Copy to clipboard to paste to another application
- CSV – Export to a Comma Separated Value file
- Excel – Export to an Excel Workbook file
- - Print – Send currently displayed table to printer
+ - Print – Send displayed table to printer
diff --git a/docs/activitymonitor/10.0/siem/qradar/app/deletions.md b/docs/activitymonitor/10.0/siem/qradar/app/deletions.md
index 1c570c383e..39808848bd 100644
--- a/docs/activitymonitor/10.0/siem/qradar/app/deletions.md
+++ b/docs/activitymonitor/10.0/siem/qradar/app/deletions.md
@@ -21,5 +21,5 @@ The Deletions dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
-interval. Then click Search to refresh the card data.
+enter the date and time you want or use the calendar buttons to set the date and time
+interval you want. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/10.0/siem/qradar/app/home.md b/docs/activitymonitor/10.0/siem/qradar/app/home.md
index 37bba278e8..e8234988b8 100644
--- a/docs/activitymonitor/10.0/siem/qradar/app/home.md
+++ b/docs/activitymonitor/10.0/siem/qradar/app/home.md
@@ -20,7 +20,7 @@ The File System Activity Home dashboard contains the following cards:
- The value for this card is a hyperlink to the [Ransomware Dashboard](/docs/activitymonitor/10.0/siem/qradar/app/ransomware.md).
- File Activity – Timeline of all file activity over the specified time interval
-- Top Users – Displays up-to the top five users associated with file activity over the specified
+- Top Users – Displays the top five users associated with file activity over the specified
time interval
- Top Servers – Displays up-to the top five servers (destination IP Addresses) associated with file
activity over the specified time interval
@@ -32,5 +32,5 @@ The File System Activity Home dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
-interval. Then click Search to refresh the card data.
+enter the date and time you want or use the calendar buttons to set the date and time
+interval you want. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/10.0/siem/qradar/app/hostinvestigation.md b/docs/activitymonitor/10.0/siem/qradar/app/hostinvestigation.md
index 1f0d0e278a..c0e8ad163f 100644
--- a/docs/activitymonitor/10.0/siem/qradar/app/hostinvestigation.md
+++ b/docs/activitymonitor/10.0/siem/qradar/app/hostinvestigation.md
@@ -7,7 +7,7 @@ sidebar_position: 60
# Host Investigation Dashboard
The Host Investigation dashboard only appears when a search is conducted. This can be done by
-clicking a hyperlink within the Destination IP column of a table card. Alternatively, type the
+clicking a hyperlink within the Destination IP column of a table card. Alternatively, enter the
complete host IP Address in the Search box on the right side of the navigation bar.
@@ -36,5 +36,5 @@ The Host Investigation dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
+enter the date and time you want or use the calendar buttons to set your preferred date and time
interval. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/10.0/siem/qradar/app/permissionchanges.md b/docs/activitymonitor/10.0/siem/qradar/app/permissionchanges.md
index 5573d26414..67cb6654d5 100644
--- a/docs/activitymonitor/10.0/siem/qradar/app/permissionchanges.md
+++ b/docs/activitymonitor/10.0/siem/qradar/app/permissionchanges.md
@@ -14,7 +14,7 @@ various metrics.
The Permission Changes dashboard contains the following cards:
- Activity – Timeline of all permission change events over the specified time interval
-- Top Users – Displays up-to the top five users associated with permission change events over the
+- Top Users – Displays the top five users associated with permission change events over the
specified time interval
- Latest Events – Tabular format of all permission change events which occurred over the specified
time interval
@@ -24,5 +24,5 @@ The Permission Changes dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
+Enter the date and time you want or use the calendar buttons to set the date and time you want
interval. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/10.0/siem/qradar/app/ransomware.md b/docs/activitymonitor/10.0/siem/qradar/app/ransomware.md
index 3696dffd76..a74616886b 100644
--- a/docs/activitymonitor/10.0/siem/qradar/app/ransomware.md
+++ b/docs/activitymonitor/10.0/siem/qradar/app/ransomware.md
@@ -31,7 +31,7 @@ The Ransomware dashboard contains the following cards:
- Only visible after clicking Search on an offense
The offenses generated within QRadar are based upon the Netwrix: Ransomware Detected rule that
-is packaged with this application. In order to adjust this rule to better suit an organization’s
-needs, please refer to the IBM QRadar
+is packaged with this application. to adjust this rule to better suit an organization’s
+needs, refer to the IBM QRadar
[Rule management](https://www.ibm.com/support/knowledgecenter/SS42VS_7.2.6/com.ibm.qradar.doc/c_qradar_rul_mgt.html)
article on how to modify rules.
diff --git a/docs/activitymonitor/10.0/siem/qradar/app/userinvestigation.md b/docs/activitymonitor/10.0/siem/qradar/app/userinvestigation.md
index 7eb65eecd1..41e192c5cf 100644
--- a/docs/activitymonitor/10.0/siem/qradar/app/userinvestigation.md
+++ b/docs/activitymonitor/10.0/siem/qradar/app/userinvestigation.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# User Investigation Dashboard
The User Investigation dashboard only appears when a search is conducted. This can be done by
-clicking a hyperlink within the Username column of a table card. Alternatively, type the complete
+clicking a hyperlink within the Username column of a table card. Alternatively, enter the complete
user name in the Search box on the right side of the navigation bar.
@@ -32,5 +32,5 @@ The User Investigation dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
+enter the date and time you want or use the calendar buttons to set the date and time
interval. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/10.0/siem/qradar/overview.md b/docs/activitymonitor/10.0/siem/qradar/overview.md
index d5be159e98..67f87d1e46 100644
--- a/docs/activitymonitor/10.0/siem/qradar/overview.md
+++ b/docs/activitymonitor/10.0/siem/qradar/overview.md
@@ -25,10 +25,8 @@ the Netwrix website for additional information.
Download the [Netwrix File Activity Monitor App for
QRadar](https://exchange.xforce.ibmcloud.com/hub/extension/STEALTHbits Technologies:STEALTHbits File Activity Monitor) from the [IBM X-Force App Exchange](https://exchange.xforce.ibmcloud.com/hub).
-After downloading the Stealthbits File Activity Monitor App for QRadar, follow the steps to install
-it within QRadar.
-
-**Step 1 –** Click on the Admin tab within QRadar.
+After downloading the Stealthbits File Activity Monitor App for QRadar,
+**Step 1 –** Click the Admin tab within QRadar.
**Step 2 –** Under System Configuration, click Extensions Management.
@@ -47,8 +45,6 @@ be saved to the Settings interface of the **File Activity Monitor** App. See the
## Initial Configuration of the QRadar App
-Follow the steps to configure QRadar to receive data from Netwrix products.
-
**Step 1 –** Determine the IP Address of the QRadar Console, e.g. run the _ifconfig_ command. This
information is required for the following sections:
@@ -61,7 +57,7 @@ information is required for the following sections:
**Step 3 –** Select Log Sources.
-**Step 4 –** View the Log Sources list. If the data source was not automatically created, click Add
+**Step 4 –** View the Log Sources list. If the data source wasn't automatically created, click Add
and enter the following information:
- Log Source Name – Enter a descriptive name to identify the data source
@@ -77,7 +73,7 @@ sent correctly between the hosts, and diagnose any possible network issues.
- Protocol Configuration – Select Syslog
- Log Source Identifier – Enter the host name or IP Address of the host where the Netwrix
Activity Monitor agent OR Threat Prevention is installed
-- Then click Save. Remember, prior to using the Netwrix File Activity Monitor App for QRadar, the
+- Then click Save. Remember, before using the Netwrix File Activity Monitor App for QRadar, the
related Netwrix product must be configured to send data to QRadar.
The Netwrix File Activity Monitor App for QRadar can now display activity data from either the
diff --git a/docs/activitymonitor/10.0/siem/qradar/settings.md b/docs/activitymonitor/10.0/siem/qradar/settings.md
index d6760cd22d..f637817261 100644
--- a/docs/activitymonitor/10.0/siem/qradar/settings.md
+++ b/docs/activitymonitor/10.0/siem/qradar/settings.md
@@ -12,4 +12,4 @@ the QRadar SEC token to be saved to the **Settings** interface.
The **More information** link will open the IBM Knowledge Center with information on generating the
-QRadar SEC token. Once the token is generated, copy and paste it here and click Save.
+QRadar SEC token. After the token is generated, paste it here and click Save.
diff --git a/docs/activitymonitor/10.0/siem/splunk/app/app.md b/docs/activitymonitor/10.0/siem/splunk/app/app.md
index f44cddf87b..5b7de9b5a8 100644
--- a/docs/activitymonitor/10.0/siem/splunk/app/app.md
+++ b/docs/activitymonitor/10.0/siem/splunk/app/app.md
@@ -13,6 +13,6 @@ Activity (Overview), Ransomware, Permission Changes, and Deletions.
The date time search feature uses the default Splunk search features.
-The timeframe interval is identified in the upper-left corner of each dashboard. The drop-down menu
+The timeframe interval is identified in the upper-left corner of each dashboard. The dropdown menu
provides additional options. To search within a different interval, choose a new option from the
menu. Then click **Submit** to refresh the card data.
diff --git a/docs/activitymonitor/10.0/siem/splunk/app/deletions.md b/docs/activitymonitor/10.0/siem/splunk/app/deletions.md
index 7a67f53482..303c536ea2 100644
--- a/docs/activitymonitor/10.0/siem/splunk/app/deletions.md
+++ b/docs/activitymonitor/10.0/siem/splunk/app/deletions.md
@@ -13,7 +13,7 @@ View deletion information in the Deletions Dashboard for Splunk.
The Deletions dashboard contains the following cards:
- Activity – Timeline of all deletion events in the specified timeframe
-- Top Users – Displays up-to the top five users related to deletion events which have been recorded
+- Top Users – Displays the top five users related to deletion events which have been recorded
in the specified timeframe
- Latest Events – Tabular format of all deletion events recorded in the specified timeframe
diff --git a/docs/activitymonitor/10.0/siem/splunk/app/overview.md b/docs/activitymonitor/10.0/siem/splunk/app/overview.md
index bafd3690dc..3e5da419e7 100644
--- a/docs/activitymonitor/10.0/siem/splunk/app/overview.md
+++ b/docs/activitymonitor/10.0/siem/splunk/app/overview.md
@@ -15,9 +15,9 @@ The File System Activity Overview dashboard contains the following cards:
- Active Users – Number of users involved with file system events in the specified timeframe
- Active Servers – Number of servers involved with file system events in the specified timeframe
- File Activity – Timeline of all file system events in the specified timeframe
-- Top Users – Displays up-to the top five users addresses related to file system events which have
+- Top Users – Displays the top five user addresses related to file system events which have
been recorded in the specified timeframe
-- Top Servers – Displays up-to the top five client IP addresses/host names related to file system
+- Top Servers – Displays the top five client IP addresses/host names related to file system
events which have been recorded in the specified timeframe
- Latest Events – Tabular format of all file system change events which have been recorded in the
specified timeframe
diff --git a/docs/activitymonitor/10.0/siem/splunk/app/permissionchanges.md b/docs/activitymonitor/10.0/siem/splunk/app/permissionchanges.md
index 8a1e47e6ba..29f60400d0 100644
--- a/docs/activitymonitor/10.0/siem/splunk/app/permissionchanges.md
+++ b/docs/activitymonitor/10.0/siem/splunk/app/permissionchanges.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Permission Changes Dashboard
-View information on permissions changes on the through the Permission Changes Dashboard for Splunk.
+View permissions changes in the Permission Changes Dashboard for Splunk.
diff --git a/docs/activitymonitor/10.0/siem/splunk/overview.md b/docs/activitymonitor/10.0/siem/splunk/overview.md
index 6c1ac1a719..063f82efac 100644
--- a/docs/activitymonitor/10.0/siem/splunk/overview.md
+++ b/docs/activitymonitor/10.0/siem/splunk/overview.md
@@ -28,7 +28,7 @@ After downloading the Netwrix File Activity Monitor App for Splunk from [Splunkb
Splunk to install the app.
:::note
-In order to use the Ransomware dashboard within the app, install
+to use the Ransomware dashboard within the app, install
[Splunk User Behavior Analytics](https://www.splunk.com/en_us/products/premium-solutions/user-behavior-analytics.html)
(any version) and the [Machine Learning Toolkit](https://splunkbase.splunk.com/app/2890/) app for
Splunk (version 2.0.0+).
@@ -41,7 +41,7 @@ configured to receive data from either theActivity Monitor or Threat Prevention.
## Initial Configuration of the Splunk App
-Follow the steps to configure Splunk to receive data from Netwrix products.
+To configure Splunk to receive data from Netwrix products, complete the following steps:
**Step 1 –** Determine the IP Address of the Splunk Console, e.g. run the ifconfig command. This
information is required for the following sections:
@@ -58,7 +58,7 @@ information is required for the following sections:
**Step 3 –** Select UDP.
**Step 4 –** Click New and add a new data input with Port 514. If another Splunk UDP input is
-already using 514, another value (515 or higher) can be used as long as it is not blocked by the
+already using 514, another value (515 or higher) can be used as long as it isn't blocked by the
network. Remember to configure the port within the Netwrix product configuration to align with
this change.
@@ -73,7 +73,7 @@ this change.
- Host – Select IP
- Index – Select Default
-**Step 7 –** Review and save the new settings. Remember, prior to using the Netwrix File
+**Step 7 –** Review and save the new settings. Remember, before using the Netwrix File
Activity Monitor App for Splunk, the related Netwrix products must be configured to send data to
Splunk.
diff --git a/docs/activitymonitor/10.0/troubleshooting/antivirusexclusions.md b/docs/activitymonitor/10.0/troubleshooting/antivirusexclusions.md
index 1ea8abd565..f0ee23df06 100644
--- a/docs/activitymonitor/10.0/troubleshooting/antivirusexclusions.md
+++ b/docs/activitymonitor/10.0/troubleshooting/antivirusexclusions.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Antivirus Exclusions
Windows activity monitoring and performance of the Activity Agent may be negatively affected by
-antivirus protections. Add the following components to antivirus exclusions in order to avoid
+antivirus protections. Add the following components to antivirus exclusions to avoid
potential performance degradation.
## Directories
@@ -30,7 +30,7 @@ The following binary files can be added to antivirus exclusions:
- Common Exclusions
- - `\net472\FSACLoggingSvc.exe` — Logging service. Forwards events to files, syslog, AMQP.
+ - `\net472\FSACLoggingSvc.exe` — Logging service. Forwards events to files, syslog, and Advanced Message Queuing Protocol (AMQP).
- `\ConfigurationAgent.Grpc.Host.exe` — Netwrix Activity Monitor Agent service
diff --git a/docs/activitymonitor/10.0/troubleshooting/backuprestore/agentbackup.md b/docs/activitymonitor/10.0/troubleshooting/backuprestore/agentbackup.md
index 836ccaab02..fe8df66642 100644
--- a/docs/activitymonitor/10.0/troubleshooting/backuprestore/agentbackup.md
+++ b/docs/activitymonitor/10.0/troubleshooting/backuprestore/agentbackup.md
@@ -6,10 +6,6 @@ sidebar_position: 10
# Agent Backup
-Follow the steps to back up the configuration, passwords, Active Directory event data file, and
-activity log files for Activity Monitor Agents deployed on file system servers, SharePoint servers,
-and domain controllers.
-
**Configuration**
**Step 1 –** Back up the `SBTFileMon.ini` file. The default location is
@@ -48,7 +44,7 @@ default folder is
**C:\ProgramData\Netwrix\Activity Monitor\Agent\ActivityLogs**
:::note
-Keep in mind that` C:\ProgramData` folder may be hidden. Navigate to it by typing
+The `C:\ProgramData` folder may be hidden. Navigate to it by typing
`%ALLUSERSPROFILE%` in the File Explorer.
:::
diff --git a/docs/activitymonitor/10.0/troubleshooting/backuprestore/agentrestore.md b/docs/activitymonitor/10.0/troubleshooting/backuprestore/agentrestore.md
index 52f1a33797..faf87a01d6 100644
--- a/docs/activitymonitor/10.0/troubleshooting/backuprestore/agentrestore.md
+++ b/docs/activitymonitor/10.0/troubleshooting/backuprestore/agentrestore.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# Agent Restoration
-Follow the steps to restore the configuration, Active Directory configuration file, and activity log
+To restore the configuration, Active Directory configuration file, and activity log
files for Activity Monitor Agents deployed on file system servers, SharePoint servers, and domain
-controllers.
+controllers, follow these steps:
:::warning
Restore the agent before restoring the console to ensure connectivity and monitoring
diff --git a/docs/activitymonitor/10.0/troubleshooting/backuprestore/consolebackup.md b/docs/activitymonitor/10.0/troubleshooting/backuprestore/consolebackup.md
index f0e06eeb35..3405ba39dc 100644
--- a/docs/activitymonitor/10.0/troubleshooting/backuprestore/consolebackup.md
+++ b/docs/activitymonitor/10.0/troubleshooting/backuprestore/consolebackup.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Console Backup
-Follow the steps to back up the list of agents managed on the Activity Monitor Console.
+Use the following steps to back up the list of agents managed on the Activity Monitor Console:
**Step 1 –** Back up the configuration file:
diff --git a/docs/activitymonitor/10.0/troubleshooting/backuprestore/consolerestore.md b/docs/activitymonitor/10.0/troubleshooting/backuprestore/consolerestore.md
index 3bdb18b487..e402d378e4 100644
--- a/docs/activitymonitor/10.0/troubleshooting/backuprestore/consolerestore.md
+++ b/docs/activitymonitor/10.0/troubleshooting/backuprestore/consolerestore.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Console Restoration
-Follow the steps to restore the list of agents managed on the Activity Monitor Console.
+To restore the list of agents managed on the Activity Monitor Console, complete the following steps:
**Step 1 –** Restore `Agents.ini` file.
diff --git a/docs/activitymonitor/10.0/troubleshooting/performancemonitoring.md b/docs/activitymonitor/10.0/troubleshooting/performancemonitoring.md
index 1d10293ce7..56834853a2 100644
--- a/docs/activitymonitor/10.0/troubleshooting/performancemonitoring.md
+++ b/docs/activitymonitor/10.0/troubleshooting/performancemonitoring.md
@@ -21,21 +21,21 @@ The following performance counters are provided by Activity Monitor.
| NetApp | ✔ | Activity Monitor - NetApp\Events Received/sec | Rate at which events are received from NetApp |
| NetApp | ✔ | Activity Monitor - NetApp\Events Reported | Number of events passed the filters and being reported to outputs |
| NetApp | ✔ | Activity Monitor - NetApp\Events Reported/sec | Rate at which events are reported to outputs |
-| NetApp | ✔ | Activity Monitor - NetApp\Session Negotiated | Number of connections established with ONTAP cluster nodes |
+| NetApp | ✔ | Activity Monitor - NetApp\Session Negotiated | Number of connections established with ONTAP (NetApp Operating System) cluster nodes |
| NetApp | ✔ | Activity Monitor - NetApp\Active Connections | Number of active connections with ONTAP cluster nodes |
| NetApp | | Activity Monitor - NetApp\Outage Files | Number of outage (resilience) files processed |
-| NetApp | ✔ | Activity Monitor - NetApp\Overloaded | Number of times the agent was overloaded and had to limit the rate of events. This counter may increase from time to time when processing large batches of events. But if it keeps increasing, it is a sure sign that the agent is not coping with the load. Consider moving some SVMs to another agent or spreading the load from one SVM across multiple agents. |
-| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Received | Number of events received from CEE |
+| NetApp | ✔ | Activity Monitor - NetApp\Overloaded | Number of times the agent was overloaded and had to limit the rate of events. This counter may increase from time to time when processing large batches of events. But if it keeps increasing, it is a sure sign that the agent isn't coping with the load. Consider moving some Storage Virtual Machines (SVMs) to another agent or spreading the load from one SVM across multiple agents. |
+| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Received | Number of events received from Common Event Enabler (CEE) |
| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Received/sec | Rate at which events are received from CEE |
| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Reported | Number of events passed the filters and being reported to outputs |
| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Reported/sec | Rate at which events are reported to outputs |
-| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Queue Size | Number of events received from CEE and waiting in queue to be processed |
+| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Queue Size | Number of events received from CEE (Common Event Enabler) and waiting in queue to be processed |
| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Receive Throttling | Delay, in milliseconds, introduced to manage the queue |
| Outputs | ✔ | Activity Monitor - Outputs\Events Reported | Total number of events reported |
| Outputs | ✔ | Activity Monitor - Outputs\Events Reported/sec | Rate at which events are reported |
| Outputs | | Activity Monitor - Outputs\Events Reported to Files | Total number of events reported to log files |
| Outputs | | Activity Monitor - Outputs\Events Reported to Syslog | Total number of events reported to syslog servers |
-| Outputs | | Activity Monitor - Outputs\Events Reported to AMQP | Total number of events reported to AMQP servers (not used currently) |
+| Outputs | | Activity Monitor - Outputs\Events Reported to AMQP | Total number of events reported to AMQP servers (not used ) |
| Outputs | ✔ | Activity Monitor - Outputs\Resolved SIDs | Number of attempts, both successful and failed, to resolve SIDs to names |
| Outputs | ✔ | Activity Monitor - Outputs\Resolved SIDs/sec | Rate at which SIDs are resolved to names |
| Outputs | ✔ | Activity Monitor - Outputs\Resolved SIDs Failures | Number of failed attempts to resolve SIDs to names |
@@ -55,8 +55,8 @@ The following performance counters are provided by Activity Monitor.
:::note
DNS and AD queries typically contribute the most to the processing time. Since the
resolution occurs in real time, slow responses can affect throughput (A 100ms DNS response limits
-the throughput to 10 events per second). Observing average and maximum values of DNS Queries Time,
-Resolved SIDs Time, and Translated UIDs Time allows you to estimate the response time.
+the throughput to 10 events per second). Observe the average and maximum values of DNS Queries Time,
+Resolved SIDs Time, and Translated UIDs Time to estimate the response time.
:::
@@ -69,7 +69,7 @@ performance counters:
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Processor(\_Total)\% Processor Time | The percentage of elapsed time that the processor spends to execute a non-Idle thread. |
| Memory\Available MBytes | The amount of physical memory, in Megabytes, immediately available for allocation to a process or for system use. |
-| Paging File(\_Total)\% Usage | The percentage of the paging file that is currently in use. |
+| Paging File(\_Total)\% Usage | The percentage of the paging file that is in use. |
| TCPv4\Connections Reset | The rate of reset TCPv4 connections |
| TCPv4\Segments Received/sec | The quantity of segments received via TCPv4 per second. |
| TCPv4\Segments Retransmitted/Sec | Quantity of segments retransmitted via TCPv4 per second. |
@@ -79,7 +79,7 @@ performance counters:
| Network Interface(\*)\Bytes Sent/sec | From all network adapters: The rate at which bytes are sent. |
| Network Interface(\*)\Output Queue Length | From all network adapters: The length of the output packet queue (in packets). |
| Network Interface(\*)\Packets Received Discarded | From all network adapters: The number of inbound packets that were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. |
-| Network Interface(\*)\Packets Received Errors | From all network adapters: The number of inbound packets that contained errors. As a result, the errored packets were not delivered to a higher-layer protocol. |
+| Network Interface(\*)\Packets Received Errors | From all network adapters: The number of inbound packets that contained errors. As a result, the errored packets weren't delivered to a higher-layer protocol. |
| Process(ConfigurationAgent.Grpc.Host)\% Processor Time | For Agent: The percentage of elapsed time that all of process threads used the processor to execution instructions. |
| Process(ConfigurationAgent.Grpc.Host)\Elapsed Time | For Agent: The duration from when the process was started until the time it terminated. |
| Process(ConfigurationAgent.Grpc.Host)\Handle Count | For Agent: The number of operating system handles the process has opened. |
@@ -131,10 +131,10 @@ performance counters:
## Register Performance Counters
-The Activity Monitor performance counters are not registered by default and must be registered
+The Activity Monitor performance counters aren't registered by default and must be registered
manually.
-Follow the steps to register the Activity Monitor performance counters on each SAM Agent server.
+To register the Activity Monitor performance counters on each SAM Agent server:
**Step 1 –** Run `cmd.exe` as Administrator.
@@ -313,10 +313,10 @@ Get-Counter @variables | Export-Counter -FileFormat csv -Path $outputFile -Force
## Unregister Performance Counters
-When performance monitoring is not needed anymore, unregister the Activity Monitor performance
+When performance monitoring isn't needed anymore, unregister the Activity Monitor performance
counters.
-Follow the steps to unregister the Activity Monitor performance counters on each SAM Agent server.
+To unregister the Activity Monitor performance counters on each SAM Agent server:
**Step 1 –** Run `cmd.exe` as Administrator.
@@ -343,4 +343,4 @@ sc stop SBTLoggingSvc
**sc start SBFileMonAgentSvc**
-Once the services have been restarted, the Activity Monitor performance counters are unregistered.
+After the services have been restarted, the Activity Monitor performance counters are unregistered.
diff --git a/docs/activitymonitor/10.0/troubleshooting/tracelogs.md b/docs/activitymonitor/10.0/troubleshooting/tracelogs.md
index 345af51ced..1f7c85e430 100644
--- a/docs/activitymonitor/10.0/troubleshooting/tracelogs.md
+++ b/docs/activitymonitor/10.0/troubleshooting/tracelogs.md
@@ -8,7 +8,7 @@ sidebar_position: 20
While activity agents store activity logs on the servers where they are deployed, the Activity
Monitor creates Trace Logs that aid in troubleshooting issues. The Trace level option set in the
-drop-down list in the lower right corner of the Activity Monitor Console determines the kind of
+dropdown list in the lower right corner of the Activity Monitor Console determines the kind of
information kept in the activity agent and monitored hosts/services logs.
@@ -25,7 +25,7 @@ properties). Select from the following trace log levels:
- Fatal – Records only when catastrophic system failures / crashes occur
When the log level is changed in the Activity Monitor Console, the new log level is propagated and
-applied immediately to all of the activity agents that do not have custom trace setting.
+applied immediately to all of the activity agents that don't have custom trace setting.
:::note
Trace level can be adjusted in the Agent Properties for the selected agent. See the
diff --git a/docs/activitymonitor/7.1/admin/agents/activedirectory.md b/docs/activitymonitor/7.1/admin/agents/activedirectory.md
index e4da27e127..e1f5dd99f6 100644
--- a/docs/activitymonitor/7.1/admin/agents/activedirectory.md
+++ b/docs/activitymonitor/7.1/admin/agents/activedirectory.md
@@ -8,21 +8,18 @@ sidebar_position: 40
Before deploying the Active Directory (AD) agent, ensure all
[AD Agent Server Requirements](/docs/activitymonitor/7.1/requirements/adagent/adagent.md)
-have been met. To effectively monitor Active Directory, it is necessary to deploy an AD agent to
-every domain controller, including the read only domain controllers. However, it is possible to
-deploy the agents in batches. Follow the steps to deploy the AD agents to the domain controllers in
-the target domain.
+have been met. Deploy the AD agent to every domain controller, including read-only domain controllers. You can deploy the agents in batches.
:::note
These steps are specific to deploying AD agents for monitoring Active Directory.
:::
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
-**Step 2 –** Click on the Install agents on Active Directory domain controllers link to deploy
+**Step 2 –** Click the Install agents on Active Directory domain controllers link to deploy
activity agents to multiple domain controllers.
:::note
@@ -33,7 +30,7 @@ The Activity Monitor will validate the entered Host Name or IP Address entered
-**Step 3 –** Specify the port that should be used by the new agent(s).
+**Step 3 –** Specify the port that should be used by the new agents.
@@ -78,24 +75,24 @@ controllers to monitor all activity of the domain.
-**Step 8 –** Click the **Test** button to verify the connection to the domains selected. Once the
+**Step 8 –** Click the **Test** button to verify the connection to the domains selected. After the
connection is verified, click **Next** to continue.
**Step 9 –** On the Windows Agent Settings page, there are two settings to configure.
-- Add Windows file activity monitoring – Select the check box to add Windows file activity
+- Add Windows file activity monitoring – Select the checkbox to add Windows file activity
monitoring after installing the agent. By default a new agent install monitors nothing. If
administrators want to monitor file activity on Windows servers, it is easier to enable it after
installation of the agent. Windows file activity monitoring can be enabled and configured later in
the console.
- Management Group – By default, the agent only accepts commands form members of the
BUILTIN\Administrators group. Less privilege accounts can be configured to manage the agent with
- the Management Group setting. Keep in mind that only administrators can install, update and
+ the Management Group setting. Only administrators can install, update, and
uninstall the agent.
-**Step 10 –** Click **Finish**. The Add New Agent(s) window closes, and the activity agent is
+**Step 10 –** Click **Finish**. The Add New Agents window closes, and the activity agent is
deployed to and installed on the target host.
During the installation process, the status will be Installing. If there are any errors, the
diff --git a/docs/activitymonitor/7.1/admin/agents/linux.md b/docs/activitymonitor/7.1/admin/agents/linux.md
index 3d5eafbb4e..59b8e7603f 100644
--- a/docs/activitymonitor/7.1/admin/agents/linux.md
+++ b/docs/activitymonitor/7.1/admin/agents/linux.md
@@ -13,23 +13,21 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
- Netwrix Threat Manager
-Prior to adding a Windows host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Windows host to the Activity Monitor, the prerequisites for the target environment
must be met. See the
[Linux Agent Server Requirements](/docs/activitymonitor/7.1/requirements/linuxagent.md) topic
for additional information.
## Deploy Linux Agent
-Follow the steps to deploy the agent to the Linux host.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
-
-
+
**Step 2 –** On the Install New Agent page, enter the server name for the Linux host. Click
**Next**.
@@ -41,7 +39,7 @@ is **4498**. Click **Next**.
-**Step 4 –** On the Credentials To Connect To The Server(s) page, connect to the Linux Server using
+**Step 4 –** On the Credentials To Connect To The Servers page, connect to the Linux Server using
either a **User name** and **Password**, or a Public Key.
The options for connecting with a Password are:
@@ -102,7 +100,7 @@ the failed connection.
**Step 6 –** On the Linux Agent Options page, select which user name to use to run the daemon. To
use root, leave the **Service user name** field blank. Click **Test** to test the connection.
-**Step 7 –** Click **Finish**. The Add New Agent(s) window closes, and the activity agent is
+**Step 7 –** Click **Finish**. The Add New Agents window closes, and the activity agent is
deployed to and installed on the target host.
During the installation process, the status will be **Installing**. If there are any errors,
@@ -115,7 +113,7 @@ Host is also configured, and the added Linux host is displayed in the monitored
[Monitored Hosts Tab](/docs/activitymonitor/7.1/admin/monitoredhosts/overview.md)
topic for additional information.
-Once a host has been added for monitoring, configure the desired outputs. See the
+Once a host has been added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/agents/multiple.md b/docs/activitymonitor/7.1/admin/agents/multiple.md
index 79c8b03162..3f9b74a7a9 100644
--- a/docs/activitymonitor/7.1/admin/agents/multiple.md
+++ b/docs/activitymonitor/7.1/admin/agents/multiple.md
@@ -7,8 +7,7 @@ sidebar_position: 20
# Multiple Activity Agents Deployment
Before deploying the activity agent, ensure all Prerequisites are met, including those for NAS
-devices when applicable. Follow the steps to deploy the activity agent to a multiple Windows
-servers. See the
+devices when applicable. See the
[Activity Agent Server Requirements](/docs/activitymonitor/7.1/requirements/activityagent/activityagent.md) topic
for additional information.
@@ -18,7 +17,7 @@ environments.
:::
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
@@ -45,7 +44,7 @@ There are two methods for adding multiple hosts are:
## Manual Entry
-Use **Manual Entry** to manually type the host names or IP addresses of the servers to be monitored.
+Use **Manual Entry** to manually enter the host names or IP addresses of the servers to be monitored.
@@ -77,9 +76,9 @@ For Import a List:
The Activity Monitor will monitor the Host Names or IP Address added to the **Install Agents on
Multiple Hosts** table. Click **Next**.
-
+
-**Step 5 –** On the Credentials To Connect To The Server(s) page, connect to the server using either
+**Step 5 –** On the Credentials To Connect To The Servers page, connect to the server using either
a **User name** and **password**, a Public Key, or a Client Certificate.
The options for connecting with a Password are:
@@ -87,7 +86,7 @@ The options for connecting with a Password are:
- User name
- Password
-
+
The options for connecting with a Public Key are:
@@ -108,7 +107,7 @@ Using an existing Client Certificate installs a new agent without using SSH.
**Step 6 –** Click **Connect** to test the connection. If the connection is successful, click
**Next**.
-The credentials are tested against each server added on the **Install Agent(s) on Multiple Hosts**
+The credentials are tested against each server added on the **Install Agents on Multiple Hosts**
page. If the connection is unsuccessful, see the status message that appears for information on the
failed connection. Activity agents are only successfully deployed for servers where the test status
returns Ok. Failed deployments can be retried through the Connection tab of the agent’s Properties
@@ -127,11 +126,13 @@ The default path is `C:\Program Files\Netwrix\Activity Monitor\Agent`. Click **N
monitoring after installation checkbox to enable monitoring all file system activity on the
targeted Windows server after installation.
- Management Group — By default, the agent only accepts commands from members from the
- BUILTIN\Administrators group. Less privileged accounts can be used to manage the agent with the
- Management group setting. Keep in mind that an administrator account must be used to install,
- upgrade, or uninstall an agent.
+ BUILTIN\Administrators group. Use the Management group setting to allow less privileged accounts to manage the agent.
-**Step 9 –** Click Finish. The Add New Agent(s) window closes, and the activity agent is deployed to
+ :::note
+ An administrator account is required to install, upgrade, or uninstall an agent.
+ :::
+
+**Step 9 –** Click Finish. The Add New Agents window closes, and the activity agent is deployed to
and installed on the target host.
During the installation process, the status will be **Installing**. If there are any errors, the
diff --git a/docs/activitymonitor/7.1/admin/agents/overview.md b/docs/activitymonitor/7.1/admin/agents/overview.md
index 1ab5ca5679..1976b1fdb6 100644
--- a/docs/activitymonitor/7.1/admin/agents/overview.md
+++ b/docs/activitymonitor/7.1/admin/agents/overview.md
@@ -12,9 +12,9 @@ available until an agent is installed.
The Agents tab is comprised of a button bar, a table of servers hosting activity agents, and an
-Agent Messages box. The button bar allows users to take the following actions:
+Agent Messages box. Use the button bar to perform the following actions:
-- Add Agent – Opens the Add New Agent(s) window to deploy the activity/AD agent to a single server
+- Add Agent – Opens the Add New Agents window to deploy the activity/AD agent to a single server
or to multiple servers at the same time. The following sections provide additional information:
- [Single Activity Agent Deployment](/docs/activitymonitor/7.1/admin/agents/single.md)
@@ -31,7 +31,7 @@ Agent Messages box. The button bar allows users to take the following actions:
the
[Agent Properties Window](/docs/activitymonitor/7.1/admin/agents/properties/overview.md)
topic for additional information.
-- Start pending modules – Starts AD agent monitoring modules which were not yet started
+- Start pending modules – Starts AD agent monitoring modules which weren't yet started
- Occasionally a Microsoft Security Bulletin impacting LSASS can interfere with the AD agent
instrumentation resulting in LSASS shutting down. The AD agents are configured to monitor for
@@ -50,7 +50,7 @@ Agent Messages box. The button bar allows users to take the following actions:
The table of servers hosting activity agents provides the following information:
- Server Name – Name or IP Address of the server hosting an activity agent
-- Status – Status of the deployed activity agent(s)
+- Status – Status of the deployed activity agents
:::note
If the AD agent has been deployed, a status of “outdated” could apply to either the
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/activedirectory.md b/docs/activitymonitor/7.1/admin/agents/properties/activedirectory.md
index 82755fa8e7..fc90c91383 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/activedirectory.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/activedirectory.md
@@ -12,7 +12,7 @@ be enabled for agents on domain controllers.
-The Agent Settings allow users to control the AD agent’s properties:
+Use the Agent Settings to control the AD agent’s properties:
- Harden the Agent – Protects the AD agent from being altered, stopped, or started from within the
local Service Control Manager
@@ -22,17 +22,17 @@ The Agent Settings allow users to control the AD agent’s properties:
:::note
This is a safety measure that disables monitoring if the environment changes as in
rare cases the instrumentation may cause LSASS crashes. Should the version change occur, a
- warning will be shown next to the agent on the Agents page. The **Start pending modules** button
- allows you to force the agent to enable monitoring.
+ warning will be shown next to the agent on the Agents page. Use the **Start pending modules** button
+ to force the agent to enable monitoring.
:::
- Enable DNS Host Name Resolution – If selected, the AD agent looks up the missing data (a NetBIOS
- name, a Fully Qualified Domain Name, or an IP Address) that is missing fromthe event
+ name, a Fully Qualified Domain Name, or an IP Address) from the event
:::note
This provides more uniform data, but may have a performance impact on the machine
- where the AD agent is deployed, especially if that machine does not handle the name resolution
+ where the AD agent is deployed, especially if that machine doesn't handle the name resolution
locally.
:::
@@ -64,16 +64,16 @@ Monitoring through Threat Prevention.
:::
-If Threat Prevention data is not used by other Netwrix products, uninstall the activity agent from
-the domain controllers if you do not plan to receive Active Directory activity in Activity Monitor
-anymore and the agents are not used for file system monitoring. If Threat Prevention data is to be
+If Threat Prevention data isn't used by other Netwrix products, uninstall the activity agent from
+the domain controllers if you don't plan to receive Active Directory activity in Activity Monitor
+anymore and the agents aren't used for file system monitoring. If Threat Prevention data is to be
used by other Netwrix products, see the
[Configuring StealthINTERCEPT to Send Active Directory Activity to the Activity Monitor](#configuring-stealthintercept-to-send-active-directory-activity-to-the-activity-monitor)
topic for additional information.
## Configuring StealthINTERCEPT to Send Active Directory Activity to the Activity Monitor
-Once the activity agent is deployed to a domain controller with an existing Threat Prevention agent,
+When the activity agent is deployed to a domain controller with an existing Threat Prevention agent,
a connection can be secured between both agents. Follow these instructions to configure the policy
used for Active Directory Activity Monitoring from the Threat Prevention Admin Console.
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/additionalproperties.md b/docs/activitymonitor/7.1/admin/agents/properties/additionalproperties.md
index 55778590fb..e45a398cbf 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/additionalproperties.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/additionalproperties.md
@@ -17,10 +17,10 @@ The Additional Properties tab for the Activity Agent has the following configura
- Comment – Create an annotation for the agent in the **Comment** text box. Annotations entered here
will appear in the Comment column in the table on the Agents tab.
-- Agent's Trace Level – Select a trace level for the agent log from the drop-down list:
+- Agent's Trace Level – Select a trace level for the agent log from the dropdown list:
- Same Level as the Console (uses the global level selected in the console)
- - Trace (the most verbose) many collection points and can slow down
+ - Trace (the most verbose) with many collection points and can slow down
:::warning
Selecting the **Trace** option can slow down collection due to the large amount
@@ -34,7 +34,7 @@ The Additional Properties tab for the Activity Agent has the following configura
- Error
- Fatal
-In certain situations, the trace logs are not enough to identify issues. Collect extended debugging
+In certain situations, the trace logs aren't enough to identify issues. Collect extended debugging
data (ETW) can be useful for problems related to the following:
- Not getting events
@@ -44,16 +44,15 @@ data (ETW) can be useful for problems related to the following:
- Issues caused by Antivirus or Backup software
When this is needed, enable the **Collect extended debugging data (ETW) from the Windows driver when
-the Trace level is activated** option to diagnose these problems.
+you activate the Trace level** option to diagnose these problems.
:::warning
-Selecting this option collects a large amount of data. Therefore, it is important to
-enable it only for short periods of time. Otherwise, the trace file may overflow with data.
+Selecting this option collects a large amount of data. Enable it only for short periods of time, or the trace file may overflow with data.
:::
-In general for troubleshooting, start with trace logs. If the root cause of the problem might be a
-low-level functionality the driver, then the ETW logs must be enabled.
+In general, for troubleshooting, start with trace logs. If the root cause of the problem might be
+low-level functionality of the driver, then enable the ETW logs.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The Agent
Properties window closes.
@@ -66,10 +65,10 @@ The Additional Properties tab for the Linux Agent has the following configuratio
- Comment – Create an annotation for the agent in the **Comment** text box. Annotations entered here
will appear in the Comment column in the table on the Agents tab.
-- Agent's Trace Level – Select a trace level for the agent log from the drop-down list:
+- Agent's Trace Level – Select a trace level for the agent log from the dropdown list:
- Same Level as the Console (uses the global level selected in the console)
- - Trace (the most verbose) many collection points and can slow down
+ - Trace (the most verbose) with many collection points and can slow down
:::warning
Selecting the **Trace** option can slow down collection due to the large amount
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/adusers.md b/docs/activitymonitor/7.1/admin/agents/properties/adusers.md
index 989172618f..5b574ee124 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/adusers.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/adusers.md
@@ -19,12 +19,12 @@ The configurable options are:
milliseconds. If a query fails to complete in the specified interval then the product reports an
empty username or a previous result from the cache. The product continues to wait for a response
in the background so that further events can use the resolution result.
-- Cache TTL for successful results –Specify the caching interval (time-to-live) for successful AD
- responses.The default is 10 hours. When an AD query returns a valid username or SID, the response
- is cached for the specified time. It is recommended to use large TTL values as the user
- information does not often change.
+- Cache TTL for successful results – Specify the caching interval (time-to-live) for successful AD
+ responses. The default is 10 hours. When an AD query returns a valid username or SID, the response
+ is cached for the specified time. Use large TTL values, as the user
+ information doesn't often change.
- Cache TTL for failed results – Specify the caching interval (time-to-live) for failed AD
- responses. The default is 1 minute. When an AD query cannot resolve a SID or username, the failed
+ responses. The default is 1 minute. When an AD query can't resolve a SID or username, the failed
result is cached for the specified time. Caching of failed responses helps to reduce the load on
domain controllers and improve performance of event processing. Short TTL values are recommended
to make the product report accurate user information.
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/apiserver.md b/docs/activitymonitor/7.1/admin/agents/properties/apiserver.md
index 937e1b7985..8f2bfdd1b9 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/apiserver.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/apiserver.md
@@ -13,7 +13,7 @@ activity.
-Check the Enable API access on this agent box to utilize the options on this tab:
+Check the Enable API access on this agent box to use the options on this tab:
- API server port (TCP): [number] (from 1000 to 65535) – Enter the API server port. The default
is 4494.
@@ -34,13 +34,12 @@ Click Add Application to open the Add or edit API client window.
- Application name – Name of application to provide read-only access to
- Permissions – list of permissions for Activity Monitor through API Server
- - Access activity data – Provides a read-only access to the activity log files of the agent
- hosting the API Server. The access is provided to the files stored on the agent's server or on
- the archival network share. The permission also provides minimal and read-only access to
+ - Access activity data – Provides read-only access to the activity log files stored on the agent
+ hosting the API Server, the agent's server, or the archival network share. This permission also provides minimal, read-only access to
configuration of monitored hosts/domain, enough to match the monitored hosts to their log
files.
- Read – Provides a read-only access to the list of the agents and their configuration settings;
- configuration of monitored domains; configuration of monitored hosts. The permission does not
+ configuration of monitored domains; configuration of monitored hosts. The permission doesn't
provide access to the saved passwords or other secrets.
- Policy change - Provides permissions required to update the AD Monitoring domain configuration
settings
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/archiving.md b/docs/activitymonitor/7.1/admin/agents/properties/archiving.md
index c43e2d9452..234f197b1e 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/archiving.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/archiving.md
@@ -13,7 +13,7 @@ agent and move the archived files to another location on the server or to a netw
The Days to keep Log files option, listed under the Log Files tab within Host Properties, applies to
-Archive log files. When the entered number of days entered have passed, the activity logs and
+Archive log files. When the specified number of days have passed, the activity logs and
Archive log files are deleted. The path to the Archive log files is next to the Configure button,
and listed under the Archive Location column within the Agents tab.
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/connection.md b/docs/activitymonitor/7.1/admin/agents/properties/connection.md
index c5b6b69a93..fe8772dbc0 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/connection.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/connection.md
@@ -6,12 +6,12 @@ sidebar_position: 60
# Connection Tab
-The Connection tab allows users to modify the agent host server name and the credentials used for
+Use the Connection tab to modify the agent host server name and the credentials used for
installation and communication. The tab varies based on the type of agent selected.
## For Activity Agent
-The server name can be modified in the text box. Modifying the name value does not move the activity
+The server name can be modified in the text box. Modifying the name value doesn't move the activity
agent to a new server. The credentials can be updated or modified as well.
:::tip
@@ -23,7 +23,7 @@ Remember, **Test** the credentials before clicking OK to ensure a successful con
Agent server fields:
-- Server name – Name or IP address of the server where the agent is deploy
+- Server name – Name or IP address of the server where the agent is deployed
- Port – Port the agent uses for communication with the application
Credential fields:
@@ -37,24 +37,22 @@ This account must be:
- Membership in the local Administrators group
-If the user name is not specified, the currently logged in user's account will be used.
+If the user name isn't specified, the logged in user's account will be used.
**Less Privileged Permissions Option**
By default, the agent accepts commands only from members of the local Administrators group. You can
allow less privileged accounts to manage the agent with the **Management Group** option. Keep in
mind that you still need to be an administrator to install, upgrade, or uninstall the agent. The
-Management Group applies to the users of the console and API servers. The Management Group does not
+Management Group applies to the users of the console and API servers. The Management Group doesn't
restrict access to the agents, but grants access to its members in addition to existing members of
the local Administrators group.
-The Specify account or group window is opened from a field where a Windows account is needed.
+Select the Specify account or group window from a field where a Windows account is needed.
-Follow the steps to use this window.
-
-**Step 1 –** Select the Domain from the drop-down menu.
+**Step 1 –** Select the Domain from the dropdown menu.
**Step 2 –** Enter the Account in the textbox.
@@ -62,7 +60,7 @@ Follow the steps to use this window.
- Use the ellipsis (…) button to open the Select Users, Computers, Service Accounts, or Groups
window to browse for an account.
-**Step 3 –** Then click Resolve. A message displays indicating whether or not the account could be
+**Step 3 –** Then click Resolve. A message displays indicating whether the account could be
resolved.
**Step 4 –** If successful, click OK.
@@ -75,7 +73,7 @@ Properties window closes.
## For Linux Agent
-The server name can be modified in the text box. Modifying the name value does not move the Linux
+The server name can be modified in the text box. Modifying the name value doesn't move the Linux
agent to a new server. The credentials can be updated or modified as well.
:::tip
@@ -87,7 +85,7 @@ Remember, **Test** the credentials before clicking OK to ensure a successful con
Agent server fields:
-- Server name – Name or IP address of the server where the agent is deploy
+- Server name – Name or IP address of the server where the agent is deployed
- Port – Port the agent uses for communication with the application
Credential fields:
@@ -101,10 +99,10 @@ This account must be:
- Root privileges with password (or SSH private key)
-The **Trace level** option configures the level for the agent log it includes the following levels:
+The **Trace level** option configures the level for the agent log. It includes the following levels:
- Same Level as the Console (uses the global level selected in the console)
-- Trace (the most verbose) many collection points and can slow down
+- Trace (the most verbose) with many collection points and can slow down
:::warning
Selecting the **Trace** option can slow down collection due to the large amount of
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/dellceeoptions.md b/docs/activitymonitor/7.1/admin/agents/properties/dellceeoptions.md
index 58aac2f218..96bcaa3a49 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/dellceeoptions.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/dellceeoptions.md
@@ -7,7 +7,7 @@ sidebar_position: 70
# Dell CEE Options Tab
The Dell CEE Options tab provides options to configure Dell Common Event Enabler (CEE) settings for
-monitoring Dell devices. File activity monitoring leverages the Dell CEE to deliver activity events
+monitoring Dell devices. File activity monitoring uses the Dell CEE to deliver activity events
from Dell devices.
CEE supports two protocols to deliver events to Activity Monitor: RPC and HTTP. An agent can receive
@@ -29,11 +29,10 @@ The options are:
server
- Choose the CEE event delivery mode:
- - Synchronous real-time delivery – Events are delivered immediately as they occur, one by one.
- - Asynchronous bulk delivery (VCAPS) - Events are delivered in batches with a cadence based on a
- time period or a number of events. As this mode provides better throughput, it is recommended
- for heavily loaded servers. If selected, specify how often events are delivered by Dell CEE
- using the following options:
+ - Synchronous real-time delivery – The system delivers events immediately as they occur, one by one.
+ - Asynchronous bulk delivery (VCAPS) - The system delivers events in batches with a cadence based on a
+ time period or a number of events. This mode provides better throughput and is recommended
+ for heavily loaded servers. If selected, use the following options to specify how often Dell CEE delivers events:
- Every [number] seconds (from 60 to 600) - Default is 60 seconds
- Or every [number] events (from 10 to 10000) - Default is 100 events
@@ -63,7 +62,7 @@ Properties window closes.
## Windows CEE Manual Configuration
Windows CEE is configured with the windows registry and depends on the selected event delivery mode,
-AUDIT or VCAPS.
+AUDIT, or VCAPS.
For the synchronous real-time delivery mode (AUDIT), use the following steps.
@@ -72,7 +71,7 @@ For the synchronous real-time delivery mode (AUDIT), use the following steps.
**Step 2 –** Set the `Enabled` parameter to 1.
-**Step 3 –** If the `EndPoint` parameter is empty, set it to the string listed below. If it is not
+**Step 3 –** If the `EndPoint` parameter is empty, set it to the string listed below. If it isn't
empty (i.e. some other 3rd party application is also receiving activity events from CEE), append the
following string to the existing `EndPoint` value, separating them with a semicolon.
@@ -89,7 +88,7 @@ For the asynchronous bulk delivery mode with a cadence based on a time period or
**Step 2 –** Set the `Enabled` parameter to 1.
-**Step 3 –** If the `EndPoint` parameter is empty, set it to the string listed below. If it is not
+**Step 3 –** If the `EndPoint` parameter is empty, set it to the string listed below. If it isn't
empty (i.e. some other 3rd party application is also receiving activity events from CEE), append the
following string to the existing `EndPoint` value, separating them with a semicolon.
@@ -183,7 +182,7 @@ Here's an example for the asynchronous delivery (VCAPS):
```
-Make sure to set `Enabled` to `1` only in `Audit` or `VCAPS` if Activity Monitor is the only product
+ensure to set `Enabled` to `1` only in `Audit` or `VCAPS` if Activity Monitor is the only product
receiving activity from CEE. Otherwise, enable the modes according to all product requirements.
If you want to send activity to several 3rd party applications, separate them with semicolons.
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/diskquota.md b/docs/activitymonitor/7.1/admin/agents/properties/diskquota.md
index 194700776f..4496481d5d 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/diskquota.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/diskquota.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# Disk Quota Tab
-The **Disk Quota Tab** is used to limit the size of logs to save disk space.
+Use the **Disk Quota Tab** to limit the size of logs and save disk space.
@@ -14,8 +14,8 @@ The configurable options are:
- Enable disk quota monitoring for this agent – Check the box to enable disk quota monitoring for
the agent
-- Maximum disk space the agent is allowed to use on the server it is installed on (at least 100MB) –
- Set the maximum disk space that is allowed to be used on the server to store log files. The
+- Maximum disk space the agent can use on the server where it is installed (at least 100MB) –
+ Set the maximum disk space for the server to use when storing log files. The
default value is **5 GB**.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The Agent
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/dns.md b/docs/activitymonitor/7.1/admin/agents/properties/dns.md
index 099f8f33c7..b45501e6d9 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/dns.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/dns.md
@@ -15,7 +15,7 @@ The configurable options are:
- Enable local DNS cache service – Select this checkbox to enable the local DNS cache service. Leave
the option unchecked to disable the local DNS cache service. The DNS cache service proactively
updates data, keeping DNS records up to date and available for real-time event reporting. Use this
- option if your DNS infrastructure cannot handle the load (requests take hundreds of milliseconds)
+ option if your DNS infrastructure can't handle the load (requests take hundreds of milliseconds)
during peak hours.
- DNS servers (IPs) – IP addresses of the DNS servers to be used for look-ups. IP addresses should
be entered as separate addresses with space, comma (,), semicolon (;), or a multi-line list. Leave
@@ -31,15 +31,15 @@ The configurable options are:
the load on DNS servers but may result in stale data being reported.
If the DNS Cache service is used, the records are automatically updated when the TTL expires.
- Cache TTL for failed results – Specify the caching interval (time-to-live) for failed DNS
- responses. The default is 1 minute. When a DNS query cannot resolve an IP address or host-name,
+ responses. The default is 1 minute. When a DNS query can't resolve an IP address or host-name,
the failed result is cached for the specified time. Caching of failed responses helps to reduce
the load on DNS servers and improve performance of event processing.
If the DNS Cache service is used, the records are automatically updated when the TTL expires.
- Maximum cache size – Specify the maximum cache size. The default is 100000.
- Refresh throttle time – Specify the time interval between DNS queries that the DNS Cache service
uses to update expired records. The default is 1000 milliseconds.
- If the DNS Cache service is used, the records are automatically updated when the TTL expires. This
- option allows you to limit the number of DNS requests the service sends to update the cache. A
+ If the DNS Cache service is used, the records are automatically updated when the TTL expires. Use
+ this option to limit the number of DNS requests the service sends to update the cache. A
throttling period of 100 milliseconds will limit the update task to 10 requests per second.
- Parallelism – Specify how many DNS requests the DNS Cache service is allowed to send in parallel.
High values may overload DNS servers.
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/inactivityalerts.md b/docs/activitymonitor/7.1/admin/agents/properties/inactivityalerts.md
index f6549bbc4b..b5ffdf86c7 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/inactivityalerts.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/inactivityalerts.md
@@ -35,10 +35,10 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:PORT format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:PORT format
in the text box. The server name can be short name, fully qualified name (FQDN), or IP Address, as
long as the organization’s environment can resolve the name format used.
-- Syslog protocol – Identify the **Syslog protocol** to be used for the alert. The drop-down menu
+- Syslog protocol – Identify the **Syslog protocol** to be used for the alert. The dropdown menu
includes:
- UDP
@@ -46,7 +46,7 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
- TLS
:::note
- The TCP and TLS protocols add the **Message framing** drop-down menu. **Message
+ The TCP and TLS protocols add the **Message framing** dropdown menu. **Message
framing** options include:
:::
@@ -61,7 +61,7 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
connection. A connection status message displays with either a green check mark or a red X
identifying the success of the sent test message. Messages vary by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -71,7 +71,7 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
-Custom templates can be created. Select the desired template or create a new template by modifying
+Custom templates can be created. Select the template you want or create a new template by modifying
an existing template within the Syslog Message Template window. The new message template is named
Custom.
@@ -84,7 +84,7 @@ configured interval. The alert is sent to the configured recipients on the Email
-- Syslog server in SERVER[:PORT] format – Type the **SMTP server name** with a SERVER:PORT format in
+- Syslog server in SERVER[:PORT] format – Enter the **SMTP server name** with a SERVER:PORT format in
the text box. The server name can be short name, fully qualified name (FQDN), or IP Address, as
long as the organization’s environment can resolve the name format used.
@@ -98,7 +98,7 @@ configured interval. The alert is sent to the configured recipients on the Email
- Message subject – Click the ellipsis (…) to open the Message Template window to customize the
- subject. Macros can be used to insert
+ subject. Use macros to insert variable values.
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/netappfpolicyoptions.md b/docs/activitymonitor/7.1/admin/agents/properties/netappfpolicyoptions.md
index 5c4d687475..293ff2422d 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/netappfpolicyoptions.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/netappfpolicyoptions.md
@@ -15,7 +15,7 @@ The available options are:
- FPolicy server port (TCP): [number] (from 1000 to 65535) – Enter the FPolicy server port. The
default is 9999.
-- FPolicy authentication – Select from the following options in the drop-down list. For TLS server
+- FPolicy authentication – Select from the following options in the dropdown list. For TLS server
authentication, a Server certificate is required. For TLS, mutual authentication, a Server
certificate and Client certificate are required.
@@ -26,10 +26,9 @@ The available options are:
and import a certificate, and Client certificate to open the Trusted client or CA certificate
window to import a certificate
-- IPv4 or IPv6 whitelist – IP Addresses of the Clustered Data ONTAP nodes, which are allowed to
- connect to the FPolicy server, can be whitelisted by entering them in the box. IP Addresses should
- be entered as separate addresses with space, comma, semicolon, or a multi-line list. Leave the box
- blank to accept connections from any hosts.
+- IPv4 or IPv6 whitelist – Enter the IP addresses of the Clustered Data ONTAP nodes that are allowed
+ to connect to the FPolicy server in the box. Enter addresses as separate items separated by space, comma,
+ semicolon, or on separate lines. Leave the box blank to accept connections from any hosts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The Agent
Properties window closes.
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/network.md b/docs/activitymonitor/7.1/admin/agents/properties/network.md
index d7c63d3143..d25dab9a41 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/network.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/network.md
@@ -14,7 +14,7 @@ connect to this server.
If an agent machine has multiple network adapters, network interfaces can be specified in the
Network Tab. Select a network interface option from the **Network Interface** dropdown menu. The
Network Interface is set to Auto Detect by default. **Auto Detect** will use the first network
-adapter or IP address that is found.
+adapter or IP address that it finds.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The Agent
Properties window closes.
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/networkproxy.md b/docs/activitymonitor/7.1/admin/agents/properties/networkproxy.md
index 71f0ed4406..058896f32a 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/networkproxy.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/networkproxy.md
@@ -24,7 +24,7 @@ The configurable options are:
- User name – Specify a user name for the proxy server
- User password – Specify a password for the user name
-- Bypass list – Specify the Bypass list. This is a list of URIs that do not use the proxy server
+- Bypass list – Specify the Bypass list. This is a list of URIs that don't use the proxy server
when accessed. Multiple addresses can be entered separated by space, comma (,), semicolon (;), or
as a multi-line list.
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/nutanix.md b/docs/activitymonitor/7.1/admin/agents/properties/nutanix.md
index 0fecfedb23..1b65748c31 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/nutanix.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/nutanix.md
@@ -14,12 +14,12 @@ The available Agent server settings for Nutanix are:
- Agent server port (TCP) – Enter the TCP port that Nutanix will use to connect to the agent. The
agent will add the port to the firewall exclusions automatically. The default is 4501.
-- IPv4 or IPv6 allowlist – Specify the IP addresses of the Nutanix nodes, which are allowed to
- connect to the agent server port. Multiple addresses can be entered separated by space, comma (,),
- semicolon (;), or as a multi-line list. Leave the box blank to accept connections from any hosts.
+- IPv4 or IPv6 allowlist – Specify the IP addresses of Nutanix nodes that are allowed to
+ connect to the agent server port. Enter multiple addresses separated by space, comma (,),
+ semicolon (;), or on separate lines. Leave the box blank to accept connections from any hosts.
:::note
- This setting is optional and it allows you to improve security by limiting the number
+ This setting is optional. Use it to improve security by limiting the number
of IP addresses allowed to connect.
:::
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/overview.md b/docs/activitymonitor/7.1/admin/agents/properties/overview.md
index 0d13d3e3e5..de7781a67b 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/overview.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/overview.md
@@ -34,6 +34,6 @@ tabs:
- [Qumulo Tab](/docs/activitymonitor/7.1/admin/agents/properties/qumulo.md)
– Activity Agent only
-Select the desired agent and click **Edit** to open the agent’s Properties window.
+Select the agent you want and click **Edit** to open the agent’s Properties window.
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/panzura.md b/docs/activitymonitor/7.1/admin/agents/properties/panzura.md
index 954127895e..68426d1d9f 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/panzura.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/panzura.md
@@ -13,16 +13,16 @@ The Panzura Tab provides features to configure settings for monitoring Panzura d
The available options are:
- Agent server port (TCP) - Enter the agent server port. The default is 4497.
-- Users can protect the port with a username and password. The credentials will be configured in
- Panzura
+- Users can protect the port with a username and password. Configure the credentials in
+ Panzura:
- User name – Enter a custom user name or click **Generate** to create a random username and
password
- Password – Enter a custom password or use the generated password. Click **Copy** to copy the
user name and password to the clipboard.
-- IPv4 or IPv6 allowlist – IP Addresses of the remote hosts, which are allowed to connect to the API
- port, can be whitelisted by entering them in the box. IP Addresses should be entered as separate
+- IPv4 or IPv6 allowlist – Enter the IP addresses of remote hosts that are allowed to connect to the API
+ port in the box. Enter IP addresses as separate
addresses with space, comma (,), semicolon (;), or a multi-line list. Leave the box blank to
accept connections from any hosts.
diff --git a/docs/activitymonitor/7.1/admin/agents/properties/qumulo.md b/docs/activitymonitor/7.1/admin/agents/properties/qumulo.md
index 96f0a08a44..06a417fa83 100644
--- a/docs/activitymonitor/7.1/admin/agents/properties/qumulo.md
+++ b/docs/activitymonitor/7.1/admin/agents/properties/qumulo.md
@@ -15,9 +15,9 @@ The available options are:
- Syslog port (TCP) – Enter the TCP port that Qumulo will use to connect to the agent. The agent
will add the port to the firewall exclusions automatically. The default is 4496. The range of
valid values is from 1000 to 65535.
-- IPv4 or IPv6 allowlist – Specify the IP addresses of the Qumulo nodes, which are allowed to
- connect to the agent server port. Multiple addresses can be entered separated by space, comma (,),
- semicolon (;), or as a multi-line list. Leave the box blank to accept connections from any hosts.
+- IPv4 or IPv6 allowlist – Specify the IP addresses of Qumulo nodes that are allowed to
+ connect to the agent server port. Enter multiple addresses separated by space, comma (,),
+ semicolon (;), or on separate lines. Leave the box blank to accept connections from any hosts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The Agent
Properties window closes.
diff --git a/docs/activitymonitor/7.1/admin/agents/single.md b/docs/activitymonitor/7.1/admin/agents/single.md
index 0bcecb1a14..dd80a988da 100644
--- a/docs/activitymonitor/7.1/admin/agents/single.md
+++ b/docs/activitymonitor/7.1/admin/agents/single.md
@@ -8,8 +8,7 @@ sidebar_position: 10
Before deploying the activity agent, ensure all
[Activity Agent Server Requirements](/docs/activitymonitor/7.1/requirements/activityagent/activityagent.md)
-have been met, including those for NAS devices when applicable. Follow the steps to deploy the
-activity agent to a single Windows server.
+have been met, including those for NAS devices when applicable.
:::note
These steps are specific to deploying activity agents for monitoring supported target
@@ -17,7 +16,7 @@ environments.
:::
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
@@ -29,9 +28,9 @@ a single server. Leave the field blank to deploy the agent on the local server.
**Step 3 –** On the Specify Port page, specify the port that should be used by the new agent. The
default port is 4498. Click **Next**.
-
+
-**Step 4 –** On the Credentials To Connect To The Server(s) page, select ether Windows or Linux file
+**Step 4 –** On the Credentials To Connect To The Servers page, select ether Windows or Linux file
monitoring. Then, enter the **User name** and **Password** to connect to the API Server.
@@ -54,12 +53,11 @@ default path is `C:\Program Files\Netwrix\Activity Monitor\Agent`. Click **Next*
installation. Alternatively, the Windows monitoring can be enabled later on the Monitored Hosts
page.
- Management Group — By default, the agent only accepts commands from members from the
- BUILTIN\Administrators group. Less privileged accounts can be used to manage the agent with the
- Management group setting. Keep in mind that an administrator account must be used to install,
+ BUILTIN\Administrators group. Use the Management group setting to let less privileged accounts manage the agent. Remember that an administrator account must be used to install,
upgrade or uninstall an agent. The value must be a domain or local security group entered in the
DOMAIN\groupname format.
-**Step 8 –** Click Finish. The Add New Agent(s) window closes, and the activity agent is deployed to
+**Step 8 –** Click Finish. The Add New Agents window closes, and the activity agent is deployed to
and installed on the target host.
During the installation process of the agent, the status will display Installing. If there are any
diff --git a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/authentication.md b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/authentication.md
index 4fa5667e1f..dcaa818e5a 100644
--- a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/authentication.md
+++ b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/authentication.md
@@ -6,12 +6,12 @@ sidebar_position: 30
# Authentication Tab
-The Authentication tab on a domain’s Configuration window allows users to configure communication
+Use the Authentication tab on a domain’s Configuration window to configure communication
with servers.
-After checking the Enable Authentication box, the following event filters can be modified on the
+After checking the Enable Authentication box, you can modify the following event filters on the
sub-tabs:
- Forged PAC Analytic
@@ -27,7 +27,7 @@ sub-tabs:
The Forged Privilege Account Certificate (PAC) analytic type identifies Kerberos tickets with a
modified PAC. By manipulating the PAC, a field in the Kerberos ticket that contains a user’s
-authorization data (in Active Directory this is group membership), an attacker is able to grant
+authorization data (in Active Directory this is group membership), an attacker can grant
themselves additional elevated privileges.
@@ -36,7 +36,7 @@ Double-click text box to enter specific **RIDs**. Click OK. The AD agent then co
PAC and user’s access token for a mismatch to trigger the incident.
:::note
-The Forged PAC analytic is monitoring for when the user is not a member of a group that is
+The Forged PAC analytic is monitoring for when the user isn't a member of a group that is
listed in the PAC section of the user’s Kerberos ticket. This analytic can be scoped to monitor
specific groups. To reduce the number of false positives, the AD agent only checks for a mismatch of
sensitive groups as selected in the policy Settings tab.
@@ -45,9 +45,9 @@ sensitive groups as selected in the policy Settings tab.
## Host (From)
-The Hosts (from) option is where the policy can be scoped to only monitor specific hosts as
-originators of an authentication event or to exclude specific hosts from being monitored for
-authentication events.
+Use the Hosts (from) option to scope the policy to monitor only specific hosts as
+originators of an authentication event or to exclude specific hosts from authentication event
+monitoring.
@@ -63,9 +63,9 @@ from authentication event collection.
## Host (To)
-The Hosts (to) option is where the policy can be scoped to only monitor specific hosts as target
-hosts of an authentication event or to exclude specific hosts from being monitored as targets of
-authentication events.
+Use the Hosts (to) option to scope the policy to monitor only specific hosts as target
+hosts of an authentication event or to exclude specific hosts from authentication event
+monitoring.
@@ -81,9 +81,9 @@ authentication event collection.
## IP Addresses (From)
-The IP Addresses (from) option is where the policy can be scoped to only monitor specific IP
-Addresses as originators of an authentication event or to exclude specific IP Addresses from being
-monitored for authentication events.
+Use the IP Addresses (from) option to scope the policy to monitor only specific IP
+Addresses as originators of an authentication event or to exclude specific IP Addresses from
+authentication event monitoring.
@@ -91,14 +91,14 @@ Underneath each section, there is an additional Address detail:
- Value – Must be provided in IP address format
-Double-click the text box beneath **Value** to enter the desired IP Addresses to include or exclude.
+Double-click the text box beneath **Value** to enter the IP Addresses you want to include or exclude.
Press the Enter or Tab key to add another text box.
## IP Addresses (To)
-The IP Addresses (to) option is where the policy can be scoped to only monitor specific IP Addresses
-as target hosts of an authentication event or to exclude specific IP Addresses from being monitored
-as targets of authentication events.
+Use the IP Addresses (to) option to scope the policy to monitor only specific IP Addresses
+as target hosts of an authentication event or to exclude specific IP Addresses from authentication
+event monitoring.
@@ -106,7 +106,7 @@ Underneath each section, there is an additional Address detail:
Value – Must be provided in IP address format
-Double-click the text box beneath **Value** to enter the desired IP Addresses to include or exclude.
+Double-click the text box beneath **Value** to enter the IP Addresses you want to include or exclude.
Press the Enter or Tab key to add another text box.
## Operations
@@ -122,7 +122,7 @@ failed events, or both:
- Failure – Monitors failed events
The **Monitor These Protocols** section is where authentication protocols to be monitored are
-selected for the policy. Check the box to select the authentication protocol(s) to be monitored:
+selected for the policy. Check the box to select the authentication protocols to be monitored:
- All
- Kerberos
@@ -140,7 +140,7 @@ Local Interactive and/or Remote Interactive logins to the Domain Controllers:
- All - Report all authentication activity approved by the Domain Controller which includes any
local or RDP direct connections to the DC.
- - Local - Report only local login to the Domain Controller - ignore all else
+ - Local - Report only local log in to the Domain Controller - ignore all else
- Remote - Report only remote/RDP access to the Domain Controller - ignore all else
- Exclude failed authentications with previously valid (N-2) password – If enabled, allows to ignore
@@ -157,14 +157,13 @@ The Servers option targets servers to be included or excluded when filtering for
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another text box.
## Users
-The Users filter is where the policy can be scoped to only monitor specific security principals
-committing changes within Active Directory or to exclude specific users committing changes from
-being monitored.
+Use the Users filter to scope the policy to monitor only specific security principals
+committing changes within Active Directory or to exclude specific users committing changes.
@@ -184,7 +183,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath **Type** to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath **Type** to enter the AD object you want to include or
exclude. Press the Enter or Tab key to add another text box. Check the box under **Subtree** to
include or exclude child contexts.
diff --git a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/changes.md b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/changes.md
index d5177fb500..21abb0248d 100644
--- a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/changes.md
+++ b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/changes.md
@@ -11,7 +11,7 @@ changes made to the domain.
-After checking the Enable AD Changes box, the following event filters can be modified on the
+After checking the Enable AD Changes box, you can modify the following event filters on the
sub-tabs:
- Attributes
@@ -26,14 +26,14 @@ sub-tabs:
## Attributes
-The Attributes Tab is where monitoring can be scoped to include events with specific attributes
+Use the Attributes Tab to scope monitoring to include events with specific attributes
within Active Directory. Further scoping of attributes can enable monitoring to only capture events
based on the new value.
-Double-click the text box beneath Name to enter the desired attribute to include or exclude.
-Double-click the text box beneath Value to enter the desired attribute value to reference. Choose
+Double-click the text box beneath Name to enter the attribute you want to include or exclude.
+Double-click the text box beneath Value to enter the attribute value you want to reference. Choose
the Operation to relate the Name and Value with. Press the **Enter** or **Tab** key to add another
textbox.
@@ -43,27 +43,27 @@ Name field must contain Active Directory attribute name.
Scoping the filter captures events when the new value matches with the supplied value. To scope the
-filter based on the new value of the attribute, use the Operation drop-down menu.
+filter based on the new value of the attribute, use the Operation dropdown menu.
- AnyValue – No scoping applied for this attribute
- EmptyValue – Blank attribute values
- Equal – Attribute values that are identical to the Value field
-- NotEqual – Attribute values that do not match the Value field
+- NotEqual – Attribute values that don't match the Value field
- LessThan – Attribute values below the supplied numeric value or before alphabetically
- GreaterThan – Attribute values above the supplied numeric value or after alphabetically
- Contains – Attribute values includes the user supplied string (numbers are treated as strings)
-- NotContain – Attribute values do not include the user supplied string (numbers are treated as
+- NotContain – Attribute values don't include the user supplied string (numbers are treated as
strings)
- Startswith – Attribute values start with the user supplied string
## Classes
-The Classes Tab is where the policy can be scoped to only monitor specific classes within Active
-Directory or to exclude specific classes from being monitored.
+Use the Classes Tab to scope the policy to monitor only specific classes within Active
+Directory or to exclude specific classes from monitoring.
-Double-click the text box beneath Name to enter the desired classes to include or exclude. Press the
+Double-click the text box beneath Name to enter the classes you want to include or exclude. Press the
**Enter** or **Tab** key to add another text box.
:::note
@@ -75,9 +75,8 @@ only last value of this multi-valued attribute. For example, for
## Context
-The Context Tab is where the policy can be scoped to only monitor specific contexts (e.g. Containers
-and Organizational Units) within Active Directory or to exclude specific contexts from being
-monitored.
+Use the Context Tab to scope the policy to monitor only specific contexts (e.g. Containers
+and Organizational Units) within Active Directory or to exclude specific contexts from monitoring.
@@ -88,15 +87,14 @@ Underneath each section, there are additional Context details:
- Distinguished Name – Field must be specified in the form of `distinguishedName` attribute syntax,
e.g. `CN=Users,DC=Domain,DC=com`
-Double-click the text box beneath Distinguished Name to enter the desired context to include or
+Double-click the text box beneath Distinguished Name to enter the context you want to include or
exclude. Press the **Enter** or **Tab** key to add another text box. Check the box under Subtree to
include or exclude child contexts.
## Host (From)
-The Hosts (from) Tab is where the policy can be scoped to only monitor specific hosts as originators
-of an authentication event or to exclude specific hosts from being monitored for authentication
-events.
+Use the Hosts (from) Tab to scope the policy to monitor only specific hosts as originators
+of an authentication event or to exclude specific hosts from authentication event monitoring.
@@ -112,9 +110,9 @@ from change event collection.
## IP Addresses (From)
-The IP Addresses (from) Tab is where the policy can be scoped to only monitor specific IP Addresses
-as originators of an authentication event or to exclude specific IP Addresses from being monitored
-for authentication events.
+Use the IP Addresses (from) Tab to scope the policy to monitor only specific IP Addresses
+as originators of an authentication event or to exclude specific IP Addresses from authentication
+event monitoring.
@@ -122,13 +120,13 @@ Underneath each section, there is an additional Address detail.
- Value – Must be provided in IP address format
-Double-click the text box beneath **Value** to enter the desired IP addresses to include or exclude.
+Double-click the text box beneath **Value** to enter the IP addresses you want to include or exclude.
Press **Enter** or **Tab** key to add another text box.
## Objects
-The Objects Tab is where the policy can be scoped to only monitor specific objects within Active
-Directory or to exclude specific objects from being monitored.
+Use the Objects Tab to scope the policy to monitor only specific objects within Active
+Directory or to exclude specific objects from monitoring.
@@ -137,7 +135,7 @@ Underneath each section, there is an additional Object detail.
- Distinguished Name – Field must be specified in the form of `distinguishedName` attribute syntax,
e.g. `CN=Users,DC=Domain,DC=com`
-Double-click the text box beneath Distinguished Name to enter the desired objects to include or
+Double-click the text box beneath Distinguished Name to enter the objects you want to include or
exclude. Press the **Enter** or **Tab** key to add another text box.
## Operations
@@ -167,14 +165,13 @@ The Servers Tab targets servers to be included or excluded when filtering for ch
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another text box.
## Users
-The Users Tab is where the policy can be scoped to only monitor specific security principals
-committing changes within Active Directory or to exclude specific users committing changes from
-being monitored.
+Use the Users Tab to scope the policy to monitor only specific security principals
+committing changes within Active Directory or to exclude specific users committing changes.
@@ -194,7 +191,7 @@ The following details appear beneath both sections.
e.g. `CN=Users,DC=Domain,DC=com`. However, for objects with `sidType` type, it must be in the form
of WellKnownSidType Enum, e.g. `AnonymousSid` or `LocalSid`.
-Double-click the text box beneath **Distinguished Name** to enter the desired group types to include
-or exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath **Distinguished Name** to enter the group types you want to include
+or exclude. Double-click the text box beneath Type to enter the AD object you want to include or
exclude. Press the **Enter** or **Tab** key to add another text box. Check the box under Subtree to
include or exclude child contexts.
diff --git a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md
index 42ded58f9b..e98b6f041f 100644
--- a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md
+++ b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md
@@ -13,13 +13,13 @@ from being monitored.
The filter options are grouped by AD Global Pre-Filters, and Authentication Global Pre-Filters.
Check the boxes to activate the filters. To disable for diagnostic purposes, simply uncheck the
-option(s) and click OK. All Authentication Global Pre-Filters options require configuration before
+options and click OK. All Authentication Global Pre-Filters options require configuration before
they can be enabled.
Enable all of the AD Global Pre-Filters options as well as the Exclude Logins from Machine Accounts
option in the Authentication Global Pre-Filters section.
-When activated, the AD Agent(s) filters out the event data according to configuration defined in the
+When activated, the AD Agents filters out the event data according to configuration defined in the
`filters.json` file located in the installation directory.
The configurable options in the Global Filters tab are:
@@ -34,8 +34,8 @@ The ‘Help’ icon (**?**) opens a window that explains the type of “noise”
## Exclude ‘Noise’ Events Option
-This option is enabled by default to filter out login and internal low level attributes which can be
-considered ‘noise’ events. This option can be scoped to include any combination to the following
+This option is enabled by default to filter out login and internal low level attributes that are
+considered ‘noise’ events. You can scope this option to include any combination of the following
‘noise’ events:
- Successful AD User Logins – Excludes events with the following attributes where ‘objectClass’ does
@@ -47,7 +47,7 @@ considered ‘noise’ events. This option can be scoped to include any combinat
- lastLogonTimestamp
- AD User Logins with Bad Password – Excludes events with the following set of attributes where
- ‘objectClass’ does not equal computer:
+ ‘objectClass’ doesn't equal computer:
- badPwdCount
- badPasswordTime
@@ -87,8 +87,8 @@ The Exclude Logins from Machine Accounts collection is only accessible for confi
Global Filters tab.
:::note
-Only perpetrators with accounts ending in “$” are considered for this filter. Wild cards
-(\*) can be used for partial matches to account names.
+Only perpetrators with accounts ending in “$” are considered for this filter. Use wild cards
+(\*) to perform partial matches to account names.
:::
@@ -105,7 +105,7 @@ accounts include
“$” in their names so by default authentication traffic generated by these accounts is filtered out because they ‘look’ like machine accounts, which prior to Server 2012 were the only account names ending in “$”.
The ability to add a list of filter strings to the “Exclude Logins from Machine Accounts” global
filter provides a means to capture activity by gMSA type accounts as this activity is typically of
-interest where as true ‘machine accounts’ is not. By supplying either an explicit list of gMSA
+interest where as true ‘machine accounts’ isn't. By supplying either an explicit list of gMSA
account names, or if a naming convention has been adopted, a set of wild card strings such as
“gMSA\*” or “svc\*”, allows capturing authentication activity from such accounts while ignoring the
noisy ‘machine accounts’.
@@ -119,7 +119,7 @@ selected hosts link to open the Edit Hosts window.
The Exclude Authentication Events from selected hosts collection is only accessible for
configuration through the Global Filters tab. All three methods of identification for a host (IP
-Address, NETBIOS host name, or DNS host name) must be known in order to effectively exclude
+Address, NETBIOS host name, or DNS host name) must be known to effectively exclude
authentication from the host. Identify the host to be excluded in the textbox of the IP Address
column and press the Enter or Tab to add another row on the grid. Activity Monitor attempts to
discover the NETBIOS host name and the DNS host name associated with the supplied IP Address.
diff --git a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md
index 61f99bb9bc..1edbd07003 100644
--- a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md
+++ b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md
@@ -6,12 +6,12 @@ sidebar_position: 60
# LDAP Monitor Tab
-The LDAP Monitor tab on a domain’s Configuration window allows users to scope monitoring by adding
+Use the LDAP Monitor tab on a domain’s Configuration window to scope monitoring by adding
filters for accounts by name or type.
-After checking the Enable Ldap Monitor box, the following event filters can be modified on the
+After checking the Enable Ldap Monitor box, you can modify the following event filters on the
sub-tabs:
- Host (From)
@@ -51,7 +51,7 @@ The Query section is where monitoring can be scoped to those LDAP queries that c
of the user-supplied string as a substring in BaseDN or in Query field of the LDAP Search request.
For the Query value, provide the user-supplied string in the text box.
-Double-click the text box beneath Value to enter the desired string. Press the Enter or Tab key to
+Double-click the text box beneath Value to enter the string you want. Press the Enter or Tab key to
add another text box.
Example Values:
@@ -63,7 +63,7 @@ The Result section is where monitoring can be scoped to those LDAP query results
least one of the user-supplied string as a substring. For the Result value, provide the
user-supplied string in the text box.
-Double-click the text box beneath Value to enter the desired string. Press the Enter or Tab key to
+Double-click the text box beneath Value to enter the string you want. Press the Enter or Tab key to
add another text box.
Example Value:
@@ -91,7 +91,7 @@ The Servers option targets servers to be included or excluded when filtering for
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another text box.
## Users
@@ -118,7 +118,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath Type to enter the AD object you want to include or
exclude. Press the Enter or Tab key to add another text box. Check the box under Subtree to include
or exclude child contexts.
diff --git a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md
index b3bc9a3c6e..6f0d3247c5 100644
--- a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md
+++ b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md
@@ -6,17 +6,14 @@ sidebar_position: 10
# Configure LDAP Monitoring for Netwrix Threat Manager
-Follow the steps to configure LDAP monitoring within Netwrix Activity Monitor for Netwrix Threat
-Manager.
-
:::note
-LDAP Monitoring is not enabled, it must be enabled in the Monitored Domains tab.
+LDAP Monitoring isn't enabled, it must be enabled in the Monitored Domains tab.
:::
-**Step 1 –** In the Activity Monitor, click on the **Monitored Domains** tab.
+**Step 1 –** In the Activity Monitor, click the **Monitored Domains** tab.
**Step 2 –** Select a domain and click **Edit**.
diff --git a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md
index 522ad3c109..ef2de21b8f 100644
--- a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md
+++ b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md
@@ -6,12 +6,12 @@ sidebar_position: 50
# LSASS Guardian Tab
-The LSASS Guardian tab allows users to modify settings that were populated with the information
+Use the LSASS Guardian tab to modify settings that were populated with the information
entered when the host was added to prevent, monitor, or block LSASS code injections.
-After checking the Enable LSASS Guardian box, the following event filters can be modified on the
+After checking the Enable LSASS Guardian box, you can modify the following event filters on the
sub-tabs:
- Operations
@@ -37,7 +37,7 @@ The Operations option filters for successful events, failed events, or both.
The Open Process Flags section is where monitoring can be scoped for requested handles that would
maliciously impact LSASS processes.
-Check the box to select the process flag(s) to be monitored:
+Check the box to select the process flags to be monitored:
- PROCESS_VM_WRITE – Writes to memory in a process
- PROCESS_CREATE_THREAD – Creates a thread
@@ -49,13 +49,13 @@ malware applications, can be included/excluded from being monitored by the polic
-Double-click the text box beneath Name to enter the desired processes to include or exclude. Press
+Double-click the text box beneath Name to enter the processes you want to include or exclude. Press
the Enter or Tab key to add another text box.
:::note
-While a processes inclusion is a filter option, it is not recommended for monitoring
+While a processes inclusion is a filter option, it isn't recommended for monitoring
LSASS. Adding a process inclusion filter will limit the scope to only monitor that process. Unknown
-malicious processes would not be monitored in this case.
+malicious processes wouldn't be monitored in this case.
:::
@@ -68,7 +68,7 @@ The Servers option targets servers to be included or excluded when filtering for
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the textbox beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the textbox beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another textbox.
## Users
@@ -95,7 +95,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath Type to enter the AD object you want to include or
exclude. Press the Enter or Tab key to add another text box. Check the box under Subtree to include
or exclude child contexts.
diff --git a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/overview.md b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/overview.md
index 72cf78402f..5328766332 100644
--- a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/overview.md
+++ b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/overview.md
@@ -11,8 +11,8 @@ Configuration window.
-This initially configured when the AD Agent is deployed to a domain controller. However, the
-monitoring configuration can be edited after that. Use the following tabs to modify monitoring of AD
+This is initially configured when the AD Agent is deployed to a domain controller. However, you can
+edit the monitoring configuration after that. Use the following tabs to modify monitoring of AD
events:
- [Global Filters Tab](/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md)
diff --git a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/replication.md b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/replication.md
index e52caa0cd2..4a8490525e 100644
--- a/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/replication.md
+++ b/docs/activitymonitor/7.1/admin/monitoreddomains/admonitoringconfiguration/replication.md
@@ -11,7 +11,7 @@ replication.
-After checking the Enable Replication box, the following event filters can be modified on the
+After checking the Enable Replication box, you can modify the following event filters on the
sub-tabs:
- Host (From)
@@ -21,15 +21,15 @@ sub-tabs:
Each filter tab acts like an “AND” statement for the filter. Any filter tab left blank is treated
like an ALL for that filter set.
-Windows cannot detect if a sync request is coming from a legitimate domain controller. This option
-is designed to monitor requests from computers that are not ‘excluded’ by the policy. Therefore,
+Windows can't detect if a sync request is coming from a legitimate domain controller. This option
+is designed to monitor requests from computers that aren't ‘excluded’ by the policy. Therefore,
legitimate domain controllers should be identified in the event filters.
## Host (From) Filter
-The Hosts (From) option is where the policy can be scoped to only monitor specific hosts as
-originators of an authentication event or to exclude specific hosts from being monitored for
-authentication events.
+Use the Hosts (From) option to scope the policy to monitor only specific hosts as
+originators of an authentication event or to exclude specific hosts from authentication event
+monitoring.
@@ -56,14 +56,13 @@ The Servers option targets servers to be included or excluded when filtering for
In both cases, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS Domain
name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another text box.
## Users Filter
-The Users option is where the policy can be scoped to only monitor specific security principals
-committing changes within Active Directory or to exclude specific users committing changes from
-being monitored
+Use the Users option to scope the policy to monitor only specific security principals
+committing changes within Active Directory or to exclude specific users committing changes
@@ -83,7 +82,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath Type to enter the AD object you want to include or
exclude. Press the Enter or Tab key to add another textbox. Check the box under Subtree to include
or exclude child contexts.
diff --git a/docs/activitymonitor/7.1/admin/monitoreddomains/output/activedirectoryjson.md b/docs/activitymonitor/7.1/admin/monitoreddomains/output/activedirectoryjson.md
index c5a046c00b..110bc30cb3 100644
--- a/docs/activitymonitor/7.1/admin/monitoreddomains/output/activedirectoryjson.md
+++ b/docs/activitymonitor/7.1/admin/monitoreddomains/output/activedirectoryjson.md
@@ -49,11 +49,11 @@ into a JSON log file:
| QueryFilter | LDAP filter used in the operation |
| QueryIsSSL | Indicates if LDAP connection is secure or not |
| QueryObjectsReturned | Number of returned objects produced by the LDAP request |
-| Source | Indicates source of the operation. Currently can be: ‘Authentication’, ‘Active Directory’, ‘LSASS Guardian – Monitor’, ‘LDAP Monitor’, ‘AD Replication Monitoring’. |
+| Source | Indicates source of the operation. can be: ‘Authentication’, ‘Active Directory’, ‘LSASS Guardian – Monitor’, ‘LDAP Monitor’, ‘AD Replication Monitoring’. |
| Success | Indicates if original operation completed successfully or not |
| TargetHost | Contains host name to which authentication attempt took place. In case of failed Kerberos AS, this field contains name of the domain controller. |
| TargetHostIP | If resolved, contains IP address of the target host |
-| TargetProcess | Contains process name that is monitored. Currently this is only lsass.exe. |
+| TargetProcess | Contains process name that is monitored. this is only lsass.exe. |
| TgsReplyEncryptionType | Indicates encryption type used in reply part of the TGS Kerberos ticket. Possible values the same as for EncryptionType. |
| TimeLogged | UTC timestamp of the event |
| UserDN | If resolved, contains DN of the object triggered operation |
diff --git a/docs/activitymonitor/7.1/admin/monitoreddomains/output/output.md b/docs/activitymonitor/7.1/admin/monitoreddomains/output/output.md
index 61d881cf72..1f16811ebc 100644
--- a/docs/activitymonitor/7.1/admin/monitoreddomains/output/output.md
+++ b/docs/activitymonitor/7.1/admin/monitoreddomains/output/output.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Output for Monitored Domains
-Once a domain is being monitored the event stream can be sent to multiple outputs.
+When you're monitoring a domain, you can send the event stream to multiple outputs.
@@ -27,15 +27,13 @@ domain. The domain event outputs are:
## Add File Output
-Follow the steps to add a File output.
+**Step 1 –** On the Monitored Domains tab, select the domain you want to configure and click **Add Output**.
-**Step 1 –** On the Monitored Domains tab, select the desired domain and click **Add Output**.
-
-**Step 2 –** Select **File** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **File** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
@@ -46,15 +44,13 @@ for additional information.
## Add Syslog Output
-Follow the steps to add a Syslog output.
-
-**Step 1 –** On the Monitored Domains tab, select the desired domain and click **Add Output**.
+**Step 1 –** On the Monitored Domains tab, select the domain you want to configure and click **Add Output**.
-**Step 2 –** Select **Syslog** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **Syslog** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
@@ -66,23 +62,21 @@ for additional information.
## Add Netwrix Threat Manager Output
:::note
-An App Token created by Netwrix Threat Manager is used to authenticate connection between
+Netwrix Threat Manager creates an App Token that authenticates the connection between
the applications. See the App Tokens Page topic of the
[Netwrix Threat Manager Documentation](https://helpcenter.netwrix.com/category/stealthdefend) for
additional information.
:::
-Follow the steps to add a Netwrix Threat Manager output.
-
-**Step 1 –** On the Monitored Domains tab, select the desired domain and click **Add Output**.
+**Step 1 –** On the Monitored Domains tab, select the domain you want to configure and click **Add Output**.
-**Step 2 –** Select **Netwrix Threat Manager (StealthDEFEND)** from the drop-down menu. The Add New
+**Step 2 –** Select **Netwrix Threat Manager (StealthDEFEND)** from the dropdown menu. The Add New
Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
diff --git a/docs/activitymonitor/7.1/admin/monitoreddomains/overview.md b/docs/activitymonitor/7.1/admin/monitoreddomains/overview.md
index 22e3218b95..1e103cc52e 100644
--- a/docs/activitymonitor/7.1/admin/monitoreddomains/overview.md
+++ b/docs/activitymonitor/7.1/admin/monitoreddomains/overview.md
@@ -17,12 +17,12 @@ The Activity Monitor can be configured to monitor the following Active Directory
- Success and Failure on Logon
- LDAP Activity Monitoring
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
- Netwrix Threat Manager
-It also provides the ability to feed activity data to SIEM products.
+It also lets you feed activity data to SIEM products.
**Agents**
@@ -31,8 +31,8 @@ within the domain to be monitored.
**Tab**
-Once the AD Agent(s) installation is complete on a domain controller, the domain appear on the
-Monitored Domains tab. The tab is not visible within the console until at least one AD Agent has
+After the AD Agents installation is complete on a domain controller, the domain appear on the
+Monitored Domains tab. The tab isn't visible within the console until at least one AD Agent has
been deployed.
This tab is comprised of a button bar and a table of domains being monitored. The events stream
@@ -40,7 +40,7 @@ output needs to be designated to view data after an activity search has been per
## Button Bar
-The button bar allows users to take the following actions:
+Use the button bar to take the following actions:
@@ -81,4 +81,4 @@ view more information on various status conditions.
Click the **Down Arrow** to expand the Error Propagation section. The information listed is
-dependent on which domain is currently selected in the Monitored Domains table.
+dependent on which domain is selected in the Monitored Domains table.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellcelerravnx.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellcelerravnx.md
index ff7962e1fc..af33da9231 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellcelerravnx.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellcelerravnx.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -23,13 +23,13 @@ specifically created for Activity Monitor event data:
[File Activity Monitor App for Splunk](/docs/activitymonitor/7.1/siem/splunk/overview.md)
for additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Dell Celerra or VNX host to the Activity Monitor, the prerequisites for the target
+Before adding a Dell Celerra or VNX host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[Dell Celerra & Dell VNX Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/celerra-vnx-aac/activity.md)
topic for additional information.
@@ -42,7 +42,6 @@ monitoring the target environment.
## Add Dell VNX/Celerra Host
-Follow the steps to add a Dell Celerra or VNX host to be monitored.
**Step 1 –** Navigate to the Monitored Hosts tab and click Add. The Add New Host window opens.
@@ -58,7 +57,7 @@ Server NetBIOS Name** for the device. If desired, add a **Comment**. Click **Nex
:::note
All Dell event source types must have the CEE Monitor Service installed on the agent in
-order to collect events. Activity Monitor will detect if the CEE Monitor is not installed and
+order to collect events. Activity Monitor will detect if the CEE Monitor isn't installed and
display a warning to install the service. If the CEE Monitor service is installed on a remote
machine, manual configuration is required. See the
[Dell CEE Options Tab](/docs/activitymonitor/7.1/admin/agents/properties/dellceeoptions.md)
@@ -69,7 +68,7 @@ topic for additional information.
**Step 4 –** On the Protocols page, select which protocols to monitor. The list of protocols that
-can be monitored are All, CIFS, or NIFS. Click **Next**.
+can be monitored are All, CIFS, or NFS. Click **Next**.
@@ -89,7 +88,7 @@ Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the options you want:
- Report account names – Adds an **Account Name** column in the generated TSV files
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -108,7 +107,7 @@ are the activity logs created by the activity agent on the proxy host. Select th
through the UNC Path. If a file is accessed locally, these columns are empty. These columns
have also been added as Syslog macros.
- When this option is selected, the user needs to provide credentials in the Auditing tab. If
- credentials are not provided, the following warning message is displayed:
+ credentials aren't provided, the following warning message is displayed:
- Credentials are required for this feature. Provide the credentials in the Auditing tab.
- Report operations with millisecond precision – Changes the timestamps of events being recorded in
the TSV log file for better ordering of events if multiple events occur within the same second
@@ -152,19 +151,19 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the text box.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -182,7 +181,7 @@ Output page can be configured.
template for Threat Manager. See the
[Netwrix Threat Manager Documentation](https://helpcenter.netwrix.com/category/stealthdefend)
for additional information.
- - Custom templates can be created. Select the desired template or create a new template by
+ - Custom templates can be created. Select the template you want or create a new template by
modifying an existing template within the Syslog Message Template window. The new message
template will be named Custom.
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -201,13 +200,13 @@ Output page can be configured.
through the UNC Path. If a file is accessed locally, these columns are empty. These columns
have also been added as Syslog macros.
- When this option is selected, the user needs to provide credentials in the Auditing tab. If
- credentials are not provided, the following warning message is displayed:
+ credentials aren't provided, the following warning message is displayed:
- Credentials are required for this feature. Provide the credentials in the Auditing tab.
- The Test button – Sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -220,7 +219,7 @@ Click **Finish**.
The added Dell Celerra or VNX host is displayed in the Monitored Hosts table. Once a host has been
-added for monitoring, configure the desired ouptuts. See the
+added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellpowerscale.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellpowerscale.md
index f0450ae172..366a65c67b 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellpowerscale.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellpowerscale.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -23,13 +23,13 @@ specifically created for Activity Monitor event data:
[File Activity Monitor App for Splunk](/docs/activitymonitor/7.1/siem/splunk/overview.md)
for additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Dell Isilon/PowerScale host to the Activity Monitor, the prerequisites for the
+Before adding a Dell Isilon/PowerScale host to the Activity Monitor, the prerequisites for the
target environment must be met. See the
[Dell Isilon/PowerScale Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/isilon-activity.md)
topic for additional information.
@@ -42,8 +42,6 @@ monitoring the target environment.
## Add Dell Isilon/PowerScale Host
-Follow the steps to add a Dell Isilon/PowerScale host to be monitored.
-
**Step 1 –** Navigate to the Monitored Hosts tab and click Add. The Add New Host window opens.
@@ -60,7 +58,7 @@ left blank to collect activity from the Isilon cluster. If desired, add a **Comm
:::note
All Dell event source types must have the CEE Monitor Service installed on the agent in
-order to collect events. Activity Monitor will detect if the CEE Monitor is not installed and
+order to collect events. Activity Monitor will detect if the CEE Monitor isn't installed and
display a warning to install the service. If the CEE Monitor service is installed on a remote
machine, manual configuration is required. See the
[Dell CEE Options Tab](/docs/activitymonitor/7.1/admin/agents/properties/dellceeoptions.md)
@@ -70,11 +68,11 @@ topic for additional information.
-**Step 4 –** On the Isilon Options page, choose whether or not to automatically enable and configure
-auditing on the Isilon cluster. If a manual configuration has been completed, do not enable these
+**Step 4 –** On the Isilon Options page, choose whether to automatically enable and configure
+auditing on the Isilon cluster. If a manual configuration has been completed, don't enable these
options.
-Follow these steps to use this automated option:
+To use this automated option:
- Check the **Enable Protocol Access Auditing in OneFS if it is disabled** box.
- Enter the User name and User password to connect to the OneFS Platform API.
@@ -92,8 +90,8 @@ Follow these steps to use this automated option:
All activity for the host is collected and placed in a single activity log file per day.
- If access zones are selected, only those access zones are monitored and the activity is placed
in a single activity log file per day.
- - Use the arrow buttons to move the desired access zones to the **Monitored** box.
- - (_Optional_) Activity log files can be generated for each access zone. In order to generate
+ - Use the arrow buttons to move the selected access zones to the **Monitored** box.
+ - (_Optional_) Activity log files can be generated for each access zone. to generate
one activity log file for each access zone, add only one access zone to this configuration of
the monitored host. Then, add the host again for each access zone to be monitored. When adding
an Isilon host for each access zone, the Dell device name will be the same for each
@@ -102,7 +100,7 @@ Follow these steps to use this automated option:
:::note
Although the Isilon Options page allows multiple access zones to be placed in the
Monitored box for a single Isilon host, when generating separate activity log files for each
- access zones, Enterprise Auditor does not support this configuration. Enterprise Auditor
+ access zones, Enterprise Auditor doesn't support this configuration. Enterprise Auditor
integration requires all access zones to be monitored from a single configuration.
:::
@@ -132,7 +130,7 @@ Click **Next**.
**Step 7 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the options to enable:
- Report account names – Adds an **Account Name** column in the generated TSV files
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -151,7 +149,7 @@ are the activity logs created by the activity agent on the proxy host. Select th
through the UNC Path. If a file is accessed locally, these columns are empty. These columns
have also been added as Syslog macros.
- When this option is selected, the user needs to provide credentials in the Auditing tab. If
- credentials are not provided, the following warning message is displayed:
+ credentials aren't provided, the following warning message is displayed:
- Credentials are required for this feature. Provide the credentials in the Auditing tab.
- Report operations with millisecond precision – Changes the timestamps of events being recorded in
the TSV log file for better ordering of events if multiple events occur within the same second
@@ -195,19 +193,19 @@ Click **Next**.
**Step 10 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the text box.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -225,7 +223,7 @@ Output page can be configured.
template for Threat Manager. See the
[Netwrix Threat Manager Documentation](https://helpcenter.netwrix.com/category/stealthdefend)
for additional information.
- - Custom templates can be created. Select the desired template or create a new template by
+ - Custom templates can be created. Select the template you want to use or create a new template by
modifying an existing template within the Syslog Message Template window. The new message
template will be named Custom.
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -244,13 +242,13 @@ Output page can be configured.
through the UNC Path. If a file is accessed locally, these columns are empty. These columns
have also been added as Syslog macros.
- When this option is selected, the user needs to provide credentials in the Auditing tab. If
- credentials are not provided, the following warning message is displayed:
+ credentials aren't provided, the following warning message is displayed:
- Credentials are required for this feature. Provide the credentials in the Auditing tab.
- The Test button – Sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -263,7 +261,7 @@ Click **Finish**.
The added Dell Isilon/PowerScale host is displayed in the monitored hosts table. Once a host has
-been added for monitoring, configure the desired ouptuts. See the
+been added for monitoring, configure the outputs you want to use. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellpowerstore.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellpowerstore.md
index cee1cb7b87..cda1085b71 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellpowerstore.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellpowerstore.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -23,12 +23,12 @@ specifically created for Activity Monitor event data:
[File Activity Monitor App for Splunk](/docs/activitymonitor/7.1/siem/splunk/overview.md)
for additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Dell PowerStore host to the Activity Monitor, the prerequisites for the target
+Before adding a Dell PowerStore host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[Dell PowerStore Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/powerstore-activity.md)
topic for additional information.
@@ -41,8 +41,6 @@ monitoring the target environment.
## Add Dell PowerStore Host
-Follow the steps to add a Dell PowerStore host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click **Add**. The Add New Host
window opens.
@@ -58,7 +56,7 @@ name. Click **Next**.
:::note
All Dell event source types must have the CEE Monitor Service installed on the agent in
-order to collect events. Activity Monitor will detect if the CEE Monitor is not installed and
+order to collect events. Activity Monitor will detect if the CEE Monitor isn't installed and
display a warning to install the service. If the CEE Monitor service is installed on a remote
machine, manual configuration is required. See the
[Dell CEE Options Tab](/docs/activitymonitor/7.1/admin/agents/properties/dellceeoptions.md)
@@ -145,7 +143,7 @@ be configured.
- Add header to Log files – Adds headers to TSV files. This is used to feed data into Splunk.
:::note
- Enterprise Auditor does not support log files with the header.
+ Enterprise Auditor doesn't support log files with the header.
:::
@@ -156,18 +154,18 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the Where To Log The Activity page, the Syslog Output
page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the **Message framing** drop-down menu. See the
+ The TCP and TLS protocols add the **Message framing** dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -175,7 +173,7 @@ page can be configured.
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -188,7 +186,7 @@ Click **Finish**.
The added Dell PowerStore host is displayed in the monitored hosts table. Once a host has been added
-for monitoring, configure the desired ouptuts. See the
+for monitoring, configure the outputs. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellunity.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellunity.md
index f80e3693c2..74e82c4559 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellunity.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/dellunity.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -23,13 +23,13 @@ specifically created for Activity Monitor event data:
[File Activity Monitor App for Splunk](/docs/activitymonitor/7.1/siem/splunk/overview.md)
for additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Dell Unity host to the Activity Monitor, the prerequisites for the target
+Before adding a Dell Unity host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[Dell Unity Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/unity-activity.md)
topic for additional information.
@@ -42,8 +42,6 @@ monitoring the target environment.
## Add Dell VNX/Celerra Host
-Follow the steps to add a Dell Unity host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -58,7 +56,7 @@ Name** for the device. If desired, add a **Comment**. Click **Next**.
:::note
All Dell event source types must have the CEE Monitor Service installed on the agent in
-order to collect events. Activity Monitor will detect if the CEE Monitor is not installed and
+order to collect events. Activity Monitor will detect if the CEE Monitor isn't installed and
display a warning to install the service. If the CEE Monitor service is installed on a remote
machine, manual configuration is required. See the
[Dell CEE Options Tab](/docs/activitymonitor/7.1/admin/agents/properties/dellceeoptions.md)
@@ -89,7 +87,7 @@ Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the options you want to enable:
- Report account names – Adds an **Account Name** column in the generated TSV files
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -108,7 +106,7 @@ are the activity logs created by the activity agent on the proxy host. Select th
through the UNC Path. If a file is accessed locally, these columns are empty. These columns
have also been added as Syslog macros.
- When this option is selected, the user needs to provide credentials in the Auditing tab. If
- credentials are not provided, the following warning message is displayed:
+ credentials aren't provided, the following warning message is displayed:
- Credentials are required for this feature. Provide the credentials in the Auditing tab.
- Report operations with millisecond precision – Changes the timestamps of events being recorded in
the TSV log file for better ordering of events if multiple events occur within the same second
@@ -152,19 +150,19 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the text box.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -182,7 +180,7 @@ Output page can be configured.
template for Threat Manager. See the
[Netwrix Threat Manager Documentation](https://helpcenter.netwrix.com/category/stealthdefend)
for additional information.
- - Custom templates can be created. Select the desired template or create a new template by
+ - Custom templates can be created. Select the template you want or create a new template by
modifying an existing template within the Syslog Message Template window. The new message
template will be named Custom.
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -201,13 +199,13 @@ Output page can be configured.
through the UNC Path. If a file is accessed locally, these columns are empty. These columns
have also been added as Syslog macros.
- When this option is selected, the user needs to provide credentials in the Auditing tab. If
- credentials are not provided, the following warning message is displayed:
+ credentials aren't provided, the following warning message is displayed:
- Credentials are required for this feature. Provide the credentials in the Auditing tab.
- The Test button – Sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -220,7 +218,7 @@ Click **Finish**.
The added Dell Unity host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the
+monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/entraid.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/entraid.md
index d6ca476054..e315f02e58 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/entraid.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/entraid.md
@@ -34,13 +34,13 @@ AD) changes:
| Invited Users | MIM Service | MyApps | PIM |
| Self-Service Group Management | Self-service Password Management | Terms of Use | |
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding aMicrosoft Entra ID host to the Activity Monitor, the prerequisites for the target
+Before adding a Microsoft Entra ID host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[Microsoft Entra ID Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/entraid-activity.md)
topic for additional information.
@@ -53,8 +53,6 @@ monitoring the target environment.
## Add Azure Active Directory / Entra ID Host
-Follow the steps to add a Microsoft Entra ID host to be monitored.
-
**Step 1 –** In the Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -119,19 +117,19 @@ Click **Next**.
**Step 8 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -139,7 +137,7 @@ Output page can be configured. The configurable options are:
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -152,7 +150,7 @@ Click **Finish**.
The added Microsoft Entra ID host is displayed in the monitored hosts table. Once a host has been
-added for monitoring, configure the desired ouptuts. See the
+added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/exchangeonline.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/exchangeonline.md
index 56dcb19756..077cb1e318 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/exchangeonline.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/exchangeonline.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Exchange Online
-Prior to adding an Exchange Online host to the Activity Monitor, the prerequisites for the target
+Before adding an Exchange Online host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[Exchange Online Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/exchange-activity.md)
topic for additional information.
@@ -19,8 +19,6 @@ monitoring the target environment.
## Add Exchange Online Host
-Follow the steps to add an Exchange Online host to be monitored.
-
**Step 1 –** In the Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -38,7 +36,7 @@ _(Optional)_ Enter a comment for the Exchange Online host.
**Step 4 –** On the Azure AD / Entra ID Connection page, enter Tenant ID, Client ID, Client Secret,
-and Region(optional) then click **Connect** to verify the connection.. Click **Open Instruction...**
+and Region(optional) then click **Connect** to verify the connection. Click **Open Instruction...**
for steps on registering the Activity Monitor with Microsoft Azure. Click **Next**.
@@ -100,19 +98,19 @@ Click **Next**.
**Step 10 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -120,7 +118,7 @@ Output page can be configured. The configurable options are:
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -132,8 +130,8 @@ Click **Finish**.
-The added Exchange Online host is displayed in the monitored hosts table. Once a host has been added
-for monitoring, configure the desired outputs. See the
+The added Exchange Online host is displayed in the monitored hosts table. After you add a host
+for monitoring, configure the outputs you want to use. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/hitachi.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/hitachi.md
index 0d9699bc84..3f5aecdbfe 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/hitachi.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/hitachi.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -23,13 +23,13 @@ specifically created for Activity Monitor event data:
[File Activity Monitor App for Splunk](/docs/activitymonitor/7.1/siem/splunk/overview.md)
for additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Hitachi host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Hitachi host to the Activity Monitor, the prerequisites for the target environment
must be met. See the
[Hitachi Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/hitachi-activity.md)
topic for additional information.
@@ -42,8 +42,6 @@ monitoring the target environment.
## Add Hitachi NAS Host
-Follow the steps to add a Hitachi host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -71,7 +69,7 @@ Operations** to be monitored. Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the options you want:
- Report UNC paths – Adds a UNC Path column and a Rename UNC Path column in the generated TSV files
- This option corresponds to the REPORT_UNC_PATH parameter in the INI file. It is disabled by
@@ -125,19 +123,19 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -145,7 +143,7 @@ Output page can be configured.
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -158,7 +156,7 @@ Click **Finish**.
The added Hitachi host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the
+monitoring, configure the outputs you want to use. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/nasuni.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/nasuni.md
index b457b3a1ef..7f3a0ee1df 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/nasuni.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/nasuni.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -23,13 +23,13 @@ specifically created for Activity Monitor event data:
[File Activity Monitor App for Splunk](/docs/activitymonitor/7.1/siem/splunk/overview.md)
for additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Nasuni Edge Appliance host to the Activity Monitor, the prerequisites for the
+Before adding a Nasuni Edge Appliance host to the Activity Monitor, the prerequisites for the
target environment must be met. See the
[Nasuni Edge Appliance Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/nasuni-activity.md)
topic for additional information.
@@ -42,7 +42,6 @@ monitoring the target environment.
## Add Nasuni Host
-Follow the steps to add a Nasuni Edge Appliance host to be monitored.
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -63,7 +62,7 @@ Click **Next**.
**Step 4 –** On the Nasuni Options page, enter the **API Key Name** and the **API Key Value**. Click
Connect to validate the connection with the Nasuni device.
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -104,7 +103,7 @@ Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the options you want:
- Report account names – Adds an Account Name column in the generated TSV files
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -119,8 +118,8 @@ are the activity logs created by the activity agent on the proxy host. Select th
- Example CIFS activity – \\ExampleHost\TestShare\DocTeam\Temp.txt
- For NFS activity – [HOST]:/[VOLUME]/[PATH]
- Example NFS activity – ExampleHost:/ExampleVolume/DocTeam/Temp.txt
- - When the option is enabled, the added columns are populated when a file is accessed remotely
- through the UNC Path. These columns have also been added as Syslog macros.
+ - When you enable this option, the new columns populate when a file is accessed remotely
+ through the UNC Path. These columns are also available as Syslog macros.
- Report operations with millisecond precision – Changes the timestamps of events being recorded in
the TSV log file for better ordering of events if multiple events occur within the same second
@@ -163,19 +162,19 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -183,7 +182,7 @@ Output page can be configured.
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -196,7 +195,7 @@ Click **Finish**.
The added Nasuni host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the
+monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/netapp.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/netapp.md
index 8c34666552..3330311f92 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/netapp.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/netapp.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -23,18 +23,18 @@ specifically created for Activity Monitor event data:
[File Activity Monitor App for Splunk](/docs/activitymonitor/7.1/siem/splunk/overview.md)
for additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a NetApp Data ONTAP host to the Activity Monitor, the prerequisites for the target
+Before adding a NetApp Data ONTAP host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[NetApp Data ONTAP Cluster-Mode Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/ontap-cluster-activity.md)
topic or the
[NetApp Data ONTAP 7-Mode Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/ontap7-activity.md)
-topic in the for additional information.
+topic for additional information.
:::tip
Remember, the Activity Agent must be deployed to a Windows server that acts as a proxy for
@@ -44,8 +44,6 @@ monitoring the target environment.
## Add NetApp Host
-Follow the steps to add a NetApp Data ONTAP host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -60,8 +58,7 @@ window opens.
textbox, enter the following information:
- Cluster-Mode devices – Enter the NetApp Filer/SVM
-- 7-Mode devices – Enter the NetApp DNS name. If using vFilers, then it is necessary to use the
- vFiler name here.
+- 7-Mode devices – Enter the NetApp DNS name. If using vFilers, use the vFiler name here.
Click **Next**.
@@ -77,10 +74,10 @@ how it is in NetApp's FPolicy configuration.
- NetApp Filer or SVM – Enter the name of the NetApp Filer or SVM. The name is case sensitive.
- Management LIF – _(Optional)_ If using Cluster Management LIF, a Management LIF can be specified
- if SVM Management LIF is not used (Vserver Tunneling)
+ if SVM Management LIF isn't used (Vserver Tunneling)
- User name – Enter the user name for the credentials to connect to the NetApp server
- User password – Enter the password for the credentials to connect to the NetApp server
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -101,7 +98,7 @@ Click **Next**.
-**Step 5 –** On the NetApp Mode FPolicy Configuration page, choose whether or not to automatically
+**Step 5 –** On the NetApp Mode FPolicy Configuration page, choose whether to automatically
configure FPolicy through Activity Monitor. If that is desired, check the Configure FPolicy option.
Any additional permissions required are listed. Be sure to select the appropriate file protocol to
configure the FPolicy.
@@ -124,7 +121,7 @@ Click **Next**.
:::info
For NetApp Cluster-Mode, create a tailored FPolicy manually. If manually
-configuring the FPolicy, do not select the ConfigureFPolicy checkbox.
+configuring the FPolicy, don't select the ConfigureFPolicy checkbox.
:::
@@ -139,7 +136,7 @@ minimum, the less privileged permissions. For Cluster-mode devices, the credenti
as ‘Employing the “Enable and connect FPolicy” Option’.
:::warning
-On the NetApp FPolicy Enable and Connect page, choose whether or not to Enable and
+On the NetApp FPolicy Enable and Connect page, choose whether to Enable and
connect FPolicy, which will “Ensure everything is active with periodic checks.”
:::
@@ -154,9 +151,7 @@ Additional permissions that are required if enabling **Enable and connect FPolic
**Important Notes**
:::info
-Enable this functionality. Without this option enabled, it is necessary to
-manually connect the FPolicy every time it is disconnected for any reason. For reliable, high
-availability file monitoring, use this option.
+Enable this functionality. Without this option enabled, you must manually reconnect the FPolicy every time it is disconnected for any reason. For reliable, high availability file monitoring, enable this option.
:::
@@ -186,7 +181,7 @@ properties > Operations tab.
If the Configure FPolicy option is enabled, then Activity Monitor updates the FPolicy according to
-these settings. If it was not enabled, then the manually configured FPolicy must be set to monitor
+these settings. If it wasn't enabled, then the manually configured FPolicy must be set to monitor
these operations. Only operations being monitored by the FPolicy are available to the activity
agent.
@@ -210,7 +205,7 @@ Click **Next**.
**Step 8 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the following options:
- Report account names – Adds an Account Name column in the generated TSV files
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -270,19 +265,19 @@ Click **Next**.
**Step 11 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -290,7 +285,7 @@ Output page can be configured.
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -303,24 +298,20 @@ Click **Finish**.
The added NetApp host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the
+monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
:::tip
-Remember, if automatic configuration of the FPolicy was selected, it is necessary to Configure
-Privileged Access.
+If automatic configuration of the FPolicy was selected, you must configure Privileged Access.
:::
## Configure Privileged Access
-If automatic configuration of the FPolicy is used for NetApp Data ONTAP Cluster-Mode devices, it is
-necessary to configure privileged access. Follow the steps to configure privileged access. Remember,
-this requires the provisioned user account to have full permissions, identified as the credentials
-‘Employing the “Configure FPolicy” Option’.
+If automatic configuration of the FPolicy is used for NetApp Data ONTAP Cluster-Mode devices, you must configure privileged access. This requires the provisioned user account to have full permissions, identified as the credentials ‘Employing the “Configure FPolicy” Option’.
-**Step 1 –** On to the Monitored Hosts tab, select the desired host and click Edit. The host’s
+**Step 1 –** On the Monitored Hosts tab, select the host you want to configure and click Edit. The host’s
Properties window opens.
@@ -333,7 +324,7 @@ This option is only available if the Configure FPolicy option is enabled.
:::
-Privileged access must be allowed and configured with appropriate credentials to leverage Enterprise
+Privileged access must be allowed and configured with appropriate credentials to enable Enterprise
Auditor permission (FSAA) scans for this NetApp device
For information on the other options for this tab, see the
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/nutanix.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/nutanix.md
index cdc8017367..07df97d3c2 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/nutanix.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/nutanix.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -23,13 +23,13 @@ specifically created for Activity Monitor event data:
[File Activity Monitor App for Splunk](/docs/activitymonitor/7.1/siem/splunk/overview.md)
for additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Nutanix files host to the Activity Monitor, the prerequisites for the target
+Before adding a Nutanix files host to the Activity Monitor, the prerequisites for the target
environment must be met. See
[Nutanix Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/nutanix-activity.md)
for more information.
@@ -54,15 +54,13 @@ topic for additional information.
## Add Nutanix Host
-Follow the steps to add a Nutanix files host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click **Add**. The Add New Host
window opens.
**Step 2 –** On the Choose Agent page, select the Agent to monitor the file server from the
-drop-down list. Click **Next**.
+dropdown list. Click **Next**.
@@ -79,7 +77,7 @@ access.
:::
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -130,8 +128,7 @@ Output page.
- Specify output file path – Specify the file path where TSV log files are saved on the agent's
server. Click the ellipses button (...) to open the Windows Explorer to navigate to a folder
destination. Click **Test** to test if the path works.
-- Period to keep Log files –Log files will be deleted after the period entered as the number of days
- elapses. The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
+- Period to keep Log files – Log files delete after the number of days you specify. The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
set amount of Minutes, Hours, or Days. This setting applies to both the local files on the agent's
server and to the archived files.
- This log file is for Enterprise Auditor – Enable this option to have Enterprise Auditor collect
@@ -152,7 +149,7 @@ Output page.
- Add header to Log files – Adds headers to TSV files. This is used to feed data into Splunk.
:::note
- Enterprise Auditor does not support log files with the header.
+ Enterprise Auditor doesn't support log files with the header.
:::
@@ -163,18 +160,18 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the Where To Log The Activity page, configure the
Syslog Output page.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the **Message framing** drop-down menu. See the
+ The TCP and TLS protocols add the **Message framing** dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -182,7 +179,7 @@ Syslog Output page.
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -195,7 +192,7 @@ Click **Finish**.
The added Nutanix host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the
+monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/panzura.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/panzura.md
index b7b6c74d6a..2c3fe233a3 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/panzura.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/panzura.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -23,7 +23,7 @@ specifically created for Activity Monitor event data:
[File Activity Monitor App for Splunk](/docs/activitymonitor/7.1/siem/splunk/overview.md)
for additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Threat Prevention
- Netwrix Threat Manager
@@ -36,13 +36,11 @@ monitoring the target environment.
## Add Panzura Host
-Prior to adding a Panzura host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Panzura host to the Activity Monitor, the prerequisites for the target environment
must be met. See the
[Panzura CloudFS Monitoring](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/panzura-activity.md) topic
for additional information.
-Follow the steps to add a Panzura host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -161,19 +159,19 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the **Message framing** drop-down menu. See the
+ The TCP and TLS protocols add the **Message framing** dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -181,7 +179,7 @@ Output page can be configured.
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -194,7 +192,7 @@ Click **Finish**.
The added Panzura host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the
+monitoring, configure the outputs you want to use. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/qumulo.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/qumulo.md
index 53753224c4..3b0e3c5008 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/qumulo.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/qumulo.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -23,13 +23,13 @@ specifically created for Activity Monitor event data:
[File Activity Monitor App for Splunk](/docs/activitymonitor/7.1/siem/splunk/overview.md)
for additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Qumulo host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Qumulo host to the Activity Monitor, the prerequisites for the target environment
must be met. See the
[Qumulo Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/qumulo-activity.md)
topic for additional information.
@@ -42,15 +42,13 @@ monitoring the target environment.
## Add Qumulo Host
-Follow the steps to add a Qumulo host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click **Add**. The Add New Host
window opens.
**Step 2 –** On the Choose Agent page, select the Agent to monitor the file server from the
-drop-down list. Click **Next**.
+dropdown list. Click **Next**.
@@ -61,7 +59,7 @@ name. Click **Next**.
**Step 4 –** On the Qumulo Options page, enter the user name and password.
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -115,7 +113,7 @@ Output page.
- Add header to Log files – Adds headers to TSV files. This is used to feed data into Splunk.
:::note
- Enterprise Auditor does not support log files with the header.
+ Enterprise Auditor doesn't support log files with the header.
:::
@@ -126,18 +124,18 @@ Click **Next**.
**Step 7 –** If Syslog Server is selected on the Where To Log The Activity page, configure the
Syslog Output page.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the **Message framing** drop-down menu. See the
+ The TCP and TLS protocols add the **Message framing** dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -145,7 +143,7 @@ Syslog Output page.
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -158,7 +156,7 @@ Click **Finish**.
The added Qumulo host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the
+monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/sharepoint.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/sharepoint.md
index a0fcebe011..e07fdb4c7b 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/sharepoint.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/sharepoint.md
@@ -23,11 +23,11 @@ The Activity Monitor can be configured to monitor the following SharePoint chang
- Security principal is added to a security group
- Security principal is removed from a security group
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
-Prior to adding a SharePoint host to the Activity Monitor, the prerequisites for the target
+Before adding a SharePoint host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[SharePoint On-Premise Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/sharepoint-onprem-activity.md)
topic for additional information.
@@ -40,8 +40,6 @@ Remember, the Activity Agent must be deployed to the SharePoint Application serv
## Add SharePoint Host
-Follow the steps to add a SharePoint host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -58,7 +56,7 @@ Click **Next**.
**Step 4 –** On the SharePoint Options page, choose to audit all sites or scope the monitoring to
-specific site(s):
+specific sites:
- Enable auditing on selected site collections – Enabling this option will ensure that auditing is
enabled for all monitored site collections with periodic checks
@@ -118,19 +116,19 @@ Click **Next**.
**Step 8 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -138,7 +136,7 @@ Output page can be configured. The configurable options are:
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -151,7 +149,7 @@ Click Finish.
The added SharePoint host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the
+monitoring, configure the output destinations. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/sharepointonline.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/sharepointonline.md
index 06c4813a54..d30e320dca 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/sharepointonline.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/sharepointonline.md
@@ -23,11 +23,11 @@ The Activity Monitor can be configured to monitor the following SharePoint chang
- Security principal is added to a security group
- Security principal is removed from a security group
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
-Prior to adding a SharePoint Online host to the Activity Monitor, the prerequisites for the target
+Before adding a SharePoint Online host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[SharePoint Online Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/sharepoint-online-activity.md)
topic for additional information.
@@ -40,7 +40,6 @@ monitoring the target environment.
## Add SharePoint Online Host
-Follow the steps to add a SharePoint Online host to be monitored.
**Step 1 –** In the Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -50,7 +49,7 @@ window opens.
**Step 2 –** On the Choose Agent page, select the Agent to monitor SharePoint Online.
:::warning
-The domain name must match the SharePoint Online host name in order to properly
+The domain name must match the SharePoint Online host name to properly
integrate SharePoint Online activity monitoring with Enterprise Auditor.
:::
@@ -71,7 +70,7 @@ Instruction...** for steps on registering the Activity Monitor with Microsoft En
- Approve consent for the organization.
:::note
- Activity Monitor does not store credentials. The credentials are used to enable
+ Activity Monitor doesn't store credentials. The credentials are used to enable
API access using the Client ID and Secret.
:::
@@ -138,19 +137,19 @@ Click **Next**.
**Step 8 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -158,7 +157,7 @@ Output page can be configured. The configurable options are:
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -171,7 +170,7 @@ Click **Finish**.
The added SharePoint Online host is displayed in the monitored hosts table. Once a host has been
-added for monitoring, configure the desired ouptuts. See the
+added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/sqlserver.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/sqlserver.md
index 48e38db732..1f24770290 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/sqlserver.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/sqlserver.md
@@ -8,11 +8,11 @@ sidebar_position: 150
**Understanding SQL Server Activity Monitoring**
-The Activity Monitor provides the ability to feed activity data to other Netwrix products:
+The Activity Monitor lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
-Prior to adding a SQL Server host to the Activity Monitor, the prerequisites for the target
+Before adding a SQL Server host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[SQL Server Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/sqlserver-activity.md)
topic for additional information.
@@ -25,8 +25,6 @@ monitoring the target environment.
## Add MS SQL Server Host
-Follow the steps to add a SQL Server host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -126,19 +124,19 @@ Output** page can be configured.
**Step 11 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -146,7 +144,7 @@ Output page can be configured.
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -159,7 +157,7 @@ Click **Finish**.
The added SQL Server host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the
+monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/add/windows.md b/docs/activitymonitor/7.1/admin/monitoredhosts/add/windows.md
index 4a98296f24..e89a22d08c 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/add/windows.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/add/windows.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -23,27 +23,24 @@ specifically created for Activity Monitor event data:
[File Activity Monitor App for Splunk](/docs/activitymonitor/7.1/siem/splunk/overview.md)
for additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Enterprise Auditor
- Netwrix Threat Manager
-Prior to adding a Windows host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Windows host to the Activity Monitor, the prerequisites for the target environment
must be met. See the
[Windows File Server Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/windowsfs-activity.md)
topic for additional information.
:::tip
-Remember, the Activity Agent must be deployed to the server. It cannot be deployed to a proxy
+Remember, the Activity Agent must be deployed to the server. It can't be deployed to a proxy
server.
:::
## Add Agent's Windows Host
-Follow the steps to add a Windows host to be monitored, if it was not configured when the agent was
-deployed.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -96,7 +93,7 @@ in Read events not being monitored.
permission updates occurred resulting in reordered ACEs (Access Control Entries) but with no other
changes in the ACL (Access Control List). For example, if a user is removed in the security
settings of a file, and then the same user is added back with the same security permissions, the
- change is not logged.
+ change isn't logged.
- Suppress Inherited Permission Changes – Filters out events for inherited permission changes. This
option is provided to improve overall performance and reduce output activity log volume.
- Suppress Microsoft Office operations on temporary files – Filters out events for Microsoft Office
@@ -108,7 +105,7 @@ Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the target host. Select the desired options:
+are the activity logs created by the activity agent on the target host. Select the options you want:
- Report Account Names – Adds an Account Name column in the generated TSV files
- Report UNC paths – Adds a UNC Path column and a Rename UNC Path column in the generated TSV files
@@ -159,19 +156,19 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md) topic
for additional information.
@@ -179,7 +176,7 @@ Output page can be configured.
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -192,7 +189,7 @@ Click **Finish**.
The added Windows file server host is displayed in the monitored hosts table. Once a host has been
-added for monitoring, configure the desired ouptuts. See the
+added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/output/filetsv.md b/docs/activitymonitor/7.1/admin/monitoredhosts/output/filetsv.md
index 4820977da8..8805985a0f 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/output/filetsv.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/output/filetsv.md
@@ -6,10 +6,10 @@ sidebar_position: 10
# File TSV Log File
-The following information lists all of the columns generated by File Activity Monitor into a TSV log
+The following information lists all columns that File Activity Monitor generates into a TSV log
file, along with descriptions.
-| Column Name(s) | Description |
+| Column Names | Description |
| ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Operation Time | Date timestamp of the event in UTC time Column format is dependent on "Report Operations with millisecond precision" option |
| Host | Host name of the monitored device |
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/output/linuxtsv.md b/docs/activitymonitor/7.1/admin/monitoredhosts/output/linuxtsv.md
index ec8b706a86..c3ef87d395 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/output/linuxtsv.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/output/linuxtsv.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Linux TSV Log File
-The following information lists all of the columns generated by Linux Activity Monitor into a TSV
+The following information lists all columns that Linux Activity Monitor generates into a TSV
log file, along with descriptions.
| | |
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md b/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md
index b42a1307cf..b139075e31 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/output/output.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Output for Monitored Hosts
-Once a host is being monitored the event stream can be sent to multiple outputs.
+After you start monitoring a host, you can send the event stream to multiple outputs.
@@ -19,15 +19,13 @@ The host event outputs are:
## Add File Output
-Follow the steps to add a File output.
+**Step 1 –** On the Monitored Hosts tab, select the host you want to configure and click **Add Output**.
-**Step 1 –** On the Monitored Hosts tab, select the desired host and click **Add Output**.
-
-**Step 2 –** Select **File** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **File** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
@@ -38,15 +36,13 @@ for additional information.
## Add Syslog Output
-Follow the steps to add a Syslog output.
-
-**Step 1 –** On the Monitored Hosts tab, select the desired host and click **Add Output**.
+**Step 1 –** On the Monitored Hosts tab, select the host you want to configure and click **Add Output**.
-**Step 2 –** Select **Syslog** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **Syslog** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/output/sharepointjson.md b/docs/activitymonitor/7.1/admin/monitoredhosts/output/sharepointjson.md
index ff42adfbda..6dfa24947e 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/output/sharepointjson.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/output/sharepointjson.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# SharePoint JSON Log File
-The JSON log file format is used to send SharePoint activity monitoring data to Enterprise Auditor
+The JSON log file format sends SharePoint activity monitoring data to Enterprise Auditor
v10.0 consoles. The following information lists all of the attributes generated by SharePoint
Activity Monitor into a JSON log file:
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/output/sharepointonlinejson.md b/docs/activitymonitor/7.1/admin/monitoredhosts/output/sharepointonlinejson.md
index d611487c8d..c87391c826 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/output/sharepointonlinejson.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/output/sharepointonlinejson.md
@@ -6,9 +6,8 @@ sidebar_position: 50
# SharePoint Online JSON Log File
-The JSON log file format is used to send SharePoint Online activity monitoring data to Enterprise
-Auditor v10.0 consoles. The following information lists all of the attributes generated by
-SharePoint Online Activity Monitor into a JSON log file:
+The JSON log file format sends SharePoint Online activity monitoring data to Enterprise
+Auditor v10.0 consoles. The following information lists all attributes that SharePoint Online Activity Monitor generates into a JSON log file:
## Base Schema
@@ -93,5 +92,5 @@ Activity Monitor by Sharing.
| -------------------------------- | ------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SharePointMetaData | Metadata about the document that contained the sensitive information | [https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#sharepointmetadata-complex-type](https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#httpsdocsmicrosoftcomen-usofficeoffice-365-management-apioffice-365-management-activity-api-schemasharepointmetadata-complex-type) |
| ExceptionInfo | Reasons why a policy no longer applies and any information about false positive or override | |
-| PolicyDetails | Policy(s) that triggered the event | [https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#policydetails-complex-type](https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#httpsdocsmicrosoftcomen-usofficeoffice-365-management-apioffice-365-management-activity-api-schemapolicydetails-complex-type) |
+| PolicyDetails | Policys that triggered the event | [https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#policydetails-complex-type](https://docs.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-schema#httpsdocsmicrosoftcomen-usofficeoffice-365-management-apioffice-365-management-activity-api-schemapolicydetails-complex-type) |
| SensitiveInfoDetectionIsIncluded | Indicates whether the event contains the value of the sensitive data type | |
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/output/sharepointtsv.md b/docs/activitymonitor/7.1/admin/monitoredhosts/output/sharepointtsv.md
index 61258cad8f..a8a4f49af5 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/output/sharepointtsv.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/output/sharepointtsv.md
@@ -6,9 +6,8 @@ sidebar_position: 40
# SharePoint TSV Log File
-The TSV log file format is used to send SharePoint activity monitoring data to Enterprise Auditor
-v10.0 and earlier consoles. The following information lists all of the columns generated by
-SharePoint Activity Monitor into a TSV log file:
+The TSV log file format sends SharePoint activity monitoring data to Enterprise Auditor
+v10.0 and earlier consoles. The following information lists all columns that SharePoint Activity Monitor generates into a TSV log file:
| Column Name | Description |
| -------------- | -------------------------------------------------------------------------------------------------------------- |
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/output/sqlservertsv.md b/docs/activitymonitor/7.1/admin/monitoredhosts/output/sqlservertsv.md
index 159d4d46a1..a068794984 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/output/sqlservertsv.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/output/sqlservertsv.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# SQL Server JSON Log File
-The following information lists all of the columns generated by SQL Server Activity Monitor into a
+The following information lists all columns that SQL Server Activity Monitor generates into a
JSON log file, along with descriptions.
| Field | Type | Description | Example |
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/overview.md b/docs/activitymonitor/7.1/admin/monitoredhosts/overview.md
index da3f7455b9..a11b9c789b 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/overview.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/overview.md
@@ -47,7 +47,7 @@ For all other hosts, the agent is deployed to a Windows proxy server.
**Tab**
-Once the agent(s) installation is complete, hosts can be added for monitoring. The tab is not
+After agents are installed, hosts can be added for monitoring. The tab isn't
visible within the console until at least one agent has been deployed.
This tab is comprised of a button bar and a table of hosts being monitored. A list of outputs is
@@ -55,13 +55,13 @@ listed under each monitored host. These are destinations to which events are for
## Button Bar
-The button bar allows users to take the following actions:
+Use the button bar to perform the following actions:
- Toggle Collapse – Expands and collapses all Monitored Hosts for viewing or hiding host's outputs
- Add Host – Opens the Add New Host window to configure monitoring of a new host or platform. See
- the section for instructions on adding the desired target environment.
+ the section for instructions on adding the target environment you want to monitor.
- Add Output – Opens the Add New Output windows to create new output for the selected host or hosts.
- Remove – Remove the selected hosts or outputs from the monitored hosts table and end monitoring. A
window prompts for confirmation to remove the selected hosts or outputs.
@@ -71,12 +71,12 @@ The button bar allows users to take the following actions:
## Bulk Actions
-All actions in the button bar except Add Host can be used in the bulk mode. That means youI.e. one
-can select several hosts or outputs and edit, disable, enable, remove them, or add new outputs at
-the same time.
+All actions in the button bar except Add Host can be used in the bulk mode. This means you can
+select several hosts or outputs and edit, disable, enable, remove them, or add new outputs at the
+same time.
-Bulk editing allows the user to selectively modify hosts or outputs. For example, with bulk editing
-it is possible to add a user to Account Exclusions, or set the retention period for log files, or
+Use bulk editing to selectively modify hosts or outputs. For example, with bulk editing
+you can add a user to Account Exclusions, set the retention period for log files, or
disable reporting of Directory Read operations, etc.
To initiate bulk editing, select multiple hosts or outputs (`Ctrl+A` and `Ctrl+Shift+A` may help
@@ -103,12 +103,12 @@ The monitored hosts table provides the following information:
for additional information.
- Received Events – Timestamp of the last event received
- Comment – Comment provided by user:
- - Often this indicates the desired output, e.g. Enterprise Auditor.
+ - Often this indicates the target output, e.g. Enterprise Auditor.
- This can be useful if adding the same monitored host multiple times with different
configurations for different outputs.
- If a Activity Monitor Agent has been deployed to a Windows server where an activity agent is
deployed, then the Comment identifies the host as “Managed by Activity Monitor”, and that
- ‘monitored host’ is not editable. Add the host again for other outputs.
+ ‘monitored host’ isn't editable. Add the host again for other outputs.
Hosts can have more than one output. To view a host's outputs, expand the host by clicking the white
arrow to the left of the Monitored Host name.
@@ -130,7 +130,7 @@ to view more information on various status conditions.
Click the **Down Arrow** to expand the Status section. The information listed is dependent on which
-host or output is currently selected in the Monitored Hosts table. Users can find information on the
+host or output is selected in the Monitored Hosts table. Users can find information on the
**Current State** of a host, as well as viewing a history of changes in state.
The possible statuses depend on the type of hosts being monitored. What is common is that the status
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/auditing.md b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/auditing.md
index 5a9e526c03..1f5631a716 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/auditing.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/auditing.md
@@ -6,14 +6,14 @@ sidebar_position: 10
# Auditing Tab
-The Auditing tab allows users to modify to modify the Isilon Options setting which was populated
+Use the Auditing tab to modify the Isilon Options setting, which was populated
with the information entered when the Dell Isilon host is added to the Monitored Hosts list.
The **Enable Protocol Access Auditing in OneFS if it is disabled** box allows the activity agent to
automatically enable and configure auditing on the Isilon cluster. If a manual configuration has
-been completed, do not enable these options. This option requires credentials for an Administrator
+been completed, don't enable these options. This option requires credentials for an Administrator
account on the Dell Isilon device and click Connect.
If the connection is successful, discovered access zones appear in the **Available** box. By
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/connection.md b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/connection.md
index 3b2c04ae73..ea9deae437 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/connection.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/connection.md
@@ -10,7 +10,7 @@ Once a host is added to the monitored hosts table, the configuration settings ar
tabs in the host’s Properties window. The Connection tab on a host’s Properties window is specific
to Microsoft Entra ID (formerly Azure AD), Exchange Online, and SharePoint Online hosts.
-
+
Configure App Registration information for a Microsoft Entra ID host in the Connection Tab of the
host's Properties window. Click **Open instructions...** for steps on registering the
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/fpolicy.md b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/fpolicy.md
index 148d48f66e..899a2f3a82 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/fpolicy.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/fpolicy.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# FPolicy Tab
-The FPolicy tab allows users to modify FPolicy settings for NetApp devices, privileged access, and
+Use the FPolicy tab to modify FPolicy settings for NetApp devices, privileged access, and
enabling/connecting to cluster nodes.
@@ -40,7 +40,7 @@ The Enable and Connect settings tab is enabled when the Enable and connect FPoli
selected.
:::note
-Adding nodes are not needed if set user is using a role that has Network Interface
+Adding nodes aren't needed if set user is using a role that has Network Interface
permissions.
:::
@@ -49,7 +49,7 @@ permissions.
Add a list of cluster nodes to connect to FPolicy by clicking Add, which opens the Add or Edit
Cluster Node window. Enter at least one cluster node in the textbox. Separate multiple nodes with
-either commas (,), semicolons (;), or spaces. Click OK and the node(s) is displayed in the **Node
+either commas (,), semicolons (;), or spaces. Click OK and the nodes is displayed in the **Node
name** list.
@@ -58,7 +58,7 @@ Click Discover to open the Connect to cluster window and retrieve nodes from the
Specify the Cluster-management LIF and then enter user credentials which will be used to retrieve a
list of the cluster nodes. This credential must have at least read-only rights to run the system
-node show command on the cluster. Click Get Nodes. If a successful connection is not achieved, the
+node show command on the cluster. Click Get Nodes. If a successful connection isn't achieved, the
message indicates the error. If a successful connection is achieved, the message indicates how many
cluster nodes were discovered. Click OK and all discovered nodes are displayed in the **Node name**
list.
@@ -68,14 +68,13 @@ Use the Remove button to remove the selected node from the list.
## Changing the FPolicy Heartbeat Interval
The activity agent periodically checks for and re-enables any StealthAUDIT filter policies which had
-been disabled for any reason, i.e. a network outage. Follow the steps to change the frequency of
-checks.
+been disabled for any reason, i.e. a network outage.
**Step 1 –** Using Regedt32 navigate to:
-**HKEY_LOCAL_MACHINE\SYSTEM\CurrentCotrolSet\Services\FPolicyServerSvc\Parameters**
+**HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FPolicyServerSvc\Parameters**
-**Step 2 –** Right-click on TimeInterval and select Modify.
+**Step 2 –** Right-click TimeInterval and select Modify.
**Step 3 –** Change “Base” to Decimal.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/hitachinas.md b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/hitachinas.md
index 67294b401a..a0032c9f9d 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/hitachinas.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/hitachinas.md
@@ -12,6 +12,6 @@ is specific to Hitachi hosts.
-The Hitachi NAS tab allows users to modify settings that were populated with the information entered
+The Hitachi NAS tab lets you modify settings that were populated with the information entered
when the Hitachi host was added. Additionally, the Path pooling interval can be configured. The Path
pooling interval is set to 15 seconds by default.
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/inactivityalerts.md b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/inactivityalerts.md
index e5f5778cdc..fcefe78474 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/inactivityalerts.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/inactivityalerts.md
@@ -29,7 +29,7 @@ Configure Syslog alerts using the Syslog Alerts Tab.
The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- Syslog protocol – Identify the Syslog protocol to be used for the alerts
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/nasuni.md b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/nasuni.md
index cdcc274098..b0a050fbab 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/nasuni.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/nasuni.md
@@ -11,7 +11,7 @@ using the tabs in the Properties window of the host.
-The **Nasuni** tab allows users to modify settings which were populated with the information entered
+The **Nasuni** tab provides options to modify settings which were populated with the information entered
when the Nasuni host was added.
The configurable options are:
@@ -19,7 +19,7 @@ The configurable options are:
- Nasuni Filer – Enter the name of the filer
- Username – Enter the user name for the Nasuni account
- Password – Enter the password for the user name
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
@@ -27,8 +27,9 @@ The configurable options are:
- Connect – Click to connect using the selected protocol and validate the connection with Nasuni
--
-HTTPS Options – Opens the Trusted server certificate window to customize the certificate
+
+
+- HTTPS Options – Opens the Trusted server certificate window to customize the certificate
verification during a TLS session
- Import – Click to browse for a trusted server certificate
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/netapp.md b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/netapp.md
index e3edef2de9..0239c0ba08 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/netapp.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/netapp.md
@@ -6,7 +6,7 @@ sidebar_position: 100
# NetApp Tab
-The NetApp tab on a host’s Properties window allows users to modify settings, which are populated
+Use the NetApp tab on a host’s Properties window to modify settings, which are populated
with the information entered when the NetApp host is added to the monitored hosts table.
@@ -14,15 +14,16 @@ with the information entered when the NetApp host is added to the monitored host
Modify the targeted NetApp device by specifying a NetApp device to be monitored for activity and
credentials to access it with the Data ONTAP API.
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
- HTTP
- Connect – Click to connect using the selected protocol and validate the connection with NetApp
--
-HTTPS Options – Opens the Trusted server certificate window to customize the certificate
+
+
+- HTTPS Options – Opens the Trusted server certificate window to customize the certificate
verification during a TLS session
- Import – Click to browse for a trusted server certificate
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/nutanix.md b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/nutanix.md
index 57faca8f71..43272dc003 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/nutanix.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/nutanix.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# Nutanix Tab
-The Nutanix tab allows users to modify settings after a Nutanix host has been configured. Once a
+Use the Nutanix tab to modify settings after a Nutanix host has been configured. Once a
Nutanix host is added to the monitored hosts table, the configuration can be edited in the host
Properties.
@@ -17,7 +17,7 @@ The configurable options are:
- Nutanix Filer – Enter the name of the filer
- Username – Enter the user name for the Nutanix account with REST API access
- Password – Enter the password for the user name
-- Protocol – Select a protocol for the REST API access from the drop-down menu:
+- Protocol – Select a protocol for the REST API access from the dropdown menu:
- Auto Detect
- HTTPS
@@ -25,8 +25,9 @@ The configurable options are:
- Connect – Click to connect using the selected protocol and validate the connection with Nutanix
--
-HTTPS Options – Opens the Trusted server certificate window to customize the certificate
+
+
+- HTTPS Options – Opens the Trusted server certificate window to customize the certificate
verification during a TLS session
- Import – Click to browse for a trusted server certificate
@@ -36,7 +37,7 @@ verification during a TLS session
- Click **OK** to close the window and save the modifications.
:::note
-Nutanix Files does not report events for activity originating from a server where the
+Nutanix Files doesn't report events for activity originating from a server where the
Activity Monitor Agent is installed.
:::
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/overview.md b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/overview.md
index 9bf0f9373b..9fcf6f0da0 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/overview.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/overview.md
@@ -11,7 +11,7 @@ through the host’s Properties window.
-On the Monitored Hosts tab, select the host and click Edit, or right-click on a host and select
+On the Monitored Hosts tab, select the host and click Edit, or right-click a host and select
**Edit Host** from the right-click menu, to open the host’s Properties window. The tabs vary based
on the type of host selected:
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/panzura.md b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/panzura.md
index 206195c1c4..68e43c055c 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/panzura.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/panzura.md
@@ -11,7 +11,7 @@ using the tabs in the Properties window of the host.
-The **Panzura** tab allows users to modify settings which were populated with the information
+Use the **Panzura** tab to modify settings which were populated with the information
entered when the Panzura host was added.
The configurable options are:
@@ -19,7 +19,7 @@ The configurable options are:
- Panzura Filer – Enter the name of the filer
- Username – Enter the user name for the Panzura account
- Password – Enter the password for the user name
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
@@ -27,8 +27,9 @@ The configurable options are:
- Connect – Click to connect using the selected protocol and validate the connection with Panzura
--
-HTTPS Options – Opens the Trusted server certificate window to customize the certificate
+
+
+- HTTPS Options – Opens the Trusted server certificate window to customize the certificate
verification during a TLS session
- Import – Click to browse for a trusted server certificate
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/qumulo.md b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/qumulo.md
index 597f810417..117a2f3558 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/qumulo.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/qumulo.md
@@ -6,7 +6,7 @@ sidebar_position: 130
# Qumulo Tab
-The Qumulo tab allows users to modify settings after a Qumulo host has been configured. Once a
+The Qumulo tab lets you modify settings after a Qumulo host has been configured. Once a
Qumulo host is added to the monitored hosts table, the configuration can be edited in the host
Properties.
@@ -17,7 +17,7 @@ The configurable options are:
- Cluster name – Enter the name of the filer
- Username – Enter the user name for the Qumulo user
- Password – Enter the password for the user name
-- Protocol – Select one of the following protocols from the drop-down menu:
+- Protocol – Select one of the following protocols from the dropdown menu:
- Auto Detect
- HTTPS
@@ -25,8 +25,9 @@ The configurable options are:
- Connect – Click to connect using the selected protocol and validate the connection with Qumulo
--
-HTTPS Options – Opens the Trusted server certificate window to customize the certificate
+
+
+- HTTPS Options – Opens the Trusted server certificate window to customize the certificate
verification during a TLS session
- Import – Click to browse for a trusted server certificate
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/sharepoint.md b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/sharepoint.md
index f11b7c4385..4545907a78 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/sharepoint.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/sharepoint.md
@@ -6,7 +6,7 @@ sidebar_position: 140
# SharePoint Tab
-The SharePoint tab on a host’s Properties window allows users to modify settings that are populated
+Use the SharePoint tab on a host’s Properties window to modify settings that are populated
with the information entered when the SharePoint host is added.
@@ -16,13 +16,13 @@ The configurable options are:
- Enable auditing on selected site collections - Check the box to enable auditing on selected site
collections. Enabling this option will ensure that auditing is enabled for all monitored site
collections with periodic checks.
-- Choose to audit all sites or scope the monitoring to specific site(s):
+- Choose to audit all sites or scope the monitoring to specific sites:
- Audit all sites – Leave textbox for URLs blank
- Scope to specific sites – List URLs for sites to be monitored in the textbox. List should be
semicolon separated. For example:
-**http://sharpoint.local/sites/marketing; http://sharepoint.local/sites/personal/user1**
+**http://sharepoint.local/sites/marketing; http://sharepoint.local/sites/personal/user1**
- Audit polling interval – Select the interval for how often the activity agent will request new
events from SharePoint. Number of seconds between polling request, set to 15 seconds by default
diff --git a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/unixids.md b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/unixids.md
index 8ba064241c..1b4986e4f0 100644
--- a/docs/activitymonitor/7.1/admin/monitoredhosts/properties/unixids.md
+++ b/docs/activitymonitor/7.1/admin/monitoredhosts/properties/unixids.md
@@ -24,7 +24,7 @@ The options are:
- This container and its descendants
- This container only
- Search - Search using the following specifications:
- - by an attribute – Specify an LDAP filter. This attribute cannot be empty.
+ - by an attribute – Specify an LDAP filter. This attribute can't be empty.
- with a custom filter – Use the %UID% macro for a Unix ID value
- Provide UID for test/Test – Test button performs a search in the specified container with the
scope and the filter, replacing %UID% with 0 for the test
diff --git a/docs/activitymonitor/7.1/admin/outputs/accountexclusions/accountexclusions.md b/docs/activitymonitor/7.1/admin/outputs/accountexclusions/accountexclusions.md
index 881fe31073..c56ef8148e 100644
--- a/docs/activitymonitor/7.1/admin/outputs/accountexclusions/accountexclusions.md
+++ b/docs/activitymonitor/7.1/admin/outputs/accountexclusions/accountexclusions.md
@@ -6,8 +6,7 @@ sidebar_position: 10
# Account Exclusions Tab
-The Account Exclusions tab on an output Properties window is where monitoring scope by account name
-can be modified. These settings are initially configured when the output is added.
+The Account Exclusions tab on an output Properties window lets you modify the monitoring scope by account name. You initially configure these settings when you add the output.
Select an output from the Monitored Hosts tab and click **Edit** to open the output Properties
window. The tab varies based on the type of host selected.
@@ -25,7 +24,7 @@ The tab contains the following settings:
- Add Unix Account – Opens the Specify Unix Account window to add an account for exclusion. See the
[Specify Unix Account Window](/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifyunixaccount.md)
topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -55,7 +54,7 @@ The tab contains the following settings:
- Add Unix Account – Opens the Specify Unix Account window to add an account for exclusion. See the
[Specify Unix Account Window](/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifyunixaccount.md)
topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -85,7 +84,7 @@ The tab contains the following settings:
- Add Unix Account – Opens the Specify Unix Account window to add an account for exclusion. See the
[Specify Unix Account Window](/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifyunixaccount.md)
topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -115,7 +114,7 @@ The tab contains the following settings:
- Add SharePoint Account – Opens the Specify account window to add an account for exclusion. See the
[Specify Account Window](/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifysharepointaccount.md)
topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -141,7 +140,7 @@ The tab contains the following settings:
- Add Sql User – Opens the Specify Sql User name window to add an account for exclusion. See the
[Specify Sql User Name Window](/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifysqluser.md)
topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -168,7 +167,7 @@ The tab contains the following settings:
See the
[Specify Account or Group Window](/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifywindowsaccount.md)
topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
diff --git a/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifysharepointaccount.md b/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifysharepointaccount.md
index a828383b21..9e27951584 100644
--- a/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifysharepointaccount.md
+++ b/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifysharepointaccount.md
@@ -12,7 +12,7 @@ The Specify account window is opened from a field where a SharePoint account is
There are two options for specifying an account:
-- SharePoint System Accounts – Check the boxes for the desired system accounts: SHAREPOINT\system,
+- SharePoint System Accounts – Check the boxes for the system accounts you want: SHAREPOINT\system,
-1, S-1-0-0 (Null SID)
- Custom – Enter the account in the textbox. Multiple accounts can be added using a semicolon (;).
diff --git a/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifyunixaccount.md b/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifyunixaccount.md
index d90cde8996..9e7423fd29 100644
--- a/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifyunixaccount.md
+++ b/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifyunixaccount.md
@@ -10,6 +10,6 @@ The Specify Unix Account or group window is opened from a field where a Unix acc
-Type the UID for the desired account in the textbox. Multiple UIDs can be added using a semicolon
+Enter the UID for the account you want to add in the textbox. Multiple UIDs can be added using a semicolon
(;), a comma (,), or a space. Then click OK. The Specify Unix Account window closes, and the account
is added to the field where the window was opened.
diff --git a/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifywindowsaccount.md b/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifywindowsaccount.md
index 5732b8d25b..5b32f465ab 100644
--- a/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifywindowsaccount.md
+++ b/docs/activitymonitor/7.1/admin/outputs/accountexclusions/specifywindowsaccount.md
@@ -10,9 +10,7 @@ The Specify account or group window is opened from a field where a Windows accou
-Follow the steps to use this window.
-
-**Step 1 –** Select the Domain from the drop-down menu.
+**Step 1 –** Select the Domain from the dropdown menu.
**Step 2 –** Enter the Account in the textbox.
@@ -20,7 +18,7 @@ Follow the steps to use this window.
- Use the ellipsis (…) button to open the Select Users, Computers, Service Accounts, or Groups
window to browse for an account.
-**Step 3 –** Then click Resolve. A message displays indicating whether or not the account could be
+**Step 3 –** Then click Resolve. A message displays indicating whether the account could be
resolved.
**Step 4 –** If successful, click OK.
diff --git a/docs/activitymonitor/7.1/admin/outputs/additionalproperties.md b/docs/activitymonitor/7.1/admin/outputs/additionalproperties.md
index 2588eda07f..df83728bb4 100644
--- a/docs/activitymonitor/7.1/admin/outputs/additionalproperties.md
+++ b/docs/activitymonitor/7.1/admin/outputs/additionalproperties.md
@@ -24,15 +24,15 @@ The options are:
Often, the Additional Properties Tab is used to indicate the purpose of the output, e.g. for Netwrix
Enterprise Auditor. This can be useful if using multiple outputs with different configurations for
different purposes. For example, a SharePoint site could be added as a host and configured for
-Netwrix Enterprise Auditor data collection. It can be added again with different monitoring options
-and be configured for SIEM notification.
+Netwrix Enterprise Auditor data collection. It can be added again with different monitoring options
+and be configured for SIEM notification.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The output
Properties window closes.
**Integration with Netwrix Threat Prevention for NAS Monitoring**
-If a Threat Prevention Agent has been deployed to the same Windows proxy server where and activity
-agent is deployed to monitor NAS devices, then the **Comment** column in the monitored hosts table
-identifies the host as being “Managed by Threat Prevention”, and that ‘monitored host’ configuration
-is not editable through the Activity Monitor Console. Simply add the host again for other outputs.
+If you deploy a Threat Prevention Agent to the same Windows proxy server where an activity
+agent monitors NAS devices, the **Comment** column in the monitored hosts table
+identifies the host as being "Managed by Threat Prevention", and you can't edit that 'monitored host' configuration
+through the Activity Monitor Console. Simply add the host again for other outputs.
diff --git a/docs/activitymonitor/7.1/admin/outputs/gidexclusions/addeditgid.md b/docs/activitymonitor/7.1/admin/outputs/gidexclusions/addeditgid.md
index 3be8b0be0b..03c995a099 100644
--- a/docs/activitymonitor/7.1/admin/outputs/gidexclusions/addeditgid.md
+++ b/docs/activitymonitor/7.1/admin/outputs/gidexclusions/addeditgid.md
@@ -10,5 +10,5 @@ The Add or Edit GID window is opened from a field where a Linux group is needed.
-Type the GID for the desired group in the textbox. Then click OK. The Add or Edit GID window closes,
+Enter the GID for the group you want to add in the textbox. Then click OK. The Add or Edit GID window closes,
and the group is added to the field where the window was opened.
diff --git a/docs/activitymonitor/7.1/admin/outputs/gidexclusions/gidexclusions.md b/docs/activitymonitor/7.1/admin/outputs/gidexclusions/gidexclusions.md
index a89f9536e7..c07efad03e 100644
--- a/docs/activitymonitor/7.1/admin/outputs/gidexclusions/gidexclusions.md
+++ b/docs/activitymonitor/7.1/admin/outputs/gidexclusions/gidexclusions.md
@@ -19,7 +19,7 @@ The tab contains the following settings:
- Add – Opens the Add or Edit GID window to add a group for exclusion. See the
[Add or Edit GID Window](/docs/activitymonitor/7.1/admin/outputs/gidexclusions/addeditgid.md)
topic for additional information.
-- Remove – Removes the selected group from exclusion. Confirmation is not requested.
+- Remove – Removes the selected group from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by group, use the **Cancel** button to discard the change.
diff --git a/docs/activitymonitor/7.1/admin/outputs/logfiles.md b/docs/activitymonitor/7.1/admin/outputs/logfiles.md
index d928f6c8fe..a3aba3a05b 100644
--- a/docs/activitymonitor/7.1/admin/outputs/logfiles.md
+++ b/docs/activitymonitor/7.1/admin/outputs/logfiles.md
@@ -26,7 +26,7 @@ The tab contains the following settings:
information recorded per event.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
@@ -42,7 +42,7 @@ The tab contains the following settings:
:::note
While the Activity Monitor can have multiple configurations per host, Netwrix
- Enterprise Auditorcan only read one of them.
+ Enterprise Auditor can only read one of them.
:::
@@ -65,7 +65,7 @@ The tab contains the following settings:
is 10 days.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
@@ -82,16 +82,15 @@ The tab contains the following settings:
[Netwrix Enterprise Auditor Documentation](https://helpcenter.netwrix.com/category/accessanalyzer)
for additional information.
- For integration with Netwrix Threat Prevention NAS monitoring, this setting only controls the
- log retention period for NAS devices, as Netwrix Threat Prevention does not read Windows file
+ log retention period for NAS devices, as Netwrix Threat Prevention doesn't read Windows file
server activity from Activity Monitor.
- Report account names – Indicates if an Account Name column is added in the activity log files
-- Add header to Log files – Indicates if headers are added in the activity log filesAdd header to
- Log files – Indicates if headers are added in the activity log files
+- Add header to Log files – Indicates if headers are added in the activity log files
:::note
This is needed to feed data into Splunk in a Syslog output. However, Netwrix
- Enterprise Auditor does not support log files with headers. Therefore, do not select this option
+ Enterprise Auditor doesn't support log files with headers. Therefore, don't select this option
for a File output designed for Netwrix Enterprise Auditor.
:::
@@ -121,7 +120,7 @@ The tab contains the following settings:
:::note
While the Activity Monitor can have multiple configurations per host, Netwrix
- Enterprise Auditorcan only read one of them.
+ Enterprise Auditor can only read one of them.
:::
@@ -140,7 +139,7 @@ The tab contains the following settings:
is 10 days.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
@@ -151,12 +150,11 @@ The tab contains the following settings:
:::
-- Add header to Log files – Indicates if headers are added in the activity log filesAdd header to
- Log files – Indicates if headers are added in the activity log files
+- Add header to Log files – Indicates if headers are added in the activity log files
:::note
This is needed to feed data into Splunk in a Syslog output. However, Netwrix
- Enterprise Auditor does not support log files with headers. Therefore, do not select this option
+ Enterprise Auditor doesn't support log files with headers. Therefore, don't select this option
for a File output designed for Netwrix Enterprise Auditor.
:::
@@ -175,7 +173,7 @@ The tab contains the following settings:
:::note
While the Activity Monitor can have multiple configurations per host, Netwrix
- Enterprise Auditorcan only read one of them.
+ Enterprise Auditor can only read one of them.
:::
@@ -194,7 +192,7 @@ The tab contains the following settings:
is 10 days.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
@@ -210,7 +208,7 @@ The tab contains the following settings:
:::note
While the Activity Monitor can have multiple configurations per host, Netwrix
- Enterprise Auditorcan only read one of them.
+ Enterprise Auditor can only read one of them.
:::
@@ -234,7 +232,7 @@ The tab contains the following settings:
is 10 days.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
@@ -250,7 +248,7 @@ The tab contains the following settings:
:::note
While the Activity Monitor can have multiple configurations per host, Netwrix
- Enterprise Auditorcan only read one of them.
+ Enterprise Auditor can only read one of them.
:::
diff --git a/docs/activitymonitor/7.1/admin/outputs/operations/operations.md b/docs/activitymonitor/7.1/admin/outputs/operations/operations.md
index deda011e36..6dd1b82d5f 100644
--- a/docs/activitymonitor/7.1/admin/outputs/operations/operations.md
+++ b/docs/activitymonitor/7.1/admin/outputs/operations/operations.md
@@ -37,8 +37,8 @@ The tab contains the following settings and features:
- Monitor Sign-Ins activity – Indicates if user sign-ins activity is monitored
- Monitor Audit activity – Indicates if audit for all operations is monitored
-- Service – Filter the table by Service using the drop-down menu
-- Category – Filter the table by Category using the drop-down menu
+- Service – Filter the table by Service using the dropdown menu
+- Category – Filter the table by Category using the dropdown menu
- Operation – Filter the table by Operation using the textbox
The table lists operations being monitored, displaying columns for Service, Category, and Operation.
@@ -124,7 +124,7 @@ Properties window closes.
## For SharePoint Online Host
-The tab contains a subset of tabs. Each tab has a **Select All** check box to include all events for
+The tab contains a subset of tabs. Each tab has a **Select All** checkbox to include all events for
that tab.
diff --git a/docs/activitymonitor/7.1/admin/outputs/operations/suppress.md b/docs/activitymonitor/7.1/admin/outputs/operations/suppress.md
index d3f4f6e0f3..65ed2de2f6 100644
--- a/docs/activitymonitor/7.1/admin/outputs/operations/suppress.md
+++ b/docs/activitymonitor/7.1/admin/outputs/operations/suppress.md
@@ -14,7 +14,7 @@ actions that have not been explicitly triggered by users.
One of the most prominent examples is the Windows File Explorer - the standard application for file
system browsing on the Windows family of operating systems. Over the years, File Explorer has had a
number of improvements and new features. File Explorer displays various information about files to
-provide a better user experience. This allows users to view file content without having to open
+provide a better user experience. This lets you view file content without having to open
them.
File Explorer displays icons for certain file types like executable (.exe) files. Depending on the
@@ -25,7 +25,7 @@ thumbnail of the files contained within the sub-folder on top of the sub-folder
additional functionality is executed automatically, mostly without the user's explicit action or
intention.
-As an example, a user may wish to open the MySampleReport.docx document located in the
+As an example, a user may want to open the MySampleReport.docx document located in the
MyTestDepartment folder. The user opens the folder, locates the file and double-clicks to open it.
From the user's perspective, only two actions were performed:
@@ -50,7 +50,7 @@ teams and IT auditing software. At the file system level, preview reads are perc
operations, like file copying or opening a file in an application. There exists no distinguishing
factor between explicit user activity and implicit actions by File Explorer. Whether it is a preview
read, opening the file in Notepad, or copying the file, all these operations are perceived as the
-same Read operation at the file system level. Therefore, it is not possible to reliably filter
+same Read operation at the file system level. Therefore, it isn't possible to reliably filter
unintentional activity without the risk of suppressing genuine user actions.
The Activity Monitor employs various techniques to minimize noise. These methods all rely on
diff --git a/docs/activitymonitor/7.1/admin/outputs/pathfiltering/pathfiltering.md b/docs/activitymonitor/7.1/admin/outputs/pathfiltering/pathfiltering.md
index ac44e8e6a9..860d19a64a 100644
--- a/docs/activitymonitor/7.1/admin/outputs/pathfiltering/pathfiltering.md
+++ b/docs/activitymonitor/7.1/admin/outputs/pathfiltering/pathfiltering.md
@@ -22,7 +22,7 @@ The tab contains the following settings and features:
- Add – Opens the Add or Edit Path window to add a new path to the list. See the
[Add or Edit Path Window](/docs/activitymonitor/7.1/admin/outputs/pathfiltering/addeditpath.md)
topic for additional information.
-- Remove – Removes the selected path from the list. Confirmation is not requested.
+- Remove – Removes the selected path from the list. Confirmation isn't requested.
:::warning
If a path is removed by accident, use the **Cancel** button to discard the change.
@@ -34,7 +34,7 @@ The tab contains the following settings and features:
- Edit – Opens the Add or Edit Path window to modify the selected path. See the
[Add or Edit Path Window](/docs/activitymonitor/7.1/admin/outputs/pathfiltering/addeditpath.md)
topic for additional information.
-- Type a path below to test whether it will be included or excluded – Enter a path in the textbox to
+- Enter a path below to test whether it will be included or excluded – Enter a path in the textbox to
test whether it will be included/excluded based on the path filtering list
- Result – Under the text box, a description of whether the indicated path is included or
@@ -57,7 +57,7 @@ precedence, and the ‘Edward’ child folder will not be monitored.
:::note
-If ‘Include’ is not listed under the Filter Type column (or no Include filter paths are
+If ‘Include’ isn't listed under the Filter Type column (or no Include filter paths are
added), then all current and new discovered drives will be monitored.
:::
@@ -74,7 +74,7 @@ The tab contains the following settings and features:
- Add – Opens the Add or Edit Path window to add a new path to the list. See the
[Add or Edit Path Window](/docs/activitymonitor/7.1/admin/outputs/pathfiltering/addeditpath.md)
topic for additional information.
-- Remove – Removes the selected path from the list. Confirmation is not requested.
+- Remove – Removes the selected path from the list. Confirmation isn't requested.
:::warning
If a path is removed by accident, use the **Cancel** button to discard the change.
@@ -86,7 +86,7 @@ The tab contains the following settings and features:
- Edit – Opens the Add or Edit Path window to modify the selected path. See the
[Add or Edit Path Window](/docs/activitymonitor/7.1/admin/outputs/pathfiltering/addeditpath.md)
topic for additional information.
-- Type a path below to test whether it will be included or excluded – Enter a path in the textbox to
+- Enter a path below to test whether it will be included or excluded – Enter a path in the textbox to
test whether it will be included/excluded based on the path filtering list
- Result – Under the text box, a description of whether the indicated path is included or
@@ -109,7 +109,7 @@ precedence, and the ‘Edward’ child folder will not be monitored.
:::note
-If ‘Include’ is not listed under the Filter Type column (or no Include filter paths are
+If ‘Include’ isn't listed under the Filter Type column (or no Include filter paths are
added), then all current and new discovered drives will be monitored.
:::
@@ -140,7 +140,7 @@ The tab contains the following settings and features:
- Add – Opens the Add or Edit Path window to add a new path to the list. See the
[Add or Edit Path Window](/docs/activitymonitor/7.1/admin/outputs/pathfiltering/addeditpath.md)
topic for additional information.
-- Remove – Removes the selected path from the list. Confirmation is not requested.
+- Remove – Removes the selected path from the list. Confirmation isn't requested.
:::warning
If a path is removed by accident, use the **Cancel** button to discard the change.
@@ -154,7 +154,7 @@ The tab contains the following settings and features:
topic for additional information.
- Add all local drives – Retrieves and adds all local drives to the bottom of the list with a type
of Include
-- Type a path below to test whether it will be included or excluded – Enter a path in the textbox to
+- Enter a path below to test whether it will be included or excluded – Enter a path in the textbox to
test whether it will be included/excluded based on the path filtering list
- Result – Under the text box, a description of whether the indicated path is included or
@@ -177,7 +177,7 @@ precedence, and the ‘Edward’ child folder will not be monitored.
:::note
-If ‘Include’ is not listed under the Filter Type column (or no Include filter paths are
+If ‘Include’ isn't listed under the Filter Type column (or no Include filter paths are
added), then all current and new discovered drives will be monitored.
:::
diff --git a/docs/activitymonitor/7.1/admin/outputs/processexclusions/addeditprocess.md b/docs/activitymonitor/7.1/admin/outputs/processexclusions/addeditprocess.md
index ab6f3761fa..88527b9d5b 100644
--- a/docs/activitymonitor/7.1/admin/outputs/processexclusions/addeditprocess.md
+++ b/docs/activitymonitor/7.1/admin/outputs/processexclusions/addeditprocess.md
@@ -14,7 +14,7 @@ output Properties window.
- Process name – Displays the name of the process to be excluded. You can enter a process name in
the textbox or select a process from the Running processes list.
- Filter – Indicates if the filter will be for **All events** or only **Read events**
-- Running Processes – Lists all processes currently running on the host
+- Running Processes – Lists all processes running on the host
Then click OK. The Add or Edit Path window closes, and the path is added to the filtering list for
the monitored host.
diff --git a/docs/activitymonitor/7.1/admin/outputs/processexclusions/processexclusions.md b/docs/activitymonitor/7.1/admin/outputs/processexclusions/processexclusions.md
index 510afafe77..0f1002d31e 100644
--- a/docs/activitymonitor/7.1/admin/outputs/processexclusions/processexclusions.md
+++ b/docs/activitymonitor/7.1/admin/outputs/processexclusions/processexclusions.md
@@ -24,7 +24,7 @@ The tab contains the following settings and features:
- Add – Opens the Add or Edit Process window to add a new process to the list. See the
[Add or Edit Process Window](/docs/activitymonitor/7.1/admin/outputs/processexclusions/addeditprocess.md)
topic for additional information.
-- Remove – Removes the selected path from the list. Confirmation is not requested.
+- Remove – Removes the selected path from the list. Confirmation isn't requested.
:::warning
If a process is removed by accident, use the **Cancel** button to discard the
diff --git a/docs/activitymonitor/7.1/admin/outputs/syslog/messagetemplate.md b/docs/activitymonitor/7.1/admin/outputs/syslog/messagetemplate.md
index fe0fd496fa..5b7ab0d7f4 100644
--- a/docs/activitymonitor/7.1/admin/outputs/syslog/messagetemplate.md
+++ b/docs/activitymonitor/7.1/admin/outputs/syslog/messagetemplate.md
@@ -11,7 +11,7 @@ field on the Syslog tab of the output Properties window.
-You can select a preconfigured template from the drop-down menu or create a custom template. The
+You can select a preconfigured template from the dropdown menu or create a custom template. The
available preconfigured templates vary based on the type of domain/host selected.
## For Monitored Domains
@@ -30,9 +30,9 @@ Monitored Domains Syslog outputs have the following preconfigured Templates:
- V 2.0 for IBM QRadar SIEM 7.2.4
- V 2.0 for Splunk SIEM
-Custom templates can be created. Select the desired template or create a new template by modifying
+Custom templates can be created. Select the template you want or create a new template by modifying
an existing template within the Message Template window. The new message template will be named
-Custom. Macro variables are also available to customize the Syslog message template.
+Custom. You can also use macro variables to customize the Syslog message template.
**Macro Variables for Monitored Domains**
@@ -102,7 +102,7 @@ Monitored Hosts Syslog outputs have the following preconfigured Templates:
- Netwrix Threat Manager (StealthDEFEND) – Use this template for Netwrix Threat Manager integration.
This is the only supported template for Threat Manager.
-Custom templates can be created. Select the desired template or create a new template by modifying
+Custom templates can be created. Select the template you want or create a new template by modifying
an existing template within the Message Template window. The new message template will be named
Custom. Macro variables are also available to customize the Syslog message template.
@@ -127,7 +127,7 @@ the Syslog message template:
| SharePoint Online | %DEST_FILENAME% | Name of the file that is copied or moved |
| SharePoint Online | %DEST_RELATIVE_PATH% | URL of the destination folder where a folder is copied or moved |
| SharePoint Online | %DLP_EXCEPTION% | Reasons why a policy no longer applies and any information about false positive or override |
-| SharePoint Online | %DLP_POLICY% | Policy(s) that triggered the event |
+| SharePoint Online | %DLP_POLICY% | Policys that triggered the event |
| SharePoint Online | %DLP_SENSITIVE% | Indicates whether the event contains the value of the sensitive data type (true/false) |
| SharePoint SharePoint Online | %DOC_LOCATION% | A relative URL of the file or document accessed by the user |
| SharePoint SharePoint Online | %EVENT_DATA% | - For SharePoint, raw event data - Fore SharePoint Online, additional event data |
diff --git a/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md b/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md
index 294f1469f8..b7e2fb2f8e 100644
--- a/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md
+++ b/docs/activitymonitor/7.1/admin/outputs/syslog/syslog.md
@@ -26,24 +26,24 @@ The tab contains the following settings:
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
[Message Template Window](/docs/activitymonitor/7.1/admin/outputs/syslog/messagetemplate.md)
topic for additional information.
- Enable periodic AD Status Check event reporting – Indicates periodic AD Status Check event
- reporting is enabled, which means the agent will send out status messages every five minutes to
+ reporting. The agent will send out status messages every five minutes to
verify whether the connection is still active.
The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -64,13 +64,13 @@ The tab contains the following settings:
organization’s environment can resolve the name format used.
- The default port for Netwrix Threat Manager is 10001.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol to use for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- - UPD is the only protocol supported for Threat Manager.
+ - UDP is the only protocol that Threat Manager supports.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -84,7 +84,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -104,10 +104,10 @@ The tab contains the following settings:
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -118,7 +118,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -139,13 +139,13 @@ The tab contains the following settings:
organization’s environment can resolve the name format used.
- The default port for Netwrix Threat Manager is 10000.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol to use for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- - UPD is the only protocol supported for Threat Manager.
+ - UDP is the only protocol that Threat Manager supports.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -160,7 +160,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -181,13 +181,13 @@ The tab contains the following settings:
organization’s environment can resolve the name format used.
- The default port for Netwrix Threat Manager is 10001.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- UPD is the only protocol supported for Threat Manager.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -199,7 +199,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
diff --git a/docs/activitymonitor/7.1/admin/search/activedirectory/activedirectory.md b/docs/activitymonitor/7.1/admin/search/activedirectory/activedirectory.md
index 3cea5e7d32..42ec6b7983 100644
--- a/docs/activitymonitor/7.1/admin/search/activedirectory/activedirectory.md
+++ b/docs/activitymonitor/7.1/admin/search/activedirectory/activedirectory.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Active Directory Search Query
You can search domain activity that has been monitored and recorded to a File output. When you
-select **Active Directory** from the magnifying glass drop-down menu, a New Search tab opens with
+select **Active Directory** from the magnifying glass dropdown menu, a New Search tab opens with
the applicable query filters.
@@ -27,21 +27,21 @@ Set the filters as desired and click **Search**. The application searches throug
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/7.1/admin/search/overview.md#filter) and
[Sort](/docs/activitymonitor/7.1/admin/search/overview.md#sort) the
-results using the column headers. Below the Search button is the
+results using the column headers. The
[Export](/docs/activitymonitor/7.1/admin/search/overview.md#export)
-option.
+option is also available in the search interface.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -56,11 +56,11 @@ configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
-- Event Source – Set which query categories will be used. The drop-down menu displays a checkbox
+- Event Source – Set which query categories will be used. The dropdown menu displays a checkbox
list of categories.
- Event Result – Filter the data for a specific event result: Any, Success, or Failure
- Event Block – Filter the data for a specific event result related to blocking: Any, Allowed, or
diff --git a/docs/activitymonitor/7.1/admin/search/activedirectory/activedirectory_1.md b/docs/activitymonitor/7.1/admin/search/activedirectory/activedirectory_1.md
index 3cd3018bbc..62c9a898e5 100644
--- a/docs/activitymonitor/7.1/admin/search/activedirectory/activedirectory_1.md
+++ b/docs/activitymonitor/7.1/admin/search/activedirectory/activedirectory_1.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Active Directory Search Results
When a search has been started, the Search Status table at the bottom displays the percentage
-complete according to the size and quantity of the activity log files being searched per AD agent.
+complete according to the size and quantity of the activity log files being searched per Active Directory (AD) agent.
You can
[Filter](/docs/activitymonitor/7.1/admin/search/overview.md#filter) and
[Sort](/docs/activitymonitor/7.1/admin/search/overview.md#sort) the
@@ -36,13 +36,13 @@ The results data grid columns display the following information for each event:
- Affected Object – Active Directory distinguished name for the affected object
- Affected Object SID – Security Identifier of the object/account affected by the event
- Affected Object Name – Name of the Affected Object
-- Protocol – Protocol(s) used for the monitored operation
+- Protocol – Protocols used for the monitored operation
- Query Filter – LDAP filter used in the operation
- Secured Query – Indicates if LDAP connection is secured or not
- Query Objects – Number of returned objects produced by the LDAP request
-- Process Name – Contains process name that is monitored. Currently this is only lsass.exe.
+- Process Name – Contains process name that is monitored. this is only lsass.exe.
- PID – Process Identifier generated for each active process
-- Old Name – Value prior to the monitored change
+- Old Name – Value before the monitored change
- New Name – Value after the monitored change
- Authentication Type – Indicates type of authentication event. Possible values: Kerberos, NTLM.
- Target Host – Name of the originating host
@@ -52,7 +52,7 @@ The results data grid columns display the following information for each event:
- NTLM Logon Type – Indicates type of protocol used to authenticate a connection between client and
server
- Ticket Encryption – Indicates encryption type used in request part of the Kerberos ticket
-- PAC – RID for the group that does not have access
+- PAC – RID for the group that doesn't have access
- SPN – Detects attempts to obtain a list of Service Principal Name values
- User Exists – Indicates if user exists
- N2 Password – Indicates if an invalid password matches the user’s password history
diff --git a/docs/activitymonitor/7.1/admin/search/entraid/entraid.md b/docs/activitymonitor/7.1/admin/search/entraid/entraid.md
index 08133eb756..b10bda3be8 100644
--- a/docs/activitymonitor/7.1/admin/search/entraid/entraid.md
+++ b/docs/activitymonitor/7.1/admin/search/entraid/entraid.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Microsoft Entra ID Search Query
You can search activity in Microsoft Entra ID (Azure AD) that has been monitored and recorded to a
-File output. When you select **Azure AD / Entra ID** from the magnifying glass drop-down menu, a New
+File output. When you select **Azure AD / Entra ID** from the magnifying glass dropdown menu, a New
Search tab opens with the applicable query filters.
@@ -28,21 +28,21 @@ Set the filters as desired and click **Search**. The application searches throug
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/7.1/admin/search/overview.md#filter) and
[Sort](/docs/activitymonitor/7.1/admin/search/overview.md#sort) the
-results using the column headers. Below the Search button is the
+results using the column headers. The
[Export](/docs/activitymonitor/7.1/admin/search/overview.md#export)
-option.
+option is also available in the search interface.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -56,11 +56,11 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
-- Source – Set which query categories will be used. The drop-down menu displays a checkbox list of
+- Source – Set which query categories will be used. The dropdown menu displays a checkbox list of
categories.
- Event Result – Filter the data for a specific event result: Any, Success, or Failure
- Reason
diff --git a/docs/activitymonitor/7.1/admin/search/entraid/entraid_1.md b/docs/activitymonitor/7.1/admin/search/entraid/entraid_1.md
index 1bbdd1d753..df5cbda4d6 100644
--- a/docs/activitymonitor/7.1/admin/search/entraid/entraid_1.md
+++ b/docs/activitymonitor/7.1/admin/search/entraid/entraid_1.md
@@ -30,12 +30,12 @@ The results data grid columns display the following information for each event:
- Application – Indicates the Application associated with the event
- Service – Indicates the Service associated with the event
- Category – Indicates the Category associated with the event. Categories returned from search
- queries can be configured using the Category filter drop-down.
+ queries can be configured using the Category filter dropdown.
- Operation - Indicates the Operation associated with the event. Operations returned from search
- queries can be configured using the Operation filter drop-down.
+ queries can be configured using the Operation filter dropdown.
- Type – Indicates the Type associated with the event. Types returned from search queries can be
- configured using the Type filter drop-down.
-- Target(s) – Indicates the Target(s) of the event
+ configured using the Type filter dropdown.
+- Targets – Indicates the Targets of the event
- Modified – Indicates modifications associated with the event
- Client App – Indicates the Client App associated with the event
- OS – Indicates the OS associated with the event
@@ -48,7 +48,7 @@ The results data grid columns display the following information for each event:
- Risk – Indicates the level of Risk associated with events
- Conditional Access – Indicates whether Conditional Access was applied to the event
- Conditional Policy – Indicates whether a Conditional Policy was applied to the event
-- Details – If applicable, provides additional information associated with the event that is not
+- Details – If applicable, provides additional information associated with the event that isn't
provided by the other Results columns
At the bottom of the search interface, additional information is displayed for selected events in
diff --git a/docs/activitymonitor/7.1/admin/search/exchangeonline/exchangeonline.md b/docs/activitymonitor/7.1/admin/search/exchangeonline/exchangeonline.md
index c0e42e6845..0888ee99a9 100644
--- a/docs/activitymonitor/7.1/admin/search/exchangeonline/exchangeonline.md
+++ b/docs/activitymonitor/7.1/admin/search/exchangeonline/exchangeonline.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# Exchange Online Search Query
You can search Exchange Online activity that has been monitored and recorded to a File output. When
-you select **Exchange Online** from the magnifying glass drop-down menu, a New Search tab opens with
+you select **Exchange Online** from the magnifying glass dropdown menu, a New Search tab opens with
the applicable query filters.
@@ -23,24 +23,24 @@ By default, the query is set to return all event activity for the past day. Conf
filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
-activity log files and returns the events that match the filters.You can
+activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/7.1/admin/search/overview.md#filter) and
[Sort](/docs/activitymonitor/7.1/admin/search/overview.md#sort) the
-results using the column headers. Below the Search button is the
+results using the column headers. The
[Export](/docs/activitymonitor/7.1/admin/search/overview.md#export)
-option.
+option is also available in the search interface.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -54,9 +54,9 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Source – Filter the data by the source type: All, Admin Audit, Mailbox Access, DLP, Sensitivity
Label, Other
diff --git a/docs/activitymonitor/7.1/admin/search/file/file.md b/docs/activitymonitor/7.1/admin/search/file/file.md
index 4c825cbee1..30fd8986dc 100644
--- a/docs/activitymonitor/7.1/admin/search/file/file.md
+++ b/docs/activitymonitor/7.1/admin/search/file/file.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# File Search Query
You can search Windows file server and NAS device activity that has been monitored and recorded to a
-File output. When you select **File** from the magnifying glass drop-down menu, a New Search tab
+File output. When you select **File** from the magnifying glass dropdown menu, a New Search tab
opens with the applicable query filters.
@@ -19,20 +19,20 @@ Set the filters as desired and click **Search**. The application searches throug
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/7.1/admin/search/overview.md#filter) and
[Sort](/docs/activitymonitor/7.1/admin/search/overview.md#sort) the
-results using the column headers. Below the Search button is the
+results using the column headers. The
[Export](/docs/activitymonitor/7.1/admin/search/overview.md#export)
-option.
+option is also available in the search interface.
**Filter Value Entry**
Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -43,9 +43,9 @@ The sections have the following filters:
- Events time range – The time frame filter must be configured for every search query:
- - From – Set the date and timestamp for the start of the activity range. The drop-down menu
+ - From – Set the date and timestamp for the start of the activity range. The dropdown menu
opens a calendar.
- - To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+ - To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- File Path – Filter the data for a specific file path where activity has occurred
diff --git a/docs/activitymonitor/7.1/admin/search/linux/linux.md b/docs/activitymonitor/7.1/admin/search/linux/linux.md
index 2fc9d2f507..d4cf02bfec 100644
--- a/docs/activitymonitor/7.1/admin/search/linux/linux.md
+++ b/docs/activitymonitor/7.1/admin/search/linux/linux.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Linux Search Query
You can search Linux file server and NAS device activity that has been monitored and recorded to a
-File output. When you select **Linux** from the magnifying glass drop-down menu, a New Search tab
+File output. When you select **Linux** from the magnifying glass dropdown menu, a New Search tab
opens with the applicable query filters.
@@ -19,20 +19,20 @@ Set the filters as desired and click **Search**. The application searches throug
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/7.1/admin/search/overview.md#filter) and
[Sort](/docs/activitymonitor/7.1/admin/search/overview.md#sort) the
-results using the column headers. Below the Search button is the
+results using the column headers. The
[Export](/docs/activitymonitor/7.1/admin/search/overview.md#export)
-option.
+option is also available in the search interface.
**Filter Value Entry**
Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -43,9 +43,9 @@ The sections have the following filters:
- Events time range – The time frame filter must be configured for every search query:
- - From – Set the date and timestamp for the start of the activity range. The drop-down menu
+ - From – Set the date and timestamp for the start of the activity range. The dropdown menu
opens a calendar.
- - To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+ - To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- File Path – Filter the data for a specific file path where activity has occurred
diff --git a/docs/activitymonitor/7.1/admin/search/overview.md b/docs/activitymonitor/7.1/admin/search/overview.md
index 41f2717336..967d0b65c6 100644
--- a/docs/activitymonitor/7.1/admin/search/overview.md
+++ b/docs/activitymonitor/7.1/admin/search/overview.md
@@ -46,11 +46,9 @@ Queries that may be useful to an organization include the following:
- What did user X do between days Y and Z?
- Administrator activity details?
-Follow the steps to use the search feature.
-
**Step 1 –** Click the magnifying glass icon and select the source type.
-**Step 2 –** Set the desired filters and click **Search**.
+**Step 2 –** Set the filters you want to apply and click **Search**.
**Step 3 –** Filter and Sort the results in the table as desired.
@@ -58,34 +56,34 @@ Follow the steps to use the search feature.
## Filter
-The drop-down menu for a column header in the search results data grid provides the option to filter
+The dropdown menu for a column header in the search results data grid provides the option to filter
the search results further.
-Choose between checking/unchecking the desired field values from the list of available values and
+Choose between checking or unchecking the field values you want to apply from the list of available values and
typing in the search textbox. The Clear filter option removes all filters from the selected column.
A filter icon appears on the header where filters have been applied. Multiple columns can be
filtered in the search results data grid.
:::note
-The columns that can be filtered will vary depending on what results are.
+The columns you can filter will vary based on your search results.
:::
## Sort
Clicking on any column header in the search results data grid sorts the results alphanumerically for
-that column, and an arrow shows next to the column name indicating the sort to be ascending or
-descending order.
+that column, and an arrow shows next to the column name indicating the sort direction as ascending or
+descending.
-The drop-down menu on the column header has options to Sort A to Z or Sort Z to A for the selected
-column. Sorting can only occur for one column at a time.
+The dropdown menu on the column header has options to Sort A to Z or Sort Z to A for the selected
+column. You can sort only one column at a time.
:::note
-The columns that can be sorted will vary depending on what results are.
+The columns you can sort will vary based on your search results.
:::
@@ -95,5 +93,5 @@ The search results data grid can be exported to a CSV/JSON file.
-Once the search results are configured as desired, click the Export button located at the top left
+After you configure the search results as needed, click the Export button located at the top left
corner of the window. Set the name and location of the CSV/JSON file.
diff --git a/docs/activitymonitor/7.1/admin/search/sharepoint/sharepoint.md b/docs/activitymonitor/7.1/admin/search/sharepoint/sharepoint.md
index 0e8291a3e1..04de4eebe8 100644
--- a/docs/activitymonitor/7.1/admin/search/sharepoint/sharepoint.md
+++ b/docs/activitymonitor/7.1/admin/search/sharepoint/sharepoint.md
@@ -7,7 +7,7 @@ sidebar_position: 60
# SharePoint Search Query
You can search SharePoint activity that has been monitored and recorded to a File output. When you
-select **SharePoint** from the magnifying glass drop-down menu, a New Search tab opens with the
+select **SharePoint** from the magnifying glass dropdown menu, a New Search tab opens with the
applicable query filters.
@@ -25,24 +25,24 @@ By default, the query is set to return all event activity for the past day. Conf
filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
-activity log files and returns the events that match the filters.You can
+activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/7.1/admin/search/overview.md#filter) and
[Sort](/docs/activitymonitor/7.1/admin/search/overview.md#sort) the
-results using the column headers. Below the Search button is the
+results using the column headers. The
[Export](/docs/activitymonitor/7.1/admin/search/overview.md#export)
-option.
+option is also available in the search interface.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -57,9 +57,9 @@ configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Event Type – Filter the data by the event type: All, CheckOut, CheckIn, View, Delete, Update,
ProfileChange, ChildDelete, SchemaChange, Undelete, Workflow, Copy, Move, AuditMaskChange, Search,
diff --git a/docs/activitymonitor/7.1/admin/search/sharepointonline/sharepointonline.md b/docs/activitymonitor/7.1/admin/search/sharepointonline/sharepointonline.md
index 01726e61ba..baad3760f8 100644
--- a/docs/activitymonitor/7.1/admin/search/sharepointonline/sharepointonline.md
+++ b/docs/activitymonitor/7.1/admin/search/sharepointonline/sharepointonline.md
@@ -7,7 +7,7 @@ sidebar_position: 70
# SharePoint Online Search Query
You can search SharePoint Online activity that has been monitored and recorded to a File output.
-When you select **SharePoint Online** from the magnifying glass drop-down menu, a New Search tab
+When you select **SharePoint Online** from the magnifying glass dropdown menu, a New Search tab
opens with the applicable query filters.
@@ -29,21 +29,21 @@ Set the filters as desired and click **Search**. The application searches throug
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/7.1/admin/search/overview.md#filter) and
[Sort](/docs/activitymonitor/7.1/admin/search/overview.md#sort) the
-results using the column headers. Below the Search button is the
+results using the column headers. The
[Export](/docs/activitymonitor/7.1/admin/search/overview.md#export)
-option.
+option is also available in the search interface.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -57,9 +57,9 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Source – Filter the data by the source type: All, File and Page, Folder, List, Sharing and Access
Request, Site Permissions, Site Administration, Synchronization, DLP, Sensitivity Label, Content
diff --git a/docs/activitymonitor/7.1/admin/search/sqlserver/sqlserver.md b/docs/activitymonitor/7.1/admin/search/sqlserver/sqlserver.md
index 3e08609c36..237068b739 100644
--- a/docs/activitymonitor/7.1/admin/search/sqlserver/sqlserver.md
+++ b/docs/activitymonitor/7.1/admin/search/sqlserver/sqlserver.md
@@ -7,7 +7,7 @@ sidebar_position: 80
# SQL Server Search Query
You can search SQL Server activity that has been monitored and recorded to a File output. When you
-select **SQL Server** from the magnifying glass drop-down menu, a New Search tab opens with the
+select **SQL Server** from the magnifying glass dropdown menu, a New Search tab opens with the
applicable query filters.
@@ -25,21 +25,21 @@ Set the filters as desired and click **Search**. The application searches throug
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/7.1/admin/search/overview.md#filter) and
[Sort](/docs/activitymonitor/7.1/admin/search/overview.md#sort) the
-results using the column headers. Below the Search button is the
+results using the column headers. The
[Export](/docs/activitymonitor/7.1/admin/search/overview.md#export)
-option.
+option is located below the Search button.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -53,9 +53,9 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Event Result – Filter the data for a specific event result: Any, Success, or Failure
- Reason
diff --git a/docs/activitymonitor/7.1/admin/search/sqlserver/sqlserver_1.md b/docs/activitymonitor/7.1/admin/search/sqlserver/sqlserver_1.md
index 87469a70b5..a290d41b90 100644
--- a/docs/activitymonitor/7.1/admin/search/sqlserver/sqlserver_1.md
+++ b/docs/activitymonitor/7.1/admin/search/sqlserver/sqlserver_1.md
@@ -11,9 +11,9 @@ complete according to the size and quantity of the activity log files being sear
agent. You can
[Filter](/docs/activitymonitor/7.1/admin/search/overview.md#filter) and
[Sort](/docs/activitymonitor/7.1/admin/search/overview.md#sort) the
-results using the column headers. Below the Search button is the
+results using the column headers. The
[Export](/docs/activitymonitor/7.1/admin/search/overview.md#export)
-option.
+option is located below the Search button.
diff --git a/docs/activitymonitor/7.1/gettingstarted.md b/docs/activitymonitor/7.1/gettingstarted.md
index 0a22ebec60..1a94f39f7e 100644
--- a/docs/activitymonitor/7.1/gettingstarted.md
+++ b/docs/activitymonitor/7.1/gettingstarted.md
@@ -6,13 +6,12 @@ sidebar_position: 10
# Getting Started
-Once Netwrix Activity Monitor is installed, the following workflow enables organizations to quickly
-and easily get started with activity monitoring.
+Once Netwrix Activity Monitor is installed, the following workflow enables organizations to get started with activity monitoring quickly.
## Requirements
The Activity Monitor console needs to be installed on a server. After that agents are deployed to
-the target environment and configured to monitor activity. It is necessary to prepare the target
+the target environment and configured to monitor activity. You must prepare the target
environment and configure the credentials used by the agents. Each supported environment has
different requirements. See the following topics for additional information:
@@ -36,7 +35,7 @@ different requirements. See the following topics for additional information:
## Install & Deploy Agents
-Once the prerequisites are accomplished, you are ready to install the application and deploy agents.
+After the prerequisites are accomplished, you are ready to install the application and deploy agents.
See the following topics for additional information:
- [Install Application](/docs/activitymonitor/7.1/install/application.md)
diff --git a/docs/activitymonitor/7.1/install/agents/agents.md b/docs/activitymonitor/7.1/install/agents/agents.md
index 87f141de99..a3838f7262 100644
--- a/docs/activitymonitor/7.1/install/agents/agents.md
+++ b/docs/activitymonitor/7.1/install/agents/agents.md
@@ -32,7 +32,7 @@ systems and applications. There are three types of agents:
for monitoring the target environment
- SQL Server – Activity Agent must be deployed to a Windows server that acts as a proxy for
monitoring the target environment
- - Windows File Server – Activity Agent must be deployed to the server. It cannot be deployed to
+ - Windows File Server – Activity Agent must be deployed to the server. It can't be deployed to
a proxy server.
- Credentials used for deployments must also be provisioned for monitoring
@@ -44,8 +44,7 @@ systems and applications. There are three types of agents:
- Credentials used for deployments must also be provisioned for monitoring
-In order to perform centralized agent maintenance from the application console server, WMI must be
-enabled on the machine where the agent is installed.
+To perform centralized agent maintenance from the application console server, enable WMI on the machine where the agent is installed.
You will need the following information to deploy agents from the console:
diff --git a/docs/activitymonitor/7.1/install/agents/manual.md b/docs/activitymonitor/7.1/install/agents/manual.md
index f2ee0e826a..f8d9e2113f 100644
--- a/docs/activitymonitor/7.1/install/agents/manual.md
+++ b/docs/activitymonitor/7.1/install/agents/manual.md
@@ -8,8 +8,6 @@ sidebar_position: 10
The Netwrix Activity Monitor Agent can be deployed via the console or manually.
-Follow the steps to manually install the agent.
-
**Step 1 –** Navigate to the Activity Monitor Console installation path and locate the agent
installation package. The default location is:
@@ -67,7 +65,7 @@ The Activity Monitor Agent command line has the following parameters:
- MANAGEMENT_GROUP
- To specify the Activity Monitor Agent Management Group (This allows user to limit users in the
- specified group to manage agents, but does not allow users in specified group to install,
+ specified group to manage agents, but doesn't allow users in specified group to install,
upgrade, or uninstall agents).
- Default value: “BUILTIN\Administrators”
- MANAGEMENT_GROUP=AMDOMAIN\AMGROUP
@@ -99,7 +97,7 @@ have been met, including those for NAS devices when applicable.
:::note
These steps are specific to deploying activity agents for monitoring file systems,
-SharePoint, SQL Server, Azure and Office 365 environments. See the
+SharePoint, SQL Server, Azure, and Office 365 environments. See the
[Active Directory Agent Deployment](/docs/activitymonitor/7.1/admin/agents/activedirectory.md)
section for instruction on deploying the AD agent. See the
[Linux Agent Deployment](/docs/activitymonitor/7.1/admin/agents/linux.md)
@@ -107,11 +105,9 @@ topic for instructions on deploying agents to Linux servers.
:::
-Follow the steps to deploy the activity agent to a single Windows server.
-
**Step 1 –** Open the Activity Monitor Console.
-**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agent(s) window opens.
+**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agents window opens.
@@ -126,7 +122,7 @@ topic for additional information. Click **Next**.
-**Step 5 –** On the Credentials to Connect to the Server(s) page, specify the credentials for the
+**Step 5 –** On the Credentials to Connect to the Servers page, specify the credentials for the
server to which the agent is deployed. See the
[Single Activity Agent Deployment](/docs/activitymonitor/7.1/admin/agents/single.md)
topic for additional information on credential options. Click **Connect**.
@@ -139,7 +135,7 @@ installed.
:::
-**Step 6 –** Regardless of the warning messages that the agent cannot be installed or upgraded,
+**Step 6 –** Regardless of the warning messages that the agent can't be installed or upgraded,
click **Next**. The console will automatically detect the agent as it is already installed.
@@ -153,7 +149,7 @@ click **Next**. The console will automatically detect the agent as it is already
:::note
The Activity Monitor Agent Management Group allows users in the specified group to manage
-agents, but does not allow users in specified group to install, upgrade, or uninstall agents.
+agents, but doesn't allow users in specified group to install, upgrade, or uninstall agents.
:::
diff --git a/docs/activitymonitor/7.1/install/agents/manualad.md b/docs/activitymonitor/7.1/install/agents/manualad.md
index 23b69fd846..56fec6b23a 100644
--- a/docs/activitymonitor/7.1/install/agents/manualad.md
+++ b/docs/activitymonitor/7.1/install/agents/manualad.md
@@ -8,7 +8,6 @@ sidebar_position: 30
The AD Module, powered by Threat Prevention, can only be installed on domain controllers.
-Follow the steps to manually deploy the AD Module.
**Step 1 –** From the Threat Prevention server, copy the Agent executable (
`...\Netwrix\Netwrix Threat Prevention\SIEnterpriseManager\Setup\SI Agent.exe`) to the machine where
@@ -38,7 +37,7 @@ location.
-> > - Use the Look In field to select the desired installation folder.
+> > - Use the Look In field to select the installation folder you want.
> > - When the Folder name is as desired, click **OK**. The wizard returns to the Destination Folder
> > page.
> > - Click **Next**.
@@ -51,7 +50,7 @@ location.
**Step 6 –** Keep the default radio button selection, Managed by Threat Prevention.
:::note
-The CA Certificate Configuration page is not applicable to the Activity Monitor.
+The CA Certificate Configuration page isn't applicable to the Activity Monitor.
:::
@@ -77,7 +76,7 @@ product to enable communication with it.
- Start Agent Service
- The **Start Agent Service** option starts the Threat Prevention Windows Agent service
- after the installation is complete. If the Threat Prevention Windows Agent service is not
+ after the installation is complete. If the Threat Prevention Windows Agent service isn't
started at the time of installation, the Activity Monitor Agent will start as needed.
- Create Windows Firewall Rules
@@ -106,11 +105,9 @@ The AD Module (SI Agent) is now installed on the server.
## Add the AD Agent to the Console
-Follow the steps to add the Activity Monitor Windows Agent (with the AD Module) to the Console:
-
**Step 1 –** Open the Activity Monitor Console.
-**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agent(s) window opens.
+**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agents window opens.
@@ -128,17 +125,17 @@ Follow the steps to add the Activity Monitor Windows Agent (with the AD Module)
**Step 6 –** On the Active Directory Connection page, specify the credentials for the domain or
-domain controller(s) where the agent is installed. Click **Connect** to verify connection to the
+domain controllers where the agent is installed. Click **Connect** to verify connection to the
domain. Click **Next**.
-**Step 7 –** Select the domain of the domain controller(s) where the agent is installed. Click
+**Step 7 –** Select the domain of the domain controllers where the agent is installed. Click
**Next**.
-**Step 8 –** Select the domain controller(s) where the agent is installed. Click **Test**.
+**Step 8 –** Select the domain controllers where the agent is installed. Click **Test**.
:::note
When clicking Test while adding the Agent to the Console, the connection may fail. When
@@ -148,7 +145,7 @@ installed.
:::
-**Step 9 –** Ignore the warning messages that the agent cannot be installed or upgraded and click
+**Step 9 –** Ignore the warning messages that the agent can't be installed or upgraded and click
**Next**.
@@ -157,7 +154,7 @@ installed.
:::note
The Activity Monitor Agent Management Group allows users in the specified group to manage
-agents, but does not allow users in specified group to install, upgrade, or uninstall agents.
+agents, but doesn't allow users in specified group to install, upgrade, or uninstall agents.
:::
diff --git a/docs/activitymonitor/7.1/install/agents/manuallinux.md b/docs/activitymonitor/7.1/install/agents/manuallinux.md
index 45e48153cc..3a79d3c164 100644
--- a/docs/activitymonitor/7.1/install/agents/manuallinux.md
+++ b/docs/activitymonitor/7.1/install/agents/manuallinux.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Manually Install the Linux Agent
-Follow the steps to manually install the agent.
+To manually install the agent, follow these steps:
**Step 1 –** Transfer the rpm package to the Linux server.
@@ -63,16 +63,16 @@ This will be needed to add the agent to the console.
## Add the Linux Agent to the Console
Before deploying the Activity agent in a Linux environment, ensure all Prerequisites have been met.
-To effectively monitor activity on a Linux host, it is necessary to deploy an agent to the host.
-Follow the steps to deploy the agent to the Linux host. See the
+To effectively monitor activity on a Linux host, deploy an agent to the host.
+To deploy the agent to the Linux host, follow these steps: See the
[Linux Agent Server Requirements](/docs/activitymonitor/7.1/requirements/linuxagent.md) topic
for additional information.
-Follow the steps to add the agent to the console.
+To add the agent to the console, follow these steps:
**Step 1 –** Open the Activity Monitor Console.
-**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agent(s) window opens.
+**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agents window opens.
@@ -104,7 +104,7 @@ installed.
**Step 6 –** On the Linux Agent Options page, select which user name to use to run the daemon. To
use root, leave the **Service user name** field blank. Click **Test** to test the connection.
-**Step 7 –** Click **Finish**. The Add New Agent(s) window closes, and the activity agent is
+**Step 7 –** Click **Finish**. The Add New Agents window closes, and the activity agent is
deployed to and installed on the target host.
:::note
diff --git a/docs/activitymonitor/7.1/install/application.md b/docs/activitymonitor/7.1/install/application.md
index 429825fe47..95b13ae560 100644
--- a/docs/activitymonitor/7.1/install/application.md
+++ b/docs/activitymonitor/7.1/install/application.md
@@ -10,8 +10,6 @@ Netwrix Activity Monitor comes with a 10-day trial license to start. If an organ
key has been acquired already, which should be provided by a Netwrix Representative, the file should
be saved in the same location where the Activity Monitor will be installed.
-Follow the steps to install the Netwrix Activity Monitor Console.
-
**Step 1 –** Run the NetwrixActivityMonitorSetup.msi executable to open the Netwrix Activity Monitor
Setup wizard.
diff --git a/docs/activitymonitor/7.1/install/importlicensekey.md b/docs/activitymonitor/7.1/install/importlicensekey.md
index 853037dc84..f8bb5c2298 100644
--- a/docs/activitymonitor/7.1/install/importlicensekey.md
+++ b/docs/activitymonitor/7.1/install/importlicensekey.md
@@ -11,7 +11,7 @@ a Enterprise Auditor key can be done from the Activity Monitor Console. If the A
Console is installed on a server where Enterprise Auditor has already been installed, it reads the
license information from the Enterprise Auditor installation directory.
-Follow the steps to import a license key file.
+To import a license key file, complete the following:
diff --git a/docs/activitymonitor/7.1/install/overview.md b/docs/activitymonitor/7.1/install/overview.md
index 15635a0d9c..3e826e9d4b 100644
--- a/docs/activitymonitor/7.1/install/overview.md
+++ b/docs/activitymonitor/7.1/install/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Installation
This topic describes the console installation and agent deployment the process for Activity Monitor.
-Prior to installing the application, ensure that all requirements have been met. See the
+Before installing the application, ensure that all requirements have been met. See the
[Requirements ](/docs/activitymonitor/7.1/requirements/overview.md) topic
for additional information.
diff --git a/docs/activitymonitor/7.1/install/upgrade/removeagent.md b/docs/activitymonitor/7.1/install/upgrade/removeagent.md
index f7ce081c93..9235368ba2 100644
--- a/docs/activitymonitor/7.1/install/upgrade/removeagent.md
+++ b/docs/activitymonitor/7.1/install/upgrade/removeagent.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Remove Agents
-On the Agents tab of the Activity Monitor Console, the Remove button allows users to remove the
+On the Agents tab of the Activity Monitor Console, use the Remove button to remove the
selected activity agent from the Agents list and/or uninstall the activity agent from the hosting
server.
diff --git a/docs/activitymonitor/7.1/install/upgrade/updateadagentinstaller.md b/docs/activitymonitor/7.1/install/upgrade/updateadagentinstaller.md
index 76776f3207..2bc12e740e 100644
--- a/docs/activitymonitor/7.1/install/upgrade/updateadagentinstaller.md
+++ b/docs/activitymonitor/7.1/install/upgrade/updateadagentinstaller.md
@@ -16,11 +16,8 @@ license keys for purchased products. See the
topic for information on how to register for a Customer Portal account. Navigate to the Netwrix
Threat Prevention Download section for the 7.4. Download the Threat Prevention Agent binary.
-Then follow the steps to update the AD Agent installer used by the Activity Monitor Console.
-
**Step 1 –** On the Agents tab, select **Update Installer**. The Select Active Directory Module
-installer package (SI Agent.exe) windowSelect Active Directory Module installer package (SI
-Agent.exe) window opens.
+installer package (SI Agent.exe) window opens.
@@ -30,9 +27,7 @@ installer and click **Open**.
**Step 3 –** A confirmation window opens displaying the version information for the selected
-installer. Click **Yes** to update to this version or **No** to cancel the operation. A confirmation
-window opens displaying the version information for the selected installer. Click **Yes** to update
-to this version or **No** to cancel the operation.
+installer. Click **Yes** to update to this version or **No** to cancel the operation.
-The AD agent installer is update. Use the Install button on the Agents tab to upgrade the deployed
+The AD agent installer is now updated. Use the Install button on the Agents tab to upgrade the deployed
AD agents to the new version.
diff --git a/docs/activitymonitor/7.1/install/upgrade/upgrade.md b/docs/activitymonitor/7.1/install/upgrade/upgrade.md
index 3a2397b7b5..1beb5360e9 100644
--- a/docs/activitymonitor/7.1/install/upgrade/upgrade.md
+++ b/docs/activitymonitor/7.1/install/upgrade/upgrade.md
@@ -14,7 +14,7 @@ section for information on integration with other Netwrix products.
## Considerations
While it is strongly recommended to match the versions of both the console and the activity agent,
-activity agent(s) V3.1+ can be managed by Activity Monitor Console V4.0+. Older versions of activity
+activity agents V3.1+ can be managed by Activity Monitor Console V4.0+. Older versions of activity
agents will be limited in monitoring capability until upgraded.
The installation and configuration paths for Netwrix Activity Monitor 7.1 have been updated from
@@ -24,8 +24,6 @@ for additional information.
## Activity Monitor Upgrade Procedure
-Follow the steps to upgrade from the Netwrix Activity Monitor V7.0 to Netwrix Activity Monitor 7.1.
-
_Prerequisite_ – Ensure console and agent servers have .NET Framework 4.7.2 installed.
**Step 1 –** Install the Activity Monitor 7.1 on the same machine where the V7.0 console resides
@@ -43,7 +41,7 @@ Update the activity agents in batches to ensure continuity of monitoring.
:::
-**Step 2 –** Select the activity agent(s) to be upgraded. The Windows Ctrl-select option can be used
+**Step 2 –** Select the activity agents to be upgraded. The Windows Ctrl-select option can be used
to select multiple activity agents. Then click Upgrade.
**Step 3 –** (_Optional_) Deploy AD agents to monitor domains.
@@ -56,6 +54,6 @@ when upgrading to Activity Monitor 7.1.
The selected activity agents are updated to V7.1. If a Threat Prevention Agent is also installed on
the Windows server for monitoring file systems, the Monitored Hosts tab identifies the host as being
-“Managed by Threat Prevention”, and that ‘monitored host’ is not editable. However, multiple outputs
+“Managed by Threat Prevention”, and that ‘monitored host’ isn't editable. However, multiple outputs
can be configured for hosts. Add the Windows host to the Monitored Hosts tab to monitor file system
for outputs to Enterprise Auditor, Threat Manager, and/or SIEM products.
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/activityagent.md b/docs/activitymonitor/7.1/requirements/activityagent/activityagent.md
index db61da19ef..8771dc4259 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/activityagent.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/activityagent.md
@@ -62,7 +62,7 @@ topic for firewall port requirements.
## Supported Exchange Online
-The Activity Monitor provides the ability to monitor Exchange Online:
+The Activity Monitor lets you monitor Exchange Online:
:::note
For monitoring Exchange Online, the Activity Agent must be deployed to a Windows server
@@ -78,7 +78,7 @@ topic for target environment requirements.
## Supported Microsoft Entra ID
-The Activity Monitor provides the ability to monitor Microsoft Entra ID:
+The Activity Monitor lets you monitor Microsoft Entra ID:
:::note
For monitoring Microsoft Entra ID, the Activity Agent must be deployed to a Windows server
@@ -94,7 +94,7 @@ topic for target environment requirements.
## Supported Network Attached Storage Devices
-The Activity Monitor provides the ability to monitor NAS file server devices:
+The Activity Monitor lets you monitor NAS file server devices:
:::note
For monitoring NAS devices, the Activity Agent must be deployed to a Windows server that
@@ -140,7 +140,7 @@ See the
[Hitachi Activity Auditing Configuration](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/hitachi-activity.md)
topic for target environment requirements.
-**Nasuni Nasuni Edge Appliances**
+**Nasuni Edge Appliances**
- 8.0+
@@ -154,7 +154,7 @@ topic for target environment requirements.
- Cluster-Mode 8.2+
:::note
- The Resiliency feature introduced in ONTAP 9.0 is not supported.
+ The Resiliency feature introduced in ONTAP 9.0 isn't supported.
:::
@@ -184,7 +184,7 @@ topic for target environment requirements.
## Supported SharePoint Farms Platforms
-The Activity Monitor provides the ability to monitor SharePoint farms:
+The Activity Monitor lets you monitor SharePoint farms:
:::note
For monitoring a SharePoint farm, the Activity Agent must be deployed to the SharePoint
@@ -204,7 +204,7 @@ topic for target environment requirements.
## Supported SharePoint Online
-The Activity Monitor provides the ability to monitor SharePoint Online:
+The Activity Monitor lets you monitor SharePoint Online:
:::note
For monitoring SharePoint Online, the Activity Agent must be deployed to a Windows server
@@ -220,11 +220,10 @@ topic for target environment requirements.
## Supported SQL Server Platforms
-The Activity Monitor provides the ability to monitor SQL Server:
+The Activity Monitor lets you monitor SQL Server:
:::note
-For monitoring SQL Server, it is recommended to install the Activity Agent must be
-deployed to a Windows server that acts as a proxy for monitoring the target environment.
+For monitoring SQL Server, it is recommended to deploy the Activity Agent to a Windows server that acts as a proxy for monitoring the target environment.
:::
@@ -242,11 +241,11 @@ topic for target environment requirements.
## Supported Windows File Servers Platforms
-The Activity Monitor provides the ability to monitor Windows file servers:
+The Activity Monitor lets you monitor Windows file servers:
:::note
For monitoring a Windows file server, the Activity Agent must be deployed to the server.
-It cannot be deployed to a proxy server.
+It can't be deployed to a proxy server.
:::
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/activityagentports.md b/docs/activitymonitor/7.1/requirements/activityagent/activityagentports.md
index 44d53caf6e..44a9aed183 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/activityagentports.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/activityagentports.md
@@ -15,7 +15,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
@@ -109,7 +109,7 @@ Agent server and the target NetApp Data ONTAP 7-Mode device:
Activity Monitor.
:::note
-If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
+If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
device must be configured manually. Also, the External Engine will not reconnect automatically in
the case of a server reboot or service restart.
:::
@@ -130,7 +130,7 @@ Agent server and the target NetApp Data ONTAP Cluster-Mode device:
Activity Monitor.
:::note
-If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
+If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
device must be configured manually. Also, the External Engine will not reconnect automatically in
the case of a server reboot or service restart.
:::
@@ -156,7 +156,7 @@ Agent server and the target Panzura device:
| Communication Direction | Protocol | Ports | Description |
| ------------------------------------------ | ------------- | ----- | ----------------------- |
| Activity Agent Server to Panzura | HTTPS | 443 | Panzura API |
-| Panzura filers to to Activity Agent Server | AMQP over TCP | 4497 | Panzura Event Reporting |
+| Panzura filers to Activity Agent Server | AMQP over TCP | 4497 | Panzura Event Reporting |
Protect the port with a username and password. The credentials will be configured in Panzura.
@@ -190,7 +190,7 @@ Agent server and the target SQL Server:
| ----------------------------------- | -------- | ----- | ----------------------- |
| SQL Server to Activity Agent Server | TCP | 1433 | Default SQL Server Port |
-If the Activity Monitor cannot connect to the SQL Server, ensure that SQL Server Browsing state is
+If the Activity Monitor can't connect to the SQL Server, ensure that SQL Server Browsing state is
**Running**.
## Integration with Netwrix Enterprise Auditor Additional Firewall Rules
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/entraid-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/entraid-activity.md
index e3b39c45ff..899209fd94 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/entraid-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/entraid-activity.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Microsoft Entra ID Activity Auditing Configuration
-It is necessary to register Activity Monitor as a web application to the targeted Microsoft Entra ID
-(formerly Azure AD), in order for Activity Monitor to monitor the environment. This generates the
+Register Activity Monitor as a web application to the targeted Microsoft Entra ID
+(formerly Azure AD) so Activity Monitor can monitor the environment. This generates the
Client ID and Client Secret needed by the Activity Agent. See
[Microsoft Support](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-reporting-api-prerequisites-azure-portal)
for assistance in configuring the Microsoft Entra ID web application.
@@ -20,14 +20,14 @@ Microsoft Entra ID.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you register the application:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
+ It isn't possible to retrieve the value after saving the new key. It must be
copied first.
:::
@@ -46,8 +46,6 @@ The following permissions are required:
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
-
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
@@ -79,9 +77,6 @@ application. Now that the application has been registered, permissions need to b
## Grant Permissions to the Registered Application
-Follow the steps to set up permissions to enable the Activity Monitor to monitor data and collect
-logs from Microsoft Entra ID.
-
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
@@ -116,8 +111,6 @@ be collected.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
-
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
@@ -154,8 +147,6 @@ application’s Client Secret Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
-
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
@@ -174,9 +165,6 @@ application’s Client Secret Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
-value when saving the new key.
-
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
@@ -185,7 +173,7 @@ additional information.
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
+It isn't possible to retrieve the value after saving the new key. It must be copied
first.
:::
@@ -212,7 +200,7 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
+If this page is left before the key is copied, then the key isn't retrievable, and
this process will have to be repeated.
:::
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/exchange-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/exchange-activity.md
index b2002fa03b..659a248094 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/exchange-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/exchange-activity.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Exchange Online Activity Auditing Configuration
-In order to collect logs and monitor Exchange Online activity using the Netwrix Activity Monitor, it
+to collect logs and monitor Exchange Online activity using the Netwrix Activity Monitor, it
needs to be registered with Microsoft® Entra ID® (formerly Azure AD).
:::note
@@ -26,14 +26,14 @@ additional information.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you register the application:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
+ It isn't possible to retrieve the value after saving the new key. It must be
copied first.
:::
@@ -54,8 +54,6 @@ The following settings are needed from your tenant once you have registered the
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
-
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
@@ -87,8 +85,6 @@ application. Now that the application has been registered, permissions need to b
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
-
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
@@ -134,8 +130,6 @@ be collected.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
-
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
@@ -175,8 +169,6 @@ Client Secret Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
-
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
@@ -197,9 +189,6 @@ Client Secret Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
-value when saving the new key.
-
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
if you start from a different Microsoft portal. See the relevant Microsoft documentation for
@@ -208,7 +197,7 @@ additional information.
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
+It isn't possible to retrieve the value after saving the new key. It must be copied
first.
:::
@@ -235,7 +224,7 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
+If this page is left before the key is copied, then the key isn't retrievable, and
this process will have to be repeated.
:::
@@ -251,14 +240,12 @@ topic for additional information.
## Enable Auditing for Exchange Online
-Follow the steps to enable auditing for Exchange Online so the Activity Monitor can receive events.
-
**Step 1 –** In the Microsoft Purview compliance portal at
[https://compliance.microsoft.com](https://compliance.microsoft.com/), go to **Solutions** >
**Audit**. Or, to go directly to the Audit page at
[https://compliance.microsoft.com/auditlogsearch](https://compliance.microsoft.com/auditlogsearch).
-**Step 2 –** If auditing is not turned on for your organization, a banner is displayed prompting you
+**Step 2 –** If auditing isn't turned on for your organization, a banner is displayed prompting you
start recording user and admin activity.
**Step 3 –** Select the **Start recording** user and **admin activity** banner.
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/celerra-vnx-aac/activity.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/celerra-vnx-aac/activity.md
index e599b77c7c..917059f214 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/celerra-vnx-aac/activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/celerra-vnx-aac/activity.md
@@ -11,15 +11,15 @@ events. All audit data can be forwarded to the Dell Common Event Enabler (CEE).
listens for all events coming through the Dell CEE and translates all relevant information into
entries in the Log files or syslog messages.
-Complete the following checklist prior to configuring the Activity Monitor to monitor the host.
+Complete the following checklist before configuring the Activity Monitor to monitor the host.
Instructions for each item of the checklist are detailed within the following sections.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - DNS name of Celerra or VNX CIFS share(s) to be monitored
- - Data Mover or Virtual Data Mover hosting the share(s) to be monitored
+ - DNS name of Celerra or VNX CIFS shares to be monitored
+ - Data Mover or Virtual Data Mover hosting the shares to be monitored
- Account with access to the CLI
- Download the Dell CEE from:
@@ -38,9 +38,9 @@ Instructions for each item of the checklist are detailed within the following se
- Important:
- - Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE
+ - Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE
is installed
- - Dell CEE 8.4.2 through Dell CEE 8.6.1 are not supported for use with the VCAPS feature
+ - Dell CEE 8.4.2 through Dell CEE 8.6.1 aren't supported for use with the VCAPS feature
- Dell CEE requires .NET Framework 3.5 to be installed on the Windows proxy server
- See the
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/celerra-vnx-aac/installcee.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/celerra-vnx-aac/installcee.md
index 114c9ef995..2aba6d8859 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/celerra-vnx-aac/installcee.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/celerra-vnx-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install & Configure Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,7 +20,7 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
+To install the Dell CEE, complete the following:
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -33,7 +33,7 @@ guide to install and configure the CEE. The installation will add two services t
- EMC CEE Monitor (Display Name: EMC CEE Monitor)
:::info
-The latest version of .NET Framework and Dell CEE is recommended to use with the
+The latest version of .NET Framework and Dell CEE is recommended for the
asynchronous bulk delivery (VCAPS) feature.
:::
@@ -42,29 +42,28 @@ See the
[CEE Debug Logs](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/validate.md#cee-debug-logs)
section for information on troubleshooting issues related to Dell CEE.
-After Dell CEE installation is complete, it is necessary to
-[Connect Data Movers to the Dell CEE Server](#connect-data-movers-to-the-dell-cee-server).
+After Dell CEE installation is complete,
+[connect Data Movers to the Dell CEE Server](#connect-data-movers-to-the-dell-cee-server).
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
-**Step 2 –** Navigate to following location:
+**Step 2 –** Navigate to the following location:
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
@@ -75,7 +74,7 @@ Examples:
**StealthAUDIT@192.168.30.15**
-**Step 7 –** Click OK. The Edit String window closes. Registry Editor can be closed.
+**Step 7 –** Click OK. The Edit String window closes, and you can close Registry Editor.
@@ -95,19 +94,19 @@ Mover.
administrative account should have a $ character in the terminal.
:::note
-Do not use a # charter.
+Don't use a # character.
:::
**Step 2 –** Create or retrieve the `cepp.conf` file.
-If there is not a `cepp.conf` file on the Data Mover(s), use a text editor to create a new blank
+If there isn't a `cepp.conf` file on the Data Movers, use a text editor to create a new blank
file in the home directory named `cepp.conf`. The following is an example command if using the text
editor ‘vi’ to create a new blank file:
**$ vi cepp.conf**
-> If a `cepp.conf` file already exists, it can be retrieved from the Data Movers for modification
+> If a `cepp.conf` file already exists, retrieve it from the Data Movers for modification
> with the following command:
**$ server_file [DATA_MOVER_NAME] -get cepp.conf cepp.conf**
@@ -127,7 +126,7 @@ The Activity Monitor requires the following parameters to be set in the `cepp.co
- `pool name= `
- This should equal the name assigned to the configuration container. This container is composed
- of the server(s) IP Address or FQDN where the Dell CEE is installed and where the list of
+ of the servers IP Address or FQDN where the Dell CEE is installed and where the list of
events to be monitored is located. It can be named as desired but must be a pool name.
- `servers= `
- This should equal the IP Address or FQDN of the Windows server where the Dell CEE is
@@ -176,7 +175,7 @@ The Activity Monitor requires the following parameters to be set in the `cepp.co
postevents=CloseModified|CloseUnmodified|CreateDir|CreateFile|DeleteDir|DeleteFile|RenameDir|RenameFile|SetAclDir|SetAclFile
-**Step 4 –** Move the `cepp.conf` file to the Data Mover(s) root file system. Run the following
+**Step 4 –** Move the `cepp.conf` file to the Data Movers root file system. Run the following
command:
**$ server_file [DATA_MOVER_NAME]‑put cepp.conf cepp.conf**
@@ -202,7 +201,7 @@ Then verify the CEPA status using the following command:
**server_cepp [DATA_MOVER_NAME] -service –status**
-Once the `cepp.config` file has been configured, it is time to configure and enable monitoring with
+After the `cepp.config` file has been configured, configure and enable monitoring with
the Activity Monitor. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor)
for additional information.
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/celerra-vnx-aac/validate.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/celerra-vnx-aac/validate.md
index faca0111af..c832b8b9bc 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/celerra-vnx-aac/validate.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/celerra-vnx-aac/validate.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
+After the Activity Monitor agent is configured to monitor the Dell device, the automated
configuration must be validated to ensure events are being monitored.
## Validate Dell CEE Registry Key Settings
@@ -21,10 +21,10 @@ topic for information on manually setting the registry key.
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
+a different server than the Windows proxy servers where the Activity Monitor activity agent is
deployed.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -91,7 +91,7 @@ additional information.
## Validate Dell CEE Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -121,19 +121,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/configureaccesstologs.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/configureaccesstologs.md
index deade0c148..d52de14476 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/configureaccesstologs.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/configureaccesstologs.md
@@ -6,9 +6,6 @@ sidebar_position: 20
# Configure Access to HNAS Audit Logs on Activity Agent Server
-Follow the steps to configure access to the HNAS audit logs on the Windows server hosting the
-Activity Monitor activity agent.
-
**Step 1 –** On the Windows computer, go to Run and type `compmgmt.msc`.
**Step 2 –** In the right-hand panel, select More Actions > Connect to another computer.
@@ -22,7 +19,7 @@ Folders > Shares.
**Step 5 –** Select the Security tab and click Advanced.
**Step 6 –** In the Advanced Security Settings dialog box, select the Audit tab. Click Add or Edit
-to select the users and groups to be audited and add the desired user or group.
+to select the users and groups to be audited and add the user or group you want to audit.
**Step 7 –** Select All for Type, and Full Control for Basic permissions.
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/configurelogs.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/configurelogs.md
index 0b78b94509..df3e4aa299 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/configurelogs.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/configurelogs.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Configure Audit Logs on HNAS
-Follow the steps to configure access to the HNAS audit logs on the Hitachi device.
-
**Step 1 –** Open a browser and enter the IP Address for HNAS in the address bar to launch the
Hitachi Storage Navigator (SN). Enter the username and password.
@@ -33,7 +31,7 @@ auditing). In the Audit Log section, set the maximum log file size to a value of
is recommended to set it to 16 MB. In the Log roll over policy section, select New. The product does
not support the Wrap policy. Click OK to close.
-Once access has been configured on the Hitachi device, it is necessary to configure access to the
+Once access has been configured on the Hitachi device, you must configure access to the
HNAS audit logs on the Windows server. See the
[Configure Access to HNAS Audit Logs on Activity Agent Server](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/configureaccesstologs.md)
topic for additional information.
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/hitachi-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/hitachi-activity.md
index 8b959c3f28..04ae4617e0 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/hitachi-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/hitachi-aac/hitachi-activity.md
@@ -11,7 +11,7 @@ multiple file systems. Auditing is enabled and configured per file system. This
to enable auditing on an HNAS and to configure the Activity Monitor to monitor activity coming from
the Hitachi device auditing.
-The Activity Monitor does not use the EVS or file system name to connect to HNAS. Therefore, all
+The Activity Monitor doesn't use the EVS or file system name to connect to HNAS. Therefore, all
that is required of the user for HNAS activity collection is the following:
- Logs path (UNC)
@@ -39,11 +39,11 @@ clients using other protocols would be costly in terms of system performance, be
operation would have to be audited as an open operation. **Therefore, when file system auditing is
enabled, by default, only clients connecting through the CIFS protocol are allowed access to the
file system.** Access by clients using other protocols, like NFS, can, however, be allowed. When
-such access is allowed, access to file system objects through these protocols is not audited.”
+such access is allowed, access to file system objects through these protocols isn't audited.”
:::note
File system auditing can be configured to deny access to clients connecting with protocols
-that cannot be audited (NFS). Please see the Hitachi
+that can't be audited (NFS). see the Hitachi
[Server and Cluster Administration Guide](https://support.hds.com/download/epcra/hnas0106.pdf) for
additional information.
:::
@@ -51,7 +51,7 @@ additional information.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Hitachi devices.
+Complete the following checklist before configuring activity monitoring of Hitachi devices.
Instructions for each item of the checklist are detailed within the following topics.
Checklist Item 1:
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/installcee.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/installcee.md
index 39b6d40df3..1841fe4f49 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/installcee.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,8 +20,6 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
-
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -45,8 +43,7 @@ section for information on troubleshooting issues related to Dell CEE.
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+one where the Activity Monitor activity agent is deployed. In those cases, you must manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -56,12 +53,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/isilon-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/isilon-activity.md
index fdf5480b35..fdc098a981 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/isilon-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/isilon-activity.md
@@ -20,15 +20,15 @@ initiated the activity. The stored events are then forwarded by the node to the
concurrently to several instances. At this point, Dell CEE forwards the audit event to a defined
endpoint, such as Activity Monitor agent.
-Complete the following checklist prior to configuring Activity Monitor to monitor the host.
+Complete the following checklist before configuring Activity Monitor to monitor the host.
Instructions for each item of the checklist are detailed within the following sections.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - DNS name of Isilon/PowerScale CIFS share(s) to be monitored
- - Access Zone(s) containing the CIFS shares to be monitored
+ - DNS name of Isilon/PowerScale CIFS shares to be monitored
+ - Access Zones containing the CIFS shares to be monitored
- Account with access to the OneFS UI or CLI
- Download the Dell CEE from:
@@ -80,12 +80,12 @@ Checklist Item 3: Configure Auditing on the Dell Isilon/PowerScale Cluster
- Important:
- Value of the **Storage Cluster Name** field must exactly match the name entered for the
- monitored host in the Activity Monitor Console. If the Storage Cluster Name cannot be modified
+ monitored host in the Activity Monitor Console. If the Storage Cluster Name can't be modified
(for example, another 3rd party depends on it), you need to set the Host Aliases parameter in
the Activity Monitor Console. Otherwise, if for some reason the Storage Cluster Name must be
left empty, one can list OneFS cluster node names in the Host Aliases.
- - If the Storage Cluster Name is not empty, set the Host Aliases parameter to its value
+ - If the Storage Cluster Name isn't empty, set the Host Aliases parameter to its value
- If the Storage Cluster Name is empty, set the Host Aliases to a semicolon-separated list
of OneFS node names
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/manualconfiguration.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/manualconfiguration.md
index 4a7eb156ef..961bb03ebd 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/manualconfiguration.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/manualconfiguration.md
@@ -22,7 +22,7 @@ cluster, include all relevant zones.
Ensure that OneFS collects only events you are interested in. By default, OneFS may monitor things
like directory reads, which can take up a large amount of space. Configuring the OneFS events that
-need monitoring is not done through the Activity Monitor console. Configure OneFS event monitoring
+need monitoring isn't done through the Activity Monitor console. Configure OneFS event monitoring
using OneFS CLI with the isi audit modify command for each access zone. Enabling monitoring for only
what is needed for the environment will reduce the data load to the agent.
@@ -53,8 +53,7 @@ server hosting CEE. Use either of the following format:
http://[SERVER Name]:[PORT]/cee
:::info
-When deploying multiple Dell CEE instances at scale, it is recommended that an
-accommodating agent must be configured with each CEE instance. If multiple CEE instances send events
+When deploying multiple Dell CEE instances at scale, configure an accommodating agent with each CEE instance. If multiple CEE instances send events
to just one agent, it may create an overflow of data and overload the agent. Distributing the
activity stream into pairs will be the most efficient way of monitoring large data sets at scale.
:::
@@ -65,7 +64,7 @@ be an exact match to the name which is entered in the Activity Monitor for the *
list.
This name is used as a ‘tag’ on all events coming through the CEE. This name must exactly match what
-is in the Activity Monitor or it does not recognize the events.
+is in the Activity Monitor or it doesn't recognize the events.
:::info
Use the CIFS DNS name for Dell OneFS.
@@ -78,10 +77,10 @@ the name entered here must exactly match what is used for Enterprise Auditor as
:::
-If the Storage Cluster Name cannot be modified (for example, another third-party depends on it), you
+If the Storage Cluster Name can't be modified (for example, another third-party depends on it), you
need to set the Host Aliases parameter in the Activity Monitor Console:
-- If the Storage Cluster Name is not empty, set the Host Aliases parameter to its value
+- If the Storage Cluster Name isn't empty, set the Host Aliases parameter to its value
- If the Storage Cluster Name is empty, set the Host Aliases to a semicolon-separated list of OneFS
node names
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/validate.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/validate.md
index 77ba3c165a..2ec14a459f 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/validate.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/isilon-powerscale-aac/validate.md
@@ -6,18 +6,18 @@ sidebar_position: 30
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
-configuration must be validated to ensure events are being monitored.
+After you configure the Activity Monitor agent to monitor the Dell device, validate the automated
+configuration to ensure events are being monitored.
## Validate Dell CEE Registry Key Settings
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
+a different server than the Windows proxy servers where the Activity Monitor activity agent is
deployed.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -84,7 +84,7 @@ additional information.
## Validate Dell CEE Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -114,19 +114,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/nasuni-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/nasuni-activity.md
index 7d370873f1..bdf744657e 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/nasuni-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/nasuni-activity.md
@@ -13,7 +13,7 @@ network connection to the appliance. Nasuni will then stream event data to the a
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Nasuni Edge Appliances.
+Complete the following checklist before configuring activity monitoring of Nasuni Edge Appliances.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Generate Nasuni API Access Key**
@@ -30,8 +30,6 @@ Instructions for each item of the checklist are detailed within the following to
## Nasuni Filer Management Interface
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Filer Management Interface.
-
**Step 1 –** Within the **Configuration** menu, under **USERS & SECURITY**, select API Access Keys.
The API Access Keys page opens.
@@ -43,8 +41,8 @@ The API Access Keys page opens.
**Step 5 –** In the Successfully Generated API Key window, copy the Key Passcode.
-Both the Key Name and the Key Passcode are required by the Activity Monitor in order to connect to
-the Nasuni Edge Appliance. Once the API Key has been generated, it is time to configure and enable
+Both the Key Name and the Key Passcode are required by the Activity Monitor to connect to
+the Nasuni Edge Appliance. After the API Key has been generated, configure and enable
monitoring with the Activity Monitor console.
:::note
@@ -55,22 +53,20 @@ the exact same case as generated.
## Nasuni Management Console
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Management Console.
-
**Step 1 –** Click Filers and select API Keys from the menu on the left. The Filer API Access Key
Settings page opens.
**Step 2 –** Click New API Key button. The Add API Access Key window opens.
-**Step 3 –** From the Filer drop-down menu, select the desired Nasuni Edge Appliance. Then enter a
+**Step 3 –** From the Filer dropdown menu, select the Nasuni Edge Appliance you want to configure. Then enter a
Name for the key; for example, the name of the application.
**Step 4 –** Click Add API Key.
**Step 5 –** A message appears which includes the Key Passcode; copy the Key Passcode.
-Both the Key Name and the Key Passcode are required by the Activity Monitor in order to connect to
-the Nasuni Edge Appliance. Once the API Key has been generated, it is time to configure and enable
+Both the Key Name and the Key Passcode are required by the Activity Monitor to connect to
+the Nasuni Edge Appliance. After the API Key has been generated, configure and enable
monitoring with the Activity Monitor console.
:::note
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/nutanix-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/nutanix-activity.md
index 98b210fe39..8f7deaeb35 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/nutanix-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/nutanix-activity.md
@@ -21,7 +21,7 @@ Monitor.
:::note
-Nutanix Files does not report events for activity originating from a server where the
+Nutanix Files doesn't report events for activity originating from a server where the
Activity Monitor Agent is installed.
:::
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/configurefirewall.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/configurefirewall.md
index 50b58da056..ff8b773721 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/configurefirewall.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/configurefirewall.md
@@ -30,11 +30,11 @@ Monitor.
Both classic ONTAPI/ZAPI and the new REST API are supported. Starting with ONTAP 9.13.1, the product
uses REST API by default if it is available. HTTP and HTTPS protocols are supported. For HTTPS, two
-modes are supported: strict and ignore errors. For the strict mode, the product allows you to
-disable the host name validation in case the agent cannot resolve the FQDN of the LIF.
+modes are supported: strict and ignore errors. For the strict mode, you can
+disable the host name validation in case the agent can't resolve the FQDN of the LIF.
Enabling the API access varies depending on ONTAP version. The following sections list common steps
-on enabling the API access. Please refer to the NetApp documentation for more details.
+on enabling the API access. refer to the NetApp documentation for more details.
### Management-http Service
@@ -74,7 +74,7 @@ network interface service-policy add-service -service management-https -policy d
### Firewall Policy
-For ONTAP 9.5 and older, the following commands can be used to either create a new firewall policy
+For ONTAP 9.5 and older, use the following commands to either create a new firewall policy
or modify an existing policy if ONTAPI is blocked.
#### Create New Firewall HTTP Policy
@@ -148,15 +148,15 @@ Verify that the output is displayed as follows:
## FPolicy
The FPolicy framework enables the collection of audit events on the ONTAP side and their transfer to
-the agent(s) via the designated Data LIFs. Each LIF establishes its own connection with one or
+the agents via the designated Data LIFs. Each LIF establishes its own connection with one or
several agents and sends notifications as soon as the file transaction occurs. The FPolicy
connection is asynchronous and buffered; both ONTAP and Activity Monitor have techniques in place to
-make sure that connections are alive and working. The connection can be secured using TLS with
+ensure that connections are alive and working. The connection can be secured using TLS with
server or mutual authentication.
ONTAP cluster nodes connect to the agent on port 9999 by default. The port can be changed in the
-agent's settings. The agent adds this port to Windows Firewall exclusions automatically. Please
-ensure the port is not blocked by other firewalls between ONTAP and the agent.
+agent's settings. The agent adds this port to Windows Firewall exclusions automatically. Ensure
+the port isn't blocked by other firewalls between ONTAP and the agent.
### Data-fpolicy-client Service
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/configurefpolicy.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/configurefpolicy.md
index 58f5dfaf7c..31e97cbdcb 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/configurefpolicy.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/configurefpolicy.md
@@ -13,11 +13,11 @@ There are two ways to configure FPolicy:
- Activity Monitor agent can facilitate the
[Automatic Configuration of FPolicy](#automatic-configuration-of-fpolicy) for the monitored SVM
- using the ONTAP API. This mode is simple, but does not allow you to exclude certain volumes or
+ using the ONTAP API. This mode is simple, but doesn't let you exclude certain volumes or
shares of the SVM from being monitored. It also requires additional permissions to create and
modify FPolicy.
- Another option is to [Manually Configure FPolicy](#manually-configure-fpolicy) for each SVM. This
- mode allows you to fine tune FPolicy by excluding certain volumes or shares from being monitored.
+ mode lets you fine tune FPolicy by excluding certain volumes or shares from being monitored.
It also reduces product permissions.
Regardless of the chosen approach for FPolicy configuration, one also needs to perform extra steps
@@ -88,8 +88,7 @@ locally on the Activity Monitor Console server.
### Create PEM File for Client Certificate
A certificate (Client Certificate) for the SVM needs to be copied to a PEM file. This is required
-for the TLS, mutual authentication option. Follow the steps to create the PEM file for the Client
-Certificate.
+for the TLS, mutual authentication option.
**Step 1 –** On the SVM , use the following command to show the security certificate details:
@@ -105,7 +104,7 @@ security certificate show -vserver testserver -type server instance
**Step 2 –** Copy the security certificate details into a text file and copy the public key to a PEM
file. The following variables from security details will be needed to set mutual-authentication
-during Part 6 of manual configuration and prior to automatic configuration:
+during Part 6 of manual configuration and before automatic configuration:
- SVM
- Common Name
@@ -120,8 +119,7 @@ The Client Certificate PEM file has been created.
## Manually Configure FPolicy
This section describes how to manually configure FPolicy. Manual configuration of the FPolicy is
-recommended if the policy needs to be scoped to monitor select volumes or shares. It is necessary to
-create several FPolicy components and then enable the FPolicy. See the sections corresponding to
+recommended if the policy needs to be scoped to monitor select volumes or shares. Create several FPolicy components and then enable the FPolicy. See the sections corresponding to
each part of this list:
- Part 1: Install Server Certificate on the SVM (only if using TLS authentication)
@@ -135,7 +133,7 @@ each part of this list:
- Part 3: Create FPolicy Events
- - An FPolicy event defines which protocol(s) to monitor and which file access events to monitor.
+ - An FPolicy event defines which protocols to monitor and which file access events to monitor.
- Part 4: Create FPolicy Policy
@@ -156,7 +154,7 @@ each part of this list:
- Part 7: Enable the FPolicy
- - Once the FPolicy is enabled, the Activity Monitor Agent can be configured to monitor the SVM.
+ - After you enable the FPolicy, the Activity Monitor Agent can be configured to monitor the SVM.
- Part 8: Connect FPolicy Server / Agent to Cluster Node (optional)
@@ -165,7 +163,7 @@ each part of this list:
### Part 1: Install Server Certificate on the SVM
-If using the TLS authentication options, it is necessary to install the Server Certificate on the
+If using the TLS authentication options, install the Server Certificate on the
SVM.
Use the following command to install the Server Certificate:
@@ -211,8 +209,7 @@ IMPORTANT:
in any of the proxy mode options.
- The following values are required:
- - `engine-name StealthAUDITEngine`, the names of the external engine object can be customized
- (see below).
+ - `engine-name StealthAUDITEngine`, the names of the external engine object can be customized. See [Customization of FPolicy Object Names](#customization-of-fpolicy-object-names).
- `port 9999`, Port number can be customized, but it is recommended to use 9999.
- `extern-engine-type asynchronous`
- `ssl-option no-auth`
@@ -249,7 +246,7 @@ Verify that the output is displayed as follows:
-Relevant NetApp Documentation: To learn more about creating an external engine, please visit the
+Relevant NetApp Documentation: For more information about creating an external engine, visit the
NetApp website and read the
[vserver fpolicy policy external-engine create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-external-engine-create.html)
article.
@@ -262,7 +259,7 @@ IMPORTANT:
- The SVM used must be the SVM hosting the CIFS or NFS shares to be monitored.
- Enterprise Auditor and the Activity Monitor are capable of monitoring both NFS and CIFS. However,
- it is necessary to create separate events for each protocol.
+ create separate events for each protocol.
- The following values are required:
- `event-name`
@@ -281,8 +278,8 @@ IMPORTANT:
reported.
- Limiting the file operations to be monitored is an excellent way to limit the performance impact
- the FPolicy will have on the NetApp device. The file operations from which to choose are below
- with additional filter options:
+ the FPolicy will have on the NetApp device. The following file operations can be monitored with
+ additional filter options:
- `create` – File create operations
- `create_dir` – Directory create operations
@@ -308,12 +305,11 @@ IMPORTANT:
- `read` – File read operations
- `first-read` – Limits notification to only first read operations for CIFS protocol. For
- ONTAP 9.2+, this filter can be used for both CIFS and NFS protocols.
+ ONTAP 9.2+, use this filter for both CIFS and NFS protocols.
- - `rename`– File rename operations
- - `rename_dir`– Directory rename operations
- - `setattr` – Set attribute operations and permission changes. The following filters are
- available for ONTAP 9.0+ to limit events to permission changes only:
+ - `rename` – File rename operations
+ - `rename_dir` – Directory rename operations
+ - `setattr` – Set attribute operations and permission changes. The following filters let you limit events to permission changes only in ONTAP 9.0+:
- CIFS:
@@ -340,7 +336,7 @@ IMPORTANT:
- `write` – File write operations
- `first-write` – Limits notification to only first write operations for CIFS protocol. For
- ONTAP 9.2+, this filter can be used for both CIFS and NFS protocols.
+ ONTAP 9.2+, use this filter for both CIFS and NFS protocols.
- For failed/denied events, the list of supported file operations is limited to the following
values:
@@ -410,7 +406,7 @@ Verify that the output is displayed as follows:
-Relevant NetApp Documentation: To learn more about creating an event, please visit the NetApp
+Relevant NetApp Documentation: For more information about creating an event, visit the NetApp
website and read the
[vserver fpolicy policy event create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-event-create.html)
article.
@@ -490,7 +486,7 @@ fpolicy policy show -instance
-Relevant NetApp Documentation: To learn more about creating a policy, please visit the NetApp
+Relevant NetApp Documentation: For more information about creating a policy, visit the NetApp
website and read the
[vserver fpolicy policy create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-create.html)
article.
@@ -504,10 +500,10 @@ variable [SVM_NAME] in the command with an asterisk (\*).
IMPORTANT:
- The SVM used must be the SVM hosting the CIFS or NFS shares to be monitored.
-- It is not necessary to specify both volumes and shares. One or the other is sufficient.
+- It isn't necessary to specify both volumes and shares. One or the other is sufficient.
- If you want to monitor everything, set the "`volumes-to-include`" value to "`*`".
-Use the following command to create the FPolicy scope by specifying volume(s):
+Use the following command to create the FPolicy scope by specifying volumes:
```
vserver fpolicy policy scope create -vserver [SVM_NAME] -policy-name StealthAUDIT -volumes-to-include [VOLUME_NAME],[VOLUME_NAME]
@@ -519,7 +515,7 @@ Example:
vserver fpolicy policy scope create -vserver testserver -policy-name StealthAUDIT -volumes-to-include samplevolume1,samplevolume2
```
-Use the following command to create the FPolicy scope by specifying share(s):
+Use the following command to create the FPolicy scope by specifying shares:
```
vserver fpolicy policy scope create -vserver [SVM_NAME] -policy-name StealthAUDIT -shares-to-include [SHARE_NAME],[SHARE_NAME]
@@ -541,14 +537,14 @@ fpolicy policy scope show -instance
-Relevant NetApp Documentation: To learn more about creating scope, please visit the NetApp website
+Relevant NetApp Documentation: For more information about creating scope, visit the NetApp website
and read the
[vserver fpolicy policy scope create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-scope-create.html)
article.
### Part 6: Set TLS Authentication
-If using the TLS authentication options, it is necessary to set authentication for the type of
+If using the TLS authentication options, set authentication for the type of
authentication.
#### Set Server-Authentication
@@ -617,7 +613,7 @@ vserver fpolicy show
-Relevant NetApp Documentation: To learn more about enabling a policy, please visit the NetApp
+Relevant NetApp Documentation: For more information about enabling a policy, visit the NetApp
website and read the
[vserver fpolicy enable](https://docs.netapp.com/us-en/ontap-cli-9121//vserver-fpolicy-enable.html)
article.
@@ -663,7 +659,7 @@ will also be necessary to set mutual authentication on the SVM.
### Set TLS Mutual-Authentication
-If using the TLS, mutual authentication options, it is necessary to set authentication.
+If using the TLS, mutual authentication options, set authentication.
Use the following command to set mutual-authentication:
@@ -702,6 +698,6 @@ These names can be customized in the monitored host's settings in the Activity M
useful in two scenarios:
- You want the names to match the company policies;
-- You want to configure FPolicy manually using your custom names, but also want to leverage the
+- You want to configure FPolicy manually using your custom names, but also want to use the
"Enable and Connect FPolicy" feature of the Activity Monitor, so that the product ensures that
FPolicy stays enabled and connected at all times.
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/ontap-cluster-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/ontap-cluster-activity.md
index aa023fe948..877ce73659 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/ontap-cluster-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/ontap-cluster-activity.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# NetApp Data ONTAP Cluster-Mode Activity Auditing Configuration
-The Activity Monitor agent employed to monitor NetApp leverages NetApp ONTAP API, and the NetApp
+The Activity Monitor agent employed to monitor NetApp uses NetApp ONTAP API and the NetApp
FPolicy framework to monitor file system events. This includes both NetApp 7-Mode and Cluster-Mode
configurations. For more information about FPolicy read the
[What are the two parts of the FPolicy solution ](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html)
@@ -25,30 +25,29 @@ list of volumes, list of LIFs. Depending on the configuration, the agent can als
of FPolicy to ensure it is enabled; configure FPolicy and register or unregister itself.
The FPolicy framework enables the collection of audit events on the ONTAP side and their transfer to
-the agent(s) via the designated Data LIFs. Each LIF establishes its own connection with one or
+the agents via the designated Data LIFs. Each LIF establishes its own connection with one or
several agents and sends notifications as soon as the file transaction occurs. The FPolicy
connection is asynchronous and buffered; both ONTAP and Activity Monitor have techniques in place to
-make sure that connections are alive and working. The connection can be secured using TLS with
+ensure that connections are alive and working. The connection can be secured using TLS with
server or mutual authentication.
FPolicy may have a significant impact on file system throughput, and it is always a best practice to
monitor performance when enabling FPolicy.
:::info
-Create a tailored FPolicy which only collects the desired activity from the
-environment to limit the scope and impact.
+Create a tailored FPolicy that collects only the activity you want from the environment to limit the scope and impact.
:::
For scale-out and fault tolerance purposes, the product supports a range of deployment options. A
single agent can receive events from multiple SVMs. Or events from a single SVM can be distributed
among multiple agents. Or a set of SVMs can distribute events among a set of agents. The choice
-depends on the fault tolerance requirements and the expected event flow. As a rule of thumb, the
-_average_ load on a single agent should not exceed 5000 events per second.
+depends on the fault tolerance requirements and the expected event flow. As a general guideline, the
+_average_ load on a single agent shouldn't exceed 5000 events per second.
**Configuration Checklist**
-Complete the following checklist prior to configuring the activity monitoring of NetApp Data ONTAP
+Complete the following checklist before configuring the activity monitoring of NetApp Data ONTAP
Cluster-Mode devices. Instructions for each item of the checklist are detailed within the following
sections.
@@ -56,10 +55,10 @@ sections.
- Gather the following information:
- - Names of the SVM(s) to be monitored
+ - Names of the SVMs to be monitored
- FPolicy is configured for each SVM separately
- - This should be the SVM(s) hosting the CIFS or NFS shares(s) to be monitored
+ - This should be the SVMs hosting the CIFS or NFS sharess to be monitored
- Credentials to access ONTAP to provision a role and account.
- Desired functionality level:
@@ -80,7 +79,7 @@ sections.
- Limiting the FPolicy to specific file operations is an effective way to limit the
performance impact of FPolicy
- - IP Address of the server(s) where the Activity Monitor Agent is deployed
+ - IP Address of the servers where the Activity Monitor Agent is deployed
- API enabled in ONTAP: the classic ONTAPI/ZAPI or the new REST API
- The product supports the REST API for ONTAP 9.13.1 and above.
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/provisionactivity.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/provisionactivity.md
index 4a46fafadb..c14e97b3fa 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/provisionactivity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/provisionactivity.md
@@ -26,7 +26,7 @@ The permissions needed depends on the functionality level:
- Least Privileged: ONLY Collect Events – This is the minimal functionality level. A user manually
configures FPolicy and ensures that it stays enabled and connected. The product only collects
- events. This functionality level is not recommended as it requires an additional solution that
+ events. This functionality level isn't recommended as it requires an additional solution that
tracks the state of FPolicy and fixes the problem should ONTAP disconnect or should the policy
become disabled.
- **_RECOMMENDED:_** Less Privileged: Enable/Connect Policy & Collect Events – With this level, the
@@ -105,7 +105,7 @@ security login rest-role create -role enterpriseauditorrest -api "/api/svm/svms"
```
:::note
-If the FPolicy account is configured with these permissions, it is necessary to manually
+If the FPolicy account is configured with these permissions, manually
configure the FPolicy. See the
[Configure FPolicy](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/configurefpolicy.md)
topic for additional information.
@@ -130,7 +130,7 @@ permissions to collect events:
:::tip
Remember, this permission permits the Activity Monitor to enable the FPolicy. If the “Enable
- and connect FPolicy” option is employed but the permission is not provided, the agent will
+ and connect FPolicy” option is employed but the permission isn't provided, the agent will
encounter “Failed to enable policy” errors, but it will still be able to connect to the FPolicy.
Since this permission model requires a manual configuration of the FPolicy, then the need to
manually enable the FPolicy will be met.
@@ -195,7 +195,7 @@ security login rest-role create -role enterpriseauditorrest -api "/api/protocols
```
:::note
-If the FPolicy account is configured with these permissions, it is necessary to manually
+If the FPolicy account is configured with these permissions, manually
configure the FPolicy. See the
[Configure FPolicy](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap-cluster-aac/configurefpolicy.md)
topic for additional information.
@@ -345,7 +345,7 @@ article.
## Part 2: Create Security Login
-Once the access control role has been created, apply it to a domain account. Ensure the following
+After the access control role has been created, apply it to a domain account. Ensure the following
requirements are met:
- The SVM used in the following command must be the same SVM used when creating the access control
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/configurefpolicy.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/configurefpolicy.md
index 99ba41585d..ebbf947a2e 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/configurefpolicy.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/configurefpolicy.md
@@ -30,7 +30,7 @@ A tailored FPolicy
## Manually Configure FPolicy (Recommended Option)
This section describes how to manually configure FPolicy. Manual configuration of the FPolicy is
-recommended so that the policy can be scoped. It is necessary to create six FPolicy components and
+recommended so that the policy can be scoped. You must create six FPolicy components and
then enable the FPolicy. See the sections corresponding to each part of this list:
- [Part 1: Create FPolicy](#part-1-create-fpolicy)
@@ -46,8 +46,7 @@ vFiler. This is because FPolicy operates on the affected vFiler. Therefore, when
commands on a vFiler, the commands must be run from a vFiler context (e.g. via the vFiler run
command).
-Relevant NetApp Documentation: To learn more about configuring file policies, please visit the
-NetApp website and read
+Relevant NetApp Documentation: For details on configuring file policies, see the NetApp
[na_fpolicy – configure file policies](https://library.netapp.com/ecmdocs/ECMP1196890/html/man1/na_fpolicy.1.html)
article.
@@ -68,8 +67,8 @@ fpolicy create StealthAUDIT screen
### Part 2: Set FPolicy Required to Off
-If the `FPolicy Required` value is set to on, user requests are denied if an FPolicy server is not
-available to implement the policy. If it is set to off, user requests are allowed when it is not
+If the `FPolicy Required` value is set to on, user requests are denied if an FPolicy server isn't
+available to implement the policy. If it is set to off, user requests are allowed when it isn't
possible to apply the policy to the file because no FPolicy server is available.
IMPORTANT:
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/customizefpolicy.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/customizefpolicy.md
index 77843dad69..4d90aecbe9 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/customizefpolicy.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/customizefpolicy.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Customize FPolicy Policy Name
There may be situations when FPolicy needs to be named something other than StealthAUDIT. In those
-cases it is necessary to manually add a parameter to the Activity Monitor agent’s `sbtfilemon.ini`
+cases, manually add a parameter to the Activity Monitor agent’s `sbtfilemon.ini`
file. After the monitoring agent has been deployed, follow the steps.
**Step 1 –** Open to the `sbtfilemon.ini` file on the agent server in a text editor:
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/ontap7-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/ontap7-activity.md
index 90361e176b..1c0f0de298 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/ontap7-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/ontap7-activity.md
@@ -6,18 +6,16 @@ sidebar_position: 70
# NetApp Data ONTAP 7-Mode Activity Auditing Configuration
-The Activity Monitor agent employed to monitor NetApp leverages 128-bit encrypted Remote Procedure
-Calls (RPC), NetApp ONTAP-API, and NetApp FPolicy to monitor file system events. This includes both
-NetApp 7-Mode and Cluster-Mode configurations. To learn more about FPolicy please visit the NetApp
-website and read the
-[What FPolicy is](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html)
-article.
+The Activity Monitor agent uses 128-bit encrypted Remote Procedure Calls (RPC), NetApp ONTAP-API, and NetApp FPolicy to monitor file system events. This includes both
+NetApp 7-Mode and Cluster-Mode configurations. For more information about FPolicy, see the NetApp
+article
+[What FPolicy is](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html).
If the activity agent is stopped, a notification will be sent to the NetApp device to disconnect and
disable the associated FPolicy policy, but it will not be removed.
If the network connection is lost between the activity agent and the NetApp device, the NetApp
-device is configured with a default timeout to wait for a response. If a response is not received
+device is configured with a default timeout to wait for a response. If a response isn't received
from the Activity Agent within the timeout, then the NetApp device will disconnect and disable the
FPolicy policy. The Activity Agent will check every minute by default to see if the FPolicy policy
has been disabled and will enable it (if the auto-enable functionality is enabled for the agent).
@@ -29,7 +27,7 @@ No activity log file will be created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of NetApp Data ONTAP
+Complete the following checklist before configuring activity monitoring of NetApp Data ONTAP
7-Mode devices. Instructions for each item of the checklist are detailed within the following
topics.
@@ -37,7 +35,7 @@ topics.
- Gather the following information:
- Names of the vFiler™(s) to be monitored
- - DNS name of the CIFS shares(s) to be monitored
+ - DNS name of the CIFS sharess to be monitored
Checklist Item 2:
[Provision FPolicy Account](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/provisionactivity.md)
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/provisionactivity.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/provisionactivity.md
index 690a741a7c..dc85c2af7f 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/provisionactivity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/ontap7-aac/provisionactivity.md
@@ -16,10 +16,9 @@ Provisioning this account is a three part process:
- Part 2: Create a Group & Assign Role
- Part 3: Add User to Group
-Relevant NetApp Documentation: To learn more about node access controls, please visit the NetApp
-website and read the
-[na_useradmin – Administers node access controls](https://library.netapp.com/ecmdocs/ECMP1511537/html/man1/na_useradmin.1.html)
-article.
+Relevant NetApp Documentation: For information about node access controls, see the NetApp
+article
+[na_useradmin – Administers node access controls](https://library.netapp.com/ecmdocs/ECMP1511537/html/man1/na_useradmin.1.html).
## Part 1: Create Role with API/CLI Access
@@ -74,7 +73,7 @@ After the role is created, complete Part 2: Create a Group & Assign Role.
## Part 2: Create a Group & Assign Role
-Once the role has been created, it must be attached to a group. The following command needs to be
+After the role has been created, it must be attached to a group. The following command needs to be
run to create a group and assign the role to it.
```
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/panzura-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/panzura-activity.md
index 1bcf555857..d23ca82bb6 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/panzura-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/panzura-activity.md
@@ -68,13 +68,13 @@ The product will also ensure the settings are correct with periodic checks.
## Manual Configuration
-Follow these steps to enable auditing.
+To enable auditing, complete the following:
**Step 1 –** Navigate to **Audit Settings** > **Third Party Support**.
**Step 2 –** Enable the **Generate Third Party Logs** option.
-**Step 3 –** Enable the **Push to Subordinate(s)** option.
+**Step 3 –** Enable the **Push to Subordinates** option.
**Step 4 –** Enter **other** as the Vendor Name.
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/auditing.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/auditing.md
index cd16fb2206..9c5e59f98c 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/auditing.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/auditing.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Enable Auditing for Dell PowerStore
-Follow the steps to enable auditing on Dell PowerStore.
+To enable auditing on Dell PowerStore, complete the following:
- [Create an Event Publishing Pool](#create-an-event-publishing-pool)
- [Create an Event Publisher](#create-an-event-publisher)
@@ -19,7 +19,7 @@ white paper for additional information.
## Create an Event Publishing Pool
-Follow the steps tTo create a new event publishing pool.:
+To create a new event publishing pool, complete the following:
**Step 1 –** Select **Storage** > **NAS Servers** > **NAS Settings** > **Publishing Pools**.
@@ -65,7 +65,7 @@ Follow the steps tTo create a new event publishing pool.:
## Create an Event Publisher
-Follow the steps tTo create a an event publisher.:
+To create an event publisher, complete the following:
**Step 1 –** Select **Storage** > **NAS Servers** > **NAS Settings** > **Events Publishers**.
@@ -93,7 +93,7 @@ The events publisher is created.
## Enable Event Publishing for the NAS Server
-Follow the steps tTo enable or disable event publishing for the NAS Server.:
+To enable event publishing for the NAS Server, complete the following:
**Step 1 –** Select **Storage** > **NAS Servers**.
@@ -112,8 +112,7 @@ Dell PowerStore is enabled for auditing.
## Enable or Disable Event Publishing for File System
-Follow the steps toYou can enable or disable the feature for each file system individually. using
-the following:
+To enable or disable event publishing for each file system individually, complete the following:
**Step 1 –** Select **Storage** > **File Systems** > **[FILE SYSTEM]** > **Security & Events** >
**Events Publishing**.
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/installcee.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/installcee.md
index f0da41459e..30ec5bea82 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/installcee.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,8 +20,6 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
-
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -41,8 +39,7 @@ asynchronous bulk delivery (VCAPS) feature.
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -52,12 +49,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
@@ -74,5 +71,5 @@ Examples:
**Step 8 –** Open Services (run `services.msc`). Start or Restart the EMC CEE Monitor service.
-The Dell CEE registry key is now properly configured to forward event to the Activity Monitor
+The Dell CEE registry key is now properly configured to forward events to the Activity Monitor
activity agent.
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/powerstore-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/powerstore-activity.md
index 76a160373a..7ba2b4c1b8 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/powerstore-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/powerstore-activity.md
@@ -20,12 +20,11 @@ activity log file is created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Dell PowerStore
-devices. Instructions for each item of the checklist are detailed within the following topics.
+Before configuring activity monitoring of Dell PowerStore devices, complete the following checklist. Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment
+- Before beginning the deployment
- See the
[Dell PowerStore: File Capabilities](https://www.delltechnologies.com/asset/en-us/products/storage/industry-market/h18155-dell-powerstore-file-capabilities.pdf)
@@ -37,7 +36,7 @@ devices. Instructions for each item of the checklist are detailed within the fol
Checklist Item 2:
[Install Dell CEE](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/powerstore-aac/installcee.md)
-- Dell CEE should be installed on the Windows proxy server(s) where the Activity Monitor activity
+- Dell CEE should be installed on the Windows proxy servers where the Activity Monitor activity
agent will be deployed
:::info
@@ -48,7 +47,7 @@ Checklist Item 2:
- Important:
- Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE is
+ Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE is
installed
**Checklist Item 3: Dell PowerStore Device Configuration**
@@ -71,8 +70,8 @@ Checklist Item 2:
Checklist Item 5: Configure Dell CEE to Forward Events to the Activity Agent
:::note
-When Dell CEE is installed on Windows proxy server(s) where the Activity Monitor activity
-agent will be deployed, the following steps are not needed.
+When Dell CEE is installed on Windows proxy servers where the Activity Monitor activity
+agent will be deployed, the following steps aren't needed.
:::
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/qumulo-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/qumulo-activity.md
index 30c80f01f7..e0687a2fdb 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/qumulo-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/qumulo-activity.md
@@ -32,7 +32,7 @@ advanced filtering of Microsoft Office activity also requires the JSON format.
The JSON format for audit events was introduced in Qumulo Core 6.0.1. The new format can be enabled
via an SSH session to the Qumulo cluster.
-Follow the steps to verify that audit event format and change the format, if needed.
+To verify that audit event format and change the format if needed, follow these steps:
**Step 1 –** Connect to the Qumulo cluster with SSH.
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/installcee.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/installcee.md
index 6d82f42b10..39fff63318 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/installcee.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -19,9 +19,6 @@ The Dell CEE package can be installed on the Windows server where the Activity
Monitor agent will be deployed (recommended) or on any other Windows or Linux server.
:::
-
-Follow the steps to install the Dell CEE.
-
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -38,14 +35,13 @@ asynchronous bulk delivery (VCAPS) feature.
:::
-After Dell CEE installation is complete, it is necessary to complete the
+After Dell CEE installation is complete, complete the
[Unity Initial Setup with Unisphere](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/setupunisphere.md).
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -55,12 +51,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/setupunisphere.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/setupunisphere.md
index a8be8dce3d..137606bd06 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/setupunisphere.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/setupunisphere.md
@@ -6,12 +6,10 @@ sidebar_position: 20
# Unity Initial Setup with Unisphere
-Follow the steps to configure the initial setup for a Unity device with Unisphere.
-
**Step 1 –** Edit the NAS Server > Protection and Events > Events Publishing > Select Pool settings:
-- Add CEPA server – This is the server where CEE is installed. It is recommended that this is also
- the server were the Activity Monitor activity agent is deployed.
+- Add CEPA server – This is the server where CEE is installed. This should also be
+ the server where the Activity Monitor activity agent is deployed.
- Enable the following events for Post Events.
Required Unity events needed for CIFS Activity:
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/unity-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/unity-activity.md
index dd21de6b40..332d1cf44b 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/unity-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/unity-activity.md
@@ -20,14 +20,14 @@ activity log file is created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Dell Unity devices.
+Complete the following checklist before configuring activity monitoring of Dell Unity devices.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - Data Mover or Virtual Data Mover hosting the share(s) to be monitored
+ - Data Mover or Virtual Data Mover hosting the shares to be monitored
- Account with access to the CLI
- Download the Dell CEE from:
@@ -36,7 +36,7 @@ Instructions for each item of the checklist are detailed within the following to
Checklist Item 2:
[Install Dell CEE](/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/installcee.md)
-- Dell CEE should be installed on the Windows proxy server(s) where the Activity Monitor activity
+- Dell CEE should be installed on the Windows proxy servers where the Activity Monitor activity
agent will be deployed
:::info
@@ -47,9 +47,9 @@ Checklist Item 2:
- Important:
- - Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE
+ - Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE
is installed
- - Dell CEE 8.4.2 through Dell CEE 8.6.1 are not supported for use with the VCAPS feature
+ - Dell CEE 8.4.2 through Dell CEE 8.6.1 aren't supported for use with the VCAPS feature
- Dell CEE requires .NET Framework 3.5 to be installed on the Windows proxy server
**Checklist Item 3: Dell Unity Device Configuration**
@@ -70,8 +70,8 @@ Checklist Item 2:
Checklist Item 5: Configure Dell CEE to Forward Events to the Activity Agent
:::note
-When Dell CEE is installed on Windows proxy server(s) where the Activity Monitor activity
-agent will be deployed, the following steps are not needed.
+When Dell CEE is installed on Windows proxy servers where the Activity Monitor activity
+agent will be deployed, the following steps aren't needed.
:::
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/validate.md b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/validate.md
index a35b512db2..17672d5731 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/validate.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/nasdeviceconfiguration/unity-aac/validate.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
+After the Activity Monitor agent is configured to monitor the Dell device, the automated
configuration must be validated to ensure events are being monitored.
## Validate CEE Registry Key Settings
@@ -21,10 +21,10 @@ topic for information on manually setting the registry key.
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
+a different server than the Windows proxy servers where the Activity Monitor activity agent is
deployed.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -91,7 +91,7 @@ additional information.
## Validate Dell CEE Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -121,19 +121,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/sharepoint-online-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/sharepoint-online-activity.md
index 5483042801..38dab95f5e 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/sharepoint-online-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/sharepoint-online-activity.md
@@ -6,8 +6,7 @@ sidebar_position: 60
# SharePoint Online Activity Auditing Configuration
-In order to collect logs and monitor SharePoint Online activity using the Netwrix Activity Monitor,
-it needs to be registered with Microsoft® Entra ID® (formerly Azure AD).
+To collect logs and monitor SharePoint Online activity, you must register Netwrix Activity Monitor with Microsoft® Entra ID® (formerly Azure AD).
:::note
A user account with the Global Administrator role is required to register an app with
@@ -26,14 +25,14 @@ additional information.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+After you register the application, you need the following settings from your tenant:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
+ It isn't possible to retrieve the value after saving the new key. It must be
copied first.
:::
@@ -55,7 +54,7 @@ The following settings are needed from your tenant once you have registered the
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
+To register Activity Monitor with Microsoft Entra ID, follow these steps:
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
@@ -88,7 +87,7 @@ application. Now that the application has been registered, permissions need to b
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
+To grant permissions to the registered application, follow these steps:
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
@@ -136,7 +135,7 @@ be collected.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
+To find the registered application's Client ID, follow these steps:
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
@@ -174,7 +173,7 @@ application’s Client Secret Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
+To find the tenant name where the registered application resides, follow these steps:
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
@@ -194,8 +193,7 @@ application’s Client Secret Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
-value when saving the new key.
+To find the registered application's Client Secret, create a new key, and save its value, follow these steps:
:::note
The steps below are for the Microsoft Entra Admin Center. These steps might vary slightly
@@ -205,7 +203,7 @@ additional information.
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
+It isn't possible to retrieve the value after saving the new key. It must be copied
first.
:::
@@ -232,7 +230,7 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
+If this page is left before the key is copied, then the key isn't retrievable, and
this process will have to be repeated.
:::
@@ -246,15 +244,14 @@ This is needed for adding a SharePoint Online host in the Activity Monitor.
## Enable Auditing for SharePoint Online
-Follow the steps to enable auditing for SharePoint Online so the Activity Monitor can receive
-events.
+To enable auditing for SharePoint Online so the Activity Monitor can receive events, follow these steps:
**Step 1 –** In the Microsoft Purview compliance portal at
[https://compliance.microsoft.com](https://compliance.microsoft.com/), go to **Solutions** >
**Audit**. Or, to go directly to the Audit page at
[https://compliance.microsoft.com/auditlogsearch](https://compliance.microsoft.com/auditlogsearch).
-**Step 2 –** If auditing is not turned on for your organization, a banner is displayed prompting you
+**Step 2 –** If auditing isn't turned on for your organization, a banner is displayed prompting you
start recording user and admin activity.
**Step 3 –** Select the **Start recording** user and **admin activity** banner.
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/sqlserver-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/sqlserver-activity.md
index f735298b95..6a43fe1548 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/sqlserver-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/sqlserver-activity.md
@@ -6,8 +6,7 @@ sidebar_position: 70
# SQL Server Activity Auditing Configuration
-In order for the Netwrix Activity Monitor to monitor SQL Server activity, a SQL login with certain
-server permissions, and must be mapped to user databases.
+To monitor SQL Server activity with Netwrix Activity Monitor, create a SQL login with certain server permissions and map it to user databases.
## SQL Database Server Permissions
@@ -70,7 +69,7 @@ declare @s varchar(max)='';select @s=@s+(case when @s<>'' then char(13)+char(10)
## Logon Trigger (Optional)
The logon trigger is required to obtain IP Addresses of client connections. Run the following script
-in order to allow the Activity Monitor to report client IP Addresses.
+to allow the Activity Monitor to report client IP Addresses.
```
CREATE TRIGGER SBAudit_LOGON_Trigger ON ALL SERVER FOR LOGON AS BEGIN declare @str varchar(max)=cast(EVENTDATA() as varchar(max));raiserror(@str,1,1);END
diff --git a/docs/activitymonitor/7.1/requirements/activityagent/windowsfs-activity.md b/docs/activitymonitor/7.1/requirements/activityagent/windowsfs-activity.md
index d02b223d36..2d5338d61e 100644
--- a/docs/activitymonitor/7.1/requirements/activityagent/windowsfs-activity.md
+++ b/docs/activitymonitor/7.1/requirements/activityagent/windowsfs-activity.md
@@ -7,12 +7,12 @@ sidebar_position: 80
# Windows File Server Activity Auditing Configuration
In order for the Netwrix Activity Monitor to monitor Windows file server activity, an Activity Agent
-must be deployed to the server. It cannot be deployed to a proxy server. However, additional
+must be deployed to the server. It can't be deployed to a proxy server. However, additional
considerations are needed when targeting a Windows File System Clusters or DFS Namespaces.
## Windows File System Clusters
-In order to monitor a Windows File System Cluster, an Activity Agent needs to be deployed on all
+to monitor a Windows File System Cluster, an Activity Agent needs to be deployed on all
nodes that comprise the Windows File System Cluster. The credential used to deploy the Activity
Agent must have the following permissions on the server:
@@ -24,13 +24,13 @@ It is also necessary to enable the Remote Registry Service on the Activity Agent
For integration between the Activity Monitor and Enterprise Auditor, the credential used by
Enterprise Auditor to read the activity log files must have also have this permission.
-After the agent has been deployed, it is necessary to modify the HOST parameter in the
+After the agent has been deployed, modify the HOST parameter in the
`SBTFilemon.ini` file to be the name of the cluster. For integration with Netwrix Enterprise
Auditor, this must be an exact match to the name of the cluster in the Master Host Table.
## DFS Namespaces
-In order to monitor activity on DFS Namespaces, an Activity Agent needs to be deployed on all DFS
+to monitor activity on DFS Namespaces, an Activity Agent needs to be deployed on all DFS
servers.
:::note
diff --git a/docs/activitymonitor/7.1/requirements/adagent/activity/activity.md b/docs/activitymonitor/7.1/requirements/adagent/activity/activity.md
index a9b357b406..4cfdc094a9 100644
--- a/docs/activitymonitor/7.1/requirements/adagent/activity/activity.md
+++ b/docs/activitymonitor/7.1/requirements/adagent/activity/activity.md
@@ -31,8 +31,7 @@ In this method, you will be deploying two agents:
- Next, deploy the AD Agent to all domain controllers in the target domain.
-Follow the steps to setup integration between Activity Monitor and Enterprise Auditor through an API
-server.
+## Set Up Integration
**Step 1 –** Deploy the Activity Agent to the API server.
@@ -42,7 +41,6 @@ The next step is to configure the agent deployed to the API server.
## Configure API Server Agent
-Follow the steps to configure the agent deployed to the API server.
**Step 1 –** On the Agents tab of the Activity Monitor Console, select the agent deployed to the
API server.
@@ -64,7 +62,7 @@ API server.
- Click **Copy** and save the Client Secret value to a text file.
:::warning
- It is not possible to retrieve the value after closing the Add or edit
+ It isn't possible to retrieve the value after closing the Add or edit
API client window. It must be copied first.
:::
@@ -74,9 +72,9 @@ API server.
if desired.
- Click **OK** to save the configuration and close the Add or edit API client window.
-- If the Activity Monitor Console server is not the API Server, then click **Use this console** to
+- If the Activity Monitor Console server isn't the API Server, then click **Use this console** to
grant the Activity Monitor the ability to manage the API server.
-- The IPv4 or IPv6 allowlist allows you to limit access to the API server data to specific hosts.
+- Use the IPv4 or IPv6 allowlist to limit access to the API server data to specific hosts.
**Step 4 –** Click **OK** to save the configuration and close the Agent properties window.
@@ -84,7 +82,6 @@ The next step is to configure the agents deployed to the domain controllers.
## Configure Domain Controller Agent
-Follow the steps to configure the agent deployed to the domain controller.
**Step 1 –** On the Agents tab of the Activity Monitor Console, select an agent deployed to domain
controller.
@@ -95,9 +92,9 @@ controller.
- Select the **Enable Archiving for this agent** checkbox.
- Select the **Archive log files on a UNC path** option. Click the **...** button and navigate to
- the desired network share on the API server.
+ the network share you want on the API server.
- The **User name** and **User password** fields only need to be filled in if the account used to
- install the agent does not have access to this share.
+ install the agent doesn't have access to this share.
:::tip
Remember, The account used to install the agent on a domain controller is a Domain
@@ -119,11 +116,11 @@ Follow the steps configure the monitored domain output for Netwrix Enterprise Au
**Step 1 –** Select the **Monitored Domains** tab.
-**Step 2 –** Select the desired domain and click **Add Output**. The Add New Ouptut window opens.
+**Step 2 –** Select the domain you want and click **Add Output**. The Add New Ouptut window opens.
**Step 3 –** Configure the following:
-- Configure the desired number of days for the **Period to keep Log files**. This is the number of
+- Configure the number of days you want for the **Period to keep Log files**. This is the number of
days the log files are kept on the API server configured in the sections above. This needs to be
set to a greater value than the days between Enterprise Auditor scans.
@@ -142,7 +139,6 @@ Enterprise Auditor now has access to the agent log files for this domain.
## Configure Enterprise Auditor Connection Profile
-Follow the steps to configure the Connection Profile in Enterprise Auditor.
:::tip
Remember, the Client ID and Client Secret were generated by the API server and copied to a text
@@ -172,7 +168,7 @@ name.
Group. Select the **Settings > Connection** node.
**Step 7 –** Select the **Select one of the following user defined profiles** option. Expand the
-drop-down menu and select the Connection Profile with this credential.
+dropdown menu and select the Connection Profile with this credential.
**Step 8 –** Click **Save** and then **OK** to confirm the changes to the job group settings.
@@ -180,8 +176,7 @@ The Connection Profile will now be used for AD Activity collection.
## Configure the AD_ActivityCollection Job
-The Enterprise Auditor requires additional configurations in order to collect domain activity data.
-Follow the steps to configure the **AD_ActivityCollection** Job.
+The Enterprise Auditor requires additional configurations to collect domain activity data.
:::note
Ensure that the **.Active Directory Inventory** Job Group has been successfully run
@@ -252,20 +247,19 @@ logs.
### (Optional) Configure Import of AD Activity into Netwrix Access Information Center
AD Activity data can be imported into Netwrix Access Information Center by the
-**AD_ActivityCollection** Job. However, this is disabled by default. Follow the steps to enable the
-importing of AD activity data into the Access Information Center.
+**AD_ActivityCollection** Job. However, this is disabled by default.
**Step 1 –** Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **0.Collection** >
**AD_ActivityCollection** Job.
**Step 2 –** On the job's Overview page, enable the import of AD Events.
-- Click on the **Enable to import AD events into the AIC** parameter.
+- Click the **Enable to import AD events into the AIC** parameter.
- On the Parameter Configuration window, select the **Enabled** checkbox and click **Save**.
**Step 3 –** On the job's Overview page, enable the import of authentication Events.
-- Click on the **Enable to import authentication events into the AIC** parameter.
+- Click the **Enable to import authentication events into the AIC** parameter.
- On the Parameter Configuration window, select the **Enabled** checkbox and click **Save**.
**Step 4 –** Optionally, modify the **List of attributes to track for Object Modified changes** and
diff --git a/docs/activitymonitor/7.1/requirements/adagent/activity/filearchive.md b/docs/activitymonitor/7.1/requirements/adagent/activity/filearchive.md
index 077a809fb8..26de0a368e 100644
--- a/docs/activitymonitor/7.1/requirements/adagent/activity/filearchive.md
+++ b/docs/activitymonitor/7.1/requirements/adagent/activity/filearchive.md
@@ -16,8 +16,6 @@ Deploy the AD Agent to each domain controller in the target domain.
## Configure Domain Controller Agent
-Follow the steps to configure the agent deployed to the domain controller.
-
:::note
These steps assume the network share where the activity log files will be archived already
exists.
@@ -35,7 +33,7 @@ controller.
- Select the **Archive log files on a UNC path** option. Click the ... button and navigate to the
desired network share.
- The **User name** and **User password** fields only need to be filled in if the account used to
- install the agent does not have access to this share.
+ install the agent doesn't have access to this share.
:::tip
Remember, The account used to install the agent on a domain controller is a Domain
@@ -60,11 +58,11 @@ Follow the steps configure the monitored domain output for Netwrix Enterprise Au
**Step 1 –** Select the **Monitored Domains** tab.
-**Step 2 –** Select the desired domain and click **Add Output**. The Add New Ouptut window opens.
+**Step 2 –** Select the domain you want to configure and click **Add Output**. The Add New Ouptut window opens.
**Step 3 –** Configure the following:
-- Configure the desired number of days for the **Period to keep Log files**. This is the number of
+- Configure the number of days for the **Period to keep Log files**. This is the number of
days the log files are kept on the API server configured in the sections above. This needs to be
set to a greater value than the days between Enterprise Auditor scans.
@@ -83,8 +81,6 @@ Enterprise Auditor now has access to the agent log files for this domain.
## Configure Enterprise Auditor Connection Profile
-Follow the steps to configure the Connection Profile in Enterprise Auditor.
-
**Step 1 –** On the Settings > Connection node of the Enterprise Auditor Console, select the
Connection Profile for the Active Directory solution. If you haven't yet created a Connection
Profile or desire a specific one for AD Activity, create a new one and provide a unique descriptive
@@ -111,7 +107,7 @@ name.
the **Settings > Connection** node.
**Step 7 –** Select the **Select one of the following user defined profiles** option. Expand the
-drop-down menu and select the Connection Profile with this credential.
+dropdown menu and select the Connection Profile with this credential.
**Step 8 –** Click **Save** and then **OK** to confirm the changes to the job group settings.
@@ -119,8 +115,7 @@ The Connection Profile will now be used for AD Activity collection.
## Configure the AD_ActivityCollection Job
-The Enterprise Auditor requires additional configurations in order to collect domain activity data.
-Follow the steps to configure the **AD_ActivityCollection** Job.
+The Enterprise Auditor requires additional configurations to collect domain activity data.
:::note
Ensure that the .Active Directory Inventory Job Group has been successfully run against
diff --git a/docs/activitymonitor/7.1/requirements/adagent/adagent.md b/docs/activitymonitor/7.1/requirements/adagent/adagent.md
index fbb4521fed..f180d2ebd5 100644
--- a/docs/activitymonitor/7.1/requirements/adagent/adagent.md
+++ b/docs/activitymonitor/7.1/requirements/adagent/adagent.md
@@ -57,7 +57,7 @@ These depend on the amount of activity expected:
The disk space requirement covers the following:
- Agent Size – 150 MB
-- Agent Queues – In the event of a network outage, the agent will cache up to 40 GB of event data
+- Agent Queues – If there is a network outage, the agent will cache up to 40 GB of event data
- Diagnostic Logging – 1 GB
Old files are zipped, typical compression ratio is 20. Optionally, old files are moved from the
@@ -83,7 +83,7 @@ The following permission is required to install and manage the agent:
## Supported Active Directory Platforms
-The Activity Monitor provides the ability to monitor Active Directory:
+The Activity Monitor lets you monitor Active Directory:
:::note
For monitoring an Active Directory domain, the AD Agent must be installed on all domain
@@ -104,7 +104,7 @@ topic for target environment requirements.
The following products conflict with the agent:
:::warning
-Do not install these products on a server where an agent is deployed. Do NOT install an
+Don't install these products on a server where an agent is deployed. Don't install an
agent on a server where these products are installed.
:::
diff --git a/docs/activitymonitor/7.1/requirements/adagent/threatprevention.md b/docs/activitymonitor/7.1/requirements/adagent/threatprevention.md
index 9bf711d9c7..164ab74600 100644
--- a/docs/activitymonitor/7.1/requirements/adagent/threatprevention.md
+++ b/docs/activitymonitor/7.1/requirements/adagent/threatprevention.md
@@ -18,8 +18,6 @@ Monitor can be configured with outputs for Enterprise Auditor and Threat Manager
:::
-Follow these steps to configure this integration.
-
:::info
It is a best practice to use the API Server option of the Activity Monitor for
this integration between Threat Prevention and Enterprise Auditor.
@@ -41,8 +39,8 @@ Threat Manager Configuration** on the menu. The Netwrix Threat Manager Configura
- App Token – Leave this field blank for integration with Activity Monitor
- Policies – The table displays all policies created in Threat Prevention along with a State icon
- indicating if the policy is active. Check the **Send** box for the desired policies monitoring the
- target domain activity.
+ indicating if the policy is active. Check the **Send** box for the policies you want to use for
+ monitoring the target domain activity.
**Step 3 –** Click **Save**.
diff --git a/docs/activitymonitor/7.1/requirements/linuxagent.md b/docs/activitymonitor/7.1/requirements/linuxagent.md
index c4aea1d954..823336f2df 100644
--- a/docs/activitymonitor/7.1/requirements/linuxagent.md
+++ b/docs/activitymonitor/7.1/requirements/linuxagent.md
@@ -19,8 +19,7 @@ are:
## Target Requirements
:::note
-For monitoring a Linux file server, the The Linux Agent is deployed to Linux servers to be
-monitored. It cannot be deployed to a proxy server.
+For monitoring a Linux file server, the Linux Agent must be deployed to Linux servers. It can't be deployed to a proxy server.
:::
@@ -33,7 +32,7 @@ The following protocols are supported for the Linux agent:
- Network File System (Mounted Client-Side)
:::note
-Server-Side NFS protocol is not supported.
+Server-Side NFS protocol isn't supported.
:::
diff --git a/docs/activitymonitor/7.1/requirements/overview.md b/docs/activitymonitor/7.1/requirements/overview.md
index 53dc27bf18..9ecb0e45a4 100644
--- a/docs/activitymonitor/7.1/requirements/overview.md
+++ b/docs/activitymonitor/7.1/requirements/overview.md
@@ -8,7 +8,7 @@ sidebar_position: 20
This topic describes the recommended configuration of the servers needed to install the application
in a production environment. Depending on the size of the organization, it is recommended to review
-your environment and requirements with a Netwrix engineer prior to deployment to ensure all
+your environment and requirements with a Netwrix engineer before deployment to ensure all
exceptions are covered.
## Architecture Overview
diff --git a/docs/activitymonitor/7.1/restapi/overview.md b/docs/activitymonitor/7.1/restapi/overview.md
index d3efe00ba1..a9d3ff8d94 100644
--- a/docs/activitymonitor/7.1/restapi/overview.md
+++ b/docs/activitymonitor/7.1/restapi/overview.md
@@ -24,8 +24,8 @@ The 7.1 API model consists of the following resources:
**Agent**
-- Represents an Activity Monitor Agent. API allows you to view existing agents and their statuses;
- register, modify or remove agents. There is no way to install, upgrade, or uninstall agents in the
+- Represents an Activity Monitor Agent. Use the API to view existing agents and their statuses,
+ register, modify, or remove agents. There is no way to install, upgrade, or uninstall agents in the
6.0 API. You can list all the agents or the agents of a **Domain** (i.e. AD-monitoring agents on
the domain controllers).
@@ -62,7 +62,7 @@ DOMAIN\service-account1), protocol (CIFS, NFS), etc.
- File – Information about the actual .TSV, .JSON, and .ZIP files stored on the agent. A file can be
downloaded.
-- Policy – Represents an Active Directory monitoring policy. The API allows you to create new
+- Policy – Represents an Active Directory monitoring policy. Use the API to create new
policies, list, modify, and delete existing.
Data is sent and received as JSON objects or JSON Merge Patch for the PATCH requests. Blank fields
diff --git a/docs/activitymonitor/7.1/restapi/resources.md b/docs/activitymonitor/7.1/restapi/resources.md
index f0753b7e2a..255e7a67ea 100644
--- a/docs/activitymonitor/7.1/restapi/resources.md
+++ b/docs/activitymonitor/7.1/restapi/resources.md
@@ -7,13 +7,13 @@ sidebar_position: 20
# Resources
This page provides an overview of various REST APIs for Activity Monitor, outlining their attributes
-and functionality. The information includes examples to help you understand and utilize REST APIs
+and functionality. The information includes examples to help you understand and use REST APIs
effectively.
## Agent
-Agent represents an Activity Monitor Agent. The API allows you to view existing agents and their
-statuses; register, modify or remove agents. The following table displays the attributes for Agent
+Agent represents an Activity Monitor Agent. The API lets you view existing agents and their
+statuses; register, modify, or remove agents. The following table displays the attributes for Agent
API:
| Attribute | Type | Detailed Only | Description |
@@ -22,7 +22,7 @@ API:
| url | string | | Self URL |
| host | string | | Host name/address as specified by user |
| netbiosName | string | | NETBIOS name |
-| userName | string | | Account for connecting to the agent. Password is not exposed. |
+| userName | string | | Account for connecting to the agent. Password isn't exposed. |
| domain | string | | Domain name of the agent |
| machineSid | string | | |
| osVersion | string | | OS "version" or "version servicepack" |
@@ -41,7 +41,7 @@ API:
| safeModeMessage | string | yes | If in the safe mode, contains a reason why the agent switched to the mode. |
| archiveIsEnabled | bool? | yes | Whether the archiving feature is enabled |
| archivePath | string | yes | UNC path of the archival location |
-| archiveUserName | string | yes | An account to access the archival location. Password is not exposed. |
+| archiveUserName | string | yes | An account to access the archival location. Password isn't exposed. |
| archiveMaxLocalSize | string | yes | Maximum space the agent is allowed to use on the local drives. |
| fpolicyPort | int? | yes | NetApp c-mode fpolicy port |
| fpolicyAuth | string | yes | `NoAuth`, `Server`, `Mutual` |
@@ -216,7 +216,7 @@ Example:
Host represents a host or platform monitored by the product (Windows, NetApp, SharePoint, SQL
Server, etc). It is a Monitored Host in the Console. The API provides access to the settings of the
-host and its status. It allows you to create new hosts, modify, enable/disable, or delete
+host and its status. Use it to create new hosts, modify, enable/disable, or delete
exisisting. The following table displays the attributes for Host API:
| Attribute | Type | Detailed Only | Description |
@@ -465,7 +465,7 @@ table displays the attributes for Output API:
| domainId | string | | AD only: ID of the owning domain |
| domainUrl | string | | AD only: Link to the owning domain |
| logsUrl | string | | Link to the file output log files (for the local agent only) |
-| isEnabled | bool | | Whether or not the output is enabled. If disabled, no activity is forwarded to it. |
+| isEnabled | bool | | Whether the output is enabled. If disabled, no activity is forwarded to it. |
| type | string | | `LogFile`,`Syslog`,`Amqp` |
| logFile | FileOutput | | Log file settings |
| syslog | SyslogOutput | | Syslog settings |
@@ -642,8 +642,8 @@ be downloaded. The following table displays the attributes for File API:
| isArchived | bool | | Determines whether the file is on a local drive of the agent or moved to the archival location. |
| type | string | | `Tsv`, `Json` |
| updatedAt | DateTime | | Last time the file was updated |
-| activityFrom | DateTime | | Activity events in the file are not younger than the date. |
-| activityTo | DateTime | | Activity events in the file are not older than the date. |
+| activityFrom | DateTime | | Activity events in the file aren't younger than the date. |
+| activityTo | DateTime | | Activity events in the file aren't older than the date. |
| outputId | string | | ID of the output that produced the file. |
| contentUrl | string | | Link to the file content. MIME type `application/x-msdownload` |
@@ -695,7 +695,7 @@ Example:
## Policy
-Policy represents an Active Directory monitoring policy. The API allows you to create new policies,
+Policy represents an Active Directory monitoring policy. Use the API to create new policies,
list, modify, and delete existing. The following table displays the attributes for Policy API:
| Attribute | Type | Detailed Only | Read-Only | Description |
@@ -919,7 +919,7 @@ Example:
**POST /api/v1/agents**
-Adds a new agent (but does not install it). The `host` attribute must be unique.
+Adds a new agent (but doesn't install it). The `host` attribute must be unique.
Permission: `Modify agents`
@@ -997,7 +997,7 @@ The following attributes can be modified:
**DELETE /api/v1/agents/«id»**
-Removes the agent. Does not uninstall.
+Removes the agent. Doesn't uninstall.
Permission: `Modify agents`
@@ -1091,7 +1091,7 @@ Permission: `Read` or `Access activity data`
GET /api/v1/agents/«agentId»/domain
Returns a domain monitored by the specified agent. Or 404 if no rights or not found or the agent
-does not monitor AD activity.
+doesn't monitor AD activity.
This endpoint is useful to get `Output` settings specific to the agent. Domain outputs are
_logical_ - they are described once and used by all the domain controllers to create actual
@@ -1105,7 +1105,7 @@ Permission: `Read` or `Access activity data`
GET /api/v1/domains/«domainId»/agents
Returns the domain controllers (agents) having this domain monitored. Or 404 if no rights or the
-domain was not found.
+domain wasn't found.
Permission: `Read` or `Access activity data`
@@ -1114,7 +1114,7 @@ Permission: `Read` or `Access activity data`
GET /api/v1/domains/«domainId»/outputs
Returns the configured outputs for the specified domain, or 404 if no rights for the domain or the
-domain was not found.
+domain wasn't found.
Permission: `Read` or `Access activity data`
@@ -1178,7 +1178,7 @@ Example:
**GET /api/v1/domains/«domainId»/outputs/«id»**
-Returns the specified domain's output. Or 404 if no rights for the domain or the domain was not
+Returns the specified domain's output. Or 404 if no rights for the domain or the domain wasn't
found.
Permission: `Read` or `Access activity data`
@@ -1453,7 +1453,7 @@ Example:
**GET /api/v1/agents/«agentId»/hosts**
-Returns a list of hosts of the specified agent. If the agent was not found or no rights - 404.
+Returns a list of hosts of the specified agent. If the agent wasn't found or no rights - 404.
Permission: `Read` or `Access activity data`
@@ -1534,7 +1534,7 @@ Permission: `Modify hosts`
GET /api/v1/hosts/«hostId»/outputs
-Returns a list of outputs of the specified host. If the host was not found or no rights - 404.
+Returns a list of outputs of the specified host. If the host wasn't found or no rights - 404.
Permission: `Read` or `Access activity data`
@@ -1571,7 +1571,7 @@ Required attributes:
**GET /api/v1/hosts/«hostId»/outputs/«id»**
-Returns the specified output of the host. If the host was not found or no rights, or the output was
+Returns the specified output of the host. If the host wasn't found or no rights, or the output was
not found - 404.
Permission: `Read` or `Access activity data`
@@ -1677,7 +1677,7 @@ The following attributes can be modified:
- `windows.discardReorderedAcl`
- `windows.vssActivity`
- `windows.vssCreation`
-- `amqp.server` - must be a a vaild hostname or ip4/ip6 address.
+- `amqp.server` - must be a valid hostname or ip4/ip6 address.
- `amqp.userName`
- `amqp.vhost`
- `amqp.queue`
diff --git a/docs/activitymonitor/7.1/restapi/security.md b/docs/activitymonitor/7.1/restapi/security.md
index 8712b4536d..924775703e 100644
--- a/docs/activitymonitor/7.1/restapi/security.md
+++ b/docs/activitymonitor/7.1/restapi/security.md
@@ -9,7 +9,7 @@ sidebar_position: 10
## Security
The REST-style API is exposed via TLS v1.2, with a self-signed certificate by default. The port is
-customizable, 4494 by default. The IP list can be used to restrict access to the port.
+customizable, 4494 by default. Use the IP list to restrict access to the port.
You can use the Activity Monitor Console to allow applications to access the API, change
permissions, or revoke access. The console generates unique Client ID and Secret for each
@@ -19,7 +19,7 @@ application.
OAuth 2.0 client-credentials grant is used for authentication. A pair of Client ID and Secret are
used to obtain an access token from the access token URL: `https://localhost:4494/api/v1/token`.
-Token expiration intervals are not configurable.
+Token expiration intervals aren't configurable.
| Type | Expires in |
| ------------- | ---------- |
@@ -28,10 +28,10 @@ Token expiration intervals are not configurable.
| Refresh Token | never |
It is considered a best practice to use short expiration periods for OAuth 2.0 tokens, like 1 hour
-for the access token. A shorter period allows you to revoke the access quicker if needed. In case of
+for the access token. With a shorter period, you can revoke access quicker if needed. In case of
Activity Monitor, the Agent is both the authentication server and the resource server. Therefore, it
can validate the token on each and every access to a resource. So, for Activity Monitor long
-expiration periods do not make the protocol less secure.
+expiration periods don't make the protocol less secure.
A client is expected to pass the access token in the `Authorization` request header.
@@ -59,7 +59,7 @@ Activity Monitor7.1 permissions:
| Permission | Description |
| ---------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| `Access activity data` | Provides minimal access rights to list and download the log files. |
-| `Read` | Read-only access to all the information about all agents, domains, and hosts. Does not allow one to download the log files. |
+| `Read` | Read-only access to all the information about all agents, domains, and hosts. Doesn't allow one to download the log files. |
| `Policy change` | Add, modify, and delete the AD monitoring policies. |
| `Modify host` | Add, modify, enable, disable, and delete Hosts and their Outputs. |
| `Modify agent` | Add, modify, and delete agents. |
diff --git a/docs/activitymonitor/7.1/siem/overview.md b/docs/activitymonitor/7.1/siem/overview.md
index b5b12394c4..98bf762b5e 100644
--- a/docs/activitymonitor/7.1/siem/overview.md
+++ b/docs/activitymonitor/7.1/siem/overview.md
@@ -6,10 +6,9 @@ sidebar_position: 70
# SIEM Integrations
-Stealthbits File Activity monitoring solutions enable organizations to successfully, efficiently,
-and affordably monitor file access and permission changes across Windows and Network Attached
+Stealthbits File Activity monitoring solutions enable organizations to monitor file access and permission changes across Windows and Network Attached
Storage (NAS) file systems in real-time. Using preconfigured Stealthbits File Activity Monitor Apps,
-users can quickly understand all file activities as a whole, for specific resources or users, as
+users can understand all file activities as a whole, for specific resources or users, as
well as patterns of activity indicative of threats such as crypto ransomware or data exfiltration
attempts. With full control over the data, users can create custom searches, all while enabling apps
to correlate file system activity with any log source.
diff --git a/docs/activitymonitor/7.1/siem/qradar/app/about.md b/docs/activitymonitor/7.1/siem/qradar/app/about.md
index a02534e61b..03abe4b478 100644
--- a/docs/activitymonitor/7.1/siem/qradar/app/about.md
+++ b/docs/activitymonitor/7.1/siem/qradar/app/about.md
@@ -10,4 +10,4 @@ The About dashboard provides information about the application.
-Information on how to obtain a license for the applicable Stealthbits software is included.
+The dashboard includes information on how to obtain a license for the applicable Stealthbits software.
diff --git a/docs/activitymonitor/7.1/siem/qradar/app/app.md b/docs/activitymonitor/7.1/siem/qradar/app/app.md
index aecaf57135..bfb23df791 100644
--- a/docs/activitymonitor/7.1/siem/qradar/app/app.md
+++ b/docs/activitymonitor/7.1/siem/qradar/app/app.md
@@ -15,30 +15,29 @@ and a Settings interface for configuring the QRadar SEC token.
The User Investigation and Host Investigation dashboards only appear when a search is conducted.
This can be done by clicking a hyperlink within the Username or Destination IP columns of a table
-card. Alternatively, type the complete user name or host IP Address in the Search box on the right
+card. Alternatively, enter the complete user name or host IP Address in the Search box on the right
side of the navigation bar.
## Table Card Features
-Within the dashboards are several cards with a tabular format. Each of these cards have the
+Within the dashboards are several cards with a tabular format. Each of these cards has the
following features:
-- Only five pages of data will be loaded at a time. Applying the Search or Sort features or moving
+- The application loads only five pages of data at a time. Applying the Search or Sort features or moving
beyond the five ‘loaded’ pages will result in a “Processing” banner being temporarily displayed
over the table while the server is directly queried for the necessary data.
- Search data entries for the Username, Destination IP, and File Path columns by typing in the
Search box in the upper-right corner of the card:
- - Any entries with a match will remain in the table, all non-matching entries will be filtered
- out.
+ - Entries with a match remain in the table, and the application filters out all non-matching entries.
- Total number of entries “Showing” will adjust for the filtered total.
- Search can also apply to the Operation column, but only for exact matches.
-- Sort can be applied to one column at a time by clicking on the desired column header.
+- Sort can be applied to one column at a time by clicking on the column header you want.
- Show 10, 25, 100, or All entries in the table. Only visible entries can be exported.
-- Result data currently visible within the table page displayed can be exported from the dashboard:
+- Result data visible within the table page displayed can be exported from the dashboard:
- - Copy – Copy to clipboard in order to paste to another application
+ - Copy – Copy to clipboard to paste to another application
- CSV – Export to a Comma Separated Value file
- Excel – Export to an Excel Workbook file
- - Print – Send currently displayed table to printer
+ - Print – Send displayed table to printer
diff --git a/docs/activitymonitor/7.1/siem/qradar/app/deletions.md b/docs/activitymonitor/7.1/siem/qradar/app/deletions.md
index fb648aab0e..4aeff15864 100644
--- a/docs/activitymonitor/7.1/siem/qradar/app/deletions.md
+++ b/docs/activitymonitor/7.1/siem/qradar/app/deletions.md
@@ -11,7 +11,7 @@ The Deletions dashboard contains the following cards:
- Activity – Timeline of all deletion events over the specified time interval
-- Top Users – Displays up-to the top five users associated with deletion events over the specified
+- Top Users – Displays the top five users associated with deletion events over the specified
time interval
- Latest Events – Tabular format of all deletion events which occurred over the specified time
interval
@@ -22,5 +22,5 @@ The Deletions dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
-interval. Then click Search to refresh the card data.
+enter the date and time you want or use the calendar buttons to set the date and time interval.
+Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/7.1/siem/qradar/app/home.md b/docs/activitymonitor/7.1/siem/qradar/app/home.md
index b607411035..4028bb82e1 100644
--- a/docs/activitymonitor/7.1/siem/qradar/app/home.md
+++ b/docs/activitymonitor/7.1/siem/qradar/app/home.md
@@ -10,10 +10,10 @@ The File System Activity Home dashboard contains the following cards:
-- Active Users – Number of distinct users recorded performing any type of file activity to/from any
+- Active Users – Number of distinct users performing any type of file activity to/from any
host over the specified time interval
- Active Servers – Number of distinct servers accessed (destination IP Addresses) with any type of
- file activity recorded over the specified time interval
+ file activity over the specified time interval
- Open Offenses – Number of ransomware offenses detected within QRadar from the file activity event
data
@@ -21,11 +21,11 @@ The File System Activity Home dashboard contains the following cards:
[Ransomware Dashboard](/docs/activitymonitor/7.1/siem/qradar/app/ransomware.md).
- File Activity – Timeline of all file activity over the specified time interval
-- Top Users – Displays up-to the top five users associated with file activity over the specified
+- Top Users – Displays the top five users associated with file activity over the specified
time interval
-- Top Servers – Displays up-to the top five servers (destination IP Addresses) associated with file
+- Top Servers – Displays the top five servers (destination IP Addresses) associated with file
activity over the specified time interval
-- Latest Events – Tabular format of all file activity events which occurred over the specified time
+- Latest Events – Tabular format of all file activity events over the specified time
interval
- See the
@@ -34,5 +34,5 @@ The File System Activity Home dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
-interval. Then click Search to refresh the card data.
+enter the date and time you want or use the calendar buttons to set the date and time
+interval you want. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/7.1/siem/qradar/app/hostinvestigation.md b/docs/activitymonitor/7.1/siem/qradar/app/hostinvestigation.md
index f485a88c31..7379865003 100644
--- a/docs/activitymonitor/7.1/siem/qradar/app/hostinvestigation.md
+++ b/docs/activitymonitor/7.1/siem/qradar/app/hostinvestigation.md
@@ -7,7 +7,7 @@ sidebar_position: 60
# Host Investigation Dashboard
The Host Investigation dashboard only appears when a search is conducted. This can be done by
-clicking a hyperlink within the Destination IP column of a table card. Alternatively, type the
+clicking a hyperlink within the Destination IP column of a table card. Alternatively, enter the
complete host IP Address in the Search box on the right side of the navigation bar.
@@ -38,5 +38,5 @@ The Host Investigation dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
-interval. Then click Search to refresh the card data.
+enter the date and time you want or use the calendar buttons to set the date and time
+interval you want. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/7.1/siem/qradar/app/permissionchanges.md b/docs/activitymonitor/7.1/siem/qradar/app/permissionchanges.md
index 42ab61a56a..693614ebc5 100644
--- a/docs/activitymonitor/7.1/siem/qradar/app/permissionchanges.md
+++ b/docs/activitymonitor/7.1/siem/qradar/app/permissionchanges.md
@@ -25,5 +25,5 @@ The Permission Changes dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
+enter the date and time you want or use the calendar buttons to set the date and time
interval. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/7.1/siem/qradar/app/ransomware.md b/docs/activitymonitor/7.1/siem/qradar/app/ransomware.md
index 8d6a8f6f0c..f7bdf18340 100644
--- a/docs/activitymonitor/7.1/siem/qradar/app/ransomware.md
+++ b/docs/activitymonitor/7.1/siem/qradar/app/ransomware.md
@@ -32,8 +32,7 @@ The Ransomware dashboard contains the following cards:
- Only visible after clicking Search on an offense
-The offenses generated within QRadar are based upon the Stealthbits: Ransomware Detected rule that
-is packaged with this application. In order to adjust this rule to better suit an organization’s
-needs, please refer to the IBM QRadar
+The Stealthbits: Ransomware Detected rule, which is packaged with this application, generates the offenses
+that appear in QRadar. To adjust this rule to better suit an organization’s needs, refer to the IBM QRadar
[Rule management](https://www.ibm.com/support/knowledgecenter/SS42VS_7.2.6/com.ibm.qradar.doc/c_qradar_rul_mgt.html)
article on how to modify rules.
diff --git a/docs/activitymonitor/7.1/siem/qradar/app/userinvestigation.md b/docs/activitymonitor/7.1/siem/qradar/app/userinvestigation.md
index 9ed7a69e6b..2c1fb78bb8 100644
--- a/docs/activitymonitor/7.1/siem/qradar/app/userinvestigation.md
+++ b/docs/activitymonitor/7.1/siem/qradar/app/userinvestigation.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# User Investigation Dashboard
The User Investigation dashboard only appears when a search is conducted. This can be done by
-clicking a hyperlink within the Username column of a table card. Alternatively, type the complete
+clicking a hyperlink within the Username column of a table card. Alternatively, enter the complete
user name in the Search box on the right side of the navigation bar.
@@ -34,5 +34,5 @@ The User Investigation dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
+enter the date and time you want or use the calendar buttons to set the date and time
interval. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/7.1/siem/qradar/overview.md b/docs/activitymonitor/7.1/siem/qradar/overview.md
index fa8300bdcb..1892088539 100644
--- a/docs/activitymonitor/7.1/siem/qradar/overview.md
+++ b/docs/activitymonitor/7.1/siem/qradar/overview.md
@@ -6,10 +6,9 @@ sidebar_position: 10
# Netwrix File Activity Monitor App for QRadar
-Netwrix File Activity monitoring solutions enable organizations to successfully, efficiently, and
-affordably monitor file access and permission changes across Windows and Network Attached Storage
+Netwrix File Activity monitoring solutions enable organizations to monitor file access and permission changes across Windows and Network Attached Storage
(NAS) file systems in real-time. Using the preconfigured Netwrix File Activity Monitor App for
-QRadar, users can quickly understand all file activities as a whole, for specific resources or
+QRadar, users can understand all file activities as a whole, for specific resources or
users, as well as patterns of activity indicative of threats such as crypto ransomware or data
exfiltration attempts. With full control over the data, users can create custom searches, all while
enabling QRadar to correlate file system activity with any log source.
@@ -26,10 +25,9 @@ the Netwrix website for additional information.
Download the [Stealthbits File Activity Monitor App for
QRadar](https://exchange.xforce.ibmcloud.com/hub/extension/STEALTHbits Technologies:STEALTHbits File
Activity Monitor) from the [IBM X-Force App Exchange](https://exchange.xforce.ibmcloud.com/hub).
-After downloading the Stealthbits File Activity Monitor App for QRadar, follow the steps to install
-it within QRadar.
+After downloading the Stealthbits File Activity Monitor App for QRadar, install it within QRadar by completing the following:
-**Step 1 –** Click on the Admin tab within QRadar.
+**Step 1 –** Click the Admin tab within QRadar.
**Step 2 –** Under System Configuration, click Extensions Management.
@@ -49,7 +47,7 @@ additional information.
## Initial Configuration of the QRadar App
-Follow the steps to configure QRadar to receive data from Stealthbitsproducts.
+To configure QRadar to receive data from Stealthbits products, complete the following:
**Step 1 –** Determine the IP Address of the QRadar Console, e.g. run the _ifconfig_ command. This
information is required for the following sections:
@@ -63,7 +61,7 @@ information is required for the following sections:
**Step 3 –** Select Log Sources.
-**Step 4 –** View the Log Sources list. If the data source was not automatically created, click Add
+**Step 4 –** View the Log Sources list. If the data source wasn't automatically created, click Add
and enter the following information:
- Log Source Name – Enter a descriptive name to identify the data source
@@ -79,7 +77,7 @@ sent correctly between the hosts, and diagnose any possible network issues.
- Protocol Configuration – Select Syslog
- Log Source Identifier – Enter the host name or IP Address of the host where the Stealthbits
Activity Monitor Console OR StealthINTERCEPT is installed
-- Then click Save. Remember, prior to using the StealthbitsFile Activity Monitor App for QRadar, the
+- Then click Save. Remember, before using the Stealthbits File Activity Monitor App for QRadar, the
related Stealthbits product must be configured to send data to QRadar.
The Stealthbits File Activity Monitor App for QRadar can now display activity data from either the
diff --git a/docs/activitymonitor/7.1/siem/qradar/settings.md b/docs/activitymonitor/7.1/siem/qradar/settings.md
index 3536432770..36ec41890e 100644
--- a/docs/activitymonitor/7.1/siem/qradar/settings.md
+++ b/docs/activitymonitor/7.1/siem/qradar/settings.md
@@ -12,4 +12,4 @@ the QRadar SEC token to be saved to the **Settings** interface.
The **More information** link will open the IBM Knowledge Center with information on generating the
-QRadar SEC token. Once the token is generated, copy and paste it here and click Save.
+QRadar SEC token. After the token is generated, copy and paste it here, and click Save.
diff --git a/docs/activitymonitor/7.1/siem/splunk/app/app.md b/docs/activitymonitor/7.1/siem/splunk/app/app.md
index 39cc2ce73f..5f97f970e0 100644
--- a/docs/activitymonitor/7.1/siem/splunk/app/app.md
+++ b/docs/activitymonitor/7.1/siem/splunk/app/app.md
@@ -13,6 +13,6 @@ Activity (Overview), Ransomware, Permission Changes, and Deletions.
The date time search feature uses the default Splunk search features.
-The timeframe interval is identified in the upper-left corner of each dashboard. The drop-down menu
+The timeframe interval is identified in the upper-left corner of each dashboard. The dropdown menu
provides additional options. To search within a different interval, choose a new option from the
menu. Then click **Submit** to refresh the card data.
diff --git a/docs/activitymonitor/7.1/siem/splunk/app/deletions.md b/docs/activitymonitor/7.1/siem/splunk/app/deletions.md
index 96ede3d065..2772dfa057 100644
--- a/docs/activitymonitor/7.1/siem/splunk/app/deletions.md
+++ b/docs/activitymonitor/7.1/siem/splunk/app/deletions.md
@@ -13,8 +13,7 @@ View deletion information in the Deletions Dashboard for Splunk.
The Deletions dashboard contains the following cards:
- Activity – Timeline of all deletion events in the specified timeframe
-- Top Users – Displays up-to the top five users related to deletion events which have been recorded
- in the specified timeframe
+- Top Users – Displays the top five users related to deletion events in the specified timeframe
- Latest Events – Tabular format of all deletion events recorded in the specified timeframe
The specified timeframe is set by default to the Last 24 hours, or past day.
diff --git a/docs/activitymonitor/7.1/siem/splunk/app/overview.md b/docs/activitymonitor/7.1/siem/splunk/app/overview.md
index 3e15fde9db..041a4b1527 100644
--- a/docs/activitymonitor/7.1/siem/splunk/app/overview.md
+++ b/docs/activitymonitor/7.1/siem/splunk/app/overview.md
@@ -1,10 +1,10 @@
---
-title: "Overview Dashobard"
-description: "Overview Dashobard"
+title: "Overview Dashboard"
+description: "Overview Dashboard"
sidebar_position: 10
---
-# Overview Dashobard
+# Overview Dashboard
View general information on the Overview Dashboard for Splunk.
@@ -15,11 +15,8 @@ The File System Activity Overview dashboard contains the following cards:
- Active Users – Number of users involved with file system events in the specified timeframe
- Active Servers – Number of servers involved with file system events in the specified timeframe
- File Activity – Timeline of all file system events in the specified timeframe
-- Top Users – Displays up-to the top five users addresses related to file system events which have
- been recorded in the specified timeframe
-- Top Servers – Displays up-to the top five client IP addresses/host names related to file system
- events which have been recorded in the specified timeframe
-- Latest Events – Tabular format of all file system change events which have been recorded in the
- specified timeframe
+- Top Users – Displays the top five users' addresses related to file system events in the specified timeframe
+- Top Servers – Displays the top five client IP addresses and host names related to file system events in the specified timeframe
+- Latest Events – Tabular format of all file system change events in the specified timeframe
The specified timeframe is set by default to the Last 24 hours, or past day.
diff --git a/docs/activitymonitor/7.1/siem/splunk/app/permissionchanges.md b/docs/activitymonitor/7.1/siem/splunk/app/permissionchanges.md
index 45db2eed30..da8a9a28b9 100644
--- a/docs/activitymonitor/7.1/siem/splunk/app/permissionchanges.md
+++ b/docs/activitymonitor/7.1/siem/splunk/app/permissionchanges.md
@@ -6,15 +6,14 @@ sidebar_position: 30
# Permission Changes Dashboard
-View information on permissions changes on the through the Permission Changes Dashboard for Splunk.
+View information on permission changes through the Permission Changes Dashboard for Splunk.
The Permission Changes dashboard contains the following cards:
- Activity – Timeline of all permission change events in the specified timeframe
-- Top Users – Displays up-to the top five users related to permission change events which have been
- recorded in the specified timeframe
+- Top Users – Displays the top five users related to permission change events in the specified timeframe
- Latest Events – Tabular format of all permission change events recorded in the specified timeframe
The specified timeframe is set by default to the Last 24 hours, or past day.
diff --git a/docs/activitymonitor/7.1/siem/splunk/overview.md b/docs/activitymonitor/7.1/siem/splunk/overview.md
index 9e21a5f4bd..85a177436a 100644
--- a/docs/activitymonitor/7.1/siem/splunk/overview.md
+++ b/docs/activitymonitor/7.1/siem/splunk/overview.md
@@ -6,10 +6,9 @@ sidebar_position: 20
# File Activity Monitor App for Splunk
-Stealthbits File Activity monitoring solutions enable organizations to successfully, efficiently,
-and affordably monitor file access and permission changes across Windows and Network Attached
+Stealthbits File Activity monitoring solutions enable organizations to monitor file access and permission changes across Windows and Network Attached
Storage (NAS) file systems in real-time. Using the preconfigured Stealthbits File Activity Monitor
-App for Splunk, users can quickly understand all file activities as a whole, for specific resources
+App for Splunk, users can understand all file activities as a whole, for specific resources
or users, as well as patterns of activity indicative of threats such as crypto ransomware or data
exfiltration attempts. With full control over the data, users can create custom searches, all while
enabling Splunk to correlate file system activity with any log source.
@@ -17,7 +16,7 @@ enabling Splunk to correlate file system activity with any log source.
This document describes how to integrate Netwrix products with the Stealthbits File Activity
Monitor App for Splunk found in Splunkbase. Any Netwrix product can be configured to monitor file
system activity and send the monitored events to Splunk. After installing this app, ensure that
-either theActivity Monitor, Threat Prevention, or Enterprise Auditor has been configured to send
+either the Activity Monitor, Threat Prevention, or Enterprise Auditor has been configured to send
events to Splunk. See the product user guide on the
[Netwrix Technical Knowledge Center](https://helpcenter.netwrix.com/) for additional information.
@@ -31,7 +30,7 @@ Activity Monitor App for Splunk, follow the
Splunk to install the app.
:::note
-In order to use the Ransomware dashboard within the app, install
+to use the Ransomware dashboard within the app, install
[Splunk User Behavior Analytics](https://www.splunk.com/en_us/products/premium-solutions/user-behavior-analytics.html)
(any version) and the [Machine Learning Toolkit](https://splunkbase.splunk.com/app/2890/) app for
Splunk (version 2.0.0+).
@@ -40,12 +39,10 @@ Splunk (version 2.0.0+).
The Stealthbits: File Activity Monitor tab will appear within the Splunk web interface. Once
installation of the Stealthbits File Activity Monitor App for Splunk is complete, it must be
-configured to receive data from either theActivity Monitor or Threat Prevention.
+configured to receive data from either the Activity Monitor or Threat Prevention.
## Initial Configuration of the Splunk App
-Follow the steps to configure Splunk to receive data from Stealthbits products.
-
**Step 1 –** Determine the IP Address of the Splunk Console, e.g. run the ifconfig command. This
information is required for the following sections:
@@ -61,7 +58,7 @@ information is required for the following sections:
**Step 3 –** Select UDP.
**Step 4 –** Click New and add a new data input with Port 514. If another Splunk UDP input is
-already using 514, another value (515 or higher) can be used as long as it is not blocked by the
+already using 514, another value (515 or higher) can be used as long as it isn't blocked by the
network. Remember to configure the port within the Stealthbits product configuration to align with
this change.
@@ -76,7 +73,7 @@ this change.
- Host – Select IP
- Index – Select Default
-**Step 7 –** Review and save the new settings. Remember, prior to using the Stealthbits File
+**Step 7 –** Review and save the new settings. Remember, before using the Stealthbits File
Activity Monitor App for Splunk, the related Stealthbits products must be configured to send data to
Splunk.
diff --git a/docs/activitymonitor/7.1/troubleshooting/antivirusexclusions.md b/docs/activitymonitor/7.1/troubleshooting/antivirusexclusions.md
index edd6366144..e0237e56ce 100644
--- a/docs/activitymonitor/7.1/troubleshooting/antivirusexclusions.md
+++ b/docs/activitymonitor/7.1/troubleshooting/antivirusexclusions.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Antivirus Exclusions
Windows activity monitoring and performance of the Activity Agent may be negatively affected by
-antivirus protections. Add the following components to antivirus exclusions in order to avoid
+antivirus protections. Add the following components to antivirus exclusions to avoid
potential performance degradation.
## Directories
diff --git a/docs/activitymonitor/7.1/troubleshooting/backuprestore/agentbackup.md b/docs/activitymonitor/7.1/troubleshooting/backuprestore/agentbackup.md
index b9c37622d9..2ef9a9da3d 100644
--- a/docs/activitymonitor/7.1/troubleshooting/backuprestore/agentbackup.md
+++ b/docs/activitymonitor/7.1/troubleshooting/backuprestore/agentbackup.md
@@ -6,10 +6,6 @@ sidebar_position: 10
# Agent Backup
-Follow the steps to back up the configuration, passwords, Active Directory event data file, and
-activity log files for Activity Monitor Agents deployed on file system servers, SharePoint servers,
-and domain controllers.
-
**Configuration**
**Step 1 –** Back up the `SBTFileMon.ini` file. The default location is
@@ -48,7 +44,7 @@ default folder is
**C:\ProgramData\Netwrix\Activity Monitor\Agent\ActivityLogs**
:::note
-Keep in mind that` C:\ProgramData` folder may be hidden. Navigate to it by typing
+The `C:\ProgramData` folder may be hidden. Navigate to it by typing
`%ALLUSERSPROFILE%` in the File Explorer.
:::
diff --git a/docs/activitymonitor/7.1/troubleshooting/backuprestore/agentrestore.md b/docs/activitymonitor/7.1/troubleshooting/backuprestore/agentrestore.md
index ae6bfdf79f..09952f2095 100644
--- a/docs/activitymonitor/7.1/troubleshooting/backuprestore/agentrestore.md
+++ b/docs/activitymonitor/7.1/troubleshooting/backuprestore/agentrestore.md
@@ -6,9 +6,7 @@ sidebar_position: 20
# Agent Restoration
-Follow the steps to restore the configuration, Active Directory configuration file, and activity log
-files for Activity Monitor Agents deployed on file system servers, SharePoint servers, and domain
-controllers.
+Restore the configuration, Active Directory configuration file, and activity log files for Activity Monitor Agents deployed on file system servers, SharePoint servers, and domain controllers.
:::warning
Restore the agent before restoring the console to ensure connectivity and monitoring
diff --git a/docs/activitymonitor/7.1/troubleshooting/backuprestore/consolebackup.md b/docs/activitymonitor/7.1/troubleshooting/backuprestore/consolebackup.md
index f0e06eeb35..c5dbb99114 100644
--- a/docs/activitymonitor/7.1/troubleshooting/backuprestore/consolebackup.md
+++ b/docs/activitymonitor/7.1/troubleshooting/backuprestore/consolebackup.md
@@ -6,8 +6,6 @@ sidebar_position: 30
# Console Backup
-Follow the steps to back up the list of agents managed on the Activity Monitor Console.
-
**Step 1 –** Back up the configuration file:
**%ALLUSERSPROFILE%\Netwrix\Activity Monitor\Console\Agents.ini**
diff --git a/docs/activitymonitor/7.1/troubleshooting/backuprestore/consolerestore.md b/docs/activitymonitor/7.1/troubleshooting/backuprestore/consolerestore.md
index 3bdb18b487..e7df49cedd 100644
--- a/docs/activitymonitor/7.1/troubleshooting/backuprestore/consolerestore.md
+++ b/docs/activitymonitor/7.1/troubleshooting/backuprestore/consolerestore.md
@@ -6,8 +6,6 @@ sidebar_position: 40
# Console Restoration
-Follow the steps to restore the list of agents managed on the Activity Monitor Console.
-
**Step 1 –** Restore `Agents.ini` file.
**Step 2 –** Restore `FileMonitor.lic` file.
diff --git a/docs/activitymonitor/7.1/troubleshooting/credentialpasswords.md b/docs/activitymonitor/7.1/troubleshooting/credentialpasswords.md
index ffe0152b09..720e84158e 100644
--- a/docs/activitymonitor/7.1/troubleshooting/credentialpasswords.md
+++ b/docs/activitymonitor/7.1/troubleshooting/credentialpasswords.md
@@ -83,7 +83,7 @@ topic for additional information.
## Monitored Host Inactivity Alerts Email Account
-The Monitored Host Inactivity Alerts Email Account are used to automate email alerts for inactivity
+The Monitored Host Inactivity Alerts Email Account is used to automate email alerts for inactivity
detected by the monitored host. The credentials can be updated in the monitored **Host Properties**.
diff --git a/docs/activitymonitor/7.1/troubleshooting/performancemonitoring.md b/docs/activitymonitor/7.1/troubleshooting/performancemonitoring.md
index 27f9aba860..d2ae04f648 100644
--- a/docs/activitymonitor/7.1/troubleshooting/performancemonitoring.md
+++ b/docs/activitymonitor/7.1/troubleshooting/performancemonitoring.md
@@ -24,7 +24,7 @@ The following performance counters are provided by Activity Monitor.
| NetApp | ✔ | Activity Monitor - NetApp\Session Negotiated | Number of connections established with ONTAP cluster nodes |
| NetApp | ✔ | Activity Monitor - NetApp\Active Connections | Number of active connections with ONTAP cluster nodes |
| NetApp | | Activity Monitor - NetApp\Outage Files | Number of outage (resilience) files processed |
-| NetApp | ✔ | Activity Monitor - NetApp\Overloaded | Number of times the agent was overloaded and had to limit the rate of events. This counter may increase from time to time when processing large batches of events. But if it keeps increasing, it is a sure sign that the agent is not coping with the load. Consider moving some SVMs to another agent or spreading the load from one SVM across multiple agents. |
+| NetApp | ✔ | Activity Monitor - NetApp\Overloaded | Number of times the agent was overloaded and had to limit the rate of events. This counter may increase from time to time when processing large batches of events. But if it keeps increasing, it is a sure sign that the agent isn't coping with the load. Consider moving some SVMs to another agent or spreading the load from one SVM across multiple agents. |
| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Received | Number of events received from CEE |
| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Received/sec | Rate at which events are received from CEE |
| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Reported | Number of events passed the filters and being reported to outputs |
@@ -35,7 +35,7 @@ The following performance counters are provided by Activity Monitor.
| Outputs | ✔ | Activity Monitor - Outputs\Events Reported/sec | Rate at which events are reported |
| Outputs | | Activity Monitor - Outputs\Events Reported to Files | Total number of events reported to log files |
| Outputs | | Activity Monitor - Outputs\Events Reported to Syslog | Total number of events reported to syslog servers |
-| Outputs | | Activity Monitor - Outputs\Events Reported to AMQP | Total number of events reported to AMQP servers (not used currently) |
+| Outputs | | Activity Monitor - Outputs\Events Reported to AMQP | Total number of events reported to AMQP servers (not used ) |
| Outputs | ✔ | Activity Monitor - Outputs\Resolved SIDs | Number of attempts, both successful and failed, to resolve SIDs to names |
| Outputs | ✔ | Activity Monitor - Outputs\Resolved SIDs/sec | Rate at which SIDs are resolved to names |
| Outputs | ✔ | Activity Monitor - Outputs\Resolved SIDs Failures | Number of failed attempts to resolve SIDs to names |
@@ -56,7 +56,7 @@ The following performance counters are provided by Activity Monitor.
DNS and AD queries typically contribute the most to the processing time. Since the
resolution occurs in real time, slow responses can affect throughput (A 100ms DNS response limits
the throughput to 10 events per second). Observing average and maximum values of DNS Queries Time,
-Resolved SIDs Time, and Translated UIDs Time allows you to estimate the response time.
+Resolved SIDs Time, and Translated UIDs Time help you estimate the response time.
:::
@@ -69,7 +69,7 @@ performance counters:
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Processor(_Total)\% Processor Time | The percentage of elapsed time that the processor spends to execute a non-Idle thread. |
| Memory\Available MBytes | The amount of physical memory, in Megabytes, immediately available for allocation to a process or for system use. |
-| Paging File(_Total)\% Usage | The percentage of the paging file that is currently in use. |
+| Paging File(_Total)\% Usage | The percentage of the paging file that is in use. |
| TCPv4\Connections Reset | The rate of reset TCPv4 connections |
| TCPv4\Segments Received/sec | The quantity of segments received via TCPv4 per second. |
| TCPv4\Segments Retransmitted/Sec | Quantity of segments retransmitted via TCPv4 per second. |
@@ -79,7 +79,7 @@ performance counters:
| Network Interface(\*)\Bytes Sent/sec | From all network adapters: The rate at which bytes are sent. |
| Network Interface(\*)\Output Queue Length | From all network adapters: The length of the output packet queue (in packets). |
| Network Interface(\*)\Packets Received Discarded | From all network adapters: The number of inbound packets that were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. |
-| Network Interface(\*)\Packets Received Errors | From all network adapters: The number of inbound packets that contained errors. As a result, the errored packets were not delivered to a higher-layer protocol. |
+| Network Interface(\*)\Packets Received Errors | From all network adapters: The number of inbound packets that contained errors. As a result, the errored packets weren't delivered to a higher-layer protocol. |
| Process(ConfigurationAgent.Grpc.Host)\% Processor Time | For Agent: The percentage of elapsed time that all of process threads used the processor to execution instructions. |
| Process(ConfigurationAgent.Grpc.Host)\Elapsed Time | For Agent: The duration from when the process was started until the time it terminated. |
| Process(ConfigurationAgent.Grpc.Host)\Handle Count | For Agent: The number of operating system handles the process has opened. |
@@ -131,10 +131,9 @@ performance counters:
## Register Performance Counters
-The Activity Monitor performance counters are not registered by default and must be registered
+The Activity Monitor performance counters aren't registered by default and must be registered
manually.
-Follow the steps to register the Activity Monitor performance counters on each SAM Agent server.
**Step 1 –** Run `cmd.exe` as Administrator.
@@ -313,10 +312,9 @@ Get-Counter @variables | Export-Counter -FileFormat csv -Path $outputFile -Force
## Unregister Performance Counters
-When performance monitoring is not needed anymore, unregister the Activity Monitor performance
+When performance monitoring isn't needed anymore, unregister the Activity Monitor performance
counters.
-Follow the steps to unregister the Activity Monitor performance counters on each SAM Agent server.
**Step 1 –** Run `cmd.exe` as Administrator.
@@ -343,4 +341,4 @@ sc stop SBTLoggingSvc
**sc start SBFileMonAgentSvc**
-Once the services have been restarted, the Activity Monitor performance counters are unregistered.
+After the services have been restarted, the Activity Monitor performance counters are unregistered.
diff --git a/docs/activitymonitor/7.1/troubleshooting/tracelogs.md b/docs/activitymonitor/7.1/troubleshooting/tracelogs.md
index 4a38a21a0c..e143eea2f5 100644
--- a/docs/activitymonitor/7.1/troubleshooting/tracelogs.md
+++ b/docs/activitymonitor/7.1/troubleshooting/tracelogs.md
@@ -8,7 +8,7 @@ sidebar_position: 20
While activity agents store activity logs on the servers where they are deployed, the Activity
Monitor creates Trace Logs that aid in troubleshooting issues. The Trace level option set in the
-drop-down list in the lower right corner of the Activity Monitor Console determines the kind of
+dropdown list in the lower right corner of the Activity Monitor Console determines the kind of
information kept in the activity agent and monitored hosts logs.
@@ -25,7 +25,7 @@ properties). Select from the following trace log levels:
- Fatal – Records only when catastrophic system failures / crashes occur
When the log level is changed in the Activity Monitor Console, the new log level is propagated and
-applied immediately to all of the activity agents that do not have custom trace setting.
+applied immediately to all of the activity agents that don't have custom trace setting.
:::note
Trace level can be adjusted in the Agent Properties for the selected agent. See the
diff --git a/docs/activitymonitor/8.0/admin/agents/activedirectory.md b/docs/activitymonitor/8.0/admin/agents/activedirectory.md
index 9c242ae41d..37988cd55e 100644
--- a/docs/activitymonitor/8.0/admin/agents/activedirectory.md
+++ b/docs/activitymonitor/8.0/admin/agents/activedirectory.md
@@ -8,31 +8,32 @@ sidebar_position: 40
Before deploying the Active Directory (AD) agent, ensure all
[AD Agent Server Requirements](/docs/activitymonitor/8.0/requirements/adagent/adagent.md) have been met. To effectively
-monitor Active Directory, it is necessary to deploy an AD agent to every domain controller,
-including the read only domain controllers. However, it is possible to deploy the agents in batches.
-Follow the steps to deploy the AD agents to the domain controllers in the target domain.
+monitor Active Directory, deploy an AD agent to every domain controller,
+including the read only domain controllers. You can deploy the agents in batches.
+
+## Deploy the AD agents to the domain controllers in the target domain
:::note
These steps are specific to deploying AD agents for monitoring Active Directory.
:::
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
-**Step 2 –** Click on the Install agents on Active Directory domain controllers link to deploy
+**Step 2 –** Click the Install agents on Active Directory domain controllers link to deploy
activity agents to multiple domain controllers.
:::note
-The Activity Monitor will validate the entered Host Name or IP Address entered in the
+The Activity Monitor will validate the Host Name or IP Address entered in the
**Server Name** text box.
:::
-**Step 3 –** Specify the port that should be used by the new agent(s).
+**Step 3 –** Specify the port that should be used by the new agents.
@@ -77,24 +78,24 @@ controllers to monitor all activity of the domain.
-**Step 8 –** Click the **Test** button to verify the connection to the domains selected. Once the
+**Step 8 –** Click the **Test** button to verify the connection to the domains selected. After the
connection is verified, click **Next** to continue.
**Step 9 –** On the Windows Agent Settings page, there are two settings to configure.
-- Add Windows file activity monitoring – Select the check box to add Windows file activity
+- Add Windows file activity monitoring – Select the checkbox to add Windows file activity
monitoring after installing the agent. By default a new agent install monitors nothing. If
administrators want to monitor file activity on Windows servers, it is easier to enable it after
installation of the agent. Windows file activity monitoring can be enabled and configured later in
the console.
- Management Group – By default, the agent only accepts commands form members of the
BUILTIN\Administrators group. Less privilege accounts can be configured to manage the agent with
- the Management Group setting. Keep in mind that only administrators can install, update and
+ the Management Group setting. Only administrators can install, update, and
uninstall the agent.
-**Step 10 –** Click **Finish**. The Add New Agent(s) window closes, and the activity agent is
+**Step 10 –** Click **Finish**. The Add New Agents window closes, and the activity agent is
deployed to and installed on the target host.
During the installation process, the status will be Installing. If there are any errors, the
diff --git a/docs/activitymonitor/8.0/admin/agents/linux.md b/docs/activitymonitor/8.0/admin/agents/linux.md
index 7d71cbd98e..192b679b5a 100644
--- a/docs/activitymonitor/8.0/admin/agents/linux.md
+++ b/docs/activitymonitor/8.0/admin/agents/linux.md
@@ -13,22 +13,20 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer (formerly Enterprise Auditor)
- Netwrix Threat Manager
-Prior to adding a Windows host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Windows host to the Activity Monitor, the prerequisites for the target environment
must be met. See the [Linux Agent Server Requirements](/docs/activitymonitor/8.0/requirements/linuxagent.md) topic
for additional information.
## Deploy Linux Agent
-Follow the steps to deploy the agent to the Linux host.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
-
-
+
**Step 2 –** On the Install New Agent page, enter the server name for the Linux host. Click
**Next**.
@@ -40,7 +38,7 @@ is **4498**. Click **Next**.
-**Step 4 –** On the Credentials To Connect To The Server(s) page, connect to the Linux Server using
+**Step 4 –** On the Credentials To Connect To The Servers page, connect to the Linux Server using
either a **User name** and **Password**, or a Public Key.
The options for connecting with a Password are:
@@ -101,7 +99,7 @@ the failed connection.
**Step 6 –** On the Linux Agent Options page, select which user name to use to run the daemon. To
use root, leave the **Service user name** field blank. Click **Test** to test the connection.
-**Step 7 –** Click **Finish**. The Add New Agent(s) window closes, and the activity agent is
+**Step 7 –** Click **Finish**. The Add New Agents window closes, and the activity agent is
deployed to and installed on the target host.
During the installation process, the status will be **Installing**. If there are any errors,
@@ -113,7 +111,7 @@ When the Linux agent installation is complete, the status changes to **Installed
Host is also configured, and the added Linux host is displayed in the monitored hosts table. See the
[Monitored Hosts Tab](/docs/activitymonitor/8.0/admin/monitoredhosts/overview.md) topic for additional information.
-Once a host has been added for monitoring, configure the desired outputs. See the
+Once a host has been added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic for additional information.
## Host Properties for Linux
diff --git a/docs/activitymonitor/8.0/admin/agents/multiple.md b/docs/activitymonitor/8.0/admin/agents/multiple.md
index c05fb4f21f..f2a8c7f76b 100644
--- a/docs/activitymonitor/8.0/admin/agents/multiple.md
+++ b/docs/activitymonitor/8.0/admin/agents/multiple.md
@@ -7,8 +7,7 @@ sidebar_position: 20
# Multiple Activity Agents Deployment
Before deploying the activity agent, ensure all Prerequisites are met, including those for NAS
-devices when applicable. Follow the steps to deploy the activity agent to a multiple Windows
-servers. See the [Activity Agent Server Requirements](/docs/activitymonitor/8.0/requirements/activityagent/activityagent.md) topic
+devices when applicable. See the [Activity Agent Server Requirements](/docs/activitymonitor/8.0/requirements/activityagent/activityagent.md) topic
for additional information.
:::note
@@ -17,7 +16,7 @@ environments.
:::
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
@@ -44,7 +43,7 @@ There are two methods for adding multiple hosts are:
**Manual Entry**
-Use **Manual Entry** to manually type the host names or IP addresses of the servers to be monitored.
+Use **Manual Entry** to manually enter the host names or IP addresses of the servers to be monitored.
@@ -76,9 +75,9 @@ For Import a List:
The Activity Monitor will monitor the Host Names or IP Address added to the **Install Agents on
Multiple Hosts** table. Click **Next**.
-
+
-**Step 5 –** On the Credentials To Connect To The Server(s) page, connect to the server using either
+**Step 5 –** On the Credentials To Connect To The Servers page, connect to the server using either
a **User name** and **password**, a Public Key, or a Client Certificate.
The options for connecting with a Password are:
@@ -86,7 +85,7 @@ The options for connecting with a Password are:
- User name
- Password
-
+
The options for connecting with a Public Key are:
@@ -107,7 +106,7 @@ Using an existing Client Certificate installs a new agent without using SSH.
**Step 6 –** Click **Connect** to test the connection. If the connection is successful, click
**Next**.
-The credentials are tested against each server added on the **Install Agent(s) on Multiple Hosts**
+The credentials are tested against each server added on the **Install Agents on Multiple Hosts**
page. If the connection is unsuccessful, see the status message that appears for information on the
failed connection. Activity agents are only successfully deployed for servers where the test status
returns Ok. Failed deployments can be retried through the Connection tab of the agent’s Properties
@@ -115,22 +114,18 @@ window. When one or more of the connections are successful, click Next.
-**Step 7 –** On the Agent Install Location page, browse to theselect the agent installation path.
+**Step 7 –** On the Agent Install Location page, select the agent installation path.
The default path is `C:\Program Files\Netwrix\Activity Monitor\Agent`. Click **Next**.
**Step 8 –** On the Windows Agent Settings window, configure the following options:
-- Add Windows file activity monitoring after installation — Check the Add Windows file activity
- monitoring after installation checkbox to enable monitoring all file system activity on the
- targeted Windows server after installation.
-- Management Group — By default, the agent only accepts commands from members from the
- BUILTIN\Administrators group. Less privileged accounts can be used to manage the agent with the
- Management group setting. Keep in mind that an administrator account must be used to install,
- upgrade, or uninstall an agent.
+- Add Windows file activity monitoring after installation — Check this checkbox to enable monitoring of all file system activity on the Windows server after installation.
+- Management Group — By default, the agent only accepts commands from members of the
+ BUILTIN\Administrators group. Less privileged accounts can manage the agent with this setting, but an administrator account is still required to install, upgrade, or uninstall the agent.
-**Step 9 –** Click Finish. The Add New Agent(s) window closes, and the activity agent is deployed to
+**Step 9 –** Click Finish. The Add New Agents window closes, and the activity agent is deployed to
and installed on the target host.
During the installation process, the status will be **Installing**. If there are any errors, the
diff --git a/docs/activitymonitor/8.0/admin/agents/overview.md b/docs/activitymonitor/8.0/admin/agents/overview.md
index b3109abca8..1995f3d044 100644
--- a/docs/activitymonitor/8.0/admin/agents/overview.md
+++ b/docs/activitymonitor/8.0/admin/agents/overview.md
@@ -12,9 +12,9 @@ available until an agent is installed.
The Agents tab is comprised of a button bar, a table of servers hosting activity agents, and an
-Agent Messages box. The button bar allows users to take the following actions:
+Agent Messages box. Use the button bar to take the following actions:
-- Add Agent – Opens the Add New Agent(s) window to deploy the activity/AD agent to a single server
+- Add Agent – Opens the Add New Agents window to deploy the activity/AD agent to a single server
or to multiple servers at the same time. The following sections provide additional information:
- [Single Activity Agent Deployment](/docs/activitymonitor/8.0/admin/agents/single.md)
@@ -28,7 +28,7 @@ Agent Messages box. The button bar allows users to take the following actions:
- Edit – Opens the selected server’s Properties window to modify the server name or credentials. See
the [Agent Properties Window](/docs/activitymonitor/8.0/admin/agents/properties/overview.md) topic for additional information.
-- Start pending modules – Starts AD agent monitoring modules which were not yet started
+- Start pending modules – Starts AD agent monitoring modules which weren't yet started
- Occasionally a Microsoft Security Bulletin impacting LSASS can interfere with the AD agent
instrumentation resulting in LSASS shutting down. The AD agents are configured to monitor for
@@ -47,7 +47,7 @@ Agent Messages box. The button bar allows users to take the following actions:
The table of servers hosting activity agents provides the following information:
- Server Name – Name or IP Address of the server hosting an activity agent
-- Status – Status of the deployed activity agent(s)
+- Status – Status of the deployed activity agents
:::note
If the AD agent has been deployed, a status of “outdated” could apply to either the
diff --git a/docs/activitymonitor/8.0/admin/agents/properties/activedirectory.md b/docs/activitymonitor/8.0/admin/agents/properties/activedirectory.md
index d19031de6b..43912e340c 100644
--- a/docs/activitymonitor/8.0/admin/agents/properties/activedirectory.md
+++ b/docs/activitymonitor/8.0/admin/agents/properties/activedirectory.md
@@ -12,7 +12,7 @@ be enabled for agents on domain controllers.
-The Agent Settings allow users to control the AD agent’s properties:
+The Agent Settings let you control the AD agent’s properties:
- Harden the Agent – Protects the AD agent from being altered, stopped, or started from within the
local Service Control Manager
@@ -22,17 +22,17 @@ The Agent Settings allow users to control the AD agent’s properties:
:::note
This is a safety measure that disables monitoring if the environment changes as in
rare cases the instrumentation may cause LSASS crashes. Should the version change occur, a
- warning will be shown next to the agent on the Agents page. The **Start pending modules** button
- allows you to force the agent to enable monitoring.
+ warning will be shown next to the agent on the Agents page. Use the **Start pending modules** button
+ to force the agent to enable monitoring.
:::
- Enable DNS Host Name Resolution – If selected, the AD agent looks up the missing data (a NetBIOS
- name, a Fully Qualified Domain Name, or an IP Address) that is missing fromthe event
+ name, a Fully Qualified Domain Name, or an IP Address) that is missing from the event
:::note
This provides more uniform data, but may have a performance impact on the machine
- where the AD agent is deployed, especially if that machine does not handle the name resolution
+ where the AD agent is deployed, especially if that machine doesn't handle the name resolution
locally.
:::
@@ -61,15 +61,15 @@ Monitoring through Threat Prevention.
:::
-If Threat Prevention data is not used by other Netwrix products, uninstall the activity agent from
-the domain controllers if you do not plan to receive Active Directory activity in Activity Monitor
-anymore and the agents are not used for file system monitoring. If Threat Prevention data is to be
+If Threat Prevention data isn't used by other Netwrix products, uninstall the activity agent from
+the domain controllers if you don't plan to receive Active Directory activity in Activity Monitor
+anymore and the agents aren't used for file system monitoring. If Threat Prevention data is to be
used by other Netwrix products, see the Configuring StealthINTERCEPT to Send Active Directory
Activity to the Activity Monitor topic for additional information.
## Configuring StealthINTERCEPT to Send Active Directory Activity to the Activity Monitor
-Once the activity agent is deployed to a domain controller with an existing Threat Prevention agent,
+When the activity agent is deployed to a domain controller with an existing Threat Prevention agent,
a connection can be secured between both agents. Follow these instructions to configure the policy
used for Active Directory Activity Monitoring from the Threat Prevention Admin Console.
diff --git a/docs/activitymonitor/8.0/admin/agents/properties/additionalproperties.md b/docs/activitymonitor/8.0/admin/agents/properties/additionalproperties.md
index 3f6f07914d..9641062545 100644
--- a/docs/activitymonitor/8.0/admin/agents/properties/additionalproperties.md
+++ b/docs/activitymonitor/8.0/admin/agents/properties/additionalproperties.md
@@ -17,7 +17,7 @@ The Additional Properties tab for the Activity Agent has the following configura
- Comment – Create an annotation for the agent in the **Comment** text box. Annotations entered here
will appear in the Comment column in the table on the Agents tab.
-- Agent's Trace Level – Select a trace level for the agent log from the drop-down list:
+- Agent's Trace Level – Select a trace level for the agent log from the dropdown list:
- Same Level as the Console (uses the global level selected in the console)
- Trace (the most verbose) many collection points and can slow down
@@ -34,7 +34,7 @@ The Additional Properties tab for the Activity Agent has the following configura
- Error
- Fatal
-In certain situations, the trace logs are not enough to identify issues. Collect extended debugging
+In certain situations, the trace logs aren't enough to identify issues. Collect extended debugging
data (ETW) can be useful for problems related to the following:
- Not getting events
@@ -47,8 +47,7 @@ When this is needed, enable the **Collect extended debugging data (ETW) from the
the Trace level is activated** option to diagnose these problems.
:::warning
-Selecting this option collects a large amount of data. Therefore, it is important to
-enable it only for short periods of time. Otherwise, the trace file may overflow with data.
+Selecting this option collects a large amount of data. Enable it only for short periods of time. Otherwise, the trace file may overflow with data.
:::
@@ -66,7 +65,7 @@ The Additional Properties tab for the Linux Agent has the following configuratio
- Comment – Create an annotation for the agent in the **Comment** text box. Annotations entered here
will appear in the Comment column in the table on the Agents tab.
-- Agent's Trace Level – Select a trace level for the agent log from the drop-down list:
+- Agent's Trace Level – Select a trace level for the agent log from the dropdown list:
- Same Level as the Console (uses the global level selected in the console)
- Trace (the most verbose) many collection points and can slow down
diff --git a/docs/activitymonitor/8.0/admin/agents/properties/adusers.md b/docs/activitymonitor/8.0/admin/agents/properties/adusers.md
index 7940bcfb08..1d2606725d 100644
--- a/docs/activitymonitor/8.0/admin/agents/properties/adusers.md
+++ b/docs/activitymonitor/8.0/admin/agents/properties/adusers.md
@@ -22,9 +22,9 @@ The configurable options are:
- Cache TTL for successful results –Specify the caching interval (time-to-live) for successful AD
responses.The default is 10 hours. When an AD query returns a valid username or SID, the response
is cached for the specified time. It is recommended to use large TTL values as the user
- information does not often change.
+ information doesn't often change.
- Cache TTL for failed results – Specify the caching interval (time-to-live) for failed AD
- responses. The default is 1 minute. When an AD query cannot resolve a SID or username, the failed
+ responses. The default is 1 minute. When an AD query can't resolve a SID or username, the failed
result is cached for the specified time. Caching of failed responses helps to reduce the load on
domain controllers and improve performance of event processing. Short TTL values are recommended
to make the product report accurate user information.
diff --git a/docs/activitymonitor/8.0/admin/agents/properties/apiserver.md b/docs/activitymonitor/8.0/admin/agents/properties/apiserver.md
index 0c662b959d..1bdc88a242 100644
--- a/docs/activitymonitor/8.0/admin/agents/properties/apiserver.md
+++ b/docs/activitymonitor/8.0/admin/agents/properties/apiserver.md
@@ -13,7 +13,7 @@ activity.
-Check the Enable API access on this agent box to utilize the options on this tab:
+Check the Enable API access on this agent box to use the options on this tab:
- API server port (TCP): [number] (from 1000 to 65535) – Enter the API server port. The default
is 4494.
@@ -40,7 +40,7 @@ Click Add Application to open the Add or edit API client window.
configuration of monitored hosts/domain, enough to match the monitored hosts to their log
files.
- Read – Provides a read-only access to the list of the agents and their configuration settings;
- configuration of monitored domains; configuration of monitored hosts. The permission does not
+ configuration of monitored domains; configuration of monitored hosts. The permission doesn't
provide access to the saved passwords or other secrets.
- Policy change - Provides permissions required to update the AD Monitoring domain configuration
settings
@@ -53,7 +53,7 @@ Click Add Application to open the Add or edit API client window.
- Secret Expires – Displays the number of days until the Client Secret expires before activated. The
default is 3 days.
-The options below the API Application Access window are:
+The following options are available:
- Managing console/Use this console – Use this console button enters the host name of the Activity
Monitor Console within the textbox
diff --git a/docs/activitymonitor/8.0/admin/agents/properties/archiving.md b/docs/activitymonitor/8.0/admin/agents/properties/archiving.md
index b1240af807..b3db1c0d20 100644
--- a/docs/activitymonitor/8.0/admin/agents/properties/archiving.md
+++ b/docs/activitymonitor/8.0/admin/agents/properties/archiving.md
@@ -13,7 +13,7 @@ agent and move the archived files to another location on the server or to a netw
The Days to keep Log files option, listed under the Log Files tab within Host Properties, applies to
-Archive log files. When the entered number of days entered have passed, the activity logs and
+Archive log files. When the entered number of days have passed, the activity logs and
Archive log files are deleted. The path to the Archive log files is next to the Configure button,
and listed under the Archive Location column within the Agents tab.
@@ -35,7 +35,7 @@ The options in the Configure a network share on this computer window are:
- Grant read access to – Click the ellipsis (…) to specify an account or group to be granted Read
and Write access to the archive
-The options below the **Configure** button are:
+The following options are available:
- Archive log files on an UNC path (e.g. \\host-name.domain.local\share-name) – Click the ellipsis
(…) to browse for a location and select the UNC path
diff --git a/docs/activitymonitor/8.0/admin/agents/properties/connection.md b/docs/activitymonitor/8.0/admin/agents/properties/connection.md
index 8c3241752b..7bd8d915cb 100644
--- a/docs/activitymonitor/8.0/admin/agents/properties/connection.md
+++ b/docs/activitymonitor/8.0/admin/agents/properties/connection.md
@@ -6,12 +6,12 @@ sidebar_position: 60
# Connection Tab
-The Connection tab allows users to modify the agent host server name and the credentials used for
+The Connection tab lets you modify the agent host server name and the credentials used for
installation and communication. The tab varies based on the type of agent selected.
## For Activity Agent
-The server name can be modified in the text box. Modifying the name value does not move the activity
+The server name can be modified in the text box. Modifying the name value doesn't move the activity
agent to a new server. The credentials can be updated or modified as well.
:::tip
@@ -37,14 +37,14 @@ This account must be:
- Membership in the local Administrators group
-If the user name is not specified, the currently logged in user's account will be used.
+If the user name isn't specified, the logged in user's account will be used.
**Less Privileged Permissions Option**
By default, the agent accepts commands only from members of the local Administrators group. You can
allow less privileged accounts to manage the agent with the **Management Group** option. Keep in
mind that you still need to be an administrator to install, upgrade, or uninstall the agent. The
-Management Group applies to the users of the console and API servers. The Management Group does not
+Management Group applies to the users of the console and API servers. The Management Group doesn't
restrict access to the agents, but grants access to its members in addition to existing members of
the local Administrators group.
@@ -52,9 +52,7 @@ The Specify account or group window is opened from a field where a Windows accou
-Follow the steps to use this window.
-
-**Step 1 –** Select the Domain from the drop-down menu.
+**Step 1 –** Select the Domain from the dropdown menu.
**Step 2 –** Enter the Account in the textbox.
@@ -62,7 +60,7 @@ Follow the steps to use this window.
- Use the ellipsis (…) button to open the Select Users, Computers, Service Accounts, or Groups
window to browse for an account.
-**Step 3 –** Then click Resolve. A message displays indicating whether or not the account could be
+**Step 3 –** Then click Resolve. A message displays indicating whether the account could be
resolved.
**Step 4 –** If successful, click OK.
@@ -75,7 +73,7 @@ Properties window closes.
## For Linux Agent
-The server name can be modified in the text box. Modifying the name value does not move the Linux
+The server name can be modified in the text box. Modifying the name value doesn't move the Linux
agent to a new server. The credentials can be updated or modified as well.
:::tip
diff --git a/docs/activitymonitor/8.0/admin/agents/properties/dellceeoptions.md b/docs/activitymonitor/8.0/admin/agents/properties/dellceeoptions.md
index c501b96f64..ae1dd53591 100644
--- a/docs/activitymonitor/8.0/admin/agents/properties/dellceeoptions.md
+++ b/docs/activitymonitor/8.0/admin/agents/properties/dellceeoptions.md
@@ -7,7 +7,7 @@ sidebar_position: 70
# Dell CEE Options Tab
The Dell CEE Options tab provides options to configure Dell Common Event Enabler (CEE) settings for
-monitoring Dell devices. File activity monitoring leverages the Dell CEE to deliver activity events
+monitoring Dell devices. File activity monitoring uses the Dell CEE to deliver activity events
from Dell devices.
CEE supports two protocols to deliver events to Activity Monitor: RPC and HTTP. An agent can receive
@@ -63,7 +63,7 @@ Properties window closes.
## Windows CEE Manual Configuration
Windows CEE is configured with the windows registry and depends on the selected event delivery mode,
-AUDIT or VCAPS.
+AUDIT, or VCAPS.
For the synchronous real-time delivery mode (AUDIT), use the following steps.
@@ -72,7 +72,7 @@ For the synchronous real-time delivery mode (AUDIT), use the following steps.
**Step 2 –** Set the `Enabled` parameter to 1.
-**Step 3 –** If the `EndPoint` parameter is empty, set it to the string listed below. If it is not
+**Step 3 –** If the `EndPoint` parameter is empty, set it to one of the following strings. If it isn't
empty (i.e. some other 3rd party application is also receiving activity events from CEE), append the
following string to the existing `EndPoint` value, separating them with a semicolon.
@@ -89,7 +89,7 @@ For the asynchronous bulk delivery mode with a cadence based on a time period or
**Step 2 –** Set the `Enabled` parameter to 1.
-**Step 3 –** If the `EndPoint` parameter is empty, set it to the string listed below. If it is not
+**Step 3 –** If the `EndPoint` parameter is empty, set it to one of the following strings. If it isn't
empty (i.e. some other 3rd party application is also receiving activity events from CEE), append the
following string to the existing `EndPoint` value, separating them with a semicolon.
@@ -219,7 +219,7 @@ Here's an example for the asynchronous delivery (VCAPS):
```
-Make sure to set `Enabled` to `1` only in `Audit` or `VCAPS` if Activity Monitor is the only product
+ensure to set `Enabled` to `1` only in `Audit` or `VCAPS` if Activity Monitor is the only product
receiving activity from CEE. Otherwise, enable the modes according to all product requirements.
If you want to send activity to several 3rd party applications, separate them with semicolons.
diff --git a/docs/activitymonitor/8.0/admin/agents/properties/dns.md b/docs/activitymonitor/8.0/admin/agents/properties/dns.md
index 5b9f6d0c6e..4088dce8d3 100644
--- a/docs/activitymonitor/8.0/admin/agents/properties/dns.md
+++ b/docs/activitymonitor/8.0/admin/agents/properties/dns.md
@@ -15,7 +15,7 @@ The configurable options are:
- Enable local DNS cache service – Select this checkbox to enable the local DNS cache service. Leave
the option unchecked to disable the local DNS cache service. The DNS cache service proactively
updates data, keeping DNS records up to date and available for real-time event reporting. Use this
- option if your DNS infrastructure cannot handle the load (requests take hundreds of milliseconds)
+ option if your DNS infrastructure can't handle the load (requests take hundreds of milliseconds)
during peak hours.
- DNS servers (IPs) – IP addresses of the DNS servers to be used for look-ups. IP addresses should
be entered as separate addresses with space, comma (,), semicolon (;), or a multi-line list. Leave
@@ -31,16 +31,16 @@ The configurable options are:
the load on DNS servers but may result in stale data being reported.
If the DNS Cache service is used, the records are automatically updated when the TTL expires.
- Cache TTL for failed results – Specify the caching interval (time-to-live) for failed DNS
- responses. The default is 1 minute. When a DNS query cannot resolve an IP address or host-name,
+ responses. The default is 1 minute. When a DNS query can't resolve an IP address or host-name,
the failed result is cached for the specified time. Caching of failed responses helps to reduce
the load on DNS servers and improve performance of event processing.
If the DNS Cache service is used, the records are automatically updated when the TTL expires.
- Maximum cache size – Specify the maximum cache size. The default is 100000.
- Refresh throttle time – Specify the time interval between DNS queries that the DNS Cache service
uses to update expired records. The default is 1000 milliseconds.
- If the DNS Cache service is used, the records are automatically updated when the TTL expires. This
- option allows you to limit the number of DNS requests the service sends to update the cache. A
- throttling period of 100 milliseconds will limit the update task to 10 requests per second.
+ If the DNS Cache service is used, the records are automatically updated when the TTL expires. Use this
+ option to limit the number of DNS requests the service sends to update the cache. A
+ throttling period of 100 milliseconds limits the update task to 10 requests per second.
- Parallelism – Specify how many DNS requests the DNS Cache service is allowed to send in parallel.
High values may overload DNS servers.
diff --git a/docs/activitymonitor/8.0/admin/agents/properties/inactivityalerts.md b/docs/activitymonitor/8.0/admin/agents/properties/inactivityalerts.md
index e0184247d6..8ee077b316 100644
--- a/docs/activitymonitor/8.0/admin/agents/properties/inactivityalerts.md
+++ b/docs/activitymonitor/8.0/admin/agents/properties/inactivityalerts.md
@@ -35,10 +35,10 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:PORT format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:PORT format
in the text box. The server name can be short name, fully qualified name (FQDN), or IP Address, as
long as the organization’s environment can resolve the name format used.
-- Syslog protocol – Identify the **Syslog protocol** to be used for the alert. The drop-down menu
+- Syslog protocol – Identify the **Syslog protocol** to be used for the alert. The dropdown menu
includes:
- UDP
@@ -46,7 +46,7 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
- TLS
:::note
- The TCP and TLS protocols add the **Message framing** drop-down menu. **Message
+ The TCP and TLS protocols add the **Message framing** dropdown menu. **Message
framing** options include:
:::
@@ -61,7 +61,7 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
connection. A connection status message displays with either a green check mark or a red X
identifying the success of the sent test message. Messages vary by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -71,7 +71,7 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
-Custom templates can be created. Select the desired template or create a new template by modifying
+Custom templates can be created. Select the template you want or create a new template by modifying
an existing template within the Syslog Message Template window. The new message template is named
Custom.
@@ -84,7 +84,7 @@ configured interval. The alert is sent to the configured recipients on the Email
-- Syslog server in SERVER[:PORT] format – Type the **SMTP server name** with a SERVER:PORT format in
+- Syslog server in SERVER[:PORT] format – Enter the **SMTP server name** with a SERVER:PORT format in
the text box. The server name can be short name, fully qualified name (FQDN), or IP Address, as
long as the organization’s environment can resolve the name format used.
@@ -98,7 +98,7 @@ configured interval. The alert is sent to the configured recipients on the Email
- Message subject – Click the ellipsis (…) to open the Message Template window to customize the
- subject. Macros can be used to insert
+ subject. Use macros to insert dynamic values.
diff --git a/docs/activitymonitor/8.0/admin/agents/properties/netappfpolicyoptions.md b/docs/activitymonitor/8.0/admin/agents/properties/netappfpolicyoptions.md
index cc523856ae..9863ffaa70 100644
--- a/docs/activitymonitor/8.0/admin/agents/properties/netappfpolicyoptions.md
+++ b/docs/activitymonitor/8.0/admin/agents/properties/netappfpolicyoptions.md
@@ -15,7 +15,7 @@ The available options are:
- FPolicy server port (TCP): [number] (from 1000 to 65535) – Enter the FPolicy server port. The
default is 9999.
-- FPolicy authentication – Select from the following options in the drop-down list. For TLS server
+- FPolicy authentication – Select from the following options in the dropdown list. For TLS server
authentication, a Server certificate is required. For TLS, mutual authentication, a Server
certificate and Client certificate are required.
diff --git a/docs/activitymonitor/8.0/admin/agents/properties/networkproxy.md b/docs/activitymonitor/8.0/admin/agents/properties/networkproxy.md
index bf88d7fe54..3931c36e2e 100644
--- a/docs/activitymonitor/8.0/admin/agents/properties/networkproxy.md
+++ b/docs/activitymonitor/8.0/admin/agents/properties/networkproxy.md
@@ -24,7 +24,7 @@ The configurable options are:
- User name – Specify a user name for the proxy server
- User password – Specify a password for the user name
-- Bypass list – Specify the Bypass list. This is a list of URIs that do not use the proxy server
+- Bypass list – Specify the Bypass list. This is a list of URIs that don't use the proxy server
when accessed. Multiple addresses can be entered separated by space, comma (,), semicolon (;), or
as a multi-line list.
diff --git a/docs/activitymonitor/8.0/admin/agents/properties/nutanix.md b/docs/activitymonitor/8.0/admin/agents/properties/nutanix.md
index fb11790949..c344c8032e 100644
--- a/docs/activitymonitor/8.0/admin/agents/properties/nutanix.md
+++ b/docs/activitymonitor/8.0/admin/agents/properties/nutanix.md
@@ -19,7 +19,7 @@ The available Agent server settings for Nutanix are:
semicolon (;), or as a multi-line list. Leave the box blank to accept connections from any hosts.
:::note
- This setting is optional and it allows you to improve security by limiting the number
+ This setting is optional and improves security by limiting the number
of IP addresses allowed to connect.
:::
diff --git a/docs/activitymonitor/8.0/admin/agents/properties/overview.md b/docs/activitymonitor/8.0/admin/agents/properties/overview.md
index 647e500df6..6945071707 100644
--- a/docs/activitymonitor/8.0/admin/agents/properties/overview.md
+++ b/docs/activitymonitor/8.0/admin/agents/properties/overview.md
@@ -27,6 +27,6 @@ tabs:
- [Panzura Tab](/docs/activitymonitor/8.0/admin/agents/properties/panzura.md) – Activity Agent only
- [Qumulo Tab](/docs/activitymonitor/8.0/admin/agents/properties/qumulo.md) – Activity Agent only
-Select the desired agent and click **Edit** to open the agent’s Properties window.
+Select the agent you want and click **Edit** to open the agent’s Properties window.
diff --git a/docs/activitymonitor/8.0/admin/agents/single.md b/docs/activitymonitor/8.0/admin/agents/single.md
index 0b10301aa5..f6f0cdea82 100644
--- a/docs/activitymonitor/8.0/admin/agents/single.md
+++ b/docs/activitymonitor/8.0/admin/agents/single.md
@@ -8,8 +8,7 @@ sidebar_position: 10
Before deploying the activity agent, ensure all
[Activity Agent Server Requirements](/docs/activitymonitor/8.0/requirements/activityagent/activityagent.md) have been met,
-including those for NAS devices when applicable. Follow the steps to deploy the activity agent to a
-single Windows server.
+including those for NAS devices when applicable.
:::note
These steps are specific to deploying activity agents for monitoring supported target
@@ -17,7 +16,7 @@ environments.
:::
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
@@ -29,9 +28,9 @@ a single server. Leave the field blank to deploy the agent on the local server.
**Step 3 –** On the Specify Port page, specify the port that should be used by the new agent. The
default port is 4498. Click **Next**.
-
+
-**Step 4 –** On the Credentials To Connect To The Server(s) page, select ether Windows or Linux file
+**Step 4 –** On the Credentials To Connect To The Servers page, select ether Windows or Linux file
monitoring. Then, enter the **User name** and **Password** to connect to the API Server.
@@ -54,12 +53,11 @@ default path is `C:\Program Files\Netwrix\Activity Monitor\Agent`. Click **Next*
installation. Alternatively, the Windows monitoring can be enabled later on the Monitored Hosts
page.
- Management Group — By default, the agent only accepts commands from members from the
- BUILTIN\Administrators group. Less privileged accounts can be used to manage the agent with the
- Management group setting. Keep in mind that an administrator account must be used to install,
- upgrade or uninstall an agent. The value must be a domain or local security group entered in the
- DOMAIN\groupname format.
+ BUILTIN\Administrators group. Use the Management group setting to allow less privileged accounts
+ to manage the agent. An administrator account must be used to install, upgrade, or uninstall an
+ agent. The value must be a domain or local security group entered in the DOMAIN\groupname format.
-**Step 8 –** Click Finish. The Add New Agent(s) window closes, and the activity agent is deployed to
+**Step 8 –** Click Finish. The Add New Agents window closes, and the activity agent is deployed to
and installed on the target host.
During the installation process of the agent, the status will display Installing. If there are any
diff --git a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/authentication.md b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/authentication.md
index 89c32e2148..da3c402c63 100644
--- a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/authentication.md
+++ b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/authentication.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Authentication Tab
-The Authentication tab on a domain’s Configuration window allows users to configure communication
+Use the Authentication tab on a domain’s Configuration window to configure communication
with servers.
@@ -27,16 +27,16 @@ sub-tabs:
The Forged Privilege Account Certificate (PAC) analytic type identifies Kerberos tickets with a
modified PAC. By manipulating the PAC, a field in the Kerberos ticket that contains a user’s
-authorization data (in Active Directory this is group membership), an attacker is able to grant
+authorization data (in Active Directory this is group membership), an attacker can grant
themselves additional elevated privileges.
-Double-click text box to enter specific **RIDs**. Click OK. The AD agent then compares against the
+Double-click text box to enter specific **Relative Identifiers (RIDs)**. Click OK. The AD agent then compares against the
PAC and user’s access token for a mismatch to trigger the incident.
:::note
-The Forged PAC analytic is monitoring for when the user is not a member of a group that is
+The Forged PAC analytic is monitoring for when the user isn't a member of a group that is
listed in the PAC section of the user’s Kerberos ticket. This analytic can be scoped to monitor
specific groups. To reduce the number of false positives, the AD agent only checks for a mismatch of
sensitive groups as selected in the policy Settings tab.
@@ -91,7 +91,7 @@ Underneath each section, there is an additional Address detail:
- Value – Must be provided in IP address format
-Double-click the text box beneath **Value** to enter the desired IP Addresses to include or exclude.
+Double-click the text box beneath **Value** to enter the IP Addresses to include or exclude.
Press the Enter or Tab key to add another text box.
## IP Addresses (To)
@@ -106,7 +106,7 @@ Underneath each section, there is an additional Address detail:
Value – Must be provided in IP address format
-Double-click the text box beneath **Value** to enter the desired IP Addresses to include or exclude.
+Double-click the text box beneath **Value** to enter the IP Addresses to include or exclude.
Press the Enter or Tab key to add another text box.
## Operations
@@ -122,7 +122,7 @@ failed events, or both:
- Failure – Monitors failed events
The **Monitor These Protocols** section is where authentication protocols to be monitored are
-selected for the policy. Check the box to select the authentication protocol(s) to be monitored:
+selected for the policy. Check the box to select the authentication protocols to be monitored:
- All
- Kerberos
@@ -140,7 +140,7 @@ Local Interactive and/or Remote Interactive logins to the Domain Controllers:
- All - Report all authentication activity approved by the Domain Controller which includes any
local or RDP direct connections to the DC.
- - Local - Report only local login to the Domain Controller - ignore all else
+ - Local - Report only local log in to the Domain Controller - ignore all else
- Remote - Report only remote/RDP access to the Domain Controller - ignore all else
- Exclude failed authentications with previously valid (N-2) password – If enabled, allows to ignore
@@ -157,7 +157,7 @@ The Servers option targets servers to be included or excluded when filtering for
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers to include or exclude. Press the
Enter or Tab key to add another text box.
## Users
@@ -184,7 +184,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath **Type** to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types to include or
+exclude. Double-click the text box beneath **Type** to enter the AD object to include or
exclude. Press the Enter or Tab key to add another text box. Check the box under **Subtree** to
include or exclude child contexts.
diff --git a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/changes.md b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/changes.md
index 9f8b3959d2..399effd8de 100644
--- a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/changes.md
+++ b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/changes.md
@@ -32,8 +32,8 @@ based on the new value.
-Double-click the text box beneath Name to enter the desired attribute to include or exclude.
-Double-click the text box beneath Value to enter the desired attribute value to reference. Choose
+Double-click the text box beneath Name to enter the attribute you want to include or exclude.
+Double-click the text box beneath Value to enter the attribute value you want to reference. Choose
the Operation to relate the Name and Value with. Press the **Enter** or **Tab** key to add another
textbox.
@@ -43,16 +43,16 @@ Name field must contain Active Directory attribute name.
Scoping the filter captures events when the new value matches with the supplied value. To scope the
-filter based on the new value of the attribute, use the Operation drop-down menu.
+filter based on the new value of the attribute, use the Operation dropdown menu.
- AnyValue – No scoping applied for this attribute
- EmptyValue – Blank attribute values
- Equal – Attribute values that are identical to the Value field
-- NotEqual – Attribute values that do not match the Value field
+- NotEqual – Attribute values that don't match the Value field
- LessThan – Attribute values below the supplied numeric value or before alphabetically
- GreaterThan – Attribute values above the supplied numeric value or after alphabetically
- Contains – Attribute values includes the user supplied string (numbers are treated as strings)
-- NotContain – Attribute values do not include the user supplied string (numbers are treated as
+- NotContain – Attribute values don't include the user supplied string (numbers are treated as
strings)
- Startswith – Attribute values start with the user supplied string
@@ -63,7 +63,7 @@ Directory or to exclude specific classes from being monitored.
-Double-click the text box beneath Name to enter the desired classes to include or exclude. Press the
+Double-click the text box beneath Name to enter the classes you want to include or exclude. Press the
**Enter** or **Tab** key to add another text box.
:::note
@@ -88,7 +88,7 @@ Underneath each section, there are additional Context details:
- Distinguished Name – Field must be specified in the form of `distinguishedName` attribute syntax,
e.g. `CN=Users,DC=Domain,DC=com`
-Double-click the text box beneath Distinguished Name to enter the desired context to include or
+Double-click the text box beneath Distinguished Name to enter the context you want to include or
exclude. Press the **Enter** or **Tab** key to add another text box. Check the box under Subtree to
include or exclude child contexts.
@@ -122,7 +122,7 @@ Underneath each section, there is an additional Address detail.
- Value – Must be provided in IP address format
-Double-click the text box beneath **Value** to enter the desired IP addresses to include or exclude.
+Double-click the text box beneath **Value** to enter the IP addresses you want to include or exclude.
Press **Enter** or **Tab** key to add another text box.
## Objects
@@ -137,7 +137,7 @@ Underneath each section, there is an additional Object detail.
- Distinguished Name – Field must be specified in the form of `distinguishedName` attribute syntax,
e.g. `CN=Users,DC=Domain,DC=com`
-Double-click the text box beneath Distinguished Name to enter the desired objects to include or
+Double-click the text box beneath Distinguished Name to enter the objects you want to include or
exclude. Press the **Enter** or **Tab** key to add another text box.
## Operations
@@ -167,7 +167,7 @@ The Servers Tab targets servers to be included or excluded when filtering for ch
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another text box.
## Users
@@ -194,7 +194,7 @@ The following details appear beneath both sections.
e.g. `CN=Users,DC=Domain,DC=com`. However, for objects with `sidType` type, it must be in the form
of WellKnownSidType Enum, e.g. `AnonymousSid` or `LocalSid`.
-Double-click the text box beneath **Distinguished Name** to enter the desired group types to include
-or exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath **Distinguished Name** to enter the group types you want to include
+or exclude. Double-click the text box beneath Type to enter the AD object you want to include or
exclude. Press the **Enter** or **Tab** key to add another text box. Check the box under Subtree to
include or exclude child contexts.
diff --git a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md
index f277f06992..76e56ec01f 100644
--- a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md
+++ b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md
@@ -12,14 +12,14 @@ from being monitored.
The filter options are grouped by AD Global Pre-Filters, and Authentication Global Pre-Filters.
-Check the boxes to activate the filters. To disable for diagnostic purposes, simply uncheck the
-option(s) and click OK. All Authentication Global Pre-Filters options require configuration before
+Check the boxes to activate the filters. To disable for diagnostic purposes, uncheck the
+options and click OK. All Authentication Global Pre-Filters options require configuration before
they can be enabled.
Enable all of the AD Global Pre-Filters options as well as the Exclude Logins from Machine Accounts
option in the Authentication Global Pre-Filters section.
-When activated, the AD Agent(s) filters out the event data according to configuration defined in the
+When activated, the AD Agents filters out the event data according to configuration defined in the
`filters.json` file located in the installation directory.
The configurable options in the Global Filters tab are:
@@ -47,7 +47,7 @@ considered ‘noise’ events. This option can be scoped to include any combinat
- lastLogonTimestamp
- AD User Logins with Bad Password – Excludes events with the following set of attributes where
- ‘objectClass’ does not equal computer:
+ ‘objectClass’ doesn't equal computer:
- badPwdCount
- badPasswordTime
@@ -87,8 +87,8 @@ The Exclude Logins from Machine Accounts collection is only accessible for confi
Global Filters tab.
:::note
-Only perpetrators with accounts ending in “$” are considered for this filter. Wild cards
-(\*) can be used for partial matches to account names.
+Only perpetrators with accounts ending in “$” are considered for this filter. You can use wild cards
+(\*) for partial matches to account names.
:::
@@ -105,7 +105,7 @@ accounts include
“$” in their names so by default authentication traffic generated by these accounts is filtered out because they ‘look’ like machine accounts, which prior to Server 2012 were the only account names ending in “$”.
The ability to add a list of filter strings to the “Exclude Logins from Machine Accounts” global
filter provides a means to capture activity by gMSA type accounts as this activity is typically of
-interest where as true ‘machine accounts’ is not. By supplying either an explicit list of gMSA
+interest where as true ‘machine accounts’ isn't. By supplying either an explicit list of gMSA
account names, or if a naming convention has been adopted, a set of wild card strings such as
“gMSA\*” or “svc\*”, allows capturing authentication activity from such accounts while ignoring the
noisy ‘machine accounts’.
@@ -119,7 +119,7 @@ selected hosts link to open the Edit Hosts window.
The Exclude Authentication Events from selected hosts collection is only accessible for
configuration through the Global Filters tab. All three methods of identification for a host (IP
-Address, NETBIOS host name, or DNS host name) must be known in order to effectively exclude
+Address, NETBIOS host name, or DNS host name) must be known to effectively exclude
authentication from the host. Identify the host to be excluded in the textbox of the IP Address
column and press the Enter or Tab to add another row on the grid. Activity Monitor attempts to
discover the NETBIOS host name and the DNS host name associated with the supplied IP Address.
@@ -135,8 +135,8 @@ selected accounts link to open the Edit Accounts window.
The Exclude Authentication Events from selected accounts collection is only accessible for
-configuration through the Global Filtering tab. Account names [domain name\account] can also be
-typed in the textbox. Wild cards (\*) can be used as part of either the domain name or account. An
+configuration through the Global Filtering tab. Type account names in [domain name\account] format
+in the textbox. Wild cards (\*) can be used as part of either the domain name or account. An
asterisk (\*) appearing anywhere other than as the first character or the last character are treated
as a literal character instead of as a wild card.
diff --git a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md
index 45783a4de6..da8a8f36ec 100644
--- a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md
+++ b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# LDAP Monitor Tab
-The LDAP Monitor tab on a domain’s Configuration window allows users to scope monitoring by adding
+The LDAP Monitor tab on a domain’s Configuration window lets you scope monitoring by adding
filters for accounts by name or type.
@@ -51,7 +51,7 @@ The Query section is where monitoring can be scoped to those LDAP queries that c
of the user-supplied string as a substring in BaseDN or in Query field of the LDAP Search request.
For the Query value, provide the user-supplied string in the text box.
-Double-click the text box beneath Value to enter the desired string. Press the Enter or Tab key to
+Double-click the text box beneath Value to enter the search string you want. Press the Enter or Tab key to
add another text box.
Example Values:
@@ -63,7 +63,7 @@ The Result section is where monitoring can be scoped to those LDAP query results
least one of the user-supplied string as a substring. For the Result value, provide the
user-supplied string in the text box.
-Double-click the text box beneath Value to enter the desired string. Press the Enter or Tab key to
+Double-click the text box beneath Value to enter the result string you want. Press the Enter or Tab key to
add another text box.
Example Value:
@@ -91,7 +91,7 @@ The Servers option targets servers to be included or excluded when filtering for
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the server names to include or exclude. Press the
Enter or Tab key to add another text box.
## Users
@@ -118,7 +118,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath Type to enter the Active Directory object type you want to include or
exclude. Press the Enter or Tab key to add another text box. Check the box under Subtree to include
or exclude child contexts.
diff --git a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md
index 2570b614dc..084a329e7e 100644
--- a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md
+++ b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md
@@ -6,17 +6,17 @@ sidebar_position: 10
# Configure LDAP Monitoring for Netwrix Threat Manager
-Follow the steps to configure LDAP monitoring within Netwrix Activity Monitor for Netwrix Threat
+ monitoring within Netwrix Activity Monitor for Netwrix Threat
Manager.
:::note
-LDAP Monitoring is not enabled, it must be enabled in the Monitored Domains tab.
+LDAP Monitoring isn't enabled, it must be enabled in the Monitored Domains tab.
:::
-**Step 1 –** In the Activity Monitor, click on the **Monitored Domains** tab.
+**Step 1 –** In the Activity Monitor, click the **Monitored Domains** tab.
**Step 2 –** Select a domain and click **Edit**.
diff --git a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md
index 1637915576..1734a4bb0a 100644
--- a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md
+++ b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# LSASS Guardian Tab
-The LSASS Guardian tab allows users to modify settings that were populated with the information
-entered when the host was added to prevent, monitor, or block LSASS code injections.
+Use the LSASS Guardian tab to modify settings that were populated with the information
+entered when the host was added. You can prevent, monitor, or block LSASS code injections.
@@ -37,7 +37,7 @@ The Operations option filters for successful events, failed events, or both.
The Open Process Flags section is where monitoring can be scoped for requested handles that would
maliciously impact LSASS processes.
-Check the box to select the process flag(s) to be monitored:
+Check the box to select the process flags to be monitored:
- PROCESS_VM_WRITE – Writes to memory in a process
- PROCESS_CREATE_THREAD – Creates a thread
@@ -49,13 +49,13 @@ malware applications, can be included/excluded from being monitored by the polic
-Double-click the text box beneath Name to enter the desired processes to include or exclude. Press
+Double-click the text box beneath Name to enter the processes you want to include or exclude. Press
the Enter or Tab key to add another text box.
:::note
-While a processes inclusion is a filter option, it is not recommended for monitoring
+While a processes inclusion is a filter option, it isn't recommended for monitoring
LSASS. Adding a process inclusion filter will limit the scope to only monitor that process. Unknown
-malicious processes would not be monitored in this case.
+malicious processes wouldn't be monitored in this case.
:::
@@ -68,7 +68,7 @@ The Servers option targets servers to be included or excluded when filtering for
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the textbox beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the textbox beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another textbox.
## Users
@@ -95,7 +95,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath Type to enter the Active Directory objects you want to include or
exclude. Press the Enter or Tab key to add another text box. Check the box under Subtree to include
or exclude child contexts.
diff --git a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/replication.md b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/replication.md
index 05cfb7dc9b..245313d8ba 100644
--- a/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/replication.md
+++ b/docs/activitymonitor/8.0/admin/monitoreddomains/admonitoringconfiguration/replication.md
@@ -21,8 +21,8 @@ sub-tabs:
Each filter tab acts like an “AND” statement for the filter. Any filter tab left blank is treated
like an ALL for that filter set.
-Windows cannot detect if a sync request is coming from a legitimate domain controller. This option
-is designed to monitor requests from computers that are not ‘excluded’ by the policy. Therefore,
+Windows can't detect if a sync request is coming from a legitimate domain controller. This option
+is designed to monitor requests from computers that aren't ‘excluded’ by the policy. Therefore,
legitimate domain controllers should be identified in the event filters.
## Host (From) Filter
@@ -56,14 +56,14 @@ The Servers option targets servers to be included or excluded when filtering for
In both cases, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS Domain
name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another text box.
## Users Filter
The Users option is where the policy can be scoped to only monitor specific security principals
committing changes within Active Directory or to exclude specific users committing changes from
-being monitored
+being monitored.
@@ -83,7 +83,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath Type to enter the AD object you want to include or
exclude. Press the Enter or Tab key to add another textbox. Check the box under Subtree to include
or exclude child contexts.
diff --git a/docs/activitymonitor/8.0/admin/monitoreddomains/output/activedirectoryjson.md b/docs/activitymonitor/8.0/admin/monitoreddomains/output/activedirectoryjson.md
index c5a046c00b..110bc30cb3 100644
--- a/docs/activitymonitor/8.0/admin/monitoreddomains/output/activedirectoryjson.md
+++ b/docs/activitymonitor/8.0/admin/monitoreddomains/output/activedirectoryjson.md
@@ -49,11 +49,11 @@ into a JSON log file:
| QueryFilter | LDAP filter used in the operation |
| QueryIsSSL | Indicates if LDAP connection is secure or not |
| QueryObjectsReturned | Number of returned objects produced by the LDAP request |
-| Source | Indicates source of the operation. Currently can be: ‘Authentication’, ‘Active Directory’, ‘LSASS Guardian – Monitor’, ‘LDAP Monitor’, ‘AD Replication Monitoring’. |
+| Source | Indicates source of the operation. can be: ‘Authentication’, ‘Active Directory’, ‘LSASS Guardian – Monitor’, ‘LDAP Monitor’, ‘AD Replication Monitoring’. |
| Success | Indicates if original operation completed successfully or not |
| TargetHost | Contains host name to which authentication attempt took place. In case of failed Kerberos AS, this field contains name of the domain controller. |
| TargetHostIP | If resolved, contains IP address of the target host |
-| TargetProcess | Contains process name that is monitored. Currently this is only lsass.exe. |
+| TargetProcess | Contains process name that is monitored. this is only lsass.exe. |
| TgsReplyEncryptionType | Indicates encryption type used in reply part of the TGS Kerberos ticket. Possible values the same as for EncryptionType. |
| TimeLogged | UTC timestamp of the event |
| UserDN | If resolved, contains DN of the object triggered operation |
diff --git a/docs/activitymonitor/8.0/admin/monitoreddomains/output/output.md b/docs/activitymonitor/8.0/admin/monitoreddomains/output/output.md
index fa9e914587..63363e80f6 100644
--- a/docs/activitymonitor/8.0/admin/monitoreddomains/output/output.md
+++ b/docs/activitymonitor/8.0/admin/monitoreddomains/output/output.md
@@ -27,15 +27,13 @@ domain. The domain event outputs are:
## Add File Output
-Follow the steps to add a File output.
+**Step 1 –** On the Monitored Domains tab, select the domain you want and click **Add Output**.
-**Step 1 –** On the Monitored Domains tab, select the desired domain and click **Add Output**.
-
-**Step 2 –** Select **File** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **File** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
@@ -45,15 +43,13 @@ information.
## Add Syslog Output
-Follow the steps to add a Syslog output.
-
-**Step 1 –** On the Monitored Domains tab, select the desired domain and click **Add Output**.
+**Step 1 –** On the Monitored Domains tab, select the domain you want and click **Add Output**.
-**Step 2 –** Select **Syslog** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **Syslog** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
@@ -71,16 +67,14 @@ additional information.
:::
-Follow the steps to add a Netwrix Threat Manager output.
-
-**Step 1 –** On the Monitored Domains tab, select the desired domain and click **Add Output**.
+**Step 1 –** On the Monitored Domains tab, select the domain you want and click **Add Output**.
-**Step 2 –** Select **Netwrix Threat Manager (StealthDEFEND)** from the drop-down menu. The Add New
+**Step 2 –** Select **Netwrix Threat Manager (StealthDEFEND)** from the dropdown menu. The Add New
Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
diff --git a/docs/activitymonitor/8.0/admin/monitoreddomains/overview.md b/docs/activitymonitor/8.0/admin/monitoreddomains/overview.md
index 2cc7cc987d..30b217585f 100644
--- a/docs/activitymonitor/8.0/admin/monitoreddomains/overview.md
+++ b/docs/activitymonitor/8.0/admin/monitoreddomains/overview.md
@@ -17,12 +17,12 @@ The Activity Monitor can be configured to monitor the following Active Directory
- Success and Failure on Logon
- LDAP Activity Monitoring
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer (formerly Enterprise Auditor)
- Netwrix Threat Manager
-It also provides the ability to feed activity data to SIEM products.
+It also lets you feed activity data to SIEM products.
**Agents**
@@ -31,8 +31,8 @@ within the domain to be monitored.
**Tab**
-Once the AD Agent(s) installation is complete on a domain controller, the domain appear on the
-Monitored Domains tab. The tab is not visible within the console until at least one AD Agent has
+After the AD Agents installation is complete on a domain controller, the domain appear on the
+Monitored Domains tab. The tab isn't visible within the console until at least one AD Agent has
been deployed.
This tab is comprised of a button bar and a table of domains being monitored. The events stream
@@ -40,7 +40,7 @@ output needs to be designated to view data after an activity search has been per
## Button Bar
-The button bar allows users to take the following actions:
+Use the button bar to take the following actions:
@@ -79,4 +79,4 @@ view more information on various status conditions.
Click the **Down Arrow** to expand the Error Propagation section. The information listed is
-dependent on which domain is currently selected in the Monitored Domains table.
+dependent on which domain is selected in the Monitored Domains table.
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/add/dellpowerscale.md b/docs/activitymonitor/8.0/admin/monitoredhosts/add/dellpowerscale.md
index ceb3e4956f..89ecfacf55 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/add/dellpowerscale.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/add/dellpowerscale.md
@@ -169,7 +169,7 @@ Click **Next**.
-**Step 9 –** If **Log File)** is selected on the **Where To Log The Activity** page, the **File
+**Step 9 –** If **Log File** is selected on the **Where To Log The Activity** page, the **File
Output** page can be configured.
- Specify output file path – Specify the file path where log files are saved. Click the ellipses
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/add/entraid.md b/docs/activitymonitor/8.0/admin/monitoredhosts/add/entraid.md
index 8857a020c7..feef061144 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/add/entraid.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/add/entraid.md
@@ -34,13 +34,13 @@ AD) changes:
| Invited Users | MIM Service | MyApps | PIM |
| Self-Service Group Management | Self-service Password Management | Terms of Use | |
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer (formerly Enterprise Auditor)
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding aMicrosoft Entra ID host to the Activity Monitor, the prerequisites for the target
+Before adding a Microsoft Entra ID host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[Microsoft Entra ID Activity Auditing Configuration](/docs/activitymonitor/8.0/requirements/activityagent/entraid-activity.md) topic
for additional information.
@@ -53,8 +53,6 @@ monitoring the target environment.
## Add Azure Active Directory / Entra ID Host
-Follow the steps to add a Microsoft Entra ID host to be monitored.
-
**Step 1 –** In the Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -120,26 +118,26 @@ Click **Next**.
**Step 8 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -150,7 +148,7 @@ Click **Finish**.
The added Microsoft Entra ID host is displayed in the monitored hosts table. Once a host has been
-added for monitoring, configure the desired ouptuts. See the
+added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic for additional information.
## Host Properties for Microsoft Entra ID
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/add/exchangeonline.md b/docs/activitymonitor/8.0/admin/monitoredhosts/add/exchangeonline.md
index ea6bde9f51..d3b1b6a0a9 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/add/exchangeonline.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/add/exchangeonline.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Exchange Online
-Prior to adding an Exchange Online host to the Activity Monitor, the prerequisites for the target
+Before adding an Exchange Online host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[Exchange Online Activity Auditing Configuration](/docs/activitymonitor/8.0/requirements/activityagent/exchange-activity.md)
topic for additional information.
@@ -19,8 +19,6 @@ monitoring the target environment.
## Add Exchange Online Host
-Follow the steps to add an Exchange Online host to be monitored.
-
**Step 1 –** In the Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -38,7 +36,7 @@ _(Optional)_ Enter a comment for the Exchange Online host.
**Step 4 –** On the Azure AD / Entra ID Connection page, enter Tenant ID, Client ID, Client Secret,
-and Region(optional) then click **Connect** to verify the connection.. Click **Open Instruction...**
+and Region(optional) then click **Connect** to verify the connection. Click **Open Instruction...**
for steps on registering the Activity Monitor with Microsoft Azure. Click **Next**.
@@ -100,26 +98,26 @@ Click **Next**.
**Step 10 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -130,7 +128,7 @@ Click **Finish**.
The added Exchange Online host is displayed in the monitored hosts table. Once a host has been added
-for monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md)
+for monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md)
topic for additional information.
## Host Properties for Exchange Online
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/add/hitachi.md b/docs/activitymonitor/8.0/admin/monitoredhosts/add/hitachi.md
index 8871fc4d36..05c5cbc70e 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/add/hitachi.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/add/hitachi.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,13 +22,13 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/8.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer (formerly Enterprise Auditor)
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Hitachi host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Hitachi host to the Activity Monitor, the prerequisites for the target environment
must be met. See the
[Hitachi Activity Auditing Configuration](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md) topic for
additional information.
@@ -41,8 +41,6 @@ monitoring the target environment.
## Add Hitachi NAS Host
-Follow the steps to add a Hitachi host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -70,7 +68,7 @@ Operations** to be monitored. Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the options you want:
- Report UNC paths – Adds a UNC Path column and a Rename UNC Path column in the generated TSV files
- This option corresponds to the REPORT_UNC_PATH parameter in the INI file. It is disabled by
@@ -90,7 +88,7 @@ Click **Next**.
**Step 7 –** On the Where To Log The Activity page, select whether to send the activity to either a
-**Log File)** or **Syslog Server**. Click **Next**.
+**Log File** or **Syslog Server**. Click **Next**.
@@ -124,26 +122,26 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -154,7 +152,7 @@ Click **Finish**.
The added Hitachi host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Hitachi
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/add/nasuni.md b/docs/activitymonitor/8.0/admin/monitoredhosts/add/nasuni.md
index b426f8175a..93a6b652ed 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/add/nasuni.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/add/nasuni.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,13 +22,13 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/8.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer (formerly Enterprise Auditor)
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Nasuni Edge Appliance host to the Activity Monitor, the prerequisites for the
+Before adding a Nasuni Edge Appliance host to the Activity Monitor, the prerequisites for the
target environment must be met. See the
[Nasuni Edge Appliance Activity Auditing Configuration](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md) topic
for additional information.
@@ -41,8 +41,6 @@ monitoring the target environment.
## Add Nasuni Host
-Follow the steps to add a Nasuni Edge Appliance host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -62,7 +60,7 @@ Click **Next**.
**Step 4 –** On the Nasuni Options page, enter the **API Key Name** and the **API Key Value**. Click
Connect to validate the connection with the Nasuni device.
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -103,7 +101,7 @@ Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the options you want:
- Report account names – Adds an Account Name column in the generated TSV files
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -128,7 +126,7 @@ Click **Next**.
**Step 7 –** On the Where To Log The Activity page, select whether to send the activity to either a
-**Log File)** or **Syslog Server**. Click **Next**.
+**Log File** or **Syslog Server**. Click **Next**.
@@ -162,26 +160,26 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -192,7 +190,7 @@ Click **Finish**.
The added Nasuni host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Nasuni
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/add/netapp.md b/docs/activitymonitor/8.0/admin/monitoredhosts/add/netapp.md
index 32ddf13041..816222b12b 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/add/netapp.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/add/netapp.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,13 +22,13 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/8.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer (formerly Enterprise Auditor)
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a NetApp Data ONTAP host to the Activity Monitor, the prerequisites for the target
+Before adding a NetApp Data ONTAP host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[NetApp Data ONTAP Cluster-Mode Activity Auditing Configuration](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md)
topic or the
@@ -43,8 +43,6 @@ monitoring the target environment.
## Add NetApp Host
-Follow the steps to add a NetApp Data ONTAP host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -59,8 +57,7 @@ window opens.
textbox, enter the following information:
- Cluster-Mode devices – Enter the NetApp Filer/SVM
-- 7-Mode devices – Enter the NetApp DNS name. If using vFilers, then it is necessary to use the
- vFiler name here.
+- 7-Mode devices – Enter the NetApp DNS name. If using vFilers, use the vFiler name here.
Click **Next**.
@@ -76,10 +73,10 @@ how it is in NetApp's FPolicy configuration.
- NetApp Filer or SVM – Enter the name of the NetApp Filer or SVM. The name is case sensitive.
- Management LIF – _(Optional)_ If using Cluster Management LIF, a Management LIF can be specified
- if SVM Management LIF is not used (Vserver Tunneling)
+ if SVM Management LIF isn't used (Vserver Tunneling)
- User name – Enter the user name for the credentials to connect to the NetApp server
- User password – Enter the password for the credentials to connect to the NetApp server
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -100,7 +97,7 @@ Click **Next**.
-**Step 5 –** On the NetApp Mode FPolicy Configuration page, choose whether or not to automatically
+**Step 5 –** On the NetApp Mode FPolicy Configuration page, choose whether to automatically
configure FPolicy through Activity Monitor. If that is desired, check the Configure FPolicy option.
Any additional permissions required are listed. Be sure to select the appropriate file protocol to
configure the FPolicy.
@@ -123,7 +120,7 @@ Click **Next**.
:::info
For NetApp Cluster-Mode, create a tailored FPolicy manually. If manually
-configuring the FPolicy, do not select the ConfigureFPolicy checkbox.
+configuring the FPolicy, don't select the ConfigureFPolicy checkbox.
:::
@@ -137,7 +134,7 @@ minimum, the less privileged permissions. For Cluster-mode devices, the credenti
as ‘Employing the “Enable and connect FPolicy” Option’.
:::warning
-On the NetApp FPolicy Enable and Connect page, choose whether or not to Enable and
+On the NetApp FPolicy Enable and Connect page, choose whether to Enable and
connect FPolicy, which will “Ensure everything is active with periodic checks.”
:::
@@ -152,9 +149,9 @@ Additional permissions that are required if enabling **Enable and connect FPolic
**Important Notes**
:::info
-Enable this functionality. Without this option enabled, it is necessary to
-manually connect the FPolicy every time it is disconnected for any reason. For reliable, high
-availability file monitoring, use this option.
+Enable this functionality. Without this option enabled, you must manually connect the FPolicy
+every time it is disconnected for any reason. For reliable, high availability file monitoring,
+use this option.
:::
@@ -184,7 +181,7 @@ properties > Operations tab.
If the Configure FPolicy option is enabled, then Activity Monitor updates the FPolicy according to
-these settings. If it was not enabled, then the manually configured FPolicy must be set to monitor
+these settings. If it wasn't enabled, then the manually configured FPolicy must be set to monitor
these operations. Only operations being monitored by the FPolicy are available to the activity
agent.
@@ -208,7 +205,7 @@ Click **Next**.
**Step 8 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the options you want:
- Report account names – Adds an Account Name column in the generated TSV files
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -238,7 +235,7 @@ Click **Next**.
-**Step 10 –** If **Log File)** is selected on the **Where To Log The Activity** page, the **File
+**Step 10 –** If **Log File** is selected on the **Where To Log The Activity** page, the **File
Output** page can be configured.
- Specify output file path – Specify the file path where log files are saved. Click the ellipses
@@ -268,26 +265,26 @@ Click **Next**.
**Step 11 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -298,23 +295,20 @@ Click **Finish**.
The added NetApp host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
for additional information.
:::tip
-Remember, if automatic configuration of the FPolicy was selected, it is necessary to Configure
+Remember, if automatic configuration of the FPolicy was selected, configure
Privileged Access.
:::
## Configure Privileged Access
-If automatic configuration of the FPolicy is used for NetApp Data ONTAP Cluster-Mode devices, it is
-necessary to configure privileged access. Follow the steps to configure privileged access. Remember,
-this requires the provisioned user account to have full permissions, identified as the credentials
-‘Employing the “Configure FPolicy” Option’.
+If automatic configuration of the FPolicy is used for NetApp Data ONTAP Cluster-Mode devices, configure privileged access. Remember, this requires the provisioned user account to have full permissions, identified as the credentials ‘Employing the “Configure FPolicy” Option’.
-**Step 1 –** On to the Monitored Hosts tab, select the desired host and click Edit. The host’s
+**Step 1 –** On the Monitored Hosts tab, select the host you want and click Edit. The host’s
Properties window opens.
@@ -327,7 +321,7 @@ This option is only available if the Configure FPolicy option is enabled.
:::
-Privileged access must be allowed and configured with appropriate credentials to leverage Access
+Privileged access must be allowed and configured with appropriate credentials to enable Access
Analyzer permission (FSAA) scans for this NetApp device
For information on the other options for this tab, see the [FPolicy Tab](/docs/activitymonitor/8.0/admin/monitoredhosts/properties/fpolicy.md)
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/add/nutanix.md b/docs/activitymonitor/8.0/admin/monitoredhosts/add/nutanix.md
index 920cc727f4..f5545016d4 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/add/nutanix.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/add/nutanix.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,13 +22,13 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/8.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer (formerly Enterprise Auditor)
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Nutanix files host to the Activity Monitor, the prerequisites for the target
+Before adding a Nutanix files host to the Activity Monitor, the prerequisites for the target
environment must be met. See
[Nutanix Files Activity Auditing Configuration](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md) for more
information.
@@ -52,24 +52,22 @@ activity delivery. Nutanix Files server connects to the agent using the TCP port
## Add Nutanix Host
-Follow the steps to add a Nutanix files host to be monitored.
-
-**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click **Add**. The Add New Host
+1. In Activity Monitor, go to the **Monitored Hosts** tab and click **Add**. The **Add New Host**
window opens.
-**Step 2 –** On the Choose Agent page, select the Agent to monitor the file server from the
-drop-down list. Click **Next**.
+2. On the **Choose Agent** page, select the agent to monitor the file server from the
+dropdown list. Click **Next**.
-**Step 3 –** On the Add Host page, select the **Nutanix Files** radio button and enter the file
+3. On the **Add Host** page, select the **Nutanix Files** radio button and enter the file
server name. Click **Next**.
-**Step 4 –** On the Nutanix Options page, enter the user name and password.
+4. On the **Nutanix Options** page, enter the user name and password.
:::note
The credentials used on the Nutanix Options page are for the Nutanix user having REST API
@@ -77,7 +75,7 @@ access.
:::
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -150,7 +148,7 @@ Output page.
- Add header to Log files – Adds headers to TSV files. This is used to feed data into Splunk.
:::note
- Access Analyzer does not support log files with the header.
+ Access Analyzer doesn't support log files with the header.
:::
@@ -161,25 +159,25 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the Where To Log The Activity page, configure the
Syslog Output page.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the **Message framing** drop-down menu. See the
+ The TCP and TLS protocols add the **Message framing** dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -190,7 +188,7 @@ Click **Finish**.
The added Nutanix host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Nutanix
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/add/panzura.md b/docs/activitymonitor/8.0/admin/monitoredhosts/add/panzura.md
index fd80205ed6..9afc916adc 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/add/panzura.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/add/panzura.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,14 +22,14 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/8.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Threat Prevention
- Netwrix Threat Manager
## Add Panzura Host
-Prior to adding a Panzura host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Panzura host to the Activity Monitor, the prerequisites for the target environment
must be met. See the [Panzura CloudFS Monitoring](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/panzura-activity.md) topic for
additional information.
@@ -39,8 +39,6 @@ monitoring the target environment.
:::
-Follow the steps to add a Panzura host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -59,7 +57,7 @@ name**. Click **Next**.
**Step 4 –** On the Panzura Options page, enter the **Username**, **Password**, and select the
**Protocol** to be used by the Panzura host.
-- The different protocols that can be selected are:
+- Select from the following protocols:
- Auto Detect (Default)
- HTTPS
@@ -135,8 +133,7 @@ Output** page can be configured.
- Specify output file path – Specify the file path where TSV log files are saved on the agent's
server. Click the ellipses button (...) to open the Windows Explorer to navigate to a folder
destination. Click **Test** to test if the path works.
-- Period to keep Log files – Log files will be deleted after the period entered as the number of
- days elapses. The default is 10 days. Use the dropdown to specify whether to keep the Log files
+- Period to keep Log files – The system deletes log files after the period you enter, in days. The default is 10 days. Use the dropdown to specify whether to keep the Log files
for a set amount of Minutes, Hours, or Days.
- This log file is for Access Analyzer – Enable this option to have Access Analyzer collect this
monitored host configuration
@@ -159,26 +156,26 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the **Message framing** drop-down menu. See the
+ The TCP and TLS protocols add the **Message framing** dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -189,7 +186,7 @@ Click **Finish**.
The added Panzura host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you need. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Panzura
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/add/qumulo.md b/docs/activitymonitor/8.0/admin/monitoredhosts/add/qumulo.md
index cf852f7cfe..a0f4e884b5 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/add/qumulo.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/add/qumulo.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,13 +22,13 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/8.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer (formerly Enterprise Auditor)
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Qumulo host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Qumulo host to the Activity Monitor, the prerequisites for the target environment
must be met. See the [Qumulo Activity Auditing Configuration](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md)
topic for additional information.
@@ -40,15 +40,13 @@ monitoring the target environment.
## Add Qumulo Host
-Follow the steps to add a Qumulo host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click **Add**. The Add New Host
window opens.
**Step 2 –** On the Choose Agent page, select the Agent to monitor the file server from the
-drop-down list. Click **Next**.
+dropdown list. Click **Next**.
@@ -59,7 +57,7 @@ name. Click **Next**.
**Step 4 –** On the Qumulo Options page, enter the user name and password.
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -92,8 +90,7 @@ Output page.
- Specify output file path – Specify the file path where TSV log files are saved on the agent's
server. Click the ellipses button (...) to open the Windows Explorer to navigate to a folder
destination. Click **Test** to test if the path works.
-- Period to keep Log files – Log files will be deleted after the period entered as the number of
- days elapses. The default is 10 days. Use the dropdown to specify whether to keep the Log files
+- Period to keep Log files – The system deletes log files after the period you enter, in days. The default is 10 days. Use the dropdown to specify whether to keep the Log files
for a set number of Hours or Days.
- This log file is for Access Analyzer – Enable this option to have Access Analyzer collect this
monitored host configuration
@@ -113,7 +110,7 @@ Output page.
- Add header to Log files – Adds headers to TSV files. This is used to feed data into Splunk.
:::note
- Access Analyzer does not support log files with the header.
+ Access Analyzer doesn't support log files with the header.
:::
@@ -124,25 +121,25 @@ Click **Next**.
**Step 7 –** If Syslog Server is selected on the Where To Log The Activity page, configure the
Syslog Output page.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the **Message framing** drop-down menu. See the
+ The TCP and TLS protocols add the **Message framing** dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -152,8 +149,8 @@ Click **Finish**.
-The added Qumulo host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
+The added Qumulo host is displayed in the monitored hosts table. After a host has been added for
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Qumulo
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/add/sharepoint.md b/docs/activitymonitor/8.0/admin/monitoredhosts/add/sharepoint.md
index b171db54fb..ac2483fca8 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/add/sharepoint.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/add/sharepoint.md
@@ -23,11 +23,11 @@ The Activity Monitor can be configured to monitor the following SharePoint chang
- Security principal is added to a security group
- Security principal is removed from a security group
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer (formerly Enterprise Auditor)
-Prior to adding a SharePoint host to the Activity Monitor, the prerequisites for the target
+Before adding a SharePoint host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[SharePoint On-Premise Activity Auditing Configuration](/docs/activitymonitor/8.0/requirements/activityagent/sharepoint-onprem-activity.md)
topic for additional information.
@@ -40,7 +40,7 @@ Remember, the Activity Agent must be deployed to the SharePoint Application serv
## Add SharePoint Host
-Follow the steps to add a SharePoint host to be monitored.
+To add a SharePoint host to be monitored, complete these steps:
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -58,7 +58,7 @@ Click **Next**.
**Step 4 –** On the SharePoint Options page, choose to audit all sites or scope the monitoring to
-specific site(s):
+specific sites:
- Enable auditing on selected site collections – Enabling this option will ensure that auditing is
enabled for all monitored site collections with periodic checks
@@ -95,10 +95,9 @@ Output** page can be configured.
- Specify output file path – Specify the file path where log files are saved. Click the ellipses
button (**...**) to open the Windows Explorer to navigate to a folder destination. Click **Test**
to test if the path works.
-- Period to keep Log files – Log files will be deleted after the period entered number of days
- entered. The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
+- Period to keep Log files – The system deletes log files after the period you enter, in days. The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
set amount of Minutes, Hours, or Days.
-- Log file format – Select whether the log file will be saved as a JSON or TSV file
+- Log file format – Select whether to save the log file as a JSON or TSV file
- This log file is for Access Analyzer – Enable this option to have Access Analyzer collect this
monitored host configuration
@@ -118,26 +117,26 @@ Click **Next**.
**Step 8 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -148,7 +147,7 @@ Click Finish.
The added SharePoint host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for SharePoint
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/add/sharepointonline.md b/docs/activitymonitor/8.0/admin/monitoredhosts/add/sharepointonline.md
index d2acf03958..853cab0bdb 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/add/sharepointonline.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/add/sharepointonline.md
@@ -23,11 +23,11 @@ The Activity Monitor can be configured to monitor the following SharePoint chang
- Security principal is added to a security group
- Security principal is removed from a security group
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer (formerly Enterprise Auditor)
-Prior to adding a SharePoint Online host to the Activity Monitor, the prerequisites for the target
+Before adding a SharePoint Online host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[SharePoint Online Activity Auditing Configuration](/docs/activitymonitor/8.0/requirements/activityagent/sharepoint-online-activity.md)
topic for additional information.
@@ -38,9 +38,9 @@ monitoring the target environment.
:::
-## Add SharePoint Online Host
+## Add a SharePoint Online Host
-Follow the steps to add a SharePoint Online host to be monitored.
+Use the following steps to add a SharePoint Online host to your monitoring configuration.
**Step 1 –** In the Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -50,7 +50,7 @@ window opens.
**Step 2 –** On the Choose Agent page, select the Agent to monitor SharePoint Online.
:::warning
-The domain name must match the SharePoint Online host name in order to properly
+The domain name must match the SharePoint Online host name to properly
integrate SharePoint Online activity monitoring with Access Analyzer.
:::
@@ -71,7 +71,7 @@ Instruction...** for steps on registering the Activity Monitor with Microsoft En
- Approve consent for the organization.
:::note
- Activity Monitor does not store credentials. The credentials are used to enable
+ Activity Monitor doesn't store credentials. The credentials are used to enable
API access using the Client ID and Secret.
:::
@@ -115,8 +115,7 @@ Output** page can be configured. The configurable options are:
- Specify output file path – Specify the file path where log files are saved. Click the ellipses
button (**...**) to open the Windows Explorer to navigate to a folder destination. Click **Test**
to test if the path works.
-- Period to keep Log files – Log files will be deleted after the period entered number of days
- entered. The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
+- Period to keep Log files – The system deletes log files after the period you enter, in days. The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
set amount of Minutes, Hours, or Days.
- This log file is for Netwrix Enterprise Auditor (StealthAUDIT) – Enable this option to have Access
Analyzer collect this monitored host configuration
@@ -137,26 +136,26 @@ Click **Next**.
**Step 8 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -167,7 +166,7 @@ Click **Finish**.
The added SharePoint Online host is displayed in the monitored hosts table. Once a host has been
-added for monitoring, configure the desired ouptuts. See the
+added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic for additional information.
## Host Properties for SharePoint Online
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/add/sqlserver.md b/docs/activitymonitor/8.0/admin/monitoredhosts/add/sqlserver.md
index c975374f6d..7f392d122a 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/add/sqlserver.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/add/sqlserver.md
@@ -8,11 +8,11 @@ sidebar_position: 150
**Understanding SQL Server Activity Monitoring**
-The Activity Monitor provides the ability to feed activity data to other Netwrix products:
+The Activity Monitor lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer (formerly Enterprise Auditor)
-Prior to adding a SQL Server host to the Activity Monitor, the prerequisites for the target
+Before adding a SQL Server host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[SQL Server Activity Auditing Configuration](/docs/activitymonitor/8.0/requirements/activityagent/sqlserver-activity.md) topic for
additional information.
@@ -25,8 +25,6 @@ monitoring the target environment.
## Add MS SQL Server Host
-Follow the steps to add a SQL Server host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -66,7 +64,7 @@ monitored. Click **Next**.
-**Step 7 –** On the SQL Server Logon Trigger page, copy and paste the SQL script into a New Query in
+**Step 7 –** On the SQL Server Logon Trigger page, copy, paste the SQL script into a New Query in
the SQL database. Execute the query to create a logon trigger. Netwrix Activity Monitor will monitor
SQL logon events and obtain IP addresses for connections. The script is:
@@ -106,8 +104,7 @@ Output** page can be configured.
- Specify output file path – Specify the file path where log files are saved. Click the ellipses
button (**...**) to open the Windows Explorer to navigate to a folder destination. Click **Test**
to test if the path works.
-- Period to keep Log files – Log files will be deleted after the period entered number of days
- entered. The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
+- Period to keep Log files – The system deletes log files after the period you enter, in days. The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
set amount of Minutes, Hours, or Days.
- This log file is for Access Analyzer – Enable this option to have Access Analyzer collect this
monitored host configuration
@@ -126,26 +123,26 @@ Output** page can be configured.
**Step 11 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -156,7 +153,7 @@ Click **Finish**.
The added SQL Server host is displayed in the monitored hosts table. Once a host has been added for
-monitoring, configure the desired ouptuts. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you need. See the [Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for SQL Server
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/add/windows.md b/docs/activitymonitor/8.0/admin/monitoredhosts/add/windows.md
index e98fc38e2b..027785952a 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/add/windows.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/add/windows.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,27 +22,24 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/8.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer (formerly Enterprise Auditor)
- Netwrix Threat Manager
-Prior to adding a Windows host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Windows host to the Activity Monitor, the prerequisites for the target environment
must be met. See the
[Windows File Server Activity Auditing Configuration](/docs/activitymonitor/8.0/requirements/activityagent/windowsfs-activity.md)
topic for additional information.
:::tip
-Remember, the Activity Agent must be deployed to the server. It cannot be deployed to a proxy
+Remember, the Activity Agent must be deployed to the server. It can't be deployed to a proxy
server.
:::
## Add Agent's Windows Host
-Follow the steps to add a Windows host to be monitored, if it was not configured when the agent was
-deployed.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts tab and click Add. The Add New Host
window opens.
@@ -59,8 +56,7 @@ must be deployed on the Windows file server to be monitored. If desired, add a *
-**Step 4 –** On the Protocols page, select which protocols to monitor. The protocols that can be
-monitored are:
+**Step 4 –** On the Protocols page, select which protocols to monitor. Choose from the following options:
- All
- CIFS
@@ -95,7 +91,7 @@ in Read events not being monitored.
permission updates occurred resulting in reordered ACEs (Access Control Entries) but with no other
changes in the ACL (Access Control List). For example, if a user is removed in the security
settings of a file, and then the same user is added back with the same security permissions, the
- change is not logged.
+ change isn't logged.
- Suppress Inherited Permission Changes – Filters out events for inherited permission changes. This
option is provided to improve overall performance and reduce output activity log volume.
- Suppress Microsoft Office operations on temporary files – Filters out events for Microsoft Office
@@ -107,7 +103,7 @@ Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the target host. Select the desired options:
+are the activity logs created by the activity agent on the target host. Select the options you want:
- Report Account Names – Adds an Account Name column in the generated TSV files
- Report UNC paths – Adds a UNC Path column and a Rename UNC Path column in the generated TSV files
@@ -136,8 +132,7 @@ Output** page can be configured.
- Specify output file path – Specify the file path where log files are saved. Click the ellipses
button (**...**) to open the Windows Explorer to navigate to a folder destination. Click **Test**
to test if the path works.
-- Period to keep Log files – Log files will be deleted after the period entered number of days
- entered. The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
+- Period to keep Log files – The system deletes log files after the period you enter, in days. The default is 10 days. Use the dropdown to specify whether to keep the Log files for a
set amount of Minutes, Hours, or Days.
- This log file is for Access Analyzer – Enable this option to have Access Analyzer collect this
monitored host configuration
@@ -158,26 +153,26 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -187,8 +182,8 @@ Click **Finish**.
-The added Windows file server host is displayed in the monitored hosts table. Once a host has been
-added for monitoring, configure the desired ouptuts. See the
+The added Windows file server host is displayed in the monitored hosts table. After a host has been
+added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md) topic for additional information.
## Host Properties for Windows File Server
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/output/filetsv.md b/docs/activitymonitor/8.0/admin/monitoredhosts/output/filetsv.md
index 5845383b96..ba075c0be6 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/output/filetsv.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/output/filetsv.md
@@ -9,7 +9,7 @@ sidebar_position: 10
The following information lists all of the columns generated by File Activity Monitor into a TSV log
file, along with descriptions.
-| Column Name(s) | Description |
+| Column Names | Description |
| ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Operation Time | Date timestamp of the event in UTC time Column format is dependent on "Report Operations with millisecond precision" option |
| Host | Host name of the monitored device |
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md b/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md
index 3e43def433..b16fd52553 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/output/output.md
@@ -19,15 +19,13 @@ The host event outputs are:
## Add File Output
-Follow the steps to add a File output.
+**Step 1 –** On the Monitored Hosts tab, select the host you want and click **Add Output**.
-**Step 1 –** On the Monitored Hosts tab, select the desired host and click **Add Output**.
-
-**Step 2 –** Select **File** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **File** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
@@ -37,15 +35,13 @@ information.
## Add Syslog Output
-Follow the steps to add a Syslog output.
-
-**Step 1 –** On the Monitored Hosts tab, select the desired host and click **Add Output**.
+**Step 1 –** On the Monitored Hosts tab, select the host you want and click **Add Output**.
-**Step 2 –** Select **Syslog** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **Syslog** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/output/sharepointtsv.md b/docs/activitymonitor/8.0/admin/monitoredhosts/output/sharepointtsv.md
index 96acd7c24b..0b4cc259fc 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/output/sharepointtsv.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/output/sharepointtsv.md
@@ -6,9 +6,9 @@ sidebar_position: 40
# SharePoint TSV Log File
-The TSV log file format is used to send SharePoint activity monitoring data to Access Analyzer v10.0
-and earlier consoles. The following information lists all of the columns generated by SharePoint
-Activity Monitor into a TSV log file:
+The TSV log file format sends SharePoint activity monitoring data to Access Analyzer v10.0
+and earlier consoles. The following information lists all of the columns that SharePoint
+Activity Monitor generates into a TSV log file:
| Column Name | Description |
| -------------- | -------------------------------------------------------------------------------------------------------------- |
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/overview.md b/docs/activitymonitor/8.0/admin/monitoredhosts/overview.md
index 1c56084974..95ac39be38 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/overview.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/overview.md
@@ -44,7 +44,7 @@ For all other hosts, the agent is deployed to a Windows proxy server.
**Tab**
-Once the agent(s) installation is complete, hosts can be added for monitoring. The tab is not
+After the agents installation is complete, hosts can be added for monitoring. The tab isn't
visible within the console until at least one agent has been deployed.
This tab is comprised of a button bar and a table of hosts being monitored. A list of outputs is
@@ -52,13 +52,13 @@ listed under each monitored host. These are destinations to which events are for
## Button Bar
-The button bar allows users to take the following actions:
+Use the button bar to take the following actions:
- Toggle Collapse – Expands and collapses all Monitored Hosts for viewing or hiding host's outputs
- Add Host – Opens the Add New Host window to configure monitoring of a new host or platform. See
- the section for instructions on adding the desired target environment.
+ the section for instructions on adding the target environment.
- Add Output – Opens the Add New Output windows to create new output for the selected host or hosts.
- Remove – Remove the selected hosts or outputs from the monitored hosts table and end monitoring. A
window prompts for confirmation to remove the selected hosts or outputs.
@@ -68,19 +68,18 @@ The button bar allows users to take the following actions:
## Bulk Actions
-All actions in the button bar except Add Host can be used in the bulk mode. That means youI.e. one
-can select several hosts or outputs and edit, disable, enable, remove them, or add new outputs at
+All actions in the button bar except Add Host support bulk mode. You can select several hosts or outputs and edit, disable, enable, remove them, or add new outputs at
the same time.
Bulk editing allows the user to selectively modify hosts or outputs. For example, with bulk editing
-it is possible to add a user to Account Exclusions, or set the retention period for log files, or
+you can add a user to Account Exclusions, set the retention period for log files, or
disable reporting of Directory Read operations, etc.
To initiate bulk editing, select multiple hosts or outputs (`Ctrl+A` and `Ctrl+Shift+A` may help
-here), and click the **Edit** Edit button. The Properties window shows divergent settings as blank
+here), and click the **Edit** button. The Properties window shows divergent settings as blank
or in the unknown state or with the `<-Different-Values->` marker for the list-like settings. Leave
the `<-Different-Values->` marker to preserve the difference in each selected object, or delete it
-to remove all divergent elements. When the window closes, only changed properties are saved to all
+to remove all divergent elements. When the window closes, the system saves only changed properties to all
selected objects, leaving unchanged properties untouched.
## Table
@@ -100,12 +99,12 @@ The monitored hosts table provides the following information:
for additional information.
- Received Events – Timestamp of the last event received
- Comment – Comment provided by user:
- - Often this indicates the desired output, e.g. Access Analyzer.
+ - Often this indicates the output, e.g. Access Analyzer.
- This can be useful if adding the same monitored host multiple times with different
configurations for different outputs.
- If a Activity Monitor Agent has been deployed to a Windows server where an activity agent is
deployed, then the Comment identifies the host as "Managed by Activity Monitor", and that
- 'monitored host' is not editable. Add the host again for other outputs.
+ 'monitored host' isn't editable. Add the host again for other outputs.
Hosts can have more than one output. To view a host's outputs, expand the host by clicking the white
arrow to the left of the Monitored Host name.
@@ -127,7 +126,7 @@ to view more information on various status conditions.
Click the **Down Arrow** to expand the Status section. The information listed is dependent on which
-host or output is currently selected in the Monitored Hosts table. Users can find information on the
+host or output is selected in the Monitored Hosts table. Users can find information on the
**Current State** of a host, as well as viewing a history of changes in state.
The possible statuses depend on the type of hosts being monitored. What is common is that the status
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/auditing.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/auditing.md
index 76b4e686f3..975f742a3d 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/auditing.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/auditing.md
@@ -6,21 +6,18 @@ sidebar_position: 10
# Auditing Tab
-The Auditing tab allows users to modify to modify the Isilon Options setting which was populated
-with the information entered when the Dell Isilon host is added to the Monitored Hosts list.
+The Auditing tab lets you modify Isilon Options settings. These settings populate with the information you enter when adding the Dell Isilon host to the Monitored Hosts list.
-The **Enable Protocol Access Auditing in OneFS if it is disabled** box allows the activity agent to
-automatically enable and configure auditing on the Isilon cluster. If a manual configuration has
-been completed, do not enable these options. This option requires credentials for an Administrator
-account on the Dell Isilon device and click Connect.
+The **Enable Protocol Access Auditing in OneFS if it is disabled** box lets the activity agent
+automatically enable and configure auditing on the Isilon cluster. If you've already configured auditing manually, don't enable these options. This option requires credentials for an Administrator
+account on the Dell Isilon device; click Connect.
-If the connection is successful, discovered access zones appear in the **Available** box. By
-default, all available access zones are monitored. To monitor specific access zones, use the arrow
-buttons to move access zones to the **Monitored** box. All activity for this configuration for the
-host is collected and placed in a single activity log file per day. This is the supported option for
-integration with StealthAUDIT, which requires all access zones to be monitored from a single
+If the connection succeeds, the system displays discovered access zones in the **Available** box. By
+default, the system monitors all available access zones. To monitor specific access zones, use the arrow
+buttons to move them to the **Monitored** box. The system collects all activity for this configuration and places it in a single activity log file per day. This is the supported option for
+integration with StealthAUDIT, which requires monitoring all access zones from a single
configuration.
To have one activity log file per access zone, create multiple output configurations for the Dell
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/connection.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/connection.md
index a3678eec51..911e00c519 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/connection.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/connection.md
@@ -16,7 +16,7 @@ Configure App Registration information for a Microsoft Entra ID host in the Conn
host's Properties window. Click **Open instructions...** for steps on registering the
Activity Monitor. Click **Sign out** to sign out of the Azure account.
-The options that can be configured on the Connection Tab are:
+You can configure the following options on the Connection Tab:
- Domain
- Azure Cloud
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/dell.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/dell.md
index beffb0b3c4..0b15e5fb22 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/dell.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/dell.md
@@ -7,9 +7,8 @@ sidebar_position: 30
# Dell Tab
The Dell tab on a host’s Properties window displays the Dell Celerra/VNX, Dell Isilon/PowerScale,
-Dell PowerStore, or Dell Unity host to be monitored for activity and any host aliases. This tab is
-populated with the information entered when the Dell host is added to the monitored hosts table. If
-desired, specify a different device to be monitored for activity.
+Dell PowerStore, or Dell Unity host to monitor for activity and any host aliases. This tab populates with the information you enter when adding the Dell host to the monitored hosts table. If
+desired, specify a different device to monitor for activity.
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/fpolicy.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/fpolicy.md
index 20aed7009d..e8059f2096 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/fpolicy.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/fpolicy.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# FPolicy Tab
-The FPolicy tab allows users to modify FPolicy settings for NetApp devices, privileged access, and
+Use the FPolicy tab to modify FPolicy settings for NetApp devices, privileged access, and
enabling/connecting to cluster nodes.
@@ -26,9 +26,9 @@ monitor by selecting the radio buttons.
-The Privileged Access tab is enabled when the Configure FPolicy checkbox is selected at the top. The
-Privileged Access tab must be configured if automatic configuration of the FPolicy for NetApp Data
-ONTAP Cluster-Mode devices is used. See the
+The Privileged Access tab becomes available when you select the Configure FPolicy checkbox at the top. You must configure the
+Privileged Access tab if you use automatic configuration of the FPolicy for NetApp Data
+ONTAP Cluster-Mode devices. See the
[Configure Privileged Access](/docs/activitymonitor/8.0/admin/monitoredhosts/add/netapp.md#configure-privileged-access) topic for additional
information.
@@ -36,11 +36,10 @@ information.
-The Enable and Connect settings tab is enabled when the Enable and connect FPolicy checkbox is
-selected.
+The Enable and Connect settings tab becomes available when you select the Enable and connect FPolicy checkbox.
:::note
-Adding nodes are not needed if set user is using a role that has Network Interface
+You don't need to add nodes if the user has a role with Network Interface
permissions.
:::
@@ -49,33 +48,31 @@ permissions.
Add a list of cluster nodes to connect to FPolicy by clicking Add, which opens the Add or Edit
Cluster Node window. Enter at least one cluster node in the textbox. Separate multiple nodes with
-either commas (,), semicolons (;), or spaces. Click OK and the node(s) is displayed in the **Node
+either commas (,), semicolons (;), or spaces. Click OK and the nodes is displayed in the **Node
name** list.
Click Discover to open the Connect to cluster window and retrieve nodes from the cluster.
-Specify the Cluster-management LIF and then enter user credentials which will be used to retrieve a
+Specify the Cluster-management LIF and enter user credentials to retrieve a
list of the cluster nodes. This credential must have at least read-only rights to run the system
-node show command on the cluster. Click Get Nodes. If a successful connection is not achieved, the
-message indicates the error. If a successful connection is achieved, the message indicates how many
-cluster nodes were discovered. Click OK and all discovered nodes are displayed in the **Node name**
+node show command on the cluster. Click Get Nodes. If the connection fails, the
+message indicates the error. If the connection succeeds, the message indicates how many
+cluster nodes the system discovered. Click OK and all discovered nodes appear in the **Node name**
list.
Use the Remove button to remove the selected node from the list.
## Changing the FPolicy Heartbeat Interval
-The activity agent periodically checks for and re-enables any StealthAUDIT filter policies which had
-been disabled for any reason, i.e. a network outage. Follow the steps to change the frequency of
-checks.
+The activity agent periodically checks for and re-enables any StealthAUDIT filter policies that were disabled for any reason (for example, a network outage).
**Step 1 –** Using Regedt32 navigate to:
**HKEY_LOCAL_MACHINE\SYSTEM\CurrentCotrolSet\Services\FPolicyServerSvc\Parameters**
-**Step 2 –** Right-click on TimeInterval and select Modify.
+**Step 2 –** Right-click TimeInterval and select Modify.
**Step 3 –** Change “Base” to Decimal.
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/hitachinas.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/hitachinas.md
index 88c5c0a550..e85dfe1de0 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/hitachinas.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/hitachinas.md
@@ -12,6 +12,6 @@ is specific to Hitachi hosts.
-The Hitachi NAS tab allows users to modify settings that were populated with the information entered
-when the Hitachi host was added. Additionally, the Path pooling interval can be configured. The Path
+Use the Hitachi NAS tab to modify settings that were populated with the information entered
+when the Hitachi host was added. You can also configure the Path pooling interval. The Path
pooling interval is set to 15 seconds by default.
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/inactivityalerts.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/inactivityalerts.md
index 85b53bcb64..74270832e7 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/inactivityalerts.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/inactivityalerts.md
@@ -6,19 +6,19 @@ sidebar_position: 60
# Inactivity Alerts Tab
-The Inactivity Alerts tab on a host's Properties window is used to configure alerts that are sent
+The Inactivity Alerts tab on a host's Properties window lets you configure alerts to send
when monitored hosts receive no events for a specified period of time.
The configurable options are:
-- Customize inactivity alerting for this host. Otherwise, the agent's settings will be used – Check
+- Customize inactivity alerting for this host. Otherwise, the system uses the agent's settings – Check
this box to enable customization of alert settings for Monitored Hosts
- Enable inactivity alerting for this host – Check this box to enable inactivity alerts for host.
-- Length of inactivity – Specify how much time must pass before an inactivity alert is sent out. The
+- Length of inactivity – Specify how long the system waits before sending an inactivity alert. The
default is **6 hours**.
-- Repeat an alert every – Specify how often an alert is sent out during periods of inactivity. The
+- Repeat an alert every – Specify how often the system sends an alert during periods of inactivity. The
default is **6 hours**.
## Syslog Alerts Tab
@@ -29,7 +29,7 @@ Configure Syslog alerts using the Syslog Alerts Tab.
The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- Syslog protocol – Identify the Syslog protocol to be used for the alerts
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/logontrigger.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/logontrigger.md
index 3bf692cbd9..ee127a8915 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/logontrigger.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/logontrigger.md
@@ -6,7 +6,7 @@ sidebar_position: 70
# Logon Trigger Tab
-The Logon trigger tab on a SQL Server host's properties window is used to configure logon triggers
+The Logon trigger tab on a SQL Server host's properties window lets you configure logon triggers
for SQL activity monitoring.
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/mssqlserver.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/mssqlserver.md
index 50407f779b..964d8f780d 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/mssqlserver.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/mssqlserver.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# MS SQL Server Tab
-The MS SQL Server tab on SQL Server host's properties window is used to configure properties for
+The MS SQL Server tab on SQL Server host's properties window lets you configure
SQL activity monitoring on the host.
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/nasuni.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/nasuni.md
index 1feb092fa9..3dae847895 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/nasuni.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/nasuni.md
@@ -6,12 +6,11 @@ sidebar_position: 90
# Nasuni Tab
-After a Nasuni host is added to the monitored hosts table, the configuration settings are edited
-using the tabs in the Properties window of the host.
+After a Nasuni host is added to the monitored hosts table, you can edit the configuration settings using the tabs in the Properties window.
-The **Nasuni** tab allows users to modify settings which were populated with the information entered
+The **Nasuni** tab lets you modify settings which were populated with the information entered
when the Nasuni host was added.
The configurable options are:
@@ -19,7 +18,7 @@ The configurable options are:
- Nasuni Filer – Enter the name of the filer
- Username – Enter the user name for the Nasuni account
- Password – Enter the password for the user name
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/netapp.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/netapp.md
index 19001fc867..742006d52f 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/netapp.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/netapp.md
@@ -6,7 +6,7 @@ sidebar_position: 100
# NetApp Tab
-The NetApp tab on a host’s Properties window allows users to modify settings, which are populated
+Use the NetApp tab on a host’s Properties window to modify settings, which are populated
with the information entered when the NetApp host is added to the monitored hosts table.
@@ -14,7 +14,7 @@ with the information entered when the NetApp host is added to the monitored host
Modify the targeted NetApp device by specifying a NetApp device to be monitored for activity and
credentials to access it with the Data ONTAP API.
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/nutanix.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/nutanix.md
index 33f42bd3a5..0a4c92a925 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/nutanix.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/nutanix.md
@@ -6,8 +6,8 @@ sidebar_position: 110
# Nutanix Tab
-The Nutanix tab allows users to modify settings after a Nutanix host has been configured. Once a
-Nutanix host is added to the monitored hosts table, the configuration can be edited in the host
+Use the Nutanix tab to modify settings after a Nutanix host has been configured. Once a
+Nutanix host is added to the monitored hosts table, you can edit the configuration in the host
Properties.
@@ -17,7 +17,7 @@ The configurable options are:
- Nutanix Filer – Enter the name of the filer
- Username – Enter the user name for the Nutanix account with REST API access
- Password – Enter the password for the user name
-- Protocol – Select a protocol for the REST API access from the drop-down menu:
+- Protocol – Select a protocol for the REST API access from the dropdown menu:
- Auto Detect
- HTTPS
@@ -36,7 +36,7 @@ verification during a TLS session
- Click **OK** to close the window and save the modifications.
:::note
-Nutanix Files does not report events for activity originating from a server where the
+Nutanix Files doesn't report events for activity originating from a server where the
Activity Monitor Agent is installed.
:::
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/overview.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/overview.md
index 1dcb11d9dc..b5c973bade 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/overview.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/overview.md
@@ -6,12 +6,12 @@ sidebar_position: 20
# Host Properties Window
-Once a host has been added to the Monitored Hosts list, the configuration settings can be modified
+Once a host has been added to the Monitored Hosts list, you can modify the configuration settings
through the host’s Properties window.
-On the Monitored Hosts tab, select the host and click Edit, or right-click on a host and select
+On the Monitored Hosts tab, select the host and click Edit, or right-click a host and select
**Edit Host** from the right-click menu, to open the host’s Properties window. The tabs vary based
on the type of host selected:
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/panzura.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/panzura.md
index 5f05092abc..0e84f45257 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/panzura.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/panzura.md
@@ -6,12 +6,11 @@ sidebar_position: 120
# Panzura Tab
-After a Panzura host is added to the monitored hosts table, the configuration settings are edited
-using the tabs in the Properties window of the host.
+After a Panzura host is added to the monitored hosts table, you can edit the configuration settings using the tabs in the Properties window.
-The **Panzura** tab allows users to modify settings which were populated with the information
+Use the **Panzura** tab to modify settings which were populated with the information
entered when the Panzura host was added.
The configurable options are:
@@ -19,7 +18,7 @@ The configurable options are:
- Panzura Filer – Enter the name of the filer
- Username – Enter the user name for the Panzura account
- Password – Enter the password for the user name
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/qumulo.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/qumulo.md
index 86778e15e5..242398196f 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/qumulo.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/qumulo.md
@@ -6,8 +6,8 @@ sidebar_position: 130
# Qumulo Tab
-The Qumulo tab allows users to modify settings after a Qumulo host has been configured. Once a
-Qumulo host is added to the monitored hosts table, the configuration can be edited in the host
+Use the Qumulo tab to modify settings after a Qumulo host has been configured. Once a
+Qumulo host is added to the monitored hosts table, you can edit the configuration in the host
Properties.
@@ -17,7 +17,7 @@ The configurable options are:
- Cluster name – Enter the name of the filer
- Username – Enter the user name for the Qumulo user
- Password – Enter the password for the user name
-- Protocol – Select one of the following protocols from the drop-down menu:
+- Protocol – Select one of the following protocols from the dropdown menu:
- Auto Detect
- HTTPS
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/sharepoint.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/sharepoint.md
index 5aa8855ebd..bc6ed098a8 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/sharepoint.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/sharepoint.md
@@ -6,7 +6,7 @@ sidebar_position: 140
# SharePoint Tab
-The SharePoint tab on a host’s Properties window allows users to modify settings that are populated
+The SharePoint tab on a host’s Properties window lets you modify settings that are populated
with the information entered when the SharePoint host is added.
@@ -16,7 +16,7 @@ The configurable options are:
- Enable auditing on selected site collections - Check the box to enable auditing on selected site
collections. Enabling this option will ensure that auditing is enabled for all monitored site
collections with periodic checks.
-- Choose to audit all sites or scope the monitoring to specific site(s):
+- Choose to audit all sites or scope the monitoring to specific sites:
- Audit all sites – Leave textbox for URLs blank
- Scope to specific sites – List URLs for sites to be monitored in the textbox. List should be
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/tweakoptions.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/tweakoptions.md
index 3160d1aed8..a4bb4dadba 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/tweakoptions.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/tweakoptions.md
@@ -6,7 +6,7 @@ sidebar_position: 150
# Tweak Options Tab
-The Tweak Options tab on a SQL Server host's properties window is used to configure extended events
+The Tweak Options tab on a SQL Server host's properties window lets you configure extended events
operations for SQL activity monitoring.
diff --git a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/unixids.md b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/unixids.md
index 813cd3478d..fdd2c6b131 100644
--- a/docs/activitymonitor/8.0/admin/monitoredhosts/properties/unixids.md
+++ b/docs/activitymonitor/8.0/admin/monitoredhosts/properties/unixids.md
@@ -9,7 +9,7 @@ sidebar_position: 160
The Unix IDs tab provides configuration options to translate Unix IDs (UID) to SIDs. This tab
applies to NetApp devices, Dell devices, and Nasuni Edge Appliances.
-When activity is performed on an NFS resource, UIDs are returned for that activity event. Depending
+When activity is performed on an NFS resource, the agent returns UIDs for that activity event. Depending
on the operating system, the UID can be mapped to Active Directory accounts using the uidNumber
attribute in Active Directory. The activity agent resolves the Active Directory SID based on the UID
from the activity event.
@@ -24,7 +24,7 @@ The options are:
- This container and its descendants
- This container only
- Search - Search using the following specifications:
- - by an attribute – Specify an LDAP filter. This attribute cannot be empty.
+ - by an attribute – Specify an LDAP filter. This attribute can't be empty.
- with a custom filter – Use the %UID% macro for a Unix ID value
- Provide UID for test/Test – Test button performs a search in the specified container with the
scope and the filter, replacing %UID% with 0 for the test
diff --git a/docs/activitymonitor/8.0/admin/outputs/accountexclusions/accountexclusions.md b/docs/activitymonitor/8.0/admin/outputs/accountexclusions/accountexclusions.md
index 3f8aaa3778..f893638e14 100644
--- a/docs/activitymonitor/8.0/admin/outputs/accountexclusions/accountexclusions.md
+++ b/docs/activitymonitor/8.0/admin/outputs/accountexclusions/accountexclusions.md
@@ -6,8 +6,7 @@ sidebar_position: 10
# Account Exclusions Tab
-The Account Exclusions tab on an output Properties window is where monitoring scope by account name
-can be modified. These settings are initially configured when the output is added.
+The Account Exclusions tab on an output Properties window lets you modify the monitoring scope by account name. These settings are initially configured when the output is added.
Select an output from the Monitored Hosts tab and click **Edit** to open the output Properties
window. The tab varies based on the type of host selected.
@@ -23,7 +22,7 @@ The tab contains the following settings:
information.
- Add Unix Account – Opens the Specify Unix Account window to add an account for exclusion. See the
[Specify Unix Account Window](/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifyunixaccount.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -34,8 +33,8 @@ The tab contains the following settings:
- Process group membership when filtering – Indicates if group memberships is processed when
filtering accounts
-The table lists accounts that are being excluded from monitoring, displaying columns for Account
-Name and Account Type. By default, no accounts are being excluded.
+The table lists accounts you have excluded from monitoring, displaying columns for Account
+Name and Account Type. By default, the system excludes no accounts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The output
Properties window closes.
@@ -51,7 +50,7 @@ The tab contains the following settings:
information.
- Add Unix Account – Opens the Specify Unix Account window to add an account for exclusion. See the
[Specify Unix Account Window](/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifyunixaccount.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -62,8 +61,8 @@ The tab contains the following settings:
- Process group membership when filtering – Indicates if group memberships is processed when
filtering accounts
-The table lists accounts that are being excluded from monitoring, displaying columns for Account
-Name and Account Type. By default, no accounts are being excluded.
+The table lists accounts you have excluded from monitoring, displaying columns for Account
+Name and Account Type. By default, the system excludes no accounts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The output
Properties window closes.
@@ -79,7 +78,7 @@ The tab contains the following settings:
information.
- Add Unix Account – Opens the Specify Unix Account window to add an account for exclusion. See the
[Specify Unix Account Window](/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifyunixaccount.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -90,8 +89,8 @@ The tab contains the following settings:
- Process group membership when filtering – Indicates if group memberships is processed when
filtering accounts
-The table lists accounts that are being excluded from monitoring, displaying columns for Account
-Name and Account Type. By default, no accounts are being excluded.
+The table lists accounts you have excluded from monitoring, displaying columns for Account
+Name and Account Type. By default, the system excludes no accounts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The output
Properties window closes.
@@ -107,7 +106,7 @@ The tab contains the following settings:
information.
- Add SharePoint Account – Opens the Specify account window to add an account for exclusion. See the
[Specify Account Window](/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifysharepointaccount.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -118,8 +117,8 @@ The tab contains the following settings:
- Process group membership when filtering – Indicates if group memberships is processed when
filtering accounts
-The table lists accounts that are being excluded from monitoring, displaying columns for Account
-Name and Account Type. By default, no accounts are being excluded.
+The table lists accounts you have excluded from monitoring, displaying columns for Account
+Name and Account Type. By default, the system excludes no accounts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The output
Properties window closes.
@@ -132,7 +131,7 @@ The tab contains the following settings:
- Add Sql User – Opens the Specify Sql User name window to add an account for exclusion. See the
[Specify Sql User Name Window](/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifysqluser.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -143,8 +142,8 @@ The tab contains the following settings:
- Process group membership when filtering – Indicates if group memberships is processed when
filtering accounts
-The table lists accounts that are being excluded from monitoring, displaying columns for Account
-Name and Account Type. By default, no accounts are being excluded.
+The table lists accounts you have excluded from monitoring, displaying columns for Account
+Name and Account Type. By default, the system excludes no accounts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The output
Properties window closes.
@@ -158,7 +157,7 @@ The tab contains the following settings:
- Add Windows Account – Opens the Specify account or group window to add an account for exclusion.
See the [Specify Account or Group Window](/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifywindowsaccount.md) topic for additional
information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by accident, use the **Cancel** button to discard the
@@ -169,7 +168,7 @@ The tab contains the following settings:
- Process group membership when filtering – Indicates if group memberships is processed when
filtering accounts
-The table lists accounts that are being excluded from monitoring, displaying columns for Account
+The table lists accounts you have excluded from monitoring, displaying columns for Account
Name and Account Type. By default, the Windows File Server monitoring is excluding the following
accounts:
diff --git a/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifysharepointaccount.md b/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifysharepointaccount.md
index f36f45e0ea..449dbeb322 100644
--- a/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifysharepointaccount.md
+++ b/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifysharepointaccount.md
@@ -6,15 +6,15 @@ sidebar_position: 10
# Specify Account Window
-The Specify account window is opened from a field where a SharePoint account is needed.
+The Specify account window opens from a field where a SharePoint account is needed.
There are two options for specifying an account:
-- SharePoint System Accounts – Check the boxes for the desired system accounts: SHAREPOINT\system,
+- SharePoint System Accounts – Check the boxes for the system accounts you want: SHAREPOINT\system,
-1, S-1-0-0 (Null SID)
-- Custom – Enter the account in the textbox. Multiple accounts can be added using a semicolon (;).
+- Custom – Enter the account in the textbox. You can add multiple accounts using a semicolon (;).
- For System Service Accounts – Enter the SID for system service accounts
- For Local User Accounts – Enter either the user name or SID for the local account
diff --git a/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifysqluser.md b/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifysqluser.md
index c061239e31..3d5084795b 100644
--- a/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifysqluser.md
+++ b/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifysqluser.md
@@ -6,10 +6,10 @@ sidebar_position: 30
# Specify Sql User Name Window
-The Specify Sql User name window is opened from a field where a SQL Server account is needed.
+The Specify Sql User name window opens from a field where a SQL Server account is needed.
-Enter the SQL Server user name into the text box. Multiple user names can be added using a semicolon
+Enter the SQL Server user name into the text box. You can add multiple user names using a semicolon
(;), a comma (,), or a space. Then click OK. The Specify Sql User name window closes, and the
account is added to the field where the window was opened.
diff --git a/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifyunixaccount.md b/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifyunixaccount.md
index bcf05e416d..57bc131a05 100644
--- a/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifyunixaccount.md
+++ b/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifyunixaccount.md
@@ -6,10 +6,10 @@ sidebar_position: 40
# Specify Unix Account Window
-The Specify Unix Account or group window is opened from a field where a Unix account is needed.
+The Specify Unix Account or group window opens from a field where a Unix account is needed.
-Type the UID for the desired account in the textbox. Multiple UIDs can be added using a semicolon
+Enter the UID for the account in the textbox. You can add multiple UIDs using a semicolon
(;), a comma (,), or a space. Then click OK. The Specify Unix Account window closes, and the account
is added to the field where the window was opened.
diff --git a/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifywindowsaccount.md b/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifywindowsaccount.md
index 7c3756d97c..459d218910 100644
--- a/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifywindowsaccount.md
+++ b/docs/activitymonitor/8.0/admin/outputs/accountexclusions/specifywindowsaccount.md
@@ -6,13 +6,13 @@ sidebar_position: 20
# Specify Account or Group Window
-The Specify account or group window is opened from a field where a Windows account is needed.
+The Specify account or group window opens from a field where a Windows account is needed.
-Follow the steps to use this window.
+Use the following steps to use this window.
-**Step 1 –** Select the Domain from the drop-down menu.
+**Step 1 –** Select the Domain from the dropdown menu.
**Step 2 –** Enter the Account in the textbox.
@@ -20,7 +20,7 @@ Follow the steps to use this window.
- Use the ellipsis (…) button to open the Select Users, Computers, Service Accounts, or Groups
window to browse for an account.
-**Step 3 –** Then click Resolve. A message displays indicating whether or not the account could be
+**Step 3 –** Then click Resolve. A message displays indicating whether the account could be
resolved.
**Step 4 –** If successful, click OK.
diff --git a/docs/activitymonitor/8.0/admin/outputs/additionalproperties.md b/docs/activitymonitor/8.0/admin/outputs/additionalproperties.md
index 3ca0f354b6..58b1cf34e7 100644
--- a/docs/activitymonitor/8.0/admin/outputs/additionalproperties.md
+++ b/docs/activitymonitor/8.0/admin/outputs/additionalproperties.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# Additional Properties Tab
The Additional Properties tab on an output Properties window is where comments and displayed host
-name can be modified. These settings are initially configured when the output is added.
+you can modify the displayed host name. These settings are initially configured when the output is added.
Select an output from the Monitored Hosts tab and click **Edit** to open the output Properties
window.
@@ -21,7 +21,7 @@ The options are:
- Comment – The value entered here will appear in the Comments column in the Monitored Hosts tab
table.
-Often, the Additional Properties Tab is used to indicate the purpose of the output, e.g. for Netwrix
+Often, the Additional Properties Tab helps you indicate the purpose of the output, e.g. for Netwrix
Access Analyzer (formerly Enterprise Auditor). This can be useful if using multiple outputs with
different configurations for different purposes. For example, a SharePoint site could be added as a
host and configured for Netwrix Access Analyzer (formerly Enterprise Auditor) data collection. It
@@ -35,4 +35,4 @@ Properties window closes.
If a Threat Prevention Agent has been deployed to the same Windows proxy server where and activity
agent is deployed to monitor NAS devices, then the **Comment** column in the monitored hosts table
identifies the host as being “Managed by Threat Prevention”, and that ‘monitored host’ configuration
-is not editable through the Activity Monitor Console. Simply add the host again for other outputs.
+isn't editable through the Activity Monitor Console. Simply add the host again for other outputs.
diff --git a/docs/activitymonitor/8.0/admin/outputs/gidexclusions/addeditgid.md b/docs/activitymonitor/8.0/admin/outputs/gidexclusions/addeditgid.md
index 395368cf5d..8d775017e1 100644
--- a/docs/activitymonitor/8.0/admin/outputs/gidexclusions/addeditgid.md
+++ b/docs/activitymonitor/8.0/admin/outputs/gidexclusions/addeditgid.md
@@ -6,9 +6,9 @@ sidebar_position: 10
# Add or Edit GID Window
-The Add or Edit GID window is opened from a field where a Linux group is needed.
+The Add or Edit GID window opens from a field where a Linux group is needed.
-Type the GID for the desired group in the textbox. Then click OK. The Add or Edit GID window closes,
+Enter the GID for the group you want in the textbox. Then click OK. The Add or Edit GID window closes,
and the group is added to the field where the window was opened.
diff --git a/docs/activitymonitor/8.0/admin/outputs/gidexclusions/gidexclusions.md b/docs/activitymonitor/8.0/admin/outputs/gidexclusions/gidexclusions.md
index 2fc2bf0a67..34f847f50c 100644
--- a/docs/activitymonitor/8.0/admin/outputs/gidexclusions/gidexclusions.md
+++ b/docs/activitymonitor/8.0/admin/outputs/gidexclusions/gidexclusions.md
@@ -18,7 +18,7 @@ The tab contains the following settings:
- Add – Opens the Add or Edit GID window to add a group for exclusion. See the
[Add or Edit GID Window](/docs/activitymonitor/8.0/admin/outputs/gidexclusions/addeditgid.md) topic for additional information.
-- Remove – Removes the selected group from exclusion. Confirmation is not requested.
+- Remove – Removes the selected group from exclusion. Confirmation isn't requested.
:::warning
If an account is removed by group, use the **Cancel** button to discard the change.
@@ -28,8 +28,8 @@ The tab contains the following settings:
- Edit – Opens the Add or Edit GID window to edit a selected group for exclusion. See the
[Add or Edit GID Window](/docs/activitymonitor/8.0/admin/outputs/gidexclusions/addeditgid.md) topic for additional information.
-The table lists groups that are being excluded from monitoring, displayed in the GID column. By
-default, no groups are being excluded.
+The table lists groups you have excluded from monitoring, displayed in the GID column. By
+default, no groups are excluded.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The output
Properties window closes.
diff --git a/docs/activitymonitor/8.0/admin/outputs/logfiles.md b/docs/activitymonitor/8.0/admin/outputs/logfiles.md
index 09f96e6aa2..d57c281b36 100644
--- a/docs/activitymonitor/8.0/admin/outputs/logfiles.md
+++ b/docs/activitymonitor/8.0/admin/outputs/logfiles.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Log Files Tab
-The Log Files tab on an output Properties window is where the activity log settings can be modified.
+The Log Files tab on an output Properties window lets you modify the activity log settings.
These settings are initially configured when the output is added.
Select a File output from either the Monitored Domains tab or the Monitored Hosts tab and click
@@ -26,7 +26,7 @@ The tab contains the following settings:
information recorded per event.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
@@ -66,7 +66,7 @@ The tab contains the following settings:
is 10 days.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
@@ -83,16 +83,15 @@ The tab contains the following settings:
[Netwrix Access Analyzer Documentation](https://helpcenter.netwrix.com/category/accessanalyzer)
for additional information.
- For integration with Netwrix Threat Prevention NAS monitoring, this setting only controls the
- log retention period for NAS devices, as Netwrix Threat Prevention does not read Windows file
+ log retention period for NAS devices, as Netwrix Threat Prevention doesn't read Windows file
server activity from Activity Monitor.
- Report account names – Indicates if an Account Name column is added in the activity log files
-- Add header to Log files – Indicates if headers are added in the activity log filesAdd header to
- Log files – Indicates if headers are added in the activity log files
+- Add header to Log files – Indicates if headers are added in the activity log files
:::note
This is needed to feed data into Splunk in a Syslog output. However, Netwrix Access
- Analyzer (formerly Enterprise Auditor) does not support log files with headers. Therefore, do
+ Analyzer (formerly Enterprise Auditor) doesn't support log files with headers. Therefore, do
not select this option for a File output designed for Netwrix Access Analyzer (formerly
Enterprise Auditor).
:::
@@ -143,7 +142,7 @@ The tab contains the following settings:
is 10 days.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
@@ -154,12 +153,11 @@ The tab contains the following settings:
:::
-- Add header to Log files – Indicates if headers are added in the activity log filesAdd header to
- Log files – Indicates if headers are added in the activity log files
+- Add header to Log files – Indicates if headers are added in the activity log files
:::note
This is needed to feed data into Splunk in a Syslog output. However, Netwrix Access
- Analyzer (formerly Enterprise Auditor) does not support log files with headers. Therefore, do
+ Analyzer (formerly Enterprise Auditor) doesn't support log files with headers. Therefore, do
not select this option for a File output designed for Netwrix Access Analyzer (formerly
Enterprise Auditor).
:::
@@ -199,7 +197,7 @@ The tab contains the following settings:
is 10 days.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
@@ -238,7 +236,7 @@ The tab contains the following settings:
is 10 days.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
diff --git a/docs/activitymonitor/8.0/admin/outputs/operations/suppress.md b/docs/activitymonitor/8.0/admin/outputs/operations/suppress.md
index d3f4f6e0f3..96571b619f 100644
--- a/docs/activitymonitor/8.0/admin/outputs/operations/suppress.md
+++ b/docs/activitymonitor/8.0/admin/outputs/operations/suppress.md
@@ -14,7 +14,7 @@ actions that have not been explicitly triggered by users.
One of the most prominent examples is the Windows File Explorer - the standard application for file
system browsing on the Windows family of operating systems. Over the years, File Explorer has had a
number of improvements and new features. File Explorer displays various information about files to
-provide a better user experience. This allows users to view file content without having to open
+provide a better user experience. With File Explorer, users can view file content without having to open
them.
File Explorer displays icons for certain file types like executable (.exe) files. Depending on the
@@ -25,7 +25,7 @@ thumbnail of the files contained within the sub-folder on top of the sub-folder
additional functionality is executed automatically, mostly without the user's explicit action or
intention.
-As an example, a user may wish to open the MySampleReport.docx document located in the
+As an example, a user may want to open the MySampleReport.docx document located in the
MyTestDepartment folder. The user opens the folder, locates the file and double-clicks to open it.
From the user's perspective, only two actions were performed:
@@ -50,7 +50,7 @@ teams and IT auditing software. At the file system level, preview reads are perc
operations, like file copying or opening a file in an application. There exists no distinguishing
factor between explicit user activity and implicit actions by File Explorer. Whether it is a preview
read, opening the file in Notepad, or copying the file, all these operations are perceived as the
-same Read operation at the file system level. Therefore, it is not possible to reliably filter
+same Read operation at the file system level. Therefore, it isn't possible to reliably filter
unintentional activity without the risk of suppressing genuine user actions.
The Activity Monitor employs various techniques to minimize noise. These methods all rely on
diff --git a/docs/activitymonitor/8.0/admin/outputs/pathfiltering/pathfiltering.md b/docs/activitymonitor/8.0/admin/outputs/pathfiltering/pathfiltering.md
index 0ce1b838da..c44a8cb498 100644
--- a/docs/activitymonitor/8.0/admin/outputs/pathfiltering/pathfiltering.md
+++ b/docs/activitymonitor/8.0/admin/outputs/pathfiltering/pathfiltering.md
@@ -21,7 +21,7 @@ The tab contains the following settings and features:
- Add – Opens the Add or Edit Path window to add a new path to the list. See the
[Add or Edit Path Window](/docs/activitymonitor/8.0/admin/outputs/pathfiltering/addeditpath.md) topic for additional information.
-- Remove – Removes the selected path from the list. Confirmation is not requested.
+- Remove – Removes the selected path from the list. Confirmation isn't requested.
:::warning
If a path is removed by accident, use the **Cancel** button to discard the change.
@@ -32,8 +32,8 @@ The tab contains the following settings and features:
buttons move the selected path up or down in the list
- Edit – Opens the Add or Edit Path window to modify the selected path. See the
[Add or Edit Path Window](/docs/activitymonitor/8.0/admin/outputs/pathfiltering/addeditpath.md) topic for additional information.
-- Type a path below to test whether it will be included or excluded – Enter a path in the textbox to
- test whether it will be included/excluded based on the path filtering list
+- Enter a path in the test textbox to verify whether it will be included or excluded – This option
+ tests whether a path will be included or excluded based on the path filtering list
- Result – Under the text box, a description of whether the indicated path is included or
excluded will appear, as well as a reason for why the indicated path is included or excluded.
@@ -55,7 +55,7 @@ precedence, and the ‘Edward’ child folder will not be monitored.
:::note
-If ‘Include’ is not listed under the Filter Type column (or no Include filter paths are
+If ‘Include’ isn't listed under the Filter Type column (or no Include filter paths are
added), then all current and new discovered drives will be monitored.
:::
@@ -71,7 +71,7 @@ The tab contains the following settings and features:
- Add – Opens the Add or Edit Path window to add a new path to the list. See the
[Add or Edit Path Window](/docs/activitymonitor/8.0/admin/outputs/pathfiltering/addeditpath.md) topic for additional information.
-- Remove – Removes the selected path from the list. Confirmation is not requested.
+- Remove – Removes the selected path from the list. Confirmation isn't requested.
:::warning
If a path is removed by accident, use the **Cancel** button to discard the change.
@@ -82,8 +82,8 @@ The tab contains the following settings and features:
buttons move the selected path up or down in the list
- Edit – Opens the Add or Edit Path window to modify the selected path. See the
[Add or Edit Path Window](/docs/activitymonitor/8.0/admin/outputs/pathfiltering/addeditpath.md) topic for additional information.
-- Type a path below to test whether it will be included or excluded – Enter a path in the textbox to
- test whether it will be included/excluded based on the path filtering list
+- Enter a path in the test textbox to verify whether it will be included or excluded – This option
+ tests whether a path will be included or excluded based on the path filtering list
- Result – Under the text box, a description of whether the indicated path is included or
excluded will appear, as well as a reason for why the indicated path is included or excluded.
@@ -105,7 +105,7 @@ precedence, and the ‘Edward’ child folder will not be monitored.
:::note
-If ‘Include’ is not listed under the Filter Type column (or no Include filter paths are
+If ‘Include’ isn't listed under the Filter Type column (or no Include filter paths are
added), then all current and new discovered drives will be monitored.
:::
@@ -135,7 +135,7 @@ The tab contains the following settings and features:
- Add – Opens the Add or Edit Path window to add a new path to the list. See the
[Add or Edit Path Window](/docs/activitymonitor/8.0/admin/outputs/pathfiltering/addeditpath.md) topic for additional information.
-- Remove – Removes the selected path from the list. Confirmation is not requested.
+- Remove – Removes the selected path from the list. Confirmation isn't requested.
:::warning
If a path is removed by accident, use the **Cancel** button to discard the change.
@@ -148,8 +148,8 @@ The tab contains the following settings and features:
[Add or Edit Path Window](/docs/activitymonitor/8.0/admin/outputs/pathfiltering/addeditpath.md) topic for additional information.
- Add all local drives – Retrieves and adds all local drives to the bottom of the list with a type
of Include
-- Type a path below to test whether it will be included or excluded – Enter a path in the textbox to
- test whether it will be included/excluded based on the path filtering list
+- Enter a path in the test textbox to verify whether it will be included or excluded – This option
+ tests whether a path will be included or excluded based on the path filtering list
- Result – Under the text box, a description of whether the indicated path is included or
excluded will appear, as well as a reason for why the indicated path is included or excluded.
@@ -171,7 +171,7 @@ precedence, and the ‘Edward’ child folder will not be monitored.
:::note
-If ‘Include’ is not listed under the Filter Type column (or no Include filter paths are
+If ‘Include’ isn't listed under the Filter Type column (or no Include filter paths are
added), then all current and new discovered drives will be monitored.
:::
diff --git a/docs/activitymonitor/8.0/admin/outputs/processexclusions/addeditprocess.md b/docs/activitymonitor/8.0/admin/outputs/processexclusions/addeditprocess.md
index ea93c93a38..880e0c748d 100644
--- a/docs/activitymonitor/8.0/admin/outputs/processexclusions/addeditprocess.md
+++ b/docs/activitymonitor/8.0/admin/outputs/processexclusions/addeditprocess.md
@@ -14,7 +14,7 @@ output Properties window.
- Process name – Displays the name of the process to be excluded. You can enter a process name in
the textbox or select a process from the Running processes list.
- Filter – Indicates if the filter will be for **All events** or only **Read events**
-- Running Processes – Lists all processes currently running on the host
+- Running Processes – Lists all processes running on the host
Then click OK. The Add or Edit Path window closes, and the path is added to the filtering list for
the monitored host.
diff --git a/docs/activitymonitor/8.0/admin/outputs/processexclusions/processexclusions.md b/docs/activitymonitor/8.0/admin/outputs/processexclusions/processexclusions.md
index 67e82f93b8..13ff9c5540 100644
--- a/docs/activitymonitor/8.0/admin/outputs/processexclusions/processexclusions.md
+++ b/docs/activitymonitor/8.0/admin/outputs/processexclusions/processexclusions.md
@@ -23,7 +23,7 @@ The tab contains the following settings and features:
- Add – Opens the Add or Edit Process window to add a new process to the list. See the
[Add or Edit Process Window](/docs/activitymonitor/8.0/admin/outputs/processexclusions/addeditprocess.md) topic for additional information.
-- Remove – Removes the selected path from the list. Confirmation is not requested.
+- Remove – Removes the selected path from the list. Confirmation isn't requested.
:::warning
If a process is removed by accident, use the **Cancel** button to discard the
diff --git a/docs/activitymonitor/8.0/admin/outputs/syslog/messagetemplate.md b/docs/activitymonitor/8.0/admin/outputs/syslog/messagetemplate.md
index 5dc1df2fcd..8a905bb460 100644
--- a/docs/activitymonitor/8.0/admin/outputs/syslog/messagetemplate.md
+++ b/docs/activitymonitor/8.0/admin/outputs/syslog/messagetemplate.md
@@ -11,7 +11,7 @@ field on the Syslog tab of the output Properties window.
-You can select a preconfigured template from the drop-down menu or create a custom template. The
+You can select a preconfigured template from the dropdown menu or create a custom template. The
available preconfigured templates vary based on the type of domain/host selected.
## For Monitored Domains
@@ -30,7 +30,7 @@ Monitored Domains Syslog outputs have the following preconfigured Templates:
- V 2.0 for IBM QRadar SIEM 7.2.4
- V 2.0 for Splunk SIEM
-Custom templates can be created. Select the desired template or create a new template by modifying
+Custom templates can be created. Select the template you want or create a new template by modifying
an existing template within the Message Template window. The new message template will be named
Custom. Macro variables are also available to customize the Syslog message template.
@@ -102,7 +102,7 @@ Monitored Hosts Syslog outputs have the following preconfigured Templates:
- Netwrix Threat Manager (StealthDEFEND) – Use this template for Netwrix Threat Manager integration.
This is the only supported template for Threat Manager.
-Custom templates can be created. Select the desired template or create a new template by modifying
+Custom templates can be created. Select the template you want or create a new template by modifying
an existing template within the Message Template window. The new message template will be named
Custom. Macro variables are also available to customize the Syslog message template.
@@ -127,7 +127,7 @@ the Syslog message template:
| SharePoint Online | %DEST_FILENAME% | Name of the file that is copied or moved |
| SharePoint Online | %DEST_RELATIVE_PATH% | URL of the destination folder where a folder is copied or moved |
| SharePoint Online | %DLP_EXCEPTION% | Reasons why a policy no longer applies and any information about false positive or override |
-| SharePoint Online | %DLP_POLICY% | Policy(s) that triggered the event |
+| SharePoint Online | %DLP_POLICY% | Policys that triggered the event |
| SharePoint Online | %DLP_SENSITIVE% | Indicates whether the event contains the value of the sensitive data type (true/false) |
| SharePoint SharePoint Online | %DOC_LOCATION% | A relative URL of the file or document accessed by the user |
| SharePoint SharePoint Online | %EVENT_DATA% | - For SharePoint, raw event data - Fore SharePoint Online, additional event data |
diff --git a/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md b/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md
index 300fc10f96..1b37d3a6e5 100644
--- a/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md
+++ b/docs/activitymonitor/8.0/admin/outputs/syslog/syslog.md
@@ -26,10 +26,10 @@ The tab contains the following settings:
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -42,7 +42,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -63,13 +63,13 @@ The tab contains the following settings:
organization’s environment can resolve the name format used.
- The default port for Netwrix Threat Manager is 10001.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- UPD is the only protocol supported for Threat Manager.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -82,7 +82,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -102,10 +102,10 @@ The tab contains the following settings:
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -115,7 +115,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -136,13 +136,13 @@ The tab contains the following settings:
organization’s environment can resolve the name format used.
- The default port for Netwrix Threat Manager is 10000.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- UPD is the only protocol supported for Threat Manager.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -156,7 +156,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -177,13 +177,13 @@ The tab contains the following settings:
organization’s environment can resolve the name format used.
- The default port for Netwrix Threat Manager is 10001.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- UPD is the only protocol supported for Threat Manager.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -194,7 +194,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
diff --git a/docs/activitymonitor/8.0/admin/search/activedirectory/activedirectory.md b/docs/activitymonitor/8.0/admin/search/activedirectory/activedirectory.md
index 2fa405560d..4426ece1dd 100644
--- a/docs/activitymonitor/8.0/admin/search/activedirectory/activedirectory.md
+++ b/docs/activitymonitor/8.0/admin/search/activedirectory/activedirectory.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Active Directory Search Query
You can search domain activity that has been monitored and recorded to a File output. When you
-select **Active Directory** from the magnifying glass drop-down menu, a New Search tab opens with
+select **Active Directory** from the magnifying glass dropdown menu, a New Search tab opens with
the applicable query filters.
@@ -26,19 +26,19 @@ filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+headers. You can also [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) the search results.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -53,11 +53,11 @@ configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
-- Event Source – Set which query categories will be used. The drop-down menu displays a checkbox
+- Event Source – Set which query categories will be used. The dropdown menu displays a checkbox
list of categories.
- Event Result – Filter the data for a specific event result: Any, Success, or Failure
- Event Block – Filter the data for a specific event result related to blocking: Any, Allowed, or
diff --git a/docs/activitymonitor/8.0/admin/search/activedirectory/activedirectory_1.md b/docs/activitymonitor/8.0/admin/search/activedirectory/activedirectory_1.md
index 67a080a1cc..c794a87466 100644
--- a/docs/activitymonitor/8.0/admin/search/activedirectory/activedirectory_1.md
+++ b/docs/activitymonitor/8.0/admin/search/activedirectory/activedirectory_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per AD agent.
You can [Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+headers. You can also [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) the search results.
@@ -32,13 +32,13 @@ The results data grid columns display the following information for each event:
- Affected Object – Active Directory distinguished name for the affected object
- Affected Object SID – Security Identifier of the object/account affected by the event
- Affected Object Name – Name of the Affected Object
-- Protocol – Protocol(s) used for the monitored operation
+- Protocol – Protocols used for the monitored operation
- Query Filter – LDAP filter used in the operation
- Secured Query – Indicates if LDAP connection is secured or not
- Query Objects – Number of returned objects produced by the LDAP request
-- Process Name – Contains process name that is monitored. Currently this is only lsass.exe.
+- Process Name – Contains process name that is monitored. this is only lsass.exe.
- PID – Process Identifier generated for each active process
-- Old Name – Value prior to the monitored change
+- Old Name – Value before the monitored change
- New Name – Value after the monitored change
- Authentication Type – Indicates type of authentication event. Possible values: Kerberos, NTLM.
- Target Host – Name of the originating host
@@ -48,7 +48,7 @@ The results data grid columns display the following information for each event:
- NTLM Logon Type – Indicates type of protocol used to authenticate a connection between client and
server
- Ticket Encryption – Indicates encryption type used in request part of the Kerberos ticket
-- PAC – RID for the group that does not have access
+- PAC – RID for the group that doesn't have access
- SPN – Detects attempts to obtain a list of Service Principal Name values
- User Exists – Indicates if user exists
- N2 Password – Indicates if an invalid password matches the user’s password history
diff --git a/docs/activitymonitor/8.0/admin/search/entraid/entraid.md b/docs/activitymonitor/8.0/admin/search/entraid/entraid.md
index 83e47f715b..50ccdfc9a7 100644
--- a/docs/activitymonitor/8.0/admin/search/entraid/entraid.md
+++ b/docs/activitymonitor/8.0/admin/search/entraid/entraid.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Microsoft Entra ID Search Query
You can search activity in Microsoft Entra ID (Azure AD) that has been monitored and recorded to a
-File output. When you select **Azure AD / Entra ID** from the magnifying glass drop-down menu, a New
+File output. When you select **Azure AD / Entra ID** from the magnifying glass dropdown menu, a New
Search tab opens with the applicable query filters.
@@ -27,19 +27,19 @@ filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+headers. You can also [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) the search results.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -53,11 +53,11 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
-- Source – Set which query categories will be used. The drop-down menu displays a checkbox list of
+- Source – Set which query categories will be used. The dropdown menu displays a checkbox list of
categories.
- Event Result – Filter the data for a specific event result: Any, Success, or Failure
- Reason
diff --git a/docs/activitymonitor/8.0/admin/search/entraid/entraid_1.md b/docs/activitymonitor/8.0/admin/search/entraid/entraid_1.md
index 5e05d6d711..215fb8369e 100644
--- a/docs/activitymonitor/8.0/admin/search/entraid/entraid_1.md
+++ b/docs/activitymonitor/8.0/admin/search/entraid/entraid_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per activity
agent. You can [Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+column headers. You can also [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) the search results.
@@ -26,12 +26,12 @@ The results data grid columns display the following information for each event:
- Application – Indicates the Application associated with the event
- Service – Indicates the Service associated with the event
- Category – Indicates the Category associated with the event. Categories returned from search
- queries can be configured using the Category filter drop-down.
+ queries can be configured using the Category filter dropdown.
- Operation - Indicates the Operation associated with the event. Operations returned from search
- queries can be configured using the Operation filter drop-down.
+ queries can be configured using the Operation filter dropdown.
- Type – Indicates the Type associated with the event. Types returned from search queries can be
- configured using the Type filter drop-down.
-- Target(s) – Indicates the Target(s) of the event
+ configured using the Type filter dropdown.
+- Targets – Indicates the Targets of the event
- Modified – Indicates modifications associated with the event
- Client App – Indicates the Client App associated with the event
- OS – Indicates the OS associated with the event
@@ -44,7 +44,7 @@ The results data grid columns display the following information for each event:
- Risk – Indicates the level of Risk associated with events
- Conditional Access – Indicates whether Conditional Access was applied to the event
- Conditional Policy – Indicates whether a Conditional Policy was applied to the event
-- Details – If applicable, provides additional information associated with the event that is not
+- Details – If applicable, provides additional information associated with the event that isn't
provided by the other Results columns
At the bottom of the search interface, additional information is displayed for selected events in
diff --git a/docs/activitymonitor/8.0/admin/search/exchangeonline/exchangeonline.md b/docs/activitymonitor/8.0/admin/search/exchangeonline/exchangeonline.md
index 0ca22186d4..77fcdef497 100644
--- a/docs/activitymonitor/8.0/admin/search/exchangeonline/exchangeonline.md
+++ b/docs/activitymonitor/8.0/admin/search/exchangeonline/exchangeonline.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# Exchange Online Search Query
You can search Exchange Online activity that has been monitored and recorded to a File output. When
-you select **Exchange Online** from the magnifying glass drop-down menu, a New Search tab opens with
+you select **Exchange Online** from the magnifying glass dropdown menu, a New Search tab opens with
the applicable query filters.
@@ -23,21 +23,21 @@ By default, the query is set to return all event activity for the past day. Conf
filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
-activity log files and returns the events that match the filters.You can
+activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+headers. You can also [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) the search results.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -51,9 +51,9 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Source – Filter the data by the source type: All, Admin Audit, Mailbox Access, DLP, Sensitivity
Label, Other
diff --git a/docs/activitymonitor/8.0/admin/search/exchangeonline/exchangeonline_1.md b/docs/activitymonitor/8.0/admin/search/exchangeonline/exchangeonline_1.md
index 12e4c858ca..a7061d370f 100644
--- a/docs/activitymonitor/8.0/admin/search/exchangeonline/exchangeonline_1.md
+++ b/docs/activitymonitor/8.0/admin/search/exchangeonline/exchangeonline_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per activity
agent. You can [Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+column headers. You can also [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) the search results.
diff --git a/docs/activitymonitor/8.0/admin/search/file/file.md b/docs/activitymonitor/8.0/admin/search/file/file.md
index 8b6fe559a9..6e17545877 100644
--- a/docs/activitymonitor/8.0/admin/search/file/file.md
+++ b/docs/activitymonitor/8.0/admin/search/file/file.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# File Search Query
You can search Windows file server and NAS device activity that has been monitored and recorded to a
-File output. When you select **File** from the magnifying glass drop-down menu, a New Search tab
+File output. When you select **File** from the magnifying glass dropdown menu, a New Search tab
opens with the applicable query filters.
@@ -18,18 +18,18 @@ filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+headers. You can also [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) the search results.
**Filter Value Entry**
Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -40,9 +40,9 @@ The sections have the following filters:
- Events time range – The time frame filter must be configured for every search query:
- - From – Set the date and timestamp for the start of the activity range. The drop-down menu
+ - From – Set the date and timestamp for the start of the activity range. The dropdown menu
opens a calendar.
- - To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+ - To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- File Path – Filter the data for a specific file path where activity has occurred
diff --git a/docs/activitymonitor/8.0/admin/search/file/file_1.md b/docs/activitymonitor/8.0/admin/search/file/file_1.md
index 408533b57d..e601aae2d1 100644
--- a/docs/activitymonitor/8.0/admin/search/file/file_1.md
+++ b/docs/activitymonitor/8.0/admin/search/file/file_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per activity
agent. You can [Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+column headers. You can also [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) the search results.
@@ -33,7 +33,7 @@ The results data grid columns display the following information for each event:
remote user
- Source – Indicates the source of the activity event
- - For local Windows activity – Process name (e.g. notepad.exe)
+ - For local Windows activity – Process name (e.g., notepad.exe)
- For network Windows activity – IP Address of the user
- For NAS device activity – IP Address for the NAS device of the user
diff --git a/docs/activitymonitor/8.0/admin/search/linux/linux.md b/docs/activitymonitor/8.0/admin/search/linux/linux.md
index 173d5cef51..99a2aeb1d7 100644
--- a/docs/activitymonitor/8.0/admin/search/linux/linux.md
+++ b/docs/activitymonitor/8.0/admin/search/linux/linux.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Linux Search Query
You can search Linux file server and NAS device activity that has been monitored and recorded to a
-File output. When you select **Linux** from the magnifying glass drop-down menu, a New Search tab
+File output. When you select **Linux** from the magnifying glass dropdown menu, a New Search tab
opens with the applicable query filters.
@@ -18,18 +18,18 @@ filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+headers. You can also [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) the search results.
**Filter Value Entry**
Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -40,9 +40,9 @@ The sections have the following filters:
- Events time range – The time frame filter must be configured for every search query:
- - From – Set the date and timestamp for the start of the activity range. The drop-down menu
+ - From – Set the date and timestamp for the start of the activity range. The dropdown menu
opens a calendar.
- - To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+ - To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- File Path – Filter the data for a specific file path where activity has occurred
diff --git a/docs/activitymonitor/8.0/admin/search/linux/linux_1.md b/docs/activitymonitor/8.0/admin/search/linux/linux_1.md
index 7e86921220..874dac2d61 100644
--- a/docs/activitymonitor/8.0/admin/search/linux/linux_1.md
+++ b/docs/activitymonitor/8.0/admin/search/linux/linux_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per Linux
agent. You can [Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+column headers. You can also [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) the search results.
diff --git a/docs/activitymonitor/8.0/admin/search/overview.md b/docs/activitymonitor/8.0/admin/search/overview.md
index 022becda74..ea8fe4fd91 100644
--- a/docs/activitymonitor/8.0/admin/search/overview.md
+++ b/docs/activitymonitor/8.0/admin/search/overview.md
@@ -46,11 +46,9 @@ Queries that may be useful to an organization include the following:
- What did user X do between days Y and Z?
- Administrator activity details?
-Follow the steps to use the search feature.
-
**Step 1 –** Click the magnifying glass icon and select the source type.
-**Step 2 –** Set the desired filters and click **Search**.
+**Step 2 –** Set the filters you want and click **Search**.
**Step 3 –** Filter and Sort the results in the table as desired.
@@ -58,12 +56,12 @@ Follow the steps to use the search feature.
## Filter
-The drop-down menu for a column header in the search results data grid provides the option to filter
+The dropdown menu for a column header in the search results data grid provides the option to filter
the search results further.
-Choose between checking/unchecking the desired field values from the list of available values and
+Choose between checking/unchecking the field values you want from the list of available values and
typing in the search textbox. The Clear filter option removes all filters from the selected column.
A filter icon appears on the header where filters have been applied. Multiple columns can be
filtered in the search results data grid.
@@ -81,7 +79,7 @@ descending order.
-The drop-down menu on the column header has options to Sort A to Z or Sort Z to A for the selected
+The dropdown menu on the column header has options to Sort A to Z or Sort Z to A for the selected
column. Sorting can only occur for one column at a time.
:::note
@@ -95,5 +93,5 @@ The search results data grid can be exported to a CSV/JSON file.
-Once the search results are configured as desired, click the Export button located at the top left
+After you configure the search results, click the Export button located at the top left
corner of the window. Set the name and location of the CSV/JSON file.
diff --git a/docs/activitymonitor/8.0/admin/search/sharepoint/sharepoint.md b/docs/activitymonitor/8.0/admin/search/sharepoint/sharepoint.md
index 0f9bc3af02..e8f0498b81 100644
--- a/docs/activitymonitor/8.0/admin/search/sharepoint/sharepoint.md
+++ b/docs/activitymonitor/8.0/admin/search/sharepoint/sharepoint.md
@@ -7,7 +7,7 @@ sidebar_position: 60
# SharePoint Search Query
You can search SharePoint activity that has been monitored and recorded to a File output. When you
-select **SharePoint** from the magnifying glass drop-down menu, a New Search tab opens with the
+select **SharePoint** from the magnifying glass dropdown menu, a New Search tab opens with the
applicable query filters.
@@ -25,21 +25,21 @@ By default, the query is set to return all event activity for the past day. Conf
filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
-activity log files and returns the events that match the filters.You can
+activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+headers. The [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option is located beneath the Search button.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -54,9 +54,9 @@ configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Event Type – Filter the data by the event type: All, CheckOut, CheckIn, View, Delete, Update,
ProfileChange, ChildDelete, SchemaChange, Undelete, Workflow, Copy, Move, AuditMaskChange, Search,
diff --git a/docs/activitymonitor/8.0/admin/search/sharepoint/sharepoint_1.md b/docs/activitymonitor/8.0/admin/search/sharepoint/sharepoint_1.md
index 0db68e043a..cf54338ccb 100644
--- a/docs/activitymonitor/8.0/admin/search/sharepoint/sharepoint_1.md
+++ b/docs/activitymonitor/8.0/admin/search/sharepoint/sharepoint_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per activity
agent. You can [Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+column headers. The [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option is located beneath the Search button.
diff --git a/docs/activitymonitor/8.0/admin/search/sharepointonline/sharepointonline.md b/docs/activitymonitor/8.0/admin/search/sharepointonline/sharepointonline.md
index 0672584b63..0b4b060414 100644
--- a/docs/activitymonitor/8.0/admin/search/sharepointonline/sharepointonline.md
+++ b/docs/activitymonitor/8.0/admin/search/sharepointonline/sharepointonline.md
@@ -7,7 +7,7 @@ sidebar_position: 70
# SharePoint Online Search Query
You can search SharePoint Online activity that has been monitored and recorded to a File output.
-When you select **SharePoint Online** from the magnifying glass drop-down menu, a New Search tab
+When you select **SharePoint Online** from the magnifying glass dropdown menu, a New Search tab
opens with the applicable query filters.
@@ -28,19 +28,19 @@ filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+headers. The [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option is located beneath the Search button.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -54,9 +54,9 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Source – Filter the data by the source type: All, File and Page, Folder, List, Sharing and Access
Request, Site Permissions, Site Administration, Synchronization, DLP, Sensitivity Label, Content
diff --git a/docs/activitymonitor/8.0/admin/search/sharepointonline/sharepointonline_1.md b/docs/activitymonitor/8.0/admin/search/sharepointonline/sharepointonline_1.md
index adf668f438..72aa0b4792 100644
--- a/docs/activitymonitor/8.0/admin/search/sharepointonline/sharepointonline_1.md
+++ b/docs/activitymonitor/8.0/admin/search/sharepointonline/sharepointonline_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per activity
agent. You can [Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+column headers. The [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option is located beneath the Search button.
diff --git a/docs/activitymonitor/8.0/admin/search/sqlserver/sqlserver.md b/docs/activitymonitor/8.0/admin/search/sqlserver/sqlserver.md
index 9a5b0e054d..24acd3592f 100644
--- a/docs/activitymonitor/8.0/admin/search/sqlserver/sqlserver.md
+++ b/docs/activitymonitor/8.0/admin/search/sqlserver/sqlserver.md
@@ -7,7 +7,7 @@ sidebar_position: 80
# SQL Server Search Query
You can search SQL Server activity that has been monitored and recorded to a File output. When you
-select **SQL Server** from the magnifying glass drop-down menu, a New Search tab opens with the
+select **SQL Server** from the magnifying glass dropdown menu, a New Search tab opens with the
applicable query filters.
@@ -24,19 +24,19 @@ filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+headers. The [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option is located beneath the Search button.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -50,9 +50,9 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Event Result – Filter the data for a specific event result: Any, Success, or Failure
- Reason
diff --git a/docs/activitymonitor/8.0/admin/search/sqlserver/sqlserver_1.md b/docs/activitymonitor/8.0/admin/search/sqlserver/sqlserver_1.md
index 321826c13f..1d2f016e0f 100644
--- a/docs/activitymonitor/8.0/admin/search/sqlserver/sqlserver_1.md
+++ b/docs/activitymonitor/8.0/admin/search/sqlserver/sqlserver_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per activity
agent. You can [Filter](/docs/activitymonitor/8.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/8.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option.
+column headers. The [Export](/docs/activitymonitor/8.0/admin/search/overview.md#export) option is located beneath the Search button.
diff --git a/docs/activitymonitor/8.0/gettingstarted.md b/docs/activitymonitor/8.0/gettingstarted.md
index e403de8252..20147cc8a3 100644
--- a/docs/activitymonitor/8.0/gettingstarted.md
+++ b/docs/activitymonitor/8.0/gettingstarted.md
@@ -6,13 +6,12 @@ sidebar_position: 10
# Getting Started
-Once Netwrix Activity Monitor is installed, the following workflow enables organizations to quickly
-and easily get started with activity monitoring.
+Once Netwrix Activity Monitor is installed, the following workflow enables organizations to get started with activity monitoring quickly.
## Requirements
The Activity Monitor console needs to be installed on a server. After that agents are deployed to
-the target environment and configured to monitor activity. It is necessary to prepare the target
+the target environment and configured to monitor activity. You must prepare the target
environment and configure the credentials used by the agents. Each supported environment has
different requirements. See the following topics for additional information:
@@ -32,7 +31,7 @@ different requirements. See the following topics for additional information:
## Install & Deploy Agents
-Once the prerequisites are accomplished, you are ready to install the application and deploy agents.
+After you complete the prerequisites, you are ready to install the application and deploy agents.
See the following topics for additional information:
- [Install Application](/docs/activitymonitor/8.0/install/application.md)
diff --git a/docs/activitymonitor/8.0/install/agents/agents.md b/docs/activitymonitor/8.0/install/agents/agents.md
index a76ae797dd..cdefe7b198 100644
--- a/docs/activitymonitor/8.0/install/agents/agents.md
+++ b/docs/activitymonitor/8.0/install/agents/agents.md
@@ -32,7 +32,7 @@ systems and applications. There are three types of agents:
for monitoring the target environment
- SQL Server – Activity Agent must be deployed to a Windows server that acts as a proxy for
monitoring the target environment
- - Windows File Server – Activity Agent must be deployed to the server. It cannot be deployed to
+ - Windows File Server – Activity Agent must be deployed to the server. It can't be deployed to
a proxy server.
- Credentials used for deployments must also be provisioned for monitoring
@@ -44,7 +44,7 @@ systems and applications. There are three types of agents:
- Credentials used for deployments must also be provisioned for monitoring
-In order to perform centralized agent maintenance from the application console server, WMI must be
+To perform centralized agent maintenance from the application console server, WMI must be
enabled on the machine where the agent is installed.
You will need the following information to deploy agents from the console:
diff --git a/docs/activitymonitor/8.0/install/agents/manual.md b/docs/activitymonitor/8.0/install/agents/manual.md
index 6016e8d223..5d6b22bc26 100644
--- a/docs/activitymonitor/8.0/install/agents/manual.md
+++ b/docs/activitymonitor/8.0/install/agents/manual.md
@@ -8,8 +8,6 @@ sidebar_position: 10
The Netwrix Activity Monitor Agent can be deployed via the console or manually.
-Follow the steps to manually install the agent.
-
**Step 1 –** Navigate to the Activity Monitor Console installation path and locate the agent
installation package. The default location is:
@@ -67,7 +65,7 @@ The Activity Monitor Agent command line has the following parameters:
- MANAGEMENT_GROUP
- To specify the Activity Monitor Agent Management Group (This allows user to limit users in the
- specified group to manage agents, but does not allow users in specified group to install,
+ specified group to manage agents, but doesn't allow users in specified group to install,
upgrade, or uninstall agents).
- Default value: “BUILTIN\Administrators”
- MANAGEMENT_GROUP=AMDOMAIN\AMGROUP
@@ -99,7 +97,7 @@ those for NAS devices when applicable.
:::note
These steps are specific to deploying activity agents for monitoring file systems,
-SharePoint, SQL Server, Azure and Office 365 environments. See the
+SharePoint, SQL Server, Azure, and Office 365 environments. See the
[Active Directory Agent Deployment](/docs/activitymonitor/8.0/admin/agents/activedirectory.md) section for
instruction on deploying the AD agent. See the
[Linux Agent Deployment](/docs/activitymonitor/8.0/admin/agents/linux.md) topic for instructions on deploying agents
@@ -107,11 +105,9 @@ to Linux servers.
:::
-Follow the steps to deploy the activity agent to a single Windows server.
-
**Step 1 –** Open the Activity Monitor Console.
-**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agent(s) window opens.
+**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agents window opens.
@@ -125,7 +121,7 @@ additional information. Click **Next**.
-**Step 5 –** On the Credentials to Connect to the Server(s) page, specify the credentials for the
+**Step 5 –** On the Credentials to Connect to the Servers page, specify the credentials for the
server to which the agent is deployed. See the
[Single Activity Agent Deployment](/docs/activitymonitor/8.0/admin/agents/single.md) topic for additional
information on credential options. Click **Connect**.
@@ -138,7 +134,7 @@ installed.
:::
-**Step 6 –** Regardless of the warning messages that the agent cannot be installed or upgraded,
+**Step 6 –** Regardless of the warning messages that the agent can't be installed or upgraded,
click **Next**. The console will automatically detect the agent as it is already installed.
@@ -152,7 +148,7 @@ click **Next**. The console will automatically detect the agent as it is already
:::note
The Activity Monitor Agent Management Group allows users in the specified group to manage
-agents, but does not allow users in specified group to install, upgrade, or uninstall agents.
+agents, but doesn't allow users in specified group to install, upgrade, or uninstall agents.
:::
diff --git a/docs/activitymonitor/8.0/install/agents/manualad.md b/docs/activitymonitor/8.0/install/agents/manualad.md
index 373ae23486..a477c45ea8 100644
--- a/docs/activitymonitor/8.0/install/agents/manualad.md
+++ b/docs/activitymonitor/8.0/install/agents/manualad.md
@@ -8,7 +8,7 @@ sidebar_position: 30
The AD Module, powered by Threat Prevention, can only be installed on domain controllers.
-Follow the steps to manually deploy the AD Module.
+
**Step 1 –** From the Threat Prevention server, copy the Agent executable (
`...\Netwrix\Netwrix Threat Prevention\SIEnterpriseManager\Setup\SI Agent.exe`) to the machine where
@@ -26,8 +26,7 @@ by another Welcome page.
-**Step 4 –** On the End-User License Agreement page, check the **I accept the terms in the License
-Agreement** box and click **Next**.
+**Step 4 –** On the End-User License Agreement page, select the checkbox to accept the license agreement terms and click **Next**.
@@ -38,7 +37,7 @@ location.
-> > - Use the Look In field to select the desired installation folder.
+> > - Use the Look In field to select the installation folder you want.
> > - When the Folder name is as desired, click **OK**. The wizard returns to the Destination Folder
> > page.
> > - Click **Next**.
@@ -51,7 +50,7 @@ location.
**Step 6 –** Keep the default radio button selection, Managed by Threat Prevention.
:::note
-The CA Certificate Configuration page is not applicable to the Activity Monitor.
+The CA Certificate Configuration page isn't applicable to the Activity Monitor.
:::
@@ -77,7 +76,7 @@ product to enable communication with it.
- Start Agent Service
- The **Start Agent Service** option starts the Threat Prevention Windows Agent service
- after the installation is complete. If the Threat Prevention Windows Agent service is not
+ after the installation is complete. If the Threat Prevention Windows Agent service isn't
started at the time of installation, the Activity Monitor Agent will start as needed.
- Create Windows Firewall Rules
@@ -106,11 +105,9 @@ The AD Module (SI Agent) is now installed on the server.
## Add the AD Agent to the Console
-Follow the steps to add the Activity Monitor Windows Agent (with the AD Module) to the Console:
-
**Step 1 –** Open the Activity Monitor Console.
-**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agent(s) window opens.
+**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agents window opens.
@@ -128,17 +125,17 @@ Follow the steps to add the Activity Monitor Windows Agent (with the AD Module)
**Step 6 –** On the Active Directory Connection page, specify the credentials for the domain or
-domain controller(s) where the agent is installed. Click **Connect** to verify connection to the
+domain controllers where the agent is installed. Click **Connect** to verify connection to the
domain. Click **Next**.
-**Step 7 –** Select the domain of the domain controller(s) where the agent is installed. Click
+**Step 7 –** Select the domain of the domain controllers where the agent is installed. Click
**Next**.
-**Step 8 –** Select the domain controller(s) where the agent is installed. Click **Test**.
+**Step 8 –** Select the domain controllers where the agent is installed. Click **Test**.
:::note
When clicking Test while adding the Agent to the Console, the connection may fail. When
@@ -148,7 +145,7 @@ installed.
:::
-**Step 9 –** Ignore the warning messages that the agent cannot be installed or upgraded and click
+**Step 9 –** Ignore the warning messages that the agent can't be installed or upgraded and click
**Next**.
@@ -157,7 +154,7 @@ installed.
:::note
The Activity Monitor Agent Management Group allows users in the specified group to manage
-agents, but does not allow users in specified group to install, upgrade, or uninstall agents.
+agents, but doesn't allow users in specified group to install, upgrade, or uninstall agents.
:::
diff --git a/docs/activitymonitor/8.0/install/agents/manuallinux.md b/docs/activitymonitor/8.0/install/agents/manuallinux.md
index 511a9cf641..5b494889cf 100644
--- a/docs/activitymonitor/8.0/install/agents/manuallinux.md
+++ b/docs/activitymonitor/8.0/install/agents/manuallinux.md
@@ -6,8 +6,6 @@ sidebar_position: 20
# Manually Install the Linux Agent
-Follow the steps to manually install the agent.
-
**Step 1 –** Transfer the rpm package to the Linux server.
For example, following is a pscp command:
@@ -63,16 +61,14 @@ This will be needed to add the agent to the console.
## Add the Linux Agent to the Console
Before deploying the Activity agent in a Linux environment, ensure all Prerequisites have been met.
-To effectively monitor activity on a Linux host, it is necessary to deploy an agent to the host.
-Follow the steps to deploy the agent to the Linux host. See the
+To effectively monitor activity on a Linux host, you must deploy an agent to the host.
+See the
[Linux Agent Server Requirements](/docs/activitymonitor/8.0/requirements/linuxagent.md) topic for additional
information.
-Follow the steps to add the agent to the console.
-
**Step 1 –** Open the Activity Monitor Console.
-**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agent(s) window opens.
+**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agents window opens.
@@ -104,7 +100,7 @@ installed.
**Step 6 –** On the Linux Agent Options page, select which user name to use to run the daemon. To
use root, leave the **Service user name** field blank. Click **Test** to test the connection.
-**Step 7 –** Click **Finish**. The Add New Agent(s) window closes, and the activity agent is
+**Step 7 –** Click **Finish**. The Add New Agents window closes, and the activity agent is
deployed to and installed on the target host.
:::note
diff --git a/docs/activitymonitor/8.0/install/application.md b/docs/activitymonitor/8.0/install/application.md
index d21634543f..3f5b3ad380 100644
--- a/docs/activitymonitor/8.0/install/application.md
+++ b/docs/activitymonitor/8.0/install/application.md
@@ -10,8 +10,6 @@ Netwrix Activity Monitor comes with a 10-day trial license to start. If an organ
key has been acquired already, which should be provided by a Netwrix Representative, the file should
be saved in the same location where the Activity Monitor will be installed.
-Follow the steps to install the Netwrix Activity Monitor Console.
-
**Step 1 –** Run the NetwrixActivityMonitorSetup.msi executable to open the Netwrix Activity Monitor
Setup wizard.
@@ -21,8 +19,8 @@ Setup wizard.
-**Step 3 –** On the End User License Agreement page, check the I accept the terms in the License
-Agreement box and click Next.
+**Step 3 –** On the End User License Agreement page, check the checkbox to accept the terms in the License
+Agreement and click Next.
diff --git a/docs/activitymonitor/8.0/install/importlicensekey.md b/docs/activitymonitor/8.0/install/importlicensekey.md
index ab3f2265f2..25c00f7949 100644
--- a/docs/activitymonitor/8.0/install/importlicensekey.md
+++ b/docs/activitymonitor/8.0/install/importlicensekey.md
@@ -11,8 +11,6 @@ a Access Analyzer key can be done from the Activity Monitor Console. If the Acti
is installed on a server where Access Analyzer has already been installed, it reads the license
information from the Access Analyzer installation directory.
-Follow the steps to import a license key file.
-
**Step 1 –** Click the `__Licensed to: __` hyperlink in the lower-left corner of the
diff --git a/docs/activitymonitor/8.0/install/overview.md b/docs/activitymonitor/8.0/install/overview.md
index f3dd5159c9..49629044cb 100644
--- a/docs/activitymonitor/8.0/install/overview.md
+++ b/docs/activitymonitor/8.0/install/overview.md
@@ -7,13 +7,13 @@ sidebar_position: 30
# Installation
This topic describes the console installation and agent deployment the process for Activity Monitor.
-Prior to installing the application, ensure that all requirements have been met. See the
+Before installing the application, ensure that all requirements have been met. See the
[Requirements ](/docs/activitymonitor/8.0/requirements/overview.md) topic for additional information.
## Software Compatibility & Versions
-For proper integration between the Activity Monitor and other Netwrix products, it is necessary for
-the versions to be compatible.
+For proper integration between the Activity Monitor and other Netwrix products, the
+versions must be compatible.
| Component | Version |
| ----------------------------------------------------- | ------- |
diff --git a/docs/activitymonitor/8.0/install/upgrade/removeagent.md b/docs/activitymonitor/8.0/install/upgrade/removeagent.md
index 547ebae832..58b61ab078 100644
--- a/docs/activitymonitor/8.0/install/upgrade/removeagent.md
+++ b/docs/activitymonitor/8.0/install/upgrade/removeagent.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Remove Agents
-On the Agents tab of the Activity Monitor Console, the Remove button allows users to remove the
+On the Agents tab of the Activity Monitor Console, use the Remove button to remove the
selected activity agent from the Agents list and/or uninstall the activity agent from the hosting
server.
diff --git a/docs/activitymonitor/8.0/install/upgrade/updateadagentinstaller.md b/docs/activitymonitor/8.0/install/upgrade/updateadagentinstaller.md
index 4181e0245b..01ab21de16 100644
--- a/docs/activitymonitor/8.0/install/upgrade/updateadagentinstaller.md
+++ b/docs/activitymonitor/8.0/install/upgrade/updateadagentinstaller.md
@@ -16,8 +16,6 @@ license keys for purchased products. See the
topic for information on how to register for a Customer Portal account. Navigate to the Netwrix
Threat Prevention Download section for the 7.5. Download the Threat Prevention Agent binary.
-Then follow the steps to update the AD Agent installer used by the Activity Monitor Console.
-
**Step 1 –** On the Agents tab, select **Update Installer**. The Select Active Directory Module
installer package (SI Agent.exe) windowSelect Active Directory Module installer package (SI
Agent.exe) window opens.
diff --git a/docs/activitymonitor/8.0/install/upgrade/upgrade.md b/docs/activitymonitor/8.0/install/upgrade/upgrade.md
index a3e311496e..2a7cdcfa2e 100644
--- a/docs/activitymonitor/8.0/install/upgrade/upgrade.md
+++ b/docs/activitymonitor/8.0/install/upgrade/upgrade.md
@@ -13,7 +13,7 @@ other Netwrix products.
## Considerations
While it is strongly recommended to match the versions of both the console and the activity agent,
-activity agent(s) V3.1+ can be managed by Activity Monitor Console V4.0+. Older versions of activity
+activity agents V3.1+ can be managed by Activity Monitor Console V4.0+. Older versions of activity
agents will be limited in monitoring capability until upgraded.
The installation and configuration paths for Netwrix Activity Monitor 8.0 have been updated from
@@ -23,8 +23,6 @@ for additional information.
## Activity Monitor Upgrade Procedure
-Follow the steps to upgrade from the Netwrix Activity Monitor V7.1 to Netwrix Activity Monitor 8.0.
-
_Prerequisite_ – Ensure console and agent servers have .NET Framework 4.7.2 installed.
**Step 1 –** Install the Activity Monitor 8.0 on the same machine where the V7.1 console resides
@@ -40,7 +38,7 @@ Update the activity agents in batches to ensure continuity of monitoring.
:::
-**Step 2 –** Select the activity agent(s) to be upgraded. The Windows Ctrl-select option can be used
+**Step 2 –** Select the activity agents to be upgraded. The Windows Ctrl-select option can be used
to select multiple activity agents. Then click Upgrade.
**Step 3 –** (_Optional_) Deploy AD agents to monitor domains.
@@ -53,6 +51,6 @@ when upgrading to Activity Monitor 8.0.
The selected activity agents are updated to V8.0. If a Threat Prevention Agent is also installed on
the Windows server for monitoring file systems, the Monitored Hosts tab identifies the host as being
-“Managed by Threat Prevention”, and that ‘monitored host’ is not editable. However, multiple outputs
+“Managed by Threat Prevention”, and that ‘monitored host’ isn't editable. However, multiple outputs
can be configured for hosts. Add the Windows host to the Monitored Hosts tab to monitor file system
for outputs to Access Analyzer, Threat Manager, and/or SIEM products.
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/activityagent.md b/docs/activitymonitor/8.0/requirements/activityagent/activityagent.md
index e8d570b037..3717e393e5 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/activityagent.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/activityagent.md
@@ -59,7 +59,7 @@ See the [Activity Agent Ports](/docs/activitymonitor/8.0/requirements/activityag
## Supported Exchange Online
-The Activity Monitor provides the ability to monitor Exchange Online:
+The Activity Monitor lets you monitor Exchange Online:
:::note
For monitoring Exchange Online, the Activity Agent must be deployed to a Windows server
@@ -74,7 +74,7 @@ topic for target environment requirements.
## Supported Microsoft Entra ID
-The Activity Monitor provides the ability to monitor Microsoft Entra ID:
+The Activity Monitor lets you monitor Microsoft Entra ID:
:::note
For monitoring Microsoft Entra ID, the Activity Agent must be deployed to a Windows server
@@ -89,7 +89,7 @@ for target environment requirements.
## Supported Network Attached Storage Devices
-The Activity Monitor provides the ability to monitor NAS file server devices:
+The Activity Monitor lets you monitor NAS file server devices:
:::note
For monitoring NAS devices, the Activity Agent must be deployed to a Windows server that
@@ -140,7 +140,7 @@ target environment requirements.
See the [Hitachi Activity Auditing Configuration](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md) topic for target
environment requirements.
-**Nasuni Nasuni Edge Appliances**
+**Nasuni Edge Appliances**
- 8.0+
@@ -176,7 +176,7 @@ environment requirements.
## Supported SharePoint Farms Platforms
-The Activity Monitor provides the ability to monitor SharePoint farms:
+The Activity Monitor lets you monitor SharePoint farms:
:::note
For monitoring a SharePoint farm, the Activity Agent must be deployed to the SharePoint
@@ -195,7 +195,7 @@ topic for target environment requirements.
## Supported SharePoint Online
-The Activity Monitor provides the ability to monitor SharePoint Online:
+The Activity Monitor lets you monitor SharePoint Online:
:::note
For monitoring SharePoint Online, the Activity Agent must be deployed to a Windows server
@@ -211,11 +211,10 @@ for target environment requirements.
## Supported SQL Server Platforms
-The Activity Monitor provides the ability to monitor SQL Server:
+The Activity Monitor lets you monitor SQL Server:
:::note
-For monitoring SQL Server, it is recommended to install the Activity Agent must be
-deployed to a Windows server that acts as a proxy for monitoring the target environment.
+For monitoring SQL Server, deploy the Activity Agent to a Windows server that acts as a proxy for monitoring the target environment.
:::
@@ -231,11 +230,11 @@ target environment requirements.
## Supported Windows File Servers Platforms
-The Activity Monitor provides the ability to monitor Windows file servers:
+The Activity Monitor lets you monitor Windows file servers:
:::note
For monitoring a Windows file server, the Activity Agent must be deployed to the server.
-It cannot be deployed to a proxy server.
+It can't be deployed to a proxy server.
:::
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/activityagentports.md b/docs/activitymonitor/8.0/requirements/activityagent/activityagentports.md
index 6032b6d369..7770316425 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/activityagentports.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/activityagentports.md
@@ -15,7 +15,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
@@ -119,7 +119,7 @@ Agent server and the target NetApp Data ONTAP 7-Mode device:
Activity Monitor.
:::note
-If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
+If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
device must be configured manually. Also, the External Engine will not reconnect automatically in
the case of a server reboot or service restart.
:::
@@ -140,7 +140,7 @@ Agent server and the target NetApp Data ONTAP Cluster-Mode device:
Activity Monitor.
:::note
-If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
+If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
device must be configured manually. Also, the External Engine will not reconnect automatically in
the case of a server reboot or service restart.
:::
@@ -166,7 +166,7 @@ Agent server and the target Panzura device:
| Communication Direction | Protocol | Ports | Description |
| ------------------------------------------ | ------------- | ----- | ----------------------- |
| Activity Agent Server to Panzura | HTTPS | 443 | Panzura API |
-| Panzura filers to to Activity Agent Server | AMQP over TCP | 4497 | Panzura Event Reporting |
+| Panzura filers to Activity Agent Server | AMQP over TCP | 4497 | Panzura Event Reporting |
Protect the port with a username and password. The credentials will be configured in Panzura.
@@ -200,7 +200,7 @@ Agent server and the target SQL Server:
| ----------------------------------- | -------- | ----- | ----------------------- |
| SQL Server to Activity Agent Server | TCP | 1433 | Default SQL Server Port |
-If the Activity Monitor cannot connect to the SQL Server, ensure that SQL Server Browsing state is
+If the Activity Monitor can't connect to the SQL Server, ensure that SQL Server Browsing state is
**Running**.
## Integration with Netwrix Enterprise Auditor Additional Firewall Rules
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/entraid-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/entraid-activity.md
index 17e5aa1972..5fd0987e0d 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/entraid-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/entraid-activity.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Microsoft Entra ID Activity Auditing Configuration
-It is necessary to register Activity Monitor as a web application to the targeted Microsoft Entra ID
-(formerly Azure AD), in order for Activity Monitor to monitor the environment. This generates the
+Register Activity Monitor as a web application to the targeted Microsoft Entra ID
+(formerly Azure AD) to enable Activity Monitor to monitor the environment. This generates the
Client ID and Client Secret needed by the Activity Agent. See
[Microsoft Support](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-reporting-api-prerequisites-azure-portal)
for assistance in configuring the Microsoft Entra ID web application.
@@ -20,14 +20,14 @@ Microsoft Entra ID.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you have registered the application:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
+ It isn't possible to retrieve the value after saving the new key. It must be
copied first.
:::
@@ -46,7 +46,7 @@ The following permissions are required:
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
+To register Activity Monitor with Microsoft Entra ID, complete these steps:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -79,8 +79,8 @@ application. Now that the application has been registered, permissions need to b
## Grant Permissions to the Registered Application
-Follow the steps to set up permissions to enable the Activity Monitor to monitor data and collect
-logs from Microsoft Entra ID.
+To set up permissions that enable the Activity Monitor to monitor data and collect
+logs from Microsoft Entra ID, complete these steps:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -116,7 +116,7 @@ be collected.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
+To find the registered application's Client ID, complete these steps:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -142,8 +142,7 @@ The Tenant ID is available in two locations within Microsoft Entra ID.
**Registered Application Overview Blade**
-You can copy the Tenant ID from the same page where you just copied the Client ID. Follow the steps
-to copy the Tenant ID from the registered application Overview blade.
+You can copy the Tenant ID from the same page where you just copied the Client ID. To copy the Tenant ID from the registered application Overview blade, complete these steps:
**Step 1 –** Copy the Directory (tenant) ID value.
@@ -154,7 +153,7 @@ application’s Client Secret Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
+To find the tenant name where the registered application resides, complete these steps:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -174,8 +173,8 @@ application’s Client Secret Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
-value when saving the new key.
+To find the registered application's Client Secret, create a new key, and save its
+value when saving the new key, complete these steps:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -185,7 +184,7 @@ documentation for additional information.
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
+It isn't possible to retrieve the value after saving the new key. It must be copied
first.
:::
@@ -212,7 +211,7 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
+If this page is left before the key is copied, then the key isn't retrievable, and
this process will have to be repeated.
:::
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/exchange-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/exchange-activity.md
index 560f5d6f84..8c7d087501 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/exchange-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/exchange-activity.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# Exchange Online Activity Auditing Configuration
-In order to collect logs and monitor Exchange Online activity using the Netwrix Activity Monitor, it
-needs to be registered with Microsoft® Entra ID® (formerly Azure AD).
+To collect logs and monitor Exchange Online activity using the Netwrix Activity Monitor, register it
+with Microsoft® Entra ID® (formerly Azure AD).
:::note
A user account with the Global Administrator role is required to register an app with
@@ -25,14 +25,14 @@ See the Enable Auditing for Exchange Online topic for additional information.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+After registering the application, collect the following settings from your tenant:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
+ It isn't possible to retrieve the value after saving the new key. It must be
copied first.
:::
@@ -53,102 +53,65 @@ The following settings are needed from your tenant once you have registered the
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
-
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
-steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
-documentation for additional information.
+These steps are for registering an app through the Microsoft Entra admin center. The steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft documentation for additional information.
:::
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/).
+2. On the left navigation menu, navigate to **Identity** > **Applications** and click **App registrations**.
+3. In the top toolbar, click **New registration**.
+4. On the **Register an application** page, enter the following information:
+ - Name – Enter a user-facing display name for the application, for example Netwrix Activity Monitor for Exchange
+ - Supported account types – Select **Accounts in this organizational directory only**
+ - Redirect URI – Set the Redirect URI to **Public client/native** (Mobile and desktop) from the dropdown menu. In the text box, enter the following:
-**Step 1 –** Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/).
-
-**Step 2 –** On the left navigation menu, navigate to **Identity** > **Applications** and click App
-registrations.
-
-**Step 3 –** In the top toolbar, click **New registration**.
-
-**Step 4 –** Enter the following information in the Register an application page:
-
-- Name – Enter a user-facing display name for the application, for example Netwrix Activity Monitor
- for Exchange
-- Supported account types – Select **Accounts in this organizational directory only**
-- Redirect URI – Set the Redirect URI to **Public client/native** (Mobile and desktop) from the drop
- down menu. In the text box, enter the following:
+ **urn:ietf:wg:oauth:2.0:oob**
-**urn:ietf:wg:oauth:2.0:oob**
-
-**Step 5 –** Click **Register**.
+5. Click **Register**.
The Overview page for the newly registered app opens. Review the newly created registered
application. Now that the application has been registered, permissions need to be granted to it.
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
-
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
-steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
-documentation for additional information.
+These steps are for registering an app through the Microsoft Entra admin center. The steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft documentation for additional information.
:::
-
-**Step 1 –** Select the newly-created, registered application. If you left the Overview page, it
-will be listed in the **Identity** > **Applications** > **App registrations** > **All applications**
-list.
-
-**Step 2 –** On the registered app blade, click **API permissions** in the Manage section.
-
-**Step 3 –** In the top toolbar, click **Add a permission**.
-
-**Step 4 –** On the Request API permissions blade, select **Microsoft Graph** on the Microsoft APIs
-tab. Select the following permissions:
+1. Select the newly-created, registered application. If you left the Overview page, it will be listed in **Identity** > **Applications** > **App registrations** > **All applications**.
+2. On the registered app blade, click **API permissions** in the Manage section.
+3. In the top toolbar, click **Add a permission**.
+4. On the **Request API permissions** blade, select **Microsoft Graph** on the **Microsoft APIs** tab and select the following permissions:
- Application:
- Directory.Read.All – Read directory data
- User.Read.All – Read all users' full profiles
-**Step 5 –** At the bottom of the page, click **Add Permissions**.
-
-**Step 6 –** In the top toolbar, click **Add a permission**.
-
-**Step 7 –** On the Request API permissions blade, select Office 365 Management APIs on the
-Microsoft APIs tab. Select the following permissions:
+5. At the bottom of the page, click **Add Permissions**.
+6. In the top toolbar, click **Add a permission**.
+7. On the **Request API permissions** blade, select **Office 365 Management APIs** on the **Microsoft APIs** tab and select the following permissions:
- Application Permissions:
- ActivityFeed.Read – Read activity data for your organization
- ActivityFeed.ReadDlp – Read DLP policy events including detected sensitive data
-**Step 8 –** At the bottom of the page, click **Add Permissions**.
-
-**Step 9 –** Click **Grant Admin Consent for [tenant]**. Then click **Yes** in the confirmation
-window.
+8. At the bottom of the page, click **Add Permissions**.
+9. Click **Grant Admin Consent for [tenant]**, then click **Yes** in the confirmation window.
Now that the permissions have been granted to it, the settings required for Activity Monitor need to
be collected.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
-
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
-steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
-documentation for additional information.
+These steps are for registering an app through the Microsoft Entra admin center. The steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft documentation for additional information.
:::
-
-**Step 1 –** Select the newly-created, registered application. If you left the Overview page, it
-will be listed in the **Identity** > **Applications** > **App registrations** > **All applications**
-list.
-
-**Step 2 –** Copy the **Application (client) ID** value.
-
-**Step 3 –** Save this value in a text file.
+1. Select the newly-created, registered application. If you left the Overview page, it will be listed in **Identity** > **Applications** > **App registrations** > **All applications**.
+2. Copy the **Application (client) ID** value.
+3. Save this value in a text file.
This is needed for adding a Exchange Online host in the Activity Monitor. See the
[Exchange Online](/docs/activitymonitor/8.0/admin/monitoredhosts/add/exchangeonline.md) topic for
@@ -160,12 +123,10 @@ The Tenant ID is available in two locations within Microsoft Entra ID.
**Registered Application Overview Blade**
-You can copy the Tenant ID from the same page where you just copied the Client ID. Follow the steps
-to copy the Tenant ID from the registered application Overview blade.
+You can copy the Tenant ID from the same page where you just copied the Client ID.
-**Step 1 –** Copy the Directory (tenant) ID value.
-
-**Step 2 –** Save this value in a text file.
+1. Copy the **Directory (tenant) ID** value.
+2. Save this value in a text file.
This is needed for adding a Exchange Online host in the Activity Monitor. See the
[Exchange Online](/docs/activitymonitor/8.0/admin/monitoredhosts/add/exchangeonline.md) topic for
@@ -174,20 +135,13 @@ Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
-
:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
-steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
-documentation for additional information.
+These steps are for registering an app through the Microsoft Entra admin center. The steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft documentation for additional information.
:::
-
-**Step 1 –** Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/).
-
-**Step 2 –** Copy the Tenant ID value.
-
-**Step 3 –** Save this value in a text file.
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/).
+2. Copy the **Tenant ID** value.
+3. Save this value in a text file.
This is needed for adding a Exchange Online host in the Activity Monitor. See the
[Exchange Online](/docs/activitymonitor/8.0/admin/monitoredhosts/add/exchangeonline.md) topic for
@@ -196,53 +150,34 @@ Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
-value when saving the new key.
-
-:::note
-The steps below are for registering an app through the Microsoft Entra admin center. These
-steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
-documentation for additional information.
-:::
-
-
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
-first.
+You can't retrieve the value after saving the new key. Copy it first.
:::
+:::note
+These steps are for registering an app through the Microsoft Entra admin center. The steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft documentation for additional information.
+:::
-**Step 1 –** Select the newly-created, registered application. If you left the Overview page, it
-will be listed in the **Identity** > **Applications** > **App registrations** > **All applications**
-list.
-
-**Step 2 –** On the registered app blade, click **Certificates & secrets** in the Manage section.
-
-**Step 3 –** In the top toolbar, click **New client secret**.
-
-**Step 4 –** On the Add a client secret blade, complete the following:
+1. Select the newly-created, registered application. If you left the Overview page, it will be listed in **Identity** > **Applications** > **App registrations** > **All applications**.
+2. On the registered app blade, click **Certificates & secrets** in the Manage section.
+3. In the top toolbar, click **New client secret**.
+4. On the **Add a client secret** blade, complete the following:
- Description – Enter a unique description for this secret
- Expires – Select the duration.
:::note
- Setting the duration on the key to expire requires reconfiguration at the time of
- expiration. It is best to configure it to expire in 1 or 2 years.
+ Setting an expiration date requires reconfiguration at the time of expiration. It's best to configure the key to expire in 1 or 2 years.
:::
-
-**Step 5 –** Click **Add** to generate the key.
+5. Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
-this process will have to be repeated.
+If you leave this page before copying the key, you can't retrieve it later and will need to repeat the process.
:::
-
-**Step 6 –** The Client Secret will be displayed in the Value column of the table. You can use the
-Copy to clipboard button to copy the Client Secret.
-
-**Step 7 –** Save this value in a text file.
+6. The **Client Secret** is displayed in the **Value** column. Use the copy button to copy it.
+7. Save this value in a text file.
This is needed for adding a Exchange Online host in the Activity Monitor. See the
[Exchange Online](/docs/activitymonitor/8.0/admin/monitoredhosts/add/exchangeonline.md) topic for
@@ -250,17 +185,9 @@ additional information.
## Enable Auditing for Exchange Online
-Follow the steps to enable auditing for Exchange Online so the Activity Monitor can receive events.
-
-**Step 1 –** In the Microsoft Purview compliance portal at
-[https://compliance.microsoft.com](https://compliance.microsoft.com/), go to **Solutions** >
-**Audit**. Or, to go directly to the Audit page at
-[https://compliance.microsoft.com/auditlogsearch](https://compliance.microsoft.com/auditlogsearch).
-
-**Step 2 –** If auditing is not turned on for your organization, a banner is displayed prompting you
-start recording user and admin activity.
-
-**Step 3 –** Select the **Start recording** user and **admin activity** banner.
+1. In the Microsoft Purview compliance portal at [https://compliance.microsoft.com](https://compliance.microsoft.com/), go to **Solutions** > **Audit**. Alternatively, go directly to the Audit page at [https://compliance.microsoft.com/auditlogsearch](https://compliance.microsoft.com/auditlogsearch).
+2. If auditing isn't enabled for your organization, a banner prompts you to start recording user and admin activity.
+3. Select the **Start recording user and admin activity** banner.
It may take several hours before events appear in the application. The Activity Monitor now has
Exchange Online auditing enabled as needed to receive events. See the Microsoft
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/celerra-vnx-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/celerra-vnx-activity.md
index 464d6a7ceb..4bdb135802 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/celerra-vnx-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/celerra-vnx-activity.md
@@ -11,15 +11,15 @@ events. All audit data can be forwarded to the Dell Common Event Enabler (CEE).
listens for all events coming through the Dell CEE and translates all relevant information into
entries in the Log files or syslog messages.
-Complete the following checklist prior to configuring the Activity Monitor to monitor the host.
+Complete the following checklist before configuring the Activity Monitor to monitor the host.
Instructions for each item of the checklist are detailed within the following sections.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - DNS name of Celerra or VNX CIFS share(s) to be monitored
- - Data Mover or Virtual Data Mover hosting the share(s) to be monitored
+ - DNS name of Celerra or VNX CIFS shares to be monitored
+ - Data Mover or Virtual Data Mover hosting the shares to be monitored
- Account with access to the CLI
- Download the Dell CEE from:
@@ -38,9 +38,9 @@ Instructions for each item of the checklist are detailed within the following se
- Important:
- - Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE
+ - Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE
is installed
- - Dell CEE 8.4.2 through Dell CEE 8.6.1 are not supported for use with the VCAPS feature
+ - Dell CEE 8.4.2 through Dell CEE 8.6.1 aren't supported for use with the VCAPS feature
- Dell CEE requires .NET Framework 3.5 to be installed on the Windows proxy server
- See the [Install & Configure Dell CEE](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md) topic for instructions.
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md
index fe6f0d1117..d33ca48ba7 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install & Configure Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,7 +20,7 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
+To install the Dell CEE, complete these steps:
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -41,14 +41,13 @@ asynchronous bulk delivery (VCAPS) feature.
See the [CEE Debug Logs](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md#cee-debug-logs) section for information on
troubleshooting issues related to Dell CEE.
-After Dell CEE installation is complete, it is necessary to Connect Data Movers to the Dell CEE
+After Dell CEE installation is complete, connect Data Movers to the Dell CEE
Server.
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -58,12 +57,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
@@ -94,13 +93,13 @@ Mover.
administrative account should have a $ character in the terminal.
:::note
-Do not use a # charter.
+Don't use a # charter.
:::
**Step 2 –** Create or retrieve the `cepp.conf` file.
-If there is not a `cepp.conf` file on the Data Mover(s), use a text editor to create a new blank
+If there isn't a `cepp.conf` file on the Data Movers, use a text editor to create a new blank
file in the home directory named `cepp.conf`. The following is an example command if using the text
editor 'vi' to create a new blank file:
@@ -126,7 +125,7 @@ The Activity Monitor requires the following parameters to be set in the `cepp.co
- `pool name= `
- This should equal the name assigned to the configuration container. This container is composed
- of the server(s) IP Address or FQDN where the Dell CEE is installed and where the list of
+ of the servers IP Address or FQDN where the Dell CEE is installed and where the list of
events to be monitored is located. It can be named as desired but must be a pool name.
- `servers= `
- This should equal the IP Address or FQDN of the Windows server where the Dell CEE is
@@ -175,7 +174,7 @@ The Activity Monitor requires the following parameters to be set in the `cepp.co
postevents=CloseModified|CloseUnmodified|CreateDir|CreateFile|DeleteDir|DeleteFile|RenameDir|RenameFile|SetAclDir|SetAclFile
-**Step 4 –** Move the `cepp.conf` file to the Data Mover(s) root file system. Run the following
+**Step 4 –** Move the `cepp.conf` file to the Data Movers root file system. Run the following
command:
**$ server_file [DATA_MOVER_NAME]‑put cepp.conf cepp.conf**
@@ -201,7 +200,7 @@ Then verify the CEPA status using the following command:
**server_cepp [DATA_MOVER_NAME] -service –status**
-Once the `cepp.config` file has been configured, it is time to configure and enable monitoring with
+After the `cepp.config` file has been configured, configure and enable monitoring with
the Activity Monitor. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor)
for additional information.
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/validate.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/validate.md
index 823567bb82..d28234dcf0 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/validate.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/validate.md
@@ -6,10 +6,10 @@ sidebar_position: 20
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
-configuration must be validated to ensure events are being monitored.
+After you configure the Activity Monitor agent to monitor the Dell device, you must validate the
+automated configuration to ensure the agent is monitoring events.
-## Validate Dell CEE Registry Key Settings
+## Validate Dell Common Event Enabler (CEE) Registry Key Settings
:::note
See the
@@ -21,10 +21,10 @@ topic for information on manually setting the registry key.
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
+a different server than the Windows proxy servers where the Activity Monitor activity agent is
deployed.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -87,10 +87,10 @@ Set the following values under the Data column:
If this is configured correctly, validate that the Dell CEE services are running. See the Validate
Dell CEE Services are Running topic for additional information.
-## Validate Dell CEE Services are Running
+## Validate Dell Common Event Enabler (CEE) Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -120,19 +120,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ctera-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ctera-activity.md
index 8c0f7b9ff4..887820e401 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ctera-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ctera-activity.md
@@ -41,10 +41,10 @@ portal.
## Enable Auditing on CTERA Edge Filer
The CTERA Edge Filer can generate audit log events for the SMB access. Audit events are stored in a
-local file and then forwarded to the CTERA Portal for further processing. The audit log is disabled
-by default and must be enabled.
+local file and then forwarded to the CTERA Portal for further processing. By default, the system
+disables the audit log, but you must enable it.
-Follow the steps to enable SMB audit logs.
+Use the following steps to enable SMB audit logs.
**Step 1 –** Log in to the Edge Filer web interface. In the Configuration view, select **Logs** >
**Audit Logs**.
@@ -64,10 +64,10 @@ create a share.
**Step 4 –** Adjust the **Keep closed files for** parameter. Otherwise, use the default value.
**Step 5 –** Check all events except the **Read Extended Attributes** event in Events to log list.
-If you do not require monitoring of _Directory Read/List_ operations, which typically generate a
+If you don't require monitoring of _Directory Read/List_ operations, which typically generate a
high volume of data, uncheck the **List Folder Read Data** event.
-**Step 6 –** Make sure that **Log permission changes in human readable format** is unchecked.
+**Step 6 –** ensure that **Log permission changes in human readable format** is unchecked.
**Step 7 –** Click **Save**.
@@ -123,7 +123,7 @@ article for additional information.
and then to ACTIVE. Wait until the status is ACTIVE before proceeding to the next step.
:::note
-If the status does not change to ACTIVE, the log files need to be collected from
+If the status doesn't change to ACTIVE, the log files need to be collected from
`/usr/local/lib/ctera/work/logs/services` directory.
See the
[CTERA Messaging Service Logs](https://kb.ctera.com/docs/setting-up-the-ctera-messaging-service-2#ctera-messaging-service-logs)
@@ -146,7 +146,7 @@ Monitor Agent will apply the settings and perform periodic checks to ensure cor
automatic configuration, use the **Enable Edge Filer Syslog auditing** option in the host properties
and specify credentials to access the CTERA Portal API.
-Follow the steps to configure the Edge Filer Syslog Service manually.
+Use the following steps to configure the Edge Filer Syslog Service manually.
**Step 1 –** Configure monitoring of the CTERA Portal in the Activity Monitor Console.
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md
index deade0c148..3e0283ba03 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md
@@ -6,9 +6,6 @@ sidebar_position: 20
# Configure Access to HNAS Audit Logs on Activity Agent Server
-Follow the steps to configure access to the HNAS audit logs on the Windows server hosting the
-Activity Monitor activity agent.
-
**Step 1 –** On the Windows computer, go to Run and type `compmgmt.msc`.
**Step 2 –** In the right-hand panel, select More Actions > Connect to another computer.
@@ -22,9 +19,9 @@ Folders > Shares.
**Step 5 –** Select the Security tab and click Advanced.
**Step 6 –** In the Advanced Security Settings dialog box, select the Audit tab. Click Add or Edit
-to select the users and groups to be audited and add the desired user or group.
+to select the users and groups to be audited and add the user or group you want.
**Step 7 –** Select All for Type, and Full Control for Basic permissions.
-Once access has been configured on both the Hitachi device and the Activity Agent server, it is time
-to configure and enable monitoring with the Activity Monitor Console.
+After you configure access on both the Hitachi device and the Activity Agent server, configure and
+enable monitoring with the Activity Monitor Console.
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md
index e20c2a72ea..f59c115271 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Configure Audit Logs on HNAS
-Follow the steps to configure access to the HNAS audit logs on the Hitachi device.
-
**Step 1 –** Open a browser and enter the IP Address for HNAS in the address bar to launch the
Hitachi Storage Navigator (SN). Enter the username and password.
@@ -33,7 +31,7 @@ auditing). In the Audit Log section, set the maximum log file size to a value of
is recommended to set it to 16 MB. In the Log roll over policy section, select New. The product does
not support the Wrap policy. Click OK to close.
-Once access has been configured on the Hitachi device, it is necessary to configure access to the
-HNAS audit logs on the Windows server. See the
+After you configure access on the Hitachi device, configure access to the HNAS audit logs on the
+Windows server. See the
[Configure Access to HNAS Audit Logs on Activity Agent Server](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md) topic for
additional information.
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md
index 0e9ad095db..46cbd9d3b7 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md
@@ -11,7 +11,7 @@ multiple file systems. Auditing is enabled and configured per file system. This
to enable auditing on an HNAS and to configure the Activity Monitor to monitor activity coming from
the Hitachi device auditing.
-The Activity Monitor does not use the EVS or file system name to connect to HNAS. Therefore, all
+The Activity Monitor doesn't use the EVS or file system name to connect to HNAS. Therefore, all
that is required of the user for HNAS activity collection is the following:
- Logs path (UNC)
@@ -39,11 +39,11 @@ clients using other protocols would be costly in terms of system performance, be
operation would have to be audited as an open operation. **Therefore, when file system auditing is
enabled, by default, only clients connecting through the CIFS protocol are allowed access to the
file system.** Access by clients using other protocols, like NFS, can, however, be allowed. When
-such access is allowed, access to file system objects through these protocols is not audited.”
+such access is allowed, access to file system objects through these protocols isn't audited.”
:::note
File system auditing can be configured to deny access to clients connecting with protocols
-that cannot be audited (NFS). Please see the Hitachi
+that can't be audited (NFS). see the Hitachi
[Server and Cluster Administration Guide](https://support.hds.com/download/epcra/hnas0106.pdf) for
additional information.
:::
@@ -51,7 +51,7 @@ additional information.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Hitachi devices.
+Complete the following checklist before configuring activity monitoring of Hitachi devices.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: [Configure Audit Logs on HNAS](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md)**
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/installcee.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/installcee.md
index 4d26538774..5d28d67c8b 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/installcee.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/installcee.md
@@ -6,8 +6,9 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
-product. Dell customers have a support account with Dell to access the download.
+Dell Common Event Enabler (CEE) should be installed on a Windows or a Linux server. The Dell CEE
+software isn't a Netwrix product. Dell customers have a support account with Dell to access the
+download.
:::tip
Remember, the latest version is the recommended version of Dell CEE.
@@ -20,8 +21,6 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
-
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -45,7 +44,7 @@ issues related to Dell CEE.
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
+one where the Activity Monitor activity agent is deployed. In those cases, you must
manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -56,12 +55,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/isilon-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/isilon-activity.md
index aee16da916..e4f4fc70a5 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/isilon-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/isilon-activity.md
@@ -20,15 +20,15 @@ initiated the activity. The stored events are then forwarded by the node to the
concurrently to several instances. At this point, Dell CEE forwards the audit event to a defined
endpoint, such as Activity Monitor agent.
-Complete the following checklist prior to configuring Activity Monitor to monitor the host.
+Complete the following checklist before configuring Activity Monitor to monitor the host.
Instructions for each item of the checklist are detailed within the following sections.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - DNS name of Isilon/PowerScale CIFS share(s) to be monitored
- - Access Zone(s) containing the CIFS shares to be monitored
+ - DNS name of Isilon/PowerScale CIFS shares to be monitored
+ - Access Zones containing the CIFS shares to be monitored
- Account with access to the OneFS UI or CLI
- Download the Dell CEE from:
@@ -79,12 +79,12 @@ Checklist Item 3: Configure Auditing on the Dell Isilon/PowerScale Cluster
- Important:
- Value of the **Storage Cluster Name** field must exactly match the name entered for the
- monitored host in the Activity Monitor Console. If the Storage Cluster Name cannot be modified
+ monitored host in the Activity Monitor Console. If the Storage Cluster Name can't be modified
(for example, another 3rd party depends on it), you need to set the Host Aliases parameter in
the Activity Monitor Console. Otherwise, if for some reason the Storage Cluster Name must be
left empty, one can list OneFS cluster node names in the Host Aliases.
- - If the Storage Cluster Name is not empty, set the Host Aliases parameter to its value
+ - If the Storage Cluster Name isn't empty, set the Host Aliases parameter to its value
- If the Storage Cluster Name is empty, set the Host Aliases to a semicolon-separated list
of OneFS node names
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/manualconfiguration.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/manualconfiguration.md
index cc3b8a747d..5990c31e50 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/manualconfiguration.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/manualconfiguration.md
@@ -21,10 +21,10 @@ is typically used. If the CIFS or NFS shares are accessible through different zo
cluster, include all relevant zones.
Ensure that OneFS collects only events you are interested in. By default, OneFS may monitor things
-like directory reads, which can take up a large amount of space. Configuring the OneFS events that
-need monitoring is not done through the Activity Monitor console. Configure OneFS event monitoring
-using OneFS CLI with the isi audit modify command for each access zone. Enabling monitoring for only
-what is needed for the environment will reduce the data load to the agent.
+like directory reads, which can take up a large amount of space. Configure the OneFS events that
+need monitoring by using the OneFS CLI with the isi audit modify command for each access zone, not
+through the Activity Monitor console. Enable monitoring for only what is needed for the
+environment to reduce the data load to the agent.
Activity Monitor monitors the following events: `close_file_modified`, `close_file_unmodified`,
`create_file`, `create_directory`, `delete_file`, `delete_directory`, `rename_file`,
@@ -53,8 +53,8 @@ server hosting CEE. Use either of the following format:
http://[SERVER Name]:[PORT]/cee
:::info
-When deploying multiple Dell CEE instances at scale, it is recommended that an
-accommodating agent must be configured with each CEE instance. If multiple CEE instances send events
+When deploying multiple Dell CEE instances at scale, configure an accommodating agent with each
+CEE instance. If multiple CEE instances send events
to just one agent, it may create an overflow of data and overload the agent. Distributing the
activity stream into pairs will be the most efficient way of monitoring large data sets at scale.
:::
@@ -65,7 +65,7 @@ be an exact match to the name which is entered in the Activity Monitor for the *
list.
This name is used as a ‘tag’ on all events coming through the CEE. This name must exactly match what
-is in the Activity Monitor or it does not recognize the events.
+is in the Activity Monitor or it doesn't recognize the events.
:::info
Use the CIFS DNS name for Dell OneFS.
@@ -78,10 +78,10 @@ name entered here must exactly match what is used for Access Analyzer as a targe
:::
-If the Storage Cluster Name cannot be modified (for example, another third-party depends on it), you
+If the Storage Cluster Name can't be modified (for example, another third-party depends on it), you
need to set the Host Aliases parameter in the Activity Monitor Console:
-- If the Storage Cluster Name is not empty, set the Host Aliases parameter to its value
+- If the Storage Cluster Name isn't empty, set the Host Aliases parameter to its value
- If the Storage Cluster Name is empty, set the Host Aliases to a semicolon-separated list of OneFS
node names
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/validate.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/validate.md
index 4db2b31e10..1d3f2197cf 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/validate.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/validate.md
@@ -6,18 +6,18 @@ sidebar_position: 30
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
-configuration must be validated to ensure events are being monitored.
+After you configure the Activity Monitor agent to monitor the Dell device, you must validate the
+automated configuration to ensure the agent is monitoring events.
-## Validate Dell CEE Registry Key Settings
+## Validate Dell Common Event Enabler (CEE) Registry Key Settings
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
+a different server than the Windows proxy servers where the Activity Monitor activity agent is
deployed.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -80,10 +80,10 @@ Set the following values under the Data column:
If this is configured correctly, validate that the Dell CEE services are running. See the Validate
Dell CEE Services are Running topic for additional information.
-## Validate Dell CEE Services are Running
+## Validate Dell Common Event Enabler (CEE) Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -113,19 +113,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md
index a74a220d97..20a08dce17 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md
@@ -13,7 +13,7 @@ network connection to the appliance. Nasuni will then stream event data to the a
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Nasuni Edge Appliances.
+Complete the following checklist before configuring activity monitoring of Nasuni Edge Appliances.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Generate Nasuni API Access Key**
@@ -28,9 +28,9 @@ Instructions for each item of the checklist are detailed within the following to
- Deploy the Activity Monitor activity agent to a Windows proxy server
-## Nasuni Filer Management Interface
+## Generate a Nasuni API Access Key in the Filer Management Interface
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Filer Management Interface.
+Use the following steps to generate a Nasuni API Access Key.
**Step 1 –** Within the **Configuration** menu, under **USERS & SECURITY**, select API Access Keys.
The API Access Keys page opens.
@@ -43,8 +43,8 @@ The API Access Keys page opens.
**Step 5 –** In the Successfully Generated API Key window, copy the Key Passcode.
-Both the Key Name and the Key Passcode are required by the Activity Monitor in order to connect to
-the Nasuni Edge Appliance. Once the API Key has been generated, it is time to configure and enable
+Both the Key Name and the Key Passcode are required by the Activity Monitor to connect to
+the Nasuni Edge Appliance. After you generate the API Key, configure and enable
monitoring with the Activity Monitor console.
:::note
@@ -53,24 +53,24 @@ the exact same case as generated.
:::
-## Nasuni Management Console
+## Generate a Nasuni API Access Key in the Management Console
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Management Console.
+Use the following steps to generate a Nasuni API Access Key.
**Step 1 –** Click Filers and select API Keys from the menu on the left. The Filer API Access Key
Settings page opens.
**Step 2 –** Click New API Key button. The Add API Access Key window opens.
-**Step 3 –** From the Filer drop-down menu, select the desired Nasuni Edge Appliance. Then enter a
+**Step 3 –** From the Filer dropdown menu, select the Nasuni Edge Appliance you want to monitor. Then enter a
Name for the key; for example, the name of the application.
**Step 4 –** Click Add API Key.
**Step 5 –** A message appears which includes the Key Passcode; copy the Key Passcode.
-Both the Key Name and the Key Passcode are required by the Activity Monitor in order to connect to
-the Nasuni Edge Appliance. Once the API Key has been generated, it is time to configure and enable
+Both the Key Name and the Key Passcode are required by the Activity Monitor to connect to
+the Nasuni Edge Appliance. After you generate the API Key, configure and enable
monitoring with the Activity Monitor console.
:::note
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md
index ee53786bf8..64fc11dabd 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md
@@ -12,7 +12,7 @@ A user having REST API access must be created on the Nutanix Files server to mon
server using Activity Monitor. Additional configurations are done automatically by Activity Monitor
using the Nutanix API with the help of this user.
-Follow the steps to create a new user account with Nutanix Prism:
+Use the following steps to create a new user account with Nutanix Prism:
**Step 1 –** Open Nutanix Prism web portal.
@@ -37,7 +37,7 @@ Monitor.
:::note
-Nutanix Files does not report events for activity originating from a server where the
+Nutanix Files doesn't report events for activity originating from a server where the
Activity Monitor Agent is installed.
:::
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefirewall.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefirewall.md
index 1a2d7de662..62e0285aa2 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefirewall.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefirewall.md
@@ -30,11 +30,11 @@ Monitor.
Both classic ONTAPI/ZAPI and the new REST API are supported. Starting with ONTAP 9.13.1, the product
uses REST API by default if it is available. HTTP and HTTPS protocols are supported. For HTTPS, two
-modes are supported: strict and ignore errors. For the strict mode, the product allows you to
-disable the host name validation in case the agent cannot resolve the FQDN of the LIF.
+modes are supported: strict and ignore errors. For the strict mode, you can
+disable the host name validation in case the agent can't resolve the FQDN of the LIF.
Enabling the API access varies depending on ONTAP version. The following sections list common steps
-on enabling the API access. Please refer to the NetApp documentation for more details.
+on enabling the API access. refer to the NetApp documentation for more details.
### Management-http Service
@@ -74,7 +74,7 @@ network interface service-policy add-service -service management-https -policy d
### Firewall Policy
-For ONTAP 9.5 and older, the following commands can be used to either create a new firewall policy
+For ONTAP 9.5 and earlier, use the following commands to create a new firewall policy
or modify an existing policy if ONTAPI is blocked.
#### Create New Firewall HTTP Policy
@@ -148,15 +148,15 @@ Verify that the output is displayed as follows:
## FPolicy
The FPolicy framework enables the collection of audit events on the ONTAP side and their transfer to
-the agent(s) via the designated Data LIFs. Each LIF establishes its own connection with one or
+the agents via the designated Data LIFs. Each LIF establishes its own connection with one or
several agents and sends notifications as soon as the file transaction occurs. The FPolicy
connection is asynchronous and buffered; both ONTAP and Activity Monitor have techniques in place to
-make sure that connections are alive and working. The connection can be secured using TLS with
+ensure that connections are alive and working. The connection can be secured using TLS with
server or mutual authentication.
ONTAP cluster nodes connect to the agent on port 9999 by default. The port can be changed in the
-agent's settings. The agent adds this port to Windows Firewall exclusions automatically. Please
-ensure the port is not blocked by other firewalls between ONTAP and the agent.
+agent's settings. The agent adds this port to Windows Firewall exclusions automatically.
+ensure the port isn't blocked by other firewalls between ONTAP and the agent.
### Data-fpolicy-client Service
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md
index 7e8b126763..b1a528288d 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md
@@ -7,15 +7,15 @@ sidebar_position: 30
# Configure FPolicy
Activity Monitor relies on the NetApp FPolicy framework for monitoring of file access events on
-Storage Virtual Machines (SVM). FPolicy needs to be configured for each SVM.
+Storage Virtual Machines (SVM). You must configure FPolicy for each SVM.
There are two ways to configure FPolicy:
- Activity Monitor agent can facilitate the Automatic Configuration of FPolicy for the monitored SVM
- using the ONTAP API. This mode is simple, but does not allow you to exclude certain volumes or
+ using the ONTAP API. This mode is simple, but you can't exclude certain volumes or
shares of the SVM from being monitored. It also requires additional permissions to create and
modify FPolicy.
-- Another option is to Manually Configure FPolicy for each SVM. This mode allows you to fine tune
+- Another option is to Manually Configure FPolicy for each SVM. This mode lets you fine-tune
FPolicy by excluding certain volumes or shares from being monitored. It also reduces product
permissions.
@@ -80,8 +80,7 @@ locally on the Activity Monitor Console server.
### Create PEM File for Client Certificate
A certificate (Client Certificate) for the SVM needs to be copied to a PEM file. This is required
-for the TLS, mutual authentication option. Follow the steps to create the PEM file for the Client
-Certificate.
+for the TLS, mutual authentication option. To create the PEM file for the Client Certificate, complete the following steps.
**Step 1 –** On the SVM , use the following command to show the security certificate details:
@@ -97,7 +96,7 @@ security certificate show -vserver testserver -type server instance
**Step 2 –** Copy the security certificate details into a text file and copy the public key to a PEM
file. The following variables from security details will be needed to set mutual-authentication
-during Part 6 of manual configuration and prior to automatic configuration:
+during Part 6 of manual configuration and before automatic configuration:
- SVM
- Common Name
@@ -118,7 +117,7 @@ dedicated volume for each SVM as a staging buffer before events are sent to the
Persistent Store requires the following parameters:
-- Volume name – If the volume does not exist, it will be created automatically (recommended).
+- Volume name – If the volume doesn't exist, it will be created automatically (recommended).
- Initial volume size – Specifies the starting size of the volume.
- Autosize mode – Options include Off, Grow, or Grow/Shrink.
@@ -142,7 +141,7 @@ To check that the SVM has assigned local tiers, use the following command:
**vserver show -vserver [SVM_NAME] -fields aggr-list**
-The command shows currently local tiers. If no tiers are assigned, "-" is displayed.
+The command shows local tiers. If no tiers are assigned, "-" is displayed.
To assign local tiers to the SVM use the following command:
@@ -163,7 +162,7 @@ deletion by marking it as not mountable.
If you choose to create the volume manually, ensure the following:
-- The volume is not mounted and has no junction point.
+- The volume isn't mounted and has no junction point.
- The snapshot policy for the volume is set to none.
For additional and up-to-date recommendations on volumes for the Persistent Store, refer to the
@@ -172,8 +171,7 @@ NetApp documentation.
## Manually Configure FPolicy
This section describes how to manually configure FPolicy. Manual configuration of the FPolicy is
-recommended if the policy needs to be scoped to monitor select volumes or shares. It is necessary to
-create several FPolicy components and then enable the FPolicy. See the sections corresponding to
+recommended if you need to scope the policy to monitor select volumes or shares. Create several FPolicy components and then enable the FPolicy. See the sections corresponding to
each part of this list:
- Part 1: Install Server Certificate on the SVM (only if using TLS authentication)
@@ -187,7 +185,7 @@ each part of this list:
- Part 3: Create FPolicy Events
- - An FPolicy event defines which protocol(s) to monitor and which file access events to monitor.
+ - An FPolicy event defines which protocols to monitor and which file access events to monitor.
- Part 4: Create Persistent Store (only if Persistent Store is used. RECOMMENDED)
@@ -213,7 +211,7 @@ each part of this list:
- Part 8: Enable the FPolicy
- - Once the FPolicy is enabled, the Activity Monitor Agent can be configured to monitor the SVM.
+ - After the FPolicy is enabled, the Activity Monitor Agent can be configured to monitor the SVM.
- Part 9: Connect FPolicy Server / Agent to Cluster Node (optional)
@@ -222,7 +220,7 @@ each part of this list:
### Part 1: Install Server Certificate on the SVM
-If using the TLS authentication options, it is necessary to install the Server Certificate on the
+If using the TLS authentication options, install the Server Certificate on the
SVM.
Use the following command to install the Server Certificate:
@@ -323,10 +321,9 @@ Maximum Notification Retention Duration: 3m
External Engine Format: xml
```
-Relevant NetApp Documentation: To learn more about creating an external engine, please visit the
-NetApp website and read the
-[vserver fpolicy policy external-engine create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-external-engine-create.html)
-article.
+Relevant NetApp Documentation: For more information about creating an external engine, see the
+NetApp documentation on
+[vserver fpolicy policy external-engine create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-external-engine-create.html).
### Part 3: Create FPolicy Event
@@ -382,7 +379,7 @@ IMPORTANT:
- `read` – File read operations
- `first-read` – Limits notification to only first read operations for CIFS protocol. For
- ONTAP 9.2+, this filter can be used for both CIFS and NFS protocols.
+ ONTAP 9.2+, this filter applies to both CIFS and NFS protocols.
- `rename`– File rename operations
- `rename_dir`– Directory rename operations
@@ -414,7 +411,7 @@ IMPORTANT:
- `write` – File write operations
- `first-write` – Limits notification to only first write operations for CIFS protocol. For
- ONTAP 9.2+, this filter can be used for both CIFS and NFS protocols.
+ ONTAP 9.2+, this filter applies to both CIFS and NFS protocols.
- For failed/denied events, the list of supported file operations is limited to the following
values:
@@ -502,10 +499,9 @@ Ontap915::> fpolicy policy event show -vserver svm0 -event-name StealthAUDITScre
Send Failed File Operation Notifications: false
```
-Relevant NetApp Documentation: To learn more about creating an event, please visit the NetApp
-website and read the
-[vserver fpolicy policy event create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-event-create.html)
-article.
+Relevant NetApp Documentation: For more information about creating an event, see the NetApp
+documentation on
+[vserver fpolicy policy event create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-event-create.html).
### Part 4: Create Persistent Store
@@ -537,7 +533,7 @@ IMPORTANT:
- `volume` – The name of the volume used for event storage.
- - If the volume does not exist, it will be automatically created on an assigned local tier.
+ - If the volume doesn't exist, it will be automatically created on an assigned local tier.
This is recommended.
- `size` – The initial size of the volume. The format is `[KB|MB|GB]`.
@@ -681,10 +677,9 @@ User Name for Privileged Access: -
Persistent Store Name: -
```
-Relevant NetApp Documentation: To learn more about creating a policy, please visit the NetApp
-website and read the
-[vserver fpolicy policy create](https://docs.netapp.com/us-en/ontap-cli/vserver-fpolicy-policy-create.html)
-article.
+Relevant NetApp Documentation: For more information about creating a policy, see the NetApp
+documentation on
+[vserver fpolicy policy create](https://docs.netapp.com/us-en/ontap-cli/vserver-fpolicy-policy-create.html).
### Part 6: Create FPolicy Scope
@@ -695,10 +690,10 @@ variable [SVM_NAME] in the command with an asterisk (\*).
IMPORTANT:
- The SVM used must be the SVM hosting the CIFS or NFS shares to be monitored.
-- It is not necessary to specify both volumes and shares. One or the other is sufficient.
+- It isn't necessary to specify both volumes and shares. One or the other is sufficient.
- If you want to monitor everything, set the "`volumes-to-include`" value to "`*`".
-Use the following command to create the FPolicy scope by specifying volume(s):
+Use the following command to create the FPolicy scope by specifying volumes:
```
vserver fpolicy policy scope create -vserver [SVM_NAME] -policy-name StealthAUDIT -volumes-to-include [VOLUME_NAME],[VOLUME_NAME]
@@ -710,7 +705,7 @@ Example:
vserver fpolicy policy scope create -vserver testserver -policy-name StealthAUDIT -volumes-to-include samplevolume1,samplevolume2
```
-Use the following command to create the FPolicy scope by specifying share(s):
+Use the following command to create the FPolicy scope by specifying shares:
```
vserver fpolicy policy scope create -vserver [SVM_NAME] -policy-name StealthAUDIT -shares-to-include [SHARE_NAME],[SHARE_NAME]
@@ -745,15 +740,13 @@ File Extensions to Include: -
File Extensions to Exclude: -
```
-Relevant NetApp Documentation: To learn more about creating scope, please visit the NetApp website
-and read the
-[vserver fpolicy policy scope create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-scope-create.html)
-article.
+Relevant NetApp Documentation: For more information about creating scope, see the NetApp
+documentation on
+[vserver fpolicy policy scope create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-scope-create.html).
### Part 7: Set TLS Authentication
-If using the TLS authentication options, it is necessary to set authentication for the type of
-authentication.
+If using the TLS authentication options, configure the authentication type.
#### Set Server-Authentication
@@ -832,10 +825,9 @@ svm0 StealthAUDIT 10 on
DITEngine
```
-Relevant NetApp Documentation: To learn more about enabling a policy, please visit the NetApp
-website and read the
-[vserver fpolicy enable](https://docs.netapp.com/us-en/ontap-cli-9121//vserver-fpolicy-enable.html)
-article.
+Relevant NetApp Documentation: For more information about enabling a policy, see the NetApp
+documentation on
+[vserver fpolicy enable](https://docs.netapp.com/us-en/ontap-cli-9121//vserver-fpolicy-enable.html).
### Part 9: Connect FPolicy Server / Agent to Cluster Node
@@ -883,7 +875,7 @@ Starting ONTAP 9.15.1 and later versions, it is recommended to enable the Persis
that stores events on disk before they are sent to the Activity Monitor Agent. This reduces
client-side latency and increases resilience during network delays or bursts of activity. To enable
the Persistent Store, specify a volume name and size on the Persistent Store tab of the FPolicy page
-in the monitored host properties. The volume will be automatically created if it does not already
+in the monitored host properties. The volume will be automatically created if it doesn't already
exist. See the Persistent Store topic for additional information on the recommended volume size.
If using the TLS, mutual authentication option, you will need to create the PEM file for the Client
@@ -892,7 +884,7 @@ will also be necessary to set mutual authentication on the SVM.
### Set TLS Mutual-Authentication
-If using the TLS, mutual authentication options, it is necessary to set authentication.
+If using the TLS mutual authentication options, set the authentication.
Use the following command to set mutual-authentication:
@@ -932,6 +924,6 @@ These names can be customized in the monitored host's settings in the Activity M
useful in two scenarios:
- You want the names to match the company policies;
-- You want to configure FPolicy manually using your custom names, but also want to leverage the
+- You want to configure FPolicy manually using your custom names, but also want to use the
"Enable and Connect FPolicy" feature of the Activity Monitor, so that the product ensures that
FPolicy stays enabled and connected at all times.
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md
index 5a5929a7a5..0f34bcfb34 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md
@@ -6,7 +6,7 @@ sidebar_position: 90
# NetApp Data ONTAP Cluster-Mode Activity Auditing Configuration
-The Activity Monitor agent employed to monitor NetApp leverages NetApp ONTAP API, and the NetApp
+The Activity Monitor agent used to monitor NetApp uses the NetApp ONTAP (Data ONTAP) API and the NetApp
FPolicy framework to monitor file system events. This includes both NetApp 7-Mode and Cluster-Mode
configurations. For more information about FPolicy read the
[What are the two parts of the FPolicy solution ](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html)
@@ -16,40 +16,40 @@ Activity Monitor requires two communication channels for ONTAP monitoring:
1. Activity Monitor Agent connects to ONTAP on port 80 or 443 for access to ONTAP API (ONTAPI/ZAPI
or REST API).
-2. Data LIFs of the SVM connect to Activity Monitor Agent on port 9999 for FPolicy notifications.
+2. Data Logical Interfaces (LIFs) of the SVM connect to Activity Monitor Agent on port 9999 for FPolicy notifications.
The ONTAP API access is mandatory; without the API access the agent will not be able to receive and
translate events from FPolicy. Both classic ONTAPI/ZAPI and the new REST API are supported. The
-agent uses the API to retrieve information about the storage virtual machines (SVM): CIFS settings,
+agent uses the API to retrieve information about the storage virtual machines (SVM): Common Internet File Sharing (CIFS) settings,
list of volumes, list of LIFs. Depending on the configuration, the agent can also retrieve the state
of FPolicy to ensure it is enabled; configure FPolicy and register or unregister itself.
The FPolicy framework enables the collection of audit events on the ONTAP side and their transfer to
-the agent(s) via the designated Data LIFs. Each LIF establishes its own connection with one or
+the agents via the designated Data LIFs. Each LIF establishes its own connection with one or
several agents and sends notifications as soon as the file transaction occurs. The FPolicy
connection is asynchronous and buffered; both ONTAP and Activity Monitor have techniques in place to
-make sure that connections are alive and working. The connection can be secured using TLS with
+ensure that connections are alive and working. The connection can be secured using TLS with
server or mutual authentication.
FPolicy may have a significant impact on file system throughput, and it is always a best practice to
monitor performance when enabling FPolicy.
:::info
-Create a tailored FPolicy which only collects the desired activity from the
+Create a tailored FPolicy that collects only the activity you need from your
environment to limit the scope and impact.
:::
For scale-out and fault tolerance purposes, the product supports a range of deployment options. A
-single agent can receive events from multiple SVMs. Or events from a single SVM can be distributed
-among multiple agents. Or a set of SVMs can distribute events among a set of agents. The choice
-depends on the fault tolerance requirements and the expected event flow. As a rule of thumb, the
-_average_ load on a single agent should not exceed 5000 events per second.
+single agent can receive events from multiple SVMs. Events from a single SVM can be distributed
+among multiple agents. A set of SVMs can distribute events among a set of agents. The choice
+depends on the fault tolerance requirements and the expected event flow. In general,
+the _average_ load on a single agent shouldn't exceed 5000 events per second.
Starting with ONTAP 9.15.1, the FPolicy Persistent Store provides resilience and predictable latency
during scenarios such as network delays or bursts of activity. The feature uses a dedicated volume
for each SVM as a staging buffer before events are sent to the agent. FPolicy will automatically
-create a volume if one does not already exist.
+create a volume if one doesn't already exist.
:::info
Enable the Persistent Store feature and allow it to create a volume
@@ -59,7 +59,7 @@ automatically.
## Configuration Checklist
-Complete the following checklist prior to configuring the activity monitoring of NetApp Data ONTAP
+Complete the following checklist before configuring the activity monitoring of NetApp Data ONTAP
Cluster-Mode devices. Instructions for each item of the checklist are detailed within the following
sections.
@@ -67,10 +67,10 @@ sections.
- Gather the following information:
- - Names of the SVM(s) to be monitored
+ - Names of the SVMs to be monitored
- FPolicy is configured for each SVM separately
- - This should be the SVM(s) hosting the CIFS or NFS shares(s) to be monitored
+ - This should be the SVMs hosting the CIFS or NFS sharess to be monitored
- Credentials to access ONTAP to provision a role and account.
- Desired functionality level:
@@ -91,7 +91,7 @@ sections.
- Limiting the FPolicy to specific file operations is an effective way to limit the
performance impact of FPolicy
- - IP Address of the server(s) where the Activity Monitor Agent is deployed
+ - IP Address of the servers where the Activity Monitor Agent is deployed
- API enabled in ONTAP: the classic ONTAPI/ZAPI or the new REST API
- The product supports the REST API for ONTAP 9.13.1 and above.
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/provisionactivity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/provisionactivity.md
index 582369a083..35eece22f4 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/provisionactivity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/provisionactivity.md
@@ -26,7 +26,7 @@ The permissions needed depends on the functionality level:
- Least Privileged: ONLY Collect Events – This is the minimal functionality level. A user manually
configures FPolicy and ensures that it stays enabled and connected. The product only collects
- events. This functionality level is not recommended as it requires an additional solution that
+ events. This functionality level isn't recommended as it requires an additional solution that
tracks the state of FPolicy and fixes the problem should ONTAP disconnect or should the policy
become disabled.
- **_RECOMMENDED:_** Less Privileged: Enable/Connect Policy & Collect Events – With this level, the
@@ -103,7 +103,7 @@ security login rest-role create -role enterpriseauditorrest -api "/api/svm/svms"
```
:::note
-If the FPolicy account is configured with these permissions, it is necessary to manually
+If the FPolicy account is configured with these permissions, manually
configure the FPolicy. See the [Configure FPolicy](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md) topic for additional
information.
:::
@@ -127,7 +127,7 @@ permissions to collect events:
:::tip
Remember, this permission permits the Activity Monitor to enable the FPolicy. If the “Enable
- and connect FPolicy” option is employed but the permission is not provided, the agent will
+ and connect FPolicy” option is employed but the permission isn't provided, the agent will
encounter “Failed to enable policy” errors, but it will still be able to connect to the FPolicy.
Since this permission model requires a manual configuration of the FPolicy, then the need to
manually enable the FPolicy will be met.
@@ -192,7 +192,7 @@ security login rest-role create -role enterpriseauditorrest -api "/api/protocols
```
:::note
-If the FPolicy account is configured with these permissions, it is necessary to manually
+If the FPolicy account is configured with these permissions, manually
configure the FPolicy. See the [Configure FPolicy](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md) topic for additional
information.
:::
@@ -340,7 +340,7 @@ article.
## Part 2: Create Security Login
-Once the access control role has been created, apply it to a domain account. Ensure the following
+After the access control role has been created, apply it to a domain account. Ensure the following
requirements are met:
- The SVM used in the following command must be the same SVM used when creating the access control
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/configurefpolicy.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/configurefpolicy.md
index a23d640ca7..0f54d36eb7 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/configurefpolicy.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/configurefpolicy.md
@@ -27,7 +27,7 @@ Manually Configure FPolicy (Recommended Option) – A tailored FPolicy
## Manually Configure FPolicy (Recommended Option)
This section describes how to manually configure FPolicy. Manual configuration of the FPolicy is
-recommended so that the policy can be scoped. It is necessary to create six FPolicy components and
+recommended so that the policy can be scoped. Create six FPolicy components and
then enable the FPolicy. See the sections corresponding to each part of this list:
- Part 1: Create FPolicy
@@ -43,10 +43,9 @@ vFiler. This is because FPolicy operates on the affected vFiler. Therefore, when
commands on a vFiler, the commands must be run from a vFiler context (e.g. via the vFiler run
command).
-Relevant NetApp Documentation: To learn more about configuring file policies, please visit the
-NetApp website and read
+Relevant NetApp Documentation: For detailed information on configuring file policies, see
[na_fpolicy – configure file policies](https://library.netapp.com/ecmdocs/ECMP1196890/html/man1/na_fpolicy.1.html)
-article.
+in the NetApp documentation.
### Part 1: Create FPolicy
@@ -65,8 +64,8 @@ fpolicy create StealthAUDIT screen
### Part 2: Set FPolicy Required to Off
-If the `FPolicy Required` value is set to on, user requests are denied if an FPolicy server is not
-available to implement the policy. If it is set to off, user requests are allowed when it is not
+If the `FPolicy Required` value is set to on, user requests are denied if an FPolicy server isn't
+available to implement the policy. If it is set to off, user requests are allowed when it isn't
possible to apply the policy to the file because no FPolicy server is available.
IMPORTANT:
@@ -81,7 +80,7 @@ fpolicy options StealthAUDIT required off
### Part 3: Set FPolicy to Collect Permission Changes
-The cifs_setattr value must be set to on in order for CIFS requests to change file security
+The cifs_setattr value must be set to on in order for Common Internet File Sharing (CIFS) requests to change file security
descriptors to be screened by the policy.
IMPORTANT:
@@ -96,7 +95,7 @@ fpolicy options StealthAUDIT cifs_setattr on
### Part 4: Set FPolicy to Monitor Alternate Data Streams
-The monitor_ads value must be set to on in order for CIFS requests for alternate data streams (ADS)
+The monitor_ads value must be set to on in order for CIFS (Common Internet File Sharing) requests for alternate data streams (ADS)
to be monitored by the policy.
IMPORTANT:
@@ -111,7 +110,7 @@ fpolicy options StealthAUDIT monitor_ads on
### Part 5: Set FPolicy to Monitor Disconnected Sessions
-The cifs_disconnect_check value must be set to on in order for CIFS requests associated with
+The cifs_disconnect_check value must be set to on in order for CIFS (Common Internet File Sharing) requests associated with
disconnected sessions to be monitored by the policy.
IMPORTANT:
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/customizefpolicy.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/customizefpolicy.md
index 77843dad69..4d90aecbe9 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/customizefpolicy.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/customizefpolicy.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Customize FPolicy Policy Name
There may be situations when FPolicy needs to be named something other than StealthAUDIT. In those
-cases it is necessary to manually add a parameter to the Activity Monitor agent’s `sbtfilemon.ini`
+cases, manually add a parameter to the Activity Monitor agent’s `sbtfilemon.ini`
file. After the monitoring agent has been deployed, follow the steps.
**Step 1 –** Open to the `sbtfilemon.ini` file on the agent server in a text editor:
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/ontap7-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/ontap7-activity.md
index 2de2bf7c59..9921b6af18 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/ontap7-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/ontap7-activity.md
@@ -6,18 +6,17 @@ sidebar_position: 80
# NetApp Data ONTAP 7-Mode Activity Auditing Configuration
-The Activity Monitor agent employed to monitor NetApp leverages 128-bit encrypted Remote Procedure
+The Activity Monitor agent uses 128-bit encrypted Remote Procedure
Calls (RPC), NetApp ONTAP-API, and NetApp FPolicy to monitor file system events. This includes both
-NetApp 7-Mode and Cluster-Mode configurations. To learn more about FPolicy please visit the NetApp
+NetApp 7-Mode and Cluster-Mode configurations. To understand FPolicy, visit the NetApp
website and read the
-[What FPolicy is](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html)
-article.
+[NetApp FPolicy documentation](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html).
If the activity agent is stopped, a notification will be sent to the NetApp device to disconnect and
disable the associated FPolicy policy, but it will not be removed.
If the network connection is lost between the activity agent and the NetApp device, the NetApp
-device is configured with a default timeout to wait for a response. If a response is not received
+device is configured with a default timeout to wait for a response. If a response isn't received
from the Activity Agent within the timeout, then the NetApp device will disconnect and disable the
FPolicy policy. The Activity Agent will check every minute by default to see if the FPolicy policy
has been disabled and will enable it (if the auto-enable functionality is enabled for the agent).
@@ -29,7 +28,7 @@ No activity log file will be created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of NetApp Data ONTAP
+Complete the following checklist before configuring activity monitoring of NetApp Data ONTAP
7-Mode devices. Instructions for each item of the checklist are detailed within the following
topics.
@@ -37,7 +36,7 @@ topics.
- Gather the following information:
- Names of the vFiler™(s) to be monitored
- - DNS name of the CIFS shares(s) to be monitored
+ - DNS name of the Common Internet File Sharing (CIFS) sharess to be monitored
**Checklist Item 2: [Provision FPolicy Account](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md)**
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md
index 690a741a7c..1d3459f9a0 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md
@@ -16,8 +16,7 @@ Provisioning this account is a three part process:
- Part 2: Create a Group & Assign Role
- Part 3: Add User to Group
-Relevant NetApp Documentation: To learn more about node access controls, please visit the NetApp
-website and read the
+Relevant NetApp Documentation: For information about node access controls, see the
[na_useradmin – Administers node access controls](https://library.netapp.com/ecmdocs/ECMP1511537/html/man1/na_useradmin.1.html)
article.
@@ -74,7 +73,7 @@ After the role is created, complete Part 2: Create a Group & Assign Role.
## Part 2: Create a Group & Assign Role
-Once the role has been created, it must be attached to a group. The following command needs to be
+After the role is created, it must be attached to a group. The following command needs to be
run to create a group and assign the role to it.
```
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/panzura-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/panzura-activity.md
index 08f76d373e..40e344936b 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/panzura-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/panzura-activity.md
@@ -26,8 +26,8 @@ Audit events are distributed between two agents. Audit settings are overridden o
The monitoring process relies on the Third Party Vendor Support auditing feature of the Panzura
-CloudFS platform, which uses the AMQP protocol for event delivery. Unlike typical uses of the AMQP
-protocol that require messaging middleware, the Panzura master and subordinate nodes connect
+CloudFS platform, which uses the Advanced Message Queuing Protocol (AMQP) for event delivery. Unlike typical uses of AMQP
+that require messaging middleware, the Panzura master and subordinate nodes connect
directly to the Netwrix Activity Monitor Agent, eliminating the need for middleware.
Netwrix Activity Monitor uses Panzura API to register itself as a consumer of auditing events. It
@@ -49,8 +49,8 @@ To prepare Panzura CloudFS for monitoring, auditing must be enabled.
Auditing in CloudFS can be enabled either automatically or manually.
:::info
-Using the automatic option using the CloudFS API streamlines the configuration
-process and ensures that auditing remains enabled and accurate.
+The automatic option streamlines the configuration process and ensures that
+auditing remains enabled and accurate.
:::
@@ -67,13 +67,11 @@ The product will also ensure the settings are correct with periodic checks.
## Manual Configuration
-Follow these steps to enable auditing.
-
**Step 1 –** Navigate to **Audit Settings** > **Third Party Support**.
**Step 2 –** Enable the **Generate Third Party Logs** option.
-**Step 3 –** Enable the **Push to Subordinate(s)** option.
+**Step 3 –** Enable the **Push to Subordinates** option.
**Step 4 –** Enter **other** as the Vendor Name.
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/powerstore-aac/auditing.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/powerstore-aac/auditing.md
index e9daa2ec32..7d7285b4e8 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/powerstore-aac/auditing.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/powerstore-aac/auditing.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Enable Auditing for Dell PowerStore
-Follow the steps to enable auditing on Dell PowerStore.
+To enable auditing on Dell PowerStore:
- Create an Event Publishing Pool
- Create an Event Publisher
@@ -18,8 +18,6 @@ white paper for additional information.
## Create an Event Publishing Pool
-Follow the steps tTo create a new event publishing pool.:
-
**Step 1 –** Select **Storage** > **NAS Servers** > **NAS Settings** > **Publishing Pools**.
**Step 2 –** Click **Create** and specify the name of the pool.
@@ -64,8 +62,6 @@ Follow the steps tTo create a new event publishing pool.:
## Create an Event Publisher
-Follow the steps tTo create a an event publisher.:
-
**Step 1 –** Select **Storage** > **NAS Servers** > **NAS Settings** > **Events Publishers**.
@@ -92,8 +88,6 @@ The events publisher is created.
## Enable Event Publishing for the NAS Server
-Follow the steps tTo enable or disable event publishing for the NAS Server.:
-
**Step 1 –** Select **Storage** > **NAS Servers**.
@@ -111,8 +105,7 @@ Dell PowerStore is enabled for auditing.
## Enable or Disable Event Publishing for File System
-Follow the steps toYou can enable or disable the feature for each file system individually. using
-the following:
+You can enable or disable event publishing for each file system individually using the following:
**Step 1 –** Select **Storage** > **File Systems** > **[FILE SYSTEM]** > **Security & Events** >
**Events Publishing**.
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md
index daa9c5094f..2ee257609e 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE (Common Event Enabler) software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,12 +20,10 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
+1. Obtain the latest CEE install package from Dell and any additional license required for
+this component. It's recommended to use the most current version.
-**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
-this component. It is recommended to use the most current version.
-
-**Step 2 –** Follow the instructions in the Dell
+2. Follow the instructions in the Dell
[Using the Common Event Enabler on Windows Platforms](https://www.dell.com/support/home/en-us/product-support/product/common-event-enabler/docs)
guide to install and configure the CEE. The installation will add two services to the machine:
@@ -41,8 +39,7 @@ asynchronous bulk delivery (VCAPS) feature.
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
-manually set the Dell CEE registry key to forward events.
+one where the Activity Monitor activity agent is deployed. In those cases, manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -52,12 +49,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/powerstore-aac/powerstore-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/powerstore-aac/powerstore-activity.md
index ae3ae703ba..a251d95702 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/powerstore-aac/powerstore-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/powerstore-aac/powerstore-activity.md
@@ -20,12 +20,12 @@ activity log file is created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Dell PowerStore
+Complete the following checklist before configuring activity monitoring of Dell PowerStore
devices. Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment
+- Before beginning the deployment
- See the
[Dell PowerStore: File Capabilities](https://www.delltechnologies.com/asset/en-us/products/storage/industry-market/h18155-dell-powerstore-file-capabilities.pdf)
@@ -36,7 +36,7 @@ devices. Instructions for each item of the checklist are detailed within the fol
**Checklist Item 2: [Install Dell CEE](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md)**
-- Dell CEE should be installed on the Windows proxy server(s) where the Activity Monitor activity
+- Dell CEE should be installed on the Windows proxy servers where the Activity Monitor activity
agent will be deployed
:::info
@@ -47,8 +47,7 @@ devices. Instructions for each item of the checklist are detailed within the fol
- Important:
- Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE is
- installed
+ Before installing Dell CEE, open MS-RPC ports between the Dell device and the Windows proxy servers
**Checklist Item 3: Dell PowerStore Device Configuration**
@@ -68,8 +67,8 @@ devices. Instructions for each item of the checklist are detailed within the fol
Checklist Item 5: Configure Dell CEE to Forward Events to the Activity Agent
:::note
-When Dell CEE is installed on Windows proxy server(s) where the Activity Monitor activity
-agent will be deployed, the following steps are not needed.
+When Dell CEE is installed on Windows proxy servers where the Activity Monitor activity
+agent will be deployed, the following steps aren't needed.
:::
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md
index e99c8b54a8..a59b64c9c7 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md
@@ -32,26 +32,28 @@ advanced filtering of Microsoft Office activity also requires the JSON format.
The JSON format for audit events was introduced in Qumulo Core 6.0.1. The new format can be enabled
via an SSH session to the Qumulo cluster.
-Follow the steps to verify that audit event format and change the format, if needed.
-
**Step 1 –** Connect to the Qumulo cluster with SSH.
**Step 2 –** Execute the following command to log in:
```bash
qq --host login -u
+```
The command will ask for the password.
-__Step 3 –__ Execute the following command to check current format:
+**Step 3 –** Execute the following command to check current format:
-**qq audit_get_syslog_config**
-
-The format will be shown in the __format__ field. The old format is __csv__; the new format is __json__.
+```bash
+qq audit_get_syslog_config
+```
-__Step 4 –__ Execute the following command to change the format, if needed:
+The format will be shown in the `format` field. The old format is `csv`; the new format is `json`.
-**qq audit_set_syslog_config --json**
+**Step 4 –** Execute the following command to change the format, if needed:
-The change willshould be reflected in the __format__ field.
+```bash
+qq audit_set_syslog_config --json
```
+
+The change will be reflected in the `format` field.
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md
index f3fef0054b..84e807a64f 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE (Common Event Enabler) software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,7 +20,7 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
+To install the Dell CEE, complete these steps:
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -38,13 +38,13 @@ asynchronous bulk delivery (VCAPS) feature.
:::
-After Dell CEE installation is complete, it is necessary to complete the
+After Dell CEE installation is complete, you must complete the
[Unity Initial Setup with Unisphere](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md).
## Configure Dell Registry Key Settings
There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
+one where the Activity Monitor activity agent is deployed. In those cases, you must
manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -55,12 +55,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md
index 99180a7932..fc20d1ca1c 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md
@@ -6,12 +6,9 @@ sidebar_position: 20
# Unity Initial Setup with Unisphere
-Follow the steps to configure the initial setup for a Unity device with Unisphere.
-
**Step 1 –** Edit the NAS Server > Protection and Events > Events Publishing > Select Pool settings:
-- Add CEPA server – This is the server where CEE is installed. It is recommended that this is also
- the server were the Activity Monitor activity agent is deployed.
+- Add CEPA server – This is the server where CEE is installed. Deploy the Activity Monitor activity agent on this server as well.
- Enable the following events for Post Events.
Required Unity events needed for CIFS Activity:
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/unity-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/unity-activity.md
index 71e290f9f0..51c47b376f 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/unity-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/unity-activity.md
@@ -20,14 +20,14 @@ activity log file is created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Dell Unity devices.
+Complete the following checklist before configuring activity monitoring of Dell Unity devices.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - Data Mover or Virtual Data Mover hosting the share(s) to be monitored
+ - Data Mover or Virtual Data Mover hosting the shares to be monitored
- Account with access to the CLI
- Download the Dell CEE from:
@@ -35,7 +35,7 @@ Instructions for each item of the checklist are detailed within the following to
**Checklist Item 2: [Install Dell CEE](/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md)**
-- Dell CEE should be installed on the Windows proxy server(s) where the Activity Monitor activity
+- Dell CEE should be installed on the Windows proxy servers where the Activity Monitor activity
agent will be deployed
:::info
@@ -46,9 +46,9 @@ Instructions for each item of the checklist are detailed within the following to
- Important:
- - Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE
+ - Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE
is installed
- - Dell CEE 8.4.2 through Dell CEE 8.6.1 are not supported for use with the VCAPS feature
+ - Dell CEE 8.4.2 through Dell CEE 8.6.1 aren't supported for use with the VCAPS feature
- Dell CEE requires .NET Framework 3.5 to be installed on the Windows proxy server
**Checklist Item 3: Dell Unity Device Configuration**
@@ -66,11 +66,11 @@ Instructions for each item of the checklist are detailed within the following to
- Automatically sets the Dell registry key settings
-Checklist Item 5: Configure Dell CEE to Forward Events to the Activity Agent
+**Checklist Item 5: Configure Dell CEE to Forward Events to the Activity Agent**
:::note
-When Dell CEE is installed on Windows proxy server(s) where the Activity Monitor activity
-agent will be deployed, the following steps are not needed.
+When Dell CEE is installed on Windows proxy servers where the Activity Monitor activity
+agent will be deployed, the following steps aren't needed.
:::
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md
index 07dbcc06bf..9e3e006ab9 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
+After the Activity Monitor agent is configured to monitor the Dell device, the automated
configuration must be validated to ensure events are being monitored.
## Validate CEE Registry Key Settings
@@ -21,10 +21,10 @@ topic for information on manually setting the registry key.
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
+a different server than the Windows proxy servers where the Activity Monitor activity agent is
deployed.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -90,7 +90,7 @@ Dell CEE Services are Running topic for additional information.
## Validate Dell CEE Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -120,19 +120,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/sharepoint-online-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/sharepoint-online-activity.md
index 655a7680c6..a3595d2a62 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/sharepoint-online-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/sharepoint-online-activity.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# SharePoint Online Activity Auditing Configuration
-In order to collect logs and monitor SharePoint Online activity using the Netwrix Activity Monitor,
+to collect logs and monitor SharePoint Online activity using the Netwrix Activity Monitor,
it needs to be registered with Microsoft® Entra ID® (formerly Azure AD).
:::note
@@ -25,14 +25,14 @@ See the Enable Auditing for SharePoint Online topic for additional information.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+After registering the application, you need the following settings from your tenant:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
+ It isn't possible to retrieve the value after saving the new key. It must be
copied first.
:::
@@ -54,8 +54,6 @@ The following settings are needed from your tenant once you have registered the
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -87,8 +85,6 @@ application. Now that the application has been registered, permissions need to b
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -135,8 +131,6 @@ be collected.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -173,8 +167,6 @@ application’s Client Secret Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -193,9 +185,6 @@ application’s Client Secret Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
-value when saving the new key.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -204,7 +193,7 @@ documentation for additional information.
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
+It isn't possible to retrieve the value after saving the new key. It must be copied
first.
:::
@@ -231,7 +220,7 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
+If this page is left before the key is copied, then the key isn't retrievable, and
this process will have to be repeated.
:::
@@ -245,15 +234,12 @@ This is needed for adding a SharePoint Online host in the Activity Monitor.
## Enable Auditing for SharePoint Online
-Follow the steps to enable auditing for SharePoint Online so the Activity Monitor can receive
-events.
-
**Step 1 –** In the Microsoft Purview compliance portal at
[https://compliance.microsoft.com](https://compliance.microsoft.com/), go to **Solutions** >
**Audit**. Or, to go directly to the Audit page at
[https://compliance.microsoft.com/auditlogsearch](https://compliance.microsoft.com/auditlogsearch).
-**Step 2 –** If auditing is not turned on for your organization, a banner is displayed prompting you
+**Step 2 –** If auditing isn't turned on for your organization, a banner is displayed prompting you
start recording user and admin activity.
**Step 3 –** Select the **Start recording** user and **admin activity** banner.
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/sqlserver-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/sqlserver-activity.md
index f735298b95..5777b69bf9 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/sqlserver-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/sqlserver-activity.md
@@ -70,7 +70,7 @@ declare @s varchar(max)='';select @s=@s+(case when @s<>'' then char(13)+char(10)
## Logon Trigger (Optional)
The logon trigger is required to obtain IP Addresses of client connections. Run the following script
-in order to allow the Activity Monitor to report client IP Addresses.
+to allow the Activity Monitor to report client IP Addresses.
```
CREATE TRIGGER SBAudit_LOGON_Trigger ON ALL SERVER FOR LOGON AS BEGIN declare @str varchar(max)=cast(EVENTDATA() as varchar(max));raiserror(@str,1,1);END
diff --git a/docs/activitymonitor/8.0/requirements/activityagent/windowsfs-activity.md b/docs/activitymonitor/8.0/requirements/activityagent/windowsfs-activity.md
index bb5083da2c..09cf78b2ff 100644
--- a/docs/activitymonitor/8.0/requirements/activityagent/windowsfs-activity.md
+++ b/docs/activitymonitor/8.0/requirements/activityagent/windowsfs-activity.md
@@ -7,12 +7,12 @@ sidebar_position: 80
# Windows File Server Activity Auditing Configuration
In order for the Netwrix Activity Monitor to monitor Windows file server activity, an Activity Agent
-must be deployed to the server. It cannot be deployed to a proxy server. However, additional
+must be deployed to the server. It can't be deployed to a proxy server. However, additional
considerations are needed when targeting a Windows File System Clusters or DFS Namespaces.
## Windows File System Clusters
-In order to monitor a Windows File System Cluster, an Activity Agent needs to be deployed on all
+to monitor a Windows File System Cluster, an Activity Agent needs to be deployed on all
nodes that comprise the Windows File System Cluster. The credential used to deploy the Activity
Agent must have the following permissions on the server:
@@ -22,21 +22,21 @@ Agent must have the following permissions on the server:
It is also necessary to enable the Remote Registry Service on the Activity Agent server.
For integration between the Activity Monitor and Access Analyzer, the credential used by Access
-Analyzer to read the activity log files must have also have this permission.
+Analyzer to read the activity log files must also have this permission.
-After the agent has been deployed, it is necessary to modify the HOST parameter in the
+After the agent has been deployed, modify the HOST parameter in the
`SBTFilemon.ini` file to be the name of the cluster. For integration with Netwrix Access Analyzer
(formerly Enterprise Auditor), this must be an exact match to the name of the cluster in the Master
Host Table.
## DFS Namespaces
-In order to monitor activity on DFS Namespaces, an Activity Agent needs to be deployed on all DFS
+to monitor activity on DFS Namespaces, an Activity Agent needs to be deployed on all DFS
servers.
:::note
-The FileSystem > 0.Collection > 0-FSDFS System Scans Job in Netwrix Access Analyzer
-(formerly Enterprise Auditor) can be used to identify all DFS servers.
+Use the FileSystem > 0.Collection > 0-FSDFS System Scans Job in Netwrix Access Analyzer
+(formerly Enterprise Auditor) to identify all DFS servers.
:::
@@ -48,4 +48,4 @@ The credential used to deploy the Activity Agent must have the following permiss
It is also necessary to enable the Remote Registry Service on the Activity Agent server.
For integration between the Activity Monitor and Access Analyzer, the credential used by Access
-Analyzer to read the activity log files must have also have this permission.
+Analyzer to read the activity log files must also have this permission.
diff --git a/docs/activitymonitor/8.0/requirements/adagent/activity/activity.md b/docs/activitymonitor/8.0/requirements/adagent/activity/activity.md
index caa21476ce..ba093c7231 100644
--- a/docs/activitymonitor/8.0/requirements/adagent/activity/activity.md
+++ b/docs/activitymonitor/8.0/requirements/adagent/activity/activity.md
@@ -30,8 +30,7 @@ In this method, you will be deploying two agents:
- Next, deploy the AD Agent to all domain controllers in the target domain.
-Follow the steps to setup integration between Activity Monitor and Access Analyzer through an API
-server.
+## Set up integration between Activity Monitor and Access Analyzer through an API server
**Step 1 –** Deploy the Activity Agent to the API server.
@@ -41,8 +40,6 @@ The next step is to configure the agent deployed to the API server.
## Configure API Server Agent
-Follow the steps to configure the agent deployed to the API server.
-
**Step 1 –** On the Agents tab of the Activity Monitor Console, select the agent deployed to the
API server.
@@ -63,7 +60,7 @@ API server.
- Click **Copy** and save the Client Secret value to a text file.
:::warning
- It is not possible to retrieve the value after closing the Add or edit
+ It isn't possible to retrieve the value after closing the Add or edit
API client window. It must be copied first.
:::
@@ -73,9 +70,9 @@ API server.
if desired.
- Click **OK** to save the configuration and close the Add or edit API client window.
-- If the Activity Monitor Console server is not the API Server, then click **Use this console** to
+- If the Activity Monitor Console server isn't the API Server, then click **Use this console** to
grant the Activity Monitor the ability to manage the API server.
-- The IPv4 or IPv6 allowlist allows you to limit access to the API server data to specific hosts.
+- Use the IPv4 or IPv6 allowlist to limit access to the API server data to specific hosts.
**Step 4 –** Click **OK** to save the configuration and close the Agent properties window.
@@ -83,8 +80,6 @@ The next step is to configure the agents deployed to the domain controllers.
## Configure Domain Controller Agent
-Follow the steps to configure the agent deployed to the domain controller.
-
**Step 1 –** On the Agents tab of the Activity Monitor Console, select an agent deployed to domain
controller.
@@ -94,9 +89,9 @@ controller.
- Select the **Enable Archiving for this agent** checkbox.
- Select the **Archive log files on a UNC path** option. Click the **...** button and navigate to
- the desired network share on the API server.
+ the network you want share on the API server.
- The **User name** and **User password** fields only need to be filled in if the account used to
- install the agent does not have access to this share.
+ install the agent doesn't have access to this share.
:::tip
Remember, The account used to install the agent on a domain controller is a Domain
@@ -110,7 +105,7 @@ controller.
**Step 5 –** Repeat Steps 1-4 for each agent deployed to domain controller.
-These agent are configured to save the Archive logs to the selected share.
+These agents are configured to save the Archive logs to the selected share.
## Configure Monitored Domain Output
@@ -119,12 +114,12 @@ Enterprise Auditor).
**Step 1 –** Select the **Monitored Domains** tab.
-**Step 2 –** Select the desired domain and click **Add Output**. The Add New Ouptut window opens.
+**Step 2 –** Select the domain you want and click **Add Output**. The Add New Ouptut window opens.
**Step 3 –** Configure the following:
-- Configure the desired number of days for the **Period to keep Log files**. This is the number of
- days the log files are kept on the API server configured in the sections above. This needs to be
+- Configure the number of days you want for the **Period to keep Log files**. This is the number of
+ days the log files are kept on the API server after configuration. This needs to be
set to a greater value than the days between Access Analyzer scans.
- For example, if Access Analyzer runs the **AD_ActivityCollection** Job once a week (every 7
@@ -142,8 +137,6 @@ Access Analyzer now has access to the agent log files for this domain.
## Configure Connection Profile
-Follow the steps to configure the Connection Profile in Access Analyzer.
-
:::tip
Remember, the Client ID and Client Secret were generated by the API server and copied to a text
file. If the secret expired before the Connection Profile is configured, it will need to be
@@ -172,7 +165,7 @@ name.
Group. Select the **Settings > Connection** node.
**Step 7 –** Select the **Select one of the following user defined profiles** option. Expand the
-drop-down menu and select the Connection Profile with this credential.
+dropdown menu and select the Connection Profile with this credential.
**Step 8 –** Click **Save** and then **OK** to confirm the changes to the job group settings.
@@ -180,8 +173,7 @@ The Connection Profile will now be used for AD Activity collection.
## Configure the AD_ActivityCollection Job
-The Access Analyzer requires additional configurations in order to collect domain activity data.
-Follow the steps to configure the **AD_ActivityCollection** Job.
+The Access Analyzer requires additional configurations to collect domain activity data.
:::note
Ensure that the **.Active Directory Inventory** Job Group has been successfully run
@@ -252,20 +244,19 @@ logs.
### (Optional) Configure Import of AD Activity into Netwrix Access Information Center
AD Activity data can be imported into Netwrix Access Information Center by the
-**AD_ActivityCollection** Job. However, this is disabled by default. Follow the steps to enable the
-importing of AD activity data into the Access Information Center.
+**AD_ActivityCollection** Job. However, this is disabled by default.
**Step 1 –** Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **0.Collection** >
**AD_ActivityCollection** Job.
**Step 2 –** On the job's Overview page, enable the import of AD Events.
-- Click on the **Enable to import AD events into the AIC** parameter.
+- Click the **Enable to import AD events into the AIC** parameter.
- On the Parameter Configuration window, select the **Enabled** checkbox and click **Save**.
**Step 3 –** On the job's Overview page, enable the import of authentication Events.
-- Click on the **Enable to import authentication events into the AIC** parameter.
+- Click the **Enable to import authentication events into the AIC** parameter.
- On the Parameter Configuration window, select the **Enabled** checkbox and click **Save**.
**Step 4 –** Optionally, modify the **List of attributes to track for Object Modified changes** and
diff --git a/docs/activitymonitor/8.0/requirements/adagent/activity/filearchive.md b/docs/activitymonitor/8.0/requirements/adagent/activity/filearchive.md
index d77004d36c..a74136d379 100644
--- a/docs/activitymonitor/8.0/requirements/adagent/activity/filearchive.md
+++ b/docs/activitymonitor/8.0/requirements/adagent/activity/filearchive.md
@@ -16,8 +16,6 @@ Deploy the AD Agent to each domain controller in the target domain.
## Configure Domain Controller Agent
-Follow the steps to configure the agent deployed to the domain controller.
-
:::note
These steps assume the network share where the activity log files will be archived already
exists.
@@ -35,7 +33,7 @@ controller.
- Select the **Archive log files on a UNC path** option. Click the ... button and navigate to the
desired network share.
- The **User name** and **User password** fields only need to be filled in if the account used to
- install the agent does not have access to this share.
+ install the agent doesn't have access to this share.
:::tip
Remember, The account used to install the agent on a domain controller is a Domain
@@ -52,22 +50,18 @@ controller.
**Step 5 –** Repeat Steps 1-4 for each agent deployed to domain controller pointing to the same
network share in Step 3 for each agent.
-These agent are configured to save the Archive logs to the selected share.
+These agents are configured to save the Archive logs to the selected share.
## Configure Monitored Domain Output
-Follow the steps configure the monitored domain output for Netwrix Access Analyzer (formerly
-Enterprise Auditor).
-
**Step 1 –** Select the **Monitored Domains** tab.
-**Step 2 –** Select the desired domain and click **Add Output**. The Add New Ouptut window opens.
+**Step 2 –** Select the domain and click **Add Output**. The Add New Output window opens.
**Step 3 –** Configure the following:
-- Configure the desired number of days for the **Period to keep Log files**. This is the number of
- days the log files are kept on the API server configured in the sections above. This needs to be
- set to a greater value than the days between Access Analyzer scans.
+- For **Period to keep Log files**, enter the number of days to keep the log files on the API server
+ after configuration. This value must be greater than the days between Access Analyzer scans.
- For example, if Access Analyzer runs the **AD_ActivityCollection** Job once a week (every 7
days), then the Activity Monitor output should be configured to retain at least 10 days of log
@@ -84,8 +78,6 @@ Access Analyzer now has access to the agent log files for this domain.
## Configure Connection Profile
-Follow the steps to configure the Connection Profile in Access Analyzer.
-
**Step 1 –** On the Settings > Connection node of the Access Analyzer Console, select the Connection
Profile for the Active Directory solution. If you haven't yet created a Connection Profile or desire
a specific one for AD Activity, create a new one and provide a unique descriptive name.
@@ -111,7 +103,7 @@ a specific one for AD Activity, create a new one and provide a unique descriptiv
the **Settings > Connection** node.
**Step 7 –** Select the **Select one of the following user defined profiles** option. Expand the
-drop-down menu and select the Connection Profile with this credential.
+dropdown menu and select the Connection Profile with this credential.
**Step 8 –** Click **Save** and then **OK** to confirm the changes to the job group settings.
@@ -119,7 +111,7 @@ The Connection Profile will now be used for AD Activity collection.
## Configure the AD_ActivityCollection Job
-Access Analyzer requires additional configurations in order to collect domain activity data. Follow
+Access Analyzer requires additional configurations to collect domain activity data. Follow
the steps to configure the **AD_ActivityCollection** Job.
:::note
diff --git a/docs/activitymonitor/8.0/requirements/adagent/adagent.md b/docs/activitymonitor/8.0/requirements/adagent/adagent.md
index 78f7534532..9974ee639b 100644
--- a/docs/activitymonitor/8.0/requirements/adagent/adagent.md
+++ b/docs/activitymonitor/8.0/requirements/adagent/adagent.md
@@ -57,7 +57,7 @@ These depend on the amount of activity expected:
The disk space requirement covers the following:
- Agent Size – 150 MB
-- Agent Queues – In the event of a network outage, the agent will cache up to 40 GB of event data
+- Agent Queues – If there is a network outage, the agent will cache up to 40 GB of event data
- Diagnostic Logging – 1 GB
Old files are zipped, typical compression ratio is 20. Optionally, old files are moved from the
@@ -82,7 +82,7 @@ The following permission is required to install and manage the agent:
## Supported Active Directory Platforms
-The Activity Monitor provides the ability to monitor Active Directory:
+The Activity Monitor lets you monitor Active Directory:
:::note
For monitoring an Active Directory domain, the AD Agent must be installed on all domain
@@ -102,7 +102,7 @@ topic for target environment requirements.
The following products conflict with the agent:
:::warning
-Do not install these products on a server where an agent is deployed. Do NOT install an
+Don't install these products on a server where an agent is deployed. Don't install an
agent on a server where these products are installed.
:::
diff --git a/docs/activitymonitor/8.0/requirements/adagent/threatprevention.md b/docs/activitymonitor/8.0/requirements/adagent/threatprevention.md
index ed2c40ead1..483949d059 100644
--- a/docs/activitymonitor/8.0/requirements/adagent/threatprevention.md
+++ b/docs/activitymonitor/8.0/requirements/adagent/threatprevention.md
@@ -18,9 +18,6 @@ either Netwrix Activity Monitor or Netwrix Threat Manager but not both. However,
Monitor can be configured with outputs for Access Analyzer and Threat Manager
:::
-
-Follow these steps to configure this integration.
-
:::info
It is a best practice to use the API Server option of the Activity Monitor for
this integration between Threat Prevention and Access Analyzer.
@@ -42,7 +39,7 @@ Threat Manager Configuration** on the menu. The Netwrix Threat Manager Configura
- App Token – Leave this field blank for integration with Activity Monitor
- Policies – The table displays all policies created in Threat Prevention along with a State icon
- indicating if the policy is active. Check the **Send** box for the desired policies monitoring the
+ indicating if the policy is active. Check the **Send** box for the policies that will monitor the
target domain activity.
**Step 3 –** Click **Save**.
diff --git a/docs/activitymonitor/8.0/requirements/linuxagent.md b/docs/activitymonitor/8.0/requirements/linuxagent.md
index 13b3a1c9a5..56bfdbed60 100644
--- a/docs/activitymonitor/8.0/requirements/linuxagent.md
+++ b/docs/activitymonitor/8.0/requirements/linuxagent.md
@@ -20,7 +20,7 @@ are:
:::note
For monitoring a Linux file server, the The Linux Agent is deployed to Linux servers to be
-monitored. It cannot be deployed to a proxy server.
+monitored. It can't be deployed to a proxy server.
:::
@@ -33,7 +33,7 @@ The following protocols are supported for the Linux agent:
- Network File System (Mounted Client-Side)
:::note
-Server-Side NFS protocol is not supported.
+Server-Side NFS protocol isn't supported.
:::
@@ -44,7 +44,7 @@ The following permission is required by the account used to install and manage t
- Root privileges with password (or SSH private key)
For integration between the Activity Monitor and Access Analyzer, the credential used by Access
-Analyzer to read the activity log files must have also have this permission.
+Analyzer to read the activity log files must also have this permission.
## Immutable Mode
diff --git a/docs/activitymonitor/8.0/requirements/overview.md b/docs/activitymonitor/8.0/requirements/overview.md
index 1261d7ad99..26a3d1a39a 100644
--- a/docs/activitymonitor/8.0/requirements/overview.md
+++ b/docs/activitymonitor/8.0/requirements/overview.md
@@ -8,7 +8,7 @@ sidebar_position: 20
This topic describes the recommended configuration of the servers needed to install the application
in a production environment. Depending on the size of the organization, it is recommended to review
-your environment and requirements with a Netwrix engineer prior to deployment to ensure all
+your environment and requirements with a Netwrix engineer before deployment to ensure all
exceptions are covered.
## Architecture Overview
diff --git a/docs/activitymonitor/8.0/restapi/resources/agent.md b/docs/activitymonitor/8.0/restapi/resources/agent.md
index 20a9b2f17f..c59d28a1ce 100644
--- a/docs/activitymonitor/8.0/restapi/resources/agent.md
+++ b/docs/activitymonitor/8.0/restapi/resources/agent.md
@@ -16,8 +16,8 @@ sidebar_position: 10
| authenticationMethod | string | | The authentication method for connecting to the agent: Password, PublicKey |
| agentPort | int | | The port that is used by the agent. Default: 4498. |
| userName | string | | Account for connecting to the agent. |
-| password | string | X | Account password for connecting to the agent. Password is not exposed. |
-| privateKey | string | | The private key used when PublicKey authentication method is used. The private key is not exposed. |
+| password | string | X | Account password for connecting to the agent. Password isn't exposed. |
+| privateKey | string | | The private key used when PublicKey authentication method is used. The private key isn't exposed. |
| clientCertificate | string | | The agent's client certificate. |
| protocol | string | | The protocol used for connecting to the agent: GRPC |
| domain | string | | Domain name of the agent |
@@ -43,13 +43,13 @@ sidebar_position: 10
| archive.IsEnabled | bool | X | Whether the archiving feature is enabled |
| archive.path | string | X | UNC path of the archival location |
| archive.userName | string | X | An account to access the archival location. |
-| archive.password | string | X | User password to access the archival location. Password is not exposed. |
+| archive.password | string | X | User password to access the archival location. Password isn't exposed. |
| archive.maxLocalSize | string | X | Maximum space the agent is allowed to use on the local drives. |
| fpolicy.port | int | X | NetApp c-mode fpolicy port |
| fpolicy.auth | string | X | `NoAuth`, `Server`, `Mutual` |
| fpolicy.ipWhitelist | string[] | X | IP whitelist |
-| fpolicy.clientCertificate | string | X | The Client or CA certificate that is currently set. |
-| fpolicy.serverCertificate | string | X | The FPolicy Server certificate that is currently set. Server Certificate is not exposed. |
+| fpolicy.clientCertificate | string | X | The Client or CA certificate that is set. |
+| fpolicy.serverCertificate | string | X | The FPolicy Server certificate that is set. Server Certificate isn't exposed. |
| minLocalFreeSpace | string | X | Free disk threshold after which the agent stops writing data to the log files |
| cee.vcapsIsEnabled | bool | X | CEE Asynchronous bulk delivery (VCAPS) is enabled or disabled. |
| cee.vcapsInterval | int | X | Interval in seconds on how often events are delivered by CEE. |
@@ -68,7 +68,7 @@ sidebar_position: 10
| inactivityAlerts.email.server | string | X | The email SMTP server that is sent inactivity alerts. |
| inactivityAlerts.email.ssl | bool | X | Email SMTP Server SSL / TLS is enabled or disabled. |
| inactivityAlerts.email.userName | string | X | Email SMTP Server Username. |
-| inactivityAlerts.email.password | string | X | Email SMTP Server Password. Password is not exposed. |
+| inactivityAlerts.email.password | string | X | Email SMTP Server Password. Password isn't exposed. |
| inactivityAlerts.email.from | string | X | Email address of where the inactivity alert is from. |
| inactivityAlerts.email.to | string | X | Email address of where the inactivity alert is sent to. |
| inactivityAlerts.email.subject | string | X | Email message subject of the inactivity alert. |
@@ -76,7 +76,7 @@ sidebar_position: 10
| apiServerIsEnabled | bool | | API Server is enabled or disabled |
| apiServerPort | int | | API Server TCP/IP port |
| apiServerIpWhitelist | string[] | X | Whitelist of IPs allowed to connect to the API Server port. |
-| apiServerMgmtConsole | string | X | NETBIOS name of the Console machine that manages the agent list of the API Server (only available for agent(s) that are running the api server) |
+| apiServerMgmtConsole | string | X | NETBIOS name of the Console machine that manages the agent list of the API Server (only available for agents that are running the api server) |
| traceLevel | string | X | The logging trace level of the agent. |
| externalNicName | string | X | The selected network interface that is used for connections. If blank, the agent will auto-detect the network interface to use. |
| comment | string | | The agent's set comment. |
@@ -86,8 +86,8 @@ sidebar_position: 10
| networkProxy.useDefaultCredentials | bool | X | If enabled the proxy server authenticates as the agent's machine account. |
| networkProxy.bypassProxyOnLocal | bool | X | If enabled the agent will bypass the proxy server for local addresses. |
| networkProxy.userName | string | X | The Proxy Server Username |
-| networkProxy.password | string | X | The Proxy Server Password. Password is not exposed. |
-| networkProxy.bypassList | string[] | X | List of regular expressions that describe URIs that do not use the proxy server when accessed. |
+| networkProxy.password | string | X | The Proxy Server Password. Password isn't exposed. |
+| networkProxy.bypassList | string[] | X | List of regular expressions that describe URIs that don't use the proxy server when accessed. |
| dns.isEnabled | bool | X | Local DNS caching service is enabled or disabled. |
| dns.listenPort | int | X | Port used by the DNS caching service. |
| dns.parallelism | int | X | Parallelism level to use while processing DNS requests. |
@@ -100,7 +100,7 @@ sidebar_position: 10
| dns.clientWaitTimeout | TimeSpan | X | The amount of the DNS service is allowed to process a request before sending a not found response. If no results are received the lookup operation continues in the background. |
| dns.refreshThreshold | TimeSpan | X | An interval between expired items in the cache check. |
| dns.maxCacheSize | int | X | The max size of the dns service buffer file. |
-| dns.uselessAge | TimeSpan | X | The DNS service does not resolve names for events older then the set time period. |
+| dns.uselessAge | TimeSpan | X | The DNS service doesn't resolve names for events older then the set time period. |
| dns.maxAttemptsToResolve | int | X | Maximum attempts that the DNS service will use to resolve addresses. If 0 is set, the DNS service will resolve addresses infinitely. |
| dns.suffix | string | X | The DNS suffix identifies the domain name that is appended to an unqualified host name to obtain a fully qualified domain name (FQDN) suitable for a dns name query. |
| adUsers.domainControllers | string[] | X | List of Domain Controllers to be used for user lookups. If blank, the default behavior is used. |
@@ -111,7 +111,7 @@ sidebar_position: 10
| panzura.port | int | X | Agent port used for Panzura. |
| panzura.useCredentials | bool | X | Protection of Panzura port is enabled or disabled. |
| panzura.username | string | X | Panzura's MQ username used for port protection. |
-| panzura.password | string | X | Panzura's MQ password used for port protection. Password is not exposed. |
+| panzura.password | string | X | Panzura's MQ password used for port protection. Password isn't exposed. |
| panzura.ipWhitelist | string[] | X | Whitelist of IP addresses of Panzura nodes that are allowed to connect to the Agent's Panzura port. If blank, connections from any host are accepted. |
| nutanix.port | int | X | Agent port used for Nutanix. |
| nutanix.ipWhitelist | string[] | X | Whitelist of IP addresses of Nutanix nodes that are allowed to connect to the Agent's Nutanix port. If blank, connections from any host are accepted. |
diff --git a/docs/activitymonitor/8.0/restapi/resources/host.md b/docs/activitymonitor/8.0/restapi/resources/host.md
index 752cc1d001..2da44d915d 100644
--- a/docs/activitymonitor/8.0/restapi/resources/host.md
+++ b/docs/activitymonitor/8.0/restapi/resources/host.md
@@ -13,7 +13,7 @@ sidebar_position: 30
| host | string | | Host name/Address as specified by a user |
| type | string | | `Windows`,`NetApp`,`Celerra`,`Isilon`,`Hitachi`,`SharePoint`,`Unity`,`Nasuni`, `Panzura`, `SharePointOnline`, `AzureAD`, `Linux`, `SqlServer` |
| userName | string | | An account to connect the host to |
-| password | string | X | Account password to connect the host to. Password is not exposed. |
+| password | string | X | Account password to connect the host to. Password isn't exposed. |
| autoConfigureAuditing | bool | | Automatically enable the auditing on the device, if supported |
| monitorAuditingStatus | bool | | Constantly verify that the auditing is enabled, fix if needed |
| hostAliases | string[] | | List of server names for NAS if they are different from the set name of the host. |
@@ -30,7 +30,7 @@ sidebar_position: 30
| inactivityAlerts.email.server | string | | The email or SMTP server or IP that is used to send host inactivity alerts. |
| inactivityAlerts.email.ssl | bool | | Email SMTP Server SSL / TLS is enabled or disabled. |
| inactivityAlerts.email.userName | string | | The email or SMTP server user name. |
-| inactivityAlerts.email.password | string | X | The email or SMTP server password. Password is not exposed. |
+| inactivityAlerts.email.password | string | X | The email or SMTP server password. Password isn't exposed. |
| inactivityAlerts.email.from | string | | Email address of where the inactivity alert is from. |
| inactivityAlerts.email.to | string | | Email address of where the inactivity alert is sent to. |
| inactivityAlerts.email.subject | string | | Email message subject of the inactivity alert. |
@@ -64,21 +64,21 @@ sidebar_position: 30
| spo.azure.tenantId | string | | The azure Tenant ID |
| spo.azure.tenantName | string | | The azure Tenant Name |
| spo.azure.clientId | string | | The azure Tenant Client ID. |
-| spo.azure.clientSecret | string | X | The azure Client Secret. Client Secret is not exposed. |
+| spo.azure.clientSecret | string | X | The azure Client Secret. Client Secret isn't exposed. |
| spo.azure.region | string | | The azure Region. |
| azureAd.azure.domain | string | | The Azure Active Directory domain being monitored. |
| azureAd.azure.azureCloud | string | | The selected Azure Cloud being used: "Azure", "Azure for US Government GCC", "Azure for Government GCC High", "Azure for US Government DoD", "Azure Germany", "Azure China by 21Vianet" |
| azureAd.azure.tenantId | string | | The azure Tenant ID |
| azureAd.azure.tenantName | string | | The azure Tenant Name |
| azureAd.azure.clientId | string | | The azure Tenant Client ID. |
-| azureAd.azure.clientSecret | string | X | The azure Client Secret. Client Secret is not exposed. |
+| azureAd.azure.clientSecret | string | X | The azure Client Secret. Client Secret isn't exposed. |
| azureAd.azure.region | string | | The azure Region. |
| exchangeOnline.azure.domain | string | | The Azure Active Directory domain being monitored for Exchange Online. |
| exchangeOnline.azure.azureCloud | string | | The selected Azure Cloud being used: "Azure", "Azure for US Government GCC", "Azure for Government GCC High", "Azure for US Government DoD", "Azure Germany", "Azure China by 21Vianet" |
| exchangeOnline.azure.tenantId | string | | The azure Tenant ID |
| exchangeOnline.azure.tenantName | string | | The azure Tenant Name |
| exchangeOnline.azure.clientId | string | | The azure Tenant Client ID. |
-| exchangeOnline.azure.clientSecret | string | X | The azure Client Secret. Client Secret is not exposed. |
+| exchangeOnline.azure.clientSecret | string | X | The azure Client Secret. Client Secret isn't exposed. |
| exchangeOnline.azure.region | string | | The azure Region. |
| sql.pollingInterval | string | | The interval for polling SQL log for new events. |
| sql.tweakOptions | string[] | | Extended Events tweaking options for SQL hosts. |
diff --git a/docs/activitymonitor/8.0/restapi/resources/output.md b/docs/activitymonitor/8.0/restapi/resources/output.md
index 4d2d703c42..4d8e4f918a 100644
--- a/docs/activitymonitor/8.0/restapi/resources/output.md
+++ b/docs/activitymonitor/8.0/restapi/resources/output.md
@@ -16,7 +16,7 @@ sidebar_position: 40
| domainId | string | | AD only: ID of the owning domain |
| domainUrl | string | | AD only: Link to the owning domain |
| logsUrl | string | | Link to the file output log files (for the local agent only, that has the API Server running) |
-| isEnabled | bool | | Whether or not the output is enabled. If disabled, no activity is forwarded to it. |
+| isEnabled | bool | | Whether the output is enabled. If disabled, no activity is forwarded to it. |
| type | string | | `LogFile`,`Syslog`,`Amqp` |
| logFile | FileOutput | | Log file settings |
| syslog | SyslogOutput | | Syslog settings |
@@ -64,7 +64,7 @@ sidebar_position: 40
| separator | string | | `Lf`,Cr, `CrLf`, `Nul`, `Rfc5425` |
| reportUncPath | bool | | Report UNC paths in addition to local/native paths |
| addCToPath | bool | | Prepend the path `C:\` and change the forward slashes to backslashes. |
-| template | string | | Text of the syslog template that is currently set to be used. |
+| template | string | | Text of the syslog template that is set to be used. |
## AmqpOutput
@@ -72,7 +72,7 @@ sidebar_position: 40
| --------- | ------ | ------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| server | string | | Hostname/address of the AMQP server or the Threat Manager server and the port in the SERVER:PORT format |
| userName | string | | User name for the AMQP connection, if needed. ForThreat Managerintegration, use an empty string. |
-| password | string | | Password / App Token for the AMQP connection. Password / App Token is not exposed. |
+| password | string | | Password / App Token for the AMQP connection. Password / App Token isn't exposed. |
| queue | string | | Message queue name to post events to. ForThreat Manager integration, use an empty string. |
| exchange | string | | Exchange name to post events to. ForThreat Manager integration, use "StealthINTERCEPT" for domain outputs or "AM" for host outputs. |
| vhost | string | | Virtual Host name, if needed. ForThreat Managerintegration, use an empty string. |
@@ -330,8 +330,8 @@ sidebar_position: 40
| isArchived | bool | | Determines whether the file is on a local drive of the agent or moved to the archival location. |
| type | string | | `Tsv`, `Json` |
| updatedAt | DateTime | | Last time the file was updated |
-| activityFrom | DateTime | | Activity events in the file are not younger than the date. |
-| activityTo | DateTime | | Activity events in the file are not older than the date. |
+| activityFrom | DateTime | | Activity events in the file aren't younger than the date. |
+| activityTo | DateTime | | Activity events in the file aren't older than the date. |
| outputId | string | | ID of the output that produced the file. |
| contentUrl | string | | Link to the file content. MIME type `application/x-msdownload` |
diff --git a/docs/activitymonitor/8.0/restapi/resources/resources.md b/docs/activitymonitor/8.0/restapi/resources/resources.md
index 8e40c2b201..831b7b69e2 100644
--- a/docs/activitymonitor/8.0/restapi/resources/resources.md
+++ b/docs/activitymonitor/8.0/restapi/resources/resources.md
@@ -8,7 +8,7 @@ sidebar_position: 20
The 8.0 API model consists of the following resources:
-- Agent – Represents an Activity Monitor Agent. API allows you to view existing agents and their
+- Agent – Represents an Activity Monitor Agent. Use the API to view existing agents and their
status, register, modify, or remove agents. There is no way to install, upgrade, or uninstall
agents in the 6.0 API. You can list all the agents or the agents of a domain (AD-monitoring agents
on the domain controllers).
@@ -16,8 +16,7 @@ The 8.0 API model consists of the following resources:
See the [Agent](/docs/activitymonitor/8.0/restapi/resources/agent.md) topic for additional information.
- Host – Represents a host or platform monitored by the product (Windows, NetApp, SharePoint, SQL
- Server, etc). It is a Monitored Host in the Console. You can list all the hosts of the agent, or
- just all the hosts. The API Provides access to the settings of the host and its status; allows you
+ Server, etc). It is a Monitored Host in the Console. You can list all the hosts of the agent, or all the hosts. The API Provides access to the settings of the host and its status; allows you
to create new hosts, modify, enable/disable, or delete existing. Typical properties include a
hostname, credentials to access API, connection settings. A Host is associated with at least one
Output. Each Host can have multiple child Outputs, and each Output has its own unique filter
@@ -41,14 +40,14 @@ The 8.0 API model consists of the following resources:
- File information about the actual .TSV, .JSON, and .ZIP files stored on the agent. A file can
be downloaded.
- - Policy represents an Active Directory monitoring policy. The API allows you to create new
+ - Policy represents an Active Directory monitoring policy. Use the API to create new
policies, list, modify, and delete existing.
See the [Output](/docs/activitymonitor/8.0/restapi/resources/output.md) topic for additional information.
Data is transmitted as JSON objects or as JSON Merge Patch for PATCH requests. Dates are formatted
in UTC using the `YYYY-MM-DDTHH:MM:SS` DateTime format. Security-sensitive data like passwords,
-certificates, and access tokens are not returned by the GET requests but can be set using POST and
+certificates, and access tokens aren't returned by the GET requests but can be set using POST and
PATCH requests.
## API
@@ -270,7 +269,7 @@ Response Example:
**POST /api/v1/agents**
-Adds a new agent but does not install it. The host attribute must be unique.
+Adds a new agent but doesn't install it. The host attribute must be unique.
- Permission – Modify agents
- Response Body – Agent
@@ -642,7 +641,7 @@ Response Example:
**GET /api/v1/domains/«domainId»**
-Returns the domain by its ID, or a 404 error if it is not found or the client lacks sufficient
+Returns the domain by its ID, or a 404 error if it isn't found or the client lacks sufficient
permissions.
- Permission – Read or Access activity data
@@ -654,8 +653,8 @@ Response: Domain
**GET /api/v1/agents/«agentId»/domain**
-Returns a domain monitored by the specified agent, or a 404 error if the domain is not found, the
-client lacks the necessary permissions, or the agent is not monitoring AD activity.
+Returns a domain monitored by the specified agent, or a 404 error if the domain isn't found, the
+client lacks the necessary permissions, or the agent isn't monitoring AD activity.
This endpoint is useful to get `Output` settings specific to the agent. Domain outputs are logical,
they are described once and used by all the domain controllers to create actual files/syslog/amqp
@@ -672,7 +671,7 @@ Response: Domain
**GET /api/v1/domains/«domainId»/agents**
Returns the domain controllers (agents) monitoring the specified domain, or a 404 error if the
-domain is not found or the client lacks the necessary permissions.
+domain isn't found or the client lacks the necessary permissions.
- Permission – Read or Access activity data
- Response – Array of Agent
@@ -684,7 +683,7 @@ Response: Array of Agent
**GET /api/v1/domains/«domainId»/outputs**
Returns the configured outputs for the specified domain, or 404 if no rights for the domain or the
-domain was not found.
+domain wasn't found.
- Permission – Read or Access activity data
- Response – Array of Output
@@ -752,7 +751,7 @@ Response Example:
**GET /api/v1/domains/«domainId»/outputs/«outputId»**
-Returns the output for the specified domain, or a 404 error if the domain is not found or the client
+Returns the output for the specified domain, or a 404 error if the domain isn't found or the client
lacks the necessary permissions.
- Permission –Read or Access activity data
@@ -1106,7 +1105,7 @@ Response: Array of Status
**GET /api/v1/agents/«agentId»/hosts**
-Returns a list of hosts for the specified agent. If the agent is not found or the client lacks the
+Returns a list of hosts for the specified agent. If the agent isn't found or the client lacks the
necessary permissions, a 404 error is returned.
- Permission – Read or Access activity data
@@ -1369,7 +1368,7 @@ Response: 204
**GET /api/v1/hosts/«hostId»/outputs**
-Returns a list of outputs for the specified host. If the host is not found or the client lacks the
+Returns a list of outputs for the specified host. If the host isn't found or the client lacks the
necessary permissions, a 404 error is returned.
- Permission – Read or Access activity data
@@ -1417,7 +1416,7 @@ Request Body Structure:
**POST /api/v1/agents/«agentId»/hosts/«hostId»/outputs**
Adds a new output for the specified host on the specified agent only. The method may be useful to
-have agent-specific outputs but is not recommended.
+have agent-specific outputs but isn't recommended.
- Permission – Modify hosts
- Response – 201, Output
@@ -1452,7 +1451,7 @@ Request Body Structure:
**GET /api/v1/hosts/«hostId»/outputs/«outputId»**
-Returns the specified output of the host. If the host or output is not found, or the client lacks
+Returns the specified output of the host. If the host or output isn't found, or the client lacks
the necessary permissions, a 404 error is returned.
- Permission – Read or Access activity data
@@ -1586,7 +1585,7 @@ The following attributes can be modified:
- `windows.discardReorderedAcl`
- `windows.vssActivity`
- `windows.vssCreation`
-- `amqp.server` - must be a a vaild hostname or ip4/ip6 address.
+- `amqp.server` - must be a valid hostname or ip4/ip6 address.
- `amqp.userName`
- `amqp.password`
- `amqp.vhost`
@@ -1674,7 +1673,7 @@ The following attributes can be modified:
- `windows.discardReorderedAcl`
- `windows.vssActivity`
- `windows.vssCreation`
-- `amqp.server` ¬ must be a a vaild hostname or ip4/ip6 address.
+- `amqp.server` ¬ must be a valid hostname or ip4/ip6 address.
- `amqp.userName`
- amqp.password
- `amqp.vhost`
diff --git a/docs/activitymonitor/8.0/restapi/security.md b/docs/activitymonitor/8.0/restapi/security.md
index 4d89fe9fa0..48cb6e0673 100644
--- a/docs/activitymonitor/8.0/restapi/security.md
+++ b/docs/activitymonitor/8.0/restapi/security.md
@@ -9,7 +9,7 @@ sidebar_position: 10
## Security
The REST-style API is exposed via TLS v1.2, with a self-signed certificate by default. The port is
-customizable, 4494 by default. The IP whitelist can be used to restrict access to the port.
+customizable, 4494 by default. Use the IP whitelist to restrict access to the port.
You can use the Activity Monitor Console to allow applications to access the API, change
permissions, or revoke access. The console generates unique Client ID and Secret for each
@@ -19,7 +19,7 @@ application.
OAuth 2.0 client-credentials grant is used for authentication. A pair of Client ID and Secret are
used to obtain an access token from the access token URL: `https://localhost:4494/api/v1/token`.
-Token expiration intervals are not configurable.
+Token expiration intervals aren't configurable.
| Type | Expires in |
| ------------- | ---------- |
@@ -28,16 +28,16 @@ Token expiration intervals are not configurable.
| Refresh Token | never |
It is considered a best practice to use short expiration periods for OAuth 2.0 tokens, like 1 hour
-for the access token. A shorter period allows you to revoke the access quicker if needed. In case of
+for the access token. A shorter period lets you revoke the access quicker if needed. In case of
Activity Monitor, the Agent is both the authentication server and the resource server. Therefore, it
can validate the token on each and every access to a resource. So, for Activity Monitor long
-expiration periods do not make the protocol less secure.
+expiration periods don't make the protocol less secure.
A client is expected to pass the access token in the `Authorization` request header.
:::note
**Use a client library that is secure and fully implements the OAuth 2.0 protocol.** The
-sample below shows just a piece of OAuth 2 interaction.
+following sample shows just a piece of OAuth 2 interaction.
:::
@@ -62,7 +62,7 @@ Activity Monitor8.0 permissions:
| Permission | Description |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| Access activity data | Provides minimal access rights to list and download the log files. |
-| Read | Read-only access to all the information about all agents, domains, and hosts. Does not allow one to download the log files. |
+| Read | Read-only access to all the information about all agents, domains, and hosts. Doesn't allow one to download the log files. |
| Policy change | Add, modify, and delete the AD monitoring policies. |
| Modify host | Add, modify, enable, disable, and delete Hosts and their Outputs. |
| Modify agent | Add, modify, and delete agents. |
diff --git a/docs/activitymonitor/8.0/siem/qradar/app/app.md b/docs/activitymonitor/8.0/siem/qradar/app/app.md
index 0fe268ca8d..d399879683 100644
--- a/docs/activitymonitor/8.0/siem/qradar/app/app.md
+++ b/docs/activitymonitor/8.0/siem/qradar/app/app.md
@@ -15,7 +15,7 @@ and a Settings interface for configuring the QRadar SEC token.
The User Investigation and Host Investigation dashboards only appear when a search is conducted.
This can be done by clicking a hyperlink within the Username or Destination IP columns of a table
-card. Alternatively, type the complete user name or host IP Address in the Search box on the right
+card. Alternatively, enter the complete user name or host IP Address in the Search box on the right
side of the navigation bar.
## Table Card Features
@@ -34,11 +34,11 @@ following features:
- Total number of entries “Showing” will adjust for the filtered total.
- Search can also apply to the Operation column, but only for exact matches.
-- Sort can be applied to one column at a time by clicking on the desired column header.
+- Sort can be applied to one column at a time by clicking on the column header you want.
- Show 10, 25, 100, or All entries in the table. Only visible entries can be exported.
-- Result data currently visible within the table page displayed can be exported from the dashboard:
+- Result data visible within the table page displayed can be exported from the dashboard:
- - Copy – Copy to clipboard in order to paste to another application
+ - Copy – Copy to clipboard to paste to another application
- CSV – Export to a Comma Separated Value file
- Excel – Export to an Excel Workbook file
- - Print – Send currently displayed table to printer
+ - Print – Send displayed table to printer
diff --git a/docs/activitymonitor/8.0/siem/qradar/app/deletions.md b/docs/activitymonitor/8.0/siem/qradar/app/deletions.md
index cbdfc2c8a0..d382362f4a 100644
--- a/docs/activitymonitor/8.0/siem/qradar/app/deletions.md
+++ b/docs/activitymonitor/8.0/siem/qradar/app/deletions.md
@@ -21,5 +21,4 @@ The Deletions dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
-interval. Then click Search to refresh the card data.
+enter the date and time or use the calendar buttons to set the interval. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/8.0/siem/qradar/app/home.md b/docs/activitymonitor/8.0/siem/qradar/app/home.md
index 453a0dcb27..1e094a15a7 100644
--- a/docs/activitymonitor/8.0/siem/qradar/app/home.md
+++ b/docs/activitymonitor/8.0/siem/qradar/app/home.md
@@ -32,5 +32,5 @@ The File System Activity Home dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
-interval. Then click Search to refresh the card data.
+enter the date and time you want or use the calendar buttons to set the date and time
+interval you want. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/8.0/siem/qradar/app/hostinvestigation.md b/docs/activitymonitor/8.0/siem/qradar/app/hostinvestigation.md
index 4fa8c6e98b..3def2715b6 100644
--- a/docs/activitymonitor/8.0/siem/qradar/app/hostinvestigation.md
+++ b/docs/activitymonitor/8.0/siem/qradar/app/hostinvestigation.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# Host Investigation Dashboard
-The Host Investigation dashboard only appears when a search is conducted. This can be done by
-clicking a hyperlink within the Destination IP column of a table card. Alternatively, type the
+The Host Investigation dashboard appears only after you conduct a search. You can conduct a search by
+clicking a hyperlink within the Destination IP column of a table card. Alternatively, enter the
complete host IP Address in the Search box on the right side of the navigation bar.
@@ -20,7 +20,7 @@ The Host Investigation dashboard contains the following cards:
- Resources – Number of distinct files associated with the host over the specified time interval
- File Activity – Timeline of all events associated with the host over the specified time interval
- - The graph values can be toggled on an off by clicking on individual elements in the legend.
+ - Click individual elements in the legend to toggle the graph values on and off.
- Details of File Activity – Tabular format of all file activity events associated with the host
which occurred over the specified time interval
@@ -36,5 +36,5 @@ The Host Investigation dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
+enter the date and time you want, or use the calendar buttons to set the date and time
interval. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/8.0/siem/qradar/app/permissionchanges.md b/docs/activitymonitor/8.0/siem/qradar/app/permissionchanges.md
index 3e47558275..9a33af67b0 100644
--- a/docs/activitymonitor/8.0/siem/qradar/app/permissionchanges.md
+++ b/docs/activitymonitor/8.0/siem/qradar/app/permissionchanges.md
@@ -24,5 +24,5 @@ The Permission Changes dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
-interval. Then click Search to refresh the card data.
+enter the date and time you want or use the calendar buttons to set the date and time interval.
+Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/8.0/siem/qradar/app/ransomware.md b/docs/activitymonitor/8.0/siem/qradar/app/ransomware.md
index 2cb0800048..83f6f81265 100644
--- a/docs/activitymonitor/8.0/siem/qradar/app/ransomware.md
+++ b/docs/activitymonitor/8.0/siem/qradar/app/ransomware.md
@@ -31,7 +31,7 @@ The Ransomware dashboard contains the following cards:
- Only visible after clicking Search on an offense
The offenses generated within QRadar are based upon the Stealthbits: Ransomware Detected rule that
-is packaged with this application. In order to adjust this rule to better suit an organization’s
-needs, please refer to the IBM QRadar
+is packaged with this application. To adjust this rule to better suit an organization’s
+needs, refer to the IBM QRadar
[Rule management](https://www.ibm.com/support/knowledgecenter/SS42VS_7.2.6/com.ibm.qradar.doc/c_qradar_rul_mgt.html)
article on how to modify rules.
diff --git a/docs/activitymonitor/8.0/siem/qradar/app/userinvestigation.md b/docs/activitymonitor/8.0/siem/qradar/app/userinvestigation.md
index 18021a1173..37741d5e13 100644
--- a/docs/activitymonitor/8.0/siem/qradar/app/userinvestigation.md
+++ b/docs/activitymonitor/8.0/siem/qradar/app/userinvestigation.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# User Investigation Dashboard
The User Investigation dashboard only appears when a search is conducted. This can be done by
-clicking a hyperlink within the Username column of a table card. Alternatively, type the complete
+clicking a hyperlink within the Username column of a table card. Alternatively, enter the complete
user name in the Search box on the right side of the navigation bar.
@@ -20,7 +20,7 @@ The User Investigation dashboard contains the following cards:
interval
- Resources – Number of distinct files associated with the user over the specified time interval
- File Activity – Timeline of all events associated with the user over the specified time interval
- - The graph values can be toggled on an off by clicking on individual elements in the legend.
+ - Click individual elements in the legend to toggle the graph values on and off.
- Details of File Activity – Tabular format of all file activity events associated with the user
which occurred over the specified time interval
- See the [Table Card Features ](/docs/activitymonitor/8.0/siem/qradar/app/app.md#table-card-features) topic for additional
@@ -32,5 +32,5 @@ The User Investigation dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
+enter the date and time or use the calendar buttons to set the date and time
interval. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/8.0/siem/qradar/overview.md b/docs/activitymonitor/8.0/siem/qradar/overview.md
index 97ad35de1f..477f9776e8 100644
--- a/docs/activitymonitor/8.0/siem/qradar/overview.md
+++ b/docs/activitymonitor/8.0/siem/qradar/overview.md
@@ -26,10 +26,10 @@ the Netwrix website for additional information.
Download the [Stealthbits File Activity Monitor App for
QRadar](https://exchange.xforce.ibmcloud.com/hub/extension/STEALTHbits Technologies:STEALTHbits File
Activity Monitor) from the [IBM X-Force App Exchange](https://exchange.xforce.ibmcloud.com/hub).
-After downloading the Stealthbits File Activity Monitor App for QRadar, follow the steps to install
+After downloading the Stealthbits File Activity Monitor App for QRadar, complete the following steps to install
it within QRadar.
-**Step 1 –** Click on the Admin tab within QRadar.
+**Step 1 –** Click the Admin tab within QRadar.
**Step 2 –** Under System Configuration, click Extensions Management.
@@ -48,7 +48,7 @@ be saved to the Settings interface of the **File Activity Monitor** App. See the
## Initial Configuration of the QRadar App
-Follow the steps to configure QRadar to receive data from Stealthbitsproducts.
+Complete these steps to configure QRadar to receive data from Stealthbits products.
**Step 1 –** Determine the IP Address of the QRadar Console, e.g. run the _ifconfig_ command. This
information is required for the following sections:
@@ -62,7 +62,7 @@ information is required for the following sections:
**Step 3 –** Select Log Sources.
-**Step 4 –** View the Log Sources list. If the data source was not automatically created, click Add
+**Step 4 –** View the Log Sources list. If the data source wasn't automatically created, click Add
and enter the following information:
- Log Source Name – Enter a descriptive name to identify the data source
@@ -78,7 +78,7 @@ sent correctly between the hosts, and diagnose any possible network issues.
- Protocol Configuration – Select Syslog
- Log Source Identifier – Enter the host name or IP Address of the host where the Stealthbits
Activity Monitor Console OR StealthINTERCEPT is installed
-- Then click Save. Remember, prior to using the StealthbitsFile Activity Monitor App for QRadar, the
+- Then click Save. Remember, before using the StealthbitsFile Activity Monitor App for QRadar, the
related Stealthbits product must be configured to send data to QRadar.
The Stealthbits File Activity Monitor App for QRadar can now display activity data from either the
diff --git a/docs/activitymonitor/8.0/siem/qradar/settings.md b/docs/activitymonitor/8.0/siem/qradar/settings.md
index c35514e86e..4385ef27b4 100644
--- a/docs/activitymonitor/8.0/siem/qradar/settings.md
+++ b/docs/activitymonitor/8.0/siem/qradar/settings.md
@@ -12,4 +12,4 @@ the QRadar SEC token to be saved to the **Settings** interface.
The **More information** link will open the IBM Knowledge Center with information on generating the
-QRadar SEC token. Once the token is generated, copy and paste it here and click Save.
+QRadar SEC token. After the token is generated, copy and paste it here and click Save.
diff --git a/docs/activitymonitor/8.0/siem/splunk/app/app.md b/docs/activitymonitor/8.0/siem/splunk/app/app.md
index 86ac0a4dd4..a8d1a32001 100644
--- a/docs/activitymonitor/8.0/siem/splunk/app/app.md
+++ b/docs/activitymonitor/8.0/siem/splunk/app/app.md
@@ -13,6 +13,6 @@ Activity (Overview), Ransomware, Permission Changes, and Deletions.
The date time search feature uses the default Splunk search features.
-The timeframe interval is identified in the upper-left corner of each dashboard. The drop-down menu
+The timeframe interval is identified in the upper-left corner of each dashboard. The dropdown menu
provides additional options. To search within a different interval, choose a new option from the
menu. Then click **Submit** to refresh the card data.
diff --git a/docs/activitymonitor/8.0/siem/splunk/app/overview.md b/docs/activitymonitor/8.0/siem/splunk/app/overview.md
index 9ce45806bd..2c4cafd9a1 100644
--- a/docs/activitymonitor/8.0/siem/splunk/app/overview.md
+++ b/docs/activitymonitor/8.0/siem/splunk/app/overview.md
@@ -1,10 +1,10 @@
---
-title: "Overview Dashobard"
-description: "Overview Dashobard"
+title: "Overview Dashboard"
+description: "Overview Dashboard"
sidebar_position: 10
---
-# Overview Dashobard
+# Overview Dashboard
View general information on the Overview Dashboard for Splunk.
diff --git a/docs/activitymonitor/8.0/siem/splunk/app/permissionchanges.md b/docs/activitymonitor/8.0/siem/splunk/app/permissionchanges.md
index c15858bcd5..9ea8d4a04f 100644
--- a/docs/activitymonitor/8.0/siem/splunk/app/permissionchanges.md
+++ b/docs/activitymonitor/8.0/siem/splunk/app/permissionchanges.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Permission Changes Dashboard
-View information on permissions changes on the through the Permission Changes Dashboard for Splunk.
+View information on permission changes through the Permission Changes Dashboard for Splunk.
diff --git a/docs/activitymonitor/8.0/siem/splunk/overview.md b/docs/activitymonitor/8.0/siem/splunk/overview.md
index 1a950215c5..42789f8dc6 100644
--- a/docs/activitymonitor/8.0/siem/splunk/overview.md
+++ b/docs/activitymonitor/8.0/siem/splunk/overview.md
@@ -16,8 +16,7 @@ enabling Splunk to correlate file system activity with any log source.
This document describes how to integrate Netwrix products with the Stealthbits File Activity
Monitor App for Splunk found in Splunkbase. Any Netwrix product can be configured to monitor file
-system activity and send the monitored events to Splunk. After installing this app, ensure that
-either theActivity Monitor, Threat Prevention, or Access Analyzer has been configured to send events
+system activity and send the monitored events to Splunk. After installing this app, configure either the Activity Monitor, Threat Prevention, or Access Analyzer to send events
to Splunk. See the product user guide on the
[Netwrix Technical Knowledge Center](https://helpcenter.netwrix.com/) for additional information.
@@ -31,7 +30,7 @@ Activity Monitor App for Splunk, follow the
Splunk to install the app.
:::note
-In order to use the Ransomware dashboard within the app, install
+To use the Ransomware dashboard within the app, install
[Splunk User Behavior Analytics](https://www.splunk.com/en_us/products/premium-solutions/user-behavior-analytics.html)
(any version) and the [Machine Learning Toolkit](https://splunkbase.splunk.com/app/2890/) app for
Splunk (version 2.0.0+).
@@ -39,52 +38,42 @@ Splunk (version 2.0.0+).
The Stealthbits: File Activity Monitor tab will appear within the Splunk web interface. Once
-installation of the Stealthbits File Activity Monitor App for Splunk is complete, it must be
-configured to receive data from either theActivity Monitor or Threat Prevention.
+installation of the Stealthbits File Activity Monitor App for Splunk is complete, configure it to receive data from either the Activity Monitor or Threat Prevention.
## Initial Configuration of the Splunk App
-Follow the steps to configure Splunk to receive data from Stealthbits products.
-
-**Step 1 –** Determine the IP Address of the Splunk Console, e.g. run the ifconfig command. This
+1. Determine the IP Address of the Splunk Console—for example, run the ifconfig command. This
information is required for the following sections:
- See the Syslog Tab section in the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor)
- for information on how to configure the Activity Monitor to send data to QRadar.
+ for information on how to configure the Activity Monitor to send data to Splunk.
- See the SIEM Tab section in the
[Netwrix Threat Prevention Documentation](https://helpcenter.netwrix.com/category/threatprevention)
- for information on how to configure Threat Prevention to send data to QRadar.
-
-**Step 2 –** Navigate to the Settings menu in the Splunk web interface and click Data Inputs.
-
-**Step 3 –** Select UDP.
-
-**Step 4 –** Click New and add a new data input with Port 514. If another Splunk UDP input is
-already using 514, another value (515 or higher) can be used as long as it is not blocked by the
-network. Remember to configure the port within the Stealthbits product configuration to align with
-this change.
-
-**Step 5 –** Click Next.
-
-**Step 6 –** Under Input Settings, enter the following information:
-
-- Source Type – Enter one of the following options:
- - For data coming from the Stealthbits Activity Monitor – SFAM
- - For data coming from Threat Prevention – Threat Prevention
-- App context – Select Search and Reporting
-- Host – Select IP
-- Index – Select Default
-
-**Step 7 –** Review and save the new settings. Remember, prior to using the Stealthbits File
-Activity Monitor App for Splunk, the related Stealthbits products must be configured to send data to
+ for information on how to configure Threat Prevention to send data to Splunk.
+
+2. Navigate to the **Settings** menu in the Splunk web interface and click **Data Inputs**.
+3. Select **UDP**.
+4. Click **New** and add a new data input with Port 514. If another Splunk UDP input is
+already using 514, you can use another value (515 or higher) as long as it isn't blocked by the
+network. Configure the port within the Stealthbits product configuration to match this change.
+5. Click **Next**.
+6. Under **Input Settings**, enter the following information:
+ - Source Type – Enter one of the following options:
+ - For data from Stealthbits Activity Monitor: SFAM
+ - For data from Threat Prevention: Threat Prevention
+ - App context – Select **Search and Reporting**
+ - Host – Select **IP**
+ - Index – Select **Default**
+7. Review and save the new settings. Before using the Stealthbits File
+Activity Monitor App for Splunk, configure the related Stealthbits products to send data to
Splunk.
-**Step 8 –** Test that the configuration is working correctly. Check the **Search and Reporting**
-app inside of the web console for Splunk (search for **SFAM or StealthINTERCEPT**). There should be
-logs of events which are generated as soon as Splunk starts receiving data. If there are no events,
-use a packet sniffer to ensure that packets are being sent correctly between the hosts, and diagnose
-any possible network issues.
+8. Test that the configuration is working correctly. Check the **Search and Reporting**
+app in the Splunk web console (search for **SFAM** or **StealthINTERCEPT**). There should be
+logs of events generated as soon as Splunk starts receiving data. If there are no events,
+use a packet sniffer to verify that packets are being sent correctly between the hosts, and diagnose
+any network issues.
The Stealthbits File Activity Monitor App for Splunk can now display activity data from either the
Stealthbits Activity Monitor or StealthINTERCEPT.
diff --git a/docs/activitymonitor/8.0/troubleshooting/antivirusexclusions.md b/docs/activitymonitor/8.0/troubleshooting/antivirusexclusions.md
index edd6366144..e0237e56ce 100644
--- a/docs/activitymonitor/8.0/troubleshooting/antivirusexclusions.md
+++ b/docs/activitymonitor/8.0/troubleshooting/antivirusexclusions.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Antivirus Exclusions
Windows activity monitoring and performance of the Activity Agent may be negatively affected by
-antivirus protections. Add the following components to antivirus exclusions in order to avoid
+antivirus protections. Add the following components to antivirus exclusions to avoid
potential performance degradation.
## Directories
diff --git a/docs/activitymonitor/8.0/troubleshooting/backuprestore/agentbackup.md b/docs/activitymonitor/8.0/troubleshooting/backuprestore/agentbackup.md
index 5274a85bcd..1350c77160 100644
--- a/docs/activitymonitor/8.0/troubleshooting/backuprestore/agentbackup.md
+++ b/docs/activitymonitor/8.0/troubleshooting/backuprestore/agentbackup.md
@@ -6,10 +6,6 @@ sidebar_position: 10
# Agent Backup
-Follow the steps to back up the configuration, passwords, Active Directory event data file, and
-activity log files for Activity Monitor Agents deployed on file system servers, SharePoint servers,
-and domain controllers.
-
**Configuration**
**Step 1 –** Back up the `SBTFileMon.ini` file. The default location is
@@ -48,8 +44,7 @@ default folder is
**C:\ProgramData\Netwrix\Activity Monitor\Agent\ActivityLogs**
:::note
-Keep in mind that` C:\ProgramData` folder may be hidden. Navigate to it by typing
-`%ALLUSERSPROFILE%` in the File Explorer.
+The `C:\ProgramData` folder may be hidden. Navigate to it by typing `%ALLUSERSPROFILE%` in the File Explorer.
:::
diff --git a/docs/activitymonitor/8.0/troubleshooting/backuprestore/agentrestore.md b/docs/activitymonitor/8.0/troubleshooting/backuprestore/agentrestore.md
index ae6bfdf79f..f0c23fc3b6 100644
--- a/docs/activitymonitor/8.0/troubleshooting/backuprestore/agentrestore.md
+++ b/docs/activitymonitor/8.0/troubleshooting/backuprestore/agentrestore.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# Agent Restoration
-Follow the steps to restore the configuration, Active Directory configuration file, and activity log
+To restore the configuration, Active Directory configuration file, and activity log
files for Activity Monitor Agents deployed on file system servers, SharePoint servers, and domain
-controllers.
+controllers, complete these steps:
:::warning
Restore the agent before restoring the console to ensure connectivity and monitoring
diff --git a/docs/activitymonitor/8.0/troubleshooting/backuprestore/consolebackup.md b/docs/activitymonitor/8.0/troubleshooting/backuprestore/consolebackup.md
index f0e06eeb35..e2d12f4b2b 100644
--- a/docs/activitymonitor/8.0/troubleshooting/backuprestore/consolebackup.md
+++ b/docs/activitymonitor/8.0/troubleshooting/backuprestore/consolebackup.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Console Backup
-Follow the steps to back up the list of agents managed on the Activity Monitor Console.
+Use the following steps to back up the list of agents managed on the Activity Monitor Console.
**Step 1 –** Back up the configuration file:
diff --git a/docs/activitymonitor/8.0/troubleshooting/backuprestore/consolerestore.md b/docs/activitymonitor/8.0/troubleshooting/backuprestore/consolerestore.md
index 3bdb18b487..e7df49cedd 100644
--- a/docs/activitymonitor/8.0/troubleshooting/backuprestore/consolerestore.md
+++ b/docs/activitymonitor/8.0/troubleshooting/backuprestore/consolerestore.md
@@ -6,8 +6,6 @@ sidebar_position: 40
# Console Restoration
-Follow the steps to restore the list of agents managed on the Activity Monitor Console.
-
**Step 1 –** Restore `Agents.ini` file.
**Step 2 –** Restore `FileMonitor.lic` file.
diff --git a/docs/activitymonitor/8.0/troubleshooting/performancemonitoring.md b/docs/activitymonitor/8.0/troubleshooting/performancemonitoring.md
index 1d10293ce7..0d83ab5b66 100644
--- a/docs/activitymonitor/8.0/troubleshooting/performancemonitoring.md
+++ b/docs/activitymonitor/8.0/troubleshooting/performancemonitoring.md
@@ -24,7 +24,7 @@ The following performance counters are provided by Activity Monitor.
| NetApp | ✔ | Activity Monitor - NetApp\Session Negotiated | Number of connections established with ONTAP cluster nodes |
| NetApp | ✔ | Activity Monitor - NetApp\Active Connections | Number of active connections with ONTAP cluster nodes |
| NetApp | | Activity Monitor - NetApp\Outage Files | Number of outage (resilience) files processed |
-| NetApp | ✔ | Activity Monitor - NetApp\Overloaded | Number of times the agent was overloaded and had to limit the rate of events. This counter may increase from time to time when processing large batches of events. But if it keeps increasing, it is a sure sign that the agent is not coping with the load. Consider moving some SVMs to another agent or spreading the load from one SVM across multiple agents. |
+| NetApp | ✔ | Activity Monitor - NetApp\Overloaded | Number of times the agent was overloaded and had to limit the rate of events. This counter may increase from time to time when processing large batches of events. But if it keeps increasing, it is a sure sign that the agent isn't coping with the load. Consider moving some SVMs to another agent or spreading the load from one SVM across multiple agents. |
| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Received | Number of events received from CEE |
| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Received/sec | Rate at which events are received from CEE |
| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Reported | Number of events passed the filters and being reported to outputs |
@@ -35,7 +35,7 @@ The following performance counters are provided by Activity Monitor.
| Outputs | ✔ | Activity Monitor - Outputs\Events Reported/sec | Rate at which events are reported |
| Outputs | | Activity Monitor - Outputs\Events Reported to Files | Total number of events reported to log files |
| Outputs | | Activity Monitor - Outputs\Events Reported to Syslog | Total number of events reported to syslog servers |
-| Outputs | | Activity Monitor - Outputs\Events Reported to AMQP | Total number of events reported to AMQP servers (not used currently) |
+| Outputs | | Activity Monitor - Outputs\Events Reported to AMQP | Total number of events reported to AMQP servers (not used ) |
| Outputs | ✔ | Activity Monitor - Outputs\Resolved SIDs | Number of attempts, both successful and failed, to resolve SIDs to names |
| Outputs | ✔ | Activity Monitor - Outputs\Resolved SIDs/sec | Rate at which SIDs are resolved to names |
| Outputs | ✔ | Activity Monitor - Outputs\Resolved SIDs Failures | Number of failed attempts to resolve SIDs to names |
@@ -55,8 +55,7 @@ The following performance counters are provided by Activity Monitor.
:::note
DNS and AD queries typically contribute the most to the processing time. Since the
resolution occurs in real time, slow responses can affect throughput (A 100ms DNS response limits
-the throughput to 10 events per second). Observing average and maximum values of DNS Queries Time,
-Resolved SIDs Time, and Translated UIDs Time allows you to estimate the response time.
+the throughput to 10 events per second). Use the average and maximum values of DNS Queries Time, Resolved SIDs Time, and Translated UIDs Time to estimate the response time.
:::
@@ -69,7 +68,7 @@ performance counters:
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Processor(\_Total)\% Processor Time | The percentage of elapsed time that the processor spends to execute a non-Idle thread. |
| Memory\Available MBytes | The amount of physical memory, in Megabytes, immediately available for allocation to a process or for system use. |
-| Paging File(\_Total)\% Usage | The percentage of the paging file that is currently in use. |
+| Paging File(\_Total)\% Usage | The percentage of the paging file that is in use. |
| TCPv4\Connections Reset | The rate of reset TCPv4 connections |
| TCPv4\Segments Received/sec | The quantity of segments received via TCPv4 per second. |
| TCPv4\Segments Retransmitted/Sec | Quantity of segments retransmitted via TCPv4 per second. |
@@ -79,7 +78,7 @@ performance counters:
| Network Interface(\*)\Bytes Sent/sec | From all network adapters: The rate at which bytes are sent. |
| Network Interface(\*)\Output Queue Length | From all network adapters: The length of the output packet queue (in packets). |
| Network Interface(\*)\Packets Received Discarded | From all network adapters: The number of inbound packets that were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. |
-| Network Interface(\*)\Packets Received Errors | From all network adapters: The number of inbound packets that contained errors. As a result, the errored packets were not delivered to a higher-layer protocol. |
+| Network Interface(\*)\Packets Received Errors | From all network adapters: The number of inbound packets that contained errors. As a result, the errored packets weren't delivered to a higher-layer protocol. |
| Process(ConfigurationAgent.Grpc.Host)\% Processor Time | For Agent: The percentage of elapsed time that all of process threads used the processor to execution instructions. |
| Process(ConfigurationAgent.Grpc.Host)\Elapsed Time | For Agent: The duration from when the process was started until the time it terminated. |
| Process(ConfigurationAgent.Grpc.Host)\Handle Count | For Agent: The number of operating system handles the process has opened. |
@@ -131,10 +130,10 @@ performance counters:
## Register Performance Counters
-The Activity Monitor performance counters are not registered by default and must be registered
+The Activity Monitor performance counters aren't registered by default and must be registered
manually.
-Follow the steps to register the Activity Monitor performance counters on each SAM Agent server.
+Use the following steps to register the Activity Monitor performance counters on each SAM Agent server.
**Step 1 –** Run `cmd.exe` as Administrator.
@@ -313,10 +312,10 @@ Get-Counter @variables | Export-Counter -FileFormat csv -Path $outputFile -Force
## Unregister Performance Counters
-When performance monitoring is not needed anymore, unregister the Activity Monitor performance
+When performance monitoring isn't needed anymore, unregister the Activity Monitor performance
counters.
-Follow the steps to unregister the Activity Monitor performance counters on each SAM Agent server.
+Use the following steps to unregister the Activity Monitor performance counters on each SAM Agent server.
**Step 1 –** Run `cmd.exe` as Administrator.
@@ -343,4 +342,4 @@ sc stop SBTLoggingSvc
**sc start SBFileMonAgentSvc**
-Once the services have been restarted, the Activity Monitor performance counters are unregistered.
+After the services restart, the Activity Monitor performance counters are unregistered.
diff --git a/docs/activitymonitor/8.0/troubleshooting/tracelogs.md b/docs/activitymonitor/8.0/troubleshooting/tracelogs.md
index bfcff94f43..13c9b9649f 100644
--- a/docs/activitymonitor/8.0/troubleshooting/tracelogs.md
+++ b/docs/activitymonitor/8.0/troubleshooting/tracelogs.md
@@ -8,7 +8,7 @@ sidebar_position: 20
While activity agents store activity logs on the servers where they are deployed, the Activity
Monitor creates Trace Logs that aid in troubleshooting issues. The Trace level option set in the
-drop-down list in the lower right corner of the Activity Monitor Console determines the kind of
+dropdown list in the lower right corner of the Activity Monitor Console determines the kind of
information kept in the activity agent and monitored hosts logs.
@@ -25,7 +25,7 @@ properties). Select from the following trace log levels:
- Fatal – Records only when catastrophic system failures / crashes occur
When the log level is changed in the Activity Monitor Console, the new log level is propagated and
-applied immediately to all of the activity agents that do not have custom trace setting.
+applied immediately to all of the activity agents that don't have custom trace setting.
:::note
Trace level can be adjusted in the Agent Properties for the selected agent. See the
diff --git a/docs/activitymonitor/9.0/admin/agents/activedirectory.md b/docs/activitymonitor/9.0/admin/agents/activedirectory.md
index a585fbcced..06d533016f 100644
--- a/docs/activitymonitor/9.0/admin/agents/activedirectory.md
+++ b/docs/activitymonitor/9.0/admin/agents/activedirectory.md
@@ -8,20 +8,19 @@ sidebar_position: 40
Before deploying the Active Directory (AD) agent, ensure all
[AD Agent Server Requirements](/docs/activitymonitor/9.0/requirements/adagent/adagent.md) have been met. To effectively
-monitor Active Directory, it is necessary to deploy an AD agent to every domain controller,
-including the read only domain controllers. However, it is possible to deploy the agents in batches.
-Follow the steps to deploy the AD agents to the domain controllers in the target domain.
+monitor Active Directory, deploy an AD agent to every domain controller,
+including the read only domain controllers. You can deploy the agents in batches.
:::note
These steps are specific to deploying AD agents for monitoring Active Directory.
:::
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
-**Step 2 –** Click on the Install agents on Active Directory domain controllers link to deploy
+**Step 2 –** Click the Install agents on Active Directory domain controllers link to deploy
activity agents to multiple domain controllers.
:::note
@@ -32,7 +31,7 @@ The Activity Monitor will validate the entered Host Name or IP Address entered
-**Step 3 –** Specify the port that should be used by the new agent(s).
+**Step 3 –** Specify the port that should be used by the new agents.
@@ -77,24 +76,23 @@ controllers to monitor all activity of the domain.
-**Step 8 –** Click the **Test** button to verify the connection to the domains selected. Once the
+**Step 8 –** Click the **Test** button to verify the connection to the domains selected. After the
connection is verified, click **Next** to continue.
**Step 9 –** On the Windows Agent Settings page, there are two settings to configure.
-- Add Windows file activity monitoring – Select the check box to add Windows file activity
+- Add Windows file activity monitoring – Select the checkbox to add Windows file activity
monitoring after installing the agent. By default a new agent install monitors nothing. If
administrators want to monitor file activity on Windows servers, it is easier to enable it after
installation of the agent. Windows file activity monitoring can be enabled and configured later in
the console.
- Management Group – By default, the agent only accepts commands from members of the
BUILTIN\Administrators group. Less privilege accounts can be configured to manage the agent with
- the Management Group setting. Keep in mind that only administrators can install, update and
- uninstall the agent.
+ the Management Group setting. Only administrators can install, update, and uninstall the agent.
-**Step 10 –** Click **Finish**. The Add New Agent(s) window closes, and the activity agent is
+**Step 10 –** Click **Finish**. The Add New Agents window closes, and the activity agent is
deployed to and installed on the target host.
During the installation process, the status will be Installing. If there are any errors, the
diff --git a/docs/activitymonitor/9.0/admin/agents/linux.md b/docs/activitymonitor/9.0/admin/agents/linux.md
index 832d088cec..3b319099b5 100644
--- a/docs/activitymonitor/9.0/admin/agents/linux.md
+++ b/docs/activitymonitor/9.0/admin/agents/linux.md
@@ -13,22 +13,20 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Manager
-Prior to adding a Windows host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Windows host to the Activity Monitor, the prerequisites for the target environment
must be met. See the [Linux Agent Server Requirements](/docs/activitymonitor/9.0/requirements/linuxagent.md) topic
for additional information.
## Deploy Linux Agent
-Follow the steps to deploy the agent to the Linux host.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
-
-
+
**Step 2 –** On the Install New Agent page, enter the server name for the Linux host. Click
**Next**.
@@ -40,7 +38,7 @@ is **4498**. Click **Next**.
-**Step 4 –** On the Credentials To Connect To The Server(s) page, connect to the Linux Server using
+**Step 4 –** On the Credentials To Connect To The Servers page, connect to the Linux Server using
either a **User name** and **Password**, or a Public Key.
The options for connecting with a Password are:
@@ -101,7 +99,7 @@ the failed connection.
**Step 6 –** On the Linux Agent Options page, select which user name to use to run the daemon. To
use root, leave the **Service user name** field blank. Click **Test** to test the connection.
-**Step 7 –** Click **Finish**. The Add New Agent(s) window closes, and the activity agent is
+**Step 7 –** Click **Finish**. The Add New Agents window closes, and the activity agent is
deployed to and installed on the target host.
During the installation process, the status will be **Installing**. If there are any errors,
@@ -113,12 +111,12 @@ When the Linux agent installation is complete, the status changes to **Installed
Host is also configured, and the added Linux host is displayed in the monitored hosts table. See the
[Monitored Hosts & Services Tab](/docs/activitymonitor/9.0/admin/monitoredhosts/overview.md) topic for additional information.
-Once a host has been added for monitoring, configure the desired outputs. See the
+After a host has been added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic for additional information.
:::info
Activity Monitor Agent uses certificates to secure the connection between the Linux Agent and the Console / API Server.
-By default, the Agent uses an automatically generated self-signed certificate. The Console and the API Server do not enforce
+By default, the Agent uses an automatically generated self-signed certificate. The Console and the API Server don't enforce
validity checks on these self-signed agent certificates.
This self-signed certificate can be replaced with one issued by a Certification Authority. Once replaced, the Console and
diff --git a/docs/activitymonitor/9.0/admin/agents/multiple.md b/docs/activitymonitor/9.0/admin/agents/multiple.md
index 52803fff42..d4893fbfae 100644
--- a/docs/activitymonitor/9.0/admin/agents/multiple.md
+++ b/docs/activitymonitor/9.0/admin/agents/multiple.md
@@ -7,8 +7,7 @@ sidebar_position: 20
# Multiple Activity Agents Deployment
Before deploying the activity agent, ensure all Prerequisites are met, including those for NAS
-devices when applicable. Follow the steps to deploy the activity agent to a multiple Windows
-servers. See the [Activity Agent Server Requirements](/docs/activitymonitor/9.0/requirements/activityagent/activityagent.md) topic
+devices when applicable. Deploy the activity agent to multiple Windows servers. See the [Activity Agent Server Requirements](/docs/activitymonitor/9.0/requirements/activityagent/activityagent.md) topic
for additional information.
:::note
@@ -17,7 +16,7 @@ environments.
:::
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
@@ -44,7 +43,7 @@ There are two methods for adding multiple hosts are:
**Manual Entry**
-Use **Manual Entry** to manually type the host names or IP addresses of the servers to be monitored.
+Use **Manual Entry** to manually enter the host names or IP addresses of the servers to be monitored.
@@ -76,9 +75,9 @@ For Import a List:
The Activity Monitor will monitor the Host Names or IP Address added to the **Install Agents on
Multiple Hosts** table. Click **Next**.
-
+
-**Step 5 –** On the Credentials To Connect To The Server(s) page, connect to the server using either
+**Step 5 –** On the Credentials To Connect To The Servers page, connect to the server using either
a **User name** and **password**, a Public Key, or a Client Certificate.
The options for connecting with a Password are:
@@ -86,7 +85,7 @@ The options for connecting with a Password are:
- User name
- Password
-
+
The options for connecting with a Public Key are:
@@ -107,7 +106,7 @@ Using an existing Client Certificate installs a new agent without using SSH.
**Step 6 –** Click **Connect** to test the connection. If the connection is successful, click
**Next**.
-The credentials are tested against each server added on the **Install Agent(s) on Multiple Hosts**
+The credentials are tested against each server added on the **Install Agents on Multiple Hosts**
page. If the connection is unsuccessful, see the status message that appears for information on the
failed connection. Activity agents are only successfully deployed for servers where the test status
returns Ok. Failed deployments can be retried through the Connection tab of the agent’s Properties
@@ -126,11 +125,10 @@ The default path is `C:\Program Files\Netwrix\Activity Monitor\Agent`. Click **N
monitoring after installation checkbox to enable monitoring all file system activity on the
targeted Windows server after installation.
- Management Group — By default, the agent only accepts commands from members from the
- BUILTIN\Administrators group. Less privileged accounts can be used to manage the agent with the
- Management group setting. Keep in mind that an administrator account must be used to install,
+ BUILTIN\Administrators group. With the Management group setting, less privileged accounts can manage the agent. An administrator account must be used to install,
upgrade, or uninstall an agent.
-**Step 9 –** Click Finish. The Add New Agent(s) window closes, and the activity agent is deployed to
+**Step 9 –** Click Finish. The Add New Agents window closes, and the activity agent is deployed to
and installed on the target host.
During the installation process, the status will be **Installing**. If there are any errors, the
diff --git a/docs/activitymonitor/9.0/admin/agents/overview.md b/docs/activitymonitor/9.0/admin/agents/overview.md
index 99ba201135..670354dd4b 100644
--- a/docs/activitymonitor/9.0/admin/agents/overview.md
+++ b/docs/activitymonitor/9.0/admin/agents/overview.md
@@ -12,9 +12,9 @@ available until an agent is installed.
The Agents tab is comprised of a button bar, a table of servers hosting activity agents, and an
-Agent Messages box. The button bar allows users to take the following actions:
+Agent Messages box. Users can take the following actions from the button bar:
-- Add Agent – Opens the Add New Agent(s) window to deploy the activity/AD agent to a single server
+- Add Agent – Opens the Add New Agents window to deploy the activity/AD agent to a single server
or to multiple servers at the same time. The following sections provide additional information:
- [Single Activity Agent Deployment](/docs/activitymonitor/9.0/admin/agents/single.md)
@@ -37,7 +37,7 @@ Agent Messages box. The button bar allows users to take the following actions:
- Install – Deploy or upgrade an activity agent to the selected host
- Upgrade – [When Agent Status is Outdated] Replaces outdated activity agent with current version
-- Update AD Module Installer – Allows you to select the newer AD Module installer. A confirmation
+- Update AD Module Installer – Select a newer AD Module installer. A confirmation
window then opens and identifies the new installer version. See the
[Update AD Module Installer](/docs/activitymonitor/9.0/install/upgrade/updateadagentinstaller.md) topic for additional
information.
@@ -46,7 +46,7 @@ Agent Messages box. The button bar allows users to take the following actions:
The table of servers hosting activity agents provides the following information:
- Server Name – Name or IP Address of the server hosting an activity agent
-- Status – Status of the deployed activity agent(s)
+- Status – Status of the deployed activity agents
:::note
If the AD agent has been deployed, a status of “outdated” could apply to either the
diff --git a/docs/activitymonitor/9.0/admin/agents/properties/activedirectory.md b/docs/activitymonitor/9.0/admin/agents/properties/activedirectory.md
index 12b48125b0..d23eea583c 100644
--- a/docs/activitymonitor/9.0/admin/agents/properties/activedirectory.md
+++ b/docs/activitymonitor/9.0/admin/agents/properties/activedirectory.md
@@ -12,7 +12,7 @@ be enabled for agents on domain controllers.
-The Agent Settings allow users to control the AD agent’s properties:
+Use the Agent Settings to control the AD agent’s properties:
- Harden the Agent – Protects the AD agent from being altered, stopped, or started from within the
local Service Control Manager
@@ -22,8 +22,8 @@ The Agent Settings allow users to control the AD agent’s properties:
:::note
This is a safety measure that disables monitoring if the environment changes as in
rare cases the instrumentation may cause LSASS crashes. Should the version change occur, a
- warning will be shown next to the agent on the Agents page. The **Start pending AD Module** button
- allows you to force the agent to enable monitoring.
+ warning will be shown next to the agent on the Agents page. Use the **Start pending AD Module** button
+ to force the agent to enable monitoring.
:::
@@ -32,7 +32,7 @@ The Agent Settings allow users to control the AD agent’s properties:
:::note
This provides more uniform data, but may have a performance impact on the machine
- where the AD agent is deployed, especially if that machine does not handle the name resolution
+ where the AD agent is deployed, especially if that machine doesn't handle the name resolution
locally.
:::
@@ -50,7 +50,7 @@ See the following sections for additional information:
## Configuring Threat Prevention to Send Active Directory Activity to Activity Monitor
-Once the activity agent is deployed to a domain controller with an existing Threat Prevention agent,
+After the activity agent is deployed to a domain controller with an existing Threat Prevention agent,
a connection can be secured between both agents. Follow these instructions to configure the policy
used for Active Directory Activity Monitoring from the Threat Prevention Admin Console.
diff --git a/docs/activitymonitor/9.0/admin/agents/properties/additionalproperties.md b/docs/activitymonitor/9.0/admin/agents/properties/additionalproperties.md
index 600db09f0d..51a4bc3f2e 100644
--- a/docs/activitymonitor/9.0/admin/agents/properties/additionalproperties.md
+++ b/docs/activitymonitor/9.0/admin/agents/properties/additionalproperties.md
@@ -17,7 +17,7 @@ The Additional Properties tab for the Activity Agent has the following configura
- Comment – Create an annotation for the agent in the **Comment** text box. Annotations entered here
will appear in the Comment column in the table on the Agents tab.
-- Agent's Trace Level – Select a trace level for the agent log from the drop-down list:
+- Agent's Trace Level – Select a trace level for the agent log from the dropdown list:
- Same Level as the Console (uses the global level selected in the console)
- Trace (the most verbose) many collection points and can slow down
@@ -34,7 +34,7 @@ The Additional Properties tab for the Activity Agent has the following configura
- Error
- Fatal
-In certain situations, the trace logs are not enough to identify issues. Collect extended debugging
+In certain situations, the trace logs aren't enough to identify issues. Collect extended debugging
data (ETW) can be useful for problems related to the following:
- Not getting events
@@ -47,7 +47,7 @@ When this is needed, enable the **Collect extended debugging data (ETW) from the
the Trace level is activated** option to diagnose these problems.
:::warning
-Selecting this option collects a large amount of data. Therefore, it is important to
+Selecting this option collects a large amount of data. Therefore,
enable it only for short periods of time. Otherwise, the trace file may overflow with data.
:::
@@ -66,7 +66,7 @@ The Additional Properties tab for the Linux Agent has the following configuratio
- Comment – Create an annotation for the agent in the **Comment** text box. Annotations entered here
will appear in the Comment column in the table on the Agents tab.
-- Agent's Trace Level – Select a trace level for the agent log from the drop-down list:
+- Agent's Trace Level – Select a trace level for the agent log from the dropdown list:
- Same Level as the Console (uses the global level selected in the console)
- Trace (the most verbose) many collection points and can slow down
diff --git a/docs/activitymonitor/9.0/admin/agents/properties/adusers.md b/docs/activitymonitor/9.0/admin/agents/properties/adusers.md
index 512720dcf5..2796dbe3ad 100644
--- a/docs/activitymonitor/9.0/admin/agents/properties/adusers.md
+++ b/docs/activitymonitor/9.0/admin/agents/properties/adusers.md
@@ -22,9 +22,9 @@ The configurable options are:
- Cache TTL for successful results –Specify the caching interval (time-to-live) for successful AD
responses.The default is 10 hours. When an AD query returns a valid username or SID, the response
is cached for the specified time. It is recommended to use large TTL values as the user
- information does not often change.
+ information doesn't often change.
- Cache TTL for failed results – Specify the caching interval (time-to-live) for failed AD
- responses. The default is 1 minute. When an AD query cannot resolve a SID or username, the failed
+ responses. The default is 1 minute. When an AD query can't resolve a SID or username, the failed
result is cached for the specified time. Caching of failed responses helps to reduce the load on
domain controllers and improve performance of event processing. Short TTL values are recommended
to make the product report accurate user information.
diff --git a/docs/activitymonitor/9.0/admin/agents/properties/apiserver.md b/docs/activitymonitor/9.0/admin/agents/properties/apiserver.md
index 43c5ffc223..44d7d504d4 100644
--- a/docs/activitymonitor/9.0/admin/agents/properties/apiserver.md
+++ b/docs/activitymonitor/9.0/admin/agents/properties/apiserver.md
@@ -13,7 +13,7 @@ activity.
-Check the Enable API access on this agent box to utilize the options on this tab:
+Check the Enable API access on this agent box to use the options on this tab:
- API server port (TCP): [number] (from 1000 to 65535) – Enter the API server port. The default
is 4494.
@@ -40,7 +40,7 @@ Click Add Application to open the Add or edit API client window.
configuration of monitored hosts/domain, enough to match the monitored hosts/services to their log
files.
- Read – Provides a read-only access to the list of the agents and their configuration settings;
- configuration of monitored domains; configuration of monitored hosts/services. The permission does not
+ configuration of monitored domains; configuration of monitored hosts/services. The permission doesn't
provide access to the saved passwords or other secrets.
- Policy change - Provides permissions required to update the AD Monitoring domain configuration
settings
diff --git a/docs/activitymonitor/9.0/admin/agents/properties/certificate.md b/docs/activitymonitor/9.0/admin/agents/properties/certificate.md
index ea5af4d73a..6b7498d169 100644
--- a/docs/activitymonitor/9.0/admin/agents/properties/certificate.md
+++ b/docs/activitymonitor/9.0/admin/agents/properties/certificate.md
@@ -9,7 +9,7 @@ sidebar_position: 5
Activity Monitor Agent uses certificates to secure the connection between the Linux Agent and the Console / API Server;
between NAS devices and the Agent; between the Agent and REST API users.
-By default, the Agent uses an automatically generated self-signed certificate. The Console and the API Server do not enforce
+By default, the Agent uses an automatically generated self-signed certificate. The Console and the API Server don't enforce
validity checks on these self-signed agent certificates.
This self-signed certificate can be replaced with one issued by a Certification Authority. Once replaced, the Console and
@@ -57,7 +57,7 @@ This CSR file will contain the agent’s hostname, FQDN, static IP addresses, op
The CSR files generated in the previous step must be manually submitted by a user to their Certification Authority. This process must be performed manually, outside of the Activity Monitor, due to the varying workflows and policies inherent to different Certification Authorities.
This step yields a set of certificate files for the agents issued by the Certification Authority based on the CSRs. The CA certificate itself also needs to be collected.
-Make sure that the agent certificates have the `Server Authentication` purpose listed in the Extended Key Usage extension and have DER or PEM encoding.
+ensure that the agent certificates have the `Server Authentication` purpose listed in the Extended Key Usage extension and have DER or PEM encoding.
If you are using OpenSSL’s Micro CA, you can generate a certificate from a CSR file using the `x509 -req` command.
@@ -80,19 +80,19 @@ If your deployment includes multiple Console instances, each instance must be up
## Using Self-Signed Certificates
-The **Manage certificates** wizard can be used to switch to automatically generated self-signed certificates. The wizard presents two options:
+Use the **Manage certificates** wizard to switch to automatically generated self-signed certificates. The wizard presents two options:
1. **Use existing self-signed certificates**
2. **Generate new private key and self-signed certificate**
The first option attempts to locate and apply a previously generated self-signed certificate, if one exists, that was in use prior
-to application of a CA-issued certificate. If the certificate does not exist, a new one will be created.
+to application of a CA-issued certificate. If the certificate doesn't exist, a new one will be created.
This approach may be beneficial in deployments with multiple instances of the Console or API Server that still rely on this specific
self-signed certificate, so its restoration would reinstate their operational status.
The second option will generate a new private key and a corresponding self-signed certificate for the agent.
-In the event of a suspected compromise of the agent's private key, this option should be employed.
+If you suspect the agent's private key has been compromised, use this option.
The **Apply Changes** button immediately applies the changes to the agents.
@@ -142,7 +142,7 @@ Parameters:
* `ca-file` - Path to the CA certificate file.
* `file` - Path to the agent's certificate file to apply.
-* `what-if` (optional) - If specified, the CA and agent certificates are validated, but the new certificate is not applied.
+* `what-if` (optional) - If specified, the CA and agent certificates are validated, but the new certificate isn't applied.
Use this option to check the certificates before applying.
### **Use Self-Signed Certificate**
diff --git a/docs/activitymonitor/9.0/admin/agents/properties/connection.md b/docs/activitymonitor/9.0/admin/agents/properties/connection.md
index 3434ba242b..cf1aa0028b 100644
--- a/docs/activitymonitor/9.0/admin/agents/properties/connection.md
+++ b/docs/activitymonitor/9.0/admin/agents/properties/connection.md
@@ -6,12 +6,12 @@ sidebar_position: 1
# Connection Tab
-The Connection tab allows users to modify the agent host server name and the credentials used for
+The Connection tab lets you modify the agent host server name and the credentials used for
installation and communication. The tab varies based on the type of agent selected.
## For Activity Agent
-The server name can be modified in the text box. Modifying the name value does not move the activity
+The server name can be modified in the text box. Modifying the name value doesn't move the activity
agent to a new server. The credentials can be updated or modified as well.
:::tip
@@ -37,14 +37,14 @@ This account must be:
- Membership in the local Administrators group
-If the user name is not specified, the currently logged in user's account will be used.
+If the user name isn't specified, the logged in user's account will be used.
**Less Privileged Permissions Option**
By default, the agent accepts commands only from members of the local Administrators group. You can
allow less privileged accounts to manage the agent with the **Management Group** option. Keep in
mind that you still need to be an administrator to install, upgrade, or uninstall the agent. The
-Management Group applies to the users of the console and API servers. The Management Group does not
+Management Group applies to the users of the console and API servers. The Management Group doesn't
restrict access to the agents, but grants access to its members in addition to existing members of
the local Administrators group.
@@ -52,9 +52,9 @@ The Specify account or group window is opened from a field where a Windows accou
-Follow the steps to use this window.
+To use this window:
-**Step 1 –** Select the Domain from the drop-down menu.
+**Step 1 –** Select the Domain from the dropdown menu.
**Step 2 –** Enter the Account in the textbox.
@@ -62,7 +62,7 @@ Follow the steps to use this window.
- Use the ellipsis (…) button to open the Select Users, Computers, Service Accounts, or Groups
window to browse for an account.
-**Step 3 –** Then click Resolve. A message displays indicating whether or not the account could be
+**Step 3 –** Then click Resolve. A message displays indicating whether the account could be
resolved.
**Step 4 –** If successful, click OK.
@@ -75,7 +75,7 @@ Properties window closes.
## For Linux Agent
-The server name can be modified in the text box. Modifying the name value does not move the Linux
+The server name can be modified in the text box. Modifying the name value doesn't move the Linux
agent to a new server. The credentials can be updated or modified as well.
:::tip
diff --git a/docs/activitymonitor/9.0/admin/agents/properties/dellceeoptions.md b/docs/activitymonitor/9.0/admin/agents/properties/dellceeoptions.md
index ee42ca935b..bfc2c37d38 100644
--- a/docs/activitymonitor/9.0/admin/agents/properties/dellceeoptions.md
+++ b/docs/activitymonitor/9.0/admin/agents/properties/dellceeoptions.md
@@ -7,7 +7,7 @@ sidebar_position: 70
# Dell CEE Options Tab
The Dell CEE Options tab provides options to configure Dell Common Event Enabler (CEE) settings for
-monitoring Dell devices. File activity monitoring leverages the Dell CEE to deliver activity events
+monitoring Dell devices. File activity monitoring uses the Dell CEE to deliver activity events
from Dell devices.
CEE supports two protocols to deliver events to Activity Monitor: RPC and HTTP. An agent can receive
@@ -63,7 +63,7 @@ Properties window closes.
## Windows CEE Manual Configuration
Windows CEE is configured with the windows registry and depends on the selected event delivery mode,
-AUDIT or VCAPS.
+AUDIT, or VCAPS.
For the synchronous real-time delivery mode (AUDIT), use the following steps.
@@ -72,7 +72,7 @@ For the synchronous real-time delivery mode (AUDIT), use the following steps.
**Step 2 –** Set the `Enabled` parameter to 1.
-**Step 3 –** If the `EndPoint` parameter is empty, set it to the string listed below. If it is not
+**Step 3 –** If the `EndPoint` parameter is empty, set it to the string listed below. If it isn't
empty (i.e. some other 3rd party application is also receiving activity events from CEE), append the
following string to the existing `EndPoint` value, separating them with a semicolon.
@@ -89,7 +89,7 @@ For the asynchronous bulk delivery mode with a cadence based on a time period or
**Step 2 –** Set the `Enabled` parameter to 1.
-**Step 3 –** If the `EndPoint` parameter is empty, set it to the string listed below. If it is not
+**Step 3 –** If the `EndPoint` parameter is empty, set it to the string listed below. If it isn't
empty (i.e. some other 3rd party application is also receiving activity events from CEE), append the
following string to the existing `EndPoint` value, separating them with a semicolon.
@@ -219,7 +219,7 @@ Here's an example for the asynchronous delivery (VCAPS):
```
-Make sure to set `Enabled` to `1` only in `Audit` or `VCAPS` if Activity Monitor is the only product
+ensure to set `Enabled` to `1` only in `Audit` or `VCAPS` if Activity Monitor is the only product
receiving activity from CEE. Otherwise, enable the modes according to all product requirements.
If you want to send activity to several 3rd party applications, separate them with semicolons.
diff --git a/docs/activitymonitor/9.0/admin/agents/properties/dns.md b/docs/activitymonitor/9.0/admin/agents/properties/dns.md
index 5f116d918b..b37a26c1af 100644
--- a/docs/activitymonitor/9.0/admin/agents/properties/dns.md
+++ b/docs/activitymonitor/9.0/admin/agents/properties/dns.md
@@ -15,7 +15,7 @@ The configurable options are:
- Enable local DNS cache service – Select this checkbox to enable the local DNS cache service. Leave
the option unchecked to disable the local DNS cache service. The DNS cache service proactively
updates data, keeping DNS records up to date and available for real-time event reporting. Use this
- option if your DNS infrastructure cannot handle the load (requests take hundreds of milliseconds)
+ option if your DNS infrastructure can't handle the load (requests take hundreds of milliseconds)
during peak hours.
- DNS servers (IPs) – IP addresses of the DNS servers to be used for look-ups. IP addresses should
be entered as separate addresses with space, comma (,), semicolon (;), or a multi-line list. Leave
@@ -31,7 +31,7 @@ The configurable options are:
the load on DNS servers but may result in stale data being reported.
If the DNS Cache service is used, the records are automatically updated when the TTL expires.
- Cache TTL for failed results – Specify the caching interval (time-to-live) for failed DNS
- responses. The default is 1 minute. When a DNS query cannot resolve an IP address or host-name,
+ responses. The default is 1 minute. When a DNS query can't resolve an IP address or host-name,
the failed result is cached for the specified time. Caching of failed responses helps to reduce
the load on DNS servers and improve performance of event processing.
If the DNS Cache service is used, the records are automatically updated when the TTL expires.
@@ -39,7 +39,7 @@ The configurable options are:
- Refresh throttle time – Specify the time interval between DNS queries that the DNS Cache service
uses to update expired records. The default is 1000 milliseconds.
If the DNS Cache service is used, the records are automatically updated when the TTL expires. This
- option allows you to limit the number of DNS requests the service sends to update the cache. A
+ option lets you limit the number of DNS requests the service sends to update the cache. A
throttling period of 100 milliseconds will limit the update task to 10 requests per second.
- Parallelism – Specify how many DNS requests the DNS Cache service is allowed to send in parallel.
High values may overload DNS servers.
diff --git a/docs/activitymonitor/9.0/admin/agents/properties/inactivityalerts.md b/docs/activitymonitor/9.0/admin/agents/properties/inactivityalerts.md
index bf22fbcd1b..d04c3afaab 100644
--- a/docs/activitymonitor/9.0/admin/agents/properties/inactivityalerts.md
+++ b/docs/activitymonitor/9.0/admin/agents/properties/inactivityalerts.md
@@ -35,10 +35,10 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:PORT format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:PORT format
in the text box. The server name can be short name, fully qualified name (FQDN), or IP Address, as
long as the organization’s environment can resolve the name format used.
-- Syslog protocol – Identify the **Syslog protocol** to be used for the alert. The drop-down menu
+- Syslog protocol – Identify the **Syslog protocol** to be used for the alert. The dropdown menu
includes:
- UDP
@@ -46,7 +46,7 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
- TLS
:::note
- The TCP and TLS protocols add the **Message framing** drop-down menu. **Message
+ The TCP and TLS protocols add the **Message framing** dropdown menu. **Message
framing** options include:
:::
@@ -61,7 +61,7 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
connection. A connection status message displays with either a green check mark or a red X
identifying the success of the sent test message. Messages vary by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -71,7 +71,7 @@ configured interval. The alert is sent to the Syslog configured on the **Syslog
-Custom templates can be created. Select the desired template or create a new template by modifying
+Custom templates can be created. Select the template you want or create a new template by modifying
an existing template within the Syslog Message Template window. The new message template is named
Custom.
@@ -84,7 +84,7 @@ configured interval. The alert is sent to the configured recipients on the Email
-- Syslog server in SERVER[:PORT] format – Type the **SMTP server name** with a SERVER:PORT format in
+- Syslog server in SERVER[:PORT] format – Enter the **SMTP server name** with a SERVER:PORT format in
the text box. The server name can be short name, fully qualified name (FQDN), or IP Address, as
long as the organization’s environment can resolve the name format used.
@@ -98,7 +98,7 @@ configured interval. The alert is sent to the configured recipients on the Email
- Message subject – Click the ellipsis (…) to open the Message Template window to customize the
- subject. Macros can be used to insert
+ subject. Use macros to insert values in the subject line. Refer to the Macros section below for available variables.
diff --git a/docs/activitymonitor/9.0/admin/agents/properties/netappfpolicyoptions.md b/docs/activitymonitor/9.0/admin/agents/properties/netappfpolicyoptions.md
index fca6569f53..48aa8f372e 100644
--- a/docs/activitymonitor/9.0/admin/agents/properties/netappfpolicyoptions.md
+++ b/docs/activitymonitor/9.0/admin/agents/properties/netappfpolicyoptions.md
@@ -15,7 +15,7 @@ The available options are:
- FPolicy server port (TCP): [number] (from 1000 to 65535) – Enter the FPolicy server port. The
default is 9999.
-- FPolicy authentication – Select from the following options in the drop-down list. For TLS server
+- FPolicy authentication – Select from the following options in the dropdown list. For TLS server
authentication, a Server certificate is required. For TLS, mutual authentication, a Server
certificate and Client certificate are required.
diff --git a/docs/activitymonitor/9.0/admin/agents/properties/networkproxy.md b/docs/activitymonitor/9.0/admin/agents/properties/networkproxy.md
index 2fece877f8..0ad53e5f3b 100644
--- a/docs/activitymonitor/9.0/admin/agents/properties/networkproxy.md
+++ b/docs/activitymonitor/9.0/admin/agents/properties/networkproxy.md
@@ -24,7 +24,7 @@ The configurable options are:
- User name – Specify a user name for the proxy server
- User password – Specify a password for the user name
-- Bypass list – Specify the Bypass list. This is a list of URIs that do not use the proxy server
+- Bypass list – Specify the Bypass list. This is a list of URIs that don't use the proxy server
when accessed. Multiple addresses can be entered separated by space, comma (,), semicolon (;), or
as a multi-line list.
diff --git a/docs/activitymonitor/9.0/admin/agents/properties/nutanix.md b/docs/activitymonitor/9.0/admin/agents/properties/nutanix.md
index 5d2e676f48..9166a7473c 100644
--- a/docs/activitymonitor/9.0/admin/agents/properties/nutanix.md
+++ b/docs/activitymonitor/9.0/admin/agents/properties/nutanix.md
@@ -19,7 +19,7 @@ The available Agent server settings for Nutanix are:
semicolon (;), or as a multi-line list. Leave the box blank to accept connections from any hosts.
:::note
- This setting is optional and it allows you to improve security by limiting the number
+ This setting is optional. Use it to improve security by limiting the number
of IP addresses allowed to connect.
:::
diff --git a/docs/activitymonitor/9.0/admin/agents/properties/overview.md b/docs/activitymonitor/9.0/admin/agents/properties/overview.md
index 59d2413086..132345cf81 100644
--- a/docs/activitymonitor/9.0/admin/agents/properties/overview.md
+++ b/docs/activitymonitor/9.0/admin/agents/properties/overview.md
@@ -28,6 +28,6 @@ tabs:
- [Qumulo Tab](/docs/activitymonitor/9.0/admin/agents/properties/qumulo.md) – Activity Agent only
- [Additional Properties Tab](/docs/activitymonitor/9.0/admin/agents/properties/additionalproperties.md)
-Select the desired agent and click **Edit** to open the agent’s Properties window.
+Select the agent you want and click **Edit** to open the agent’s Properties window.
diff --git a/docs/activitymonitor/9.0/admin/agents/single.md b/docs/activitymonitor/9.0/admin/agents/single.md
index bc44fc463d..6c5be513d0 100644
--- a/docs/activitymonitor/9.0/admin/agents/single.md
+++ b/docs/activitymonitor/9.0/admin/agents/single.md
@@ -8,8 +8,8 @@ sidebar_position: 10
Before deploying the activity agent, ensure all
[Activity Agent Server Requirements](/docs/activitymonitor/9.0/requirements/activityagent/activityagent.md) have been met,
-including those for NAS devices when applicable. Follow the steps to deploy the activity agent to a
-single Windows server.
+including those for NAS devices when applicable. To deploy the activity agent to a
+single Windows server, follow these steps:
:::note
These steps are specific to deploying activity agents for monitoring supported target
@@ -17,7 +17,7 @@ environments.
:::
-**Step 1 –** On the Agents tab, click Add agent to open the Add New Agent(s) window.
+**Step 1 –** On the Agents tab, click Add agent to open the Add New Agents window.
@@ -29,9 +29,9 @@ a single server. Leave the field blank to deploy the agent on the local server.
**Step 3 –** On the Specify Port page, specify the port that should be used by the new agent. The
default port is 4498. Click **Next**.
-
+
-**Step 4 –** On the Credentials To Connect To The Server(s) page, select either Windows or Linux file
+**Step 4 –** On the Credentials To Connect To The Servers page, select either Windows or Linux file
monitoring. Then, enter the **User name** and **Password** to connect to the API Server.
@@ -54,12 +54,11 @@ default path is `C:\Program Files\Netwrix\Activity Monitor\Agent`. Click **Next*
installation. Alternatively, the Windows monitoring can be enabled later on the Monitored Hosts & Services
tab.
- Management Group — By default, the agent only accepts commands from members from the
- BUILTIN\Administrators group. Less privileged accounts can be used to manage the agent with the
- Management group setting. Keep in mind that an administrator account must be used to install,
- upgrade or uninstall an agent. The value must be a domain or local security group entered in the
+ BUILTIN\Administrators group. With the Management group setting, less privileged accounts can manage the agent. An administrator account must be used to install,
+ upgrade, or uninstall an agent. The value must be a domain or local security group entered in the
DOMAIN\groupname format.
-**Step 8 –** Click Finish. The Add New Agent(s) window closes, and the activity agent is deployed to
+**Step 8 –** Click Finish. The Add New Agents window closes, and the activity agent is deployed to
and installed on the target host.
During the installation process of the agent, the status will display Installing. If there are any
diff --git a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/authentication.md b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/authentication.md
index 9e6592f894..98b9158671 100644
--- a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/authentication.md
+++ b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/authentication.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Authentication Tab
-The Authentication tab on a domain’s Configuration window allows users to configure communication
+The Authentication tab on a domain’s Configuration window lets you configure communication
with servers.
@@ -27,7 +27,7 @@ sub-tabs:
The Forged Privilege Account Certificate (PAC) analytic type identifies Kerberos tickets with a
modified PAC. By manipulating the PAC, a field in the Kerberos ticket that contains a user’s
-authorization data (in Active Directory this is group membership), an attacker is able to grant
+authorization data (in Active Directory this is group membership), an attacker can grant
themselves additional elevated privileges.
@@ -36,7 +36,7 @@ Double-click text box to enter specific **RIDs**. Click OK. The AD agent then co
PAC and user’s access token for a mismatch to trigger the incident.
:::note
-The Forged PAC analytic is monitoring for when the user is not a member of a group that is
+The Forged PAC analytic is monitoring for when the user isn't a member of a group that is
listed in the PAC section of the user’s Kerberos ticket. This analytic can be scoped to monitor
specific groups. To reduce the number of false positives, the AD agent only checks for a mismatch of
sensitive groups as selected in the policy Settings tab.
@@ -91,7 +91,7 @@ Underneath each section, there is an additional Address detail:
- Value – Must be provided in IP address format
-Double-click the text box beneath **Value** to enter the desired IP Addresses to include or exclude.
+Double-click the text box beneath **Value** to enter the IP Addresses you want to include or exclude.
Press the Enter or Tab key to add another text box.
## IP Addresses (To)
@@ -106,7 +106,7 @@ Underneath each section, there is an additional Address detail:
Value – Must be provided in IP address format
-Double-click the text box beneath **Value** to enter the desired IP Addresses to include or exclude.
+Double-click the text box beneath **Value** to enter the IP Addresses you want to include or exclude.
Press the Enter or Tab key to add another text box.
## Operations
@@ -122,7 +122,7 @@ failed events, or both:
- Failure – Monitors failed events
The **Monitor These Protocols** section is where authentication protocols to be monitored are
-selected for the policy. Check the box to select the authentication protocol(s) to be monitored:
+selected for the policy. Check the box to select the authentication protocols to be monitored:
- All
- Kerberos
@@ -140,7 +140,7 @@ Local Interactive and/or Remote Interactive logins to the Domain Controllers:
- All - Report all authentication activity approved by the Domain Controller which includes any
local or RDP direct connections to the DC.
- - Local - Report only local login to the Domain Controller - ignore all else
+ - Local - Report only local log in to the Domain Controller - ignore all else
- Remote - Report only remote/RDP access to the Domain Controller - ignore all else
- Exclude failed authentications with previously valid (N-2) password – If enabled, allows to ignore
@@ -157,7 +157,7 @@ The Servers option targets servers to be included or excluded when filtering for
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another text box.
## Users
@@ -184,7 +184,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath **Type** to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath **Type** to enter the AD object you want to include or
exclude. Press the Enter or Tab key to add another text box. Check the box under **Subtree** to
include or exclude child contexts.
diff --git a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/changes.md b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/changes.md
index cbda892375..f64cbb4380 100644
--- a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/changes.md
+++ b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/changes.md
@@ -11,7 +11,7 @@ changes made to the domain.
-After checking the Enable AD Changes box, the following event filters can be modified on the
+After checking the Enable AD Changes box, you can modify the following event filters on the
sub-tabs:
- Attributes
@@ -26,14 +26,13 @@ sub-tabs:
## Attributes
-The Attributes Tab is where monitoring can be scoped to include events with specific attributes
-within Active Directory. Further scoping of attributes can enable monitoring to only capture events
-based on the new value.
+The Attributes Tab is where you can scope monitoring to include events with specific attributes
+within Active Directory. You can further scope attributes to capture events based only on the new value.
-Double-click the text box beneath Name to enter the desired attribute to include or exclude.
-Double-click the text box beneath Value to enter the desired attribute value to reference. Choose
+Double-click the text box beneath Name to enter the attribute to include or exclude.
+Double-click the text box beneath Value to enter the attribute value to reference. Choose
the Operation to relate the Name and Value with. Press the **Enter** or **Tab** key to add another
textbox.
@@ -43,27 +42,27 @@ Name field must contain Active Directory attribute name.
Scoping the filter captures events when the new value matches with the supplied value. To scope the
-filter based on the new value of the attribute, use the Operation drop-down menu.
+filter based on the new value of the attribute, use the Operation dropdown menu.
- AnyValue – No scoping applied for this attribute
- EmptyValue – Blank attribute values
- Equal – Attribute values that are identical to the Value field
-- NotEqual – Attribute values that do not match the Value field
+- NotEqual – Attribute values that don't match the Value field
- LessThan – Attribute values below the supplied numeric value or before alphabetically
- GreaterThan – Attribute values above the supplied numeric value or after alphabetically
- Contains – Attribute values includes the user supplied string (numbers are treated as strings)
-- NotContain – Attribute values do not include the user supplied string (numbers are treated as
+- NotContain – Attribute values don't include the user supplied string (numbers are treated as
strings)
- Startswith – Attribute values start with the user supplied string
## Classes
-The Classes Tab is where the policy can be scoped to only monitor specific classes within Active
-Directory or to exclude specific classes from being monitored.
+The Classes Tab is where you can scope the policy to monitor only specific classes within Active
+Directory or exclude specific classes from monitoring.
-Double-click the text box beneath Name to enter the desired classes to include or exclude. Press the
+Double-click the text box beneath Name to enter the classes to include or exclude. Press the
**Enter** or **Tab** key to add another text box.
:::note
@@ -75,9 +74,8 @@ only last value of this multi-valued attribute. For example, for
## Context
-The Context Tab is where the policy can be scoped to only monitor specific contexts (e.g. Containers
-and Organizational Units) within Active Directory or to exclude specific contexts from being
-monitored.
+The Context Tab is where you can scope the policy to monitor only specific contexts (e.g. Containers
+and Organizational Units) within Active Directory or exclude specific contexts from monitoring.
@@ -88,15 +86,14 @@ Underneath each section, there are additional Context details:
- Distinguished Name – Field must be specified in the form of `distinguishedName` attribute syntax,
e.g. `CN=Users,DC=Domain,DC=com`
-Double-click the text box beneath Distinguished Name to enter the desired context to include or
+Double-click the text box beneath Distinguished Name to enter the context to include or
exclude. Press the **Enter** or **Tab** key to add another text box. Check the box under Subtree to
include or exclude child contexts.
## Host (From)
-The Hosts (from) Tab is where the policy can be scoped to only monitor specific hosts as originators
-of an authentication event or to exclude specific hosts from being monitored for authentication
-events.
+The Hosts (from) Tab is where you can scope the policy to monitor only specific hosts as originators
+of an authentication event or exclude specific hosts from monitoring for authentication events.
@@ -112,9 +109,8 @@ from change event collection.
## IP Addresses (From)
-The IP Addresses (from) Tab is where the policy can be scoped to only monitor specific IP Addresses
-as originators of an authentication event or to exclude specific IP Addresses from being monitored
-for authentication events.
+The IP Addresses (from) Tab is where you can scope the policy to monitor only specific IP Addresses
+as originators of an authentication event or exclude specific IP Addresses from monitoring for authentication events.
@@ -122,13 +118,13 @@ Underneath each section, there is an additional Address detail.
- Value – Must be provided in IP address format
-Double-click the text box beneath **Value** to enter the desired IP addresses to include or exclude.
+Double-click the text box beneath **Value** to enter the IP addresses to include or exclude.
Press **Enter** or **Tab** key to add another text box.
## Objects
-The Objects Tab is where the policy can be scoped to only monitor specific objects within Active
-Directory or to exclude specific objects from being monitored.
+The Objects Tab is where you can scope the policy to monitor only specific objects within Active
+Directory or exclude specific objects from monitoring.
@@ -137,7 +133,7 @@ Underneath each section, there is an additional Object detail.
- Distinguished Name – Field must be specified in the form of `distinguishedName` attribute syntax,
e.g. `CN=Users,DC=Domain,DC=com`
-Double-click the text box beneath Distinguished Name to enter the desired objects to include or
+Double-click the text box beneath Distinguished Name to enter the objects to include or
exclude. Press the **Enter** or **Tab** key to add another text box.
## Operations
@@ -151,12 +147,12 @@ Monitor These Attempts – Filter for successful events, failed events, or both
- Success – Monitors successful events
- Failure – Monitors failed events
-Operations – Filter for Active Directory events to be monitored.
+Operations – Filter for Active Directory events to monitor.
-- Object Added – Monitors for objects being added to Active Directory
-- Object Deleted – Monitors for objects being deleted from Active Directory
-- Object Modified – Monitors for objects being modified within Active Directory
-- Object Moved or Renamed – Monitors for objects being moved or renamed within Active Directory
+- Object Added – Monitors objects added to Active Directory
+- Object Deleted – Monitors objects deleted from Active Directory
+- Object Modified – Monitors objects modified within Active Directory
+- Object Moved or Renamed – Monitors objects moved or renamed within Active Directory
## Servers
@@ -167,14 +163,13 @@ The Servers Tab targets servers to be included or excluded when filtering for ch
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers to include or exclude. Press the
Enter or Tab key to add another text box.
## Users
-The Users Tab is where the policy can be scoped to only monitor specific security principals
-committing changes within Active Directory or to exclude specific users committing changes from
-being monitored.
+The Users Tab is where you can scope the policy to monitor only specific security principals
+committing changes within Active Directory or exclude specific users committing changes from monitoring.
@@ -194,7 +189,7 @@ The following details appear beneath both sections.
e.g. `CN=Users,DC=Domain,DC=com`. However, for objects with `sidType` type, it must be in the form
of WellKnownSidType Enum, e.g. `AnonymousSid` or `LocalSid`.
-Double-click the text box beneath **Distinguished Name** to enter the desired group types to include
-or exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath **Distinguished Name** to enter the group types to include
+or exclude. Double-click the text box beneath Type to enter the AD object to include or
exclude. Press the **Enter** or **Tab** key to add another text box. Check the box under Subtree to
include or exclude child contexts.
diff --git a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md
index 05af6502bb..4b68ba5eae 100644
--- a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md
+++ b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md
@@ -12,14 +12,14 @@ from being monitored.
The filter options are grouped by AD Global Pre-Filters, and Authentication Global Pre-Filters.
-Check the boxes to activate the filters. To disable for diagnostic purposes, simply uncheck the
-option(s) and click OK. All Authentication Global Pre-Filters options require configuration before
-they can be enabled.
+Check the boxes to activate the filters. To disable for diagnostic purposes, uncheck the
+options and click OK. You must configure all Authentication Global Pre-Filters options before
+you can enable them.
Enable all of the AD Global Pre-Filters options as well as the Exclude Logins from Machine Accounts
option in the Authentication Global Pre-Filters section.
-When activated, the AD Agent(s) filters out the event data according to configuration defined in the
+When activated, the AD Agents filters out the event data according to configuration defined in the
`filters.json` file located in the installation directory.
The configurable options in the Global Filters tab are:
@@ -34,8 +34,7 @@ The ‘Help’ icon (**?**) opens a window that explains the type of “noise”
## Exclude ‘Noise’ Events Option
-This option is enabled by default to filter out login and internal low level attributes which can be
-considered ‘noise’ events. This option can be scoped to include any combination to the following
+This option is enabled by default to filter out login and internal low level attributes that are ‘noise’ events. You can scope this option to include any combination of the following
‘noise’ events:
- Successful AD User Logins – Excludes events with the following attributes where ‘objectClass’ does
@@ -47,7 +46,7 @@ considered ‘noise’ events. This option can be scoped to include any combinat
- lastLogonTimestamp
- AD User Logins with Bad Password – Excludes events with the following set of attributes where
- ‘objectClass’ does not equal computer:
+ ‘objectClass’ doesn't equal computer:
- badPwdCount
- badPasswordTime
@@ -88,12 +87,11 @@ Global Filters tab.
:::note
Only perpetrators with accounts ending in “$” are considered for this filter. Wild cards
-(\*) can be used for partial matches to account names.
+Use (\*) for partial matches to account names.
:::
-All machine accounts in the textbox are either included or excluded from event data monitoring by
-the AD Agent. Machine accounts not in the list have the unselected property applied.
+The AD Agent either includes or excludes all machine accounts in the textbox from event data monitoring. Machine accounts not in the list remain unselected.
Repeat the process until all machine accounts to be included or excluded from Authentication event
data have been entered in the list. Then click **OK**.
@@ -105,7 +103,7 @@ accounts include
“$” in their names so by default authentication traffic generated by these accounts is filtered out because they ‘look’ like machine accounts, which prior to Server 2012 were the only account names ending in “$”.
The ability to add a list of filter strings to the “Exclude Logins from Machine Accounts” global
filter provides a means to capture activity by gMSA type accounts as this activity is typically of
-interest where as true ‘machine accounts’ is not. By supplying either an explicit list of gMSA
+interest where as true ‘machine accounts’ isn't. By supplying either an explicit list of gMSA
account names, or if a naming convention has been adopted, a set of wild card strings such as
“gMSA\*” or “svc\*”, allows capturing authentication activity from such accounts while ignoring the
noisy ‘machine accounts’.
@@ -119,7 +117,7 @@ selected hosts link to open the Edit Hosts window.
The Exclude Authentication Events from selected hosts collection is only accessible for
configuration through the Global Filters tab. All three methods of identification for a host (IP
-Address, NETBIOS host name, or DNS host name) must be known in order to effectively exclude
+Address, NETBIOS host name, or DNS host name) must be known to effectively exclude
authentication from the host. Identify the host to be excluded in the textbox of the IP Address
column and press the Enter or Tab to add another row on the grid. Activity Monitor attempts to
discover the NETBIOS host name and the DNS host name associated with the supplied IP Address.
diff --git a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md
index 18b3805a24..80117bc0b0 100644
--- a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md
+++ b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapmonitor.md
@@ -6,12 +6,12 @@ sidebar_position: 60
# LDAP Monitor Tab
-The LDAP Monitor tab on a domain’s Configuration window allows users to scope monitoring by adding
+Use the LDAP Monitor tab on a domain’s Configuration window to scope monitoring by adding
filters for accounts by name or type.
-After checking the Enable Ldap Monitor box, the following event filters can be modified on the
+After checking the Enable Ldap Monitor box, you can modify the following event filters on the
sub-tabs:
- Host (From)
@@ -20,13 +20,12 @@ sub-tabs:
- Servers
- Users
-Each filter tab acts like an “AND” statement for the filter. Any filter tab left blank is treated
-like an all for that filter set.
+Each filter tab acts like an “AND” statement for the filter. Any filter tab left blank applies to all values for that filter set.
## Host (From)
-The Hosts (from) option is where the policy can be scoped to only monitor specific hosts as
-originators of an authentication event or to exclude specific hosts from being monitored for
+The Hosts (from) option is where you can scope the policy to monitor only specific hosts as
+originators of an authentication event or exclude specific hosts from monitoring for
authentication events.
@@ -51,7 +50,7 @@ The Query section is where monitoring can be scoped to those LDAP queries that c
of the user-supplied string as a substring in BaseDN or in Query field of the LDAP Search request.
For the Query value, provide the user-supplied string in the text box.
-Double-click the text box beneath Value to enter the desired string. Press the Enter or Tab key to
+Double-click the text box beneath Value to enter the string you want. Press the Enter or Tab key to
add another text box.
Example Values:
@@ -63,7 +62,7 @@ The Result section is where monitoring can be scoped to those LDAP query results
least one of the user-supplied string as a substring. For the Result value, provide the
user-supplied string in the text box.
-Double-click the text box beneath Value to enter the desired string. Press the Enter or Tab key to
+Double-click the text box beneath Value to enter the string you want. Press the Enter or Tab key to
add another text box.
Example Value:
@@ -91,14 +90,14 @@ The Servers option targets servers to be included or excluded when filtering for
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another text box.
## Users
-The Users option is where the policy can be scoped to only monitor specific security principals
-committing changes within Active Directory or to exclude specific users committing changes from
-being monitored.
+The Users option is where you can scope the policy to monitor only specific security principals
+committing changes within Active Directory or exclude specific users committing changes from
+monitoring.
@@ -118,7 +117,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath Type to enter the AD object you want to include or
exclude. Press the Enter or Tab key to add another text box. Check the box under Subtree to include
or exclude child contexts.
diff --git a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md
index b1a7554c93..0ee568d965 100644
--- a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md
+++ b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/ldapmonitor/ldapthreatmanager.md
@@ -6,17 +6,16 @@ sidebar_position: 10
# Configure LDAP Monitoring for Netwrix Threat Manager
-Follow the steps to configure LDAP monitoring within Netwrix Activity Monitor for Netwrix Threat
-Manager.
+Configure LDAP monitoring within Netwrix Activity Monitor for Netwrix Threat Manager.
:::note
-LDAP Monitoring is not enabled, it must be enabled in the Monitored Domains tab.
+LDAP Monitoring isn't enabled, it must be enabled in the Monitored Domains tab.
:::
-**Step 1 –** In the Activity Monitor, click on the **Monitored Domains** tab.
+**Step 1 –** In the Activity Monitor, click the **Monitored Domains** tab.
**Step 2 –** Select a domain and click **Edit**.
diff --git a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md
index f40854571c..4e69db101a 100644
--- a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md
+++ b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/lsassguardian.md
@@ -6,12 +6,12 @@ sidebar_position: 50
# LSASS Guardian Tab
-The LSASS Guardian tab allows users to modify settings that were populated with the information
+Use the LSASS Guardian tab to modify settings that were populated with the information
entered when the host was added to prevent, monitor, or block LSASS code injections.
-After checking the Enable LSASS Guardian box, the following event filters can be modified on the
+After checking the Enable LSASS Guardian box, you can modify the following event filters on the
sub-tabs:
- Operations
@@ -19,8 +19,7 @@ sub-tabs:
- Servers
- Users
-Each filter tab acts like an "AND" statement for the filter. Any filter tab left blank is treated
-like an "ALL" for that filter set.
+Each filter tab acts like an "AND" statement for the filter. Any filter tab left blank applies to all values for that filter set.
:::info
Add exclusion process filters for legitimate processes that make changes to
@@ -37,7 +36,7 @@ The Operations option filters for successful events, failed events, or both.
The Open Process Flags section is where monitoring can be scoped for requested handles that would
maliciously impact LSASS processes.
-Check the box to select the process flag(s) to be monitored:
+Check the box to select the process flags to be monitored:
- PROCESS_VM_WRITE – Writes to memory in a process
- PROCESS_CREATE_THREAD – Creates a thread
@@ -49,13 +48,13 @@ malware applications, can be included/excluded from being monitored by the polic
-Double-click the text box beneath Name to enter the desired processes to include or exclude. Press
+Double-click the text box beneath Name to enter the processes you want to include or exclude. Press
the Enter or Tab key to add another text box.
:::note
-While a processes inclusion is a filter option, it is not recommended for monitoring
+While a processes inclusion is a filter option, it isn't recommended for monitoring
LSASS. Adding a process inclusion filter will limit the scope to only monitor that process. Unknown
-malicious processes would not be monitored in this case.
+malicious processes wouldn't be monitored in this case.
:::
@@ -68,14 +67,14 @@ The Servers option targets servers to be included or excluded when filtering for
In both sections, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS
Domain name and SERVER is NetBIOS server name.
-Double-click the textbox beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the textbox beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another textbox.
## Users
-The Users option is where the policy can be scoped to only monitor specific security principals
-committing changes within Active Directory or to exclude specific users committing changes from
-being monitored.
+The Users option is where you can scope the policy to monitor only specific security principals
+committing changes within Active Directory or exclude specific users committing changes from
+monitoring.
@@ -95,7 +94,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath Type to enter the AD you want object to include or
exclude. Press the Enter or Tab key to add another text box. Check the box under Subtree to include
or exclude child contexts.
diff --git a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/overview.md b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/overview.md
index 79d570a76e..86e6acfcd9 100644
--- a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/overview.md
+++ b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/overview.md
@@ -11,8 +11,8 @@ Configuration window.
-This initially configured when the AD Agent is deployed to a domain controller. However, the
-monitoring configuration can be edited after that. Use the following tabs to modify monitoring of AD
+This is configured initially when the AD Agent is deployed to a domain controller. However, you
+can edit the monitoring configuration after deployment. Use the following tabs to modify monitoring of AD
events:
- [Global Filters Tab](/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/globalfilters.md)
diff --git a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/replication.md b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/replication.md
index 42990b4526..4caa62d39e 100644
--- a/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/replication.md
+++ b/docs/activitymonitor/9.0/admin/monitoreddomains/admonitoringconfiguration/replication.md
@@ -11,7 +11,7 @@ replication.
-After checking the Enable Replication box, the following event filters can be modified on the
+After checking the Enable Replication box, you can modify the following event filters on the
sub-tabs:
- Host (From)
@@ -21,14 +21,14 @@ sub-tabs:
Each filter tab acts like an “AND” statement for the filter. Any filter tab left blank is treated
like an ALL for that filter set.
-Windows cannot detect if a sync request is coming from a legitimate domain controller. This option
-is designed to monitor requests from computers that are not ‘excluded’ by the policy. Therefore,
+Windows can't detect if a sync request is coming from a legitimate domain controller. This option
+is designed to monitor requests from computers that aren't ‘excluded’ by the policy. Therefore,
legitimate domain controllers should be identified in the event filters.
## Host (From) Filter
-The Hosts (From) option is where the policy can be scoped to only monitor specific hosts as
-originators of an authentication event or to exclude specific hosts from being monitored for
+The Hosts (From) option is where you can scope the policy to monitor only specific hosts as
+originators of an authentication event or exclude specific hosts from monitoring for
authentication events.
@@ -56,14 +56,14 @@ The Servers option targets servers to be included or excluded when filtering for
In both cases, servers must be specified in the form 'DOMAIN\SERVER', where DOMAIN is NetBIOS Domain
name and SERVER is NetBIOS server name.
-Double-click the text box beneath Name to enter the desired servers to include or exclude. Press the
+Double-click the text box beneath Name to enter the servers you want to include or exclude. Press the
Enter or Tab key to add another text box.
## Users Filter
-The Users option is where the policy can be scoped to only monitor specific security principals
-committing changes within Active Directory or to exclude specific users committing changes from
-being monitored
+The Users option is where you can scope the policy to monitor only specific security principals
+committing changes within Active Directory or exclude specific users committing changes from
+monitoring
@@ -83,7 +83,7 @@ The following details appear beneath both sections:
e.g. 'CN=Users,DC=Domain,DC=com'. However, for objects with 'sidType' type, it must be in the form
of WellKnownSidType Enum, e.g. 'AnonymousSid' or 'LocalSid'.
-Double-click the text box beneath Distinguished Name to enter the desired group types to include or
-exclude. Double-click the text box beneath Type to enter the desired AD object to include or
+Double-click the text box beneath Distinguished Name to enter the group types you want to include or
+exclude. Double-click the text box beneath Type to enter the AD object you want to include or
exclude. Press the Enter or Tab key to add another textbox. Check the box under Subtree to include
or exclude child contexts.
diff --git a/docs/activitymonitor/9.0/admin/monitoreddomains/output/activedirectoryjson.md b/docs/activitymonitor/9.0/admin/monitoreddomains/output/activedirectoryjson.md
index c5a046c00b..110bc30cb3 100644
--- a/docs/activitymonitor/9.0/admin/monitoreddomains/output/activedirectoryjson.md
+++ b/docs/activitymonitor/9.0/admin/monitoreddomains/output/activedirectoryjson.md
@@ -49,11 +49,11 @@ into a JSON log file:
| QueryFilter | LDAP filter used in the operation |
| QueryIsSSL | Indicates if LDAP connection is secure or not |
| QueryObjectsReturned | Number of returned objects produced by the LDAP request |
-| Source | Indicates source of the operation. Currently can be: ‘Authentication’, ‘Active Directory’, ‘LSASS Guardian – Monitor’, ‘LDAP Monitor’, ‘AD Replication Monitoring’. |
+| Source | Indicates source of the operation. can be: ‘Authentication’, ‘Active Directory’, ‘LSASS Guardian – Monitor’, ‘LDAP Monitor’, ‘AD Replication Monitoring’. |
| Success | Indicates if original operation completed successfully or not |
| TargetHost | Contains host name to which authentication attempt took place. In case of failed Kerberos AS, this field contains name of the domain controller. |
| TargetHostIP | If resolved, contains IP address of the target host |
-| TargetProcess | Contains process name that is monitored. Currently this is only lsass.exe. |
+| TargetProcess | Contains process name that is monitored. this is only lsass.exe. |
| TgsReplyEncryptionType | Indicates encryption type used in reply part of the TGS Kerberos ticket. Possible values the same as for EncryptionType. |
| TimeLogged | UTC timestamp of the event |
| UserDN | If resolved, contains DN of the object triggered operation |
diff --git a/docs/activitymonitor/9.0/admin/monitoreddomains/output/output.md b/docs/activitymonitor/9.0/admin/monitoreddomains/output/output.md
index 2e2c9e0e8b..55ea227987 100644
--- a/docs/activitymonitor/9.0/admin/monitoreddomains/output/output.md
+++ b/docs/activitymonitor/9.0/admin/monitoreddomains/output/output.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Output for Monitored Domains
-Once a domain is being monitored the event stream can be sent to multiple outputs.
+After you monitor a domain, you can send the event stream to multiple outputs.
@@ -27,15 +27,13 @@ domain. The domain event outputs are:
## Add File Output
-Follow the steps to add a File output.
+**Step 1 –** On the Monitored Domains tab, select the domain you want to add output to and click **Add Output**.
-**Step 1 –** On the Monitored Domains tab, select the desired domain and click **Add Output**.
-
-**Step 2 –** Select **File** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **File** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
@@ -45,15 +43,13 @@ information.
## Add Syslog Output
-Follow the steps to add a Syslog output.
-
-**Step 1 –** On the Monitored Domains tab, select the desired domain and click **Add Output**.
+**Step 1 –** On the Monitored Domains tab, select the domain you want to add output to and click **Add Output**.
-**Step 2 –** Select **Syslog** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **Syslog** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
@@ -71,16 +67,14 @@ additional information.
:::
-Follow the steps to add a Netwrix Threat Manager output.
-
-**Step 1 –** On the Monitored Domains tab, select the desired domain and click **Add Output**.
+**Step 1 –** On the Monitored Domains tab, select the domain you want to add output to and click **Add Output**.
-**Step 2 –** Select **Netwrix Threat Manager** from the drop-down menu. The Add New
+**Step 2 –** Select **Netwrix Threat Manager** from the dropdown menu. The Add New
Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
diff --git a/docs/activitymonitor/9.0/admin/monitoreddomains/overview.md b/docs/activitymonitor/9.0/admin/monitoreddomains/overview.md
index b0a04c7dc1..ca81f7bdf4 100644
--- a/docs/activitymonitor/9.0/admin/monitoreddomains/overview.md
+++ b/docs/activitymonitor/9.0/admin/monitoreddomains/overview.md
@@ -17,12 +17,12 @@ The Activity Monitor can be configured to monitor the following Active Directory
- Success and Failure on Logon
- LDAP Activity Monitoring
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Manager
-It also provides the ability to feed activity data to SIEM products.
+It also lets you feed activity data to SIEM products.
**Agents**
@@ -31,16 +31,15 @@ within the domain to be monitored.
**Tab**
-Once the AD Agent(s) installation is complete on a domain controller, the domain appear on the
-Monitored Domains tab. The tab is not visible within the console until at least one AD Agent has
-been deployed.
+After you complete the AD Agent installation on a domain controller, the domain appears on the
+Monitored Domains tab. The tab isn't visible within the console until you deploy at least one AD Agent.
This tab is comprised of a button bar and a table of domains being monitored. The events stream
output needs to be designated to view data after an activity search has been performed.
## Button Bar
-The button bar allows users to take the following actions:
+Use the button bar to take the following actions:
@@ -79,4 +78,4 @@ view more information on various status conditions.
Click the **Down Arrow** to expand the Error Propagation section. The information listed is
-dependent on which domain is currently selected in the Monitored Domains table.
+dependent on which domain is selected in the Monitored Domains table.
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/azurefiles.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/azurefiles.md
index 6dbc41a03b..09298acb88 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/azurefiles.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/azurefiles.md
@@ -6,16 +6,13 @@ sidebar_position: 11
# Add Azure Files Storage Accounts
-Prior to adding Azure Files storage accounts to the Activity Monitor, the prerequisites for the target environment
-must be met. See the [Azure Files Requirements](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/azure-files/azurefiles-activity.md)
+Before adding Azure Files storage accounts to the Activity Monitor, you must meet the prerequisites for the target environment. See the [Azure Files Requirements](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/azure-files/azurefiles-activity.md)
topic for additional information.
-Follow the steps to add Azure Files storage accounts to be monitored.
-
1. On the **Monitored Hosts & Services** page, select **Add Host/Service**.
2. Select the agent that will be monitoring Azure Files, and then select **Next**.
3. Select **Azure Files**, specify the tenant’s domain name, and then select **Next**.
-4. On the **Connection** page, specify the Tenant ID (if it was not resolved automatically), Client ID, and Client Secret—values
+4. On the **Connection** page, specify the Tenant ID (if it wasn't resolved automatically), Client ID, and Client Secret—values
copied in the previous steps during application registration.
5. Select **Connect**.
The button will verify the connection to Azure, enumerate all storage accounts, and retrieve their settings visible to the registered application.
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellcelerravnx.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellcelerravnx.md
index b783993b80..6bb0009125 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellcelerravnx.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellcelerravnx.md
@@ -56,7 +56,7 @@ To add a Dell Celerra or VNX host to be monitored, complete the following steps:
Server NetBIOS Name** for the device. If desired, add a **Comment**. Click **Next**.
:::note
-All Dell event source types must have the CEE Monitor Service installed on the agent in
+All Dell event source types must have the CEE (Common Event Engine) Monitor Service installed on the agent in
order to collect events. Activity Monitor will detect if the CEE Monitor isn't installed and
display a warning to install the service. If the CEE Monitor service is installed on a remote
machine, manual configuration is required. See the
@@ -219,8 +219,7 @@ Click **Finish**.
-The added Dell Celerra or VNX host is displayed in the Monitored Hosts & Services table. Once a host has been
-added for monitoring, configure the outputs you want. See the
+The Monitored Hosts & Services table displays the added Dell Celerra or VNX host. After you add a host for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic for additional information.
## Host Properties for Dell Celerra or VNX
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellpowerscale.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellpowerscale.md
index 3ba0956d15..6d5a46201e 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellpowerscale.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellpowerscale.md
@@ -58,7 +58,7 @@ left blank to collect activity from the Isilon cluster. If desired, add a **Comm
**Next**.
:::note
-All Dell event source types must have the CEE Monitor Service installed on the agent in
+All Dell event source types must have the CEE (Common Event Engine) Monitor Service installed on the agent in
order to collect events. Activity Monitor will detect if the CEE Monitor isn't installed and
display a warning to install the service. If the CEE Monitor service is installed on a remote
machine, manual configuration is required. See the
@@ -262,8 +262,7 @@ Click **Finish**.
-The added Dell Isilon/PowerScale host is displayed in the monitored hosts/services table. Once a host has
-been added for monitoring, configure the outputs you want. See the
+The monitored hosts/services table displays the added Dell Isilon/PowerScale host. After you add a host for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic for additional information.
## Host Properties for Dell Isilon/PowerScale
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellpowerstore.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellpowerstore.md
index 9148d1a080..56a2029840 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellpowerstore.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellpowerstore.md
@@ -56,7 +56,7 @@ Click**Next**.
name. Click **Next**.
:::note
-All Dell event source types must have the CEE Monitor Service installed on the agent in
+All Dell event source types must have the CEE (Common Event Engine) Monitor Service installed on the agent in
order to collect events. Activity Monitor will detect if the CEE Monitor isn't installed and
display a warning to install the service. If the CEE Monitor service is installed on a remote
machine, manual configuration is required. See the
@@ -188,8 +188,7 @@ Click **Finish**.
-The added Dell PowerStore host is displayed in the monitored hosts/services table. Once a host has been added
-for monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md)
+The monitored hosts/services table displays the added Dell PowerStore host. After you add a host for monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md)
topic for additional information.
## Host Properties for Dell PowerStore
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellunity.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellunity.md
index e957fd8426..90066f3c82 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellunity.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/dellunity.md
@@ -56,7 +56,7 @@ window opens.
Name** for the device. If desired, add a **Comment**. Click **Next**.
:::note
-All Dell event source types must have the CEE Monitor Service installed on the agent in
+All Dell event source types must have the CEE (Common Event Engine) Monitor Service installed on the agent in
order to collect events. Activity Monitor will detect if the CEE Monitor isn't installed and
display a warning to install the service. If the CEE Monitor service is installed on a remote
machine, manual configuration is required. See the
@@ -219,8 +219,7 @@ Click **Finish**.
-The added Dell Unity host is displayed in the monitored hosts/service table. Once a host has been added for
-monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
+The monitored hosts/service table displays the added Dell Unity host. After you add a host for monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Dell Unity
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/entraid.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/entraid.md
index eedd9628cc..5dba3c48a6 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/entraid.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/entraid.md
@@ -34,14 +34,14 @@ AD) changes:
| Invited Users | MIM Service | MyApps | PIM |
| Self-Service Group Management | Self-service Password Management | Terms of Use | |
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding aMicrosoft Entra ID host to the Activity Monitor, the prerequisites for the target
-environment must be met. See the
+Before adding a Microsoft Entra ID host to the Activity Monitor, you must meet the prerequisites for the target
+environment. See the
[Microsoft Entra ID Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/entraid-activity.md) topic
for additional information.
@@ -53,8 +53,6 @@ monitoring the target environment.
## Add Azure Active Directory / Entra ID Host
-Follow the steps to add a Microsoft Entra ID host to be monitored.
-
**Step 1 –** In the Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -118,26 +116,26 @@ Click **Next**.
**Step 8 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -147,8 +145,7 @@ Click **Finish**.
-The added Microsoft Entra ID host is displayed in the monitored hosts/service table. Once a host has been
-added for monitoring, configure the desired outputs. See the
+The monitored hosts/service table displays the added Microsoft Entra ID host. After you add a host for monitoring, configure the outputs. See the
[Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic for additional information.
## Host Properties for Microsoft Entra ID
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/exchangeonline.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/exchangeonline.md
index 3e653517a6..1899768a12 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/exchangeonline.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/exchangeonline.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# Exchange Online
-Prior to adding an Exchange Online host to the Activity Monitor, the prerequisites for the target
-environment must be met. See the
+Before adding an Exchange Online host to the Activity Monitor, you must meet the prerequisites for the target
+environment. See the
[Exchange Online Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/exchange-activity.md)
topic for additional information.
@@ -19,8 +19,6 @@ monitoring the target environment.
## Add Exchange Online Host
-Follow the steps to add an Exchange Online host to be monitored.
-
**Step 1 –** In the Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -99,26 +97,26 @@ Click **Next**.
**Step 10 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -128,8 +126,7 @@ Click **Finish**.
-The added Exchange Online host is displayed in the monitored hosts/service table. Once a host has been added
-for monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md)
+The monitored hosts/service table displays the added Exchange Online host. After you add a host for monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md)
topic for additional information.
## Host Properties for Exchange Online
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/hitachi.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/hitachi.md
index feeef08ca0..2aec188f74 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/hitachi.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/hitachi.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,14 +22,13 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/9.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Hitachi host to the Activity Monitor, the prerequisites for the target environment
-must be met. See the
+Before adding a Hitachi host to the Activity Monitor, you must meet the prerequisites for the target environment. See the
[Hitachi Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md) topic for
additional information.
@@ -41,8 +40,6 @@ monitoring the target environment.
## Add Hitachi NAS Host
-Follow the steps to add a Hitachi host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -70,7 +67,7 @@ Operations** to be monitored. Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the options you want:
- Report UNC paths – Adds a UNC Path column and a Rename UNC Path column in the generated TSV files
- This option corresponds to the REPORT_UNC_PATH parameter in the INI file. It is disabled by
@@ -123,26 +120,26 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -152,8 +149,7 @@ Click **Finish**.
-The added Hitachi host is displayed in the monitored hosts/service table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
+The monitored hosts/service table displays the added Hitachi host. After you add a host for monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Hitachi
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/nasuni.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/nasuni.md
index 3d0ed43c9e..95b80c76a7 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/nasuni.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/nasuni.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,14 +22,14 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/9.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Nasuni Edge Appliance host to the Activity Monitor, the prerequisites for the
-target environment must be met. See the
+Before adding a Nasuni Edge Appliance host to the Activity Monitor, you must meet the prerequisites for the
+target environment. See the
[Nasuni Edge Appliance Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md) topic
for additional information.
@@ -41,8 +41,6 @@ monitoring the target environment.
## Add Nasuni Host
-Follow the steps to add a Nasuni Edge Appliance host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -62,7 +60,7 @@ Click **Next**.
**Step 4 –** On the Nasuni Options page, enter the **API Key Name** and the **API Key Value**. Click
Connect to validate the connection with the Nasuni device.
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -103,7 +101,7 @@ Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select the options you want:
- Report account names – Adds an Account Name column in the generated TSV files
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -162,26 +160,26 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -191,8 +189,7 @@ Click **Finish**.
-The added Nasuni host is displayed in the monitored hosts/services table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
+The monitored hosts/services table displays the added Nasuni host. After you add a host for monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Nasuni
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/netapp.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/netapp.md
index 120ca48942..3ac2184976 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/netapp.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/netapp.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,13 +22,13 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/9.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a NetApp Data ONTAP host to the Activity Monitor, the prerequisites for the target
+Before adding a NetApp Data ONTAP host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[NetApp Data ONTAP Cluster-Mode Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md)
topic or the
@@ -36,15 +36,13 @@ topic or the
topic in the for additional information.
:::tip
-Remember, the Activity Agent must be deployed to a Windows server that acts as a proxy for
+Remember, deploy the Activity Agent to a Windows server that acts as a proxy for
monitoring the target environment.
:::
## Add NetApp Host
-Follow the steps to add a NetApp Data ONTAP host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -59,8 +57,7 @@ window opens.
textbox, enter the following information:
- Cluster-Mode devices – Enter the NetApp Filer/SVM
-- 7-Mode devices – Enter the NetApp DNS name. If using vFilers, then it is necessary to use the
- vFiler name here.
+- 7-Mode devices – Enter the NetApp DNS name. If using vFilers, use the vFiler name here.
Click **Next**.
@@ -76,10 +73,10 @@ how it is in NetApp's FPolicy configuration.
- NetApp Filer or SVM – Enter the name of the NetApp Filer or SVM. The name is case sensitive.
- Management LIF – _(Optional)_ If using Cluster Management LIF, a Management LIF can be specified
- if SVM Management LIF is not used (Vserver Tunneling)
+ if SVM Management LIF isn't used (Vserver Tunneling)
- User name – Enter the user name for the credentials to connect to the NetApp server
- User password – Enter the password for the credentials to connect to the NetApp server
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -100,7 +97,7 @@ Click **Next**.
-**Step 5 –** On the NetApp Mode FPolicy Configuration page, choose whether or not to automatically
+**Step 5 –** On the NetApp Mode FPolicy Configuration page, choose whether to automatically
configure FPolicy through Activity Monitor. If that is desired, check the Configure FPolicy option.
Any additional permissions required are listed. Be sure to select the appropriate file protocol to
configure the FPolicy.
@@ -123,7 +120,7 @@ Click **Next**.
:::info
For NetApp Cluster-Mode, create a tailored FPolicy manually. If manually
-configuring the FPolicy, do not select the ConfigureFPolicy checkbox.
+configuring the FPolicy, don't select the ConfigureFPolicy checkbox.
:::
@@ -137,7 +134,7 @@ minimum, the less privileged permissions. For Cluster-mode devices, the credenti
as ‘Employing the “Enable and connect FPolicy” Option’.
:::warning
-On the NetApp FPolicy Enable and Connect page, choose whether or not to Enable and
+On the NetApp FPolicy Enable and Connect page, choose whether to Enable and
connect FPolicy, which will “Ensure everything is active with periodic checks.”
:::
@@ -152,9 +149,7 @@ Additional permissions that are required if enabling **Enable and connect FPolic
**Important Notes**
:::info
-Enable this functionality. Without this option enabled, it is necessary to
-manually connect the FPolicy every time it is disconnected for any reason. For reliable, high
-availability file monitoring, use this option.
+Enable this functionality. Without this option enabled, you must manually connect the FPolicy whenever it disconnects. For reliable, high availability file monitoring, use this option.
:::
@@ -184,7 +179,7 @@ properties > Operations tab.
If the Configure FPolicy option is enabled, then Activity Monitor updates the FPolicy according to
-these settings. If it was not enabled, then the manually configured FPolicy must be set to monitor
+these settings. If it wasn't enabled, then the manually configured FPolicy must be set to monitor
these operations. Only operations being monitored by the FPolicy are available to the activity
agent.
@@ -208,7 +203,7 @@ Click **Next**.
**Step 8 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the proxy host. Select the desired options:
+are the activity logs created by the activity agent on the proxy host. Select which options to enable:
- Report account names – Adds an Account Name column in the generated TSV files
- Add C:\ to the beginning of the reported file paths – Adds ‘C:\” to file paths to be displayed
@@ -267,26 +262,26 @@ Click **Next**.
**Step 11 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -297,23 +292,22 @@ Click **Finish**.
The added NetApp host is displayed in the monitored hosts/services table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
for additional information.
:::tip
-Remember, if automatic configuration of the FPolicy was selected, it is necessary to Configure
-Privileged Access.
+Remember, if you selected automatic FPolicy configuration, configure Privileged Access.
:::
## Configure Privileged Access
If automatic configuration of the FPolicy is used for NetApp Data ONTAP Cluster-Mode devices, it is
-necessary to configure privileged access. Follow the steps to configure privileged access. Remember,
+necessary to configure privileged access. Remember,
this requires the provisioned user account to have full permissions, identified as the credentials
‘Employing the “Configure FPolicy” Option’.
-**Step 1 –** On to the Monitored Hosts & Services tab, select the desired host and click Edit. The host’s
+**Step 1 –** On to the Monitored Hosts & Services tab, select the host you want to edit and click Edit. The host’s
Properties window opens.
@@ -326,8 +320,8 @@ This option is only available if the Configure FPolicy option is enabled.
:::
-Privileged access must be allowed and configured with appropriate credentials to leverage Access
-Analyzer permission (FSAA) scans for this NetApp device
+Allow and configure privileged access with appropriate credentials to enable Access
+Analyzer permission (FSAA) scans for this NetApp device.
For information on the other options for this tab, see the [FPolicy Tab](/docs/activitymonitor/9.0/admin/monitoredhosts/properties/fpolicy.md)
section.
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/nutanix.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/nutanix.md
index 1a103005da..b9a495f8a2 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/nutanix.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/nutanix.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,19 +22,19 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/9.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Nutanix files host to the Activity Monitor, the prerequisites for the target
+Before adding a Nutanix files host to the Activity Monitor, the prerequisites for the target
environment must be met. See
[Nutanix Files Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md) for more
information.
:::tip
-Remember, the Activity Agent must be deployed to a Windows server that acts as a proxy for
+Remember, deploy the Activity Agent to a Windows server that acts as a proxy for
monitoring the target environment.
:::
@@ -52,15 +52,13 @@ activity delivery. Nutanix Files server connects to the agent using the TCP port
## Add Nutanix Host
-Follow the steps to add a Nutanix files host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click **Add**. The Add New Host
window opens.
**Step 2 –** On the Choose Agent page, select the Agent to monitor the file server from the
-drop-down list. Click **Next**.
+dropdown list. Click **Next**.
@@ -77,7 +75,7 @@ access.
:::
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -150,7 +148,7 @@ Output page.
- Add header to Log files – Adds headers to TSV files. This is used to feed data into Splunk.
:::note
- Access Analyzer does not support log files with the header.
+ Access Analyzer doesn't support log files with the header.
:::
@@ -161,25 +159,25 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the Where To Log The Activity page, configure the
Syslog Output page.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the **Message framing** drop-down menu. See the
+ The TCP and TLS protocols add the **Message framing** dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -189,8 +187,8 @@ Click **Finish**.
-The added Nutanix host is displayed in the monitored hosts/service table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
+The added Nutanix host is displayed in the monitored hosts/service table. After a host is added for
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Nutanix
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/panzura.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/panzura.md
index ebf894839d..184f124dd7 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/panzura.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/panzura.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,24 +22,24 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/9.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Threat Prevention
- Netwrix Threat Manager
## Add Panzura Host
-Prior to adding a Panzura host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Panzura host to the Activity Monitor, the prerequisites for the target environment
must be met. See the [Panzura CloudFS Monitoring](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/panzura-activity.md) topic for
additional information.
:::tip
-Remember, the Activity Agent must be deployed to a Windows server that acts as a proxy for
+Remember, deploy the Activity Agent to a Windows server that acts as a proxy for
monitoring the target environment.
:::
-Follow the steps to add a Panzura host to be monitored.
+To add a Panzura host to be monitored, complete the following steps:
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -159,26 +159,26 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the **Message framing** drop-down menu. See the
+ The TCP and TLS protocols add the **Message framing** dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -189,7 +189,7 @@ Click **Finish**.
The added Panzura host is displayed in the monitored hosts/services table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Panzura
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/qumulo.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/qumulo.md
index e8e78b303d..25b95acf02 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/qumulo.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/qumulo.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,25 +22,25 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/9.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Prevention
- Netwrix Threat Manager
-Prior to adding a Qumulo host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Qumulo host to the Activity Monitor, the prerequisites for the target environment
must be met. See the [Qumulo Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md)
topic for additional information.
:::tip
-Remember, the Activity Agent must be deployed to a Windows server that acts as a proxy for
+Remember, deploy the Activity Agent to a Windows server that acts as a proxy for
monitoring the target environment.
:::
## Add Qumulo Host
-Follow the steps to add a Qumulo host to be monitored.
+Add a Qumulo host to be monitored.
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click **Add**. The Add New Host
window opens.
@@ -48,7 +48,7 @@ window opens.
**Step 2 –** On the Choose Agent page, select the Agent to monitor the file server from the
-drop-down list. Click **Next**.
+dropdown list. Click **Next**.
@@ -59,7 +59,7 @@ name. Click **Next**.
**Step 4 –** On the Qumulo Options page, enter the user name and password.
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
@@ -113,7 +113,7 @@ Output page.
- Add header to Log files – Adds headers to TSV files. This is used to feed data into Splunk.
:::note
- Access Analyzer does not support log files with the header.
+ Access Analyzer doesn't support log files with the header.
:::
@@ -124,25 +124,25 @@ Click **Next**.
**Step 7 –** If Syslog Server is selected on the Where To Log The Activity page, configure the
Syslog Output page.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the **Message framing** drop-down menu. See the
+ The TCP and TLS protocols add the **Message framing** dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -153,7 +153,7 @@ Click **Finish**.
The added Qumulo host is displayed in the monitored hosts/services table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for Qumulo
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/sharepoint.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/sharepoint.md
index 827bc2b616..08505cd376 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/sharepoint.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/sharepoint.md
@@ -23,25 +23,23 @@ The Activity Monitor can be configured to monitor the following SharePoint chang
- Security principal is added to a security group
- Security principal is removed from a security group
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
-Prior to adding a SharePoint host to the Activity Monitor, the prerequisites for the target
+Before adding a SharePoint host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[SharePoint On-Premise Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/sharepoint-onprem-activity.md)
topic for additional information.
:::tip
-Remember, the Activity Agent must be deployed to the SharePoint Application server that hosts the
+Remember, deploy the Activity Agent to the SharePoint Application server that hosts the
“Central Administration” component of the SharePoint farm.
:::
## Add SharePoint Host
-Follow the steps to add a SharePoint host to be monitored.
-
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -58,7 +56,7 @@ Click **Next**.
**Step 4 –** On the SharePoint Options page, choose to audit all sites or scope the monitoring to
-specific site(s):
+specific sites:
- Enable auditing on selected site collections – Enabling this option will ensure that auditing is
enabled for all monitored site collections with periodic checks
@@ -118,26 +116,26 @@ Click **Next**.
**Step 8 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -148,7 +146,7 @@ Click Finish.
The added SharePoint host is displayed in the monitored hosts/services table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for SharePoint
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/sharepointonline.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/sharepointonline.md
index be02c860d0..f30055c9fc 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/sharepointonline.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/sharepointonline.md
@@ -23,25 +23,23 @@ The Activity Monitor can be configured to monitor the following SharePoint chang
- Security principal is added to a security group
- Security principal is removed from a security group
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
-Prior to adding a SharePoint Online host to the Activity Monitor, the prerequisites for the target
+Before adding a SharePoint Online host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[SharePoint Online Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/sharepoint-online-activity.md)
topic for additional information.
:::tip
-Remember, the Activity Agent must be deployed to a Windows server that acts as a proxy for
+Remember, deploy the Activity Agent to a Windows server that acts as a proxy for
monitoring the target environment.
:::
## Add SharePoint Online Host
-Follow the steps to add a SharePoint Online host to be monitored.
-
**Step 1 –** In the Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -50,7 +48,7 @@ window opens.
**Step 2 –** On the Choose Agent page, select the Agent to monitor SharePoint Online.
:::warning
-The domain name must match the SharePoint Online host name in order to properly
+The domain name must match the SharePoint Online host name to properly
integrate SharePoint Online activity monitoring with Access Analyzer.
:::
@@ -71,7 +69,7 @@ Instruction...** for steps on registering the Activity Monitor with Microsoft En
- Approve consent for the organization.
:::note
- Activity Monitor does not store credentials. The credentials are used to enable
+ Activity Monitor doesn't store credentials. The credentials are used to enable
API access using the Client ID and Secret.
:::
@@ -135,26 +133,26 @@ Click **Next**.
**Step 8 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured. The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -164,8 +162,8 @@ Click **Finish**.
-The added SharePoint Online host is displayed in the monitored hosts/services table. Once a host has been
-added for monitoring, configure the desired outputs. See the
+The added SharePoint Online host is displayed in the monitored hosts/services table. After a host has been
+added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic for additional information.
## Host Properties for SharePoint Online
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/sqlserver.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/sqlserver.md
index e44a70adaa..347189a71a 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/sqlserver.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/sqlserver.md
@@ -8,24 +8,24 @@ sidebar_position: 150
**Understanding SQL Server Activity Monitoring**
-The Activity Monitor provides the ability to feed activity data to other Netwrix products:
+The Activity Monitor lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
-Prior to adding a SQL Server host to the Activity Monitor, the prerequisites for the target
+Before adding a SQL Server host to the Activity Monitor, the prerequisites for the target
environment must be met. See the
[SQL Server Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/sqlserver-activity.md) topic for
additional information.
:::tip
-Remember, the Activity Agent must be deployed to a Windows server that acts as a proxy for
+Remember, deploy the Activity Agent to a Windows server that acts as a proxy for
monitoring the target environment.
:::
## Add MS SQL Server Host
-Follow the steps to add a SQL Server host to be monitored.
+To add a SQL Server host to be monitored, complete the following steps:
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
window opens.
@@ -126,26 +126,26 @@ Output** page can be configured.
**Step 11 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -156,7 +156,7 @@ Click **Finish**.
The added SQL Server host is displayed in the monitored hosts/services table. Once a host has been added for
-monitoring, configure the desired outputs. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
+monitoring, configure the outputs you want. See the [Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic
for additional information.
## Host Properties for SQL Server
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/add/windows.md b/docs/activitymonitor/9.0/admin/monitoredhosts/add/windows.md
index 7ff4d9561e..6cb5d6f4c9 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/add/windows.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/add/windows.md
@@ -13,7 +13,7 @@ The Activity Monitor can be configured to monitor the following:
- Ability to collect all or specific file activity for specific values or specific combinations of
values
-It provides the ability to feed activity data to SIEM products. The following dashboards have been
+It lets you feed activity data to SIEM products. The following dashboards have been
specifically created for Activity Monitor event data:
- For IBM® QRadar®, see the
@@ -22,25 +22,24 @@ specifically created for Activity Monitor event data:
- For Splunk®, see the [File Activity Monitor App for Splunk](/docs/activitymonitor/9.0/siem/splunk/overview.md) for
additional information.
-It also provides the ability to feed activity data to other Netwrix products:
+It also lets you feed activity data to other Netwrix products:
- Netwrix Access Analyzer
- Netwrix Threat Manager
-Prior to adding a Windows host to the Activity Monitor, the prerequisites for the target environment
+Before adding a Windows host to the Activity Monitor, the prerequisites for the target environment
must be met. See the
[Windows File Server Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/windowsfs-activity.md)
topic for additional information.
:::tip
-Remember, the Activity Agent must be deployed to the server. It cannot be deployed to a proxy
-server.
+Remember, deploy the Activity Agent to the server. You can't deploy it to a proxy server.
:::
## Add Agent's Windows Host
-Follow the steps to add a Windows host to be monitored, if it was not configured when the agent was
+Add a Windows host to be monitored, if it wasn't configured when the agent was
deployed.
**Step 1 –** In Activity Monitor, go to the Monitored Hosts & Services tab and click Add. The Add New Host
@@ -53,8 +52,7 @@ server. Click **Next**.
-**Step 3 –** On the Add Host page, select the Agent’s Windows host radio button. Remember, the agent
-must be deployed on the Windows file server to be monitored. If desired, add a **Comment**. Click
+**Step 3 –** On the Add Host page, select the Agent’s Windows host radio button. Remember, deploy the agent on the Windows file server to be monitored. If desired, add a **Comment**. Click
**Next**.
@@ -95,7 +93,7 @@ in Read events not being monitored.
permission updates occurred resulting in reordered ACEs (Access Control Entries) but with no other
changes in the ACL (Access Control List). For example, if a user is removed in the security
settings of a file, and then the same user is added back with the same security permissions, the
- change is not logged.
+ change isn't logged.
- Suppress Inherited Permission Changes – Filters out events for inherited permission changes. This
option is provided to improve overall performance and reduce output activity log volume.
- Suppress Microsoft Office operations on temporary files – Filters out events for Microsoft Office
@@ -107,7 +105,7 @@ Click **Next**.
**Step 6 –** On the Configure Basic Options page, choose which settings to enable. The “Log files”
-are the activity logs created by the activity agent on the target host. Select the desired options:
+are the activity logs created by the activity agent on the target host. Select the options you want:
- Report Account Names – Adds an Account Name column in the generated TSV files
- Report UNC paths – Adds a UNC Path column and a Rename UNC Path column in the generated TSV files
@@ -158,26 +156,26 @@ Click **Next**.
**Step 9 –** If Syslog Server is selected on the **Where To Log The Activity** page, the Syslog
Output page can be configured.
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used. The Event stream is the activity
being monitored according to this configuration for the monitored host.
-- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The drop-down
+- Syslog Protocol – Identify the **Syslog protocol** to be used for the Event stream. The dropdown
menu includes:
- UDP
- TCP
- TLS
- The TCP and TLS protocols add the Message framing drop-down menu. See the
+ The TCP and TLS protocols add the Message framing dropdown menu. See the
[Syslog Tab](/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md) topic for additional information.
- The Test button sends a test message to the Syslog server to check the connection. A green check
mark or red will determine whether the test message has been sent or failed to send. Messages vary
by Syslog protocol:
- - UDP – Sends a test message and does not verify connection
+ - UDP – Sends a test message and doesn't verify connection
- TCP/TLS – Sends test message and verifies connection
- TLS – Shows error if TLS handshake fails
@@ -188,7 +186,7 @@ Click **Finish**.
The added Windows file server host is displayed in the monitored hosts/services table. Once a host has been
-added for monitoring, configure the desired outputs. See the
+added for monitoring, configure the outputs you want. See the
[Output for Monitored Hosts](/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md) topic for additional information.
## Host Properties for Windows File Server
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/output/filetsv.md b/docs/activitymonitor/9.0/admin/monitoredhosts/output/filetsv.md
index 5845383b96..b940cd7b06 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/output/filetsv.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/output/filetsv.md
@@ -6,10 +6,9 @@ sidebar_position: 10
# File TSV Log File
-The following information lists all of the columns generated by File Activity Monitor into a TSV log
-file, along with descriptions.
+The following lists all columns that File Activity Monitor generates into a TSV log file, along with descriptions.
-| Column Name(s) | Description |
+| Column Names | Description |
| ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Operation Time | Date timestamp of the event in UTC time Column format is dependent on "Report Operations with millisecond precision" option |
| Host | Host name of the monitored device |
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/output/linuxtsv.md b/docs/activitymonitor/9.0/admin/monitoredhosts/output/linuxtsv.md
index ec8b706a86..0ff32d35e2 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/output/linuxtsv.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/output/linuxtsv.md
@@ -6,8 +6,7 @@ sidebar_position: 20
# Linux TSV Log File
-The following information lists all of the columns generated by Linux Activity Monitor into a TSV
-log file, along with descriptions.
+The following lists all columns that Linux Activity Monitor generates into a TSV log file, along with descriptions.
| | |
| ---------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md b/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md
index 0eb06a7223..d70c1c4647 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/output/output.md
@@ -6,11 +6,11 @@ sidebar_position: 30
# Output for Monitored Hosts/Services
-Once a host is being monitored the event stream can be sent to multiple outputs.
+After you monitor a host, you can send the event stream to multiple outputs.
-Configured outputs are grouped under the host. You can have multiple outputs configured for a host.
+The system groups configured outputs under the host. You can have multiple outputs configured for a host.
The host event outputs are:
- File – Creates an activity log as a TSV or JSON file for every day of activity
@@ -19,15 +19,13 @@ The host event outputs are:
## Add File Output
-Follow the steps to add a File output.
+**Step 1 –** On the Monitored Hosts & Services tab, select the host you want and click **Add Output**.
-**Step 1 –** On the Monitored Hosts & Services tab, select the desired host and click **Add Output**.
-
-**Step 2 –** Select **File** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **File** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
@@ -37,15 +35,13 @@ information.
## Add Syslog Output
-Follow the steps to add a Syslog output.
-
-**Step 1 –** On the Monitored Hosts & Services tab, select the desired host and click **Add Output**.
+**Step 1 –** On the Monitored Hosts & Services tab, select the host you want and click **Add Output**.
-**Step 2 –** Select **Syslog** from the drop-down menu. The Add New Output window opens.
+**Step 2 –** Select **Syslog** from the dropdown menu. The Add New Output window opens.
-**Step 3 –** Configure the tab(s) as desired.
+**Step 3 –** Configure the tabs as desired.
**Step 4 –** Click **Add Output** to save your settings. The Add New Output window closes.
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/output/sharepointjson.md b/docs/activitymonitor/9.0/admin/monitoredhosts/output/sharepointjson.md
index 212b8af530..4327c9718d 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/output/sharepointjson.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/output/sharepointjson.md
@@ -6,19 +6,17 @@ sidebar_position: 30
# SharePoint JSON Log File
-The JSON log file format is used to send SharePoint activity monitoring data to Access Analyzer
-v10.0 consoles. The following information lists all of the attributes generated by SharePoint
-Activity Monitor into a JSON log file:
+Use the JSON log file format to send SharePoint activity monitoring data to Access Analyzer v10.0 consoles. The following lists all attributes that SharePoint Activity Monitor generates into a JSON log file:
| Attribute Name | Description | Example |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| TimeLogged | DateTime/ string | 2019-03-14T18:13:39.00Z |
| ActivityType | Constant “SharePoint” | SharePoint |
| AgentHost | Host name where agent is installed | sphost |
-| UserSid | User SID who caused the event | S-1-0-0 |
-| UserName | User Name who caused the event | System Account |
-| UserID | ID of the user who caused the event | 1073741823 |
-| UserLogin | User Login who caused the event | SHAREPOINT\system |
+| UserSid | The SID of the user who triggered the event | S-1-0-0 |
+| UserName | The name of the user who triggered the event | System Account |
+| UserID | The ID of the user who triggered the event | 1073741823 |
+| UserLogin | The login name of the user who triggered the event | SHAREPOINT\system |
| Protocol | Protocol: HTTP / HTTPS.. | HTTP |
| AbsoluteUrl | Full Url: SiteUrl + DocLocation | http://sphost/Lists/Comments/1\_.000 |
| WebApplication | Web application name | SharePoint – 80 |
@@ -26,28 +24,28 @@ Activity Monitor into a JSON log file:
| SiteUrl | Site Url | http://sphost/sites/mysite |
| WebTitle | Web title | my site |
| DocLocation | Location of an audited object at the time of the audited event | Lists/Comments/1\_.000 |
-| ItemId | A Guid that the object whose event is represented by the entry | 2c4174dc-322d-47bc-a420-52968fc3ba6c |
+| ItemId | The GUID of the object that the entry represents | 2c4174dc-322d-47bc-a420-52968fc3ba6c |
| ItemTitle | Title of the object | Welcome to my blog! |
| ItemType | Type of the object: Document / ListItem / List / Folder / Web / Site | ListItem |
| EventType | An SPAuditEventType that represents the type of event | Update |
| EventSource | A value that indicates whether the event occurred as a result of user action in the SharePoint Foundation user interface (UI) or programmatically. Values: SharePoint / ObjectModel | SharePoint |
| LocationType | Specifies the actual location of a document in a SharePoint document library: Invalid, Url, ClientLocation | Url |
-| AppPrincipalId | The ID of the app principal who caused the event. If the value of EventSource is ObjectModel, thenAppPrincipalId holds the ID of the app principal whose context the code that caused the event was running. If there is no app context, the AppPrincipalId is null. | 0 |
+| AppPrincipalId | The ID of the app principal that triggered the event. If EventSource has the value ObjectModel, AppPrincipalId holds the ID of the app principal whose context ran the code that triggered the event. If no app context exists, AppPrincipalId is null. | 0 |
| SourceName | The name of the application that caused the event | `` |
| RawEventData | A String that holds XML markup providing data that is specific to the type of event that the entry object represents. | `06C49477-0498-4858-900C-45B595337462 MyDocs/myfile.zip` marker for the list-like settings. Leave
the `<-Different-Values->` marker to preserve the difference in each selected object, or delete it
to remove all divergent elements. When the window closes, only changed properties are saved to all
@@ -101,21 +99,17 @@ The monitored hosts/services table provides the following information:
for additional information.
- Received Events – Timestamp of the last event received
- Comment – Comment provided by user:
- - Often this indicates the desired output, e.g. Access Analyzer.
+ - Often this indicates the output, e.g. Access Analyzer.
- This can be useful if adding the same monitored host multiple times with different
configurations for different outputs.
- If a Activity Monitor Agent has been deployed to a Windows server where an activity agent is
deployed, then the Comment identifies the host as "Managed by Activity Monitor", and that
- 'monitored host' is not editable. Add the host again for other outputs.
+ 'monitored host' isn't editable. Add the host again for other outputs.
Hosts can have more than one output. To view a host's outputs, expand the host by clicking the white
arrow to the left of the Monitored Host name.
-For integration with Netwrix Access Analyzer, only one configuration
-of a 'monitored host' can be set as the Netwrix Access Analyzer
-output. After a 'monitored host' has been added, use the Edit feature to identify the configuration
-as being for Netwrix Access Analyzer on the Log Files tab of the
-host's Properties window. See the [Log Files Tab](/docs/activitymonitor/9.0/admin/outputs/logfiles.md) topic for additional
+For integration with Netwrix Access Analyzer, set only one configuration per 'monitored host' as the Netwrix Access Analyzer output. After you add a 'monitored host', use the Edit feature to identify the configuration as being for Netwrix Access Analyzer on the Log Files tab of the host's Properties window. See the [Log Files Tab](/docs/activitymonitor/9.0/admin/outputs/logfiles.md) topic for additional
information.
## Monitoring Status
@@ -128,7 +122,7 @@ to view more information on various status conditions.
Click the **Down Arrow** to expand the Status section. The information listed is dependent on which
-host or output is currently selected in the Monitored Hosts & Services table. Users can find information on the
+host or output is selected in the Monitored Hosts & Services table. Users can find information on the
**Current State** of a host, as well as viewing a history of changes in state.
The possible statuses depend on the type of hosts being monitored. What is common is that the status
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/auditing.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/auditing.md
index cb8b0937ce..7ba51fd4c3 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/auditing.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/auditing.md
@@ -6,14 +6,13 @@ sidebar_position: 10
# Auditing Tab
-The Auditing tab allows users to modify to modify the Isilon Options setting which was populated
-with the information entered when the Dell Isilon host is added to the Monitored Hosts & Services list.
+Use the Auditing tab to modify the Isilon Options settings that were populated when you added the Dell Isilon host to the Monitored Hosts & Services list.
The **Enable Protocol Access Auditing in OneFS if it is disabled** box allows the activity agent to
automatically enable and configure auditing on the Isilon cluster. If a manual configuration has
-been completed, do not enable these options. This option requires credentials for an Administrator
+been completed, don't enable these options. This option requires credentials for an Administrator
account on the Dell Isilon device and click Connect.
If the connection is successful, discovered access zones appear in the **Available** box. By
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/connection.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/connection.md
index 2a82598be2..4af5f30ef6 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/connection.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/connection.md
@@ -6,9 +6,7 @@ sidebar_position: 20
# Connection Tab
-Once a host is added to the monitored hosts/services table, the configuration settings are edited through the
-tabs in the host’s Properties window. The Connection tab on a host’s Properties window is specific
-to Microsoft Entra ID (formerly Azure AD), Exchange Online, and SharePoint Online hosts.
+After you add a host to the monitored hosts/services table, edit the configuration settings through the tabs in the host’s Properties window. The Connection tab on a host’s Properties window is specific to Microsoft Entra ID (formerly Azure AD), Exchange Online, and SharePoint Online hosts.
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/dell.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/dell.md
index 9ad6e090c6..04dbcc3d82 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/dell.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/dell.md
@@ -7,9 +7,7 @@ sidebar_position: 30
# Dell Tab
The Dell tab on a host’s Properties window displays the Dell Celerra/VNX, Dell Isilon/PowerScale,
-Dell PowerStore, or Dell Unity host to be monitored for activity and any host aliases. This tab is
-populated with the information entered when the Dell host is added to the monitored hosts/services table. If
-desired, specify a different device to be monitored for activity.
+Dell PowerStore, or Dell Unity host to be monitored for activity and any host aliases. This tab shows the information you entered when you added the Dell host to the monitored hosts/services table. If desired, specify a different device to be monitored for activity.
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/fpolicy.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/fpolicy.md
index d55811dd54..9600834dae 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/fpolicy.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/fpolicy.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# FPolicy Tab
-The FPolicy tab allows users to modify FPolicy settings for NetApp devices, privileged access, and
+On the FPolicy tab, you can modify FPolicy settings for NetApp devices, privileged access, and
enabling/connecting to cluster nodes.
@@ -26,9 +26,7 @@ monitor by selecting the radio buttons.
-The Privileged Access tab is enabled when the Configure FPolicy checkbox is selected at the top. The
-Privileged Access tab must be configured if automatic configuration of the FPolicy for NetApp Data
-ONTAP Cluster-Mode devices is used. See the
+The Privileged Access tab is enabled when the Configure FPolicy checkbox is selected at the top. Configure the Privileged Access tab when you automatically configure the FPolicy for NetApp Data ONTAP Cluster-Mode devices. See the
[Configure Privileged Access](/docs/activitymonitor/9.0/admin/monitoredhosts/add/netapp.md#configure-privileged-access) topic for additional
information.
@@ -40,7 +38,7 @@ The Enable and Connect settings tab is enabled when the Enable and connect FPoli
selected.
:::note
-Adding nodes are not needed if set user is using a role that has Network Interface
+Adding nodes aren't needed if set user is using a role that has Network Interface
permissions.
:::
@@ -49,7 +47,7 @@ permissions.
Add a list of cluster nodes to connect to FPolicy by clicking Add, which opens the Add or Edit
Cluster Node window. Enter at least one cluster node in the textbox. Separate multiple nodes with
-either commas (,), semicolons (;), or spaces. Click OK and the node(s) is displayed in the **Node
+either commas (,), semicolons (;), or spaces. Click OK and the nodes is displayed in the **Node
name** list.
@@ -58,7 +56,7 @@ Click Discover to open the Connect to cluster window and retrieve nodes from the
Specify the Cluster-management LIF and then enter user credentials which will be used to retrieve a
list of the cluster nodes. This credential must have at least read-only rights to run the system
-node show command on the cluster. Click Get Nodes. If a successful connection is not achieved, the
+node show command on the cluster. Click Get Nodes. If a successful connection isn't achieved, the
message indicates the error. If a successful connection is achieved, the message indicates how many
cluster nodes were discovered. Click OK and all discovered nodes are displayed in the **Node name**
list.
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/hitachinas.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/hitachinas.md
index b4a8669b30..a45e0f8834 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/hitachinas.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/hitachinas.md
@@ -6,12 +6,10 @@ sidebar_position: 50
# Hitachi NAS Tab
-Once a Hitachi host is added to the monitored hosts/services table, the configuration settings are edited
-through the tabs in the host’s Properties window. The Hitachi NAS tab on a host’s Properties window
-is specific to Hitachi hosts.
+After you add a Hitachi host to the monitored hosts/services table, edit the configuration settings through the tabs in the host’s Properties window. The Hitachi NAS tab on a host’s Properties window is specific to Hitachi hosts.
-The Hitachi NAS tab allows users to modify settings that were populated with the information entered
+Use the Hitachi NAS tab to modify settings that were populated with the information entered
when the Hitachi host was added. Additionally, the Path pooling interval can be configured. The Path
pooling interval is set to 15 seconds by default.
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/inactivityalerts.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/inactivityalerts.md
index 58714f76cb..6dc18188db 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/inactivityalerts.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/inactivityalerts.md
@@ -29,7 +29,7 @@ Configure Syslog alerts using the Syslog Alerts Tab.
The configurable options are:
-- Syslog server in SERVER[:PORT] format – Type the **Syslog server name** with a SERVER:Port format
+- Syslog server in SERVER[:PORT] format – Enter the **Syslog server name** with a SERVER:Port format
in the textbox.
- Syslog protocol – Identify the Syslog protocol to be used for the alerts
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/logontrigger.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/logontrigger.md
index 88a3419986..37b166b53b 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/logontrigger.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/logontrigger.md
@@ -6,11 +6,11 @@ sidebar_position: 70
# Logon Trigger Tab
-The Logon trigger tab on a SQL Server host's properties window is used to configure logon triggers
+The Logon trigger tab on a SQL Server host's properties window configures logon triggers
for SQL activity monitoring.
Copy and paste the SQL Script into a SQL query and execute to enable the Activity Monitor to obtain
-IP addresses of client connections. Click **Check Status** to check if the trigger is properly
+IP addresses of client connections. Click **Check Status** to verify that the trigger is properly
configured on the SQL server.
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/mssqlserver.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/mssqlserver.md
index 024f263802..fd1d171143 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/mssqlserver.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/mssqlserver.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# MS SQL Server Tab
-The MS SQL Server tab on SQL Server host's properties window is used to configure properties for
+The MS SQL Server tab on SQL Server host's properties window configures properties for
SQL activity monitoring on the host.
@@ -14,7 +14,7 @@ SQL activity monitoring on the host.
The configurable options are:
- Enable Trace automatically — Check the box to enable the activity monitor to enable Trace
- automatically if it is disabled
+ automatically when disabled
- Audit polling interval — Configure the interval between audits. The default is **15 seconds**.
- Open instruction... — Click **Open Instruction...** to view steps on how to create a login for
SQL monitoring
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/nasuni.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/nasuni.md
index ef629472fe..1c517fe469 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/nasuni.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/nasuni.md
@@ -6,12 +6,12 @@ sidebar_position: 90
# Nasuni Tab
-After a Nasuni host is added to the monitored hosts/services table, the configuration settings are edited
+After you add a Nasuni host to the monitored hosts/services table, you edit the configuration settings
using the tabs in the Properties window of the host.
-The **Nasuni** tab allows users to modify settings which were populated with the information entered
+On the **Nasuni** tab, you can modify settings with the information you entered
when the Nasuni host was added.
The configurable options are:
@@ -19,7 +19,7 @@ The configurable options are:
- Nasuni Filer – Enter the name of the filer
- Username – Enter the user name for the Nasuni account
- Password – Enter the password for the user name
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/netapp.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/netapp.md
index b9a2524fa0..51c76d9087 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/netapp.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/netapp.md
@@ -6,15 +6,14 @@ sidebar_position: 100
# NetApp Tab
-The NetApp tab on a host’s Properties window allows users to modify settings, which are populated
-with the information entered when the NetApp host is added to the monitored hosts/services table.
+The NetApp tab on a host’s Properties window lets you modify the settings you entered when you added the NetApp host to the monitored hosts/services table.
Modify the targeted NetApp device by specifying a NetApp device to be monitored for activity and
credentials to access it with the Data ONTAP API.
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
- HTTPS, ignore certificate errors
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/nutanix.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/nutanix.md
index 63fdbfdd61..093d2c1253 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/nutanix.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/nutanix.md
@@ -6,8 +6,8 @@ sidebar_position: 110
# Nutanix Tab
-The Nutanix tab allows users to modify settings after a Nutanix host has been configured. Once a
-Nutanix host is added to the monitored hosts/services table, the configuration can be edited in the host
+Use the Nutanix tab to modify settings after a Nutanix host you've configured. Once a
+Nutanix host you add to the monitored hosts/services table, you can edit the configuration in the host
Properties.
@@ -17,7 +17,7 @@ The configurable options are:
- Nutanix Filer – Enter the name of the filer
- Username – Enter the user name for the Nutanix account with REST API access
- Password – Enter the password for the user name
-- Protocol – Select a protocol for the REST API access from the drop-down menu:
+- Protocol – Select a protocol for the REST API access from the dropdown menu:
- Auto Detect
- HTTPS
@@ -37,7 +37,7 @@ verification during a TLS session
- Click **OK** to close the window and save the modifications.
:::note
-Nutanix Files does not report events for activity originating from a server where the
+Nutanix Files doesn't report events for activity originating from a server where the
Activity Monitor Agent is installed.
:::
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/overview.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/overview.md
index aac4c08b70..ff35ffabc5 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/overview.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/overview.md
@@ -11,7 +11,7 @@ through the host’s Properties window.
-On the Monitored Hosts tab, select the host and click Edit, or right-click on a host and select
+On the Monitored Hosts tab, select the host and click Edit, or right-click a host and select
**Edit Host** from the right-click menu, to open the host’s Properties window. The tabs vary based
on the type of host selected:
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/panzura.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/panzura.md
index cd9b0d2dbc..b552b9f5fd 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/panzura.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/panzura.md
@@ -6,20 +6,19 @@ sidebar_position: 120
# Panzura Tab
-After a Panzura host is added to the monitored hosts/services table, the configuration settings are edited
+After you add a Panzura host to the monitored hosts/services table, you edit the configuration settings
using the tabs in the Properties window of the host.
-The **Panzura** tab allows users to modify settings which were populated with the information
-entered when the Panzura host was added.
+Use the **Panzura** tab to modify settings with the information you entered when you added the Panzura host.
The configurable options are:
- Panzura Filer – Enter the name of the filer
- Username – Enter the user name for the Panzura account
- Password – Enter the password for the user name
-- Protocol – Select from the following options in the drop-down list:
+- Protocol – Select from the following options in the dropdown list:
- Auto Detect
- HTTPS
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/qumulo.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/qumulo.md
index abde3b5a15..3ebe3b386d 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/qumulo.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/qumulo.md
@@ -6,8 +6,8 @@ sidebar_position: 130
# Qumulo Tab
-The Qumulo tab allows users to modify settings after a Qumulo host has been configured. Once a
-Qumulo host is added to the monitored hosts/services table, the configuration can be edited in the host
+The Qumulo tab lets you modify settings for a Qumulo host you've configured. After you
+add a Qumulo host to the monitored hosts/services table, you can edit the configuration in the host
Properties.
@@ -17,7 +17,7 @@ The configurable options are:
- Cluster name – Enter the name of the filer
- Username – Enter the user name for the Qumulo user
- Password – Enter the password for the user name
-- Protocol – Select one of the following protocols from the drop-down menu:
+- Protocol – Select one of the following protocols from the dropdown menu:
- Auto Detect
- HTTPS
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/sharepoint.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/sharepoint.md
index aba47f2739..dcbaa59a6b 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/sharepoint.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/sharepoint.md
@@ -6,17 +6,16 @@ sidebar_position: 140
# SharePoint Tab
-The SharePoint tab on a host’s Properties window allows users to modify settings that are populated
-with the information entered when the SharePoint host is added.
+Use the SharePoint tab on a host’s Properties window to modify settings with the information you entered when you added the SharePoint host.
The configurable options are:
- Enable auditing on selected site collections - Check the box to enable auditing on selected site
- collections. Enabling this option will ensure that auditing is enabled for all monitored site
+ collections. Enabling this option ensures the system audits all monitored site
collections with periodic checks.
-- Choose to audit all sites or scope the monitoring to specific site(s):
+- Choose to audit all sites or scope the monitoring to specific sites:
- Audit all sites – Leave textbox for URLs blank
- Scope to specific sites – List URLs for sites to be monitored in the textbox. List should be
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/tweakoptions.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/tweakoptions.md
index d0ae6d2035..4cf081534a 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/tweakoptions.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/tweakoptions.md
@@ -6,7 +6,7 @@ sidebar_position: 150
# Tweak Options Tab
-The Tweak Options tab on a SQL Server host's properties window is used to configure extended events
+The Tweak Options tab on a SQL Server host's properties window configures extended events
operations for SQL activity monitoring.
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/unixids.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/unixids.md
index 2c2dfc3f86..bbc8b99f4d 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/unixids.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/unixids.md
@@ -9,8 +9,8 @@ sidebar_position: 160
The Unix IDs tab provides configuration options to translate Unix IDs (UID) to SIDs. This tab
applies to NetApp devices, Dell devices, and Nasuni Edge Appliances.
-When activity is performed on an NFS resource, UIDs are returned for that activity event. Depending
-on the operating system, the UID can be mapped to Active Directory accounts using the uidNumber
+When you perform activity on an NFS resource, UIDs are returned for that activity event. Depending
+on the operating system, you can map the UID to Active Directory accounts using the uidNumber
attribute in Active Directory. The activity agent resolves the Active Directory SID based on the UID
from the activity event.
@@ -24,7 +24,7 @@ The options are:
- This container and its descendants
- This container only
- Search - Search using the following specifications:
- - by an attribute – Specify an LDAP filter. This attribute cannot be empty.
+ - by an attribute – Specify an LDAP filter. This attribute can't be empty.
- with a custom filter – Use the %UID% macro for a Unix ID value
- Provide UID for test/Test – Test button performs a search in the specified container with the
scope and the filter, replacing %UID% with 0 for the test
diff --git a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/windows.md b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/windows.md
index 97ff0873d2..9198df67af 100644
--- a/docs/activitymonitor/9.0/admin/monitoredhosts/properties/windows.md
+++ b/docs/activitymonitor/9.0/admin/monitoredhosts/properties/windows.md
@@ -11,4 +11,4 @@ The Windows tab on a host's Properties window is specific to Windows hosts.
Select whether to report the host name as either a **NETBIOS name** or a **Fully qualified domain
-name**. The Host Name can be previewed to see how it appears depending on the option selected.
+name**. The Host Name preview shows how it appears depending on the option you select.
diff --git a/docs/activitymonitor/9.0/admin/outputs/accountexclusions/accountexclusions.md b/docs/activitymonitor/9.0/admin/outputs/accountexclusions/accountexclusions.md
index 76954fb874..ecda670398 100644
--- a/docs/activitymonitor/9.0/admin/outputs/accountexclusions/accountexclusions.md
+++ b/docs/activitymonitor/9.0/admin/outputs/accountexclusions/accountexclusions.md
@@ -6,8 +6,7 @@ sidebar_position: 10
# Account Exclusions Tab
-The Account Exclusions tab on an output Properties window is where monitoring scope by account name
-can be modified. These settings are initially configured when the output is added.
+Use the Account Exclusions tab on an output Properties window to modify monitoring scope by account name. The system initially configures these settings when you add the output.
Select an output from the Monitored Hosts & Services tab and click **Edit** to open the output Properties
window. The tab varies based on the type of host selected.
@@ -23,19 +22,16 @@ The tab contains the following settings:
information.
- Add Unix Account – Opens the Specify Unix Account window to add an account for exclusion. See the
[Specify Unix Account Window](/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifyunixaccount.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. No confirmation appears.
:::warning
- If an account is removed by accident, use the **Cancel** button to discard the
- change.
+ If you remove an account by accident, use the **Cancel** button to discard the change.
:::
-- Process group membership when filtering – Indicates if group memberships is processed when
- filtering accounts
+- Process group membership when filtering – Indicates whether the system processes group memberships when filtering accounts
-The table lists accounts that are being excluded from monitoring, displaying columns for Account
-Name and Account Type. By default, no accounts are being excluded.
+The table lists accounts that you exclude from monitoring, displaying columns for Account Name and Account Type. By default, the system excludes no accounts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The output
Properties window closes.
@@ -51,19 +47,16 @@ The tab contains the following settings:
information.
- Add Unix Account – Opens the Specify Unix Account window to add an account for exclusion. See the
[Specify Unix Account Window](/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifyunixaccount.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. No confirmation appears.
:::warning
- If an account is removed by accident, use the **Cancel** button to discard the
- change.
+ If you remove an account by accident, use the **Cancel** button to discard the change.
:::
-- Process group membership when filtering – Indicates if group memberships is processed when
- filtering accounts
+- Process group membership when filtering – Indicates whether the system processes group memberships when filtering accounts
-The table lists accounts that are being excluded from monitoring, displaying columns for Account
-Name and Account Type. By default, no accounts are being excluded.
+The table lists accounts that you exclude from monitoring, displaying columns for Account Name and Account Type. By default, the system excludes no accounts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The output
Properties window closes.
@@ -79,19 +72,16 @@ The tab contains the following settings:
information.
- Add Unix Account – Opens the Specify Unix Account window to add an account for exclusion. See the
[Specify Unix Account Window](/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifyunixaccount.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. No confirmation appears.
:::warning
- If an account is removed by accident, use the **Cancel** button to discard the
- change.
+ If you remove an account by accident, use the **Cancel** button to discard the change.
:::
-- Process group membership when filtering – Indicates if group memberships is processed when
- filtering accounts
+- Process group membership when filtering – Indicates whether the system processes group memberships when filtering accounts
-The table lists accounts that are being excluded from monitoring, displaying columns for Account
-Name and Account Type. By default, no accounts are being excluded.
+The table lists accounts that you exclude from monitoring, displaying columns for Account Name and Account Type. By default, the system excludes no accounts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The output
Properties window closes.
@@ -107,19 +97,16 @@ The tab contains the following settings:
information.
- Add SharePoint Account – Opens the Specify account window to add an account for exclusion. See the
[Specify Account Window](/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifysharepointaccount.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. No confirmation appears.
:::warning
- If an account is removed by accident, use the **Cancel** button to discard the
- change.
+ If you remove an account by accident, use the **Cancel** button to discard the change.
:::
-- Process group membership when filtering – Indicates if group memberships is processed when
- filtering accounts
+- Process group membership when filtering – Indicates whether the system processes group memberships when filtering accounts
-The table lists accounts that are being excluded from monitoring, displaying columns for Account
-Name and Account Type. By default, no accounts are being excluded.
+The table lists accounts that you exclude from monitoring, displaying columns for Account Name and Account Type. By default, the system excludes no accounts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The output
Properties window closes.
@@ -132,19 +119,16 @@ The tab contains the following settings:
- Add Sql User – Opens the Specify Sql User name window to add an account for exclusion. See the
[Specify Sql User Name Window](/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifysqluser.md) topic for additional information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. No confirmation appears.
:::warning
- If an account is removed by accident, use the **Cancel** button to discard the
- change.
+ If you remove an account by accident, use the **Cancel** button to discard the change.
:::
-- Process group membership when filtering – Indicates if group memberships is processed when
- filtering accounts
+- Process group membership when filtering – Indicates whether the system processes group memberships when filtering accounts
-The table lists accounts that are being excluded from monitoring, displaying columns for Account
-Name and Account Type. By default, no accounts are being excluded.
+The table lists accounts that you exclude from monitoring, displaying columns for Account Name and Account Type. By default, the system excludes no accounts.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The output
Properties window closes.
@@ -158,18 +142,16 @@ The tab contains the following settings:
- Add Windows Account – Opens the Specify account or group window to add an account for exclusion.
See the [Specify Account or Group Window](/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifywindowsaccount.md) topic for additional
information.
-- Remove – Removes the selected account from exclusion. Confirmation is not requested.
+- Remove – Removes the selected account from exclusion. No confirmation appears.
:::warning
- If an account is removed by accident, use the **Cancel** button to discard the
- change.
+ If you remove an account by accident, use the **Cancel** button to discard the change.
:::
-- Process group membership when filtering – Indicates if group memberships is processed when
- filtering accounts
+- Process group membership when filtering – Indicates whether the system processes group memberships when filtering accounts
-The table lists accounts that are being excluded from monitoring, displaying columns for Account
+The table lists accounts you're excluding from monitoring, displaying columns for Account
Name and Account Type. By default, the Windows File Server monitoring is excluding the following
accounts:
diff --git a/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifysharepointaccount.md b/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifysharepointaccount.md
index 0caf42a1e7..a49f210518 100644
--- a/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifysharepointaccount.md
+++ b/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifysharepointaccount.md
@@ -6,18 +6,17 @@ sidebar_position: 10
# Specify Account Window
-The Specify account window is opened from a field where a SharePoint account is needed.
+This window opens when you need to specify a SharePoint account in a field.
There are two options for specifying an account:
-- SharePoint System Accounts – Check the boxes for the desired system accounts: SHAREPOINT\system,
+- SharePoint System Accounts – Check the boxes for the system accounts you want: SHAREPOINT\system,
-1, S-1-0-0 (Null SID)
- Custom – Enter the account in the textbox. Multiple accounts can be added using a semicolon (;).
- For System Service Accounts – Enter the SID for system service accounts
- For Local User Accounts – Enter either the user name or SID for the local account
-Click **OK**. The Specify account window closes, and the account is added to the field where the
-window was opened.
+Click **OK**. The Specify account window closes, and the system adds the account to the field.
diff --git a/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifysqluser.md b/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifysqluser.md
index f72a6d524d..e026d3ec91 100644
--- a/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifysqluser.md
+++ b/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifysqluser.md
@@ -6,10 +6,10 @@ sidebar_position: 30
# Specify Sql User Name Window
-The Specify Sql User name window is opened from a field where a SQL Server account is needed.
+This window opens when you need to specify a SQL Server account in a field.
Enter the SQL Server user name into the text box. Multiple user names can be added using a semicolon
(;), a comma (,), or a space. Then click OK. The Specify Sql User name window closes, and the
-account is added to the field where the window was opened.
+system adds the account to the field.
diff --git a/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifyunixaccount.md b/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifyunixaccount.md
index 7f0a42eb62..89bb3af473 100644
--- a/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifyunixaccount.md
+++ b/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifyunixaccount.md
@@ -6,10 +6,10 @@ sidebar_position: 40
# Specify Unix Account Window
-The Specify Unix Account or group window is opened from a field where a Unix account is needed.
+This window opens when you need to specify a Unix account in a field.
-Type the UID for the desired account in the textbox. Multiple UIDs can be added using a semicolon
+Enter the UID for the account you want in the textbox. Multiple UIDs can be added using a semicolon
(;), a comma (,), or a space. Then click OK. The Specify Unix Account window closes, and the account
-is added to the field where the window was opened.
+the system adds it to the field.
diff --git a/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifywindowsaccount.md b/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifywindowsaccount.md
index 15e3fe7d08..7bbefbefdc 100644
--- a/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifywindowsaccount.md
+++ b/docs/activitymonitor/9.0/admin/outputs/accountexclusions/specifywindowsaccount.md
@@ -6,13 +6,13 @@ sidebar_position: 20
# Specify Account or Group Window
-The Specify account or group window is opened from a field where a Windows account is needed.
+The Specify account or group window opens when you need to specify a Windows account in a field.
-Follow the steps to use this window.
+To use this window, follow these steps:
-**Step 1 –** Select the Domain from the drop-down menu.
+**Step 1 –** Select the Domain from the dropdown menu.
**Step 2 –** Enter the Account in the textbox.
@@ -20,10 +20,9 @@ Follow the steps to use this window.
- Use the ellipsis (…) button to open the Select Users, Computers, Service Accounts, or Groups
window to browse for an account.
-**Step 3 –** Then click Resolve. A message displays indicating whether or not the account could be
+**Step 3 –** Then click Resolve. A message displays indicating whether the account could be
resolved.
**Step 4 –** If successful, click OK.
-The Specify account or group window closes, and the account is added to the field where the window
-was opened.
+The Specify account or group window closes, and the system adds the account to the field.
diff --git a/docs/activitymonitor/9.0/admin/outputs/additionalproperties.md b/docs/activitymonitor/9.0/admin/outputs/additionalproperties.md
index aa95f6aa72..13dae3b175 100644
--- a/docs/activitymonitor/9.0/admin/outputs/additionalproperties.md
+++ b/docs/activitymonitor/9.0/admin/outputs/additionalproperties.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# Additional Properties Tab
The Additional Properties tab on an output Properties window is where comments and displayed host
-name can be modified. These settings are initially configured when the output is added.
+name can be modified. The system initially configures these settings when you add the output.
Select an output from the Monitored Hosts & Services tab and click **Edit** to open the output Properties
window.
@@ -16,12 +16,12 @@ window.
The options are:
-- Report hostname as – The value entered here will customize the hostname that is reported for the
- event in the activity log outputs
-- Comment – The value entered here will appear in the Comments column in the Monitored Hosts & Services tab
+- Report hostname as – Enter a value here to customize the hostname in the activity log outputs
+ for the event
+- Comment – Your entry appears in the Comments column in the Monitored Hosts & Services tab
table.
-Often, the Additional Properties Tab is used to indicate the purpose of the output, e.g. for Netwrix
+Often, the Additional Properties Tab indicates the purpose of the output, e.g. for Netwrix
Access Analyzer . This can be useful if using multiple outputs with
different configurations for different purposes. For example, a SharePoint site could be added as a
host and configured for Netwrix Access Analyzer data collection. It
@@ -35,4 +35,4 @@ Properties window closes.
If a Threat Prevention Agent has been deployed to the same Windows proxy server where and activity
agent is deployed to monitor NAS devices, then the **Comment** column in the monitored hosts/services table
identifies the host as being “Managed by Threat Prevention”, and that ‘monitored host’ configuration
-is not editable through the Activity Monitor Console. Simply add the host again for other outputs.
+isn't editable through the Activity Monitor Console. Simply add the host again for other outputs.
diff --git a/docs/activitymonitor/9.0/admin/outputs/gidexclusions/addeditgid.md b/docs/activitymonitor/9.0/admin/outputs/gidexclusions/addeditgid.md
index 6071172afe..123d794f6c 100644
--- a/docs/activitymonitor/9.0/admin/outputs/gidexclusions/addeditgid.md
+++ b/docs/activitymonitor/9.0/admin/outputs/gidexclusions/addeditgid.md
@@ -6,9 +6,9 @@ sidebar_position: 10
# Add or Edit GID Window
-The Add or Edit GID window is opened from a field where a Linux group is needed.
+This window opens when you need to specify a Linux group in a field.
-Type the GID for the desired group in the textbox. Then click OK. The Add or Edit GID window closes,
-and the group is added to the field where the window was opened.
+Enter the GID for the group you want in the textbox. Then click OK. The Add or Edit GID window closes,
+and the system adds the group to the field.
diff --git a/docs/activitymonitor/9.0/admin/outputs/gidexclusions/gidexclusions.md b/docs/activitymonitor/9.0/admin/outputs/gidexclusions/gidexclusions.md
index db7e1cf684..8d3a32dcd5 100644
--- a/docs/activitymonitor/9.0/admin/outputs/gidexclusions/gidexclusions.md
+++ b/docs/activitymonitor/9.0/admin/outputs/gidexclusions/gidexclusions.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# GID Exclusions Tab
The GID Exclusions tab on an output Properties window is where monitoring scope by group can be
-modified. These settings are initially configured when the output is added.
+modified. The system initially configures these settings when you add the output.
Select an output for a Linux host on the Monitored Hosts & Services tab and click **Edit** to open the output
Properties window.
@@ -18,10 +18,10 @@ The tab contains the following settings:
- Add – Opens the Add or Edit GID window to add a group for exclusion. See the
[Add or Edit GID Window](/docs/activitymonitor/9.0/admin/outputs/gidexclusions/addeditgid.md) topic for additional information.
-- Remove – Removes the selected group from exclusion. Confirmation is not requested.
+- Remove – Removes the selected group from exclusion. Confirmation isn't requested.
:::warning
- If an account is removed by group, use the **Cancel** button to discard the change.
+ If you remove a group by mistake, use the **Cancel** button to discard the change.
:::
diff --git a/docs/activitymonitor/9.0/admin/outputs/logfiles.md b/docs/activitymonitor/9.0/admin/outputs/logfiles.md
index a24ba54ba3..43ecb1b5ac 100644
--- a/docs/activitymonitor/9.0/admin/outputs/logfiles.md
+++ b/docs/activitymonitor/9.0/admin/outputs/logfiles.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Log Files Tab
The Log Files tab on an output Properties window is where the activity log settings can be modified.
-These settings are initially configured when the output is added.
+These settings are initially configured when you add the output.
Select a File output from either the Monitored Domains tab or the Monitored Hosts & Services tab and click
**Edit** to open the output Properties window. The tab varies based on the type of domain/host
@@ -26,7 +26,7 @@ The tab contains the following settings:
information recorded per event.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
@@ -48,7 +48,7 @@ The tab contains the following settings:
- Enable periodic AD Status Check event reporting – Indicates periodic AD Status Check event
- reporting is enabled, which means the agent will send out status messages every five minutes to
+ reporting sends status messages from the agent every five minutes to
verify whether the connection is still active.
Click **OK** to commit the modifications. Click **Cancel** to discard the modifications. The output
@@ -66,7 +66,7 @@ The tab contains the following settings:
is 10 days.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
@@ -83,24 +83,22 @@ The tab contains the following settings:
[Netwrix Access Analyzer Documentation](https://helpcenter.netwrix.com/category/accessanalyzer)
for additional information.
- For integration with Netwrix Threat Prevention NAS monitoring, this setting only controls the
- log retention period for NAS devices, as Netwrix Threat Prevention does not read Windows file
+ log retention period for NAS devices, as Netwrix Threat Prevention doesn't read Windows file
server activity from Activity Monitor.
-- Report account names – Indicates if an Account Name column is added in the activity log files
-- Add header to Log files – Indicates if headers are added in the activity log filesAdd header to
- Log files – Indicates if headers are added in the activity log files
+- Report account names – Whether an Account Name column appears in the activity log files
+- Add header to Log files – Whether headers appear in the activity log files
:::note
- This is needed to feed data into Splunk in a Syslog output. However, Netwrix Access
- Analyzer does not support log files with headers. Therefore, do
+ Enable this to feed data into Splunk in a Syslog output. However, Netwrix Access
+ Analyzer doesn't support log files with headers. Therefore, do
not select this option for a File output designed for Netwrix Access Analyzer.
:::
-- Report UNC paths – Indicates if a UNC Path column and a Rename UNC Path column are added in the
- activity log files. This option corresponds to the REPORT_UNC_PATH parameter in the INI file. When
- the option is enabled, the added columns are populated when a file is accessed remotely through
- the UNC Path. If a file is accessed locally, these columns are empty.
+- Report UNC paths – Whether the activity log files include a UNC Path column and a Rename UNC Path column. This option corresponds to the REPORT_UNC_PATH parameter in the INI file. When
+ you enable this option, the columns contain data when you access a file remotely through
+ the UNC Path. If you access a file locally, these columns remain empty.
- The UNC Path is in the following format:
@@ -142,7 +140,7 @@ The tab contains the following settings:
is 10 days.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
@@ -153,22 +151,20 @@ The tab contains the following settings:
:::
-- Add header to Log files – Indicates if headers are added in the activity log filesAdd header to
- Log files – Indicates if headers are added in the activity log files
+- Add header to Log files – Whether headers appear in the activity log files
:::note
- This is needed to feed data into Splunk in a Syslog output. However, Netwrix Access
- Analyzer does not support log files with headers. Therefore, do
+ Enable this to feed data into Splunk in a Syslog output. However, Netwrix Access
+ Analyzer doesn't support log files with headers. Therefore, do
not select this option for a File output designed for Netwrix Access Analyzer.
:::
- Add C:\ to the beginning of the reported file paths – Adds C:\ to the beginning of the reported
file paths in the activity log file
-- Report UNC paths – Indicates if a UNC Path column and a Rename UNC Path column are added in the
- activity log files. This option corresponds to the REPORT_UNC_PATH parameter in the INI file. When
- the option is enabled, the added columns are populated when a file is accessed remotely through
- the UNC Path. If a file is accessed locally, these columns are empty.
+- Report UNC paths – Whether the activity log files include a UNC Path column and a Rename UNC Path column. This option corresponds to the REPORT_UNC_PATH parameter in the INI file. When
+ you enable this option, the columns contain data when you access a file remotely through
+ the UNC Path. If you access a file locally, these columns remain empty.
- Report operations with millisecond precision – Indicates the timestamps of events being recorded
in the activity log file has been changed for better ordering of events if multiple events occur
within the same second
@@ -197,7 +193,7 @@ The tab contains the following settings:
is 10 days.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
@@ -236,7 +232,7 @@ The tab contains the following settings:
is 10 days.
:::note
- This setting effects activity log retention whether or not the archiving feature is
+ This setting effects activity log retention whether the archiving feature is
enabled.
:::
diff --git a/docs/activitymonitor/9.0/admin/outputs/operations/suppress.md b/docs/activitymonitor/9.0/admin/outputs/operations/suppress.md
index d3f4f6e0f3..517850187f 100644
--- a/docs/activitymonitor/9.0/admin/outputs/operations/suppress.md
+++ b/docs/activitymonitor/9.0/admin/outputs/operations/suppress.md
@@ -14,7 +14,7 @@ actions that have not been explicitly triggered by users.
One of the most prominent examples is the Windows File Explorer - the standard application for file
system browsing on the Windows family of operating systems. Over the years, File Explorer has had a
number of improvements and new features. File Explorer displays various information about files to
-provide a better user experience. This allows users to view file content without having to open
+provide a better user experience. Users can view file content without having to open
them.
File Explorer displays icons for certain file types like executable (.exe) files. Depending on the
@@ -25,7 +25,7 @@ thumbnail of the files contained within the sub-folder on top of the sub-folder
additional functionality is executed automatically, mostly without the user's explicit action or
intention.
-As an example, a user may wish to open the MySampleReport.docx document located in the
+As an example, a user may want to open the MySampleReport.docx document located in the
MyTestDepartment folder. The user opens the folder, locates the file and double-clicks to open it.
From the user's perspective, only two actions were performed:
@@ -50,7 +50,7 @@ teams and IT auditing software. At the file system level, preview reads are perc
operations, like file copying or opening a file in an application. There exists no distinguishing
factor between explicit user activity and implicit actions by File Explorer. Whether it is a preview
read, opening the file in Notepad, or copying the file, all these operations are perceived as the
-same Read operation at the file system level. Therefore, it is not possible to reliably filter
+same Read operation at the file system level. Therefore, it isn't possible to reliably filter
unintentional activity without the risk of suppressing genuine user actions.
The Activity Monitor employs various techniques to minimize noise. These methods all rely on
diff --git a/docs/activitymonitor/9.0/admin/outputs/pathfiltering/addeditpath.md b/docs/activitymonitor/9.0/admin/outputs/pathfiltering/addeditpath.md
index 140c6128cf..16719bac3e 100644
--- a/docs/activitymonitor/9.0/admin/outputs/pathfiltering/addeditpath.md
+++ b/docs/activitymonitor/9.0/admin/outputs/pathfiltering/addeditpath.md
@@ -20,7 +20,7 @@ the monitored host.
## Special Consideration for NAS Device Hosts
-For NAS devices, the activity agent can configured to add ‘C:\’ to the beginning of the path, which
+For NAS devices, the activity agent can be configured to add ‘C:\’ to the beginning of the path, which
is a requirement for the output that is designated for StealthAUDIT.exe or being read by a Netwrix
Threat Prevention agent. That configuration is on the [Log Files Tab](/docs/activitymonitor/9.0/admin/outputs/logfiles.md). If the option
is enabled for this monitored device, start your paths with C:\.
diff --git a/docs/activitymonitor/9.0/admin/outputs/pathfiltering/pathfiltering.md b/docs/activitymonitor/9.0/admin/outputs/pathfiltering/pathfiltering.md
index 99a34d988a..5865878807 100644
--- a/docs/activitymonitor/9.0/admin/outputs/pathfiltering/pathfiltering.md
+++ b/docs/activitymonitor/9.0/admin/outputs/pathfiltering/pathfiltering.md
@@ -21,7 +21,7 @@ The tab contains the following settings and features:
- Add – Opens the Add or Edit Path window to add a new path to the list. See the
[Add or Edit Path Window](/docs/activitymonitor/9.0/admin/outputs/pathfiltering/addeditpath.md) topic for additional information.
-- Remove – Removes the selected path from the list. Confirmation is not requested.
+- Remove – Removes the selected path from the list. Confirmation isn't requested.
:::warning
If a path is removed by accident, use the **Cancel** button to discard the change.
@@ -32,7 +32,7 @@ The tab contains the following settings and features:
buttons move the selected path up or down in the list
- Edit – Opens the Add or Edit Path window to modify the selected path. See the
[Add or Edit Path Window](/docs/activitymonitor/9.0/admin/outputs/pathfiltering/addeditpath.md) topic for additional information.
-- Type a path below to test whether it will be included or excluded – Enter a path in the textbox to
+- Test path – Enter a path in the textbox to
test whether it will be included/excluded based on the path filtering list
- Result – Under the text box, a description of whether the indicated path is included or
@@ -55,7 +55,7 @@ precedence, and the ‘Edward’ child folder will not be monitored.
:::note
-If ‘Include’ is not listed under the Filter Type column (or no Include filter paths are
+If ‘Include’ isn't listed under the Filter Type column (or no Include filter paths are
added), then all current and new discovered drives will be monitored.
:::
@@ -71,7 +71,7 @@ The tab contains the following settings and features:
- Add – Opens the Add or Edit Path window to add a new path to the list. See the
[Add or Edit Path Window](/docs/activitymonitor/9.0/admin/outputs/pathfiltering/addeditpath.md) topic for additional information.
-- Remove – Removes the selected path from the list. Confirmation is not requested.
+- Remove – Removes the selected path from the list. Confirmation isn't requested.
:::warning
If a path is removed by accident, use the **Cancel** button to discard the change.
@@ -82,7 +82,7 @@ The tab contains the following settings and features:
buttons move the selected path up or down in the list
- Edit – Opens the Add or Edit Path window to modify the selected path. See the
[Add or Edit Path Window](/docs/activitymonitor/9.0/admin/outputs/pathfiltering/addeditpath.md) topic for additional information.
-- Type a path below to test whether it will be included or excluded – Enter a path in the textbox to
+- Test path – Enter a path in the textbox to
test whether it will be included/excluded based on the path filtering list
- Result – Under the text box, a description of whether the indicated path is included or
@@ -105,7 +105,7 @@ precedence, and the ‘Edward’ child folder will not be monitored.
:::note
-If ‘Include’ is not listed under the Filter Type column (or no Include filter paths are
+If ‘Include’ isn't listed under the Filter Type column (or no Include filter paths are
added), then all current and new discovered drives will be monitored.
:::
@@ -135,7 +135,7 @@ The tab contains the following settings and features:
- Add – Opens the Add or Edit Path window to add a new path to the list. See the
[Add or Edit Path Window](/docs/activitymonitor/9.0/admin/outputs/pathfiltering/addeditpath.md) topic for additional information.
-- Remove – Removes the selected path from the list. Confirmation is not requested.
+- Remove – Removes the selected path from the list. Confirmation isn't requested.
:::warning
If a path is removed by accident, use the **Cancel** button to discard the change.
@@ -148,7 +148,7 @@ The tab contains the following settings and features:
[Add or Edit Path Window](/docs/activitymonitor/9.0/admin/outputs/pathfiltering/addeditpath.md) topic for additional information.
- Add all local drives – Retrieves and adds all local drives to the bottom of the list with a type
of Include
-- Type a path below to test whether it will be included or excluded – Enter a path in the textbox to
+- Test path – Enter a path in the textbox to
test whether it will be included/excluded based on the path filtering list
- Result – Under the text box, a description of whether the indicated path is included or
@@ -171,7 +171,7 @@ precedence, and the ‘Edward’ child folder will not be monitored.
:::note
-If ‘Include’ is not listed under the Filter Type column (or no Include filter paths are
+If ‘Include’ isn't listed under the Filter Type column (or no Include filter paths are
added), then all current and new discovered drives will be monitored.
:::
diff --git a/docs/activitymonitor/9.0/admin/outputs/processexclusions/addeditprocess.md b/docs/activitymonitor/9.0/admin/outputs/processexclusions/addeditprocess.md
index 215dd6bc2f..cdc413d9a7 100644
--- a/docs/activitymonitor/9.0/admin/outputs/processexclusions/addeditprocess.md
+++ b/docs/activitymonitor/9.0/admin/outputs/processexclusions/addeditprocess.md
@@ -14,7 +14,7 @@ output Properties window.
- Process name – Displays the name of the process to be excluded. You can enter a process name in
the textbox or select a process from the Running processes list.
- Filter – Indicates if the filter will be for **All events** or only **Read events**
-- Running Processes – Lists all processes currently running on the host
+- Running Processes – Lists all processes running on the host
-Then click OK. The Add or Edit Path window closes, and the path is added to the filtering list for
+Then click OK. The Add or Edit Process window closes, and the process is added to the exclusion list for
the monitored host.
diff --git a/docs/activitymonitor/9.0/admin/outputs/processexclusions/processexclusions.md b/docs/activitymonitor/9.0/admin/outputs/processexclusions/processexclusions.md
index 74b079cab3..27f4713911 100644
--- a/docs/activitymonitor/9.0/admin/outputs/processexclusions/processexclusions.md
+++ b/docs/activitymonitor/9.0/admin/outputs/processexclusions/processexclusions.md
@@ -23,7 +23,7 @@ The tab contains the following settings and features:
- Add – Opens the Add or Edit Process window to add a new process to the list. See the
[Add or Edit Process Window](/docs/activitymonitor/9.0/admin/outputs/processexclusions/addeditprocess.md) topic for additional information.
-- Remove – Removes the selected path from the list. Confirmation is not requested.
+- Remove – Removes the selected process from the list. Confirmation isn't requested.
:::warning
If a process is removed by accident, use the **Cancel** button to discard the
diff --git a/docs/activitymonitor/9.0/admin/outputs/syslog/messagetemplate.md b/docs/activitymonitor/9.0/admin/outputs/syslog/messagetemplate.md
index 8e748ef3b7..2731c63d35 100644
--- a/docs/activitymonitor/9.0/admin/outputs/syslog/messagetemplate.md
+++ b/docs/activitymonitor/9.0/admin/outputs/syslog/messagetemplate.md
@@ -11,7 +11,7 @@ field on the Syslog tab of the output Properties window.
-You can select a preconfigured template from the drop-down menu or create a custom template. The
+You can select a preconfigured template from the dropdown menu or create a custom template. The
available preconfigured templates vary based on the type of domain/host selected.
## For Monitored Domains
@@ -19,8 +19,8 @@ available preconfigured templates vary based on the type of domain/host selected
Monitored Domains Syslog outputs have the following preconfigured Templates:
- V 1.0 for AlienVault SIEM
-- V 1.0 for Generic CEF SIEM – Incorporates the CEF message format
-- V 1.0 for Generic LEEF SIEM – Incorporates the LEEF message format
+- V 1.0 for Generic Common Event Format (CEF) SIEM – Incorporates the CEF message format
+- V 1.0 for Generic Log Event Extended Format (LEEF) SIEM – Incorporates the LEEF message format
- V 1.0 for Generic SYSLOG SIEM
- V 1.0 for HP ArcSight SIEM
- V 1.0 for LogRhythm SIEM
@@ -30,7 +30,7 @@ Monitored Domains Syslog outputs have the following preconfigured Templates:
- V 2.0 for IBM QRadar SIEM 7.2.4
- V 2.0 for Splunk SIEM
-Custom templates can be created. Select the desired template or create a new template by modifying
+Custom templates can be created. Select the template you want or create a new template by modifying
an existing template within the Message Template window. The new message template will be named
Custom. Macro variables are also available to customize the Syslog message template.
@@ -102,7 +102,7 @@ Monitored Hosts/Services Syslog outputs have the following preconfigured Templat
- Netwrix Threat Manager (StealthDEFEND) – Use this template for Netwrix Threat Manager integration.
This is the only supported template for Threat Manager.
-Custom templates can be created. Select the desired template or create a new template by modifying
+Custom templates can be created. Select the template you want or create a new template by modifying
an existing template within the Message Template window. The new message template will be named
Custom. Macro variables are also available to customize the Syslog message template.
@@ -127,10 +127,10 @@ the Syslog message template:
| SharePoint Online | %DEST_FILENAME% | Name of the file that is copied or moved |
| SharePoint Online | %DEST_RELATIVE_PATH% | URL of the destination folder where a folder is copied or moved |
| SharePoint Online | %DLP_EXCEPTION% | Reasons why a policy no longer applies and any information about false positive or override |
-| SharePoint Online | %DLP_POLICY% | Policy(s) that triggered the event |
+| SharePoint Online | %DLP_POLICY% | Policies that triggered the event |
| SharePoint Online | %DLP_SENSITIVE% | Indicates whether the event contains the value of the sensitive data type (true/false) |
| SharePoint SharePoint Online | %DOC_LOCATION% | A relative URL of the file or document accessed by the user |
-| SharePoint SharePoint Online | %EVENT_DATA% | - For SharePoint, raw event data - Fore SharePoint Online, additional event data |
+| SharePoint SharePoint Online | %EVENT_DATA% | - For SharePoint, raw event data - For SharePoint Online, additional event data |
| File Servers & NAS Devices | %EVENT_NAME% | Operation type: Read/Create/Update/Delete/Access Rights Change/ Rename/ ``. The same as %OPERATION% |
| SharePoint SharePoint Online | %EVENT_SOURCE% | Originating source of the event (SharePoint or ObjectModel) |
| File Servers & NAS Devices | %EVENT_SOURCE_NAME% | Domain name |
@@ -168,7 +168,7 @@ the Syslog message template:
| SharePoint | %PARAM% | Parameters that come with the event |
| SharePoint | %PATH% | Truncated path |
| File Servers & NAS Devices | %PERMISSIONS_SDDL_DESCRIPTION% | Windows events only: Permission change details in readable format |
-| File Servers & NAS Devices | %PERMISSIONS_SDDL_DIFF% | Windows events only: Permission change details in SDDL format, '`` ``' |
+| File Servers & NAS Devices | %PERMISSIONS_SDDL_DIFF% | Windows events only: Permission change details in Security Descriptor Definition Language (SDDL) format, '`` ``' |
| File Servers & NAS Devices | %PERPETRATOR% | User name |
| File Servers & NAS Devices SharePoint SharePoint Online | %PRODUCT% | Fixed string: Activity Monitor |
| File Servers & NAS Devices SharePoint SharePoint Online | %PRODUCT_VERSION% | Product Version |
diff --git a/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md b/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md
index 49e9be7f76..3e5d3779b0 100644
--- a/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md
+++ b/docs/activitymonitor/9.0/admin/outputs/syslog/syslog.md
@@ -26,10 +26,10 @@ The tab contains the following settings:
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -42,7 +42,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -63,13 +63,13 @@ The tab contains the following settings:
organization’s environment can resolve the name format used.
- The default port for Netwrix Threat Manager is 10001.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- UPD is the only protocol supported for Threat Manager.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -82,7 +82,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -102,10 +102,10 @@ The tab contains the following settings:
- The server name can be short name, fully qualified name (FQDN), or IP Address, as long as the
organization’s environment can resolve the name format used.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -115,7 +115,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -136,13 +136,13 @@ The tab contains the following settings:
organization’s environment can resolve the name format used.
- The default port for Netwrix Threat Manager is 10000.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- UPD is the only protocol supported for Threat Manager.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -156,7 +156,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
@@ -177,13 +177,13 @@ The tab contains the following settings:
organization’s environment can resolve the name format used.
- The default port for Netwrix Threat Manager is 10001.
-- Syslog protocol – Identifies which protocol is used for the Event stream. The drop-down menu
+- Syslog protocol – Identifies which protocol is used for the Event stream. The dropdown menu
includes: UDP, TCP, and TLS.
- UPD is the only protocol supported for Threat Manager.
- Message framing – The TCP and TLS Syslog protocols require Message framing to be set. The
- drop-down menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
+ dropdown menu includes: LS (ASCII 10) delimiter, CR (ASCII 13) delimiter, CRLF (ASCII 13, 10)
delimiter, NUL (ASCII 0) delimiter, and Octet Count (RFC 5425).
- Syslog message template – Template that controls what data is sent in the event stream. The
ellipsis (…) button opens the Syslog Message Template window. See the
@@ -194,7 +194,7 @@ The Test button sends a test message to the Syslog server to check the connectio
mark or red x will indicate whether the test message has been sent or failed to send. Test messages
vary by Syslog protocol:
-- UDP protocol – Sends a test message and does not verify connection
+- UDP protocol – Sends a test message and doesn't verify connection
- TCP protocol – Sends test message and verifies connection
- TLS protocol – Sends test message and verifies connection and shows an error if TLS handshake
fails
diff --git a/docs/activitymonitor/9.0/admin/search/activedirectory/activedirectory.md b/docs/activitymonitor/9.0/admin/search/activedirectory/activedirectory.md
index 6c9544708d..fa97ab6e47 100644
--- a/docs/activitymonitor/9.0/admin/search/activedirectory/activedirectory.md
+++ b/docs/activitymonitor/9.0/admin/search/activedirectory/activedirectory.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Active Directory Search Query
You can search domain activity that has been monitored and recorded to a File output. When you
-select **Active Directory** from the magnifying glass drop-down menu, a New Search tab opens with
+select **Active Directory** from the magnifying glass dropdown menu, a New Search tab opens with
the applicable query filters.
@@ -30,15 +30,15 @@ headers. Below the Search button is the [Export](/docs/activitymonitor/9.0/admin
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -53,11 +53,11 @@ configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
-- Event Source – Set which query categories will be used. The drop-down menu displays a checkbox
+- Event Source – Set which query categories will be used. The dropdown menu displays a checkbox
list of categories.
- Event Result – Filter the data for a specific event result: Any, Success, or Failure
- Event Block – Filter the data for a specific event result related to blocking: Any, Allowed, or
diff --git a/docs/activitymonitor/9.0/admin/search/activedirectory/activedirectory_1.md b/docs/activitymonitor/9.0/admin/search/activedirectory/activedirectory_1.md
index 429dc0dfc0..6ca46e02f8 100644
--- a/docs/activitymonitor/9.0/admin/search/activedirectory/activedirectory_1.md
+++ b/docs/activitymonitor/9.0/admin/search/activedirectory/activedirectory_1.md
@@ -32,13 +32,13 @@ The results data grid columns display the following information for each event:
- Affected Object – Active Directory distinguished name for the affected object
- Affected Object SID – Security Identifier of the object/account affected by the event
- Affected Object Name – Name of the Affected Object
-- Protocol – Protocol(s) used for the monitored operation
+- Protocol – Protocols used for the monitored operation
- Query Filter – LDAP filter used in the operation
- Secured Query – Indicates if LDAP connection is secured or not
- Query Objects – Number of returned objects produced by the LDAP request
-- Process Name – Contains process name that is monitored. Currently this is only lsass.exe.
+- Process Name – Contains process name that is monitored. this is only lsass.exe.
- PID – Process Identifier generated for each active process
-- Old Name – Value prior to the monitored change
+- Old Name – Value before the monitored change
- New Name – Value after the monitored change
- Authentication Type – Indicates type of authentication event. Possible values: Kerberos, NTLM.
- Target Host – Name of the originating host
@@ -48,7 +48,7 @@ The results data grid columns display the following information for each event:
- NTLM Logon Type – Indicates type of protocol used to authenticate a connection between client and
server
- Ticket Encryption – Indicates encryption type used in request part of the Kerberos ticket
-- PAC – RID for the group that does not have access
+- PAC – RID for the group that doesn't have access
- SPN – Detects attempts to obtain a list of Service Principal Name values
- User Exists – Indicates if user exists
- N2 Password – Indicates if an invalid password matches the user’s password history
diff --git a/docs/activitymonitor/9.0/admin/search/entraid/entraid.md b/docs/activitymonitor/9.0/admin/search/entraid/entraid.md
index 19147abcbc..07cbbc20ca 100644
--- a/docs/activitymonitor/9.0/admin/search/entraid/entraid.md
+++ b/docs/activitymonitor/9.0/admin/search/entraid/entraid.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Microsoft Entra ID Search Query
You can search activity in Microsoft Entra ID (Azure AD) that has been monitored and recorded to a
-File output. When you select **Azure AD / Entra ID** from the magnifying glass drop-down menu, a New
+File output. When you select **Azure AD / Entra ID** from the magnifying glass dropdown menu, a New
Search tab opens with the applicable query filters.
@@ -31,15 +31,15 @@ headers. Below the Search button is the [Export](/docs/activitymonitor/9.0/admin
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -53,11 +53,11 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
-- Source – Set which query categories will be used. The drop-down menu displays a checkbox list of
+- Source – Set which query categories will be used. The dropdown menu displays a checkbox list of
categories.
- Event Result – Filter the data for a specific event result: Any, Success, or Failure
- Reason
diff --git a/docs/activitymonitor/9.0/admin/search/entraid/entraid_1.md b/docs/activitymonitor/9.0/admin/search/entraid/entraid_1.md
index eca85a7094..fa475c87ad 100644
--- a/docs/activitymonitor/9.0/admin/search/entraid/entraid_1.md
+++ b/docs/activitymonitor/9.0/admin/search/entraid/entraid_1.md
@@ -26,12 +26,12 @@ The results data grid columns display the following information for each event:
- Application – Indicates the Application associated with the event
- Service – Indicates the Service associated with the event
- Category – Indicates the Category associated with the event. Categories returned from search
- queries can be configured using the Category filter drop-down.
+ queries can be configured using the Category filter dropdown.
- Operation - Indicates the Operation associated with the event. Operations returned from search
- queries can be configured using the Operation filter drop-down.
+ queries can be configured using the Operation filter dropdown.
- Type – Indicates the Type associated with the event. Types returned from search queries can be
- configured using the Type filter drop-down.
-- Target(s) – Indicates the Target(s) of the event
+ configured using the Type filter dropdown.
+- Targets – Indicates the Targets of the event
- Modified – Indicates modifications associated with the event
- Client App – Indicates the Client App associated with the event
- OS – Indicates the OS associated with the event
@@ -44,7 +44,7 @@ The results data grid columns display the following information for each event:
- Risk – Indicates the level of Risk associated with events
- Conditional Access – Indicates whether Conditional Access was applied to the event
- Conditional Policy – Indicates whether a Conditional Policy was applied to the event
-- Details – If applicable, provides additional information associated with the event that is not
+- Details – If applicable, provides additional information associated with the event that isn't
provided by the other Results columns
At the bottom of the search interface, additional information is displayed for selected events in
diff --git a/docs/activitymonitor/9.0/admin/search/exchangeonline/exchangeonline.md b/docs/activitymonitor/9.0/admin/search/exchangeonline/exchangeonline.md
index 6b380a1d4a..52f6d34635 100644
--- a/docs/activitymonitor/9.0/admin/search/exchangeonline/exchangeonline.md
+++ b/docs/activitymonitor/9.0/admin/search/exchangeonline/exchangeonline.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# Exchange Online Search Query
You can search Exchange Online activity that has been monitored and recorded to a File output. When
-you select **Exchange Online** from the magnifying glass drop-down menu, a New Search tab opens with
+you select **Exchange Online** from the magnifying glass dropdown menu, a New Search tab opens with
the applicable query filters.
@@ -29,15 +29,15 @@ headers. Below the Search button is the [Export](/docs/activitymonitor/9.0/admin
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -51,9 +51,9 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Source – Filter the data by the source type: All, Admin Audit, Mailbox Access, DLP, Sensitivity
Label, Other
diff --git a/docs/activitymonitor/9.0/admin/search/file/file.md b/docs/activitymonitor/9.0/admin/search/file/file.md
index c8d1b17e0b..ba76ee1f66 100644
--- a/docs/activitymonitor/9.0/admin/search/file/file.md
+++ b/docs/activitymonitor/9.0/admin/search/file/file.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# File Search Query
You can search Windows file server and NAS device activity that has been monitored and recorded to a
-File output. When you select **File** from the magnifying glass drop-down menu, a New Search tab
+File output. When you select **File** from the magnifying glass dropdown menu, a New Search tab
opens with the applicable query filters.
@@ -24,12 +24,12 @@ headers. Below the Search button is the [Export](/docs/activitymonitor/9.0/admin
Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -40,9 +40,9 @@ The sections have the following filters:
- Events time range – The time frame filter must be configured for every search query:
- - From – Set the date and timestamp for the start of the activity range. The drop-down menu
+ - From – Set the date and timestamp for the start of the activity range. The dropdown menu
opens a calendar.
- - To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+ - To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- File Path – Filter the data for a specific file path where activity has occurred
diff --git a/docs/activitymonitor/9.0/admin/search/linux/linux.md b/docs/activitymonitor/9.0/admin/search/linux/linux.md
index 005e362d76..0649ad4f49 100644
--- a/docs/activitymonitor/9.0/admin/search/linux/linux.md
+++ b/docs/activitymonitor/9.0/admin/search/linux/linux.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Linux Search Query
You can search Linux file server and NAS device activity that has been monitored and recorded to a
-File output. When you select **Linux** from the magnifying glass drop-down menu, a New Search tab
+File output. When you select **Linux** from the magnifying glass dropdown menu, a New Search tab
opens with the applicable query filters.
@@ -24,12 +24,12 @@ headers. Below the Search button is the [Export](/docs/activitymonitor/9.0/admin
Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -40,9 +40,9 @@ The sections have the following filters:
- Events time range – The time frame filter must be configured for every search query:
- - From – Set the date and timestamp for the start of the activity range. The drop-down menu
+ - From – Set the date and timestamp for the start of the activity range. The dropdown menu
opens a calendar.
- - To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+ - To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- File Path – Filter the data for a specific file path where activity has occurred
diff --git a/docs/activitymonitor/9.0/admin/search/overview.md b/docs/activitymonitor/9.0/admin/search/overview.md
index f52d47c288..f6d58af5c6 100644
--- a/docs/activitymonitor/9.0/admin/search/overview.md
+++ b/docs/activitymonitor/9.0/admin/search/overview.md
@@ -46,11 +46,10 @@ Queries that may be useful to an organization include the following:
- What did user X do between days Y and Z?
- Administrator activity details?
-Follow the steps to use the search feature.
**Step 1 –** Click the magnifying glass icon and select the source type.
-**Step 2 –** Set the desired filters and click **Search**.
+**Step 2 –** Set the filters you want and click **Search**.
**Step 3 –** Filter and Sort the results in the table as desired.
@@ -58,12 +57,12 @@ Follow the steps to use the search feature.
## Filter
-The drop-down menu for a column header in the search results data grid provides the option to filter
+The dropdown menu for a column header in the search results data grid provides the option to filter
the search results further.
-Choose between checking/unchecking the desired field values from the list of available values and
+Choose between checking/unchecking the field values you want from the list of available values and
typing in the search textbox. The Clear filter option removes all filters from the selected column.
A filter icon appears on the header where filters have been applied. Multiple columns can be
filtered in the search results data grid.
@@ -81,7 +80,7 @@ descending order.
-The drop-down menu on the column header has options to Sort A to Z or Sort Z to A for the selected
+The dropdown menu on the column header has options to Sort A to Z or Sort Z to A for the selected
column. Sorting can only occur for one column at a time.
:::note
@@ -95,5 +94,5 @@ The search results data grid can be exported to a CSV/JSON file.
-Once the search results are configured as desired, click the Export button located at the top left
+After the search results are configured as desired, click the Export button located at the top left
corner of the window. Set the name and location of the CSV/JSON file.
diff --git a/docs/activitymonitor/9.0/admin/search/sharepoint/sharepoint.md b/docs/activitymonitor/9.0/admin/search/sharepoint/sharepoint.md
index e85036f7e4..d3b76194d9 100644
--- a/docs/activitymonitor/9.0/admin/search/sharepoint/sharepoint.md
+++ b/docs/activitymonitor/9.0/admin/search/sharepoint/sharepoint.md
@@ -7,7 +7,7 @@ sidebar_position: 60
# SharePoint Search Query
You can search SharePoint activity that has been monitored and recorded to a File output. When you
-select **SharePoint** from the magnifying glass drop-down menu, a New Search tab opens with the
+select **SharePoint** from the magnifying glass dropdown menu, a New Search tab opens with the
applicable query filters.
@@ -25,21 +25,21 @@ By default, the query is set to return all event activity for the past day. Conf
filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
-activity log files and returns the events that match the filters.You can
+activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/9.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/9.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/9.0/admin/search/overview.md#export) option.
+headers. You can also [Export](/docs/activitymonitor/9.0/admin/search/overview.md#export) the results.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -54,9 +54,9 @@ configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Event Type – Filter the data by the event type: All, CheckOut, CheckIn, View, Delete, Update,
ProfileChange, ChildDelete, SchemaChange, Undelete, Workflow, Copy, Move, AuditMaskChange, Search,
diff --git a/docs/activitymonitor/9.0/admin/search/sharepoint/sharepoint_1.md b/docs/activitymonitor/9.0/admin/search/sharepoint/sharepoint_1.md
index 3a3da6e432..b56c3bf8f6 100644
--- a/docs/activitymonitor/9.0/admin/search/sharepoint/sharepoint_1.md
+++ b/docs/activitymonitor/9.0/admin/search/sharepoint/sharepoint_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per activity
agent. You can [Filter](/docs/activitymonitor/9.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/9.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/9.0/admin/search/overview.md#export) option.
+column headers. You can also [Export](/docs/activitymonitor/9.0/admin/search/overview.md#export) the results.
diff --git a/docs/activitymonitor/9.0/admin/search/sharepointonline/sharepointonline.md b/docs/activitymonitor/9.0/admin/search/sharepointonline/sharepointonline.md
index a7d5a28dd0..cd75b7baaf 100644
--- a/docs/activitymonitor/9.0/admin/search/sharepointonline/sharepointonline.md
+++ b/docs/activitymonitor/9.0/admin/search/sharepointonline/sharepointonline.md
@@ -7,7 +7,7 @@ sidebar_position: 70
# SharePoint Online Search Query
You can search SharePoint Online activity that has been monitored and recorded to a File output.
-When you select **SharePoint Online** from the magnifying glass drop-down menu, a New Search tab
+When you select **SharePoint Online** from the magnifying glass dropdown menu, a New Search tab
opens with the applicable query filters.
@@ -28,19 +28,19 @@ filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/9.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/9.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/9.0/admin/search/overview.md#export) option.
+headers. You can also [Export](/docs/activitymonitor/9.0/admin/search/overview.md#export) the results.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -54,13 +54,13 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
-- Source – Filter the data by the source type: All, File and Page, Folder, List, Sharing and Access
+- Source – Filter the data by the source type: All, File and Page, Folder, List, Sharing, and Access
Request, Site Permissions, Site Administration, Synchronization, DLP, Sensitivity Label, Content
- Explorer, Other
+ Explorer, and Other
:::note
Disabling a source that is also a category will hide that category from the query
diff --git a/docs/activitymonitor/9.0/admin/search/sharepointonline/sharepointonline_1.md b/docs/activitymonitor/9.0/admin/search/sharepointonline/sharepointonline_1.md
index 2463e342de..8a77eb161b 100644
--- a/docs/activitymonitor/9.0/admin/search/sharepointonline/sharepointonline_1.md
+++ b/docs/activitymonitor/9.0/admin/search/sharepointonline/sharepointonline_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per activity
agent. You can [Filter](/docs/activitymonitor/9.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/9.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/9.0/admin/search/overview.md#export) option.
+column headers. You can also [Export](/docs/activitymonitor/9.0/admin/search/overview.md#export) the results.
diff --git a/docs/activitymonitor/9.0/admin/search/sqlserver/sqlserver.md b/docs/activitymonitor/9.0/admin/search/sqlserver/sqlserver.md
index 11a4680bb2..1d30e42fc1 100644
--- a/docs/activitymonitor/9.0/admin/search/sqlserver/sqlserver.md
+++ b/docs/activitymonitor/9.0/admin/search/sqlserver/sqlserver.md
@@ -7,7 +7,7 @@ sidebar_position: 80
# SQL Server Search Query
You can search SQL Server activity that has been monitored and recorded to a File output. When you
-select **SQL Server** from the magnifying glass drop-down menu, a New Search tab opens with the
+select **SQL Server** from the magnifying glass dropdown menu, a New Search tab opens with the
applicable query filters.
@@ -24,19 +24,19 @@ filters will scope results returned.
Set the filters as desired and click **Search**. The application searches through the appropriate
activity log files and returns the events that match the filters. You can
[Filter](/docs/activitymonitor/9.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/9.0/admin/search/overview.md#sort) the results using the column
-headers. Below the Search button is the [Export](/docs/activitymonitor/9.0/admin/search/overview.md#export) option.
+headers. You can also [Export](/docs/activitymonitor/9.0/admin/search/overview.md#export) the results.
**Filter Value Entry**
-When the drop-down menu is in front of a query filter, it is used to show or hide the filter entry
+When the dropdown menu is in front of a query filter, it is used to show or hide the filter entry
field. Field options vary based on the selected query filter:
-- Textbox – Enter the filter value. If the field has a drop-down arrow, then you can select from
+- Textbox – Enter the filter value. If the field has a dropdown arrow, then you can select from
values known to the application.
-- Gray drop-down menu – Provides options to match the value against on of the following, which vary
+- Gray dropdown menu – Provides options to match the value against on of the following, which vary
based on the filter:
- - Selected values – Filters by the value selected from the drop-down menu for the textbox
+ - Selected values – Filters by the value selected from the dropdown menu for the textbox
- Simple string with wildcards – Filters by the value entered into the textbox, which contains
an asterisk (\*) as the wildcard
- Regular expression – Filters by the Regex entered into the textbox
@@ -50,9 +50,9 @@ must be configured for every search query.
This section has the following filters:
-- From – Set the date and timestamp for the start of the activity range. The drop-down menu opens a
+- From – Set the date and timestamp for the start of the activity range. The dropdown menu opens a
calendar.
-- To – Set the date and timestamp for the end of the activity range. The drop-down menu opens a
+- To – Set the date and timestamp for the end of the activity range. The dropdown menu opens a
calendar.
- Event Result – Filter the data for a specific event result: Any, Success, or Failure
- Reason
diff --git a/docs/activitymonitor/9.0/admin/search/sqlserver/sqlserver_1.md b/docs/activitymonitor/9.0/admin/search/sqlserver/sqlserver_1.md
index 810f3b66ff..3f717ed5b6 100644
--- a/docs/activitymonitor/9.0/admin/search/sqlserver/sqlserver_1.md
+++ b/docs/activitymonitor/9.0/admin/search/sqlserver/sqlserver_1.md
@@ -9,7 +9,7 @@ sidebar_position: 10
When a search has been started, the Search Status table at the bottom displays the percentage
complete according to the size and quantity of the activity log files being searched per activity
agent. You can [Filter](/docs/activitymonitor/9.0/admin/search/overview.md#filter) and [Sort](/docs/activitymonitor/9.0/admin/search/overview.md#sort) the results using the
-column headers. Below the Search button is the [Export](/docs/activitymonitor/9.0/admin/search/overview.md#export) option.
+column headers. You can also [Export](/docs/activitymonitor/9.0/admin/search/overview.md#export) the results.
diff --git a/docs/activitymonitor/9.0/gettingstarted.md b/docs/activitymonitor/9.0/gettingstarted.md
index 6ee993a1ee..22c59e3176 100644
--- a/docs/activitymonitor/9.0/gettingstarted.md
+++ b/docs/activitymonitor/9.0/gettingstarted.md
@@ -12,7 +12,7 @@ and easily get started with activity monitoring.
## Requirements
The Activity Monitor console needs to be installed on a server or workstation. After that agents are deployed to
-the target environment and configured to monitor activity. It is necessary to prepare the target
+the target environment and configured to monitor activity. Prepare the target
environment and configure the credentials used by the agents. Each supported environment has
different requirements. See the following topics for additional information:
@@ -32,7 +32,7 @@ different requirements. See the following topics for additional information:
## Install & Deploy Agents
-Once the prerequisites are accomplished, you are ready to install the application and deploy agents.
+After the prerequisites are accomplished, you are ready to install the application and deploy agents.
See the following topics for additional information:
- [Install Application](/docs/activitymonitor/9.0/install/application.md)
@@ -41,10 +41,10 @@ See the following topics for additional information:
## Configure Monitoring
-After the agents have been deployed, you can configure the monitoring of the target environment. For
-Windows File Servers, this can be done at the same time as the agent is deployed, but for all other
-target environments it is done after the agent is deployed. You will configure what will be
-monitored as well as where the collected data will go (outputs). See the following topics for
+After you deploy the agents, configure the monitoring of the target environment. For
+Windows File Servers, configure monitoring at the same time you deploy the agent. For all other
+target environments, configure monitoring after you deploy the agent. Configure what to
+monitor and where the collected data will go (outputs). See the following topics for
additional information:
- [Monitored Domains Tab](/docs/activitymonitor/9.0/admin/monitoreddomains/overview.md) for Active Directory monitoring
diff --git a/docs/activitymonitor/9.0/install/agents/agents.md b/docs/activitymonitor/9.0/install/agents/agents.md
index 7dbf19d9a9..10c5265615 100644
--- a/docs/activitymonitor/9.0/install/agents/agents.md
+++ b/docs/activitymonitor/9.0/install/agents/agents.md
@@ -15,19 +15,19 @@ There are two deployment modes:
1. **The agent monitors the server it is installed on**
-The agent must be deployed on the target system for the following event sources:
+Deploy the agent on the target system for the following event sources:
|Event source|Additional requirements|
|------------|-----------------------|
|Windows File Server| |
|Linux File Server| |
-|Active Directory domain controllers| The agent must be installed on all domain controllers of the monitored domain.|
-|SharePoint On-Premise|The agent must be deployed to the server that hosts the _Central Administration_ component of the SharePoint farm.|
+|Active Directory domain controllers| Install the agent on all domain controllers of the monitored domain.|
+|SharePoint On-Premise|Deploy the agent to the server that hosts the _Central Administration_ component of the SharePoint farm.|
2. **The agent monitors remote hosts or services**
-In this mode, the agent is installed on a Windows Server and configured to monitor the following event sources:
+In this mode, install the agent on a Windows Server and configure it to monitor the following event sources:
|Event source|Additional requirements|
|------------|-----------------------|
@@ -55,7 +55,7 @@ In this mode, the agent is installed on a Windows Server and configured to monit
:::info
-For file storage, the agent's server should be located close to the monitored NAS device on the network to reduce latency.
+For file storage, locate the agent's server close to the monitored NAS device on the network to reduce latency.
:::
:::info
diff --git a/docs/activitymonitor/9.0/install/agents/manual.md b/docs/activitymonitor/9.0/install/agents/manual.md
index b92e65324f..b02f9d860c 100644
--- a/docs/activitymonitor/9.0/install/agents/manual.md
+++ b/docs/activitymonitor/9.0/install/agents/manual.md
@@ -6,9 +6,7 @@ sidebar_position: 10
# Manually Install the Activity Agent
-The Netwrix Activity Monitor Agent can be deployed via the console or manually.
-
-Follow the steps to manually install the agent.
+Deploy the Netwrix Activity Monitor Agent via the console or manually.
**Step 1 –** Navigate to the Activity Monitor Console installation path and locate the agent
installation package. The default location is:
@@ -67,7 +65,7 @@ The Activity Monitor Agent command line has the following parameters:
- `MANAGEMENT_GROUP`
- To specify the Activity Monitor Agent Management Group (This allows user to limit users in the
- specified group to manage agents, but does not allow users in specified group to install,
+ specified group to manage agents, but doesn't allow users in specified group to install,
upgrade, or uninstall agents).
- Default value: `BUILTIN\Administrators`
- Example: `MANAGEMENT_GROUP=CORP\ActivityMonitorGroup`
@@ -101,7 +99,7 @@ those for NAS devices when applicable.
:::note
These steps are specific to deploying activity agents for monitoring file systems,
-SharePoint, SQL Server, Azure and Office 365 environments. See the
+SharePoint, SQL Server, Azure, and Office 365 environments. See the
[Active Directory Agent Deployment](/docs/activitymonitor/9.0/admin/agents/activedirectory.md) section for
instruction on deploying the AD agent. See the
[Linux Agent Deployment](/docs/activitymonitor/9.0/admin/agents/linux.md) topic for instructions on deploying agents
@@ -109,11 +107,9 @@ to Linux servers.
:::
-Follow the steps to deploy the activity agent to a single Windows server.
-
**Step 1 –** Open the Activity Monitor Console.
-**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agent(s) window opens.
+**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agents window opens.
@@ -127,7 +123,7 @@ additional information. Click **Next**.
-**Step 5 –** On the Credentials to Connect to the Server(s) page, specify the credentials for the
+**Step 5 –** On the Credentials to Connect to the Servers page, specify the credentials for the
server to which the agent is deployed. See the
[Single Activity Agent Deployment](/docs/activitymonitor/9.0/admin/agents/single.md) topic for additional
information on credential options. Click **Connect**.
@@ -135,12 +131,12 @@ information on credential options. Click **Connect**.
:::note
When clicking **Connect** while adding the Agent to the Console, the connection may fail.
When clicking Connect, the Activity Monitor verifies not only its ability to manage the agent but
-the console's ability to deploy the agent as well. Errors can be ignored if the agent was manually
-installed.
+the console's ability to deploy the agent as well. You can ignore errors if you manually
+installed the agent.
:::
-**Step 6 –** Regardless of the warning messages that the agent cannot be installed or upgraded,
+**Step 6 –** Regardless of the warning messages that the agent can't be installed or upgraded,
click **Next**. The console will automatically detect the agent as it is already installed.
@@ -154,7 +150,7 @@ click **Next**. The console will automatically detect the agent as it is already
:::note
The Activity Monitor Agent Management Group allows users in the specified group to manage
-agents, but does not allow users in specified group to install, upgrade, or uninstall agents.
+agents, but doesn't allow users in specified group to install, upgrade, or uninstall agents.
:::
diff --git a/docs/activitymonitor/9.0/install/agents/manualad.md b/docs/activitymonitor/9.0/install/agents/manualad.md
index 08a8f87329..30d2716573 100644
--- a/docs/activitymonitor/9.0/install/agents/manualad.md
+++ b/docs/activitymonitor/9.0/install/agents/manualad.md
@@ -8,7 +8,7 @@ sidebar_position: 30
The AD Module, powered by Threat Prevention, can only be installed on domain controllers.
-Follow the steps to manually deploy the AD Module.
+To manually deploy the AD Module:
**Step 1 –** From the Activity Monitor Console machine, copy the AD Agent executable (
`%ProgramFiles%\Netwrix\Activity Monitor\Console\Agents\SI Agent.exe`) to the domain controller where
@@ -17,7 +17,7 @@ Setup wizard opens.
-**Step 2 –** On the Welcome page, click **Install**. The Setup Progress page is displayed, followed
+**Step 2 –** On the Welcome page, click **Install**. The Setup Progress page appears, followed
by another Welcome page.
@@ -38,7 +38,7 @@ location.
-> > - Use the Look In field to select the desired installation folder.
+> > - Use the Look In field to select the installation folder you want.
> > - When the Folder name is as desired, click **OK**. The wizard returns to the Destination Folder
> > page.
> > - Click **Next**.
@@ -51,7 +51,7 @@ location.
**Step 6 –** Keep the default radio button selection, Managed by Threat Prevention.
:::note
-The CA Certificate Configuration page is not applicable to the Activity Monitor.
+The CA Certificate Configuration page isn't applicable to the Activity Monitor.
:::
@@ -77,7 +77,7 @@ product to enable communication with it.
- Start Agent Service
- The **Start Agent Service** option starts the Threat Prevention Windows Agent service
- after the installation is complete. If the Threat Prevention Windows Agent service is not
+ after the installation is complete. If the Threat Prevention Windows Agent service isn't
started at the time of installation, the Activity Monitor Agent will start as needed.
- Create Windows Firewall Rules
@@ -106,11 +106,11 @@ The AD Module (NTP Agent) is now installed on the server.
## Add the AD Agent to the Console
-Follow the steps to add the Activity Monitor Windows Agent (with the AD Module) to the Console:
+To add the Activity Monitor Windows Agent (with the AD Module) to the Console:
**Step 1 –** Open the Activity Monitor Console.
-**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agent(s) window opens.
+**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agents window opens.
@@ -128,27 +128,27 @@ Follow the steps to add the Activity Monitor Windows Agent (with the AD Module)
**Step 6 –** On the Active Directory Connection page, specify the credentials for the domain or
-domain controller(s) where the agent is installed. Click **Connect** to verify connection to the
+domain controllers where the agent is installed. Click **Connect** to verify connection to the
domain. Click **Next**.
-**Step 7 –** Select the domain of the domain controller(s) where the agent is installed. Click
+**Step 7 –** Select the domain of the domain controllers where the agent is installed. Click
**Next**.
-**Step 8 –** Select the domain controller(s) where the agent is installed. Click **Test**.
+**Step 8 –** Select the domain controllers where the agent is installed. Click **Test**.
:::note
When clicking Test while adding the Agent to the Console, the connection may fail. When
clicking Test, the Activity Monitor verifies not only its ability to manage the agent but the
-console's ability to deploy the agent as well. Errors can be ignored if the agent was manually
-installed.
+console's ability to deploy the agent as well. You can ignore errors if you manually
+installed the agent.
:::
-**Step 9 –** Ignore the warning messages that the agent cannot be installed or upgraded and click
+**Step 9 –** Ignore the warning messages that the agent can't be installed or upgraded and click
**Next**.
@@ -157,7 +157,7 @@ installed.
:::note
The Activity Monitor Agent Management Group allows users in the specified group to manage
-agents, but does not allow users in specified group to install, upgrade, or uninstall agents.
+agents, but doesn't allow users in specified group to install, upgrade, or uninstall agents.
:::
diff --git a/docs/activitymonitor/9.0/install/agents/manuallinux.md b/docs/activitymonitor/9.0/install/agents/manuallinux.md
index e19547afb1..a1f8729765 100644
--- a/docs/activitymonitor/9.0/install/agents/manuallinux.md
+++ b/docs/activitymonitor/9.0/install/agents/manuallinux.md
@@ -6,8 +6,6 @@ sidebar_position: 20
# Manually Install the Linux Agent
-Follow the steps to manually install the agent.
-
**Step 1 –** Transfer the rpm package to the Linux server.
For example, following is a pscp command:
@@ -61,23 +59,21 @@ sudo ./activity-monitor-agentd create-client-certificate --name amagent
**Step 5 –** Copy full certificate output from previous command on the Linux server.
:::note
-This will be needed to add the agent to the console.
+You'll need this to add the agent to the console.
:::
## Add the Linux Agent to the Console
-Before deploying the Activity agent in a Linux environment, ensure all Prerequisites have been met.
-To effectively monitor activity on a Linux host, it is necessary to deploy an agent to the host.
-Follow the steps to deploy the agent to the Linux host. See the
+Before deploying the Activity agent to a Linux environment, verify you've met all prerequisites.
+Deploy an agent to the Linux host to effectively monitor activity.
+See the
[Linux Agent Server Requirements](/docs/activitymonitor/9.0/requirements/linuxagent.md) topic for additional
information.
-Follow the steps to add the agent to the console.
-
**Step 1 –** Open the Activity Monitor Console.
-**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agent(s) window opens.
+**Step 2 –** On the Agents tab, click **Add Agent**. The Add New Agents window opens.
@@ -109,7 +105,7 @@ installed.
**Step 6 –** On the Linux Agent Options page, select which user name to use to run the daemon. To
use root, leave the **Service user name** field blank. Click **Test** to test the connection.
-**Step 7 –** Click **Finish**. The Add New Agent(s) window closes, and the activity agent is
+**Step 7 –** Click **Finish**. The Add New Agents window closes, and the activity agent is
deployed to and installed on the target host.
:::note
diff --git a/docs/activitymonitor/9.0/install/application.md b/docs/activitymonitor/9.0/install/application.md
index 9945ee3371..aea0afb611 100644
--- a/docs/activitymonitor/9.0/install/application.md
+++ b/docs/activitymonitor/9.0/install/application.md
@@ -6,11 +6,8 @@ sidebar_position: 10
# Install Application
-Netwrix Activity Monitor comes with a 10-day trial license to start. If an organization's license
-key has been acquired already, which should be provided by a Netwrix Representative, the file should
-be saved in the same location where the Activity Monitor will be installed.
-
-Follow the steps to install the Netwrix Activity Monitor Console.
+Netwrix Activity Monitor comes with a 10-day trial license to start. If your organization has a license
+key from a Netwrix Representative, save it in the same location where you'll install the Activity Monitor.
**Step 1 –** Run the NetwrixActivityMonitorSetup.msi executable to open the Netwrix Activity Monitor
Setup wizard.
diff --git a/docs/activitymonitor/9.0/install/importlicensekey.md b/docs/activitymonitor/9.0/install/importlicensekey.md
index 95b19452f0..66f09e42db 100644
--- a/docs/activitymonitor/9.0/install/importlicensekey.md
+++ b/docs/activitymonitor/9.0/install/importlicensekey.md
@@ -6,12 +6,11 @@ sidebar_position: 40
# Import License Key
-The Activity Monitor comes with a temporary 10-day license. Uploading a new license key or importing
-a Access Analyzer key can be done from the Activity Monitor Console. If the Activity Monitor Console
+The Activity Monitor comes with a temporary 10-day license. You can upload a new license key or import
+an Access Analyzer key from the Activity Monitor Console. If the Activity Monitor Console
is installed on a server where Access Analyzer has already been installed, it reads the license
information from the Access Analyzer installation directory.
-Follow the steps to import a license key file.
diff --git a/docs/activitymonitor/9.0/install/overview.md b/docs/activitymonitor/9.0/install/overview.md
index c3e32b4012..0a5c0a045a 100644
--- a/docs/activitymonitor/9.0/install/overview.md
+++ b/docs/activitymonitor/9.0/install/overview.md
@@ -7,13 +7,13 @@ sidebar_position: 30
# Installation
This topic describes the console installation and agent deployment the process for Activity Monitor.
-Prior to installing the application, ensure that all requirements have been met. See the
+Before installing the application, verify that you've met all requirements. See the
[Requirements ](/docs/activitymonitor/9.0/requirements/overview.md) topic for additional information.
## Software Compatibility & Versions
-For proper integration between the Activity Monitor and other Netwrix products, it is necessary for
-the versions to be compatible.
+For proper integration between the Activity Monitor and other Netwrix products, ensure the
+versions are compatible.
| Component | Version |
| ----------------------------------------------------- | ------- |
diff --git a/docs/activitymonitor/9.0/install/upgrade/removeagent.md b/docs/activitymonitor/9.0/install/upgrade/removeagent.md
index 29ce1b0320..c2117d35fb 100644
--- a/docs/activitymonitor/9.0/install/upgrade/removeagent.md
+++ b/docs/activitymonitor/9.0/install/upgrade/removeagent.md
@@ -6,13 +6,13 @@ sidebar_position: 20
# Remove Agents
-On the Agents tab of the Activity Monitor Console, the Remove button allows users to remove the
+On the Agents tab of the Activity Monitor Console, the Remove button lets you remove the
selected activity agent from the Agents list and/or uninstall the activity agent from the hosting
server.
To only remove the server from the Agents list, click Remove. To also uninstall the activity agent
-from the server, click Uninstall and remove. During the uninstall process, the status will be
+from the server, click Uninstall and remove. During the uninstall process, the status shows as
Uninstalling. If there are any errors, the list of errors appears in the **Agent messages** box.
-When the activity agent uninstall is complete, it is removed from the Agents list.
+When the activity agent uninstall is complete, the system removes it from the Agents list.
diff --git a/docs/activitymonitor/9.0/install/upgrade/updateadagentinstaller.md b/docs/activitymonitor/9.0/install/upgrade/updateadagentinstaller.md
index 7cf2efcca3..e7237bcc1b 100644
--- a/docs/activitymonitor/9.0/install/upgrade/updateadagentinstaller.md
+++ b/docs/activitymonitor/9.0/install/upgrade/updateadagentinstaller.md
@@ -20,7 +20,7 @@ license keys for purchased products. See the
topic for information on how to register for a Customer Portal account. Navigate to the Netwrix
Threat Prevention Download section for the 7.5. Download the Threat Prevention Agent binary.
-Then follow the steps to update the AD Module installer used by the Activity Monitor Console.
+Update the AD Module installer used by the Activity Monitor Console.
**Step 1 –** On the Agents tab, select **Update AD Module Installer**. The Select AD Module
installer package (SI Agent.exe) window opens.
diff --git a/docs/activitymonitor/9.0/install/upgrade/upgrade.md b/docs/activitymonitor/9.0/install/upgrade/upgrade.md
index bac0ac8199..28db6d2602 100644
--- a/docs/activitymonitor/9.0/install/upgrade/upgrade.md
+++ b/docs/activitymonitor/9.0/install/upgrade/upgrade.md
@@ -12,9 +12,9 @@ other Netwrix products.
## Considerations
-While it is strongly recommended to match the versions of both the console and the activity agent,
-activity agent(s) V8.0+ can be managed by Activity Monitor Console V9.0+. Older versions of activity
-agents will be limited in monitoring capability until upgraded.
+Match the versions of both the console and the activity agent when possible.
+Activity Monitor Console V9.0+ manages activity agents V8.0+. Older versions of activity
+agents have limited monitoring capability until you upgrade them.
The installation and configuration paths for Netwrix Activity Monitor have been updated from
Activity Monitor 7.1. See the
@@ -23,10 +23,8 @@ for additional information.
## Activity Monitor Upgrade Procedure
-Follow the steps to upgrade from an older version of Netwrix Activity Monitor to Netwrix Activity Monitor 9.0.
-
:::info
-Uninstall of the existing Activity Monitor Console is not required.
+Uninstall of the existing Activity Monitor Console isn't required.
:::
**Step 1 –** Install the Activity Monitor 9.0 on the same machine where the older console resides
@@ -34,7 +32,7 @@ following the instructions in the [Install Application](/docs/activitymonitor/9.
Launch the Activity Monitor Console and navigate to the Agents tab.
-**Step 2 –** Select the activity agent(s) to be upgraded. The Windows Ctrl-select option can be used
+**Step 2 –** Select the activity agents to be upgraded. Use the Windows Ctrl-select option
to select multiple activity agents. Then click Upgrade.
:::info
@@ -44,6 +42,6 @@ Update the activity agents in batches to ensure continuity of monitoring.
The selected activity agents are updated to V9.0. If a Netwrix Threat Prevention Agent is also installed on
the Windows server for monitoring file systems, the Monitored Hosts & Services tab identifies the host as being
-“Managed by Threat Prevention”, and that ‘monitored host’ is not editable. However, multiple outputs
-can be configured for hosts. Add the Windows host to the Monitored Hosts & Services tab to monitor file system
+“Managed by Threat Prevention”, and that ‘monitored host’ isn't editable. However, you can configure multiple outputs
+for hosts. Add the Windows host to the Monitored Hosts & Services tab to monitor file system
for outputs to Access Analyzer, Threat Manager, and/or SIEM products.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/activityagent.md b/docs/activitymonitor/9.0/requirements/activityagent/activityagent.md
index 9a80e9e829..db1635357a 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/activityagent.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/activityagent.md
@@ -60,19 +60,19 @@ See the [Activity Agent Ports](/docs/activitymonitor/9.0/requirements/activityag
## Supported File Storage Platforms
-The Activity Monitor provides the ability to monitor Windows and various NAS file servers.
+The Activity Monitor lets you monitor Windows and various NAS file servers.
:::note
-For monitoring NAS devices, the Activity Agent must be deployed to a Windows server that acts as a proxy for monitoring the target environment.
+To monitor NAS devices, deploy the Activity Agent to a Windows server that acts as a proxy for monitoring the target environment.
:::
**Supported Windows File Servers Platforms**
-The Activity Monitor provides the ability to monitor Windows file servers:
+The Activity Monitor lets you monitor Windows file servers:
:::note
-To monitor a Windows file server, the Activity Agent must be deployed on the server being monitored.
+To monitor a Windows file server, deploy the Activity Agent on the server being monitored.
:::
@@ -137,7 +137,7 @@ target environment requirements.
See the [Hitachi Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md) topic for target
environment requirements.
-**Nasuni Nasuni Edge Appliances**
+**Nasuni Edge Appliances**
- 8.0+
@@ -173,7 +173,7 @@ environment requirements.
## Supported Microsoft Entra ID
-The Activity Monitor provides the ability to monitor Microsoft Entra ID:
+The Activity Monitor lets you monitor Microsoft Entra ID:
See the [Microsoft Entra ID Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/entraid-activity.md) topic
for target environment requirements.
@@ -181,7 +181,7 @@ for target environment requirements.
## Supported Exchange Online
-The Activity Monitor provides the ability to monitor Exchange Online:
+The Activity Monitor lets you monitor Exchange Online:
See the [Exchange Online Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/exchange-activity.md)
topic for target environment requirements.
@@ -189,7 +189,7 @@ topic for target environment requirements.
## Supported SharePoint Online
-The Activity Monitor provides the ability to monitor SharePoint Online:
+The Activity Monitor lets you monitor SharePoint Online:
See the
[SharePoint Online Activity Auditing Configuration](/docs/activitymonitor/9.0/requirements/activityagent/sharepoint-online-activity.md) topic
@@ -197,10 +197,10 @@ for target environment requirements.
## Supported SharePoint On-Premise Platforms
-The Activity Monitor provides the ability to monitor SharePoint On-Premise farms:
+The Activity Monitor lets you monitor SharePoint On-Premise farms:
:::note
-For monitoring a SharePoint farm, the Activity Agent must be deployed to the SharePoint
+To monitor a SharePoint farm, deploy the Activity Agent to the SharePoint
Application server that hosts the "Central Administration" component of the SharePoint farm.
:::
@@ -215,11 +215,10 @@ topic for target environment requirements.
## Supported SQL Server Platforms
-The Activity Monitor provides the ability to monitor SQL Server:
+The Activity Monitor lets you monitor SQL Server:
:::note
-For monitoring SQL Server, it is recommended to install the Activity Agent must be
-deployed to a Windows server that acts as a proxy for monitoring the target environment.
+To monitor SQL Server, deploy the Activity Agent to a Windows server that acts as a proxy for monitoring the target environment.
:::
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/activityagentports.md b/docs/activitymonitor/9.0/requirements/activityagent/activityagentports.md
index ea3f5e93ba..31983badad 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/activityagentports.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/activityagentports.md
@@ -15,7 +15,7 @@ are required for communication between the Agent server and the Netwrix Activity
The Windows firewall rules need to be configured on the Windows server, which require certain
inbound rules be created if the scans are running in applet mode. These scans operate over a default
-port range, which cannot be specified via an inbound rule. For more information, see the Microsoft
+port range, which can't be specified via an inbound rule. For more information, see the Microsoft
[Connecting to WMI on a Remote Computer](https://msdn.microsoft.com/en-us/library/windows/desktop/aa389290(v=vs.85).aspx)
article.
@@ -119,7 +119,7 @@ Agent server and the target NetApp Data ONTAP 7-Mode device:
Activity Monitor.
:::note
-If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
+If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
device must be configured manually. Also, the External Engine will not reconnect automatically in
the case of a server reboot or service restart.
:::
@@ -140,7 +140,7 @@ Agent server and the target NetApp Data ONTAP Cluster-Mode device:
Activity Monitor.
:::note
-If either HTTP or HTTPS are not enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
+If either HTTP or HTTPS aren't enabled, the FPolicy on the NetApp Data ONTAP 7-Mode
device must be configured manually. Also, the External Engine will not reconnect automatically in
the case of a server reboot or service restart.
:::
@@ -166,7 +166,7 @@ Agent server and the target Panzura device:
| Communication Direction | Protocol | Ports | Description |
| ------------------------------------------ | ------------- | ----- | ----------------------- |
| Activity Agent Server to Panzura | HTTPS | 443 | Panzura API |
-| Panzura filers to to Activity Agent Server | AMQP over TCP | 4497 | Panzura Event Reporting |
+| Panzura filers to Activity Agent Server | AMQP over TCP | 4497 | Panzura Event Reporting |
Protect the port with a username and password. The credentials will be configured in Panzura.
@@ -210,7 +210,7 @@ Agent server and the target SQL Server:
| ----------------------------------- | -------- | ----- | ----------------------- |
| SQL Server to Activity Agent Server | TCP | 1433 | Default SQL Server Port |
-If the Activity Monitor cannot connect to the SQL Server, ensure that SQL Server Browsing state is
+If the Activity Monitor can't connect to the SQL Server, ensure that SQL Server Browsing state is
**Running**.
## Integration with Netwrix Access Analyzer Additional Firewall Rules
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/entraid-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/entraid-activity.md
index 17e5aa1972..4c21904188 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/entraid-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/entraid-activity.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Microsoft Entra ID Activity Auditing Configuration
-It is necessary to register Activity Monitor as a web application to the targeted Microsoft Entra ID
-(formerly Azure AD), in order for Activity Monitor to monitor the environment. This generates the
+Register Activity Monitor as a web application to the targeted Microsoft Entra ID
+(formerly Azure AD) to enable Activity Monitor to monitor the environment. This generates the
Client ID and Client Secret needed by the Activity Agent. See
[Microsoft Support](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-reporting-api-prerequisites-azure-portal)
for assistance in configuring the Microsoft Entra ID web application.
@@ -20,15 +20,14 @@ Microsoft Entra ID.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you register the application:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
- copied first.
+ You can't retrieve the value after saving the new key. Copy it first.
:::
@@ -46,7 +45,7 @@ The following permissions are required:
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
+To register Activity Monitor with Microsoft Entra ID, complete the following steps:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -79,8 +78,7 @@ application. Now that the application has been registered, permissions need to b
## Grant Permissions to the Registered Application
-Follow the steps to set up permissions to enable the Activity Monitor to monitor data and collect
-logs from Microsoft Entra ID.
+To set up permissions to enable the Activity Monitor to monitor data and collect logs from Microsoft Entra ID, complete the following steps:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -116,7 +114,7 @@ be collected.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
+To find the registered application's Client ID, complete the following steps:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -154,7 +152,7 @@ application’s Client Secret Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
+To find the tenant name where the registered application resides, complete the following steps:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -174,8 +172,7 @@ application’s Client Secret Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
-value when saving the new key.
+To find the registered application's Client Secret, create a new key, and save its value when saving the new key, complete the following steps:
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -185,8 +182,7 @@ documentation for additional information.
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
-first.
+You can't retrieve the value after saving the new key. Copy it first.
:::
@@ -212,8 +208,7 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
-this process will have to be repeated.
+If you leave this page before copying the key, you can't retrieve it later, and you'll have to repeat this process.
:::
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/exchange-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/exchange-activity.md
index 70d4003a02..5449c263eb 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/exchange-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/exchange-activity.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Exchange Online Activity Auditing Configuration
-In order to collect logs and monitor Exchange Online activity using the Netwrix Activity Monitor, it
+to collect logs and monitor Exchange Online activity using the Netwrix Activity Monitor, it
needs to be registered with Microsoft® Entra ID® (formerly Azure AD).
:::note
@@ -25,15 +25,14 @@ See the Enable Auditing for Exchange Online topic for additional information.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+After you register the application, the following settings are needed from your tenant:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
- copied first.
+ You can't retrieve the value after saving the new key. Copy it first.
:::
@@ -53,7 +52,7 @@ The following settings are needed from your tenant once you have registered the
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
+Register Activity Monitor with Microsoft Entra ID.
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -86,7 +85,7 @@ application. Now that the application has been registered, permissions need to b
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
+Grant permissions to the registered application.
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -133,7 +132,7 @@ be collected.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
+Find the registered application's Client ID.
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -174,7 +173,7 @@ Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
+Find the tenant name where the registered application resides.
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
@@ -196,7 +195,7 @@ Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
+Find the registered application's Client Secret, create a new key, and save its
value when saving the new key.
:::note
@@ -207,8 +206,7 @@ documentation for additional information.
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
-first.
+You can't retrieve the value after saving the new key. Copy it first.
:::
@@ -234,7 +232,7 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
+If this page is left before the key is copied, then the key isn't retrievable, and
this process will have to be repeated.
:::
@@ -250,14 +248,14 @@ additional information.
## Enable Auditing for Exchange Online
-Follow the steps to enable auditing for Exchange Online so the Activity Monitor can receive events.
+Enable auditing for Exchange Online so the Activity Monitor can receive events.
**Step 1 –** In the Microsoft Purview compliance portal at
[https://compliance.microsoft.com](https://compliance.microsoft.com/), go to **Solutions** >
**Audit**. Or, to go directly to the Audit page at
[https://compliance.microsoft.com/auditlogsearch](https://compliance.microsoft.com/auditlogsearch).
-**Step 2 –** If auditing is not turned on for your organization, a banner is displayed prompting you
+**Step 2 –** If auditing isn't turned on for your organization, a banner is displayed prompting you
start recording user and admin activity.
**Step 3 –** Select the **Start recording** user and **admin activity** banner.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/azure-files/azurefiles-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/azure-files/azurefiles-activity.md
index 535265481b..deaa6d1af8 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/azure-files/azurefiles-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/azure-files/azurefiles-activity.md
@@ -19,24 +19,24 @@ There are several steps in preparing Azure Files for monitoring:
## Enable auditing for storage accounts
-Auditing in Azure Files is disabled by default. It must be enabled for each storage account to be monitored.
+Auditing in Azure Files is disabled by default. Enable auditing for each storage account to be monitored.
### Logs storage account
You must provide a storage account for audit data. The audit data is written as blobs named `insight-logs` to that storage account.
-It must be a different storage account — it cannot be the same account that hosts Azure Files.
+It must be a different storage account — it can't be the same account that hosts Azure Files.
-It is recommended to share such a *logs storage account* among multiple *files storage accounts*.
+Share such a *logs storage account* among multiple *files storage accounts*.
A single account can store nearly unlimited blobs and up to 5 PB of data, which is more than enough for audit logs.
A shared account also helps stay within the Azure limit of 250–500 accounts per region per subscription.
-However, for security reasons, you may choose to use separate *logs storage accounts* so that activity from different accounts is not mixed in the same blob storage.
+However, for security reasons, you may choose to use separate *logs storage accounts* so that activity from different accounts isn't mixed in the same blob storage.
-The *logs storage account* must be in the same Azure region as the monitored Azure Files storage account, but it does not need
+The *logs storage account* must be in the same Azure region as the monitored Azure Files storage account, but it doesn't need
to be in the same resource group or subscription.
-Because the product does not require historical logs, it is recommended to configure an **Azure Lifecycle Management rule** for this storage account
+Because the product doesn't require historical logs, configure an **Azure Lifecycle Management rule** for this storage account
to control storage volume and cost (not documented here). Otherwise, the data will be stored indefinitely.
### Diagnostic setting
@@ -52,7 +52,7 @@ at the management group, subscription, or resource group scope (not documented h
2. Click **Add diagnostic setting** to create a new auditing configuration or open an existing one.
3. Under the **Logs** section, select **audit**, **StorageRead**, **StorageWrite**, and **StorageDelete**.
- You can adjust these categories based on your needs; for example, unselect **StorageRead** if you are not interested in read activity.
+ You can adjust these categories based on your needs; for example, unselect **StorageRead** if you aren't interested in read activity.
4. Under the **Destination details** section, select **Archive to a storage account**, then choose the storage account prepared in Step 1.
@@ -74,8 +74,6 @@ A user account with the **Global Administrator** role is required to register an
If you already have an application registered for Activity Monitor for Entra ID, SharePoint Online, or Exchange Online, you can reuse that
registration for Azure Files by assigning additional RBAC roles.
-Follow these steps to register the application in Azure.
-
### Open Microsoft Azure portal
- Azure Public – https://portal.azure.com/
@@ -111,7 +109,7 @@ Be aware of the client secret's expiration date. You'll need to generate a new o
:::
:::warning
-Make sure you copy the **Value**, not the **Secret ID**.
+ensure you copy the **Value**, not the **Secret ID**.
:::
### Grant API permissions
@@ -136,7 +134,7 @@ Assign the following roles to the registered application:
Allows enumeration of storage accounts and reading of their settings.
- `Storage Blob Data Reader` – the data plane role.
- Allows reading of audit data from the logs storage account(s).
+ Allows reading of audit data from the logs storage accounts.
You can assign these roles at different levels, which grant access to all storage accounts within the selected scope:
@@ -187,7 +185,7 @@ The last step is adding the Azure Files storage account to Activity Monitor.
1. On the **Monitored Hosts & Services** page, select **Add Host/Service**.
2. Select the agent that will be monitoring Azure Files, and then select **Next**.
3. Select **Azure Files**, specify the tenant’s domain name, and then select **Next**.
-4. On the **Connection** page, specify the Tenant ID (if it was not resolved automatically), Client ID, and Client Secret—values
+4. On the **Connection** page, specify the Tenant ID (if it wasn't resolved automatically), Client ID, and Client Secret—values
copied in the previous steps during application registration.
5. Select **Connect**.
The button will verify the connection to Azure, enumerate all storage accounts, and retrieve their settings visible to the registered application.
@@ -204,4 +202,4 @@ You can use this wizard multiple times to add newly created storage accounts—a
:::
8. Check the status of the added storage accounts on the **Monitored Hosts & Services** page.
-Address any audit setting misconfigurations or missing RBAC roles.
\ No newline at end of file
+Address any audit setting misconfigurations or missing RBAC roles.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/celerra-vnx-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/celerra-vnx-activity.md
index 7268d6eb62..de5ddc5ab8 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/celerra-vnx-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/celerra-vnx-activity.md
@@ -11,15 +11,15 @@ events. All audit data can be forwarded to the Dell Common Event Enabler (CEE).
listens for all events coming through the Dell CEE and translates all relevant information into
entries in the Log files or syslog messages.
-Complete the following checklist prior to configuring the Activity Monitor to monitor the host.
+Complete the following checklist before configuring the Activity Monitor to monitor the host.
Instructions for each item of the checklist are detailed within the following sections.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - DNS name of Celerra or VNX CIFS share(s) to be monitored
- - Data Mover or Virtual Data Mover hosting the share(s) to be monitored
+ - DNS name of Celerra or VNX CIFS shares to be monitored
+ - Data Mover or Virtual Data Mover hosting the shares to be monitored
- Account with access to the CLI
- Download the Dell CEE from:
@@ -38,9 +38,9 @@ Instructions for each item of the checklist are detailed within the following se
- Important:
- - Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE
+ - Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE
is installed
- - Dell CEE 8.4.2 through Dell CEE 8.6.1 are not supported for use with the VCAPS feature
+ - Dell CEE 8.4.2 through Dell CEE 8.6.1 aren't supported for use with the VCAPS feature
- Dell CEE requires .NET Framework 3.5 to be installed on the Windows proxy server
- See the [Install & Configure Dell CEE](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md) topic for instructions.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md
index 44921fd78f..5886ad199e 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install & Configure Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,10 +20,10 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
+To install the Dell CEE, complete the following steps:
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
-this component. It is recommended to use the most current version.
+this component. Use the most current version.
**Step 2 –** Follow the instructions in the Dell
[Using the Common Event Enabler on Windows Platforms](https://www.dell.com/support/home/en-us/product-support/product/common-event-enabler/docs)
@@ -33,7 +33,7 @@ guide to install and configure the CEE. The installation will add two services t
- EMC CEE Monitor (Display Name: EMC CEE Monitor)
:::info
-The latest version of .NET Framework and Dell CEE is recommended to use with the
+Use the latest versions of .NET Framework and Dell CEE with the
asynchronous bulk delivery (VCAPS) feature.
:::
@@ -41,13 +41,13 @@ asynchronous bulk delivery (VCAPS) feature.
See the [CEE Debug Logs](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md#cee-debug-logs) section for information on
troubleshooting issues related to Dell CEE.
-After Dell CEE installation is complete, it is necessary to Connect Data Movers to the Dell CEE
+After Dell CEE installation is complete, you need to connect Data Movers to the Dell CEE
Server.
## Configure Dell Registry Key Settings
-There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
+In some cases, Dell CEE may need to be installed on a different Windows server than the
+one where the Activity Monitor activity agent is deployed. When this happens, you must
manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -58,12 +58,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
@@ -94,13 +94,13 @@ Mover.
administrative account should have a $ character in the terminal.
:::note
-Do not use a # charter.
+Don't use a # charter.
:::
**Step 2 –** Create or retrieve the `cepp.conf` file.
-If there is not a `cepp.conf` file on the Data Mover(s), use a text editor to create a new blank
+If there isn't a `cepp.conf` file on the Data Movers, use a text editor to create a new blank
file in the home directory named `cepp.conf`. The following is an example command if using the text
editor 'vi' to create a new blank file:
@@ -126,7 +126,7 @@ The Activity Monitor requires the following parameters to be set in the `cepp.co
- `pool name= `
- This should equal the name assigned to the configuration container. This container is composed
- of the server(s) IP Address or FQDN where the Dell CEE is installed and where the list of
+ of the servers IP Address or FQDN where the Dell CEE is installed and where the list of
events to be monitored is located. It can be named as desired but must be a pool name.
- `servers= `
- This should equal the IP Address or FQDN of the Windows server where the Dell CEE is
@@ -175,7 +175,7 @@ The Activity Monitor requires the following parameters to be set in the `cepp.co
postevents=CloseModified|CloseUnmodified|CreateDir|CreateFile|DeleteDir|DeleteFile|RenameDir|RenameFile|SetAclDir|SetAclFile
-**Step 4 –** Move the `cepp.conf` file to the Data Mover(s) root file system. Run the following
+**Step 4 –** Move the `cepp.conf` file to the Data Movers root file system. Run the following
command:
**$ server_file [DATA_MOVER_NAME]-put cepp.conf cepp.conf**
@@ -201,7 +201,7 @@ Then verify the CEPA status using the following command:
**server_cepp [DATA_MOVER_NAME] -service –status**
-Once the `cepp.config` file has been configured, it is time to configure and enable monitoring with
+After the `cepp.config` file has been configured, configure and enable monitoring with
the Activity Monitor. See the
[Netwrix Activity Monitor Documentation](https://helpcenter.netwrix.com/category/activitymonitor)
for additional information.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/validate.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/validate.md
index 167a8b34fe..2c8c277d40 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/validate.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/celerra-vnx-aac/validate.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
+After the Activity Monitor agent is configured to monitor the Dell device, the automated
configuration must be validated to ensure events are being monitored.
## Validate Dell CEE Registry Key Settings
@@ -19,12 +19,12 @@ topic for information on manually setting the registry key.
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
-configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
-to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
+configure the Dell CEE automatically if it is installed on the same server as the agent. You must
+set this manually in the rare situations where the Dell CEE is installed on
+a different server than the Windows proxy servers where the Activity Monitor activity agent is
deployed.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -90,7 +90,7 @@ Dell CEE Services are Running topic for additional information.
## Validate Dell CEE Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -120,19 +120,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ctera-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ctera-activity.md
index e3adc627c7..670e32cfd0 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ctera-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ctera-activity.md
@@ -44,7 +44,7 @@ The CTERA Edge Filer can generate audit log events for the SMB access. Audit eve
local file and then forwarded to the CTERA Portal for further processing. The audit log is disabled
by default and must be enabled.
-Follow the steps to enable SMB audit logs.
+Enable SMB audit logs.
**Step 1 –** Log in to the Edge Filer web interface. In the Configuration view, select **Logs** >
**Audit Logs**.
@@ -64,10 +64,10 @@ create a share.
**Step 4 –** Adjust the **Keep closed files for** parameter. Otherwise, use the default value.
**Step 5 –** Check all events except the **Read Extended Attributes** event in Events to log list.
-If you do not require monitoring of _Directory Read/List_ operations, which typically generate a
+If you don't require monitoring of _Directory Read/List_ operations, which typically generate a
high volume of data, uncheck the **List Folder Read Data** event.
-**Step 6 –** Make sure that **Log permission changes in human readable format** is unchecked.
+**Step 6 –** ensure that **Log permission changes in human readable format** is unchecked.
**Step 7 –** Click **Save**.
@@ -123,7 +123,7 @@ article for additional information.
and then to ACTIVE. Wait until the status is ACTIVE before proceeding to the next step.
:::note
-If the status does not change to ACTIVE, the log files need to be collected from
+If the status doesn't change to ACTIVE, the log files need to be collected from
`/usr/local/lib/ctera/work/logs/services` directory.
See the
[CTERA Messaging Service Logs](https://kb.ctera.com/docs/setting-up-the-ctera-messaging-service-2#ctera-messaging-service-logs)
@@ -146,7 +146,7 @@ Monitor Agent will apply the settings and perform periodic checks to ensure cor
automatic configuration, use the **Enable Edge Filer Syslog auditing** option in the host properties
and specify credentials to access the CTERA Portal API.
-Follow the steps to configure the Edge Filer Syslog Service manually.
+Configure the Edge Filer Syslog Service manually.
**Step 1 –** Configure monitoring of the CTERA Portal in the Activity Monitor Console.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md
index deade0c148..a1085fcf53 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md
@@ -6,9 +6,6 @@ sidebar_position: 20
# Configure Access to HNAS Audit Logs on Activity Agent Server
-Follow the steps to configure access to the HNAS audit logs on the Windows server hosting the
-Activity Monitor activity agent.
-
**Step 1 –** On the Windows computer, go to Run and type `compmgmt.msc`.
**Step 2 –** In the right-hand panel, select More Actions > Connect to another computer.
@@ -22,7 +19,7 @@ Folders > Shares.
**Step 5 –** Select the Security tab and click Advanced.
**Step 6 –** In the Advanced Security Settings dialog box, select the Audit tab. Click Add or Edit
-to select the users and groups to be audited and add the desired user or group.
+to select the users and groups to be audited and add the user or group you want.
**Step 7 –** Select All for Type, and Full Control for Basic permissions.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md
index 216ea99581..d4dab92ebf 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Configure Audit Logs on HNAS
-Follow the steps to configure access to the HNAS audit logs on the Hitachi device.
+Configure access to the HNAS audit logs on the Hitachi device by following these steps:
**Step 1 –** Open a browser and enter the IP Address for HNAS in the address bar to launch the
Hitachi Storage Navigator (SN). Enter the username and password.
@@ -33,7 +33,7 @@ auditing). In the Audit Log section, set the maximum log file size to a value of
is recommended to set it to 16 MB. In the Log roll over policy section, select New. The product does
not support the Wrap policy. Click OK to close.
-Once access has been configured on the Hitachi device, it is necessary to configure access to the
+Once access has been configured on the Hitachi device, configure access to the
HNAS audit logs on the Windows server. See the
[Configure Access to HNAS Audit Logs on Activity Agent Server](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configureaccesstologs.md) topic for
additional information.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md
index c3e8fee835..17842f2b53 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/hitachi-activity.md
@@ -11,7 +11,7 @@ multiple file systems. Auditing is enabled and configured per file system. This
to enable auditing on an HNAS and to configure the Activity Monitor to monitor activity coming from
the Hitachi device auditing.
-The Activity Monitor does not use the EVS or file system name to connect to HNAS. Therefore, all
+The Activity Monitor doesn't use the EVS or file system name to connect to HNAS. Therefore, all
that is required of the user for HNAS activity collection is the following:
- Logs path (UNC)
@@ -39,11 +39,11 @@ clients using other protocols would be costly in terms of system performance, be
operation would have to be audited as an open operation. **Therefore, when file system auditing is
enabled, by default, only clients connecting through the CIFS protocol are allowed access to the
file system.** Access by clients using other protocols, like NFS, can, however, be allowed. When
-such access is allowed, access to file system objects through these protocols is not audited.”
+such access is allowed, access to file system objects through these protocols isn't audited.”
:::note
File system auditing can be configured to deny access to clients connecting with protocols
-that cannot be audited (NFS). Please see the Hitachi
+that can't be audited (NFS). see the Hitachi
[Server and Cluster Administration Guide](https://support.hds.com/download/epcra/hnas0106.pdf) for
additional information.
:::
@@ -51,7 +51,7 @@ additional information.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Hitachi devices.
+Complete the following checklist before configuring activity monitoring of Hitachi devices.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: [Configure Audit Logs on HNAS](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/hitachi-aac/configurelogs.md)**
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/installcee.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/installcee.md
index 39bfb11e36..e6788baf9f 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/installcee.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,10 +20,8 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
-
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
-this component. It is recommended to use the most current version.
+this component. Use the most current version.
**Step 2 –** Follow the instructions in the Dell
[Using the Common Event Enabler on Windows Platforms](https://www.dell.com/support/home/en-us/product-support/product/common-event-enabler/docs)
@@ -33,7 +31,7 @@ guide to install and configure the CEE. The installation will add two services t
- EMC CEE Monitor (Display Name: EMC CEE Monitor)
:::info
-The latest version of .NET Framework and Dell CEE is recommended to use with the
+The latest version of .NET Framework and Dell CEE with
asynchronous bulk delivery (VCAPS) feature.
:::
@@ -44,8 +42,8 @@ issues related to Dell CEE.
## Configure Dell Registry Key Settings
-There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
+In some cases, Dell CEE may need to be installed on a different Windows server than the
+one where the Activity Monitor activity agent is deployed. When this happens, you must
manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -56,12 +54,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/isilon-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/isilon-activity.md
index 97f28cdc32..803b3699f9 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/isilon-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/isilon-activity.md
@@ -20,15 +20,15 @@ initiated the activity. The stored events are then forwarded by the node to the
concurrently to several instances. At this point, Dell CEE forwards the audit event to a defined
endpoint, such as Activity Monitor agent.
-Complete the following checklist prior to configuring Activity Monitor to monitor the host.
+Complete the following checklist before configuring Activity Monitor to monitor the host.
Instructions for each item of the checklist are detailed within the following sections.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - DNS name of Isilon/PowerScale CIFS share(s) to be monitored
- - Access Zone(s) containing the CIFS shares to be monitored
+ - DNS name of Isilon/PowerScale CIFS shares to be monitored
+ - Access Zones containing the CIFS shares to be monitored
- Account with access to the OneFS UI or CLI
- Download the Dell CEE from:
@@ -54,7 +54,7 @@ activity will be evenly distributed between the pairs.
- Important:
- - Dell CEE 8.8 is the minimum supported version. It is recommended to use the latest available
+ - Dell CEE 8.8 is the minimum supported version. Use the latest available
version.
- Dell CEE requires .NET Framework 3.5 to be installed on the Windows server
@@ -79,12 +79,12 @@ Checklist Item 3: Configure Auditing on the Dell Isilon/PowerScale Cluster
- Important:
- Value of the **Storage Cluster Name** field must exactly match the name entered for the
- monitored host in the Activity Monitor Console. If the Storage Cluster Name cannot be modified
+ monitored host in the Activity Monitor Console. If the Storage Cluster Name can't be modified
(for example, another 3rd party depends on it), you need to set the Host Aliases parameter in
the Activity Monitor Console. Otherwise, if for some reason the Storage Cluster Name must be
left empty, one can list OneFS cluster node names in the Host Aliases.
- - If the Storage Cluster Name is not empty, set the Host Aliases parameter to its value
+ - If the Storage Cluster Name isn't empty, set the Host Aliases parameter to its value
- If the Storage Cluster Name is empty, set the Host Aliases to a semicolon-separated list
of OneFS node names
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/manualconfiguration.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/manualconfiguration.md
index e9006d0363..affab398c4 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/manualconfiguration.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/manualconfiguration.md
@@ -22,7 +22,7 @@ cluster, include all relevant zones.
Ensure that OneFS collects only events you are interested in. By default, OneFS may monitor things
like directory reads, which can take up a large amount of space. Configuring the OneFS events that
-need monitoring is not done through the Activity Monitor console. Configure OneFS event monitoring
+need monitoring isn't done through the Activity Monitor console. Configure OneFS event monitoring
using OneFS CLI with the isi audit modify command for each access zone. Enabling monitoring for only
what is needed for the environment will reduce the data load to the agent.
@@ -54,8 +54,8 @@ server hosting CEE. Use either of the following format:
:::info
-When deploying multiple Dell CEE instances at scale, it is recommended that an
-accommodating agent must be configured with each CEE instance. If multiple CEE instances send events
+When deploying multiple Dell CEE instances at scale, configure an
+accommodating agent with each CEE instance. If multiple CEE instances send events
to just one agent, it may create an overflow of data and overload the agent. Distributing the
activity stream into pairs will be the most efficient way of monitoring large data sets at scale.
:::
@@ -66,7 +66,7 @@ be an exact match to the name which is entered in the Activity Monitor for the *
list.
This name is used as a ‘tag’ on all events coming through the CEE. This name must exactly match what
-is in the Activity Monitor or it does not recognize the events.
+is in the Activity Monitor or it doesn't recognize the events.
:::info
Use the CIFS DNS name for Dell OneFS.
@@ -79,12 +79,12 @@ name entered here must exactly match what is used for Access Analyzer as a targe
:::
-If the Storage Cluster Name cannot be modified (for example, another third-party depends on it), you
+If the Storage Cluster Name can't be modified (for example, another third-party depends on it), you
need to set the Host Aliases parameter in the Activity Monitor Console:
-- If the Storage Cluster Name is not empty, set the Host Aliases parameter to its value
+- If the Storage Cluster Name isn't empty, set the Host Aliases parameter to its value
- If the Storage Cluster Name is empty, set the Host Aliases to a semicolon-separated list of OneFS
node names
-Next, it is time to configure the monitoring agent on the Windows server to monitor the
+Next, configure the monitoring agent on the Windows server to monitor the
Isilon/PowerScale device.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/validate.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/validate.md
index 2bd4def69e..4d046cf0d5 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/validate.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/isilon-powerscale-aac/validate.md
@@ -6,18 +6,18 @@ sidebar_position: 30
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
+After the Activity Monitor agent is configured to monitor the Dell device, the automated
configuration must be validated to ensure events are being monitored.
## Validate Dell CEE Registry Key Settings
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
-to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
+to be set manually in the rare situations where the Dell CEE is installed on
+a different server than the Windows proxy servers where the Activity Monitor activity agent is
deployed.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -83,7 +83,7 @@ Dell CEE Services are Running topic for additional information.
## Validate Dell CEE Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -113,19 +113,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md
index a74a220d97..304f47a942 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/nasuni-activity.md
@@ -13,7 +13,7 @@ network connection to the appliance. Nasuni will then stream event data to the a
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Nasuni Edge Appliances.
+Complete the following checklist before configuring activity monitoring of Nasuni Edge Appliances.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Generate Nasuni API Access Key**
@@ -30,8 +30,6 @@ Instructions for each item of the checklist are detailed within the following to
## Nasuni Filer Management Interface
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Filer Management Interface.
-
**Step 1 –** Within the **Configuration** menu, under **USERS & SECURITY**, select API Access Keys.
The API Access Keys page opens.
@@ -43,8 +41,8 @@ The API Access Keys page opens.
**Step 5 –** In the Successfully Generated API Key window, copy the Key Passcode.
-Both the Key Name and the Key Passcode are required by the Activity Monitor in order to connect to
-the Nasuni Edge Appliance. Once the API Key has been generated, it is time to configure and enable
+Both the Key Name and the Key Passcode are required by the Activity Monitor to connect to
+the Nasuni Edge Appliance. After the API Key has been generated, configure and enable
monitoring with the Activity Monitor console.
:::note
@@ -55,22 +53,20 @@ the exact same case as generated.
## Nasuni Management Console
-Follow the steps to generate a Nasuni API Access Key in the Nasuni Management Console.
-
**Step 1 –** Click Filers and select API Keys from the menu on the left. The Filer API Access Key
Settings page opens.
**Step 2 –** Click New API Key button. The Add API Access Key window opens.
-**Step 3 –** From the Filer drop-down menu, select the desired Nasuni Edge Appliance. Then enter a
+**Step 3 –** From the Filer dropdown menu, select the Nasuni Edge Appliance you want. Then enter a
Name for the key; for example, the name of the application.
**Step 4 –** Click Add API Key.
**Step 5 –** A message appears which includes the Key Passcode; copy the Key Passcode.
-Both the Key Name and the Key Passcode are required by the Activity Monitor in order to connect to
-the Nasuni Edge Appliance. Once the API Key has been generated, it is time to configure and enable
+Both the Key Name and the Key Passcode are required by the Activity Monitor to connect to
+the Nasuni Edge Appliance. After the API Key has been generated, configure and enable
monitoring with the Activity Monitor console.
:::note
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md
index eff70052ec..5ab326a4a9 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/nutanix-activity.md
@@ -12,7 +12,7 @@ A user having REST API access must be created on the Nutanix Files server to mon
server using Activity Monitor. Additional configurations are done automatically by Activity Monitor
using the Nutanix API with the help of this user.
-Follow the steps to create a new user account with Nutanix Prism:
+To create a new user account with Nutanix Prism:
**Step 1 –** Open Nutanix Prism web portal.
@@ -37,7 +37,7 @@ Monitor.
:::note
-Nutanix Files does not report events for activity originating from a server where the
+Nutanix Files doesn't report events for activity originating from a server where the
Activity Monitor Agent is installed.
:::
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefirewall.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefirewall.md
index 6926d8d108..541b83545e 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefirewall.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefirewall.md
@@ -30,11 +30,11 @@ Monitor.
Both classic ONTAPI/ZAPI and the new REST API are supported. Starting with ONTAP 9.13.1, the product
uses REST API by default if it is available. HTTP and HTTPS protocols are supported. For HTTPS, two
-modes are supported: strict and ignore errors. For the strict mode, the product allows you to
-disable the host name validation in case the agent cannot resolve the FQDN of the LIF.
+modes are supported: strict and ignore errors. For the strict mode, you can
+disable the host name validation in case the agent can't resolve the FQDN of the LIF.
Enabling the API access varies depending on ONTAP version. The following sections list common steps
-on enabling the API access. Please refer to the NetApp documentation for more details.
+on enabling the API access. refer to the NetApp documentation for more details.
### Management-http Service
@@ -74,7 +74,7 @@ network interface service-policy add-service -service management-https -policy d
### Firewall Policy
-For ONTAP 9.5 and older, the following commands can be used to either create a new firewall policy
+For ONTAP 9.5 and older, the following commands Use the following commands to create a new firewall policy
or modify an existing policy if ONTAPI is blocked.
#### Create New Firewall HTTP Policy
@@ -148,15 +148,15 @@ Verify that the output is displayed as follows:
## FPolicy
The FPolicy framework enables the collection of audit events on the ONTAP side and their transfer to
-the agent(s) via the designated Data LIFs. Each LIF establishes its own connection with one or
+the agents via the designated Data LIFs. Each LIF establishes its own connection with one or
several agents and sends notifications as soon as the file transaction occurs. The FPolicy
connection is asynchronous and buffered; both ONTAP and Activity Monitor have techniques in place to
-make sure that connections are alive and working. The connection can be secured using TLS with
+ensure that connections are alive and working. The connection can be secured using TLS with
server or mutual authentication.
ONTAP cluster nodes connect to the agent on port 9999 by default. The port can be changed in the
-agent's settings. The agent adds this port to Windows Firewall exclusions automatically. Please
-ensure the port is not blocked by other firewalls between ONTAP and the agent.
+agent's settings. The agent adds this port to Windows Firewall exclusions automatically. Ensure
+the port isn't blocked by other firewalls between ONTAP and the agent.
### Data-fpolicy-client Service
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md
index b0ba05a883..e6da199ba8 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md
@@ -7,15 +7,15 @@ sidebar_position: 30
# Configure FPolicy
Activity Monitor relies on the NetApp FPolicy framework for monitoring of file access events on
-Storage Virtual Machines (SVM). FPolicy needs to be configured for each SVM.
+Storage Virtual Machines (SVM). Configure FPolicy for each SVM.
There are two ways to configure FPolicy:
- Activity Monitor agent can facilitate the Automatic Configuration of FPolicy for the monitored SVM
- using the ONTAP API. This mode is simple, but does not allow you to exclude certain volumes or
+ using the ONTAP API. This mode is simple, but you can't exclude certain volumes or
shares of the SVM from being monitored. It also requires additional permissions to create and
modify FPolicy.
-- Another option is to Manually Configure FPolicy for each SVM. This mode allows you to fine tune
+- Another option is to Manually Configure FPolicy for each SVM. This mode lets you fine-tune
FPolicy by excluding certain volumes or shares from being monitored. It also reduces product
permissions.
@@ -80,7 +80,7 @@ locally on the Activity Monitor Console server.
### Create PEM File for Client Certificate
A certificate (Client Certificate) for the SVM needs to be copied to a PEM file. This is required
-for the TLS, mutual authentication option. Follow the steps to create the PEM file for the Client
+for the TLS, mutual authentication option. The following steps create the PEM file for the Client
Certificate.
**Step 1 –** On the SVM , use the following command to show the security certificate details:
@@ -97,7 +97,7 @@ security certificate show -vserver testserver -type server instance
**Step 2 –** Copy the security certificate details into a text file and copy the public key to a PEM
file. The following variables from security details will be needed to set mutual-authentication
-during Part 6 of manual configuration and prior to automatic configuration:
+during Part 6 of manual configuration and before automatic configuration:
- SVM
- Common Name
@@ -118,7 +118,7 @@ dedicated volume for each SVM as a staging buffer before events are sent to the
Persistent Store requires the following parameters:
-- Volume name – If the volume does not exist, it will be created automatically (recommended).
+- Volume name – If the volume doesn't exist, it will be created automatically (recommended).
- Initial volume size – Specifies the starting size of the volume.
- Autosize mode – Options include Off, Grow, or Grow/Shrink.
@@ -142,7 +142,7 @@ To check that the SVM has assigned local tiers, use the following command:
**vserver show -vserver [SVM_NAME] -fields aggr-list**
-The command shows currently local tiers. If no tiers are assigned, "-" is displayed.
+The command shows local tiers. If no tiers are assigned, "-" is displayed.
To assign local tiers to the SVM use the following command:
@@ -163,7 +163,7 @@ deletion by marking it as not mountable.
If you choose to create the volume manually, ensure the following:
-- The volume is not mounted and has no junction point.
+- The volume isn't mounted and has no junction point.
- The snapshot policy for the volume is set to none.
For additional and up-to-date recommendations on volumes for the Persistent Store, refer to the
@@ -172,8 +172,7 @@ NetApp documentation.
## Manually Configure FPolicy
This section describes how to manually configure FPolicy. Manual configuration of the FPolicy is
-recommended if the policy needs to be scoped to monitor select volumes or shares. It is necessary to
-create several FPolicy components and then enable the FPolicy. See the sections corresponding to
+recommended if the policy needs to be scoped to monitor select volumes or shares. Create several FPolicy components and then enable the FPolicy. See the sections corresponding to
each part of this list:
- Part 1: Install Server Certificate on the SVM (only if using TLS authentication)
@@ -187,7 +186,7 @@ each part of this list:
- Part 3: Create FPolicy Events
- - An FPolicy event defines which protocol(s) to monitor and which file access events to monitor.
+ - An FPolicy event defines which protocols to monitor and which file access events to monitor.
- Part 4: Create Persistent Store (only if Persistent Store is used. RECOMMENDED)
@@ -213,7 +212,7 @@ each part of this list:
- Part 8: Enable the FPolicy
- - Once the FPolicy is enabled, the Activity Monitor Agent can be configured to monitor the SVM.
+ - After the FPolicy is enabled, the Activity Monitor Agent can be configured to monitor the SVM.
- Part 9: Connect FPolicy Server / Agent to Cluster Node (optional)
@@ -222,7 +221,7 @@ each part of this list:
### Part 1: Install Server Certificate on the SVM
-If using the TLS authentication options, it is necessary to install the Server Certificate on the
+If using the TLS authentication options, install the Server Certificate on the
SVM.
Use the following command to install the Server Certificate:
@@ -269,8 +268,8 @@ IMPORTANT:
- The following values are required:
- `engine-name StealthAUDITEngine`, the names of the external engine object can be customized
- (see below).
- - `port 9999`, Port number can be customized, but it is recommended to use 9999.
+ (see Customization of FPolicy Object Names).
+ - `port 9999`, Port number can be customized, but use 9999.
- `extern-engine-type asynchronous`
- `ssl-option no-auth`
- `send-buffer-size 6291456`, for ONTAP 9.10+ use `send-buffer-size 8388608`
@@ -323,10 +322,9 @@ Maximum Notification Retention Duration: 3m
External Engine Format: xml
```
-Relevant NetApp Documentation: To learn more about creating an external engine, please visit the
-NetApp website and read the
-[vserver fpolicy policy external-engine create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-external-engine-create.html)
-article.
+Relevant NetApp Documentation: For more information about creating an external engine, refer to the
+NetApp documentation on
+[vserver fpolicy policy external-engine create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-external-engine-create.html).
### Part 3: Create FPolicy Event
@@ -355,8 +353,7 @@ IMPORTANT:
reported.
- Limiting the file operations to be monitored is an excellent way to limit the performance impact
- the FPolicy will have on the NetApp device. The file operations from which to choose are below
- with additional filter options:
+ the FPolicy will have on the NetApp device. The following file operations have additional filter options:
- `create` – File create operations
- `create_dir` – Directory create operations
@@ -382,7 +379,7 @@ IMPORTANT:
- `read` – File read operations
- `first-read` – Limits notification to only first read operations for CIFS protocol. For
- ONTAP 9.2+, this filter can be used for both CIFS and NFS protocols.
+ ONTAP 9.2+, you can use this filter with both CIFS and NFS protocols.
- `rename`– File rename operations
- `rename_dir`– Directory rename operations
@@ -414,7 +411,7 @@ IMPORTANT:
- `write` – File write operations
- `first-write` – Limits notification to only first write operations for CIFS protocol. For
- ONTAP 9.2+, this filter can be used for both CIFS and NFS protocols.
+ ONTAP 9.2+, you can use this filter with both CIFS and NFS protocols.
- For failed/denied events, the list of supported file operations is limited to the following
values:
@@ -502,10 +499,9 @@ Ontap915::> fpolicy policy event show -vserver svm0 -event-name StealthAUDITScre
Send Failed File Operation Notifications: false
```
-Relevant NetApp Documentation: To learn more about creating an event, please visit the NetApp
-website and read the
-[vserver fpolicy policy event create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-event-create.html)
-article.
+Relevant NetApp Documentation: For more information about event creation, refer to the NetApp
+documentation on
+[vserver fpolicy policy event create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-event-create.html).
### Part 4: Create Persistent Store
@@ -537,7 +533,7 @@ IMPORTANT:
- `volume` – The name of the volume used for event storage.
- - If the volume does not exist, it will be automatically created on an assigned local tier.
+ - If the volume doesn't exist, it will be automatically created on an assigned local tier.
This is recommended.
- `size` – The initial size of the volume. The format is `[KB|MB|GB]`.
@@ -681,10 +677,9 @@ User Name for Privileged Access: -
Persistent Store Name: -
```
-Relevant NetApp Documentation: To learn more about creating a policy, please visit the NetApp
-website and read the
-[vserver fpolicy policy create](https://docs.netapp.com/us-en/ontap-cli/vserver-fpolicy-policy-create.html)
-article.
+Relevant NetApp Documentation: For more information about creating a policy, refer to the NetApp
+documentation on
+[vserver fpolicy policy create](https://docs.netapp.com/us-en/ontap-cli/vserver-fpolicy-policy-create.html).
### Part 6: Create FPolicy Scope
@@ -695,10 +690,10 @@ variable [SVM_NAME] in the command with an asterisk (\*).
IMPORTANT:
- The SVM used must be the SVM hosting the CIFS or NFS shares to be monitored.
-- It is not necessary to specify both volumes and shares. One or the other is sufficient.
+- It isn't necessary to specify both volumes and shares. One or the other is sufficient.
- If you want to monitor everything, set the "`volumes-to-include`" value to "`*`".
-Use the following command to create the FPolicy scope by specifying volume(s):
+Use the following command to create the FPolicy scope by specifying volumes:
```
vserver fpolicy policy scope create -vserver [SVM_NAME] -policy-name StealthAUDIT -volumes-to-include [VOLUME_NAME],[VOLUME_NAME]
@@ -710,7 +705,7 @@ Example:
vserver fpolicy policy scope create -vserver testserver -policy-name StealthAUDIT -volumes-to-include samplevolume1,samplevolume2
```
-Use the following command to create the FPolicy scope by specifying share(s):
+Use the following command to create the FPolicy scope by specifying shares:
```
vserver fpolicy policy scope create -vserver [SVM_NAME] -policy-name StealthAUDIT -shares-to-include [SHARE_NAME],[SHARE_NAME]
@@ -745,14 +740,13 @@ File Extensions to Include: -
File Extensions to Exclude: -
```
-Relevant NetApp Documentation: To learn more about creating scope, please visit the NetApp website
-and read the
-[vserver fpolicy policy scope create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-scope-create.html)
-article.
+Relevant NetApp Documentation: For more information about creating scope, refer to the NetApp
+documentation on
+[vserver fpolicy policy scope create](https://docs.netapp.com/us-en/ontap-cli-9141/vserver-fpolicy-policy-scope-create.html).
### Part 7: Set TLS Authentication
-If using the TLS authentication options, it is necessary to set authentication for the type of
+If using the TLS authentication options, set authentication for the type of
authentication.
#### Set Server-Authentication
@@ -832,10 +826,9 @@ svm0 StealthAUDIT 10 on
DITEngine
```
-Relevant NetApp Documentation: To learn more about enabling a policy, please visit the NetApp
-website and read the
-[vserver fpolicy enable](https://docs.netapp.com/us-en/ontap-cli-9121//vserver-fpolicy-enable.html)
-article.
+Relevant NetApp Documentation: For more information about enabling a policy, refer to the NetApp
+documentation on
+[vserver fpolicy enable](https://docs.netapp.com/us-en/ontap-cli-9121//vserver-fpolicy-enable.html).
### Part 9: Connect FPolicy Server / Agent to Cluster Node
@@ -883,7 +876,7 @@ Starting ONTAP 9.15.1 and later versions, it is recommended to enable the Persis
that stores events on disk before they are sent to the Activity Monitor Agent. This reduces
client-side latency and increases resilience during network delays or bursts of activity. To enable
the Persistent Store, specify a volume name and size on the Persistent Store tab of the FPolicy page
-in the monitored host properties. The volume will be automatically created if it does not already
+in the monitored host properties. The volume will be automatically created if it doesn't already
exist. See the Persistent Store topic for additional information on the recommended volume size.
If using the TLS, mutual authentication option, you will need to create the PEM file for the Client
@@ -892,7 +885,7 @@ will also be necessary to set mutual authentication on the SVM.
### Set TLS Mutual-Authentication
-If using the TLS, mutual authentication options, it is necessary to set authentication.
+If using the TLS, mutual authentication options, set authentication.
Use the following command to set mutual-authentication:
@@ -932,6 +925,6 @@ These names can be customized in the monitored host's settings in the Activity M
useful in two scenarios:
- You want the names to match the company policies;
-- You want to configure FPolicy manually using your custom names, but also want to leverage the
+- You want to configure FPolicy manually using your custom names, but also want to use the
"Enable and Connect FPolicy" feature of the Activity Monitor, so that the product ensures that
FPolicy stays enabled and connected at all times.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md
index 894559daad..3902bc12f5 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/ontap-cluster-activity.md
@@ -6,7 +6,7 @@ sidebar_position: 90
# NetApp Data ONTAP Cluster-Mode Activity Auditing Configuration
-The Activity Monitor agent employed to monitor NetApp leverages NetApp ONTAP API, and the NetApp
+The Activity Monitor agent employed to monitor NetApp uses NetApp ONTAP API, and the NetApp
FPolicy framework to monitor file system events. This includes both NetApp 7-Mode and Cluster-Mode
configurations. For more information about FPolicy read the
[What are the two parts of the FPolicy solution ](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html)
@@ -25,17 +25,17 @@ list of volumes, list of LIFs. Depending on the configuration, the agent can als
of FPolicy to ensure it is enabled; configure FPolicy and register or unregister itself.
The FPolicy framework enables the collection of audit events on the ONTAP side and their transfer to
-the agent(s) via the designated Data LIFs. Each LIF establishes its own connection with one or
+the agents via the designated Data LIFs. Each LIF establishes its own connection with one or
several agents and sends notifications as soon as the file transaction occurs. The FPolicy
connection is asynchronous and buffered; both ONTAP and Activity Monitor have techniques in place to
-make sure that connections are alive and working. The connection can be secured using TLS with
+ensure that connections are alive and working. The connection can be secured using TLS with
server or mutual authentication.
FPolicy may have a significant impact on file system throughput, and it is always a best practice to
monitor performance when enabling FPolicy.
:::info
-Create a tailored FPolicy which only collects the desired activity from the
+Create a tailored FPolicy which only collects the activity you want from the
environment to limit the scope and impact.
:::
@@ -43,13 +43,13 @@ environment to limit the scope and impact.
For scale-out and fault tolerance purposes, the product supports a range of deployment options. A
single agent can receive events from multiple SVMs. Or events from a single SVM can be distributed
among multiple agents. Or a set of SVMs can distribute events among a set of agents. The choice
-depends on the fault tolerance requirements and the expected event flow. As a rule of thumb, the
-_average_ load on a single agent should not exceed 5000 events per second.
+depends on the fault tolerance requirements and the expected event flow. In general, the
+_average_ load on a single agent shouldn't exceed 5000 events per second.
Starting with ONTAP 9.15.1, the FPolicy Persistent Store provides resilience and predictable latency
during scenarios such as network delays or bursts of activity. The feature uses a dedicated volume
for each SVM as a staging buffer before events are sent to the agent. FPolicy will automatically
-create a volume if one does not already exist.
+create a volume if one doesn't already exist.
:::info
Enable the Persistent Store feature and allow it to create a volume
@@ -59,7 +59,7 @@ automatically.
## Configuration Checklist
-Complete the following checklist prior to configuring the activity monitoring of NetApp Data ONTAP
+Complete the following checklist before configuring the activity monitoring of NetApp Data ONTAP
Cluster-Mode devices. Instructions for each item of the checklist are detailed within the following
sections.
@@ -67,10 +67,10 @@ sections.
- Gather the following information:
- - Names of the SVM(s) to be monitored
+ - Names of the SVMs to monitor
- FPolicy is configured for each SVM separately
- - This should be the SVM(s) hosting the CIFS or NFS shares(s) to be monitored
+ - This should be the SVMs hosting the CIFS or NFS shares that you want to monitor
- Credentials to access ONTAP to provision a role and account.
- Desired functionality level:
@@ -81,21 +81,21 @@ sections.
- _Configure FPolicy_. The product configures FPolicy automatically and ensures it stays
enabled and connected all the time. RECOMMENDED.
- - Volumes or shares on each SVM to be monitored
+ - Volumes or shares on each SVM to monitor
- Limiting the FPolicy to select volumes or shares is an effective way to limit the
performance impact of FPolicy
- - Successful/failed file operations to be monitored
+ - Successful/failed file operations to monitor
- Limiting the FPolicy to specific file operations is an effective way to limit the
performance impact of FPolicy
- - IP Address of the server(s) where the Activity Monitor Agent is deployed
+ - IP Address of the servers where the Activity Monitor Agent is deployed
- API enabled in ONTAP: the classic ONTAPI/ZAPI or the new REST API
- The product supports the REST API for ONTAP 9.13.1 and above.
- - Volume names and sizes to be used as a Persistent Store for each SVM. This is recommended.
+ - Volume names and sizes for the Persistent Store for each SVM. This is recommended.
- The product supports the Persistent Store feature for ONTAP 9.15.1 and later.
- At least one local tier (aggregate) is assigned to the SVM.
@@ -185,21 +185,21 @@ Monitor Agent.
- Agent must be able to connect to ONTAP API via a management LIF on ports HTTP (80) or HTTPS (443)
- - NetApp firewall policy may need to be modified.
- - LIF's service policy may need to be modified to include `management-https` or
- `management-http` services.
+ - Modify the NetApp firewall policy if needed.
+ - Modify the LIF's service policy to include `management-https` or
+ `management-http` services if needed.
- Either of these ports is required. Activity Monitor requires ONTAP API access.
- ONTAP cluster nodes, which serve the SVM, must be able to connect to the agent on port 9999.
- - LIFs' service policy may need to be modified to include `data-fpolicy-client` service.
+ - Modify the LIFs' service policy to include `data-fpolicy-client` service if needed.
- Each data serving node should have its own LIF with the `data-fpolicy-client` service.
- The default port 9999 can be changed in the agent's settings.
**Checklist Item 4: [Configure FPolicy](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md)**
- Remember: all FPolicy objects and SVM names are case sensitive.
-- FPolicy must be configured for each SVM to be monitored.
+- Configure FPolicy for each SVM you want to monitor.
- If using TLS, … authentication options, generate needed certificates and PEM files
- Select method:
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/provisionactivity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/provisionactivity.md
index 8689a54726..6f35c4dec0 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/provisionactivity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/provisionactivity.md
@@ -26,7 +26,7 @@ The permissions needed depends on the functionality level:
- Least Privileged: ONLY Collect Events – This is the minimal functionality level. A user manually
configures FPolicy and ensures that it stays enabled and connected. The product only collects
- events. This functionality level is not recommended as it requires an additional solution that
+ events. This functionality level isn't recommended as it requires an additional solution that
tracks the state of FPolicy and fixes the problem should ONTAP disconnect or should the policy
become disabled.
- **_RECOMMENDED:_** Less Privileged: Enable/Connect Policy & Collect Events – With this level, the
@@ -39,9 +39,8 @@ The permissions needed depends on the functionality level:
No matter which set of permissions you provision, validate the configuration before continuing to
Part 2. See the Validate Part 1: Security Role Configuration topic for additional information.
-If the FPolicy is to be used for both the Activity Monitor and Access Analyzer, the account also
-needs to be provisioned with an additional permission. See the Access Analyzer Integration topic for
-additional information.
+If you use FPolicy with both the Activity Monitor and Access Analyzer, you must provision the account
+with an additional permission. See the Access Analyzer Integration topic for additional information.
The commands to create a role and names of permissions depend on the ONTAP API used. The product
supports both the classic ONTAPI/ZAPI and the new REST API. For ONTAPI/ZAPI you need to use
@@ -103,7 +102,7 @@ security login rest-role create -role enterpriseauditorrest -api "/api/svm/svms"
```
:::note
-If the FPolicy account is configured with these permissions, it is necessary to manually
+If the FPolicy account is configured with these permissions, you need to manually
configure the FPolicy. See the [Configure FPolicy](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md) topic for additional
information.
:::
@@ -127,7 +126,7 @@ permissions to collect events:
:::tip
Remember, this permission permits the Activity Monitor to enable the FPolicy. If the “Enable
- and connect FPolicy” option is employed but the permission is not provided, the agent will
+ and connect FPolicy” option is employed but the permission isn't provided, the agent will
encounter “Failed to enable policy” errors, but it will still be able to connect to the FPolicy.
Since this permission model requires a manual configuration of the FPolicy, then the need to
manually enable the FPolicy will be met.
@@ -192,7 +191,7 @@ security login rest-role create -role enterpriseauditorrest -api "/api/protocols
```
:::note
-If the FPolicy account is configured with these permissions, it is necessary to manually
+If the FPolicy account is configured with these permissions, you need to manually
configure the FPolicy. See the [Configure FPolicy](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap-cluster-aac/configurefpolicy.md) topic for additional
information.
:::
@@ -286,7 +285,7 @@ additional information.
### Access Analyzer Integration
-If the desire is for FPolicy to be used with both the Activity Monitor and Access Analyzer, then the
+If you use FPolicy with both the Activity Monitor and Access Analyzer, the
following permission is also required:
- `security login role show-ontapi` – Readonly access
@@ -340,7 +339,7 @@ article.
## Part 2: Create Security Login
-Once the access control role has been created, apply it to a domain account. Ensure the following
+After the access control role has been created, apply it to a domain account. Ensure the following
requirements are met:
- The SVM used in the following command must be the same SVM used when creating the access control
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/configurefpolicy.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/configurefpolicy.md
index 64cf6f42c9..4e1feb3fa2 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/configurefpolicy.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/configurefpolicy.md
@@ -27,7 +27,7 @@ Manually Configure FPolicy (Recommended Option) – A tailored FPolicy
## Manually Configure FPolicy (Recommended Option)
This section describes how to manually configure FPolicy. Manual configuration of the FPolicy is
-recommended so that the policy can be scoped. It is necessary to create six FPolicy components and
+recommended so that the policy can be scoped. Create six FPolicy components and
then enable the FPolicy. See the sections corresponding to each part of this list:
- Part 1: Create FPolicy
@@ -43,10 +43,9 @@ vFiler. This is because FPolicy operates on the affected vFiler. Therefore, when
commands on a vFiler, the commands must be run from a vFiler context (e.g. via the vFiler run
command).
-Relevant NetApp Documentation: To learn more about configuring file policies, please visit the
-NetApp website and read
-[na_fpolicy – configure file policies](https://library.netapp.com/ecmdocs/ECMP1196890/html/man1/na_fpolicy.1.html)
-article.
+Relevant NetApp Documentation: For more information about configuring file policies, refer to the
+NetApp documentation on
+[na_fpolicy – configure file policies](https://library.netapp.com/ecmdocs/ECMP1196890/html/man1/na_fpolicy.1.html).
### Part 1: Create FPolicy
@@ -65,8 +64,8 @@ fpolicy create StealthAUDIT screen
### Part 2: Set FPolicy Required to Off
-If the `FPolicy Required` value is set to on, user requests are denied if an FPolicy server is not
-available to implement the policy. If it is set to off, user requests are allowed when it is not
+If the `FPolicy Required` value is set to on, the device denies user requests if an FPolicy server isn't
+available to implement the policy. If it is set to off, the device allows user requests when it isn't
possible to apply the policy to the file because no FPolicy server is available.
IMPORTANT:
@@ -81,8 +80,8 @@ fpolicy options StealthAUDIT required off
### Part 3: Set FPolicy to Collect Permission Changes
-The cifs_setattr value must be set to on in order for CIFS requests to change file security
-descriptors to be screened by the policy.
+The cifs_setattr value must be set to on so the policy screens CIFS requests that change file security
+descriptors.
IMPORTANT:
@@ -96,8 +95,7 @@ fpolicy options StealthAUDIT cifs_setattr on
### Part 4: Set FPolicy to Monitor Alternate Data Streams
-The monitor_ads value must be set to on in order for CIFS requests for alternate data streams (ADS)
-to be monitored by the policy.
+The monitor_ads value must be set to on so the policy monitors CIFS requests for alternate data streams (ADS).
IMPORTANT:
@@ -111,8 +109,8 @@ fpolicy options StealthAUDIT monitor_ads on
### Part 5: Set FPolicy to Monitor Disconnected Sessions
-The cifs_disconnect_check value must be set to on in order for CIFS requests associated with
-disconnected sessions to be monitored by the policy.
+The cifs_disconnect_check value must be set to on so the policy monitors CIFS requests associated with
+disconnected sessions.
IMPORTANT:
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/customizefpolicy.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/customizefpolicy.md
index 52ede5e022..aef57c6218 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/customizefpolicy.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/customizefpolicy.md
@@ -6,5 +6,4 @@ sidebar_position: 40
# Customize FPolicy Policy Name
-There may be situations when FPolicy needs to be named something other than StealthAUDIT.
-Use **Host properties > FPolicy > Customize FPolicy** page to change the FPolicy object names.
\ No newline at end of file
+If you need to use a FPolicy name other than StealthAUDIT, use the **Host properties > FPolicy > Customize FPolicy** page to change the FPolicy object names.
\ No newline at end of file
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/enablehttp.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/enablehttp.md
index 2cdbc8a4ce..33c814e77f 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/enablehttp.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/enablehttp.md
@@ -28,7 +28,7 @@ Use the following command to enable HTTPS:
options httpd.admin.ssl.enable on
```
-Check HTTP Status:
+Check HTTPS Status:
```
options httpd.admin.ssl.enable
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/ontap7-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/ontap7-activity.md
index e6d8b4881f..a1466988bb 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/ontap7-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/ontap7-activity.md
@@ -6,18 +6,17 @@ sidebar_position: 80
# NetApp Data ONTAP 7-Mode Activity Auditing Configuration
-The Activity Monitor agent employed to monitor NetApp leverages 128-bit encrypted Remote Procedure
+The Activity Monitor agent uses 128-bit encrypted Remote Procedure
Calls (RPC), NetApp ONTAP-API, and NetApp FPolicy to monitor file system events. This includes both
-NetApp 7-Mode and Cluster-Mode configurations. To learn more about FPolicy please visit the NetApp
-website and read the
+NetApp 7-Mode and Cluster-Mode configurations. For more information about FPolicy, see the
[What FPolicy is](https://library.netapp.com/ecmdocs/ECMP1401220/html/GUID-54FE1A84-6CF0-447E-9AAE-F43B61CA2138.html)
-article.
+article on the NetApp website.
If the activity agent is stopped, a notification will be sent to the NetApp device to disconnect and
disable the associated FPolicy policy, but it will not be removed.
If the network connection is lost between the activity agent and the NetApp device, the NetApp
-device is configured with a default timeout to wait for a response. If a response is not received
+device is configured with a default timeout to wait for a response. If a response isn't received
from the Activity Agent within the timeout, then the NetApp device will disconnect and disable the
FPolicy policy. The Activity Agent will check every minute by default to see if the FPolicy policy
has been disabled and will enable it (if the auto-enable functionality is enabled for the agent).
@@ -29,15 +28,15 @@ No activity log file will be created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of NetApp Data ONTAP
+Complete the following checklist before configuring activity monitoring of NetApp Data ONTAP
7-Mode devices. Instructions for each item of the checklist are detailed within the following
topics.
**Checklist Item 1: Plan Deployment**
- Gather the following information:
- - Names of the vFiler™(s) to be monitored
- - DNS name of the CIFS shares(s) to be monitored
+ - Names of the vFiler™(s) you want to monitor
+ - DNS name of the CIFS shares you want to monitor
**Checklist Item 2: [Provision FPolicy Account](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md)**
@@ -73,7 +72,7 @@ topics.
**Checklist Item 3: Firewall Configuration**
- HTTP (80) or HTTPS (443)
-- HTTP or HTTPS protocols need to be enabled on the NetApp filer
+- Enable HTTP or HTTPS protocols on the NetApp filer
- TCP 135
- TCP 445
- Dynamic port range: TCP/UDP 137-139
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md
index f334e6dce4..3fa8083512 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/ontap7-aac/provisionactivity.md
@@ -16,10 +16,8 @@ Provisioning this account is a three part process:
- Part 2: Create a Group & Assign Role
- Part 3: Add User to Group
-Relevant NetApp Documentation: To learn more about node access controls, please visit the NetApp
-website and read the
-[na_useradmin – Administers node access controls](https://library.netapp.com/ecmdocs/ECMP1511537/html/man1/na_useradmin.1.html)
-article.
+For information about node access controls, see the NetApp documentation for
+[na_useradmin – Administers node access controls](https://library.netapp.com/ecmdocs/ECMP1511537/html/man1/na_useradmin.1.html).
## Part 1: Create Role with API/CLI Access
@@ -42,9 +40,9 @@ Host configuration.
:::
-The following command needs to be run to create the role.
+Run the following command to create the role.
-Run the following command when provisioning an account for manual configuration of FPolicy; it
+When provisioning an account for manual configuration of FPolicy, run the following command; it
includes the "Enable and connect FPolicy" option requirement:
```
@@ -57,7 +55,7 @@ Example:
useradmin role -add activitymonitor -c "Role for Activity Monitor" -a login-http-admin,api-system-api-list,api-system-get-version,api-cifs-share-list-iter-*,api-volume-list-info-iter-*,cli-fpolicy*
```
-Run the following command when provisioning an account for automatic configuration of FPolicy; it
+When provisioning an account for automatic configuration of FPolicy, run the following command; it
includes the "Enable and connect FPolicy" option requirement:
```
@@ -74,8 +72,7 @@ After the role is created, complete Part 2: Create a Group & Assign Role.
## Part 2: Create a Group & Assign Role
-Once the role has been created, it must be attached to a group. The following command needs to be
-run to create a group and assign the role to it.
+After you've created the role, attach it to a group. Run the following command to create a group and assign the role to it.
```
useradmin group -add [GROUP_NAME] -r [ROLE_NAME]
@@ -92,7 +89,7 @@ After the group is created and the role is assigned, complete Part 3: Add User t
## Part 3: Add User to Group
The final step is to add the domain user to the new group, Backup Operators group, and Power Users
-group. The following command needs to be run to add the user to all three groups.
+group. Run the following command to add the user to all three groups.
```
useradmin domainuser -add [DOMAIN\USER] -g [GROUP_NAME, WITHIN " MARKS IF MULTIPLE WORDS],"Backup Operators","Power Users"
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/panzura-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/panzura-activity.md
index 21593ed15b..1b49ce9ed6 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/panzura-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/panzura-activity.md
@@ -49,8 +49,8 @@ To prepare Panzura CloudFS for monitoring, auditing must be enabled.
Auditing in CloudFS can be enabled either automatically or manually.
:::info
-Using the automatic option using the CloudFS API streamlines the configuration
-process and ensures that auditing remains enabled and accurate.
+The automatic CloudFS API option streamlines the configuration process and
+ensures that auditing remains enabled and accurate.
:::
@@ -59,21 +59,21 @@ process and ensures that auditing remains enabled and accurate.
Netwrix Activity Monitor uses the CloudFS API to configure Third Party Vendor Support auditing
option.
-If a master node is targeted, the product will configure the global audit settings and assign to be
-pushed to subordinate nodes. If a subordinate node is targeted, the product will configure the local
+If a master node is targeted, the product will configure the global audit settings and push them to
+subordinate nodes. If a subordinate node is targeted, the product will configure the local
audit settings to override the global ones.
The product will also ensure the settings are correct with periodic checks.
## Manual Configuration
-Follow these steps to enable auditing.
+Enable auditing.
**Step 1 –** Navigate to **Audit Settings** > **Third Party Support**.
**Step 2 –** Enable the **Generate Third Party Logs** option.
-**Step 3 –** Enable the **Push to Subordinate(s)** option.
+**Step 3 –** Enable the **Push to Subordinates** option.
**Step 4 –** Enter **other** as the Vendor Name.
@@ -87,7 +87,7 @@ of data, also include readdir to the list.
**Step 7 –** Specify - in Exclude Files.
-**Step 8 –** Finally, add the Panzura host to be monitored in the Activity Monitor Console.
+**Step 8 –** Add the Panzura host you want to monitor in the Activity Monitor Console.
Auditing is now enabled.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/powerstore-aac/auditing.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/powerstore-aac/auditing.md
index b873219695..7bdc51c110 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/powerstore-aac/auditing.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/powerstore-aac/auditing.md
@@ -6,8 +6,6 @@ sidebar_position: 20
# Enable Auditing for Dell PowerStore
-Follow the steps to enable auditing on Dell PowerStore.
-
- Create an Event Publishing Pool
- Create an Event Publisher
- Enable Event Publishing for the NAS Server OR Enable or Disable Event Publishing for File System
@@ -18,8 +16,6 @@ white paper for additional information.
## Create an Event Publishing Pool
-Follow the steps tTo create a new event publishing pool.:
-
**Step 1 –** Select **Storage** > **NAS Servers** > **NAS Settings** > **Publishing Pools**.
**Step 2 –** Click **Create** and specify the name of the pool.
@@ -64,8 +60,6 @@ Follow the steps tTo create a new event publishing pool.:
## Create an Event Publisher
-Follow the steps tTo create a an event publisher.:
-
**Step 1 –** Select **Storage** > **NAS Servers** > **NAS Settings** > **Events Publishers**.
@@ -92,8 +86,6 @@ The events publisher is created.
## Enable Event Publishing for the NAS Server
-Follow the steps tTo enable or disable event publishing for the NAS Server.:
-
**Step 1 –** Select **Storage** > **NAS Servers**.
@@ -111,8 +103,7 @@ Dell PowerStore is enabled for auditing.
## Enable or Disable Event Publishing for File System
-Follow the steps toYou can enable or disable the feature for each file system individually. using
-the following:
+Enable or disable event publishing for each file system individually.
**Step 1 –** Select **Storage** > **File Systems** > **[FILE SYSTEM]** > **Security & Events** >
**Events Publishing**.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md
index 1a44db4585..4f1be765f5 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,8 +20,6 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
-
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -40,8 +38,7 @@ asynchronous bulk delivery (VCAPS) feature.
## Configure Dell Registry Key Settings
-There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
+If you install Dell CEE on a different Windows server than the Activity Monitor activity agent, you must
manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -52,12 +49,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/powerstore-aac/powerstore-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/powerstore-aac/powerstore-activity.md
index 1b8e914c01..a42b625c02 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/powerstore-aac/powerstore-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/powerstore-aac/powerstore-activity.md
@@ -20,12 +20,12 @@ activity log file is created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Dell PowerStore
+Complete the following checklist before configuring activity monitoring of Dell PowerStore
devices. Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment
+- Before beginning the deployment
- See the
[Dell PowerStore: File Capabilities](https://www.delltechnologies.com/asset/en-us/products/storage/industry-market/h18155-dell-powerstore-file-capabilities.pdf)
@@ -36,7 +36,7 @@ devices. Instructions for each item of the checklist are detailed within the fol
**Checklist Item 2: [Install Dell CEE](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/powerstore-aac/installcee.md)**
-- Dell CEE should be installed on the Windows proxy server(s) where the Activity Monitor activity
+- Dell CEE should be installed on the Windows proxy servers where the Activity Monitor activity
agent will be deployed
:::info
@@ -47,7 +47,7 @@ devices. Instructions for each item of the checklist are detailed within the fol
- Important:
- Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE is
+ Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE is
installed
**Checklist Item 3: Dell PowerStore Device Configuration**
@@ -68,8 +68,8 @@ devices. Instructions for each item of the checklist are detailed within the fol
Checklist Item 5: Configure Dell CEE to Forward Events to the Activity Agent
:::note
-When Dell CEE is installed on Windows proxy server(s) where the Activity Monitor activity
-agent will be deployed, the following steps are not needed.
+When Dell CEE is installed on Windows proxy servers where the Activity Monitor activity
+agent will be deployed, the following steps aren't needed.
:::
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md
index e99c8b54a8..ffc2fc0037 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/qumulo-activity.md
@@ -7,8 +7,8 @@ sidebar_position: 120
# Qumulo Activity Auditing Configuration
The Netwrix Activity Monitor can be configured to monitor activity on Qumulo devices. To prepare
-Qumulo to be monitored, an account needs to be provisioned and the audit event format may need to be
-modified.
+Qumulo for monitoring, you need to provision an account and may need to modify the audit event
+format.
## Provision Account
@@ -32,26 +32,28 @@ advanced filtering of Microsoft Office activity also requires the JSON format.
The JSON format for audit events was introduced in Qumulo Core 6.0.1. The new format can be enabled
via an SSH session to the Qumulo cluster.
-Follow the steps to verify that audit event format and change the format, if needed.
-
**Step 1 –** Connect to the Qumulo cluster with SSH.
**Step 2 –** Execute the following command to log in:
```bash
qq --host login -u
+```
The command will ask for the password.
-__Step 3 –__ Execute the following command to check current format:
+**Step 3 –** Execute the following command to check current format:
-**qq audit_get_syslog_config**
-
-The format will be shown in the __format__ field. The old format is __csv__; the new format is __json__.
+```bash
+qq audit_get_syslog_config
+```
-__Step 4 –__ Execute the following command to change the format, if needed:
+The format will be shown in the `format` field. The old format is `csv`; the new format is `json`.
-**qq audit_set_syslog_config --json**
+**Step 4 –** Execute the following command to change the format, if needed:
-The change willshould be reflected in the __format__ field.
+```bash
+qq audit_set_syslog_config --json
```
+
+The change will be reflected in the `format` field.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md
index 34daed915e..e578d1b3ba 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Dell CEE
-Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software is not a Netwrix
+Dell CEE should be installed on a Windows or a Linux server. The Dell CEE software isn't a Netwrix
product. Dell customers have a support account with Dell to access the download.
:::tip
@@ -20,8 +20,6 @@ Monitor agent will be deployed (recommended) or on any other Windows or Linux se
:::
-Follow the steps to install the Dell CEE.
-
**Step 1 –** Obtain the latest CEE install package from Dell and any additional license required for
this component. It is recommended to use the most current version.
@@ -38,13 +36,12 @@ asynchronous bulk delivery (VCAPS) feature.
:::
-After Dell CEE installation is complete, it is necessary to complete the
+After Dell CEE installation is complete, complete the
[Unity Initial Setup with Unisphere](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md).
## Configure Dell Registry Key Settings
-There may be situations when Dell CEE needs to be installed on a different Windows server than the
-one where the Activity Monitor activity agent is deployed. In those cases it is necessary to
+If you install Dell CEE on a different Windows server than the Activity Monitor activity agent, you must
manually set the Dell CEE registry key to forward events.
**Step 1 –** Open the Registry Editor (run regedit).
@@ -55,12 +52,12 @@ manually set the Dell CEE registry key to forward events.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\CEPP\AUDIT\Configuration**
-**Step 3 –** Right-click on **Enabled** and select Modify. The Edit DWORD Value window opens.
+**Step 3 –** Right-click **Enabled** and select Modify. The Edit DWORD Value window opens.
**Step 4 –** In the Value data field, enter the value of 1. Click OK, and the Edit DWORD Value
window closes.
-**Step 5 –** Right-click on **EndPoint** and select Modify. The Edit String window opens.
+**Step 5 –** Right-click **EndPoint** and select Modify. The Edit String window opens.
**Step 6 –** In the Value data field, enter the StealthAUDIT value with the IP Address for the
Windows proxy server hosting the Activity Monitor activity agent. Use the following format:
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md
index 9845a39663..fbec5fdb37 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/setupunisphere.md
@@ -6,12 +6,9 @@ sidebar_position: 20
# Unity Initial Setup with Unisphere
-Follow the steps to configure the initial setup for a Unity device with Unisphere.
-
**Step 1 –** Edit the NAS Server > Protection and Events > Events Publishing > Select Pool settings:
-- Add CEPA server – This is the server where CEE is installed. It is recommended that this is also
- the server were the Activity Monitor activity agent is deployed.
+- Add CEPA (CEE Plugin Architecture) server – This is the server where you install CEE (Common Event Enabler). Recommend that this server also hosts the Activity Monitor activity agent.
- Enable the following events for Post Events.
Required Unity events needed for CIFS Activity:
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/unity-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/unity-activity.md
index 6792883a00..141cff277b 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/unity-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/unity-activity.md
@@ -11,8 +11,8 @@ All audit data can be forwarded to the Dell Common Event Enabler (CEE). The Netw
listens for all events coming through the Dell CEE and translates all relevant information into
entries in the TSV files or syslog messages.
-If the service is turned off, a notification will be sent to the Dell CEE framework to turn off the
-associated Activity Monitor filter, but the policy will not be removed.
+If you turn off the service, the system sends a notification to the Dell CEE framework to turn off the
+associated Activity Monitor filter, but the policy remains.
The Dell CEE Framework uses a "push" mechanism so a notification is sent only to the activity agent
when a transaction occurs. Daily activity log files are created only if activity is performed. No
@@ -20,14 +20,14 @@ activity log file is created if there is no activity for the day.
**Configuration Checklist**
-Complete the following checklist prior to configuring activity monitoring of Dell Unity devices.
+Complete the following checklist before configuring activity monitoring of Dell Unity devices.
Instructions for each item of the checklist are detailed within the following topics.
**Checklist Item 1: Plan Deployment**
-- Prior to beginning the deployment, gather the following:
+- Before beginning the deployment, gather the following:
- - Data Mover or Virtual Data Mover hosting the share(s) to be monitored
+ - Data Mover or Virtual Data Mover hosting the shares to be monitored
- Account with access to the CLI
- Download the Dell CEE from:
@@ -35,7 +35,7 @@ Instructions for each item of the checklist are detailed within the following to
**Checklist Item 2: [Install Dell CEE](/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/installcee.md)**
-- Dell CEE should be installed on the Windows proxy server(s) where the Activity Monitor activity
+- Dell CEE should be installed on the Windows proxy servers where the Activity Monitor activity
agent will be deployed
:::info
@@ -46,9 +46,9 @@ Instructions for each item of the checklist are detailed within the following to
- Important:
- - Open MS-RPC ports between the Dell device and the Windows proxy server(s) where the Dell CEE
+ - Open MS-RPC ports between the Dell device and the Windows proxy servers where the Dell CEE
is installed
- - Dell CEE 8.4.2 through Dell CEE 8.6.1 are not supported for use with the VCAPS feature
+ - Dell CEE 8.4.2 through Dell CEE 8.6.1 aren't supported for use with the VCAPS feature
- Dell CEE requires .NET Framework 3.5 to be installed on the Windows proxy server
**Checklist Item 3: Dell Unity Device Configuration**
@@ -69,8 +69,8 @@ Instructions for each item of the checklist are detailed within the following to
Checklist Item 5: Configure Dell CEE to Forward Events to the Activity Agent
:::note
-When Dell CEE is installed on Windows proxy server(s) where the Activity Monitor activity
-agent will be deployed, the following steps are not needed.
+When Dell CEE is installed on Windows proxy servers where the Activity Monitor activity
+agent will be deployed, the following steps aren't needed.
:::
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md
index a8f5f5176a..790071872f 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/nas-device-configuration/unity-aac/validate.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Validate Setup
-Once the Activity Monitor agent is configured to monitor the Dell device, the automated
+After the Activity Monitor agent is configured to monitor the Dell device, the automated
configuration must be validated to ensure events are being monitored.
## Validate CEE Registry Key Settings
@@ -20,11 +20,11 @@ topic for information on manually setting the registry key.
After the Activity Monitor activity agent has been configured to monitor the Dell device, it will
configure the Dell CEE automatically if it is installed on the same server as the agent. This needs
-to be set manually in the rare situations where it is necessary for the Dell CEE to be installed on
-a different server than the Windows proxy server(s) where the Activity Monitor activity agent is
+to be set manually in the rare situations where you need to install the Dell CEE on
+a different server than the Windows proxy servers where the Activity Monitor activity agent is
deployed.
-If the monitoring agent is not registering events, validate that the EndPoint is accurately set.
+If the monitoring agent isn't registering events, validate that the EndPoint is accurately set.
Open the Registry Editor (run regedit). For the synchronous real-time delivery mode (AUDIT), use the
following steps.
@@ -90,7 +90,7 @@ Dell CEE Services are Running topic for additional information.
## Validate Dell CEE Services are Running
After the Activity Monitor Activity Agent has been configured to monitor the Dell device, the Dell
-CEE services should be running. If the Activity Agent is not registering events and the EndPoint is
+CEE services should be running. If the Activity Agent isn't registering events and the EndPoint is
set accurately, validate that the Dell CEE services are running. Open the Services (run
`services.msc`).
@@ -120,19 +120,19 @@ and Disable monitoring.
**HKEY_LOCAL_MACHINE\SOFTWARE\EMC\CEE\Configuration**
-**Step 10 –** Right-click on **Debug** and select Modify. The Edit DWORD Value window opens. In the
+**Step 10 –** Right-click **Debug** and select Modify. The Edit DWORD Value window opens. In the
Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Debug DWORD Value does not exist, it needs to be added.
+If the Debug DWORD Value doesn't exist, it needs to be added.
:::
-**Step 11 –** Right-click on **Verbose** and select Modify. The Edit DWORD Value window opens. In
+**Step 11 –** Right-click **Verbose** and select Modify. The Edit DWORD Value window opens. In
the Value data field, enter the value of 3F. Click OK, and the Edit DWORD Value window closes.
:::note
-If the Verbose DWORD Value does not exist, it needs to be added.
+If the Verbose DWORD Value doesn't exist, it needs to be added.
:::
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/sharepoint-online-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/sharepoint-online-activity.md
index 655a7680c6..abbeff4429 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/sharepoint-online-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/sharepoint-online-activity.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# SharePoint Online Activity Auditing Configuration
-In order to collect logs and monitor SharePoint Online activity using the Netwrix Activity Monitor,
+to collect logs and monitor SharePoint Online activity using the Netwrix Activity Monitor,
it needs to be registered with Microsoft® Entra ID® (formerly Azure AD).
:::note
@@ -25,15 +25,14 @@ See the Enable Auditing for SharePoint Online topic for additional information.
**Configuration Settings from the Registered Application**
-The following settings are needed from your tenant once you have registered the application:
+The following settings are needed from your tenant after you have registered the application:
- Tenant ID – This is the Tenant ID for Microsoft Entra ID
- Client ID – This is the Application (client) ID for the registered application
- Client Secret – This is the Client Secret Value generated when a new secret is created
:::warning
- It is not possible to retrieve the value after saving the new key. It must be
- copied first.
+ You can't retrieve the value after saving the new key. Copy it first.
:::
@@ -54,8 +53,6 @@ The following settings are needed from your tenant once you have registered the
## Register a Microsoft Entra ID Application
-Follow the steps to register Activity Monitor with Microsoft Entra ID.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -87,8 +84,6 @@ application. Now that the application has been registered, permissions need to b
## Grant Permissions to the Registered Application
-Follow the steps to grant permissions to the registered application.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -135,8 +130,6 @@ be collected.
## Identify the Client ID
-Follow the steps to find the registered application's Client ID.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -173,8 +166,6 @@ application’s Client Secret Key.
**Overview Page**
-Follow the steps to find the tenant name where the registered application resides.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -193,9 +184,6 @@ application’s Client Secret Key.
## Generate the Client Secret Key
-Follow the steps to find the registered application's Client Secret, create a new key, and save its
-value when saving the new key.
-
:::note
The steps below are for registering an app through the Microsoft Entra admin center. These
steps may vary slightly if you use a different Microsoft portal. See the relevant Microsoft
@@ -204,8 +192,7 @@ documentation for additional information.
:::warning
-It is not possible to retrieve the value after saving the new key. It must be copied
-first.
+You can't retrieve the value after saving the new key. Copy it first.
:::
@@ -231,7 +218,7 @@ list.
**Step 5 –** Click **Add** to generate the key.
:::warning
-If this page is left before the key is copied, then the key is not retrievable, and
+If this page is left before the key is copied, then the key isn't retrievable, and
this process will have to be repeated.
:::
@@ -245,15 +232,12 @@ This is needed for adding a SharePoint Online host in the Activity Monitor.
## Enable Auditing for SharePoint Online
-Follow the steps to enable auditing for SharePoint Online so the Activity Monitor can receive
-events.
-
**Step 1 –** In the Microsoft Purview compliance portal at
[https://compliance.microsoft.com](https://compliance.microsoft.com/), go to **Solutions** >
**Audit**. Or, to go directly to the Audit page at
[https://compliance.microsoft.com/auditlogsearch](https://compliance.microsoft.com/auditlogsearch).
-**Step 2 –** If auditing is not turned on for your organization, a banner is displayed prompting you
+**Step 2 –** If auditing isn't turned on for your organization, a banner is displayed prompting you
start recording user and admin activity.
**Step 3 –** Select the **Start recording** user and **admin activity** banner.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/sharepoint-onprem-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/sharepoint-onprem-activity.md
index fecb0fa571..ca52dfbe71 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/sharepoint-onprem-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/sharepoint-onprem-activity.md
@@ -44,7 +44,7 @@ select the events to be audited.
**Step 6 –** Click OK to save the changes.
-SharePoint will create the audit logs to be monitored by the Netwrix Activity Monitor and/or audited
+SharePoint creates the audit logs for the Netwrix Activity Monitor to monitor by the Netwrix Activity Monitor and/or audited
by Access Analyzer. See the Microsoft
[Configure audit settings for a site collection (SharePoint 2013/2016/2019)](https://support.office.com/en-us/article/Configure-audit-settings-for-a-site-collection-a9920c97-38c0-44f2-8bcb-4cf1e2ae22d2)
article for additional information.
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/sqlserver-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/sqlserver-activity.md
index f735298b95..358736f810 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/sqlserver-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/sqlserver-activity.md
@@ -6,8 +6,8 @@ sidebar_position: 70
# SQL Server Activity Auditing Configuration
-In order for the Netwrix Activity Monitor to monitor SQL Server activity, a SQL login with certain
-server permissions, and must be mapped to user databases.
+For the Netwrix Activity Monitor to monitor SQL Server activity, a SQL login with certain
+server permissions and map it to user databases.
## SQL Database Server Permissions
@@ -70,7 +70,7 @@ declare @s varchar(max)='';select @s=@s+(case when @s<>'' then char(13)+char(10)
## Logon Trigger (Optional)
The logon trigger is required to obtain IP Addresses of client connections. Run the following script
-in order to allow the Activity Monitor to report client IP Addresses.
+to allow the Activity Monitor to report client IP Addresses.
```
CREATE TRIGGER SBAudit_LOGON_Trigger ON ALL SERVER FOR LOGON AS BEGIN declare @str varchar(max)=cast(EVENTDATA() as varchar(max));raiserror(@str,1,1);END
diff --git a/docs/activitymonitor/9.0/requirements/activityagent/windowsfs-activity.md b/docs/activitymonitor/9.0/requirements/activityagent/windowsfs-activity.md
index eb33a09a0b..11bdf6c780 100644
--- a/docs/activitymonitor/9.0/requirements/activityagent/windowsfs-activity.md
+++ b/docs/activitymonitor/9.0/requirements/activityagent/windowsfs-activity.md
@@ -6,11 +6,11 @@ sidebar_position: 80
# Windows File Server Activity Auditing Configuration
-In order for the Netwrix Activity Monitor to monitor Windows file server activity, an Activity Agent must be deployed to the server. It cannot be deployed to a proxy server. However, additional considerations are needed when targeting a Windows File System Clusters.
+In order for the Netwrix Activity Monitor to monitor Windows file server activity, you must deploy an Activity Agent to the server, not to a proxy server. However, additional considerations apply when targeting a Windows File System Cluster.
## Windows File System Clusters
-In order to monitor a Windows File System Cluster, an Activity Agent needs to be deployed on all nodes that comprise the Windows File System Cluster. The credential used to deploy the Activity Agent must have the following permissions on the server:
+to monitor a Windows File System Cluster, an Activity Agent needs to be deployed on all nodes that comprise the Windows File System Cluster. The credential used to deploy the Activity Agent must have the following permissions on the server:
- Membership in the local Administrators group
- READ and WRITE access to the archive location for Archiving feature only
diff --git a/docs/activitymonitor/9.0/requirements/adagent/activity/activity.md b/docs/activitymonitor/9.0/requirements/adagent/activity/activity.md
index c3b3af7300..f6abee5e3c 100644
--- a/docs/activitymonitor/9.0/requirements/adagent/activity/activity.md
+++ b/docs/activitymonitor/9.0/requirements/adagent/activity/activity.md
@@ -30,8 +30,7 @@ In this method, you will be deploying two agents:
- Next, deploy the AD Agent to all domain controllers in the target domain.
-Follow the steps to setup integration between Activity Monitor and Access Analyzer through an API
-server.
+## Set Up Integration Through API Server
**Step 1 –** Deploy the Activity Agent to the API server.
@@ -41,8 +40,6 @@ The next step is to configure the agent deployed to the API server.
## Configure API Server Agent
-Follow the steps to configure the agent deployed to the API server.
-
**Step 1 –** On the Agents tab of the Activity Monitor Console, select the agent deployed to the
API server.
@@ -63,7 +60,7 @@ API server.
- Click **Copy** and save the Client Secret value to a text file.
:::warning
- It is not possible to retrieve the value after closing the Add or edit
+ It isn't possible to retrieve the value after closing the Add or edit
API client window. It must be copied first.
:::
@@ -73,9 +70,9 @@ API server.
if desired.
- Click **OK** to save the configuration and close the Add or edit API client window.
-- If the Activity Monitor Console server is not the API Server, then click **Use this console** to
+- If the Activity Monitor Console server isn't the API Server, then click **Use this console** to
grant the Activity Monitor the ability to manage the API server.
-- The IPv4 or IPv6 allowlist allows you to limit access to the API server data to specific hosts.
+- Use the IPv4 or IPv6 allowlist to limit access to the API server data to specific hosts.
**Step 4 –** Click **OK** to save the configuration and close the Agent properties window.
@@ -83,8 +80,6 @@ The next step is to configure the agents deployed to the domain controllers.
## Configure Domain Controller Agent
-Follow the steps to configure the agent deployed to the domain controller.
-
**Step 1 –** On the Agents tab of the Activity Monitor Console, select an agent deployed to domain
controller.
@@ -94,9 +89,9 @@ controller.
- Select the **Enable Archiving for this agent** checkbox.
- Select the **Archive log files on a UNC path** option. Click the **...** button and navigate to
- the desired network share on the API server.
+ the network share you want on the API server.
- The **User name** and **User password** fields only need to be filled in if the account used to
- install the agent does not have access to this share.
+ install the agent doesn't have access to this share.
:::tip
Remember, The account used to install the agent on a domain controller is a Domain
@@ -110,19 +105,17 @@ controller.
**Step 5 –** Repeat Steps 1-4 for each agent deployed to domain controller.
-These agent are configured to save the Archive logs to the selected share.
+These agents now save the Archive logs to the selected share.
## Configure Monitored Domain Output
-Follow the steps configure the monitored domain output for Netwrix Access Analyzer.
-
**Step 1 –** Select the **Monitored Domains** tab.
-**Step 2 –** Select the desired domain and click **Add Output**. The Add New Ouptut window opens.
+**Step 2 –** Select the domain you want and click **Add Output**. The Add New Ouptut window opens.
**Step 3 –** Configure the following:
-- Configure the desired number of days for the **Period to keep Log files**. This is the number of
+- Configure the number of days you want for the **Period to keep Log files**. This is the number of
days the log files are kept on the API server configured in the sections above. This needs to be
set to a greater value than the days between Access Analyzer scans.
@@ -141,8 +134,6 @@ Access Analyzer now has access to the agent log files for this domain.
## Configure Connection Profile
-Follow the steps to configure the Connection Profile in Access Analyzer.
-
:::tip
Remember, the Client ID and Client Secret were generated by the API server and copied to a text
file. If the secret expired before the Connection Profile is configured, it will need to be
@@ -171,7 +162,7 @@ name.
Group. Select the **Settings > Connection** node.
**Step 7 –** Select the **Select one of the following user defined profiles** option. Expand the
-drop-down menu and select the Connection Profile with this credential.
+dropdown menu and select the Connection Profile with this credential.
**Step 8 –** Click **Save** and then **OK** to confirm the changes to the job group settings.
@@ -179,9 +170,7 @@ The Connection Profile will now be used for AD Activity collection.
## Configure the AD_ActivityCollection Job
-The Access Analyzer requires additional configurations in order to collect domain activity data.
-Follow the steps to configure the **AD_ActivityCollection** Job.
-
+The Access Analyzer requires additional configurations to collect domain activity data.
:::note
Ensure that the **.Active Directory Inventory** Job Group has been successfully run
against the target domain.
@@ -251,20 +240,18 @@ logs.
### (Optional) Configure Import of AD Activity into Netwrix Access Information Center
AD Activity data can be imported into Netwrix Access Information Center by the
-**AD_ActivityCollection** Job. However, this is disabled by default. Follow the steps to enable the
-importing of AD activity data into the Access Information Center.
**Step 1 –** Navigate to the **Jobs** > **Active Directory** > **6.Activity** > **0.Collection** >
**AD_ActivityCollection** Job.
**Step 2 –** On the job's Overview page, enable the import of AD Events.
-- Click on the **Enable to import AD events into the AIC** parameter.
+- Click the **Enable to import AD events into the AIC** parameter.
- On the Parameter Configuration window, select the **Enabled** checkbox and click **Save**.
**Step 3 –** On the job's Overview page, enable the import of authentication Events.
-- Click on the **Enable to import authentication events into the AIC** parameter.
+- Click the **Enable to import authentication events into the AIC** parameter.
- On the Parameter Configuration window, select the **Enabled** checkbox and click **Save**.
**Step 4 –** Optionally, modify the **List of attributes to track for Object Modified changes** and
diff --git a/docs/activitymonitor/9.0/requirements/adagent/activity/filearchive.md b/docs/activitymonitor/9.0/requirements/adagent/activity/filearchive.md
index 235cdfabfc..c5232087e6 100644
--- a/docs/activitymonitor/9.0/requirements/adagent/activity/filearchive.md
+++ b/docs/activitymonitor/9.0/requirements/adagent/activity/filearchive.md
@@ -16,7 +16,7 @@ Deploy the AD Agent to each domain controller in the target domain.
## Configure Domain Controller Agent
-Follow the steps to configure the agent deployed to the domain controller.
+To configure the agent deployed to the domain controller, complete the following steps:
:::note
These steps assume the network share where the activity log files will be archived already
@@ -35,7 +35,7 @@ controller.
- Select the **Archive log files on a UNC path** option. Click the ... button and navigate to the
desired network share.
- The **User name** and **User password** fields only need to be filled in if the account used to
- install the agent does not have access to this share.
+ install the agent doesn't have access to this share.
:::tip
Remember, The account used to install the agent on a domain controller is a Domain
@@ -52,7 +52,7 @@ controller.
**Step 5 –** Repeat Steps 1-4 for each agent deployed to domain controller pointing to the same
network share in Step 3 for each agent.
-These agent are configured to save the Archive logs to the selected share.
+These agents now save the Archive logs to the selected share.
## Configure Monitored Domain Output
@@ -60,11 +60,11 @@ Follow the steps configure the monitored domain output for Netwrix Access Analyz
**Step 1 –** Select the **Monitored Domains** tab.
-**Step 2 –** Select the desired domain and click **Add Output**. The Add New Ouptut window opens.
+**Step 2 –** Select the domain you want and click **Add Output**. The Add New Ouptut window opens.
**Step 3 –** Configure the following:
-- Configure the desired number of days for the **Period to keep Log files**. This is the number of
+- Configure the number of days you want for the **Period to keep Log files**. This is the number of
days the log files are kept on the API server configured in the sections above. This needs to be
set to a greater value than the days between Access Analyzer scans.
@@ -83,7 +83,7 @@ Access Analyzer now has access to the agent log files for this domain.
## Configure Connection Profile
-Follow the steps to configure the Connection Profile in Access Analyzer.
+To configure the Connection Profile in Access Analyzer, complete the following steps:
**Step 1 –** On the Settings > Connection node of the Access Analyzer Console, select the Connection
Profile for the Active Directory solution. If you haven't yet created a Connection Profile or desire
@@ -110,7 +110,7 @@ a specific one for AD Activity, create a new one and provide a unique descriptiv
the **Settings > Connection** node.
**Step 7 –** Select the **Select one of the following user defined profiles** option. Expand the
-drop-down menu and select the Connection Profile with this credential.
+dropdown menu and select the Connection Profile with this credential.
**Step 8 –** Click **Save** and then **OK** to confirm the changes to the job group settings.
@@ -118,7 +118,7 @@ The Connection Profile will now be used for AD Activity collection.
## Configure the AD_ActivityCollection Job
-Access Analyzer requires additional configurations in order to collect domain activity data. Follow
+Access Analyzer requires additional configurations to collect domain activity data. Follow
the steps to configure the **AD_ActivityCollection** Job.
:::note
diff --git a/docs/activitymonitor/9.0/requirements/adagent/adagent.md b/docs/activitymonitor/9.0/requirements/adagent/adagent.md
index c1d32aa6f2..6a4f284892 100644
--- a/docs/activitymonitor/9.0/requirements/adagent/adagent.md
+++ b/docs/activitymonitor/9.0/requirements/adagent/adagent.md
@@ -37,7 +37,7 @@ versatile, security-enhanced option.
## Requirements
-The AD Agent is deployed to every domain controllers to monitor Active Directory domains. The server
+Deploy the AD Agent to every domain controller to monitor Active Directory domains. The server
can be physical or virtual. The supported operating systems are:
- Windows Server 2022
@@ -57,7 +57,7 @@ These depend on the amount of activity expected:
The disk space requirement covers the following:
- Agent Size – 150 MB
-- Agent Queues – In the event of a network outage, the agent will cache up to 40 GB of event data
+- Agent Queues – If a network outage occurs, the agent will cache up to 40 GB of event data
- Diagnostic Logging – 1 GB
Old files are zipped, typical compression ratio is 20. Optionally, old files are moved from the
@@ -82,7 +82,7 @@ The following permission is required to install and manage the agent:
## Supported Active Directory Platforms
-The Activity Monitor provides the ability to monitor Active Directory:
+The Activity Monitor lets you monitor Active Directory:
:::note
For monitoring an Active Directory domain, the AD Agent must be installed on all domain
@@ -102,7 +102,7 @@ topic for target environment requirements.
The following products conflict with the agent:
:::warning
-Do not install these products on a server where an agent is deployed. Do NOT install an
+Don't install these products on a server where an agent is deployed. Don't install an
agent on a server where these products are installed.
:::
diff --git a/docs/activitymonitor/9.0/requirements/adagent/threatprevention.md b/docs/activitymonitor/9.0/requirements/adagent/threatprevention.md
index 9cc890344e..4db6401b7d 100644
--- a/docs/activitymonitor/9.0/requirements/adagent/threatprevention.md
+++ b/docs/activitymonitor/9.0/requirements/adagent/threatprevention.md
@@ -13,13 +13,13 @@ Netwrix Activity Monitor, which in turn creates the activity log files that Acce
collects.
:::note
-Threat Prevention can only be configured to send event data to one Netwrix application,
+You can configure Threat Prevention to send event data to only one Netwrix application,
either Netwrix Activity Monitor or Netwrix Threat Manager but not both. However, the Activity
Monitor can be configured with outputs for Access Analyzer and Threat Manager
:::
-Follow these steps to configure this integration.
+Configure this integration.
:::info
It is a best practice to use the API Server option of the Activity Monitor for
@@ -42,7 +42,7 @@ Threat Manager Configuration** on the menu. The Netwrix Threat Manager Configura
- App Token – Leave this field blank for integration with Activity Monitor
- Policies – The table displays all policies created in Threat Prevention along with a State icon
- indicating if the policy is active. Check the **Send** box for the desired policies monitoring the
+ indicating if the policy is active. Check the **Send** box for the policies you want monitoring the
target domain activity.
**Step 3 –** Click **Save**.
diff --git a/docs/activitymonitor/9.0/requirements/linuxagent.md b/docs/activitymonitor/9.0/requirements/linuxagent.md
index 8d6575c593..af4407fc2a 100644
--- a/docs/activitymonitor/9.0/requirements/linuxagent.md
+++ b/docs/activitymonitor/9.0/requirements/linuxagent.md
@@ -19,8 +19,8 @@ are:
## Target Requirements
:::note
-For monitoring a Linux file server, the The Linux Agent is deployed to Linux servers to be
-monitored. It cannot be deployed to a proxy server.
+For monitoring a Linux file server, deploy the Linux Agent to the Linux servers you want to
+monitor, not to a proxy server.
:::
@@ -33,7 +33,7 @@ The following protocols are supported for the Linux agent:
- Network File System (Mounted Client-Side)
:::note
-Server-Side NFS protocol is not supported.
+Server-Side NFS protocol isn't supported.
:::
@@ -48,7 +48,7 @@ Analyzer to read the activity log files must have also have this permission.
:::info
Activity Monitor Agent uses certificates to secure the connection between the Linux Agent and the Console / API Server.
-By default, the Agent uses an automatically generated self-signed certificate. The Console and the API Server do not enforce
+By default, the Agent uses an automatically generated self-signed certificate. The Console and the API Server don't enforce
validity checks on these self-signed agent certificates.
This self-signed certificate can be replaced with one issued by a Certification Authority. Once replaced, the Console and
diff --git a/docs/activitymonitor/9.0/requirements/overview.md b/docs/activitymonitor/9.0/requirements/overview.md
index 205e2700d9..e72bbb3242 100644
--- a/docs/activitymonitor/9.0/requirements/overview.md
+++ b/docs/activitymonitor/9.0/requirements/overview.md
@@ -8,7 +8,7 @@ sidebar_position: 20
This topic describes the recommended configuration of the servers needed to install the application
in a production environment. Depending on the size of the organization, it is recommended to review
-your environment and requirements with a Netwrix engineer prior to deployment to ensure all
+your environment and requirements with a Netwrix engineer before deployment to ensure all
exceptions are covered.
## Architecture Overview
@@ -26,7 +26,7 @@ The following servers are required for installation of the application:
:::
-- **Agents** – There are three deployment scenarios that that differ in their requirements:
+- **Agents** – There are three deployment scenarios that differ in their requirements:
- Activity monitoring of Windows file servers, Network Attached Storage (NAS) devices, Azure Files, Microsoft Entra ID, SharePoint On-premise,
SharePoint Online, Exchange Online, and SQL Server. The agent is deployed on a Windows Server.
@@ -44,7 +44,7 @@ Activity Monitor. Most solutions have additional target requirements.
## Activity Monitor Console Machine Requirements
-The machine can be a Windows Server or desktop, as well as physical or virtual. The Console can be installed on serveral machines to manage the same agents.
+The machine can be a Windows Server or desktop, as well as physical or virtual. You can install the Console on multiple machines to manage the same agents.
The following Windows Server operating systems are supported:
- Windows Server 2025
diff --git a/docs/activitymonitor/9.0/restapi/resources/agent.md b/docs/activitymonitor/9.0/restapi/resources/agent.md
index 30ef470331..988a11ffed 100644
--- a/docs/activitymonitor/9.0/restapi/resources/agent.md
+++ b/docs/activitymonitor/9.0/restapi/resources/agent.md
@@ -16,8 +16,8 @@ sidebar_position: 10
| authenticationMethod | string | | The authentication method for connecting to the agent: Password, PublicKey |
| agentPort | int | | The port that is used by the agent. Default: 4498. |
| userName | string | | Account for connecting to the agent. |
-| password | string | X | Account password for connecting to the agent. Password is not exposed. |
-| privateKey | string | | The private key used when PublicKey authentication method is used. The private key is not exposed. |
+| password | string | X | Account password for connecting to the agent. Password isn't exposed. |
+| privateKey | string | | The private key used when PublicKey authentication method is used. The private key isn't exposed. |
| clientCertificate | string | | The agent's client certificate. |
| protocol | string | | The protocol used for connecting to the agent: GRPC |
| domain | string | | Domain name of the agent |
@@ -43,13 +43,13 @@ sidebar_position: 10
| archive.IsEnabled | bool | X | Whether the archiving feature is enabled |
| archive.path | string | X | UNC path of the archival location |
| archive.userName | string | X | An account to access the archival location. |
-| archive.password | string | X | User password to access the archival location. Password is not exposed. |
+| archive.password | string | X | User password to access the archival location. Password isn't exposed. |
| archive.maxLocalSize | string | X | Maximum space the agent is allowed to use on the local drives. |
| fpolicy.port | int | X | NetApp c-mode fpolicy port |
| fpolicy.auth | string | X | `NoAuth`, `Server`, `Mutual` |
| fpolicy.ipWhitelist | string[] | X | IP whitelist |
-| fpolicy.clientCertificate | string | X | The Client or CA certificate that is currently set. |
-| fpolicy.serverCertificate | string | X | The FPolicy Server certificate that is currently set. Server Certificate is not exposed. |
+| fpolicy.clientCertificate | string | X | The Client or CA certificate that is set. |
+| fpolicy.serverCertificate | string | X | The FPolicy Server certificate that is set. Server Certificate isn't exposed. |
| minLocalFreeSpace | string | X | Free disk threshold after which the agent stops writing data to the log files |
| cee.vcapsIsEnabled | bool | X | CEE Asynchronous bulk delivery (VCAPS) is enabled or disabled. |
| cee.vcapsInterval | int | X | Interval in seconds on how often events are delivered by CEE. |
@@ -68,7 +68,7 @@ sidebar_position: 10
| inactivityAlerts.email.server | string | X | The email SMTP server that is sent inactivity alerts. |
| inactivityAlerts.email.ssl | bool | X | Email SMTP Server SSL / TLS is enabled or disabled. |
| inactivityAlerts.email.userName | string | X | Email SMTP Server Username. |
-| inactivityAlerts.email.password | string | X | Email SMTP Server Password. Password is not exposed. |
+| inactivityAlerts.email.password | string | X | Email SMTP Server Password. Password isn't exposed. |
| inactivityAlerts.email.from | string | X | Email address of where the inactivity alert is from. |
| inactivityAlerts.email.to | string | X | Email address of where the inactivity alert is sent to. |
| inactivityAlerts.email.subject | string | X | Email message subject of the inactivity alert. |
@@ -76,7 +76,7 @@ sidebar_position: 10
| apiServerIsEnabled | bool | | API Server is enabled or disabled |
| apiServerPort | int | | API Server TCP/IP port |
| apiServerIpWhitelist | string[] | X | Whitelist of IPs allowed to connect to the API Server port. |
-| apiServerMgmtConsole | string | X | NETBIOS name of the Console machine that manages the agent list of the API Server (only available for agent(s) that are running the api server) |
+| apiServerMgmtConsole | string | X | NETBIOS name of the Console machine that manages the agent list of the API Server (only available for agents that are running the api server) |
| traceLevel | string | X | The logging trace level of the agent. |
| externalNicName | string | X | The selected network interface that is used for connections. If blank, the agent will auto-detect the network interface to use. |
| comment | string | | The agent's set comment. |
@@ -86,8 +86,8 @@ sidebar_position: 10
| networkProxy.useDefaultCredentials | bool | X | If enabled the proxy server authenticates as the agent's machine account. |
| networkProxy.bypassProxyOnLocal | bool | X | If enabled the agent will bypass the proxy server for local addresses. |
| networkProxy.userName | string | X | The Proxy Server Username |
-| networkProxy.password | string | X | The Proxy Server Password. Password is not exposed. |
-| networkProxy.bypassList | string[] | X | List of regular expressions that describe URIs that do not use the proxy server when accessed. |
+| networkProxy.password | string | X | The Proxy Server Password. Password isn't exposed. |
+| networkProxy.bypassList | string[] | X | List of regular expressions that describe URIs that don't use the proxy server when accessed. |
| dns.isEnabled | bool | X | Local DNS caching service is enabled or disabled. |
| dns.listenPort | int | X | Port used by the DNS caching service. |
| dns.parallelism | int | X | Parallelism level to use while processing DNS requests. |
@@ -100,7 +100,7 @@ sidebar_position: 10
| dns.clientWaitTimeout | TimeSpan | X | The amount of the DNS service is allowed to process a request before sending a not found response. If no results are received the lookup operation continues in the background. |
| dns.refreshThreshold | TimeSpan | X | An interval between expired items in the cache check. |
| dns.maxCacheSize | int | X | The max size of the dns service buffer file. |
-| dns.uselessAge | TimeSpan | X | The DNS service does not resolve names for events older then the set time period. |
+| dns.uselessAge | TimeSpan | X | The DNS service doesn't resolve names for events older then the set time period. |
| dns.maxAttemptsToResolve | int | X | Maximum attempts that the DNS service will use to resolve addresses. If 0 is set, the DNS service will resolve addresses infinitely. |
| dns.suffix | string | X | The DNS suffix identifies the domain name that is appended to an unqualified host name to obtain a fully qualified domain name (FQDN) suitable for a dns name query. |
| adUsers.domainControllers | string[] | X | List of Domain Controllers to be used for user lookups. If blank, the default behavior is used. |
@@ -111,7 +111,7 @@ sidebar_position: 10
| panzura.port | int | X | Agent port used for Panzura. |
| panzura.useCredentials | bool | X | Protection of Panzura port is enabled or disabled. |
| panzura.username | string | X | Panzura's MQ username used for port protection. |
-| panzura.password | string | X | Panzura's MQ password used for port protection. Password is not exposed. |
+| panzura.password | string | X | Panzura's MQ password used for port protection. Password isn't exposed. |
| panzura.ipWhitelist | string[] | X | Whitelist of IP addresses of Panzura nodes that are allowed to connect to the Agent's Panzura port. If blank, connections from any host are accepted. |
| nutanix.port | int | X | Agent port used for Nutanix. |
| nutanix.ipWhitelist | string[] | X | Whitelist of IP addresses of Nutanix nodes that are allowed to connect to the Agent's Nutanix port. If blank, connections from any host are accepted. |
diff --git a/docs/activitymonitor/9.0/restapi/resources/host.md b/docs/activitymonitor/9.0/restapi/resources/host.md
index 55a187f7e5..6a990827ba 100644
--- a/docs/activitymonitor/9.0/restapi/resources/host.md
+++ b/docs/activitymonitor/9.0/restapi/resources/host.md
@@ -13,7 +13,7 @@ sidebar_position: 30
| host | string | | Host name/Address as specified by a user |
| type | string | | `Windows`,`NetApp`,`Celerra`,`Isilon`,`Hitachi`,`SharePoint`,`Unity`,`Nasuni`, `Panzura`, `SharePointOnline`, `AzureAD`, `Linux`, `SqlServer` |
| userName | string | | An account to connect the host to |
-| password | string | X | Account password to connect the host to. Password is not exposed. |
+| password | string | X | Account password to connect the host to. Password isn't exposed. |
| autoConfigureAuditing | bool | | Automatically enable the auditing on the device, if supported |
| monitorAuditingStatus | bool | | Constantly verify that the auditing is enabled, fix if needed |
| hostAliases | string[] | | List of server names for NAS if they are different from the set name of the host. |
@@ -30,7 +30,7 @@ sidebar_position: 30
| inactivityAlerts.email.server | string | | The email or SMTP server or IP that is used to send host inactivity alerts. |
| inactivityAlerts.email.ssl | bool | | Email SMTP Server SSL / TLS is enabled or disabled. |
| inactivityAlerts.email.userName | string | | The email or SMTP server user name. |
-| inactivityAlerts.email.password | string | X | The email or SMTP server password. Password is not exposed. |
+| inactivityAlerts.email.password | string | X | The email or SMTP server password. Password isn't exposed. |
| inactivityAlerts.email.from | string | | Email address of where the inactivity alert is from. |
| inactivityAlerts.email.to | string | | Email address of where the inactivity alert is sent to. |
| inactivityAlerts.email.subject | string | | Email message subject of the inactivity alert. |
@@ -68,21 +68,21 @@ sidebar_position: 30
| spo.azure.tenantId | string | | The azure Tenant ID |
| spo.azure.tenantName | string | | The azure Tenant Name |
| spo.azure.clientId | string | | The azure Tenant Client ID. |
-| spo.azure.clientSecret | string | X | The azure Client Secret. Client Secret is not exposed. |
+| spo.azure.clientSecret | string | X | The azure Client Secret. Client Secret isn't exposed. |
| spo.azure.region | string | | The azure Region. |
| azureAd.azure.domain | string | | The Azure Active Directory domain being monitored. |
| azureAd.azure.azureCloud | string | | The selected Azure Cloud being used: "Azure", "Azure for US Government GCC", "Azure for Government GCC High", "Azure for US Government DoD", "Azure Germany", "Azure China by 21Vianet" |
| azureAd.azure.tenantId | string | | The azure Tenant ID |
| azureAd.azure.tenantName | string | | The azure Tenant Name |
| azureAd.azure.clientId | string | | The azure Tenant Client ID. |
-| azureAd.azure.clientSecret | string | X | The azure Client Secret. Client Secret is not exposed. |
+| azureAd.azure.clientSecret | string | X | The azure Client Secret. Client Secret isn't exposed. |
| azureAd.azure.region | string | | The azure Region. |
| exchangeOnline.azure.domain | string | | The Azure Active Directory domain being monitored for Exchange Online. |
| exchangeOnline.azure.azureCloud | string | | The selected Azure Cloud being used: "Azure", "Azure for US Government GCC", "Azure for Government GCC High", "Azure for US Government DoD", "Azure Germany", "Azure China by 21Vianet" |
| exchangeOnline.azure.tenantId | string | | The azure Tenant ID |
| exchangeOnline.azure.tenantName | string | | The azure Tenant Name |
| exchangeOnline.azure.clientId | string | | The azure Tenant Client ID. |
-| exchangeOnline.azure.clientSecret | string | X | The azure Client Secret. Client Secret is not exposed. |
+| exchangeOnline.azure.clientSecret | string | X | The azure Client Secret. Client Secret isn't exposed. |
| exchangeOnline.azure.region | string | | The azure Region. |
| sql.pollingInterval | string | | The interval for polling SQL log for new events. |
| sql.tweakOptions | string[] | | Extended Events tweaking options for SQL hosts. |
diff --git a/docs/activitymonitor/9.0/restapi/resources/output.md b/docs/activitymonitor/9.0/restapi/resources/output.md
index 5d881c9d1b..8d2745c82b 100644
--- a/docs/activitymonitor/9.0/restapi/resources/output.md
+++ b/docs/activitymonitor/9.0/restapi/resources/output.md
@@ -16,7 +16,7 @@ sidebar_position: 40
| domainId | string | | AD only: ID of the owning domain |
| domainUrl | string | | AD only: Link to the owning domain |
| logsUrl | string | | Link to the file output log files (for the local agent only, that has the API Server running) |
-| isEnabled | bool | | Whether or not the output is enabled. If disabled, no activity is forwarded to it. |
+| isEnabled | bool | | Whether the output is enabled. If disabled, no activity is forwarded to it. |
| type | string | | `LogFile`,`Syslog`,`Amqp` |
| logFile | FileOutput | | Log file settings |
| syslog | SyslogOutput | | Syslog settings |
@@ -64,7 +64,7 @@ sidebar_position: 40
| separator | string | | `Lf`,Cr, `CrLf`, `Nul`, `Rfc5425` |
| reportUncPath | bool | | Report UNC paths in addition to local/native paths |
| addCToPath | bool | | Prepend the path `C:\` and change the forward slashes to backslashes. |
-| template | string | | Text of the syslog template that is currently set to be used. |
+| template | string | | Text of the syslog template that is set to be used. |
## AmqpOutput
@@ -72,13 +72,13 @@ sidebar_position: 40
| --------- | ------ | ------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| server | string | | Hostname/address of the AMQP server or the Threat Manager server and the port in the SERVER:PORT format |
| userName | string | | User name for the AMQP connection, if needed. ForThreat Managerintegration, use an empty string. |
-| password | string | | Password / App Token for the AMQP connection. Password / App Token is not exposed. |
+| password | string | | Password / App Token for the AMQP connection. Password / App Token isn't exposed. |
| queue | string | | Message queue name to post events to. ForThreat Manager integration, use an empty string. |
| exchange | string | | Exchange name to post events to. For Threat Manager integration, use "StealthINTERCEPT" for domain outputs or "AM" for host outputs. |
| vhost | string | | Virtual Host name, if needed. ForThreat Managerintegration, use an empty string. |
| caCertificate| string | | Certificate Autority certificate to validate the TLS connection. |
| protocol | string | | `TCP` (default) or `TLS`. |
-| hostNameVerification | bool | | Whether or not verify the hostname during the TLS handshake. |
+| hostNameVerification | bool | | Whether verify the hostname during the TLS handshake. |
## FileFilter
@@ -333,8 +333,8 @@ sidebar_position: 40
| isArchived | bool | | Determines whether the file is on a local drive of the agent or moved to the archival location. |
| type | string | | `Tsv`, `Json` |
| updatedAt | DateTime | | Last time the file was updated |
-| activityFrom | DateTime | | Activity events in the file are not younger than the date. |
-| activityTo | DateTime | | Activity events in the file are not older than the date. |
+| activityFrom | DateTime | | Activity events in the file aren't younger than the date. |
+| activityTo | DateTime | | Activity events in the file aren't older than the date. |
| outputId | string | | ID of the output that produced the file. |
| contentUrl | string | | Link to the file content. MIME type `application/x-msdownload` |
diff --git a/docs/activitymonitor/9.0/restapi/resources/resources.md b/docs/activitymonitor/9.0/restapi/resources/resources.md
index 8234d03ee4..485bbf66d9 100644
--- a/docs/activitymonitor/9.0/restapi/resources/resources.md
+++ b/docs/activitymonitor/9.0/restapi/resources/resources.md
@@ -8,7 +8,7 @@ sidebar_position: 20
The 9.0 API model consists of the following resources:
-- Agent – Represents an Activity Monitor Agent. API allows you to view existing agents and their
+- Agent – Represents an Activity Monitor Agent. With the API, you can view existing agents and their
status, register, modify, or remove agents. You can list all the agents or the agents of a domain
(AD-monitoring agents on the domain controllers).
Children: Host, Domain
@@ -16,8 +16,8 @@ The 9.0 API model consists of the following resources:
- Host – Represents a host or service monitored by the product (Windows, NetApp, SharePoint, SQL
Server, etc.). It is a Monitored Host/Service in the Console. You can list all the hosts of the agent, or
- just all the hosts. The API Provides access to the settings of the host and its status; allows you
- to create new hosts, modify, enable/disable, or delete existing. Typical properties include a
+ just all the hosts. The API provides access to the settings of the host and its status. You can
+ create new hosts, modify, enable/disable, or delete existing. Typical properties include a
hostname, credentials to access API, connection settings. A Host is associated with at least one
Output. Each Host can have multiple child Outputs, and each Output has its own unique filter
settings.
@@ -42,14 +42,14 @@ The 9.0 API model consists of the following resources:
- File - Represents a log file created by a File Output - an actual .tsv, .json, or .zip file stored on
the agent or on a network share. A file can be downloaded.
-- Policy - Represents an Active Directory nonitoring policy. The API allows you to create new
+- Policy - Represents an Active Directory monitoring policy. Use the API to create new
policies, list, modify, and delete existing.
Data is transmitted as JSON objects or as JSON Merge Patch for PATCH requests. Dates are formatted
in UTC using the `YYYY-MM-DDTHH:MM:SS` DateTime format. Security-sensitive data like passwords,
-certificates, and access tokens are not returned by the GET requests but can be set using POST and
+certificates, and access tokens aren't returned by the GET requests but can be set using POST and
PATCH requests.
## API
@@ -271,7 +271,7 @@ Response Example:
**POST /api/v1/agents**
-Adds a new agent but does not install it. The host attribute must be unique.
+Adds a new agent but doesn't install it. The host attribute must be unique.
- Permission – Modify agents
- Response Body – Agent
@@ -642,7 +642,7 @@ Response Example:
**GET /api/v1/domains/«domainId»**
-Returns the domain by its ID, or a 404 error if it is not found or the client lacks sufficient
+Returns the domain by its ID, or a 404 error if it isn't found or the client lacks sufficient
permissions.
- Permission – Read or Access activity data
@@ -654,8 +654,8 @@ Response: Domain
**GET /api/v1/agents/«agentId»/domain**
-Returns a domain monitored by the specified agent, or a 404 error if the domain is not found, the
-client lacks the necessary permissions, or the agent is not monitoring AD activity.
+Returns a domain monitored by the specified agent, or a 404 error if the domain isn't found, the
+client lacks the necessary permissions, or the agent isn't monitoring AD activity.
This endpoint is useful to get `Output` settings specific to the agent. Domain outputs are logical,
they are described once and used by all the domain controllers to create actual files/syslog/amqp
@@ -672,7 +672,7 @@ Response: Domain
**GET /api/v1/domains/«domainId»/agents**
Returns the domain controllers (agents) monitoring the specified domain, or a 404 error if the
-domain is not found or the client lacks the necessary permissions.
+domain isn't found or the client lacks the necessary permissions.
- Permission – Read or Access activity data
- Response – Array of Agent
@@ -684,7 +684,7 @@ Response: Array of Agent
**GET /api/v1/domains/«domainId»/outputs**
Returns the configured outputs for the specified domain, or 404 if no rights for the domain or the
-domain was not found.
+domain wasn't found.
- Permission – Read or Access activity data
- Response – Array of Output
@@ -752,7 +752,7 @@ Response Example:
**GET /api/v1/domains/«domainId»/outputs/«outputId»**
-Returns the output for the specified domain, or a 404 error if the domain is not found or the client
+Returns the output for the specified domain, or a 404 error if the domain isn't found or the client
lacks the necessary permissions.
- Permission –Read or Access activity data
@@ -1106,7 +1106,7 @@ Response: Array of Status
**GET /api/v1/agents/«agentId»/hosts**
-Returns a list of hosts for the specified agent. If the agent is not found or the client lacks the
+Returns a list of hosts for the specified agent. If the agent isn't found or the client lacks the
necessary permissions, a 404 error is returned.
- Permission – Read or Access activity data
@@ -1369,7 +1369,7 @@ Response: 204
**GET /api/v1/hosts/«hostId»/outputs**
-Returns a list of outputs for the specified host. If the host is not found or the client lacks the
+Returns a list of outputs for the specified host. If the host isn't found or the client lacks the
necessary permissions, a 404 error is returned.
- Permission – Read or Access activity data
@@ -1417,7 +1417,7 @@ Request Body Structure:
**POST /api/v1/agents/«agentId»/hosts/«hostId»/outputs**
Adds a new output for the specified host on the specified agent only. The method may be useful to
-have agent-specific outputs but is not recommended.
+have agent-specific outputs but isn't recommended.
- Permission – Modify hosts
- Response – 201, Output
@@ -1452,7 +1452,7 @@ Request Body Structure:
**GET /api/v1/hosts/«hostId»/outputs/«outputId»**
-Returns the specified output of the host. If the host or output is not found, or the client lacks
+Returns the specified output of the host. If the host or output isn't found, or the client lacks
the necessary permissions, a 404 error is returned.
- Permission – Read or Access activity data
@@ -1586,7 +1586,7 @@ The following attributes can be modified:
- `windows.discardReorderedAcl`
- `windows.vssActivity`
- `windows.vssCreation`
-- `amqp.server` - must be a a vaild hostname or ip4/ip6 address.
+- `amqp.server` - must be a valid hostname or ip4/ip6 address.
- `amqp.userName`
- `amqp.password`
- `amqp.vhost`
@@ -1674,7 +1674,7 @@ The following attributes can be modified:
- `windows.discardReorderedAcl`
- `windows.vssActivity`
- `windows.vssCreation`
-- `amqp.server` ¬ must be a a vaild hostname or ip4/ip6 address.
+- `amqp.server` - must be a valid hostname or ip4/ip6 address.
- `amqp.userName`
- amqp.password
- `amqp.vhost`
@@ -1870,7 +1870,7 @@ Required attributes:
**PATCH /api/v1/domains/«domainId»/policies/«policyId»**
-Modifies attributes of the policy. If XML is updated, ID and GUID attributes in the XML are ignored,
+Modifies attributes of the policy. If XML is updated, ID, GUID, and other attributes in the XML are ignored,
and existing values are preserved.
**Permission: Policy change**
diff --git a/docs/activitymonitor/9.0/restapi/security.md b/docs/activitymonitor/9.0/restapi/security.md
index 8584763f91..9c447fd66c 100644
--- a/docs/activitymonitor/9.0/restapi/security.md
+++ b/docs/activitymonitor/9.0/restapi/security.md
@@ -9,7 +9,7 @@ sidebar_position: 10
## Security
The REST-style API is exposed via TLS v1.2, with a self-signed certificate by default. The port is
-customizable, 4494 by default. The IP whitelist can be used to restrict access to the port.
+customizable, 4494 by default. Use the IP whitelist to restrict access to the port.
You can use the Activity Monitor Console to allow applications to access the API, change
permissions, or revoke access. The console generates unique Client ID and Secret for each
@@ -19,7 +19,7 @@ application.
OAuth 2.0 client-credentials grant is used for authentication. A pair of Client ID and Secret are
used to obtain an access token from the access token URL: `https://localhost:4494/api/v1/token`.
-Token expiration intervals are not configurable.
+Token expiration intervals aren't configurable.
| Type | Expires in |
| ------------- | ---------- |
@@ -28,10 +28,10 @@ Token expiration intervals are not configurable.
| Refresh Token | never |
It is considered a best practice to use short expiration periods for OAuth 2.0 tokens, like 1 hour
-for the access token. A shorter period allows you to revoke the access quicker if needed. In case of
+for the access token. A shorter period lets you revoke the access quicker if needed. In case of
Activity Monitor, the Agent is both the authentication server and the resource server. Therefore, it
can validate the token on each and every access to a resource. So, for Activity Monitor long
-expiration periods do not make the protocol less secure.
+expiration periods don't make the protocol less secure.
A client is expected to pass the access token in the `Authorization` request header.
@@ -62,7 +62,7 @@ Activity Monitor 9.0 permissions:
| Permission | Description |
| -------------------- | --------------------------------------------------------------------------------------------------------------------------- |
| Access activity data | Provides minimal access rights to list and download the log files. |
-| Read | Read-only access to all the information about all agents, domains, and hosts. Does not allow one to download the log files. |
+| Read | Read-only access to all the information about all agents, domains, and hosts. Doesn't allow one to download the log files. |
| Policy change | Add, modify, and delete the AD monitoring policies. |
| Modify host | Add, modify, enable, disable, and delete Hosts and their Outputs. |
| Modify agent | Add, modify, and delete agents. |
diff --git a/docs/activitymonitor/9.0/siem/qradar/app/app.md b/docs/activitymonitor/9.0/siem/qradar/app/app.md
index a6762fd75f..62bc5292a3 100644
--- a/docs/activitymonitor/9.0/siem/qradar/app/app.md
+++ b/docs/activitymonitor/9.0/siem/qradar/app/app.md
@@ -15,7 +15,7 @@ and a Settings interface for configuring the QRadar SEC token.
The User Investigation and Host Investigation dashboards only appear when a search is conducted.
This can be done by clicking a hyperlink within the Username or Destination IP columns of a table
-card. Alternatively, type the complete user name or host IP Address in the Search box on the right
+card. Alternatively, enter the complete user name or host IP Address in the Search box on the right
side of the navigation bar.
## Table Card Features
@@ -34,11 +34,11 @@ following features:
- Total number of entries “Showing” will adjust for the filtered total.
- Search can also apply to the Operation column, but only for exact matches.
-- Sort can be applied to one column at a time by clicking on the desired column header.
+- Sort can be applied to one column at a time by clicking on the column header you want.
- Show 10, 25, 100, or All entries in the table. Only visible entries can be exported.
-- Result data currently visible within the table page displayed can be exported from the dashboard:
+- Result data visible within the table page displayed can be exported from the dashboard:
- - Copy – Copy to clipboard in order to paste to another application
+ - Copy – Copy to clipboard to paste to another application
- CSV – Export to a Comma Separated Value file
- Excel – Export to an Excel Workbook file
- - Print – Send currently displayed table to printer
+ - Print – Send displayed table to printer
diff --git a/docs/activitymonitor/9.0/siem/qradar/app/deletions.md b/docs/activitymonitor/9.0/siem/qradar/app/deletions.md
index 828f3c9d5b..cf7e137c76 100644
--- a/docs/activitymonitor/9.0/siem/qradar/app/deletions.md
+++ b/docs/activitymonitor/9.0/siem/qradar/app/deletions.md
@@ -21,5 +21,5 @@ The Deletions dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
-interval. Then click Search to refresh the card data.
+enter the date and time you want or use the calendar buttons to set the date and time
+interval you want. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/9.0/siem/qradar/app/home.md b/docs/activitymonitor/9.0/siem/qradar/app/home.md
index a0855f8b25..a86b0abfbd 100644
--- a/docs/activitymonitor/9.0/siem/qradar/app/home.md
+++ b/docs/activitymonitor/9.0/siem/qradar/app/home.md
@@ -10,11 +10,10 @@ The File System Activity Home dashboard contains the following cards:
-- Active Users – Number of distinct users recorded performing any type of file activity to/from any
+- Active Users – Number of distinct users performing any type of file activity to/from any
host over the specified time interval
-- Active Servers – Number of distinct servers accessed (destination IP Addresses) with any type of
- file activity recorded over the specified time interval
-- Open Offenses – Number of ransomware offenses detected within QRadar from the file activity event
+- Active Servers – Number of distinct servers with file activity (destination IP Addresses) over the specified time interval
+- Open Offenses – Number of ransomware offenses that QRadar finds from the file activity event
data
- The value for this card is a hyperlink to the [Ransomware Dashboard](/docs/activitymonitor/9.0/siem/qradar/app/ransomware.md).
@@ -32,5 +31,5 @@ The File System Activity Home dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
+enter the date and time you want or use the calendar buttons to set the date and time you want
interval. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/9.0/siem/qradar/app/hostinvestigation.md b/docs/activitymonitor/9.0/siem/qradar/app/hostinvestigation.md
index 7bc4275f67..17c6df65da 100644
--- a/docs/activitymonitor/9.0/siem/qradar/app/hostinvestigation.md
+++ b/docs/activitymonitor/9.0/siem/qradar/app/hostinvestigation.md
@@ -6,8 +6,8 @@ sidebar_position: 60
# Host Investigation Dashboard
-The Host Investigation dashboard only appears when a search is conducted. This can be done by
-clicking a hyperlink within the Destination IP column of a table card. Alternatively, type the
+The Host Investigation dashboard only appears when you conduct a search. You can do this by
+clicking a hyperlink within the Destination IP column of a table card. Alternatively, enter the
complete host IP Address in the Search box on the right side of the navigation bar.
@@ -20,7 +20,7 @@ The Host Investigation dashboard contains the following cards:
- Resources – Number of distinct files associated with the host over the specified time interval
- File Activity – Timeline of all events associated with the host over the specified time interval
- - The graph values can be toggled on an off by clicking on individual elements in the legend.
+ - You can toggle the graph values on and off by clicking individual elements in the legend.
- Details of File Activity – Tabular format of all file activity events associated with the host
which occurred over the specified time interval
@@ -36,5 +36,5 @@ The Host Investigation dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
-interval. Then click Search to refresh the card data.
+enter the date and time you want or use the calendar buttons to set the date and time
+interval you want. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/9.0/siem/qradar/app/permissionchanges.md b/docs/activitymonitor/9.0/siem/qradar/app/permissionchanges.md
index 1ddc441a97..2ba8d648eb 100644
--- a/docs/activitymonitor/9.0/siem/qradar/app/permissionchanges.md
+++ b/docs/activitymonitor/9.0/siem/qradar/app/permissionchanges.md
@@ -24,5 +24,5 @@ The Permission Changes dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
+enter the date and time you want or use the calendar buttons to set the date and time you want
interval. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/9.0/siem/qradar/app/ransomware.md b/docs/activitymonitor/9.0/siem/qradar/app/ransomware.md
index 154d56d939..f65ef80a7d 100644
--- a/docs/activitymonitor/9.0/siem/qradar/app/ransomware.md
+++ b/docs/activitymonitor/9.0/siem/qradar/app/ransomware.md
@@ -12,8 +12,8 @@ The Ransomware Dashboard for QRadar shows a list of suspected ransomware events.
The Ransomware dashboard contains the following cards:
-- Offenses – List of offenses detected within QRadar from the file activity data as a potential
- ransomware attack
+- Offenses – List of offenses that QRadar detects from the file activity data as potential
+ ransomware attacks
- See the [Table Card Features ](/docs/activitymonitor/9.0/siem/qradar/app/app.md#table-card-features) topic for additional
information.
@@ -30,8 +30,8 @@ The Ransomware dashboard contains the following cards:
- Only visible after clicking Search on an offense
-The offenses generated within QRadar are based upon the Netwrix: Ransomware Detected rule that
-is packaged with this application. In order to adjust this rule to better suit an organization’s
-needs, please refer to the IBM QRadar
+QRadar generates the offenses based on the Netwrix: Ransomware Detected rule that
+this application includes. To adjust this rule to better suit your organization’s
+needs, see the IBM QRadar
[Rule management](https://www.ibm.com/support/knowledgecenter/SS42VS_7.2.6/com.ibm.qradar.doc/c_qradar_rul_mgt.html)
article on how to modify rules.
diff --git a/docs/activitymonitor/9.0/siem/qradar/app/userinvestigation.md b/docs/activitymonitor/9.0/siem/qradar/app/userinvestigation.md
index 6e0f22f3bd..83e89c0f25 100644
--- a/docs/activitymonitor/9.0/siem/qradar/app/userinvestigation.md
+++ b/docs/activitymonitor/9.0/siem/qradar/app/userinvestigation.md
@@ -6,8 +6,8 @@ sidebar_position: 50
# User Investigation Dashboard
-The User Investigation dashboard only appears when a search is conducted. This can be done by
-clicking a hyperlink within the Username column of a table card. Alternatively, type the complete
+The User Investigation dashboard only appears when you conduct a search. You can do this by
+clicking a hyperlink within the Username column of a table card. Alternatively, enter the complete
user name in the Search box on the right side of the navigation bar.
@@ -20,7 +20,7 @@ The User Investigation dashboard contains the following cards:
interval
- Resources – Number of distinct files associated with the user over the specified time interval
- File Activity – Timeline of all events associated with the user over the specified time interval
- - The graph values can be toggled on an off by clicking on individual elements in the legend.
+ - You can toggle the graph values on and off by clicking individual elements in the legend.
- Details of File Activity – Tabular format of all file activity events associated with the user
which occurred over the specified time interval
- See the [Table Card Features ](/docs/activitymonitor/9.0/siem/qradar/app/app.md#table-card-features) topic for additional
@@ -32,5 +32,5 @@ The User Investigation dashboard contains the following cards:
The time interval is identified in the upper-right corner with the Start and End boxes. This is set
by default to the “past day,” or 24 hours. To search within a different interval, either manually
-type the desired date and time or use the calendar buttons to set the desired date and time
+enter the date and time you want or use the calendar buttons to set the date and time you want
interval. Then click Search to refresh the card data.
diff --git a/docs/activitymonitor/9.0/siem/qradar/overview.md b/docs/activitymonitor/9.0/siem/qradar/overview.md
index dad5896184..ed567581c3 100644
--- a/docs/activitymonitor/9.0/siem/qradar/overview.md
+++ b/docs/activitymonitor/9.0/siem/qradar/overview.md
@@ -15,9 +15,9 @@ exfiltration attempts. With full control over the data, users can create custom
enabling QRadar to correlate file system activity with any log source.
This document describes how to integrate Netwrix products with the Netwrix File Activity Monitor App
-for QRadar found in the IBM X-Force Exchange. Any Netwrix products can be configured to monitor file
+for QRadar found in the IBM X-Force Exchange. You can configure any Netwrix product to monitor file
system activity and send the monitored events to QRadar. After installing this app, ensure that
-either the Activity Monitor, Threat Prevention, or Access Analyzer has been configured to send
+you configure either the Activity Monitor, Threat Prevention, or Access Analyzer to send
events to QRadar. See the [Netwrix Technical Knowledge Center](https://helpcenter.netwrix.com/) on
the Netwrix website for additional information.
@@ -25,10 +25,10 @@ the Netwrix website for additional information.
Download the [Netwrix File Activity Monitor App for
QRadar](https://exchange.xforce.ibmcloud.com/hub/extension/STEALTHbits Technologies:STEALTHbits File Activity Monitor) from the [IBM X-Force App Exchange](https://exchange.xforce.ibmcloud.com/hub).
-After downloading the Stealthbits File Activity Monitor App for QRadar, follow the steps to install
+After downloading the Stealthbits File Activity Monitor App for QRadar, install it by following these steps:
it within QRadar.
-**Step 1 –** Click on the Admin tab within QRadar.
+**Step 1 –** Click the Admin tab within QRadar.
**Step 2 –** Under System Configuration, click Extensions Management.
@@ -41,13 +41,12 @@ Then click **Install**.
**Step 5 –** Close the Extensions Management window, and then select the File Activity Monitor tab
within QRadar.
-The File Activity Monitor tab will appear within QRadar. It is necessary for the QRadar SEC token to
-be saved to the Settings interface of the **File Activity Monitor** App. See the
+The File Activity Monitor tab will appear within QRadar. You must save the QRadar SEC token to the Settings interface of the **File Activity Monitor** App. See the
[Settings](/docs/activitymonitor/9.0/siem/qradar/settings.md) topic for additional information.
## Initial Configuration of the QRadar App
-Follow the steps to configure QRadar to receive data from Netwrix products.
+Configure QRadar to receive data from Netwrix products by following these steps:
**Step 1 –** Determine the IP Address of the QRadar Console, e.g. run the _ifconfig_ command. This
information is required for the following sections:
@@ -61,7 +60,7 @@ information is required for the following sections:
**Step 3 –** Select Log Sources.
-**Step 4 –** View the Log Sources list. If the data source was not automatically created, click Add
+**Step 4 –** View the Log Sources list. If the data source wasn't automatically created, click Add
and enter the following information:
- Log Source Name – Enter a descriptive name to identify the data source
@@ -77,7 +76,7 @@ sent correctly between the hosts, and diagnose any possible network issues.
- Protocol Configuration – Select Syslog
- Log Source Identifier – Enter the host name or IP Address of the host where the Netwrix
Activity Monitor agent OR Threat Prevention is installed
-- Then click Save. Remember, prior to using the Netwrix File Activity Monitor App for QRadar, the
+- Then click Save. Remember, before using the Netwrix File Activity Monitor App for QRadar, the
related Netwrix product must be configured to send data to QRadar.
The Netwrix File Activity Monitor App for QRadar can now display activity data from either the
diff --git a/docs/activitymonitor/9.0/siem/qradar/settings.md b/docs/activitymonitor/9.0/siem/qradar/settings.md
index d6760cd22d..41f4aca150 100644
--- a/docs/activitymonitor/9.0/siem/qradar/settings.md
+++ b/docs/activitymonitor/9.0/siem/qradar/settings.md
@@ -12,4 +12,4 @@ the QRadar SEC token to be saved to the **Settings** interface.
The **More information** link will open the IBM Knowledge Center with information on generating the
-QRadar SEC token. Once the token is generated, copy and paste it here and click Save.
+QRadar SEC token. After the token is generated, copy, paste it here, and click Save.
diff --git a/docs/activitymonitor/9.0/siem/splunk/app/app.md b/docs/activitymonitor/9.0/siem/splunk/app/app.md
index f44cddf87b..5b7de9b5a8 100644
--- a/docs/activitymonitor/9.0/siem/splunk/app/app.md
+++ b/docs/activitymonitor/9.0/siem/splunk/app/app.md
@@ -13,6 +13,6 @@ Activity (Overview), Ransomware, Permission Changes, and Deletions.
The date time search feature uses the default Splunk search features.
-The timeframe interval is identified in the upper-left corner of each dashboard. The drop-down menu
+The timeframe interval is identified in the upper-left corner of each dashboard. The dropdown menu
provides additional options. To search within a different interval, choose a new option from the
menu. Then click **Submit** to refresh the card data.
diff --git a/docs/activitymonitor/9.0/siem/splunk/app/deletions.md b/docs/activitymonitor/9.0/siem/splunk/app/deletions.md
index 7a67f53482..da8eb0f18a 100644
--- a/docs/activitymonitor/9.0/siem/splunk/app/deletions.md
+++ b/docs/activitymonitor/9.0/siem/splunk/app/deletions.md
@@ -13,7 +13,7 @@ View deletion information in the Deletions Dashboard for Splunk.
The Deletions dashboard contains the following cards:
- Activity – Timeline of all deletion events in the specified timeframe
-- Top Users – Displays up-to the top five users related to deletion events which have been recorded
+- Top Users – Displays up-to the top five users associated with deletion events that occurred
in the specified timeframe
- Latest Events – Tabular format of all deletion events recorded in the specified timeframe
diff --git a/docs/activitymonitor/9.0/siem/splunk/app/overview.md b/docs/activitymonitor/9.0/siem/splunk/app/overview.md
index bafd3690dc..bbaa9ab55d 100644
--- a/docs/activitymonitor/9.0/siem/splunk/app/overview.md
+++ b/docs/activitymonitor/9.0/siem/splunk/app/overview.md
@@ -15,11 +15,11 @@ The File System Activity Overview dashboard contains the following cards:
- Active Users – Number of users involved with file system events in the specified timeframe
- Active Servers – Number of servers involved with file system events in the specified timeframe
- File Activity – Timeline of all file system events in the specified timeframe
-- Top Users – Displays up-to the top five users addresses related to file system events which have
- been recorded in the specified timeframe
-- Top Servers – Displays up-to the top five client IP addresses/host names related to file system
- events which have been recorded in the specified timeframe
-- Latest Events – Tabular format of all file system change events which have been recorded in the
+- Top Users – Displays up-to the top five users associated with file system events that occurred in
+ the specified timeframe
+- Top Servers – Displays up-to the top five client IP addresses/host names associated with file system
+ events that occurred in the specified timeframe
+- Latest Events – Tabular format of all file system change events that occurred in the
specified timeframe
The specified timeframe is set by default to the Last 24 hours, or past day.
diff --git a/docs/activitymonitor/9.0/siem/splunk/app/permissionchanges.md b/docs/activitymonitor/9.0/siem/splunk/app/permissionchanges.md
index 8a1e47e6ba..9e40a15085 100644
--- a/docs/activitymonitor/9.0/siem/splunk/app/permissionchanges.md
+++ b/docs/activitymonitor/9.0/siem/splunk/app/permissionchanges.md
@@ -6,15 +6,15 @@ sidebar_position: 30
# Permission Changes Dashboard
-View information on permissions changes on the through the Permission Changes Dashboard for Splunk.
+View information on permission changes through the Permission Changes Dashboard for Splunk.
The Permission Changes dashboard contains the following cards:
- Activity – Timeline of all permission change events in the specified timeframe
-- Top Users – Displays up-to the top five users related to permission change events which have been
- recorded in the specified timeframe
-- Latest Events – Tabular format of all permission change events recorded in the specified timeframe
+- Top Users – Displays up-to the top five users associated with permission change events that occurred in
+ the specified timeframe
+- Latest Events – Tabular format of all permission change events that occurred in the specified timeframe
The specified timeframe is set by default to the Last 24 hours, or past day.
diff --git a/docs/activitymonitor/9.0/siem/splunk/overview.md b/docs/activitymonitor/9.0/siem/splunk/overview.md
index 6c1ac1a719..08b2ae2bef 100644
--- a/docs/activitymonitor/9.0/siem/splunk/overview.md
+++ b/docs/activitymonitor/9.0/siem/splunk/overview.md
@@ -15,9 +15,9 @@ exfiltration attempts. With full control over the data, users can create custom
enabling Splunk to correlate file system activity with any log source.
This document describes how to integrate Netwrix products with the Netwrix File Activity
-Monitor App for Splunk found in Splunkbase. Any Netwrix product can be configured to monitor file
+Monitor App for Splunk found in Splunkbase. Configure any Netwrix product to monitor file
system activity and send the monitored events to Splunk. After installing this app, ensure that
-either theActivity Monitor, Threat Prevention, or Access Analyzer has been configured to send events
+you configure either the Activity Monitor, Threat Prevention, or Access Analyzer to send events
to Splunk. See the product user guide on the
[Netwrix Technical Knowledge Center](https://helpcenter.netwrix.com/) for additional information.
@@ -28,7 +28,7 @@ After downloading the Netwrix File Activity Monitor App for Splunk from [Splunkb
Splunk to install the app.
:::note
-In order to use the Ransomware dashboard within the app, install
+to use the Ransomware dashboard within the app, install
[Splunk User Behavior Analytics](https://www.splunk.com/en_us/products/premium-solutions/user-behavior-analytics.html)
(any version) and the [Machine Learning Toolkit](https://splunkbase.splunk.com/app/2890/) app for
Splunk (version 2.0.0+).
@@ -41,7 +41,7 @@ configured to receive data from either theActivity Monitor or Threat Prevention.
## Initial Configuration of the Splunk App
-Follow the steps to configure Splunk to receive data from Netwrix products.
+To configure Splunk to receive data from Netwrix products, complete the following steps:
**Step 1 –** Determine the IP Address of the Splunk Console, e.g. run the ifconfig command. This
information is required for the following sections:
@@ -58,7 +58,7 @@ information is required for the following sections:
**Step 3 –** Select UDP.
**Step 4 –** Click New and add a new data input with Port 514. If another Splunk UDP input is
-already using 514, another value (515 or higher) can be used as long as it is not blocked by the
+already using 514, another value (515 or higher) can be used as long as it isn't blocked by the
network. Remember to configure the port within the Netwrix product configuration to align with
this change.
@@ -73,7 +73,7 @@ this change.
- Host – Select IP
- Index – Select Default
-**Step 7 –** Review and save the new settings. Remember, prior to using the Netwrix File
+**Step 7 –** Review and save the new settings. Remember, before using the Netwrix File
Activity Monitor App for Splunk, the related Netwrix products must be configured to send data to
Splunk.
diff --git a/docs/activitymonitor/9.0/troubleshooting/antivirusexclusions.md b/docs/activitymonitor/9.0/troubleshooting/antivirusexclusions.md
index 1ea8abd565..87961f5e45 100644
--- a/docs/activitymonitor/9.0/troubleshooting/antivirusexclusions.md
+++ b/docs/activitymonitor/9.0/troubleshooting/antivirusexclusions.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Antivirus Exclusions
Windows activity monitoring and performance of the Activity Agent may be negatively affected by
-antivirus protections. Add the following components to antivirus exclusions in order to avoid
+antivirus protections. Add the following components to antivirus exclusions to avoid
potential performance degradation.
## Directories
diff --git a/docs/activitymonitor/9.0/troubleshooting/backuprestore/agentbackup.md b/docs/activitymonitor/9.0/troubleshooting/backuprestore/agentbackup.md
index a0deae0209..b490e3a49a 100644
--- a/docs/activitymonitor/9.0/troubleshooting/backuprestore/agentbackup.md
+++ b/docs/activitymonitor/9.0/troubleshooting/backuprestore/agentbackup.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Agent Backup
-Follow the steps to back up the configuration, passwords, Active Directory event data file, and
+Back up the configuration, passwords, Active Directory event data file, and
activity log files for Activity Monitor Agents deployed on file system servers, SharePoint servers,
and domain controllers.
@@ -22,9 +22,7 @@ The location of the `SBTFileMon.ini` is determined by the registry value:
**Step 2 –** Back up passwords
-> Passwords are stored in the `SBTFileMon.ini` file in an encrypted form using DPAPI. They can only
-> be decrypted on the same Windows server. To be able to restore the configuration of a different
-> server, back up the passwords separately. This includes the following:
+> The `SBTFileMon.ini` file stores passwords in an encrypted form using DPAPI. You can only decrypt them on the same Windows server. To restore the configuration on a different server, back up the passwords separately. This includes the following:
- Credentials for Agent
- Credentials for Monitored Hosts/Services
@@ -48,7 +46,7 @@ default folder is
**C:\ProgramData\Netwrix\Activity Monitor\Agent\ActivityLogs**
:::note
-Keep in mind that` C:\ProgramData` folder may be hidden. Navigate to it by typing
+The `C:\ProgramData` folder may be hidden. Navigate to it by typing
`%ALLUSERSPROFILE%` in the File Explorer.
:::
diff --git a/docs/activitymonitor/9.0/troubleshooting/backuprestore/agentrestore.md b/docs/activitymonitor/9.0/troubleshooting/backuprestore/agentrestore.md
index 52f1a33797..8d22ea2157 100644
--- a/docs/activitymonitor/9.0/troubleshooting/backuprestore/agentrestore.md
+++ b/docs/activitymonitor/9.0/troubleshooting/backuprestore/agentrestore.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# Agent Restoration
-Follow the steps to restore the configuration, Active Directory configuration file, and activity log
+Restore the configuration, Active Directory configuration file, and activity log
files for Activity Monitor Agents deployed on file system servers, SharePoint servers, and domain
-controllers.
+controllers by following these steps:
:::warning
Restore the agent before restoring the console to ensure connectivity and monitoring
diff --git a/docs/activitymonitor/9.0/troubleshooting/backuprestore/consolebackup.md b/docs/activitymonitor/9.0/troubleshooting/backuprestore/consolebackup.md
index f0e06eeb35..6933f64177 100644
--- a/docs/activitymonitor/9.0/troubleshooting/backuprestore/consolebackup.md
+++ b/docs/activitymonitor/9.0/troubleshooting/backuprestore/consolebackup.md
@@ -6,8 +6,6 @@ sidebar_position: 30
# Console Backup
-Follow the steps to back up the list of agents managed on the Activity Monitor Console.
-
**Step 1 –** Back up the configuration file:
**%ALLUSERSPROFILE%\Netwrix\Activity Monitor\Console\Agents.ini**
@@ -18,8 +16,6 @@ Follow the steps to back up the list of agents managed on the Activity Monitor C
**Step 3 –** Back up passwords.
-Credentials for the agents are stored in the `Agents.ini` file in an encrypted form using PSAPI.
-They can only be decrypted on the same Windows workstation. To be able to restore the configuration
-on a different workstation, back up the passwords separately.
+The `Agents.ini` file stores agent credentials in an encrypted form using PSAPI. You can only decrypt them on the same Windows workstation. To restore the configuration on a different workstation, back up the passwords separately.
All key components necessary for data recovery have now been backed up for the console.
diff --git a/docs/activitymonitor/9.0/troubleshooting/backuprestore/consolerestore.md b/docs/activitymonitor/9.0/troubleshooting/backuprestore/consolerestore.md
index 3bdb18b487..eba4fdb388 100644
--- a/docs/activitymonitor/9.0/troubleshooting/backuprestore/consolerestore.md
+++ b/docs/activitymonitor/9.0/troubleshooting/backuprestore/consolerestore.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Console Restoration
-Follow the steps to restore the list of agents managed on the Activity Monitor Console.
+Restore the list of agents managed on the Activity Monitor Console.
**Step 1 –** Restore `Agents.ini` file.
diff --git a/docs/activitymonitor/9.0/troubleshooting/performancemonitoring.md b/docs/activitymonitor/9.0/troubleshooting/performancemonitoring.md
index 1d10293ce7..609335a590 100644
--- a/docs/activitymonitor/9.0/troubleshooting/performancemonitoring.md
+++ b/docs/activitymonitor/9.0/troubleshooting/performancemonitoring.md
@@ -24,8 +24,8 @@ The following performance counters are provided by Activity Monitor.
| NetApp | ✔ | Activity Monitor - NetApp\Session Negotiated | Number of connections established with ONTAP cluster nodes |
| NetApp | ✔ | Activity Monitor - NetApp\Active Connections | Number of active connections with ONTAP cluster nodes |
| NetApp | | Activity Monitor - NetApp\Outage Files | Number of outage (resilience) files processed |
-| NetApp | ✔ | Activity Monitor - NetApp\Overloaded | Number of times the agent was overloaded and had to limit the rate of events. This counter may increase from time to time when processing large batches of events. But if it keeps increasing, it is a sure sign that the agent is not coping with the load. Consider moving some SVMs to another agent or spreading the load from one SVM across multiple agents. |
-| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Received | Number of events received from CEE |
+| NetApp | ✔ | Activity Monitor - NetApp\Overloaded | Number of times the agent was overloaded and had to limit the rate of events. This counter may increase from time to time when processing large batches of events. But if it keeps increasing, it is a sure sign that the agent isn't coping with the load. Consider moving some SVMs to another agent or spreading the load from one SVM across multiple agents. |
+| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Received | Number of events received from CEE (Common Event Expression) |
| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Received/sec | Rate at which events are received from CEE |
| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Reported | Number of events passed the filters and being reported to outputs |
| VNX, Isilon, Unity | ✔ | Activity Monitor - Dell\Events Reported/sec | Rate at which events are reported to outputs |
@@ -35,7 +35,7 @@ The following performance counters are provided by Activity Monitor.
| Outputs | ✔ | Activity Monitor - Outputs\Events Reported/sec | Rate at which events are reported |
| Outputs | | Activity Monitor - Outputs\Events Reported to Files | Total number of events reported to log files |
| Outputs | | Activity Monitor - Outputs\Events Reported to Syslog | Total number of events reported to syslog servers |
-| Outputs | | Activity Monitor - Outputs\Events Reported to AMQP | Total number of events reported to AMQP servers (not used currently) |
+| Outputs | | Activity Monitor - Outputs\Events Reported to AMQP | Total number of events reported to AMQP (Advanced Message Queuing Protocol) servers (not used ) |
| Outputs | ✔ | Activity Monitor - Outputs\Resolved SIDs | Number of attempts, both successful and failed, to resolve SIDs to names |
| Outputs | ✔ | Activity Monitor - Outputs\Resolved SIDs/sec | Rate at which SIDs are resolved to names |
| Outputs | ✔ | Activity Monitor - Outputs\Resolved SIDs Failures | Number of failed attempts to resolve SIDs to names |
@@ -56,7 +56,7 @@ The following performance counters are provided by Activity Monitor.
DNS and AD queries typically contribute the most to the processing time. Since the
resolution occurs in real time, slow responses can affect throughput (A 100ms DNS response limits
the throughput to 10 events per second). Observing average and maximum values of DNS Queries Time,
-Resolved SIDs Time, and Translated UIDs Time allows you to estimate the response time.
+Resolved SIDs Time, and Translated UIDs Time helps you estimate the response time.
:::
@@ -69,7 +69,7 @@ performance counters:
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Processor(\_Total)\% Processor Time | The percentage of elapsed time that the processor spends to execute a non-Idle thread. |
| Memory\Available MBytes | The amount of physical memory, in Megabytes, immediately available for allocation to a process or for system use. |
-| Paging File(\_Total)\% Usage | The percentage of the paging file that is currently in use. |
+| Paging File(\_Total)\% Usage | The percentage of the paging file that is in use. |
| TCPv4\Connections Reset | The rate of reset TCPv4 connections |
| TCPv4\Segments Received/sec | The quantity of segments received via TCPv4 per second. |
| TCPv4\Segments Retransmitted/Sec | Quantity of segments retransmitted via TCPv4 per second. |
@@ -79,7 +79,7 @@ performance counters:
| Network Interface(\*)\Bytes Sent/sec | From all network adapters: The rate at which bytes are sent. |
| Network Interface(\*)\Output Queue Length | From all network adapters: The length of the output packet queue (in packets). |
| Network Interface(\*)\Packets Received Discarded | From all network adapters: The number of inbound packets that were chosen to be discarded even though no errors had been detected to prevent their being deliverable to a higher-layer protocol. |
-| Network Interface(\*)\Packets Received Errors | From all network adapters: The number of inbound packets that contained errors. As a result, the errored packets were not delivered to a higher-layer protocol. |
+| Network Interface(\*)\Packets Received Errors | From all network adapters: The number of inbound packets that contained errors. As a result, the errored packets weren't delivered to a higher-layer protocol. |
| Process(ConfigurationAgent.Grpc.Host)\% Processor Time | For Agent: The percentage of elapsed time that all of process threads used the processor to execution instructions. |
| Process(ConfigurationAgent.Grpc.Host)\Elapsed Time | For Agent: The duration from when the process was started until the time it terminated. |
| Process(ConfigurationAgent.Grpc.Host)\Handle Count | For Agent: The number of operating system handles the process has opened. |
@@ -131,11 +131,9 @@ performance counters:
## Register Performance Counters
-The Activity Monitor performance counters are not registered by default and must be registered
+The Activity Monitor performance counters aren't registered by default and must be registered
manually.
-Follow the steps to register the Activity Monitor performance counters on each SAM Agent server.
-
**Step 1 –** Run `cmd.exe` as Administrator.
**Step 2 –** Change current directory to the agent installation folder
@@ -313,11 +311,9 @@ Get-Counter @variables | Export-Counter -FileFormat csv -Path $outputFile -Force
## Unregister Performance Counters
-When performance monitoring is not needed anymore, unregister the Activity Monitor performance
+When performance monitoring isn't needed anymore, unregister the Activity Monitor performance
counters.
-Follow the steps to unregister the Activity Monitor performance counters on each SAM Agent server.
-
**Step 1 –** Run `cmd.exe` as Administrator.
**Step 2 –** Change current directory to the agent installation folder.
@@ -343,4 +339,4 @@ sc stop SBTLoggingSvc
**sc start SBFileMonAgentSvc**
-Once the services have been restarted, the Activity Monitor performance counters are unregistered.
+After the services have been restarted, the Activity Monitor performance counters are unregistered.
diff --git a/docs/activitymonitor/9.0/troubleshooting/tracelogs.md b/docs/activitymonitor/9.0/troubleshooting/tracelogs.md
index fe71fa1c23..494832f67f 100644
--- a/docs/activitymonitor/9.0/troubleshooting/tracelogs.md
+++ b/docs/activitymonitor/9.0/troubleshooting/tracelogs.md
@@ -8,7 +8,7 @@ sidebar_position: 20
While activity agents store activity logs on the servers where they are deployed, the Activity
Monitor creates Trace Logs that aid in troubleshooting issues. The Trace level option set in the
-drop-down list in the lower right corner of the Activity Monitor Console determines the kind of
+dropdown list in the lower right corner of the Activity Monitor Console determines the kind of
information kept in the activity agent and monitored hosts/services logs.
@@ -25,7 +25,7 @@ properties). Select from the following trace log levels:
- Fatal – Records only when catastrophic system failures / crashes occur
When the log level is changed in the Activity Monitor Console, the new log level is propagated and
-applied immediately to all of the activity agents that do not have custom trace setting.
+applied immediately to all of the activity agents that don't have custom trace setting.
:::note
Trace level can be adjusted in the Agent Properties for the selected agent. See the
diff --git a/docs/auditor/10.7/accessreviews/accessreviews.md b/docs/auditor/10.7/accessreviews/accessreviews.md
index 8d9206458a..34c06cab17 100644
--- a/docs/auditor/10.7/accessreviews/accessreviews.md
+++ b/docs/auditor/10.7/accessreviews/accessreviews.md
@@ -24,42 +24,45 @@ the following data sources:
This workflow assumes you already have Netwrix Auditor installed with configured monitoring plans
for a supported data source.
-**NOTE:** Access Reviews is a separately licensed product and is not included with Netwrix Auditor.
-Make sure that you have the Access Reviews license enabled in Auditor.
+**NOTE:** Access Reviews is a separately licensed product and isn't included with Netwrix Auditor.
+Ensure that you have the Access Reviews license enabled in Auditor.
See the [Licenses](/docs/auditor/10.7/admin/settings/licenses.md) topic for additional information.
_Remember,_ there is one single Access Review license for all data sources that can send data to the
application.
-Follow the steps to use Netwrix Auditor Access Reviews in conjuction with Auditor.
+## Set up Netwrix Auditor Access Reviews
-**Step 1 –** Install Access Reviews on the same computer where Netwrix Auditor is installed. See the
+1. Install Access Reviews on the same computer where Netwrix Auditor is installed. See the
[Installation Overview](/docs/auditor/10.7/accessreviews/installation/overview.md) topic for prerequisites and
additional information.
-**Step 2 –** Configure Access Reviews. The Configuration interface is only available to users with
+2. Configure Access Reviews. The Configuration interface is only available to users with
the Administrator role. See the [Administrator Overview](/docs/auditor/10.7/accessreviews/admin/overview.md) topic
for configuration settings and enabling user access.
-**Step 3 –** Use the Access reviews configuration tool to setup the data flow from the Auditor
+3. Use the Access reviews configuration tool to set up the data flow from the Auditor
database to the Access Reviews database. See the
[Select Data Sources](/docs/auditor/10.7/accessreviews/installation/accessreviewsconfiguration.md) topic for additional information.
-**NOTE:** Data upload speed depends on the amount of collected data and Auditor collectors
-configuration.
+:::note
+Data upload speed depends on the amount of collected data and Auditor collectors configuration.
+:::
-**Step 4 –** Configure resource ownership through the Access Reviews Console. The Resource Owners
+4. Configure resource ownership through the Access Reviews Console. The Resource Owners
interface is available to users with either the Security Team or Administrator role. Managing
-ownership is core component for the Access Reviews workflow. See the
+ownership is a core component of the Access Reviews workflow. See the
[Resource Owners Overview](/docs/auditor/10.7/accessreviews/resourceowners/overview.md) topic for additional
information.
-**NOTE:** The [Owners & Access Reviews](/docs/auditor/10.7/accessreviews/owneroverview/owneroverview.md) topic and
+:::note
+The [Owners & Access Reviews](/docs/auditor/10.7/accessreviews/owneroverview/owneroverview.md) topic and
subtopics are written for the assigned owners. You can distribute the URL to this topic or download
a PDF to be distributed to your assigned resource owners.
+:::
-**Step 5 –** Configure and run reviews. The Entitlement Reviews interface is available to users with
+5. Configure and run reviews. The Entitlement Reviews interface is available to users with
either the Security Team or Administrator role. See the
[Reviews Overview](/docs/auditor/10.7/accessreviews/entitlementreviews/overview.md) topic for additional
information.
@@ -70,14 +73,14 @@ Netwrix Auditor Access Reviews is now configured and ready to use.
Review the following considerations:
-1. Enabling State-in-Time data collection for your monitoring plans option is not required for the
+1. Enabling State-in-Time data collection for your monitoring plans option isn't required for the
integration works properly.
2. The data collected by Auditor is updated at least once a day.
3. If a monitoring plan or a data source with enabled integration is deleted, all collected data
will be removed from the Access Reviews database.
4. If there are errors in upload of data to the Access Reviews database, these errors are reflected
in the Netwrix Auditor Health Log and text log files; status of items and data sources in Auditor
- is not affected by these errors.
+ isn't affected by these errors.
5. Permissions-related considerations:
- For Windows File Servers, permission data for all items in this data source is sent to the
@@ -87,70 +90,70 @@ Review the following considerations:
- Transfer of permission data to the Access Reviews application is started when you enable the
integration for a data source.
- ## Initial Configuration
+## Initial Configuration
- Next, configure the Access Reviews for your environment:
+Next, configure the Access Reviews for your environment:
- - Console Users — Grant users access to the application starting with an Administrator account.
- There are two levels of access: Administrator and Security Team. See the
- [Console Access Page](/docs/auditor/10.7/accessreviews/admin/configuration/consoleaccess.md) topic for
- information.
+- Console Users — Grant users access to the application starting with an Administrator account.
+ There are two levels of access: Administrator and Security Team. See the
+ [Console Access Page](/docs/auditor/10.7/accessreviews/admin/configuration/consoleaccess.md) topic for
+ information.
- - Optionally, disable the Builtin Administrator account. See the
- [Modify the Builtin Administrator Account](/docs/auditor/10.7/accessreviews/admin/configuration/consoleaccess.md#modify-the-builtin-administrator-account)
- topic for additional information.
+ - Optionally, disable the Builtin Administrator account. See the
+ [Modify the Builtin Administrator Account](/docs/auditor/10.7/accessreviews/admin/configuration/consoleaccess.md#modify-the-builtin-administrator-account)
+ topic for additional information.
- - Notification — Configure the Notification settings required in order for the application to
- send email. See the
- [Notifications Page](/docs/auditor/10.7/accessreviews/admin/configuration/notifications.md) topic for
- information.
+- Notification — Configure the Notification settings required in order for the application to
+ send email. See the
+ [Notifications Page](/docs/auditor/10.7/accessreviews/admin/configuration/notifications.md) topic for
+ information.
- ## Enable Console Users
+## Enable Console Users
- Access Reviews Console users granted one of the available roles should be notified.
+Access Reviews Console users granted one of the available roles should be notified.
- **_RECOMMENDED:_** The notification should include:
+**_RECOMMENDED:_** The notification should include:
- - Why your organization is using Netwrix Auditor Access Reviews.
- - What they will be doing in the Access Reviews Console.
- - How to log into the Access Reviews Console, specifically what URL and credentials to use.
+- Why your organization is using Netwrix Auditor Access Reviews.
+- What they will be doing in the Access Reviews Console.
+- How to log into the Access Reviews Console, specifically what URL and credentials to use.
- You should also provide links to the appropriate topics based on the user's role:
+You should also provide links to the appropriate topics based on the user's role:
- - Security Team — Need topics that align to the work the will be doing in the Access Reviews
- Console:
+- Security Team — Need topics that align to the work the will be doing in the Access Reviews
+ Console:
- - Ownership Administrator — Send the URL link for the
- [Resource Owners Overview](/docs/auditor/10.7/accessreviews/resourceowners/overview.md) topic.
- - Review Administrator — Send the URL link for the
- [Reviews Overview](/docs/auditor/10.7/accessreviews/entitlementreviews/overview.md) topic.
+ - Ownership Administrator — Send the URL link for the
+ [Resource Owners Overview](/docs/auditor/10.7/accessreviews/resourceowners/overview.md) topic.
+ - Review Administrator — Send the URL link for the
+ [Reviews Overview](/docs/auditor/10.7/accessreviews/entitlementreviews/overview.md) topic.
- - Administrator — Send the URL link for the
- [Administrator Overview](/docs/auditor/10.7/accessreviews/admin/overview.md) topic.
+- Administrator — Send the URL link for the
+ [Administrator Overview](/docs/auditor/10.7/accessreviews/admin/overview.md) topic.
- ## Resource Ownership Configuration
+## Resource Ownership Configuration
- Ownership of resources must be assigned in order to use the Access Reviews workflow:
+Ownership of resources must be assigned to use the Access Reviews workflow:
- - Resource Ownership — Assign ownership for resources to be managed through the application. See
- the [Resource Owners Interface](/docs/auditor/10.7/accessreviews/resourceowners/interface/interface.md) topic for
- additional information.
- - Enable Owners — Send a notification to your owners about resource ownership with the
- application. See the
- [Notification to Owners](/docs/auditor/10.7/accessreviews/resourceowners/overview.md#notification-to-owners)
- topic for additional information.
+- Resource Ownership — Assign ownership for resources to be managed through the application. See
+ the [Resource Owners Interface](/docs/auditor/10.7/accessreviews/resourceowners/interface/interface.md) topic for
+ additional information.
+- Enable Owners — Send a notification to your owners about resource ownership with the
+ application. See the
+ [Notification to Owners](/docs/auditor/10.7/accessreviews/resourceowners/overview.md#notification-to-owners)
+ topic for additional information.
- ## Access Reviews Workflow
+## Access Reviews Workflow
- The Access Reviews applicaton runs attestations on resources and groups with the assigned
- owners. The workflow consists of:
+The Access Reviews applicaton runs attestations on resources and groups with the assigned
+owners. The workflow consists of:
- - Reviews — Configure reviews for resource Access or group Membership .
- - Owner Performs Review — Owners process the review, potentially recommending changes
- - Review Administrator Approval — Review and process owner recommended changes
+- Reviews — Configure reviews for resource Access or group Membership .
+- Owner Performs Review — Owners process the review, potentially recommending changes
+- Review Administrator Approval — Review and process owner recommended changes
- **_RECOMMENDED:_** Set expectations for response time from owners.
+**_RECOMMENDED:_** Set expectations for response time from owners.
- Reviews can be run multiple times, maintaining a historical record for each instance. See the
- [Reviews Overview](/docs/auditor/10.7/accessreviews/entitlementreviews/overview.md) topic for additional
- information.
+Reviews can be run multiple times, maintaining a historical record for each instance. See the
+[Reviews Overview](/docs/auditor/10.7/accessreviews/entitlementreviews/overview.md) topic for additional
+information.
diff --git a/docs/auditor/10.7/accessreviews/admin/additionalconfig/emailtemplates.md b/docs/auditor/10.7/accessreviews/admin/additionalconfig/emailtemplates.md
index 78d013597c..adde83011f 100644
--- a/docs/auditor/10.7/accessreviews/admin/additionalconfig/emailtemplates.md
+++ b/docs/auditor/10.7/accessreviews/admin/additionalconfig/emailtemplates.md
@@ -27,7 +27,7 @@ Substitution Tokens are only valid for certain Notification message templates. B
the Substitution Tokens, the value or string they represent, and the message templates in which they
may be used.
-| Substitution Token | Description | Applicable Template(s) |
+| Substitution Token | Description | Applicable Templates |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
| @LoginUrl@ | URL that allows a user to access the default (login) page | OwnershipChangeNotification ReminderDigest |
| @ResourceDescription@ | Description of resource - To use the resource's description in emails instead of the path, replace @ResourcePath@ with @ResourceDescription@ | OwnershipConfirm ReminderDigest |
@@ -43,16 +43,15 @@ Email templates are shipped in a ZIP file and stored in the Access Reviews insta
...\Netwrix\Access Reviews
-Follow the steps to customize the email templates.
**NOTE:** To successfully modify these Notifications email templates, a familiarity with basic HTML
is necessary.
-**Step 1 –** Navigate to the Access Reviews installation directory.
+1. Navigate to the Access Reviews installation directory.
-**Step 2 –** Unzip the `Templates.zip` file and save the contents to a folder within this directory
+2. Unzip the `Templates.zip` file and save the contents to a folder within this directory
named `Templates`.
**CAUTION:** The customized email templates must be in the `Templates` folder within the
@@ -60,20 +59,20 @@ installation directory to be preserved during future application upgrades.
-**Step 3 –** Locate the desired HTML message template.
+3. Locate the HTML message template.
-**Step 4 –** Open the file with a text editor, e.g. Notepad, and customize the email body.
+4. Open the file with a text editor, e.g. Notepad, and customize the email body.
**NOTE:** Using a tool other than a text editor to edit HTML files, such as a WYSIWYG web page
-editor which may drastically alter the underlying HTML code, is not supported.
+editor which may drastically alter the underlying HTML code, isn't supported.
-**Step 5 –** Email subject lines can be edited by changing the text between the opening ``
+5. Email subject lines can be edited by changing the text between the opening `<title>`
tag and the closing `` tag.
-**Step 6 –** After making changes, save the file and view it within a web browser to see what the
+6. After making changes, save the file and view it within a web browser to see what the
changes will look like. The Substitution Tokens will display without supplied values.
-**Step 7 –** After making the desired changes, save and close the text editor. Then re-launch the
+7. After making the changes, save and close the text editor. Then re-launch the
application.
The modifications to the HTML email templates are in use by the notification emails.
diff --git a/docs/auditor/10.7/accessreviews/admin/additionalconfig/timeoutparameter.md b/docs/auditor/10.7/accessreviews/admin/additionalconfig/timeoutparameter.md
index 25b9fef5ae..362c60217e 100644
--- a/docs/auditor/10.7/accessreviews/admin/additionalconfig/timeoutparameter.md
+++ b/docs/auditor/10.7/accessreviews/admin/additionalconfig/timeoutparameter.md
@@ -14,19 +14,18 @@ the Access Reviews installation directory:
...\Netwrix\Access Reviews
-Follow the steps to modify the timeout parameter.
-**Step 1 –** Open the `AccessInformationCenter.Service.exe.Config` file with a text editor, e.g.
+1. Open the `AccessInformationCenter.Service.exe.Config` file with a text editor, e.g.
Notepad.
-**Step 2 –** Change the value for the `AuthSessionTimeout` parameter to the desired number of
+2. Change the value for the `AuthSessionTimeout` parameter to the number of
minutes. For example:
-**Step 3 –** Save and close the file.
+3. Save and close the file.
A user session times out after the number of minutes specified for inactivity, for example after 20
minutes.
diff --git a/docs/auditor/10.7/accessreviews/admin/configuration/activedirectory.md b/docs/auditor/10.7/accessreviews/admin/configuration/activedirectory.md
index 9f697ae791..6c92432b91 100644
--- a/docs/auditor/10.7/accessreviews/admin/configuration/activedirectory.md
+++ b/docs/auditor/10.7/accessreviews/admin/configuration/activedirectory.md
@@ -41,11 +41,10 @@ _Remember,_ click **Save** when any changes are made to this page.
## Update the Active Directory Service Account Password
-Follow the steps to update the Active Directory service account password. These steps only apply for
the **Use the following Active Directory account** option.
-**Step 1 –** On the Active Directory page, enter the new password in the correct field.
+1. On the Active Directory page, enter the new password in the correct field.
-**Step 2 –** Click **Save**. Then click **OK** to confirm.
+2. Click **Save**. Then click **OK** to confirm.
The Active Directory service account password has been updated.
diff --git a/docs/auditor/10.7/accessreviews/admin/configuration/consoleaccess.md b/docs/auditor/10.7/accessreviews/admin/configuration/consoleaccess.md
index 837efa562c..5c883f6cbc 100644
--- a/docs/auditor/10.7/accessreviews/admin/configuration/consoleaccess.md
+++ b/docs/auditor/10.7/accessreviews/admin/configuration/consoleaccess.md
@@ -20,40 +20,39 @@ There are two levels of access, or roles, which can be granted to domain users o
has created.
- Access can be limited by resource types (File System, SharePoint, or Active Directory)
-**CAUTION:** Before disabling the Builtin Administrator account, it is necessary to first assign at
+**CAUTION:** Before disabling the Builtin Administrator account, first assign at
least one domain user account to the Administrator role. Login with another Administrator account to
disable the Builtin Administrator. Failure to do this could result in being locked-out of the
Configuration interface. As an alternative to disabling this account, the password can be changed.
See the Modify the Builtin Administrator Account topic for additional information.
Once users have been granted console access, they can login with their domain credentials. Console
-access is not a requirement for owners to complete Access Reviews. See the
+access isn't a requirement for owners to complete Access Reviews. See the
[URL & Login](/docs/auditor/10.7/accessreviews/admin/login.md) topic for information on how users will log in and where they are
directed after login based on their assigned role or lack of role.
## Add Console Users
-Follow the steps to grant domain users or groups console access.
-**Step 1 –** In the Configuration interface on the Console Access page, click Add. The Console
+1. In the Configuration interface on the Console Access page, click Add. The Console
Access wizard opens.
-**Step 2 –** On the Select Trustee page, enter the following information and click Next:
+2. On the Select Trustee page, enter the following information and click Next:
-- Domain — If the Access Reviews Console has been configured for multiple domains, use the drop-down
- menu to select the desired domain
+- Domain — If the Access Reviews Console has been configured for multiple domains, use the dropdown
+ menu to select the domain
- Search — Begin typing the sAMAccountName or display name and the field will auto-populate options
from Active Directory sAMAccountName
-**Step 3 –** On the Select Access page, enter the following information and click **Finish**:
+3. On the Select Access page, enter the following information and click **Finish**:
-- Select a role for this trustee – Select a role from the drop down list:
+- Select a role for this trustee – Select a role from the dropdown list:
- Unlimited Access — The Administrator role grants unlimited access
- Limited Access — All other roles can be granted limited access
@@ -61,34 +60,33 @@ Access wizard opens.
- Allow access to the following resource — When enabled, users can be limited to only having
visibility into data for the selected types of resources. Check the boxes for the type of resource
data to be made available to this user.
-- Access is enabled – A user's account must be enabled in order to log into the console. Unchecking
- this option allows you to configure access to be granted at a future time.
+- Access is enabled – A user's account must be enabled to log into the console. Unchecking
+ this option lets you configure access to be granted at a future time.
-**Step 4 –** The new user displays in the list on the Console Access page. Repeat these steps for
+4. The new user displays in the list on the Console Access page. Repeat these steps for
each trustee to be granted console access.
-Once the first user with the role of Administrator has been added, the Builtin Administrator account
+After the first user with the role of Administrator has been added, the Builtin Administrator account
can be disabled by that user. See the Modify the Builtin Administrator Account topic for additional
information.
## Modify Console Users
-Follow the steps to modify a user’s console access.
-**NOTE:** These steps are for modifying domain users with console access roles and do not apply to
+**NOTE:** These steps are for modifying domain users with console access roles and don't apply to
the Builtin Administrator account. See the Modify the Builtin Administrator Account topic for
additional information.
-**Step 1 –** In the Configuration interface on the Console Access page, select the user to be
+1. In the Configuration interface on the Console Access page, select the user to be
modified and click Modify. The Console Access wizard opens to the Select Access page.
-**Step 2 –** Modify the desired settings and click **Finish**:
+2. Modify the settings and click **Finish**:
-- Select a role for this trustee – Select a role from the drop down list:
+- Select a role for this trustee – Select a role from the dropdown list:
- Unlimited Access — The Administrator role grants unlimited access
- Limited Access — All other roles can be granted limited access
@@ -100,40 +98,38 @@ modified and click Modify. The Console Access wizard opens to the Select Access
visibility into data for specific servers. Begin typing server names and the field will
auto-populate with known servers from scanned data. A resource type appears in parentheses after
the host name for quick reference.
-- Access is enabled – A user's account must be enabled in order to log into the console. Unchecking
- this option allows you to configure access to be granted at a future time.
+- Access is enabled – A user's account must be enabled to log into the console. Unchecking
+ this option lets you configure access to be granted at a future time.
Any modifications to the user’s role are visible in the list on the Console Access page.
## Delete Console Users
-**CAUTION:** Confirmation is not requested when deleting users. An alternative to deleting a console
+**CAUTION:** Confirmation isn't requested when deleting users. An alternative to deleting a console
user is to disable their access. See the Modify Console Users topic for additional information.
-Follow the steps to remove a user’s configured console access.
-**Step 1 –** In the Configuration interface on the Console Access page, select the user.
+1. In the Configuration interface on the Console Access page, select the user.
-**Step 2 –** Click Remove.
+2. Click Remove.
The user is removed from the list on the Console Access page.
## Modify the Builtin Administrator Account
-The Builtin Administrator account can be disabled or its password can be changed. Follow the steps
-to modify this account.
+Disable or change the password for the Builtin Administrator account.
-**Step 1 –** In the Configuration interface on the Console Access page, select the Builtin
+1. In the Configuration interface on the Console Access page, select the Builtin
Administrator account and click **Modify**. The Builtin Administrator window opens.
-**Step 2 –** Modify the account as desired and click **OK**:
+2. Modify the account as needed and click **OK**:
-- Access is enabled — Indicates whether the account can be used to login
-- Change Password — Allows you to change the password for this Builtin Administrator account. Check
+- Access is enabled — Indicates whether the account is enabled for login
+- Change Password — Lets you change the password for this Builtin Administrator account. Check
the box and enter the new password in both entry fields. The password must be eight or more
characters long.
diff --git a/docs/auditor/10.7/accessreviews/admin/configuration/database.md b/docs/auditor/10.7/accessreviews/admin/configuration/database.md
index 09d7654a58..30305e12a2 100644
--- a/docs/auditor/10.7/accessreviews/admin/configuration/database.md
+++ b/docs/auditor/10.7/accessreviews/admin/configuration/database.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Database Page
The Access Reviews application must have access to the SQL Server hosting the database. It is
-configured during installation. If it is necessary to modify these setting after installation, that
+configured during installation. If modify these setting after installation, that
is done on the Database Page of the Configuration interface.
@@ -45,11 +45,10 @@ _Remember,_ click **Save** when any changes are made to this page.
## Update the Database Service Account Password
-Follow the steps to update the Database service account password. These steps only apply for the SQL
Authentication option.
-**Step 1 –** On the Database page, enter the new password in the correct field.
+1. On the Database page, enter the new password in the correct field.
-**Step 2 –** Click **Save**. Then click **OK** to confirm.
+2. Click **Save**. Then click **OK** to confirm.
The Database service account password has been updated.
diff --git a/docs/auditor/10.7/accessreviews/admin/configuration/diagnostics.md b/docs/auditor/10.7/accessreviews/admin/configuration/diagnostics.md
index bd7ec27de8..6697bc7c30 100644
--- a/docs/auditor/10.7/accessreviews/admin/configuration/diagnostics.md
+++ b/docs/auditor/10.7/accessreviews/admin/configuration/diagnostics.md
@@ -16,17 +16,16 @@ download the archive of all application logs.
## Debug Logs
-When requested by [Netwrix Support](https://www.netwrix.com/support.html) , follow the steps to
-provide debug logs.
+When requested by [Netwrix Support](https://www.netwrix.com/support.html), provide debug logs.
-**Step 1 –** On the Diagnostics page, check the Enable debug logging box.
+1. On the Diagnostics page, check the Enable debug logging box.
-**Step 2 –** Click **Save**.
+2. Click **Save**.
-**Step 3 –** Reproduce the issue you are having.
+3. Reproduce the issue you are having.
-**Step 4 –** On the Diagnostics page, click **Download Logs**.
+4. On the Diagnostics page, click **Download Logs**.
The downloaded logs have the debug logging information and can be sent to
-[Netwrix Support](https://www.netwrix.com/support.html). When your issue is resolved, do not forget
+[Netwrix Support](https://www.netwrix.com/support.html). When your issue is resolved, don't forget
to turn off Debug logs.
diff --git a/docs/auditor/10.7/accessreviews/admin/configuration/notifications.md b/docs/auditor/10.7/accessreviews/admin/configuration/notifications.md
index ac1c99dcc8..0ef71e3ac5 100644
--- a/docs/auditor/10.7/accessreviews/admin/configuration/notifications.md
+++ b/docs/auditor/10.7/accessreviews/admin/configuration/notifications.md
@@ -18,24 +18,23 @@ for configuring weekly reminders for owners with outstanding reviews.
## Configure SMTP Server Settings
-SMTP server information is supplied and modified on the Notifications page. Follow the steps to
-configure or modify the SMTP settings.
+Configure or modify the SMTP settings on the Notifications page.
-**Step 1 –** In the Configuration interface, select the Notifications page.
+1. In the Configuration interface, select the Notifications page.
-**Step 2 –** Enter the SMTP Server Name in the textbox. This should be the fully qualified domain
+2. Enter the SMTP Server Name in the textbox. This should be the fully qualified domain
name (mail.example.com) or IP Address.
-**Step 3 –** If needed, modify the Port used by your SMTP server to listen for new messages.
+3. If needed, modify the Port used by your SMTP server to listen for new messages.
Historically, the default for SMTP has been port 25. However, if a secure connection is desired
(SSL/TLS), the SMTPS port needs to be changed, traditionally 465. Alternately, environments with
off-premises or outsourced email service, e.g. gmail.com, hotmail.com, etc., may have to supply a
different submission port, traditionally port 587. Ultimately it is an organization’s
email/messaging administrator who will know the proper value for the SMTP port.
-**Step 4 –** SMTP security settings:
+4. SMTP security settings:
- Use a secure connection for this server (SSL/TLS) – Allows for the use of a secure transport layer
for message relay requests (submissions) and authentication requests
@@ -62,23 +61,23 @@ email/messaging administrator who will know the proper value for the SMTP port.
-**Step 5 –** Click **Test Settings** to ensure a connection to the SMTP server. The Test Settings
+5. Click **Test Settings** to ensure a connection to the SMTP server. The Test Settings
window opens. Enter a valid email address and click **OK**.
-**Step 6 –** If the SMTP settings are configured correctly, you receive a successful message. Click
+6. If the SMTP settings are configured correctly, you receive a successful message. Click
**OK** to close the Testing your settings window. The test recipient should have recieved a test
email.
-**Step 7 –** Click **Save**. Then click **OK** to confirm.
+7. Click **Save**. Then click **OK** to confirm.
The Access Reviews Console is now configured to send email. See the following topics for additional
Notification options.
## Notification Options
-Once the SMTP server is configured, there are additional options. Only the Reply-To field must be
+After the SMTP server is configured, there are additional options. Only the Reply-To field must be
populated:
@@ -104,18 +103,18 @@ steps to configure weekly reminders to resource owners.
-**Step 1 –** In the Configuration interface, select the Notifications page and scroll down to the
+1. In the Configuration interface, select the Notifications page and scroll down to the
Reminders section.
-**Step 2 –** Check the Send reminders to owners with pending events option.
+2. Check the Send reminders to owners with pending events option.
-**Step 3 –** Set the date and time for when the reminder will be sent:
+3. Set the date and time for when the reminder will be sent:
-- Day of the week – Select the day of the week from the drop-down menu
-- Time of day – Click on the field to open a clock window. Set the time of day reminders will be
+- Day of the week – Select the day of the week from the dropdown menu
+- Time of day – Click the field to open a clock window. Set the time of day reminders will be
sent, e.g. 12:00 AM
-**Step 4 –** Click **Save**. Then click **OK** to confirm.
+4. Click **Save**. Then click **OK** to confirm.
Assigned resource owners now receive weekly reminders of pending events. The **Notifications were
last sent on** field will populate with the date timestamp for when the last set of reminders were
diff --git a/docs/auditor/10.7/accessreviews/admin/firstlaunch.md b/docs/auditor/10.7/accessreviews/admin/firstlaunch.md
index 807bc2112f..25cfd2ca96 100644
--- a/docs/auditor/10.7/accessreviews/admin/firstlaunch.md
+++ b/docs/auditor/10.7/accessreviews/admin/firstlaunch.md
@@ -31,7 +31,7 @@ access for domain users and configure notification settings. Select the Configur
[Console Access Page](/docs/auditor/10.7/accessreviews/admin/configuration/consoleaccess.md) and
[Notifications Page](/docs/auditor/10.7/accessreviews/admin/configuration/notifications.md) topics for additional information.
-The interfaces available to console users are controlled by the role assigned. Owners do not need to
+The interfaces available to console users are controlled by the role assigned. Owners don't need to
be assigned console access. See the [URL & Login](/docs/auditor/10.7/accessreviews/admin/login.md) topic for information on how users will
log in and where they are directed after login.
diff --git a/docs/auditor/10.7/accessreviews/admin/login.md b/docs/auditor/10.7/accessreviews/admin/login.md
index 750d91e6e2..ea9dddd81f 100644
--- a/docs/auditor/10.7/accessreviews/admin/login.md
+++ b/docs/auditor/10.7/accessreviews/admin/login.md
@@ -27,7 +27,7 @@ the application in their default browser. Alternatively, the localhost URL can b
Remote Access
-Since Access Reviews is a browser-based application, it is possible to access the web interface
+Since Access Reviews is a browser-based application, access the web interface
remotely. It is up to the Administrator to provide users with the correct URL for access.
Depending on your network environment, you may need to use the NetBIOS name, FQDN, or IP Address of
diff --git a/docs/auditor/10.7/accessreviews/admin/navigate/datagrid.md b/docs/auditor/10.7/accessreviews/admin/navigate/datagrid.md
index aa531608c8..e234b0999a 100644
--- a/docs/auditor/10.7/accessreviews/admin/navigate/datagrid.md
+++ b/docs/auditor/10.7/accessreviews/admin/navigate/datagrid.md
@@ -10,7 +10,7 @@ The data grids within various tables have several features to improve your exper
## Search & Filter
-There is a Search box above a table's header row that can be used to filter the table data.
+There is a Search box above a table's header row that Use this to filter the table data.
@@ -18,7 +18,7 @@ Begin typing in the Search box. The filter acts as a wildcard, filtering the tab
## Column Filters
-There is a filter icon to the right of each column name that can be used to apply a column specific
+There is a filter icon to the right of each column name that Use this to apply a column specific
filter. You can apply filters to multiple columns simultaneously.
@@ -40,7 +40,7 @@ Table column widths can be resized to change the width.
-Simply select the edges of the column headers and drag to the desired width.
+Simply select the edges of the column headers and drag to the width.
## Sort
@@ -48,13 +48,13 @@ Data within a table can be sorted alphanumerically for a column.
-Click on any column header. An arrow will appear next to the column name indicating the sort to be
+Click any column header. An arrow will appear next to the column name indicating the sort to be
ascending or descending order.
## Columns Selector
Columns can be hidden or unhidden. Available columns for a table are listed in the column selector
-menu that appears when you right-click on a column header.
+menu that appears when you right-click a column header.
@@ -63,8 +63,8 @@ Unchecked columns are hidden.
## Exports
-There are two export buttons above a table's header row that can be used to export the data
-currently displayed within the table.
+There are two export buttons above a table's header row that Use this to export the data
+displayed within the table.
diff --git a/docs/auditor/10.7/accessreviews/admin/navigate/editnotes.md b/docs/auditor/10.7/accessreviews/admin/navigate/editnotes.md
index e58e9797e9..a52856d451 100644
--- a/docs/auditor/10.7/accessreviews/admin/navigate/editnotes.md
+++ b/docs/auditor/10.7/accessreviews/admin/navigate/editnotes.md
@@ -6,15 +6,14 @@ sidebar_position: 20
# Edit Notes Window
-The Edit Note window can be opened from a variety of interfaces. Follow the steps to add or edit a
-note.
+The Edit Note window can be opened from a variety of interfaces.
-**Step 1 –** Select the item in the interface and click Edit Notes. The Edit Notes window opens.
+1. Select the item in the interface and click Edit Notes. The Edit Notes window opens.
-**Step 2 –** Type or edit the note in the textbox.
+2. Type or edit the note in the textbox.
-**Step 3 –** Click OK when finished. The Edit Notes window closes.
+3. Click OK when finished. The Edit Notes window closes.
The user name and a date timestamp will appear at the beginning of each note added.
diff --git a/docs/auditor/10.7/accessreviews/admin/troubleshooting/loglevel.md b/docs/auditor/10.7/accessreviews/admin/troubleshooting/loglevel.md
index bf5b6f4118..98ea102a87 100644
--- a/docs/auditor/10.7/accessreviews/admin/troubleshooting/loglevel.md
+++ b/docs/auditor/10.7/accessreviews/admin/troubleshooting/loglevel.md
@@ -11,16 +11,15 @@ Reviews installation directory:
...\Netwrix\Access Reviews
-Follow the steps to modify the log level.
-**Step 1 –** Open the `AccessInformationCenter.Service.exe.Config` file in a text editor, e.g.
+1. Open the `AccessInformationCenter.Service.exe.Config` file in a text editor, e.g.
Notepad.
-**Step 2 –** The level value is set in the `LogLevel` parameter, where "2" is the default level. As
+2. The level value is set in the `LogLevel` parameter, where "2" is the default level. As
the logging level increases from 0 to 3, the types of information and level of detail included
-within the log file also increase. Change to the desired log level:
+within the log file also increase. Change to the log level:
@@ -31,7 +30,7 @@ within the log file also increase. Change to the desired log level:
- Debug logging can be enabled from the Diagnostics page of the Configuration interface
-**Step 3 –** Save and close the `AccessInformationCenter.Service.exe.Config` file.
+3. Save and close the `AccessInformationCenter.Service.exe.Config` file.
Once troubleshooting has finished, it is recommended to return the log level to the default level,
Info = 2, to prevent the log file from growing too large.
diff --git a/docs/auditor/10.7/accessreviews/admin/troubleshooting/overview.md b/docs/auditor/10.7/accessreviews/admin/troubleshooting/overview.md
index f48f2fc114..9e76440e02 100644
--- a/docs/auditor/10.7/accessreviews/admin/troubleshooting/overview.md
+++ b/docs/auditor/10.7/accessreviews/admin/troubleshooting/overview.md
@@ -15,7 +15,7 @@ Configuration of Permissions on the Installation Directory:
The Windows service account running the Netwrix Auditor Access Reviews service may be used as the
Database service account, the Active Directory service account, and/or the SMTP authentication
account. Check the Database, Active Directory, and Notification pages in the Configuration interface
-to confirm where the account is in use before modifying it to ensure these functionality are not
+to confirm where the account is in use before modifying it to ensure these functionality aren't
impaired. If this account is changed, a new account must have the **Full Control** permission to
files and folders in the Access Reviews installation directory. See the
[Application Service Account](/docs/auditor/10.7/accessreviews/admin/troubleshooting/serviceaccount.md) topic for additional information.
diff --git a/docs/auditor/10.7/accessreviews/admin/troubleshooting/serviceaccount.md b/docs/auditor/10.7/accessreviews/admin/troubleshooting/serviceaccount.md
index d67ab2718e..434e5e251d 100644
--- a/docs/auditor/10.7/accessreviews/admin/troubleshooting/serviceaccount.md
+++ b/docs/auditor/10.7/accessreviews/admin/troubleshooting/serviceaccount.md
@@ -9,7 +9,7 @@ sidebar_position: 20
The Windows service account running the Netwrix Auditor Access Reviews service may be used as the
Database service account, the Active Directory service account, and/or the SMTP authentication
account. Check the Database, Active Directory, and Notification pages in the Configuration interface
-to confirm where the account is in use before modifying it to ensure these functionality are not
+to confirm where the account is in use before modifying it to ensure these functionality aren't
impaired. If the same account is being used for multiple purposes, it will require the proper
permissions for each purpose.
@@ -24,25 +24,24 @@ Control over the installation directory:
## Modify the Service Account via Service Control Manager
-Follow the steps to enable and/or modify the Windows service account running the Netwrix Auditor
Access Reviews service.
-**Step 1 –** Navigate to Service Control Manager (`services.msc`). The Services Control Manager
+1. Navigate to Service Control Manager (`services.msc`). The Services Control Manager
opens.
-**Step 2 –** Right-click on the Netwrix Auditor Access Reviews service and select **Properties**.
+2. Right-click the Netwrix Auditor Access Reviews service and select **Properties**.
The service Properties window opens.
-**Step 3 –** On the **Log On** tab, select the **This account** radio button. Enter the account name
+3. On the **Log On** tab, select the **This account** radio button. Enter the account name
using NTAccount format [```DOMAIN\username```]. Optionally, use the **Browse** button to search for
the account. Enter the account's password in both the **Password** and **Confirm password** fields.
Then click **OK**. The Properties window closes.
-**Step 4 –** The selected account is displayed in the Log On As column for the service. Either
+4. The selected account is displayed in the Log On As column for the service. Either
Restart or Stop and Start the service for this change to take affect.
The Netwrix Auditor Access Reviews service is now running with the supplied Windows account.
diff --git a/docs/auditor/10.7/accessreviews/entitlementreviews/approvalprocess/approvalprocess.md b/docs/auditor/10.7/accessreviews/entitlementreviews/approvalprocess/approvalprocess.md
index 9384b1a312..24429d1f1b 100644
--- a/docs/auditor/10.7/accessreviews/entitlementreviews/approvalprocess/approvalprocess.md
+++ b/docs/auditor/10.7/accessreviews/entitlementreviews/approvalprocess/approvalprocess.md
@@ -20,59 +20,57 @@ decline, or defer all owner-recommended changes for a review.
## Process Owner Responses
-Follow the steps to perform a granular review of a resource owner's recommended changes.
-**Step 1 –** On the Manage Reviews page, select a review and click **View Details**. The Review
+1. On the Manage Reviews page, select a review and click **View Details**. The Review
Details page opens.
-**Step 2 –** Select a resource in the list and click **View Responses**. The View Responses window
+2. Select a resource in the list and click **View Responses**. The View Responses window
opens.
-**Step 3 –** By default, the table displays only the recommended changes. Select an item and click
-the desired action button: Accept, Decline, or Defer. The Approval column icon updates. See the
+3. By default, the table displays only the recommended changes. Select an item and click
+the action button: Accept, Decline, or Defer. The Approval column icon updates. See the
[View Responses Window](/docs/auditor/10.7/accessreviews/entitlementreviews/interface/viewresponses.md) topic for additional information.
-**Step 4 –** Repeat Step 3 until all changes have been processed. Then click **Close**. The View
+4. Repeat Step 3 until all changes have been processed. Then click **Close**. The View
Responses window closes.
-**Step 5 –** Repeat Steps 2-4 for each resource included in the review.
+5. Repeat Steps 2-4 for each resource included in the review.
-**Step 6 –** Remediation of the accepted changes must be done manually. Accepted changes must be
+6. Remediation of the accepted changes must be done manually. Accepted changes must be
implemented outside of the application by your IT department. Use the **Export Excel** or **Export
CSV** buttons to generate and download an export of accepted changes.
-**Step 7 –** When remediation is complete, return to the Mange Reviews page (click on the
+7. When remediation is complete, return to the Mange Reviews page (click the
breadcrumb). Select the review in the list and click **Mark Completed**.
The review remains marked as Completed until the next instance is started.
## Batch Processing
-Follow the steps to perform a batch processing of a resource owner's recommended changes.
-**Step 1 –** On the Manage Reviews page, select a review and click **View Details**. The Review
+1. On the Manage Reviews page, select a review and click **View Details**. The Review
Details page opens. .
-**Step 2 –** Select a resource in the list and open the **Process Changes** drop-down menu.
+2. Select a resource in the list and open the **Process Changes** dropdown menu.
-**Step 3 –** Select the desired action for all recommended changes: Accept, Decline, or Defer.
+3. Select the action for all recommended changes: Accept, Decline, or Defer.
_Remember,_ all recommended changes for the selected resource will be processed with the same
resolution.
-**Step 4 –** Repeat Steps 2-3 for each resource included in the review.
+4. Repeat Steps 2-3 for each resource included in the review.
-**Step 5 –** Remediation of the accepted changes must be done manually. Accepted changes must be
+5. Remediation of the accepted changes must be done manually. Accepted changes must be
implemented outside of the application by your IT department. Use the **Export Excel** or **Export
CSV** buttons to generate and download an export of accepted changes.
-**Step 6 –** When remediation is complete, return to the Mange Reviews page (click on the
+6. When remediation is complete, return to the Mange Reviews page (click the
breadcrumb). Select the review in the list and click **Mark Completed**.
The review remains marked as Completed until the next instance is started.
diff --git a/docs/auditor/10.7/accessreviews/entitlementreviews/approvalprocess/removechanges.md b/docs/auditor/10.7/accessreviews/entitlementreviews/approvalprocess/removechanges.md
index c5066eb0cf..f5742a8fb2 100644
--- a/docs/auditor/10.7/accessreviews/entitlementreviews/approvalprocess/removechanges.md
+++ b/docs/auditor/10.7/accessreviews/entitlementreviews/approvalprocess/removechanges.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Remove Changes Window
-Select the desired resource on a Review Details page and click **Remove Changes**. The Remove
+Select the resource on a Review Details page and click **Remove Changes**. The Remove
changes window opens to confirm the action.
diff --git a/docs/auditor/10.7/accessreviews/entitlementreviews/create/create.md b/docs/auditor/10.7/accessreviews/entitlementreviews/create/create.md
index 8d041ebf30..17349dcb6d 100644
--- a/docs/auditor/10.7/accessreviews/entitlementreviews/create/create.md
+++ b/docs/auditor/10.7/accessreviews/entitlementreviews/create/create.md
@@ -32,13 +32,12 @@ See the Create a Review topic for additional information.
## Create a Review
-Follow the steps to create a review.
-**Step 1 –** On the Manage Reviews page, click Create. The Create Review wizard opens.
+1. On the Manage Reviews page, click Create. The Create Review wizard opens.
-**Step 2 –** On the Review Type page, provide the following information and click **Next**:
+2. On the Review Type page, provide the following information and click **Next**:
- Review Name — Enter a unique, descriptive name for the review. The review name is only visible to
Review Administrators.
@@ -50,7 +49,7 @@ Follow the steps to create a review.
-**Step 3 –** On the Resources page, select the resources to be included in the review. The Search
+3. On the Resources page, select the resources to be included in the review. The Search
feature is available to filter the list of available resource that match the type of review being
created.
@@ -62,27 +61,27 @@ created.
- Description — Description or explanation of the resource as supplied by either the Ownership
Administrator or the assigned owner
- Reviewer — Primary owner assigned to the resource
- - Confirmed — Indicates whether or not the assigned owner has confirmed ownership of that
+ - Confirmed — Indicates whether the assigned owner has confirmed ownership of that
resource. Tool-tips display when hovering over the icons indicating whether the resource
ownership has been confirmed, declined, pending response, or that a confirmation has not been
requested.
- Scan Data — A checkmark indicates the resource has been scanned. Only resources with scan data
can be included in a review.
-- Select the desired resource(s) and click **Add**. The **View Selections** button indicates how
+- Select the resources and click **Add**. The **View Selections** button indicates how
many resources have been selected. Click the button to open the Selected Resources window, where
you can view and modify the selections. See the
[Selected Resources Window](/docs/auditor/10.7/accessreviews/entitlementreviews/interface/selectedresources.md) topic for additional information.
-- Once the desired resources have been selected, click **Next**.
+- After the resources have been selected, click **Next**.
-**Step 4 –** On the Summary page, review the settings and click Finish. The Access Reviews begins to
+4. On the Summary page, review the settings and click Finish. The Access Reviews begins to
create the review. Action status displays on the page. When the update has completed (100%), click
Close. The Create Review wizard closes.
The new review displays in the table on the Manage Reviews page. An email was sent to the primary
-owner assigned to the resource(s) in this review. By default, the application is configured to send
+owner assigned to the resources in this review. By default, the application is configured to send
notifications only to the primary owner. However, this can be customized on the Configuration >
Notifications page to send notifications to all assigned owners. See the
[Notifications Page](/docs/auditor/10.7/accessreviews/admin/configuration/notifications.md) topic for additional information.
diff --git a/docs/auditor/10.7/accessreviews/entitlementreviews/create/reviewinstances.md b/docs/auditor/10.7/accessreviews/entitlementreviews/create/reviewinstances.md
index 9b2131d8e6..17943daa1c 100644
--- a/docs/auditor/10.7/accessreviews/entitlementreviews/create/reviewinstances.md
+++ b/docs/auditor/10.7/accessreviews/entitlementreviews/create/reviewinstances.md
@@ -9,7 +9,7 @@ sidebar_position: 10
After a review has been completed, it can be run again, which creates multiple instances of the
review. Each instance is identified by date timestamps indicating its start and end times.
-**_RECOMMENDED:_** Prior to running another review instance, ensure the most up to date information
+**_RECOMMENDED:_** Before running another review instance, ensure the most up to date information
is available to owners for review.
diff --git a/docs/auditor/10.7/accessreviews/entitlementreviews/interface/deletereview.md b/docs/auditor/10.7/accessreviews/entitlementreviews/interface/deletereview.md
index b06577809e..925a2fa75e 100644
--- a/docs/auditor/10.7/accessreviews/entitlementreviews/interface/deletereview.md
+++ b/docs/auditor/10.7/accessreviews/entitlementreviews/interface/deletereview.md
@@ -17,7 +17,7 @@ The Delete Review window opens from either the
## Delete Entire Review
-Select the desired review on the Manage Reviews page and click **Delete**. The Delete Review window
+Select the review on the Manage Reviews page and click **Delete**. The Delete Review window
opens to confirm the action.
@@ -29,7 +29,7 @@ Click **Yes** to complete the deletion. Click **No** to cancel it. The Delete Re
## Delete Review Instance
-Select the desired review instance from the drop-down menu on the Review Details page and click
+Select the review instance from the dropdown menu on the Review Details page and click
**Delete**. The Delete Review window opens to confirm the action.
diff --git a/docs/auditor/10.7/accessreviews/entitlementreviews/interface/renamereview.md b/docs/auditor/10.7/accessreviews/entitlementreviews/interface/renamereview.md
index 5464377854..e45625a523 100644
--- a/docs/auditor/10.7/accessreviews/entitlementreviews/interface/renamereview.md
+++ b/docs/auditor/10.7/accessreviews/entitlementreviews/interface/renamereview.md
@@ -7,14 +7,14 @@ sidebar_position: 20
# Rename Review Window
The Rename Review window opens from the [Manage Reviews Page](/docs/auditor/10.7/accessreviews/entitlementreviews/interface/interface.md#manage-reviews-page)
-of the Entitlement Reviews interface. Follow the steps to rename a review.
+of the Entitlement Reviews interface.
-**Step 1 –** Select the review and click **Rename**. The Rename Review window opens.
+1. Select the review and click **Rename**. The Rename Review window opens.
-**Step 2 –** Edit the review name in the textbox.
+2. Edit the review name in the textbox.
-**Step 3 –** Click **OK** when finished. The Rename Review window closes.
+3. Click **OK** when finished. The Rename Review window closes.
The renamed review will display in the table on the Manage Reviews page.
diff --git a/docs/auditor/10.7/accessreviews/entitlementreviews/interface/sendreminders.md b/docs/auditor/10.7/accessreviews/entitlementreviews/interface/sendreminders.md
index 2f17616c55..9b1a7c5e04 100644
--- a/docs/auditor/10.7/accessreviews/entitlementreviews/interface/sendreminders.md
+++ b/docs/auditor/10.7/accessreviews/entitlementreviews/interface/sendreminders.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Send Reminders Window
The Send Reminders window opens from the [Manage Reviews Page](/docs/auditor/10.7/accessreviews/entitlementreviews/interface/interface.md#manage-reviews-page)
-of the Entitlement Reviews interface. Select the desired active review(s) and click **Send
+of the Entitlement Reviews interface. Select the active reviews and click **Send
Reminders** to send immediate reminder notifications. The Send Reminders window opens to display an
action status.
diff --git a/docs/auditor/10.7/accessreviews/entitlementreviews/interface/stopreview.md b/docs/auditor/10.7/accessreviews/entitlementreviews/interface/stopreview.md
index 981e12a9d8..b9ac6e37ad 100644
--- a/docs/auditor/10.7/accessreviews/entitlementreviews/interface/stopreview.md
+++ b/docs/auditor/10.7/accessreviews/entitlementreviews/interface/stopreview.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# Stop Review Window
The Stop Review window opens from the [Manage Reviews Page](/docs/auditor/10.7/accessreviews/entitlementreviews/interface/interface.md#manage-reviews-page) of
-the Entitlement Reviews interface. Select the desired active review(s) and click **Stop**. The Stop
+the Entitlement Reviews interface. Select the active reviews and click **Stop**. The Stop
Review window opens to confirm the action.
diff --git a/docs/auditor/10.7/accessreviews/entitlementreviews/interface/viewresponses.md b/docs/auditor/10.7/accessreviews/entitlementreviews/interface/viewresponses.md
index 17d4bc972e..c116dc5b54 100644
--- a/docs/auditor/10.7/accessreviews/entitlementreviews/interface/viewresponses.md
+++ b/docs/auditor/10.7/accessreviews/entitlementreviews/interface/viewresponses.md
@@ -17,7 +17,7 @@ The information displayed in the table includes:
- Item Reviewed — Item upon which changes were suggested by the owner
- Current — Current state of the item at the time of the review
- Desired — Change suggested by the owner
-- Notes — Icon indicates a Note has been added. Click on the icon to read the attached note(s).
+- Notes — Icon indicates a Note has been added. Click the icon to read the attached notes.
- Approval — Status of the Review Administrator's approval
- Clock — Indicates waiting on the Review Administrator to make an official decision
diff --git a/docs/auditor/10.7/accessreviews/entitlementreviews/overview.md b/docs/auditor/10.7/accessreviews/entitlementreviews/overview.md
index 07e07b7f8d..132fea1f73 100644
--- a/docs/auditor/10.7/accessreviews/entitlementreviews/overview.md
+++ b/docs/auditor/10.7/accessreviews/entitlementreviews/overview.md
@@ -11,7 +11,7 @@ The Entitlement Reviews interface is where users with either the Security Team o
business users or data custodians (to be referred to as Owners) to attest to the access and
privileges users have to their resources.
-For the purpose of the Access Reviewsapplication, a “resource” refers to the file system shared
+to the Access Reviewsapplication, a “resource” refers to the file system shared
folders, SharePoint Online site collections, and Active Directory (AD) groups. All data available
within the Access Reviews application is collected by Netwrix Auditor according to the synchronized
monitoring plans.
@@ -65,7 +65,7 @@ Prerequisite:
Workflow:
**_RECOMMENDED:_** When deploying the Access Reviews application in an organization to process
-reviews, owners should be notified prior to launching the first set of reviews. See the
+reviews, owners should be notified before launching the first set of reviews. See the
[Notification to Owners](/docs/auditor/10.7/accessreviews/resourceowners/overview.md#notification-to-owners) topic for additional
information.
diff --git a/docs/auditor/10.7/accessreviews/installation/accessreviewsconfiguration.md b/docs/auditor/10.7/accessreviews/installation/accessreviewsconfiguration.md
index cd0b2c64c0..47d87b6e9b 100644
--- a/docs/auditor/10.7/accessreviews/installation/accessreviewsconfiguration.md
+++ b/docs/auditor/10.7/accessreviews/installation/accessreviewsconfiguration.md
@@ -18,19 +18,18 @@ You can configure Netwrix Auditor Access Reviews in two ways:
If you plan to use Access Reviews for multiple data sources, configure the settings to work with the
data sources that you select.
-Follow the steps to configure Access Reviews in the Netwrix Auditor.
-**Step 1 –** Go to **Settings > General > Access Reviews**.
+1. Go to **Settings > General > Access Reviews**.
-**Step 2 –** Click **Manage**.
+2. Click **Manage**.
-**Step 3 –** Select the desired data sources to review.
+3. Select the data sources to review.
-**Step 4 –** Click **Save**.
+4. Click **Save**.
Netwrix Auditor Access Reviews is configured and ready to use in the Netwrix Auditor.
@@ -39,18 +38,17 @@ Netwrix Auditor Access Reviews is configured and ready to use in the Netwrix Aud
If you plan to use Access Reviews for a specific monitoring plan, configure Access Reviews in that
monitoring plan.
-Follow the steps to configure Access Reviews in the Netwrix Auditor.
-**Step 1 –** Go to **Configuration > Monitoring plans**.
+1. Go to **Configuration > Monitoring plans**.
-**Step 2 –** Double click the desired monitoring plan.
+2. Double click the monitoring plan.
-**Step 3 –** Click **Edit data source** button on the left.
+3. Click **Edit data source** button on the left.
-**Step 4 –** Navigate to the Send data for Access Reviews and select the checkbox.
+4. Navigate to the Send data for Access Reviews and select the checkbox.
-**Step 5 –** Click **Save** or **Save & Close**.
+5. Click **Save** or **Save & Close**.
Netwrix Auditor Access Reviews is configured and ready to use in the Netwrix Auditor.
diff --git a/docs/auditor/10.7/accessreviews/installation/install.md b/docs/auditor/10.7/accessreviews/installation/install.md
index 6cf1df870d..9b0baafd96 100644
--- a/docs/auditor/10.7/accessreviews/installation/install.md
+++ b/docs/auditor/10.7/accessreviews/installation/install.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install
-Once the prerequisites have been met, follow the steps to install the Access Reviews application.
+After the prerequisites have been met, install the Access Reviews application.
**Step 1 –** Run the `AccessReviews.exe` executable, and the Netwrix Auditor Access Reviews Setup
wizard opens.
@@ -17,8 +17,8 @@ wizard opens.
-**Step 3 –** On the End-User License Agreement page, select the **I accept the terms in the License
-Agreement** checkbox and click **Next**.
+**Step 3 –** On the End-User License Agreement page, select the checkbox to accept the terms in the License
+Agreement, then click **Next**.
@@ -46,7 +46,7 @@ specific requirements for changing the path.
- Database — Enter the name of the database. By default, this is set to NetwrixAR.
-- Authentication – Select the Database service account type from the drop-down menu. Then enter the
+- Authentication – Select the Database service account type from the dropdown menu. Then enter the
account information in the **User Name** and **Password** fields.
- For Windows Authentication – **User Name** format must be `[DOMAIN]\[username]` , for example
`NWXTECH\ad.bruce`
@@ -54,7 +54,7 @@ specific requirements for changing the path.
**NOTE:** See the [Database Page](/docs/auditor/10.7/accessreviews/admin/configuration/database.md) topic for additional
information.
-
+
**Step 6 –** If there are no errors, you will be asked to confirm creation of the new database.
Click **Yes**.
@@ -73,7 +73,7 @@ field. When the port is set as desired, click **Next**.
-**Step 9 –** Once the installation has successfully completed, click **Finish** to exit the wizard.
+**Step 9 –** After the installation has successfully completed, click **Finish** to exit the wizard.
The installation wizard placed a Netwrix Auditor Access Reviews icon on the desktop. Now proceed to
the [First Launch](/docs/auditor/10.7/accessreviews/admin/firstlaunch.md) topic for next steps.
diff --git a/docs/auditor/10.7/accessreviews/installation/overview.md b/docs/auditor/10.7/accessreviews/installation/overview.md
index 216a4539e1..84e2d184f7 100644
--- a/docs/auditor/10.7/accessreviews/installation/overview.md
+++ b/docs/auditor/10.7/accessreviews/installation/overview.md
@@ -11,8 +11,8 @@ in a Microsoft® SQL® Server database. Netwrix Auditor must be installed and co
installing and using the Access Reviews application. The Access Reviews Configuration tool must be
used after installation to complete the integration of these products.
-**NOTE:** Access Reviews is a separately licensed product and is not included with Netwrix Auditor.
-Make sure that you have the Access Reviews license enabled in Auditor.
+**NOTE:** Access Reviews is a separately licensed product and isn't included with Netwrix Auditor.
+ensure that you have the Access Reviews license enabled in Auditor.
## Prerequisites
@@ -21,7 +21,7 @@ The Access Reviews application must be installed on the same server as Netwrix A
### Permissions
Permissions are needed to the Netwrix Auditor database and to Active Directory. This can be one
-account with sufficient rights to each or two separate accounts. For the purpose of this document,
+account with sufficient rights to each or two separate accounts. to this document,
these will be referred to as the Database service account and the Active Directory service account.
- Database service account – This is the same account used by Netwrix Auditor for a database service
diff --git a/docs/auditor/10.7/accessreviews/installation/secure.md b/docs/auditor/10.7/accessreviews/installation/secure.md
index 95129cc5b3..f949182de2 100644
--- a/docs/auditor/10.7/accessreviews/installation/secure.md
+++ b/docs/auditor/10.7/accessreviews/installation/secure.md
@@ -14,7 +14,7 @@ Infrastructure (PKI) and certificates. To continue with this configuration, it w
necessary to confer with the PKI administrator to determine which certificate method will conform to
the organization’s security policies.
-Follow the steps to enable SSL.
+## Enable SSL
**Step 1 –** Create an SSL Binding.
@@ -43,7 +43,7 @@ value and the certificate name:
dir cert:\localmachine\my
```
-Replace the environmental variables in the example script below. Then Run the PowerShell command to
+Replace the environmental variables in the example script below. Then run the PowerShell command to
create an SSL binding:
```powershell
@@ -58,8 +58,7 @@ The next step is to modify the `AccessInformationCenter.Service.exe.Config` file
## Modify the AccessInformationCenter.Service.exe.Config File
-Follow the steps to modify the Modify the `AccessInformationCenter.Service.exe.Config` file for
-HTTPS.
+Configure the `AccessInformationCenter.Service.exe.Config` file for HTTPS:
**Step 1 –** Open the `AccessInformationCenter.Service.exe.Config` file in a text editor, e.g.
Notepad. It is located in the installation directory:
diff --git a/docs/auditor/10.7/accessreviews/installation/upgrade.md b/docs/auditor/10.7/accessreviews/installation/upgrade.md
index 09250b8ab8..d3c86357aa 100644
--- a/docs/auditor/10.7/accessreviews/installation/upgrade.md
+++ b/docs/auditor/10.7/accessreviews/installation/upgrade.md
@@ -11,7 +11,7 @@ the Netwrix Auditor Access Reviews application, see the Special Considerations t
steps.
To upgrade the Access Reviews application to a newer version, simply run the new `AccessReviews.msi`
-executable. It is not necessary to uninstall the existing version. See the [Install](/docs/auditor/10.7/accessreviews/installation/install.md)
+executable. It isn't necessary to uninstall the existing version. See the [Install](/docs/auditor/10.7/accessreviews/installation/install.md)
topic for additional information.
_Remember,_ the Access Reviews version must align to the compatible Netwrix Auditor version.
@@ -39,8 +39,7 @@ When the installer is run over an existing version, the following is happening i
The originally released Netwrix Access Information Center has been rebranded to Netwrix Auditor
Access Reviews. This rebranding project included changing the installation directory, the name of
-the service, and the default name of the database created by the installer. Follow the steps to
-replace Netwrix Access Information Center with Netwrix Auditor Access Reviews.
+the service, and the default name of the database created by the installer.
**Step 1 –** Install the Netwrix Auditor Access Reviews application on the same server where the
Netwrix Access Information Center was installed. See the [Install](/docs/auditor/10.7/accessreviews/installation/install.md) topic for additional
diff --git a/docs/auditor/10.7/accessreviews/owneroverview/pendingreviews/access.md b/docs/auditor/10.7/accessreviews/owneroverview/pendingreviews/access.md
index 344964e08e..6fafeeaf0d 100644
--- a/docs/auditor/10.7/accessreviews/owneroverview/pendingreviews/access.md
+++ b/docs/auditor/10.7/accessreviews/owneroverview/pendingreviews/access.md
@@ -22,8 +22,8 @@ The table displays access information for the resource being reviewed:
- Access Level (Full Control, Modify, and Read) columns — Blue checkmark icon indicates current
access level
-**Step 2 –** Recommend access changes for a trustee by clicking the icon for the desired access
-level (Full Control, Modify, or Read columns). A yellow checkmark icon indicates the new level of
+**Step 2 –** Recommend access changes for a trustee by clicking the icon for the access level you
+want (Full Control, Modify, or Read columns). A yellow checkmark icon indicates the new level of
access you are recommending.
**Step 3 –** Recommend removing access by selecting one or more trustees and clicking the **Remove
diff --git a/docs/auditor/10.7/accessreviews/owneroverview/pendingreviews/membership.md b/docs/auditor/10.7/accessreviews/owneroverview/pendingreviews/membership.md
index c8025c7c40..6257d84b85 100644
--- a/docs/auditor/10.7/accessreviews/owneroverview/pendingreviews/membership.md
+++ b/docs/auditor/10.7/accessreviews/owneroverview/pendingreviews/membership.md
@@ -6,8 +6,7 @@ sidebar_position: 20
# Perform a Membership Review
-A Membership review is an evaluation of group membership. Follow the steps to perform a Membership
-review.
+A Membership review is an evaluation of group membership.
**Step 1 –** On the Pending Reviews page, select the resource with a pending Membership review and
click **Begin Review**. The Resource Review page opens to the 1 Make changes tab.
diff --git a/docs/auditor/10.7/accessreviews/owneroverview/pendingreviews/pendingreviews.md b/docs/auditor/10.7/accessreviews/owneroverview/pendingreviews/pendingreviews.md
index 04416a5ea5..172d1d15ae 100644
--- a/docs/auditor/10.7/accessreviews/owneroverview/pendingreviews/pendingreviews.md
+++ b/docs/auditor/10.7/accessreviews/owneroverview/pendingreviews/pendingreviews.md
@@ -73,8 +73,8 @@ features:
- Save Changes — Saves all recommended changes, enabling you to leave the review in progress and
return at a later time to complete it. It opens the Saving review window, which displays a status
for the action.
-- Remove Access — On the 1 Make changes tab, removes access from the selected trustees. Ctrl-click
- can be used for multi-select. Current access blue icon with a checkmark will turn to an empty
+- Remove Access — On the 1 Make changes tab, removes access from the selected trustees. Hold Ctrl
+ and click to select multiple items. Current access blue icon with a checkmark will turn to an empty
yellow icon.
- Only show changes since last review — Scopes the table to only display those items that have been
modified since the last review instance
diff --git a/docs/auditor/10.7/accessreviews/resourceowners/confirmation/confirm.md b/docs/auditor/10.7/accessreviews/resourceowners/confirmation/confirm.md
index 2b95ca9b16..5d8f4589c4 100644
--- a/docs/auditor/10.7/accessreviews/resourceowners/confirmation/confirm.md
+++ b/docs/auditor/10.7/accessreviews/resourceowners/confirmation/confirm.md
@@ -13,27 +13,25 @@ Owners interface. It can be opened for one or multiple resources.
It contains one page:
-- 1. Select Owners — Lists the current owner(s) for each selected resource and confirmation status
+- 1. Select Owners — Lists the current owners for each selected resource and confirmation status
## Request Ownership Confirmation
-Follow the steps to request ownership confirmation.
-
-**Step 1 –** In the Resource Owners interface, select the desired resource or resources and click
+**Step 1 –** In the Resource Owners interface, select the resource or resources you want and click
Request Confirmation. The Confirm Ownership wizard opens.
-**Step 2 –** On the Select Owners page, you can optionally remove owners you do not want or need
+**Step 2 –** On the Select Owners page, you can optionally remove owners you don't want or need
ownership confirmation from. Select those owners and click **Remove**. Those owners will not receive
-the confirmation email. Once the list is set as desired, click **Finish**. The Access Reviews
+the confirmation email. After the list is set as desired, click **Finish**. The Access Reviews
application begins to send the confirmation email. The table provides the following information:
- Resource Name — The icon indicates the type of resource. The resource name includes its location,
such as the UNC path for a file system resource, the URL for SharePoint resource, or Group name
(e.g., [Domain]\[Group]).
- Owner Name — Name of the assigned owner
-- Confirmed — Indicates whether or not the assigned owner has confirmed ownership of that resource.
+- Confirmed — Indicates whether the assigned owner has confirmed ownership of that resource.
Tool-tips display when hovering over the icons indicating whether the resource ownership has been
confirmed, declined, pending response, or that a confirmation has not been requested.
diff --git a/docs/auditor/10.7/accessreviews/resourceowners/confirmation/confirmation.md b/docs/auditor/10.7/accessreviews/resourceowners/confirmation/confirmation.md
index ed9c54c298..0c53dc9d78 100644
--- a/docs/auditor/10.7/accessreviews/resourceowners/confirmation/confirmation.md
+++ b/docs/auditor/10.7/accessreviews/resourceowners/confirmation/confirmation.md
@@ -8,7 +8,7 @@ sidebar_position: 20
The reason for assigning owners to resources is to enable those resources to be included in reviews,
or attestations, conducted through the application. In order for this to work, the assigned owner
-needs to claim that ownership responsibility. Resources that do not have confirmed owners may fall
+needs to claim that ownership responsibility. Resources that don't have confirmed owners may fall
through the cracks.
**NOTE:** This does require the Notification settings to be configured for the Access Reviews
@@ -27,7 +27,7 @@ this column to indicate the owner confirmation status:
|  | Confirmed | Indicates the assigned owner confirmed ownership of the resource. Hover over the icon to view the date timestamp of the confirmation. |
|  | Declined | Indicates the assigned owner declined ownership of the resource. These individuals would have been asked to suggest an alternative owner. Check the Notes for the resource to view this information. Hover over the icon to view the date timestamp of the decline. _Remember,_ a resource with declined ownership needs to be updated to assign a new owner. See the [Update Resource Wizard](/docs/auditor/10.7/accessreviews/resourceowners/interface/update.md) topic for additional information. |
-If multiple owners have been assigned, there is a choice for which assigned owner(s) should receive
+If multiple owners have been assigned, there is a choice for which assigned owners should receive
the confirmation. If multiple owners were sent the request, the column remains as a waiting symbol
until the assigned Primary owner replies.
diff --git a/docs/auditor/10.7/accessreviews/resourceowners/interface/add.md b/docs/auditor/10.7/accessreviews/resourceowners/interface/add.md
index 2f731e1444..61c2b9e948 100644
--- a/docs/auditor/10.7/accessreviews/resourceowners/interface/add.md
+++ b/docs/auditor/10.7/accessreviews/resourceowners/interface/add.md
@@ -21,8 +21,6 @@ See the Add a Resource topic for additional information.
## Add a Resource
-Follow the steps to add resources one at a time and assign owners.
-
**Step 1 –** In the Resource Owners interface, click **Add**. The Add new resource wizard opens.
@@ -36,8 +34,8 @@ Follow the steps to add resources one at a time and assign owners.
- For example, http://farm.corp.com
- For groups, enter the group name in NTAccount format [DOMAIN\GROUP]
- For example, acme\app.group
-- Browse option – Navigate through the resource tree to select the desired File System or SharePoint
- resource.
+- Browse option – Navigate through the resource tree to select the File System or SharePoint
+ resource you want.
@@ -58,7 +56,7 @@ the owners:
- Owner Mail — Trustee's email address as read from Active Directory
- Owner Title — Trustee's title as read from Active Directory
- Owner Department — Trustee's department as read from Active Directory
-- Confirmed — Indicates whether or not the assigned owner has confirmed ownership of that resource.
+- Confirmed — Indicates whether the assigned owner has confirmed ownership of that resource.
Tool-tips display when hovering over the icons indicating whether the resource ownership has been
confirmed, declined, pending response, or that a confirmation has not been requested.
diff --git a/docs/auditor/10.7/accessreviews/resourceowners/interface/addowner.md b/docs/auditor/10.7/accessreviews/resourceowners/interface/addowner.md
index f62e990588..3e8e91a52e 100644
--- a/docs/auditor/10.7/accessreviews/resourceowners/interface/addowner.md
+++ b/docs/auditor/10.7/accessreviews/resourceowners/interface/addowner.md
@@ -13,6 +13,6 @@ browsing Active Directory.
Enter a name in the search field to find and select users from Active Directory, which populates in
-a drop-down menu as you type. If multiple domains are known to the application, ensure the correct
-domain is selected from the drop-down menu. Click **OK** and the Add Owner window closes. The
+a dropdown menu as you type. If multiple domains are known to the application, ensure the correct
+domain is selected from the dropdown menu. Click **OK** and the Add Owner window closes. The
selected user appears in the Owner list.
diff --git a/docs/auditor/10.7/accessreviews/resourceowners/interface/confirmremoval.md b/docs/auditor/10.7/accessreviews/resourceowners/interface/confirmremoval.md
index ef4f2f1cd6..050b67e996 100644
--- a/docs/auditor/10.7/accessreviews/resourceowners/interface/confirmremoval.md
+++ b/docs/auditor/10.7/accessreviews/resourceowners/interface/confirmremoval.md
@@ -6,17 +6,15 @@ sidebar_position: 40
# Confirm Removal Window
-The process of removing a resource from the Resource Owners interface disassociates the owner(s)
-from the resource, it does not remove the resource from the database or from the available reports.
+The process of removing a resource from the Resource Owners interface disassociates the owners
+from the resource, it doesn't remove the resource from the database or from the available reports.
Any history of actions performed by the owner for that resource will be maintained, but pending
-actions will be canceled. Pending actions may include s outstanding reviews.
-
-Follow the steps to remove a resource from being managed through the application.
+actions will be canceled. Pending actions may include outstanding reviews.
**Step 1 –** In the Resource Owners interface, select the resource and click Remove. The Confirm
Removal window opens.
-
+
**Step 2 –** Click Yes to complete the removal process or **No** to cancel it.
diff --git a/docs/auditor/10.7/accessreviews/resourceowners/interface/interface.md b/docs/auditor/10.7/accessreviews/resourceowners/interface/interface.md
index 4a0ae44046..a0922a368c 100644
--- a/docs/auditor/10.7/accessreviews/resourceowners/interface/interface.md
+++ b/docs/auditor/10.7/accessreviews/resourceowners/interface/interface.md
@@ -21,11 +21,11 @@ The information displayed in the table includes:
information.
- Owner Name – Name of the assigned owner. If there are several owners of a resource, the list is
comma-separated.
-- Status – Indicates whether or not the assigned owner has confirmed ownership of that resource.
+- Status – Indicates whether the assigned owner has confirmed ownership of that resource.
Tool-tips display when hovering over the icons indicating whether the resource ownership has been
confirmed, declined, pending response, or that a confirmation has not been requested. See the
[Ownership Confirmation](/docs/auditor/10.7/accessreviews/resourceowners/confirmation/confirmation.md) topic for additional information.
-- Notes – Icon indicates a Note has been added. Click on the icon to read the attached note(s).
+- Notes – Icon indicates a Note has been added. Click the icon to read the attached notes.
Notes can be added by Ownership Administrators or populated with alternative owners by individuals
who declined ownership. See the [Edit Notes Window](/docs/auditor/10.7/accessreviews/admin/navigate/editnotes.md) and the Notes &
Descriptions topics for additional information.
@@ -34,7 +34,7 @@ The information displayed in the table includes:
review instance. See the
[Review Details Page](/docs/auditor/10.7/accessreviews/entitlementreviews/interface/interface.md#review-details-page) topic for additional
information.
-- Active Review – Indicates whether or not there is a pending review. The hyperlink will open the
+- Active Review – Indicates whether there is a pending review. The hyperlink will open the
Entitlement Reviews interface to that Review Details page displaying the active review instance.
See the [Review Details Page](/docs/auditor/10.7/accessreviews/entitlementreviews/interface/interface.md#review-details-page) topic for
additional information.
@@ -42,16 +42,16 @@ The information displayed in the table includes:
The table data grid functions the same way as other table grids. See the
[Data Grid Features](/docs/auditor/10.7/accessreviews/admin/navigate/datagrid.md) topic for additional information.
-The buttons at the bottom enable you to conduct the following actions:
+With the buttons at the bottom, you can conduct the following actions:
| Button | Function |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Add | Launches the Add new resource wizard to add a new resource to the list. This allows you to add one resource at a time and assign an owner. See the [Add New Resource Wizard](/docs/auditor/10.7/accessreviews/resourceowners/interface/add.md) topic for additional information. |
-| Update | Launches the Update resource wizard for the selected resource. This allows you to make changes to the assigned owners or add/edit the resource description. See the [Update Resource Wizard](/docs/auditor/10.7/accessreviews/resourceowners/interface/update.md) topic for additional information. |
-| Remove | Opens the Confirm removal window to removes the selected resource from being managed through the application. _Remember,_ only resources with an assigned owner will be visible in the table. Removing a resource from this table does not delete the resource from the application database. See the [Confirm Removal Window](/docs/auditor/10.7/accessreviews/resourceowners/interface/confirmremoval.md) topic for additional information. |
-| Request Confirmation | Opens the Confirm Ownership wizard. Sends an email to the assigned owner(s) for the selected resource requesting ownership confirmation. See the[Confirm Ownership Wizard](/docs/auditor/10.7/accessreviews/resourceowners/confirmation/confirm.md) topic for additional information. |
+| Add | Launches the Add new resource wizard to add a new resource to the list. With this wizard, you can add one resource at a time and assign an owner. See the [Add New Resource Wizard](/docs/auditor/10.7/accessreviews/resourceowners/interface/add.md) topic for additional information. |
+| Update | Launches the Update resource wizard for the selected resource. With this wizard, you can make changes to the assigned owners or add/edit the resource description. See the [Update Resource Wizard](/docs/auditor/10.7/accessreviews/resourceowners/interface/update.md) topic for additional information. |
+| Remove | Opens the Confirm removal window to removes the selected resource from being managed through the application. _Remember,_ only resources with an assigned owner will be visible in the table. Removing a resource from this table doesn't delete the resource from the application database. See the [Confirm Removal Window](/docs/auditor/10.7/accessreviews/resourceowners/interface/confirmremoval.md) topic for additional information. |
+| Request Confirmation | Opens the Confirm Ownership wizard. Sends an email to the assigned owners for the selected resource requesting ownership confirmation. See the[Confirm Ownership Wizard](/docs/auditor/10.7/accessreviews/resourceowners/confirmation/confirm.md) topic for additional information. |
| Edit Notes | Opens the Edit Notes window for the selected resource and allows free-text editing of the notes. See the [Edit Notes Window](/docs/auditor/10.7/accessreviews/admin/navigate/editnotes.md) topic for additional information. |
## Notes & Descriptions
diff --git a/docs/auditor/10.7/accessreviews/resourceowners/interface/update.md b/docs/auditor/10.7/accessreviews/resourceowners/interface/update.md
index d121769ac5..46a65c8f58 100644
--- a/docs/auditor/10.7/accessreviews/resourceowners/interface/update.md
+++ b/docs/auditor/10.7/accessreviews/resourceowners/interface/update.md
@@ -12,7 +12,7 @@ The Update resource wizard is opened with the **Update** button in the Resource
It contains three pages:
-- 1. Select Owners — Lists the current owner(s). Modify by adding new owners, removing owners, or
+- 1. Select Owners — Lists the current owners. Modify by adding new owners, removing owners, or
changing owner priority order (primary, secondary, etc.)
- 2. Description — Enter or modify a note describing the resource
- 3. Summary — Provides a preview of the settings selected within the wizard
@@ -21,14 +21,12 @@ See the Update a Resource topic for additional information.
## Update a Resource
-Follow the steps to update ownership configuration for a resource.
-
-**Step 1 –** In the Resource Owners interface, select the desired resource and click **Update**. The
+**Step 1 –** In the Resource Owners interface, select the resource you want and click **Update**. The
Update resource wizard opens.
-**Step 2 –** The Select Owners page lists the currently assigned owner(s). Modify as desired and
+**Step 2 –** The Select Owners page lists the assigned owners. Modify as desired and
click **Next** to continue.
- Add new owners — Click **Add** to browse for a new owner. See the
@@ -44,14 +42,14 @@ information on the owners:
- Owner Mail — Trustee's email address as read from Active Directory
- Owner Title — Trustee's title as read from Active Directory
- Owner Department — Trustee's department as read from Active Directory
-- Confirmed — Indicates whether or not the assigned owner has confirmed ownership of that resource.
+- Confirmed — Indicates whether the assigned owner has confirmed ownership of that resource.
Tool-tips display when hovering over the icons indicating whether the resource ownership has been
confirmed, declined, pending response, or that a confirmation has not been requested.
**Step 3 –** The Description page displays any description that has been provided by either the
-Ownership Administrator or the assigned owner(s) for the resource. Modify as desired by typing in
+Ownership Administrator or the assigned owners for the resource. Modify as desired by typing in
the textbox. Then click **Next** to continue.
diff --git a/docs/auditor/10.7/accessreviews/resourceowners/overview.md b/docs/auditor/10.7/accessreviews/resourceowners/overview.md
index b708fd1e56..bf2766d487 100644
--- a/docs/auditor/10.7/accessreviews/resourceowners/overview.md
+++ b/docs/auditor/10.7/accessreviews/resourceowners/overview.md
@@ -8,7 +8,7 @@ sidebar_position: 30
The Resource Owners interface is where Access Reviews Console users with either the Security Team or
Administrator role (to be referred to as Ownership Administrators) can assign ownership of resources
-to be managed through the application. Assigned owners do not require a console user role. Resources
+to be managed through the application. Assigned owners don't require a console user role. Resources
to be included in the Access Reviews workflow must first be assigned owners within the Resource
Owners interface.
@@ -70,7 +70,7 @@ Prerequisite:
Workflow:
-**NOTE:** This workflow is not numbered because the Notification piece can occur at any time in the
+**NOTE:** This workflow isn't numbered because the Notification piece can occur at any time in the
workflow.
- Add resources to be managed by associating a business data owner with a resource. See the
diff --git a/docs/auditor/10.7/accountlockoutexaminer/configure.md b/docs/auditor/10.7/accountlockoutexaminer/configure.md
index 02751fa1d2..4e8cb9c8af 100644
--- a/docs/auditor/10.7/accountlockoutexaminer/configure.md
+++ b/docs/auditor/10.7/accountlockoutexaminer/configure.md
@@ -11,7 +11,7 @@ environment, as described in this section.
## System requirements
-Make sure that the machine where you plan install the solution meets the system requirements listed
+Ensure that the machine where you plan install the solution meets the system requirements listed
below.
**Hardware:**
@@ -73,7 +73,7 @@ lockout reason detection:
### Inbound firewall rules
-Make sure the following **Inbound** firewall rules are enabled on the Domain Controllers and domain
+Ensure the following **Inbound** firewall rules are enabled on the Domain Controllers and domain
computers:
- File and Printer Sharing (Echo Request - ICMPv4-In)
diff --git a/docs/auditor/10.7/accountlockoutexaminer/overview.md b/docs/auditor/10.7/accountlockoutexaminer/overview.md
index ed09f54f50..94fab45a25 100644
--- a/docs/auditor/10.7/accountlockoutexaminer/overview.md
+++ b/docs/auditor/10.7/accountlockoutexaminer/overview.md
@@ -25,18 +25,17 @@ You can investigate lockouts originating from the following sources:
## Upgrade recommendations
-Since the functionality of older and newer versions does not match one-to-one (see Feature
+Since the functionality of older and newer versions doesn't match one-to-one (see Feature
comparison of Netwrix Account Lockout Examiner 4.1 and 5.x), there is no upgrade path for **Netwrix
Account Lockout Examiner 4.1**.
-Though its users can continue working with that older version, we recommend to use the latest
-Netwrix Account Lockout Examiner to benefit from the variety of its new features and enhanced
-usability.
+Users can continue working with that older version, but the latest Netwrix Account Lockout Examiner
+is recommended to benefit from the variety of its new features and enhanced usability.
## Feature comparison of Netwrix Account Lockout Examiner 4.1 and 5.x
-Netwrix Account Lockout Examiner 5.1 and later is not an evolutionary update, but rather a total
-revamp of version 4.1. Hence, the functionality of the older and newer versions does not match
+Netwrix Account Lockout Examiner 5.1 and later isn't an evolutionary update, but rather a total
+revamp of version 4.1. Hence, the functionality of the older and newer versions doesn't match
one-to-one. Feature comparison is provided in the table below.
| Feature | Version 4.1 | Version 5.x |
@@ -64,7 +63,6 @@ one-to-one. Feature comparison is provided in the table below.
Users of Account Lockout Examiner 4.1 can continue using that older version, as there is no upgrade
path, just a new installation of the latest version.
-We welcome any feedback and ideas you might have. You can check in on
+Your feedback and ideas are welcome. You can check in on
[Netwrix page at Spiceworks](https://community.spiceworks.com/pages/NetWrix?tab=353) or submit
-direct feedback via
-[this link](https://community.spiceworks.com/products/47099-netwrix-account-lockout-examiner).
+direct feedback on the [Netwrix Account Lockout Examiner product page](https://community.spiceworks.com/products/47099-netwrix-account-lockout-examiner).
diff --git a/docs/auditor/10.7/accountlockoutexaminer/usage.md b/docs/auditor/10.7/accountlockoutexaminer/usage.md
index 56d74168ce..43e86bd90f 100644
--- a/docs/auditor/10.7/accountlockoutexaminer/usage.md
+++ b/docs/auditor/10.7/accountlockoutexaminer/usage.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Examining Lockouts
-To start using **Netwrix Account Lockout Examiner**, download it from Netwrix web site. Once the
+To start using **Netwrix Account Lockout Examiner**, download it from Netwrix web site. After the
download completes, run the executable from your browser menu or from your **Downloads** folder.
To find out why an Active Directory account was locked out, perform the following steps:
@@ -26,7 +26,7 @@ To find out why an Active Directory account was locked out, perform the followin
-Once the examination completes, you will be presented with a list of reasons why the account you
+After the examination completes, you'll see a list of reasons why the account you
supplied is being locked out.
## Modifying product settings
@@ -36,7 +36,7 @@ After you click **Settings** in the main window, you can apply the following opt
| Option | Description | Default |
| ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| **Examining** | | |
-| Skip unresolved IP addresses | For safety reasons, Netwrix Account Lockout Examiner by default does not connect to the unknown and potentially dangerous IP addresses. See [this Knowledge Base article](https://kb.netwrix.com/5810) for more information. | Enabled |
+| Skip unresolved IP addresses | For safety reasons, Netwrix Account Lockout Examiner by default doesn't connect to the unknown and potentially dangerous IP addresses. See [this Knowledge Base article](https://kb.netwrix.com/5810) for more information. | Enabled |
| Examine all domain controllers | Select this option if you want to examine all domain controllers to detect potential lockout reason. | Disabled |
| **Usage statistics** | | |
| Take part in Netwrix Customer Experience Improvement program | Select this option to participate in the program. See [this Knowledge Base article](https://kb.netwrix.com/5820) for more information on the program. | |
@@ -50,12 +50,11 @@ Lockout Examiner\Logs_ folder.
| Symptom | Cause | Solution |
| --------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| In the environments with root/child domains, you may receive the "_Could not query ComputerName. Access is denied_." error. | The account used to run Netwrix Account Lockout Examiner is not a member of the local **Administrators** group on the workstations in both root and child domains. Administrative rights are required to access the Security Event logs on these workstations. | Make sure this account is included in the local **Administrators** group. |
-| **Issues encountered during examination** section is shown in the examination results. | Most probably this means that **Netwrix Account Lockout Examiner** cannot reach some of the data sources it needs. | - Check that you have configured the audit settings in the target domain as described in [Required audit settings](configure.md#required-audit-settings) section. - Check that network connectivity between the Account Lockout Examiner machine and the domain controllers in your domain works properly. |
+| In the environments with root/child domains, you may receive the "_Couldn't query ComputerName. Access is denied_." error. | The account used to run Netwrix Account Lockout Examiner isn't a member of the local **Administrators** group on the workstations in both root and child domains. Administrative rights are required to access the Security Event logs on these workstations. | Ensure this account is included in the local **Administrators** group. |
+| **Issues encountered during examination** section is shown in the examination results. | Most probably this means that **Netwrix Account Lockout Examiner** can't reach some of the data sources it needs. | - Check that you have configured the audit settings in the target domain as described in [Required audit settings](configure.md#required-audit-settings) section. - Check that network connectivity between the Account Lockout Examiner machine and the domain controllers in your domain works properly. |
-We welcome any feedback and ideas you might have. Please take a minute to check in on
+Your feedback and ideas are welcome. Take a minute to check in on
[Netwrix page at Spiceworks](https://community.spiceworks.com/pages/NetWrix?tab=353) or submit
-direct feedback via
-[this link](https://community.spiceworks.com/products/47099-netwrix-account-lockout-examiner).
+direct feedback on the [Netwrix Account Lockout Examiner product page](https://community.spiceworks.com/products/47099-netwrix-account-lockout-examiner).
diff --git a/docs/auditor/10.7/addon/alienvaultusm/automate.md b/docs/auditor/10.7/addon/alienvaultusm/automate.md
index 5aee188592..818ea2a759 100644
--- a/docs/auditor/10.7/addon/alienvaultusm/automate.md
+++ b/docs/auditor/10.7/addon/alienvaultusm/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.7/addon/alienvaultusm/integrationeventlog.md b/docs/auditor/10.7/addon/alienvaultusm/integrationeventlog.md
index a3e492d49e..994741b8a3 100644
--- a/docs/auditor/10.7/addon/alienvaultusm/integrationeventlog.md
+++ b/docs/auditor/10.7/addon/alienvaultusm/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.7/addon/alienvaultusm/overview.md b/docs/auditor/10.7/addon/alienvaultusm/overview.md
index 16831b68f3..fa4094a2c9 100644
--- a/docs/auditor/10.7/addon/alienvaultusm/overview.md
+++ b/docs/auditor/10.7/addon/alienvaultusm/overview.md
@@ -46,5 +46,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.7/addon/alienvaultusm/parameters.md b/docs/auditor/10.7/addon/alienvaultusm/parameters.md
index d4577ca8c4..4a5fe8918c 100644
--- a/docs/auditor/10.7/addon/alienvaultusm/parameters.md
+++ b/docs/auditor/10.7/addon/alienvaultusm/parameters.md
@@ -31,10 +31,10 @@ dynamically calculated EventIDs will be modified and applied incorrectly.
| Parameter | Default value | Description |
| -------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId\* | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to _TRUE_. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
\* When configuring the **IncludeDataSourceToMakeEventId** parameter, consider that the _Object
Type - Action_ pair may be identical for several data sources (e.g., Object='User' and
diff --git a/docs/auditor/10.7/addon/alienvaultusm/powershell.md b/docs/auditor/10.7/addon/alienvaultusm/powershell.md
index f066d2b7b0..fb5b133c3d 100644
--- a/docs/auditor/10.7/addon/alienvaultusm/powershell.md
+++ b/docs/auditor/10.7/addon/alienvaultusm/powershell.md
@@ -11,11 +11,9 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
-
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -55,7 +53,7 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
first run. At the end of the first run, the timestamp will be created, and the next run will start
diff --git a/docs/auditor/10.7/addon/amazonwebservices/automate.md b/docs/auditor/10.7/addon/amazonwebservices/automate.md
index fa6d6f2f0a..4d30f99ac0 100644
--- a/docs/auditor/10.7/addon/amazonwebservices/automate.md
+++ b/docs/auditor/10.7/addon/amazonwebservices/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.7/addon/amazonwebservices/collecteddata.md b/docs/auditor/10.7/addon/amazonwebservices/collecteddata.md
index b692a9f7ab..8cc05d43a5 100644
--- a/docs/auditor/10.7/addon/amazonwebservices/collecteddata.md
+++ b/docs/auditor/10.7/addon/amazonwebservices/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data.
-
**Step 1 –** Start the Auditor client and navigate to **Search**.
**Step 2 –** Click **Search**.
diff --git a/docs/auditor/10.7/addon/amazonwebservices/overview.md b/docs/auditor/10.7/addon/amazonwebservices/overview.md
index 332f149d44..e69bdd4f55 100644
--- a/docs/auditor/10.7/addon/amazonwebservices/overview.md
+++ b/docs/auditor/10.7/addon/amazonwebservices/overview.md
@@ -7,10 +7,10 @@ sidebar_position: 20
# Amazon Web Services
Amazon Web Services (AWS) provides a wide range of cloud-based services, including solutions and
-management tools for virtualization, data storage and hosting, private networking, relational and
-NoSQL databases, and many more. AWS CloudTrail is an internal tracking service that records AWS API
-calls. Companies leverage this information for analyzing user activity patterns and detecting
-potential threats. Unfortunately, collected audit data cannot be used for future reference: AWS
+management tools for virtualization, data storage and hosting, private networking, and both relational and
+NoSQL databases. AWS CloudTrail is an internal tracking service that records AWS API
+calls. Companies use this information to analyze user activity patterns and detect
+potential threats. Unfortunately, collected audit data can't be used for future reference: AWS
CloudTrail stores events for 7 days allowing administrators and security analysts to review data for
only short time periods.
@@ -30,7 +30,7 @@ On a high level, the add-on works as follows:
- The add-on processes these events into Netwrix Auditor-compatible format (Activity Records). Each
Activity Record contains the user account, action, time, and other details.
- Currently, Netwrix Auditor processes details for the following AWS events (other events can be
+ Netwrix Auditor processes details for the following AWS events (other events can be
imported without details):
| | | | |
@@ -46,7 +46,7 @@ See the [Integration API](/docs/auditor/10.7/api/overview.md) topic for addition
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging the Integration API. Download the latest add-on version in the Add-on Store.
See the [Integration API](/docs/auditor/10.7/api/overview.md) topic for additional information about schema
diff --git a/docs/auditor/10.7/addon/amazonwebservices/parameters.md b/docs/auditor/10.7/addon/amazonwebservices/parameters.md
index 262ccf54a9..5eba882069 100644
--- a/docs/auditor/10.7/addon/amazonwebservices/parameters.md
+++ b/docs/auditor/10.7/addon/amazonwebservices/parameters.md
@@ -21,10 +21,10 @@ modify the parameters as required.
| ---------------------- | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| AWSSDKInstallPath | 'C:\Program Files (x86)\AWS SDK for .NET' | Assumes that AWS SDK for .NET is installed by its default path. To specify another location, provide a path in single quotes (e.g., '_C:\Program Files (x86)\My SDKs\AWS SDK for .NET_'). |
| ImportAllEvents | — | By deafult, only events with processed details will be imported. To import all events, set the switch during the add-on execution. **NOTE:** Importing all events makes audit data less human-readable. |
-| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add- on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer,WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). |
+| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer,WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). |
| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format. **NOTE:** The account must be assigned the **Contributor** role in Auditor. |
| NetwrixAuditorPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
-| NetwrixAuditorPlan | — | Unless specified, data is written to the **Netwrix\_ Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. **NOTE:** If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the **Netwrix API** data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the **Audit Database**. |
+| NetwrixAuditorPlan | — | Unless specified, data is written to the **Netwrix\_ Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. **NOTE:** If you select a plan name in the add-on, ensure a dedicated plan is created in Auditor, the **Netwrix API** data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the **Audit Database**. |
## Update In-Script Parameters
diff --git a/docs/auditor/10.7/addon/amazonwebservices/powershell.md b/docs/auditor/10.7/addon/amazonwebservices/powershell.md
index 515847bf2b..e9ea8f99c2 100644
--- a/docs/auditor/10.7/addon/amazonwebservices/powershell.md
+++ b/docs/auditor/10.7/addon/amazonwebservices/powershell.md
@@ -6,11 +6,9 @@ sidebar_position: 30
# Run the Add-On with PowerShell
-Follow the steps to run add-on with PowerShell:
-
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
diff --git a/docs/auditor/10.7/addon/arcsight/automate.md b/docs/auditor/10.7/addon/arcsight/automate.md
index a853cd56d1..92b02a7539 100644
--- a/docs/auditor/10.7/addon/arcsight/automate.md
+++ b/docs/auditor/10.7/addon/arcsight/automate.md
@@ -16,7 +16,7 @@ running the add-on.
**Step 2 –** Select **Create Task**.
**Step 3 –** On the **General** tab, specify a task name, e.g., Netwrix Auditor Add-on for ArcSight.
-Make sure the account that runs the task has all necessary rights and permissions.
+Ensure the account that runs the task has all necessary rights and permissions.
**Step 4 –** On the **Triggers** tab, **click** New and define the schedule. This option controls
how often audit data is exported from Auditor and transferred to ArcSight Logger. Netwrix recommends
diff --git a/docs/auditor/10.7/addon/arcsight/collecteddata.md b/docs/auditor/10.7/addon/arcsight/collecteddata.md
index 739b67d6b1..fea39177ea 100644
--- a/docs/auditor/10.7/addon/arcsight/collecteddata.md
+++ b/docs/auditor/10.7/addon/arcsight/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to see collected data.
-
**Step 1 –** Log on to your ArcSight Logger web interface.
**Step 2 –** On the **Summary** page, select the **Event Summary by Receiver** diagram and click the
diff --git a/docs/auditor/10.7/addon/arcsight/overview.md b/docs/auditor/10.7/addon/arcsight/overview.md
index 8f6e567079..622277f667 100644
--- a/docs/auditor/10.7/addon/arcsight/overview.md
+++ b/docs/auditor/10.7/addon/arcsight/overview.md
@@ -44,7 +44,7 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging the Integration API. Download the latest add-on version in the Add-on Store. See the
[Integration API](/docs/auditor/10.7/api/overview.md)topic for additional information.
diff --git a/docs/auditor/10.7/addon/arcsight/parameters.md b/docs/auditor/10.7/addon/arcsight/parameters.md
index b1f76ffb96..3b3595d180 100644
--- a/docs/auditor/10.7/addon/arcsight/parameters.md
+++ b/docs/auditor/10.7/addon/arcsight/parameters.md
@@ -21,6 +21,6 @@ modify the parameters as required.
| ---------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| TCP | – | By default, UDP protocol is used. Specify the switch during the add-on execution if you want to use TCP protocol for transferring data. Via UDP, events will be sent one by one, via TCP— in a batch. |
| ArcSightHost | – | Provide a name of the computer where ArcSight resides (e.g., 172.28.6.18, ArcSightSRV, ArcSightSRV.enterprise.local). **NOTE:** This is a mandatory parameter. Unless specified, the add- on assumes that the default port 514 is used for UDP and 515 for TCP. To specify a non-default port, provide a server name followed by the port number (e.g., _ArcSightSRV.enterprise.local:9998_). |
-| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add- on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). |
+| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). |
| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format. **NOTE:** The account must be assigned the **Global reviewer** role in Netwrix Auditor or be a member of the **Netwrix Auditor Client Users** group on the computer hosting Auditor Server. |
| NetwrixAuditorPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
diff --git a/docs/auditor/10.7/addon/arcsight/powershell.md b/docs/auditor/10.7/addon/arcsight/powershell.md
index 7718acf4af..90d18d19fc 100644
--- a/docs/auditor/10.7/addon/arcsight/powershell.md
+++ b/docs/auditor/10.7/addon/arcsight/powershell.md
@@ -6,11 +6,9 @@ sidebar_position: 30
# Run the Add-On with PowerShell
-Follow the steps to run add-on with PowerShell:
-
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -25,7 +23,10 @@ quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Ad
Depending on the number of Activity Records stored in the Audit Database execution may take a while.
Ensure the script execution completed successfully. As a result, data will be exported to ArcSight.
-Note that events exceeding 4000 symbols are trimmed.
+
+:::note
+Events exceeding 4000 symbols are trimmed.
+:::
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records.
diff --git a/docs/auditor/10.7/addon/azurefiles/collecteddata.md b/docs/auditor/10.7/addon/azurefiles/collecteddata.md
index 1760daf9a2..e1b5944cf6 100644
--- a/docs/auditor/10.7/addon/azurefiles/collecteddata.md
+++ b/docs/auditor/10.7/addon/azurefiles/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+You can use data collected with the add-on in the following ways in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.7/addon/azurefiles/deployment.md b/docs/auditor/10.7/addon/azurefiles/deployment.md
index 67238f1089..39dcb469d2 100644
--- a/docs/auditor/10.7/addon/azurefiles/deployment.md
+++ b/docs/auditor/10.7/addon/azurefiles/deployment.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Deployment Procedure
-Follow the steps to install Azure Files add-on.
-
**Step 1 –** Accept EULA.
@@ -20,27 +18,25 @@ Follow the steps to install Azure Files add-on.
## Configure Azure Files for Monitoring
-Follow the steps to configure Azure files for monitoring.
-
-**Step 1 –** Make sure you have a storage account to store logs. To reduce the volume of the stored
+**Step 1 –** ensure you have a storage account to store logs. To reduce the volume of the stored
logs and the corresponding cost, it is recommended to create a rule in Life Cycle Management for
this storage. Netwrix Auditor doesn't need historic logs, after the add-on has written them into the
database. Refer to the
[corresponding Microsoft article](https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview?tabs=azure-portal)
for additional information.
-**Step 2 –** Enable audit in the Azure Files settings. Go to the Diagnostic settings, and make sure
+**Step 2 –** Enable audit in the Azure Files settings. Go to the Diagnostic settings, and ensure
that the following options are selected:
- "Audit" under the **Logs**
- "Archive to a storage account" under the **Destination details**
-- Correct Storage account in the drop-down menu
+- Correct Storage account in the dropdown menu
**Step 3 –** Go to the storage account that has been created before and copy Connection String. This
parameter will be used in the add-on configuration.
**Step 4 –** If Microsoft Entra Kerberos or Active Directory Domain Services is used as an Identity
-source, Graph API will be used to resolve the user names. It is necessary to register an Azure App
+source, Graph API will be used to resolve the user names. Register an Azure App
and grant it the following permissions:
- Type - Application
@@ -50,8 +46,6 @@ After that, save the Tenant ID, Application ID, and secret.
## Configure the add-on
-Follow the steps to configure the add-on.
-
**Step 1 –** After the installation, the add-on configuration wizard will start. If it didn't start
automatically - open it from the installation folder.
@@ -67,14 +61,14 @@ Auditor Server resides (e.g., _172.28.6.15_, EnterpriseNAServer, WKS.enterprise.
non-default port, provide a server name followed by the port number (e.g., WKS.ent
erprise.local:9999).
-**CAUTION:** Do not modify the endpoint part (_/netwrix/api_).
+**CAUTION:** Don't modify the endpoint part (_/netwrix/api_).
**Step 4 –** Specify Active Directory credentials:
- Username – Provide the name of the account under which the service runs. Unless specified, the
- service runs under the account currently logged on.
+ service runs under the account logged on.
- Password – Provide the password for the selected account.
diff --git a/docs/auditor/10.7/addon/azurefiles/overview.md b/docs/auditor/10.7/addon/azurefiles/overview.md
index 6ba8252c80..e1782846cc 100644
--- a/docs/auditor/10.7/addon/azurefiles/overview.md
+++ b/docs/auditor/10.7/addon/azurefiles/overview.md
@@ -9,15 +9,15 @@ sidebar_position: 40
Azure Files is a Microsoft service that offers file shares in the cloud that are accessible via the
industry standard Server Message Block (SMB) protocol, Network File System (NFS) protocol, and Azure
Files REST API. Azure file shares can be mounted concurrently by cloud or on-premises deployments.
-SMB Azure file shares are accessible from Windows, Linux, and macOS clients. To learn more about
+SMB Azure file shares are accessible from Windows, Linux, and macOS clients. For more information about
Azure Files, refer to the
-[corresponding Microsoft article](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-introduction).
+[Azure Files documentation](https://learn.microsoft.com/en-us/azure/storage/files/storage-files-introduction).
The Netwrix Auditor Add-On for Azure Files works in collaboration with Netwrix Auditor, supplying
-data about SMB changes on your Azure Files shares, such as document reads, modifications and
+data about SMB changes on your Azure Files shares, such as document reads, modifications, and
deletions.
-To get the add-on up and running, please read the following topics:
+To deploy the add-on, read the following topics:
- [Deployment Procedure](/docs/auditor/10.7/addon/azurefiles/deployment.md)
- [Work with Collected Data](/docs/auditor/10.7/addon/azurefiles/collecteddata.md)
diff --git a/docs/auditor/10.7/addon/connectwise/configure.md b/docs/auditor/10.7/addon/connectwise/configure.md
index e4107a6604..dbdc103121 100644
--- a/docs/auditor/10.7/addon/connectwise/configure.md
+++ b/docs/auditor/10.7/addon/connectwise/configure.md
@@ -10,8 +10,6 @@ This section describes how to configure settings of the main add-on component, N
**ConnectWise Manage Integration Service** that is required for connection to ConnectWise Manage and
service ticket creation.
-Follow the steps to configure ConnectWise.
-
**Step 1 –** To connect to ConnectWise Manage REST API, the API keys will be required. To obtain
them, you will need an API Member account. See
[this article](https://docs.connectwise.com/ConnectWise_Documentation/090/040/010/040) for details.
diff --git a/docs/auditor/10.7/addon/connectwise/connectionticketingsettings.md b/docs/auditor/10.7/addon/connectwise/connectionticketingsettings.md
index 5f13c77fc2..1c4987ff09 100644
--- a/docs/auditor/10.7/addon/connectwise/connectionticketingsettings.md
+++ b/docs/auditor/10.7/addon/connectwise/connectionticketingsettings.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Connection and Ticketing Settings
-It is recommended that you use configuration wizard to specify connection and ticketing settings.
+Use the configuration wizard to specify connection and ticketing settings.
However, you can adjust them manually, using the information provided in this section.
## Settings for ConnectWise Ticket Creation
@@ -23,7 +23,7 @@ values are provided. Add more ticket parameters or update values if necessary.
| `` | `` | Description |
| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Summary | [Netwrix Auditor] %AlertName% | Instructs the system to fill in the Summary ticket field with the Auditor alert name (e.g., _[Netwrix Auditor] Password Reset)_. |
-| InitialDescription | Alert Details: Who: %Who% Action: %Action% Object type: %ObjectType% What: %What% When: %When% Where: %Where% Workstation: %Workstation% Details: %Details% Data source: %DataSource% Monitoring plan: %MonitoringPlanName% Item: %Item% Sent by Netwrix Auditor from %Computer% | Instructs the system to fill in the InitialDescription ticket field with the Auditor activity record data. To read more about activity records, see the [Reference for Creating Activity Records](/docs/auditor/10.7/api/activityrecordreference.md) topic for additional information. You may need to fill in the internal description intended for use by MSP only (this description will not be visible to managed clients), perform the following steps: **Step 1 –** Run the configuration wizard (or modify _ConnectWiseSettings.xml_) to specify the settings you need. **Step 2 –** Then open _ConnectWiseSettings.xml_ for edit. **Step 3 –** Locate the **InitialDescription** parameter and change the Name attribute to _initialInternalAnalysis_. |
+| InitialDescription | Alert Details: Who: %Who% Action: %Action% Object type: %ObjectType% What: %What% When: %When% Where: %Where% Workstation: %Workstation% Details: %Details% Data source: %DataSource% Monitoring plan: %MonitoringPlanName% Item: %Item% Sent by Netwrix Auditor from %Computer% | Instructs the system to fill in the InitialDescription ticket field with the Auditor activity record data. See [Reference for Creating Activity Records](/docs/auditor/10.7/api/activityrecordreference.md) for details about activity records. You may need to fill in the internal description intended for use by MSP only (this description will not be visible to managed clients), perform the following steps: **Step 1 –** Run the configuration wizard (or modify _ConnectWiseSettings.xml_) to specify the settings you need. **Step 2 –** Then open _ConnectWiseSettings.xml_ for edit. **Step 3 –** Locate the **InitialDescription** parameter and change the Name attribute to _initialInternalAnalysis_. |
| Impact/Urgency | Medium | Instructs the system to set ticket Impact/Urgency to _Medium_. |
## Parameters for Handling Related Tickets
@@ -43,7 +43,7 @@ automatically.
| Name | Description |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ClosedTicketStates TicketState | Lists closed ticket statuses. By default, resolved, closed, and canceled tickets can be reopened. To specify a new status, provide its ID in the `` tag (e.g., 8 for canceled). |
-| NewState | Defines a ticket status once it is reopened. By default, is set to _new_. To specify another status, provide its ID in the `` tag (e.g., _1_ for _new_). |
+| NewState | Defines a ticket status after it is reopened. By default, it's set to _new_. To specify another status, provide its ID in the `` tag (e.g., _1_ for _new_). |
When finished, save your changes to configuration file.
@@ -51,8 +51,7 @@ Remember to restart the add-on service every time you update any of configuratio
## Review Other Parameters
-You can update other parameters with your own values if necessary; however, it is recommended that
-you contact Netwrixbefore modifying this section.
+You can update other parameters with your own values if necessary; however, consult Netwrix before modifying this section.
| Name | Description |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
diff --git a/docs/auditor/10.7/addon/connectwise/deployment.md b/docs/auditor/10.7/addon/connectwise/deployment.md
index 1d7439ddd8..1842032fe7 100644
--- a/docs/auditor/10.7/addon/connectwise/deployment.md
+++ b/docs/auditor/10.7/addon/connectwise/deployment.md
@@ -6,13 +6,11 @@ sidebar_position: 10
# Deploy the Add-On
-Follow the steps to deploy the Add-On for ConnectWise.
-
**Step 1 –** Prepare Auditor for using the add-on:
1. In the Auditor settings, enable Integration API and specify connection port. See the
[Integrations](/docs/auditor/10.7/admin/settings/integrations.md) topic for additional information.
-2. Make sure your monitoring plans set up in Auditor are using Audit Databases to store collected
+2. Ensure your monitoring plans set up in Auditor are using Audit Databases to store collected
data. See the [Audit Database](/docs/auditor/10.7/admin/settings/auditdatabase.md) topic for additional
information.
diff --git a/docs/auditor/10.7/addon/connectwise/operationalsettings.md b/docs/auditor/10.7/addon/connectwise/operationalsettings.md
index 3c7c99de1d..6f34aa9b14 100644
--- a/docs/auditor/10.7/addon/connectwise/operationalsettings.md
+++ b/docs/auditor/10.7/addon/connectwise/operationalsettings.md
@@ -8,7 +8,7 @@ sidebar_position: 50
This section describes how to configure settings of the main add-on component, Netwrix Auditor
**ConnectWise Manage Integration Service**, required for its operation, including connection to
-Auditor Server, activity records processing, queuing and forwarding, ticket creation, and so on.
+Auditor Server, activity records processing, queuing, and forwarding, ticket creation, and so on.
For that, follow the steps:
@@ -23,10 +23,10 @@ policies. Use the following format: `value`.
| ----------------------------------- | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| NetwrixAuditorHost | https://localhost:9699 | The add-on runs on the computer where Auditor Server resides and uses the default Integration API port (TCP port **9699**). To specify a non-default port, provide a new port number (e.g., _https://localhost:8788_). The add-on must always run locally, on the computer where Auditor Server resides. |
| NetwrixAuditorUserName | — | Unless specified, the Netwrix Auditor **ConnectWise Manage Integration Service** runs under the LocalSystem account. If you want this service to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format in this parameter value. The user account for running the service and connecting to Auditor Server must be granted the Global administrator role in Auditor or be a member of the Netwrix Auditor **Administrators** group. It must also have sufficient permissions to create files on the local computer. |
-| NetwrixAuditorPassword | — | Provide a password for the account. Unless an account is specified, the service runs under the LocalSystem account and does not require a password. |
+| NetwrixAuditorPassword | — | Provide a password for the account. Unless an account is specified, the service runs under the LocalSystem account and doesn't require a password. |
| TicketFloodLimit | 10 | Specify the maximum number of standalone tickets the service can create during TicketFloodInterval. If a ticket flood limit is reached, the service writes all new alerts into a single ticket. |
| TicketFloodInterval | 3600 | Specify the time period, in seconds. During this time period, the service can create as many tickets as specified in TicketFloodLimit. The default value is 3600 seconds, i.e., 1 hour. |
-| ConsolidationInterval | 900 | Specify the time period, in seconds. During this time period, the service does not process similar alerts as they happen but consolidates them before updating open tickets. The default values is 900 seconds, i.e., 15 minutes. This option works in combination with UpdateTicketOnRepetitiveAlertsand is helpful if you want to reduce the number of ticket updates on ConnectWise Manage side. I.e., this option defines the maximum delay for processing alerts and updating existing tickets. Tickets for new alert types are created immediately. For example, a new alert is triggered—the service opens a new ticket. The alert keeps firing 20 times more within 10 minutes. Instead of updating the ticket every time, the service consolidates alerts for 15 minutes, and then updates a ticket just once with all collected data. |
+| ConsolidationInterval | 900 | Specify the time period, in seconds. During this time period, the service doesn't process similar alerts as they happen but consolidates them before updating open tickets. The default values is 900 seconds, i.e., 15 minutes. This option works in combination with UpdateTicketOnRepetitiveAlertsand is helpful if you want to reduce the number of ticket updates on ConnectWise Manage side. i.e., this option defines the maximum delay for processing alerts and updating existing tickets. Tickets for new alert types are created immediately. For example, a new alert is triggered—the service opens a new ticket. The alert keeps firing 20 times more within 10 minutes. Instead of updating the ticket every time, the service consolidates alerts for 15 minutes, and then updates a ticket just once with all collected data. |
| CheckAlertQueueInterval | 5 | Internal parameter. Check and process the alert queue every N seconds; in seconds. |
| UpdateTicketOnRepetitiveAlerts | true | Instead of creating a new ticket, update an existing active ticket if a similar alert occurs within UpdateInterval. To open a new ticket for every alert, set the parameter to _"false"_. |
| ReopenTicketOnRepetitiveAlerts | true | Instead of creating a new ticket, reopen an existing ticket that is in a closed state (be default, closed, canceled, and resolved) if a similar alert occurs within UpdateInterval. This option works only when UpdateTicketOnRepetitiveAlerts is set to _"true"_. If you want to reopen closed tickets, you must be granted the right to perform Write operations on inactive tickets. |
@@ -36,13 +36,13 @@ policies. Use the following format: `value`.
| ProcessActivityRecord QueueInterval | 5 | Internal parameter. Process activity record queue every N seconds; in seconds. |
| DisplayOnlyFirstActivityRecord | true | Add only the first activity record in the work notes, activity records that update this ticket will be added as attachments to this ticket. If false, all activity records will be displayed in the ticket work notes. |
| ActivityRecordRequestsRetention | | |
-| RequestLimit | 5000 | Internal parameter. The maximum number of activity record requests the service can store in its internal memory. Once the limit is reached, the service clears activity record requests starting with older ones. |
+| RequestLimit | 5000 | Internal parameter. The maximum number of activity record requests the service can store in its internal memory. When the limit is reached, the service clears activity record requests starting with older ones. |
| RequestLimitInterval | 604800 | Internal parameter. The service can store the activity record requests not older than N seconds; in seconds. Older activity record requests are cleared. |
| ActivityRecordWebRequests | | |
| RequestLimit | 200 | Internal parameter. The maximum number of activity records the service can retrieve in a single request. |
| RequestTimeout | 180 | Internal parameter. By default, 3 minutes. Defines the connection timeout. |
| TicketRequestsRetention | | |
-| RequestLimit | 300000 | Internal parameter. The maximum number of ticket requests the service can store in its internal memory. Once the limit is reached, the service clears ticket requests starting with older ones. |
+| RequestLimit | 300000 | Internal parameter. The maximum number of ticket requests the service can store in its internal memory. When the limit is reached, the service clears ticket requests starting with older ones. |
| RequestLimitInterval | 604800 | Internal parameter. The service can store the ticket requests not older than N seconds; in seconds. Older tickets requests are cleared. |
**Step 3 –** Restart the service every time you update ITSMSettings.xml configuration file.
diff --git a/docs/auditor/10.7/addon/connectwise/overview.md b/docs/auditor/10.7/addon/connectwise/overview.md
index 4892876cf8..9e302c7f18 100644
--- a/docs/auditor/10.7/addon/connectwise/overview.md
+++ b/docs/auditor/10.7/addon/connectwise/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# ConnectWise Manage
-Managed Service Providers (MSP) need to effectively utilize and standardize IT service management
+Managed Service Providers (MSP) need to effectively use and standardize IT service management
tools. Those who use for that purpose the ConnectWise Manage solution usually have similar processes
in place:
@@ -43,7 +43,7 @@ On a high level, the workflow is as follows:
2. Whenever the alert is triggered, the add-on uses the Integration API to retrieve activity record
for the original event from the audit store. An activity record contains the user account,
action, time, and other details. The add-on creates a service ticket in ConnectWise Manage,
- populates it with data from the activity record, and assigns Impact, Priority and SLA status to
+ populates it with data from the activity record, and assigns Impact, Priority, and SLA status to
the ticket.
3. The designated service team performs data analysis and root cause detection to resolve the
ticket; MSP is notified of the results and possible response actions to take on the client side.
diff --git a/docs/auditor/10.7/addon/copilot/collecteddata.md b/docs/auditor/10.7/addon/copilot/collecteddata.md
index 32c1b9d4a0..ae40ac0ff1 100644
--- a/docs/auditor/10.7/addon/copilot/collecteddata.md
+++ b/docs/auditor/10.7/addon/copilot/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected by the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.7/addon/copilot/deployment.md b/docs/auditor/10.7/addon/copilot/deployment.md
index c3d4a8a8cc..c587ae3ee3 100644
--- a/docs/auditor/10.7/addon/copilot/deployment.md
+++ b/docs/auditor/10.7/addon/copilot/deployment.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Deployment Procedure
-Follow the steps to install Microsoft Copilot add-on.
-
**Step 1 –** Accept EULA.
**Step 2 –** Select the installation folder and click **Next**.
@@ -16,9 +14,7 @@ Follow the steps to install Microsoft Copilot add-on.
## Configure Copilot for Monitoring
-Follow the steps to configure Copilot for monitoring.
-
-**Step 1 –** Make sure you have a storage account to store logs. To reduce the volume of the stored
+**Step 1 –** Ensure you have a storage account to store logs. To reduce the volume of the stored
logs and the corresponding cost, it is recommended to create a rule in Life Cycle Management for
this storage. Netwrix Auditor doesn't need historic logs, after the add-on has written them into the
database. Refer to the
@@ -32,12 +28,10 @@ for additional information.
## Configure the add-on
-Follow the steps to configure the add-on.
-
**Step 1 –** Specify Active Directory credentials.
- Username – Provide the name of the account under which the service runs. Unless specified, the
- service runs under the account currently logged on.
+ service runs under the account logged on.
- Password – Provide the password for the selected account.
diff --git a/docs/auditor/10.7/addon/copilot/overview.md b/docs/auditor/10.7/addon/copilot/overview.md
index 664b25d4b8..57026181c1 100644
--- a/docs/auditor/10.7/addon/copilot/overview.md
+++ b/docs/auditor/10.7/addon/copilot/overview.md
@@ -7,15 +7,15 @@ sidebar_position: 70
# Copilot
Microsoft Copilot is an AI-powered assistant designed to help users in Microsoft 365 apps like Word,
-Excel, and Teams. It leverages large language models to assist with tasks such as generating
+Excel, and Teams. It uses large language models to assist with tasks such as generating
content, analyzing data, and automating workflows.
To retrieve activity logs on Copilot interactions, the Add-on requires an Azure App registration.
This allows the application to interact with Microsoft services by obtaining necessary logs and data
related to Copilot activity.
-The Netwrix Auditor Add-On for Microsoft Copilot works in collaboration with Netwrix Auditor. To get
-the add-on up and running, refer the following topics:
+The Netwrix Auditor Add-On for Microsoft Copilot works in collaboration with Netwrix Auditor. To deploy
+and configure the add-on, refer the following topics:
- [Deployment Procedure](/docs/auditor/10.7/addon/copilot/deployment.md)
- [Work with Collected Data](/docs/auditor/10.7/addon/copilot/collecteddata.md)
diff --git a/docs/auditor/10.7/addon/ctera/collecteddata.md b/docs/auditor/10.7/addon/ctera/collecteddata.md
index 5849885f38..788f0bc8f8 100644
--- a/docs/auditor/10.7/addon/ctera/collecteddata.md
+++ b/docs/auditor/10.7/addon/ctera/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected by the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
@@ -31,7 +31,7 @@ See the following topics for additional information:
- [View and Search Collected Data](/docs/auditor/10.7/admin/search/overview.md)
- [Subscriptions](/docs/auditor/10.7/admin/subscriptions/overview.md)
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected by the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.7/addon/ctera/install.md b/docs/auditor/10.7/addon/ctera/install.md
index 955178db1f..8fedf31c94 100644
--- a/docs/auditor/10.7/addon/ctera/install.md
+++ b/docs/auditor/10.7/addon/ctera/install.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Install Add-On
-Follow the steps to install the Add-On:
-
**Step 1 –** Navigate to your add-on package.
**Step 2 –** Unzip the Add-On to a desired folder.
diff --git a/docs/auditor/10.7/addon/ctera/overview.md b/docs/auditor/10.7/addon/ctera/overview.md
index 2d2a98c2af..1973071631 100644
--- a/docs/auditor/10.7/addon/ctera/overview.md
+++ b/docs/auditor/10.7/addon/ctera/overview.md
@@ -36,7 +36,7 @@ follows:
### Configure Logging for CTERA Edge Filer
-Prior to start using the Add-On, configure syslog logging settings on your CTERA Edge Filers. See
+Before you start using the Add-On, configure syslog logging settings on your CTERA Edge Filers. See
the
[Configuring Syslog Settings](https://kb.ctera.com/docs/configuring-logging#configuring-syslog-settings)
article on the CTERA product documentation portal for detailed instructions.
@@ -59,5 +59,5 @@ installed on the same server.
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.7/addon/ctera/parameters.md b/docs/auditor/10.7/addon/ctera/parameters.md
index e142f66165..c297aa9d6e 100644
--- a/docs/auditor/10.7/addon/ctera/parameters.md
+++ b/docs/auditor/10.7/addon/ctera/parameters.md
@@ -16,14 +16,14 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hostingAuditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.ent erprise.local:9999_). Do not modify the endpoint part (_/ netwrix/ api_ ) |
-| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hostingAuditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.ent erprise.local:9999_). Don't modify the endpoint part (_/ netwrix/ api_ ) |
+| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
-| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account currently logged on. |
+| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account logged on. |
| Password | Provide the password for the selected account. |
| Auditor Monitoring Plan settings | |
-| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Auditor Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Auditor Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
diff --git a/docs/auditor/10.7/addon/cyberark/collecteddata.md b/docs/auditor/10.7/addon/cyberark/collecteddata.md
index a24736a0b1..cd4d30c771 100644
--- a/docs/auditor/10.7/addon/cyberark/collecteddata.md
+++ b/docs/auditor/10.7/addon/cyberark/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected by the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.7/addon/cyberark/deployment.md b/docs/auditor/10.7/addon/cyberark/deployment.md
index b937710fe2..4ff40211ec 100644
--- a/docs/auditor/10.7/addon/cyberark/deployment.md
+++ b/docs/auditor/10.7/addon/cyberark/deployment.md
@@ -6,9 +6,7 @@ sidebar_position: 20
# Deploy the Add-On
-Follow the steps to deploy the Add-On:
-
-**Step 1 –** Prepare Auditorfor data processing.
+**Step 1 –** Prepare Auditor for data processing.
**Step 2 –** Configure Syslog message forwarding in CyberArk.
@@ -22,12 +20,12 @@ Follow the steps to deploy the Add-On:
In Auditor client, go to the Integrations section and verify Integration API settings:
-1. Make sure the **Leverage Integration API** is switched to **ON**.
+1. Ensure the **Leverage Integration API** is switched to **ON**.
2. Check the TCP communication port number – default is **9699**.
See the [Prerequisites](/docs/auditor/10.7/api/prerequisites.md) topic for additional information.
-By default, activity records are written to _Netwrix_Auditor_API_ database which is not associated
+By default, activity records are written to _Netwrix_Auditor_API_ database which isn't associated
with a specific monitoring plan.
Optionally, you can create a dedicated monitoring plan in Auditor. In this case, data will be
@@ -45,8 +43,6 @@ On the CyberArk side, you need to specify the server that will receive Syslog me
CyberArk, process them and forward to Auditor Server. This will be the add-on installation server
(the machine where _SyslogService.exe_ runs).
-Follow the steps to configure Syslog message forwarding in CyberArk.
-
**Step 1 –** Log in to your CyberArk system.
**Step 2 –** On the CyberArk server, locate the _%Program Files (x86)%\PrivateArk\Server\Conf_
@@ -60,8 +56,7 @@ folder and open the **dbparam.ini** file for editing.
%\PrivateArk\Server\Syslog_ folder.
Place the _Netwrix.xsl_ file there, too, so that default relative path should be _\Server\Syslog_.
- **SyslogServerPort** – communication port of the syslog server (i.e. add-on installation server).
- Default is **514**. Note that if you are using Netwrix Auditor for Network Devices, this port may
- be already in use, and you should provide another one.
+ Default is **514**. :::warning If you are using Netwrix Auditor for Network Devices, this port may already be in use. Provide another port. :::
- **SyslogServerIP** - IP address of the add-on installation server.
- SyslogServerProtocol – communication protocol for data transfer between CyberArk system and the
add-on. Specify **UDP** protocol.
@@ -83,8 +78,6 @@ _Remember,_ deploy the add-on on the same machine with the Auditor Server.
## Install Add-On
-Follow the steps to install the Add-On:
-
**Step 3 –** Navigate to your add-on package.
**Step 4 –** Unzip the Add-On to a desired folder.
@@ -112,14 +105,14 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hostingAuditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.ent erprise.local:9999_). Do not modify the endpoint part (_/ netwrix/ api_ ) |
-| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hostingAuditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.ent erprise.local:9999_). Don't modify the endpoint part (_/ netwrix/ api_ ) |
+| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
-| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account currently logged on. |
+| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account logged on. |
| Password | Provide the password for the selected account. |
| Auditor Monitoring Plan settings | |
-| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Auditor Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Auditor Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
diff --git a/docs/auditor/10.7/addon/cyberark/overview.md b/docs/auditor/10.7/addon/cyberark/overview.md
index d8d8e60748..3fabaa35e9 100644
--- a/docs/auditor/10.7/addon/cyberark/overview.md
+++ b/docs/auditor/10.7/addon/cyberark/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 80
# CyberArk Privileged Access Security
Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables
-control over changes, configurations and access in hybrid IT environments to protect data regardless
+control over changes, configurations, and access in hybrid IT environments to protect data regardless
of its location. The platform provides security analytics to detect anomalies in user behavior and
investigate threat patterns before a data breach occurs.
@@ -16,7 +16,7 @@ and SSH Keys. It enables organizations to manage and monitor all activities asso
privileged identities, for example, Windows server administrator, root on a UNIX server, etc. A
featured set of the Privileged Access Security tools includes, in particular:
-- **Privileged Session Manager** - a tool that enables users to securely connect to remote targets
+- **Privileged Session Manager** - a tool that lets you securely connect to remote targets
with a standard remote desktop client application, providing isolated sessions.
- **Enterprise Password Vault** – a tool for storage and centralized management of the privileged
accounts; it supports automated changes and logging of the activities associated with all types of
@@ -53,7 +53,7 @@ works as follows:
of events to be monitored, etc.
See the [Monitored Events](/docs/auditor/10.7/addon/cyberark/monitoredevents.md) topic for additional information on the events
- supported for monitoring out of the box.
+ supported by default.
3. On the add-on installation server, the administrator runs the installation file and configures
the Add-On parameters in the configuration wizard.
diff --git a/docs/auditor/10.7/addon/cyberark/parameters.md b/docs/auditor/10.7/addon/cyberark/parameters.md
index 6a5e5bbea7..f98814c154 100644
--- a/docs/auditor/10.7/addon/cyberark/parameters.md
+++ b/docs/auditor/10.7/addon/cyberark/parameters.md
@@ -20,16 +20,16 @@ Parameters in **Settings.xml** can be grouped as follows:
- **General parameters** that affect add- on execution. They are listed in the table below.
- Settings for a certain event source (within the _Source_ section) that can override general
settings.
-- **Internal parameters** that should not be modified in most cases. They are listed in the topic.
+- **Internal parameters** that shouldn't be modified in most cases. They are listed in the topic.
| Parameter | Default value | Description |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General parameters | | |
| ListenUdpPort | 514 | Specify UDP port for listening to the incoming syslog events. |
-| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (/netwrix/api . . . . ) |
-| NetwrixAuditor CertificateThumbprint | NOCHECK | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check the certificate via Windows Certificate Store. - `AB:BB:CC.`—Check the certificate thumbprint identifier. - `NOCHECK`—Do not check the certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
-| NetwrixAuditorPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
-| NetwrixAuditorPlanItem | — | Unless specified, data is not associated with a specific monitoring plan and thus cannot be filtered by item name. Specify an item name here. Make sure to create a dedicated item in Auditor in advance. |
+| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (/netwrix/api . . . . ) |
+| NetwrixAuditor CertificateThumbprint | NOCHECK | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check the certificate via Windows Certificate Store. - `AB:BB:CC.`—Check the certificate thumbprint identifier. - `NOCHECK`—Don't check the certificate. ensure to select this parameter if you plan to specify servers by their IP. |
+| NetwrixAuditorPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, ensure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
+| NetwrixAuditorPlanItem | — | Unless specified, data isn't associated with a specific monitoring plan and thus can't be filtered by item name. Specify an item name here. ensure to create a dedicated item in Auditor in advance. |
| EventStorePath | — | Select where to store temporary files of syslog messages before the add-on sends them to Auditor Server. Netwrix recommends to store these files in the same directory with the add-on (SyslogService.exe). |
| LogLevel | warning | Specify logging level: - none - info - warning (used by default) - error - debug |
| WriteCriticalIssues ToEventLog | 0 | Instructs the add-on to write important events (like service start or critical issue) not only to its own log but also to Netwrix event log. - 1=yes - 0=no (default) |
@@ -37,8 +37,8 @@ Parameters in **Settings.xml** can be grouped as follows:
| NetwrixAuditorPlan | — | When specified, overrides the general settings. |
| NetwrixAuditorPlanItem | — | When specified, overrides the general settings. |
| AppNameRegExp | — | Custom regular expression pattern that will be used to retrieve the application name from your syslog messages. The add-on will match the application name and the files with syslog parsing rules to be applied. The pattern you provide here must match the application name in your custom rule file. Unless specified, RFC 3164/5424 format is used. |
-| AppNameGroupID | — | Define application name value by Group ID only if messages are not formatted in accordance with RFC 3164/5424. Otherwise, leave the default value. |
-| RuleFileList PathFile | cyberark-v2.xml | Specify paths to XML file(s) with regular expression parsing rules. You can create a custom file or use rules provided out of the box. Currently, the **cyberark-v2.xml** rule file is shipped with this add-on. You can specify several rule files. The service will check if the AppName parameter in the first rule file matches the AppNameRegExp and AppNameGroupID regular expression in this file. If not, the service will proceed to the next rule file. |
+| AppNameGroupID | — | Define application name value by Group ID only if messages aren't formatted in accordance with RFC 3164/5424. Otherwise, leave the default value. |
+| RuleFileList PathFile | cyberark-v2.xml | Specify paths to XML files with regular expression parsing rules. You can create a custom file or use the provided rules. the **cyberark-v2.xml** rule file is shipped with this add-on. You can specify several rule files. The service will check if the AppName parameter in the first rule file matches the AppNameRegExp and AppNameGroupID regular expression in this file. If not, the service will proceed to the next rule file. |
| AcceptList Address | — | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. The _Address_ parameter may be followed by optional attributes that override parameters specified above: - _naplan_—A name of associated monitoring plan - _naplanitem_—A name of associated item For example: `172.28.3.15 ` |
Remember to save **Settings.xml** after editing is complete.
diff --git a/docs/auditor/10.7/addon/cyberark/troubleshooting.md b/docs/auditor/10.7/addon/cyberark/troubleshooting.md
index 6eaa4878b7..fb6d1bac4f 100644
--- a/docs/auditor/10.7/addon/cyberark/troubleshooting.md
+++ b/docs/auditor/10.7/addon/cyberark/troubleshooting.md
@@ -11,14 +11,12 @@ same folder as **SyslogService.exe.**
To change the add-on logging level, use the **LogLevel** parameter in the **Settings.xml** file.
-- It is recommended that before the first run you set this parameter to `debug`. This will
- facilitate operations tracking and possible problem solving.
-- After that it is strongly recommended to re-set this parameter to `error` to prevent the
- uncontrolled log growth.
+- Before the first run, set this parameter to `debug`. This will facilitate operations tracking and possible problem solving.
+- After that, reset this parameter to `error` to prevent uncontrolled log growth.
-If you cannot see collected data in Auditor, check the following:
+If you can't see collected data in Auditor, check the following:
-1. In Auditor settings, go to the **Integrations** section and make sure the **Leverage Integration
+1. In Auditor settings, go to the **Integrations** section and ensure the **Leverage Integration
API** is switched to **ON**. Check the communication port number – default is **9699**.
-2. If you configured a dedicated monitoring plan, make sure data source monitoring is enabled.
+2. If you configured a dedicated monitoring plan, ensure data source monitoring is enabled.
3. Verify the parameters you provided in **Settings.xml** and **dbparam.ini**.
diff --git a/docs/auditor/10.7/addon/hyperv/collecteddata.md b/docs/auditor/10.7/addon/hyperv/collecteddata.md
index 6ae8cc55e1..5379c71e68 100644
--- a/docs/auditor/10.7/addon/hyperv/collecteddata.md
+++ b/docs/auditor/10.7/addon/hyperv/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected by the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.7/addon/hyperv/deployment.md b/docs/auditor/10.7/addon/hyperv/deployment.md
index 1f5569263d..b96b7a7351 100644
--- a/docs/auditor/10.7/addon/hyperv/deployment.md
+++ b/docs/auditor/10.7/addon/hyperv/deployment.md
@@ -27,7 +27,7 @@ Users_ local group on the SCVMM server.
-In this scenario, make sure to specify SCVMM server address in the **DataCollectionServer**
+In this scenario, ensure to specify SCVMM server address in the **DataCollectionServer**
parameter (not the machine where SCVMM console runs) in the **settings.xml** configuration file. See
the [Add-On Parameters](/docs/auditor/10.7/addon/hyperv/parameters.md)topic for additional information.
@@ -78,7 +78,7 @@ Configuration parameters __NetwrixAuditorUserName__ and __NetrixAuditorPassword_
``
-Credentials for **Data Collection Server** (that is, SCVMM) are not required.
+Credentials for **Data Collection Server** (that is, SCVMM) aren't required.
## Example 4
diff --git a/docs/auditor/10.7/addon/hyperv/install.md b/docs/auditor/10.7/addon/hyperv/install.md
index 76b7de313f..a9dfa79ff8 100644
--- a/docs/auditor/10.7/addon/hyperv/install.md
+++ b/docs/auditor/10.7/addon/hyperv/install.md
@@ -6,8 +6,6 @@ sidebar_position: 30
# Deploy the Add-On
-Follow the step to deploy the Add-On:
-
**Step 1 –** Prepare Netwrix Auditor for Data Processing.
**Step 2 –** Download the Add-On.
@@ -20,12 +18,12 @@ Follow the step to deploy the Add-On:
In Auditor client, go to the Integrations section and verify Integration API settings:
-1. Make sure the **Leverage Integration API** is switched to **ON**.
+1. Ensure the **Leverage Integration API** is switched to **ON**.
2. Check the TCP communication port number – default is **9699**.
See the [Prerequisites](/docs/auditor/10.7/api/prerequisites.md) topic for additional information.
-By default, activity records are written to _Netwrix_Auditor_API_ database which is not associated
+By default, activity records are written to _Netwrix_Auditor_API_ database which isn't associated
with a specific monitoring plan.
Optionally, you can create a dedicated monitoring plan in Auditor. In this case, data will be
@@ -51,8 +49,8 @@ See the [Add-On Parameters](/docs/auditor/10.7/addon/hyperv/parameters.md)topic
| Parameter | Default value | Description |
| ---------------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| DataCollectionServer | (empty) | Specify SCVMM server to collect data from. You can use IP address, FQDN or NETBIOS name. For _localhost_, leave this parameter empty. |
-| DataCollectionUserName | (empty) | Specify user account that will be used for data collection from SCVMM server. To use the account currently logged in, leave this parameter empty.s Make sure the account has administrative rights on that server (see the [Accounts and Rights](overview.md#accounts-and-rights) topic for additional information). |
+| DataCollectionServer | (empty) | Specify SCVMM server to collect data from. You can use IP address, FQDN, or NETBIOS name. For _localhost_, leave this parameter empty. |
+| DataCollectionUserName | (empty) | Specify user account that will be used for data collection from SCVMM server. To use the account logged in, leave this parameter empty.s ensure the account has administrative rights on that server (see the [Accounts and Rights](overview.md#accounts-and-rights) topic for additional information). |
| DataCollectionPassword | | Specify user account password. |
| ShortTermFolder | ShortTerm | Specify path to the short-term archive (Netwrix Auditor working folder). You can use full or relative path. |
diff --git a/docs/auditor/10.7/addon/hyperv/overview.md b/docs/auditor/10.7/addon/hyperv/overview.md
index b673fa9b18..92e782eaf8 100644
--- a/docs/auditor/10.7/addon/hyperv/overview.md
+++ b/docs/auditor/10.7/addon/hyperv/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 90
# Hyper-V SCVMM
Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables
-control over changes, configurations and access in hybrid IT environments to protect data regardless
+control over changes, configurations, and access in hybrid IT environments to protect data regardless
of its location. The platform provides security analytic to detect anomalies in user behavior and
investigate threat patterns before a data breach occurs.
@@ -68,7 +68,7 @@ See the [Integration API](/docs/auditor/10.7/api/overview.md) topic for addition
of the Activity Record and the capabilities of the Integration API.
8. The add-on uses the Integration API to send the Activity Records to Auditor Server, where this
- data becomes available for search, reporting and alerting.
+ data becomes available for search, reporting, and alerting.
9. Users open Auditor Client to work with collected data:
- Search for file changes using certain criteria
- Export data to PDF or CSV files
@@ -78,7 +78,7 @@ of the Activity Record and the capabilities of the Integration API.
### Add-on Delivery Package
-The add-on delivery package is a ZIP archive comprising several files, including DLLs, configuration
+The add-on delivery package is a ZIP archive comprising several files, including DLLs, configuration,
and executable files. The latter ones are listed in the table below.
| File name | Description |
diff --git a/docs/auditor/10.7/addon/hyperv/parameters.md b/docs/auditor/10.7/addon/hyperv/parameters.md
index bc678cb5fe..d0290e0177 100644
--- a/docs/auditor/10.7/addon/hyperv/parameters.md
+++ b/docs/auditor/10.7/addon/hyperv/parameters.md
@@ -16,16 +16,16 @@ your execution scenario and security policies.
| Parameter | Default value | Description |
| ------------------------------------ | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| NetwrixIntegration | | |
-| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (/netwrix/api . . . . ) |
-| NetwrixAuditor CertificateThumbprint | NOCHECK | Auditor Certificate Thumbprint Property. Possible values: - `AB:BB:CC.`—Check Auditor server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (/netwrix/api . . . . ) |
+| NetwrixAuditor CertificateThumbprint | NOCHECK | Auditor Certificate Thumbprint Property. Possible values: - `AB:BB:CC.`—Check Auditor server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| NetwrixAuditorDateTimeFormat | yyyy-MM-ddTHH:mm:ssZ | Auditor time format. By default, set to zero offset. |
-| NetwrixAuditorPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
-| NetwrixAuditorPlanItem | — | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item in Auditor in advance. |
+| NetwrixAuditorPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, ensure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
+| NetwrixAuditorPlanItem | — | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item in Auditor in advance. |
| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format. The account must be assigned the Contributor role in Netwrix Auditor. |
| NetwrixAuditorUserPassword | Current user credentials | Unless specified, the add-on runs with the current user credentials. Provide a different password if necessary. |
| DataCollection | | |
-| DataCollectionServer | (empty) | Specify SCVMM server to collect data from. You can use IP address, FQDN or NETBIOS name. For localhost, leave this parameter empty. |
-| DataCollectionUserName | (empty) | Specify user account that will be used for data collection from SCVMM server. To use the account currently logged in, leave this parameter empty. Make sure the account has administrative rights on that server (see the [Accounts and Rights](overview.md#accounts-and-rights) topic for additional information). |
+| DataCollectionServer | (empty) | Specify SCVMM server to collect data from. You can use IP address, FQDN, or NETBIOS name. For localhost, leave this parameter empty. |
+| DataCollectionUserName | (empty) | Specify user account that will be used for data collection from SCVMM server. To use the account logged in, leave this parameter empty. ensure the account has administrative rights on that server (see the [Accounts and Rights](overview.md#accounts-and-rights) topic for additional information). |
| DataCollectionPassword | | Specify user account password. |
| ShortTermFolder | ShortTerm | Specify path to the short-term archive (Netwrix Auditor working folder). You can use full or relative path. |
diff --git a/docs/auditor/10.7/addon/hyperv/troubleshooting.md b/docs/auditor/10.7/addon/hyperv/troubleshooting.md
index eb68417583..3a8d79b7c5 100644
--- a/docs/auditor/10.7/addon/hyperv/troubleshooting.md
+++ b/docs/auditor/10.7/addon/hyperv/troubleshooting.md
@@ -6,13 +6,13 @@ sidebar_position: 60
# Maintenance and Troubleshooting
-If you cannot see collected data in Auditor, check the following:
+If you can't see collected data in Auditor, check the following:
- Add-on account has sufficient rights to access SCVMM and Auditor.
-- In Netwrix Auditor settings, go to the **Integrations** section and make sure the **Leverage
+- In Netwrix Auditor settings, go to the **Integrations** section and ensure the **Leverage
Integration API** is switched to **ON**. Check the communication port number – default is
**9699**.
-- If you configured a dedicated monitoring plan, make sure data source monitoring is enabled.
+- If you configured a dedicated monitoring plan, ensure data source monitoring is enabled.
- Verify the parameters you provided in **settings.xml**.
## Monitor Several SCVMM
@@ -50,11 +50,11 @@ Alternatively, you can use **Windows Task Scheduler**.
- If the solution was deployed using the third scenario (that is, SCVMM server and add-on are
running on different machines), then the following error may be written in the solution log:
-The WinRM client cannot process the request.
+The WinRM client can't process the request.
See the [Deployment Scenarios](/docs/auditor/10.7/addon/hyperv/deployment.md)topic for additional information.
-If the authentication scheme is different from Kerberos, or if the client computer is not joined to
+If the authentication scheme is different from Kerberos, or if the client computer isn't joined to
a domain, then HTTPS transport must be used or the destination machine must be added to the
**TrustedHosts** list. To configure this list, use **winrm.cmd**.
diff --git a/docs/auditor/10.7/addon/ibmqradar/automate.md b/docs/auditor/10.7/addon/ibmqradar/automate.md
index 2655f3682c..a7b2b9b255 100644
--- a/docs/auditor/10.7/addon/ibmqradar/automate.md
+++ b/docs/auditor/10.7/addon/ibmqradar/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.7/addon/ibmqradar/collecteddata.md b/docs/auditor/10.7/addon/ibmqradar/collecteddata.md
index 6f1f0a7795..6aecbd739f 100644
--- a/docs/auditor/10.7/addon/ibmqradar/collecteddata.md
+++ b/docs/auditor/10.7/addon/ibmqradar/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
-
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.7/addon/ibmqradar/integrationeventlog.md b/docs/auditor/10.7/addon/ibmqradar/integrationeventlog.md
index b975f2ae89..aa6bb6d3c9 100644
--- a/docs/auditor/10.7/addon/ibmqradar/integrationeventlog.md
+++ b/docs/auditor/10.7/addon/ibmqradar/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.7/addon/ibmqradar/overview.md b/docs/auditor/10.7/addon/ibmqradar/overview.md
index 06be65ae26..a0556ca02e 100644
--- a/docs/auditor/10.7/addon/ibmqradar/overview.md
+++ b/docs/auditor/10.7/addon/ibmqradar/overview.md
@@ -46,5 +46,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.7/addon/ibmqradar/parameters.md b/docs/auditor/10.7/addon/ibmqradar/parameters.md
index 2615b0bb30..785a67a4d7 100644
--- a/docs/auditor/10.7/addon/ibmqradar/parameters.md
+++ b/docs/auditor/10.7/addon/ibmqradar/parameters.md
@@ -31,10 +31,10 @@ dynamically calculated EventIDs will be modified and applied incorrectly.
| Parameter | Default value | Description |
| -------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId\* | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to _TRUE_. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
\* When configuring the **IncludeDataSourceToMakeEventId** parameter, consider that the _Object
Type - Action_ pair may be identical for several data sources (e.g., Object='User' and
diff --git a/docs/auditor/10.7/addon/ibmqradar/powershell.md b/docs/auditor/10.7/addon/ibmqradar/powershell.md
index 2dead271ca..00f51ee93c 100644
--- a/docs/auditor/10.7/addon/ibmqradar/powershell.md
+++ b/docs/auditor/10.7/addon/ibmqradar/powershell.md
@@ -11,11 +11,9 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
-
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -56,7 +54,7 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
first run. At the end of the first run, the timestamp will be created, and the next run will start
diff --git a/docs/auditor/10.7/addon/intelsecurity/automate.md b/docs/auditor/10.7/addon/intelsecurity/automate.md
index 62b9a7045a..93d616af4e 100644
--- a/docs/auditor/10.7/addon/intelsecurity/automate.md
+++ b/docs/auditor/10.7/addon/intelsecurity/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.7/addon/intelsecurity/collecteddata.md b/docs/auditor/10.7/addon/intelsecurity/collecteddata.md
index 6f1f0a7795..6aecbd739f 100644
--- a/docs/auditor/10.7/addon/intelsecurity/collecteddata.md
+++ b/docs/auditor/10.7/addon/intelsecurity/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
-
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.7/addon/intelsecurity/integrationeventlog.md b/docs/auditor/10.7/addon/intelsecurity/integrationeventlog.md
index 08f1754eae..fe146a4f1b 100644
--- a/docs/auditor/10.7/addon/intelsecurity/integrationeventlog.md
+++ b/docs/auditor/10.7/addon/intelsecurity/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.7/addon/intelsecurity/overview.md b/docs/auditor/10.7/addon/intelsecurity/overview.md
index 48adce1313..08b0fe5da1 100644
--- a/docs/auditor/10.7/addon/intelsecurity/overview.md
+++ b/docs/auditor/10.7/addon/intelsecurity/overview.md
@@ -46,5 +46,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.7/addon/intelsecurity/parameters.md b/docs/auditor/10.7/addon/intelsecurity/parameters.md
index 3d19f1cbec..792924bbe9 100644
--- a/docs/auditor/10.7/addon/intelsecurity/parameters.md
+++ b/docs/auditor/10.7/addon/intelsecurity/parameters.md
@@ -31,10 +31,10 @@ dynamically calculated EventIDs will be modified and applied incorrectly.
| Parameter | Default value | Description |
| -------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId\* | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to _TRUE_. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
\* When configuring the **IncludeDataSourceToMakeEventId** parameter, consider that the _Object
Type - Action_ pair may be identical for several data sources (e.g., Object='User' and
diff --git a/docs/auditor/10.7/addon/intelsecurity/powershell.md b/docs/auditor/10.7/addon/intelsecurity/powershell.md
index 1add42cf80..a98681577a 100644
--- a/docs/auditor/10.7/addon/intelsecurity/powershell.md
+++ b/docs/auditor/10.7/addon/intelsecurity/powershell.md
@@ -15,7 +15,7 @@ modify the parameters as required.
**Step 1 –** On computer where you want to execute the add-on, start **Windows PowerShell**.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -56,7 +56,7 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
first run. At the end of the first run, the timestamp will be created, and the next run will start
diff --git a/docs/auditor/10.7/addon/linux/collecteddata.md b/docs/auditor/10.7/addon/linux/collecteddata.md
index 2435ba82e2..a7cc3f7519 100644
--- a/docs/auditor/10.7/addon/linux/collecteddata.md
+++ b/docs/auditor/10.7/addon/linux/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 30
# Work with Collected Data
-Follow the steps to search for collected data:
-
**Step 1 –** Start the Auditor client and navigate to **Search**.
**Step 2 –** Click **Search**.
diff --git a/docs/auditor/10.7/addon/linux/install.md b/docs/auditor/10.7/addon/linux/install.md
index 955178db1f..8fedf31c94 100644
--- a/docs/auditor/10.7/addon/linux/install.md
+++ b/docs/auditor/10.7/addon/linux/install.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Install Add-On
-Follow the steps to install the Add-On:
-
**Step 1 –** Navigate to your add-on package.
**Step 2 –** Unzip the Add-On to a desired folder.
diff --git a/docs/auditor/10.7/addon/linux/overview.md b/docs/auditor/10.7/addon/linux/overview.md
index 0c3fd15f9b..7526affb6e 100644
--- a/docs/auditor/10.7/addon/linux/overview.md
+++ b/docs/auditor/10.7/addon/linux/overview.md
@@ -17,7 +17,7 @@ On a high level, the add-on works as follows:
**Step 1 –** The add-on listens to the specified UDP ports and captures designated Syslog messages.
-**Step 2 –** Out of the box, messages from Red Hat Enterprise Linux 7 and 6, SUSE Linux Enterprise
+**Step 2 –** By default, messages from Red Hat Enterprise Linux 7 and 6, SUSE Linux Enterprise
Server 12, openSUSE42, and Ubuntu 16 are supported. For other distributions, deployment of the
rsyslog package may be required. You can edit the add-on configuration to extend the captured
message list.
@@ -40,4 +40,4 @@ follows:
| ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| The Netwrix Auditor Server side | - The Audit Database settings are configured in Auditor Server. - The TCP **9699** port (default Auditor Integration API port) is open for inbound connections. - The user retrieving data from the Audit Database is granted the Contributor role in Auditor. Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user will have the most extended permissions in the product. |
| The computer where the add-on will be installed | - The UDP 514 port is open for inbound connections. **CAUTION:** UPD 514 port can only be used by one service, otherwise the following error will occur: [ERROR] Error occurred when starting the syslog udp listener. Only one usage of each socket address (protocol/network address/port) is normally permitted - .Net Framework [3.5 SP1](http://www.microsoft.com/en-us/download/details.aspx?id=22), [4.0](https://www.microsoft.com/en-us/download/details.aspx?id=17851), [4.5](https://www.microsoft.com/en-us/download/details.aspx?id=30653), or [4.6](https://www.microsoft.com/en-us/download/details.aspx?id=48130) is installed. |
-| On the target syslog-based platform | Outbound UDP 514 port must be enabled. The **Syslog daemon** must be configured to redirect events. The procedure below explains how to configure redirection. **NOTE:** Red Hat Enterprise Linux 7 and 6, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16 are supported out of the box. For other distributions, deployment of the rsyslog package may be required. - On Red Hat Enterprise Linux 7, perform the following steps: **Step 5 –** Open the **/ etc/ rsyslog.conf** file. **Step 6 –** Add the following line: `auth.*;authpriv.* @name:514;RSYSLOG_SyslogProtocol23Format` where **name** is a FQDN, Net BIOSname or IP address of the computer where Netwrix Auditor Server is installed. For example: `auth.*;authpriv.* @172.28.18.25:514;RSYSLOG_SyslogProtocol23Format` **Step 7 –** Launch the **RHEL console** and execute the following command: `service rsyslog restart` - On Ubuntu 16, perform the following steps: **Step 1 –** Navigate to the **/ etc/ rsyslog.d/ 50-default.conf** file. **Step 2 –** Add the following line: `auth.*;authpriv.* @name:514;RSYSLOG_SyslogProtocol23Format` where **name** is a FQDN, Net BIOSname or IP address of the computer where Netwrix Auditor Server is installed. For example: `auth.*;authpriv.* @172.28.18.25:514;RSYSLOG_SyslogProtocol23Format` **Step 3 –** Launch the **UBUNTU console** and execute the following command: `service rsyslog restart` |
+| On the target syslog-based platform | Outbound UDP 514 port must be enabled. The **Syslog daemon** must be configured to redirect events. The procedure below explains how to configure redirection. **NOTE:** Red Hat Enterprise Linux 7 and 6, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16 are supported by default. For other distributions, deployment of the rsyslog package may be required. - On Red Hat Enterprise Linux 7, perform the following steps: **Step 5 –** Open the **/ etc/ rsyslog.conf** file. **Step 6 –** Add the following line: `auth.*;authpriv.* @name:514;RSYSLOG_SyslogProtocol23Format` where **name** is a FQDN, Net BIOSname or IP address of the computer where Netwrix Auditor Server is installed. For example: `auth.*;authpriv.* @172.28.18.25:514;RSYSLOG_SyslogProtocol23Format` **Step 7 –** Launch the **RHEL console** and execute the following command: `service rsyslog restart` - On Ubuntu 16, perform the following steps: **Step 1 –** Navigate to the **/ etc/ rsyslog.d/ 50-default.conf** file. **Step 2 –** Add the following line: `auth.*;authpriv.* @name:514;RSYSLOG_SyslogProtocol23Format` where **name** is a FQDN, Net BIOSname or IP address of the computer where Netwrix Auditor Server is installed. For example: `auth.*;authpriv.* @172.28.18.25:514;RSYSLOG_SyslogProtocol23Format` **Step 3 –** Launch the **UBUNTU console** and execute the following command: `service rsyslog restart` |
diff --git a/docs/auditor/10.7/addon/linux/parameters.md b/docs/auditor/10.7/addon/linux/parameters.md
index 370912a9ca..37a3971140 100644
--- a/docs/auditor/10.7/addon/linux/parameters.md
+++ b/docs/auditor/10.7/addon/linux/parameters.md
@@ -16,14 +16,14 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hostingAuditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.ent erprise.local:9999_). Do not modify the endpoint part (_/ netwrix/ api_ ) |
-| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hostingAuditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.ent erprise.local:9999_). Don't modify the endpoint part (_/ netwrix/ api_ ) |
+| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
-| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account currently logged on. |
+| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account logged on. |
| Password | Provide the password for the selected account. |
| Auditor Monitoring Plan settings | |
-| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Auditor Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Auditor Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
diff --git a/docs/auditor/10.7/addon/logrhythm/automate.md b/docs/auditor/10.7/addon/logrhythm/automate.md
index 40abd9569c..d029321b39 100644
--- a/docs/auditor/10.7/addon/logrhythm/automate.md
+++ b/docs/auditor/10.7/addon/logrhythm/automate.md
@@ -11,7 +11,7 @@ task manually. To do this, right-click a task and click **Run**.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.7/addon/logrhythm/collecteddata.md b/docs/auditor/10.7/addon/logrhythm/collecteddata.md
index 4eb4fba982..6aecbd739f 100644
--- a/docs/auditor/10.7/addon/logrhythm/collecteddata.md
+++ b/docs/auditor/10.7/addon/logrhythm/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data.
-
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.7/addon/logrhythm/integrationeventlog.md b/docs/auditor/10.7/addon/logrhythm/integrationeventlog.md
index 600a053373..7e3017d59d 100644
--- a/docs/auditor/10.7/addon/logrhythm/integrationeventlog.md
+++ b/docs/auditor/10.7/addon/logrhythm/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.7/addon/logrhythm/overview.md b/docs/auditor/10.7/addon/logrhythm/overview.md
index d843024659..9657df87d0 100644
--- a/docs/auditor/10.7/addon/logrhythm/overview.md
+++ b/docs/auditor/10.7/addon/logrhythm/overview.md
@@ -46,5 +46,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.7/addon/logrhythm/parameters.md b/docs/auditor/10.7/addon/logrhythm/parameters.md
index 9ec8025eb4..aca81ebcc6 100644
--- a/docs/auditor/10.7/addon/logrhythm/parameters.md
+++ b/docs/auditor/10.7/addon/logrhythm/parameters.md
@@ -31,10 +31,10 @@ dynamically calculated EventIDs will be modified and applied incorrectly.
| Parameter | Default value | Description |
| -------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId\* | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to _TRUE_. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
\* When configuring the **IncludeDataSourceToMakeEventId** parameter, consider that the _Object
Type - Action_ pair may be identical for several data sources (e.g., Object='User' and
diff --git a/docs/auditor/10.7/addon/logrhythm/powershell.md b/docs/auditor/10.7/addon/logrhythm/powershell.md
index 69f77943d8..c3dcb6e729 100644
--- a/docs/auditor/10.7/addon/logrhythm/powershell.md
+++ b/docs/auditor/10.7/addon/logrhythm/powershell.md
@@ -11,11 +11,9 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run the script with PowerShell.
-
**Step 1 –** On computer where you want to execute the add-on, start **Windows PowerShell**.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -56,7 +54,7 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
first run. At the end of the first run, the timestamp will be created, and the next run will start
diff --git a/docs/auditor/10.7/addon/nasuni/collecteddata.md b/docs/auditor/10.7/addon/nasuni/collecteddata.md
index a24736a0b1..cd4d30c771 100644
--- a/docs/auditor/10.7/addon/nasuni/collecteddata.md
+++ b/docs/auditor/10.7/addon/nasuni/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected by the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.7/addon/nasuni/install.md b/docs/auditor/10.7/addon/nasuni/install.md
index 955178db1f..8fedf31c94 100644
--- a/docs/auditor/10.7/addon/nasuni/install.md
+++ b/docs/auditor/10.7/addon/nasuni/install.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Install Add-On
-Follow the steps to install the Add-On:
-
**Step 1 –** Navigate to your add-on package.
**Step 2 –** Unzip the Add-On to a desired folder.
diff --git a/docs/auditor/10.7/addon/nasuni/overview.md b/docs/auditor/10.7/addon/nasuni/overview.md
index af04c12974..30177c40d0 100644
--- a/docs/auditor/10.7/addon/nasuni/overview.md
+++ b/docs/auditor/10.7/addon/nasuni/overview.md
@@ -36,8 +36,6 @@ follows:
### Configure Logging for
-Follow the steps to configure the syslog integration.
-
**Step 1 –** Log in to the Nasuni Management Console and go to the **Console Settings** > **Syslog
Exports**.
@@ -53,8 +51,8 @@ configuration.
**Step 4 –** Enable auditing:
1. On the Volumes tab, open **Auditing**.
-2. Choose the volume you wish to be audited and click **Edit Volumes**.
-3. Select the **Auditing Enabled** option and choose which Event Types you wish to be reported.
+2. Choose the volume you want to be audited and click **Edit Volumes**.
+3. Select the **Auditing Enabled** option and choose which Event Types you want to be reported.
4. Hit the **Save Auditing Settings** button.
### Accounts and Rights
@@ -77,5 +75,5 @@ admin privileges.
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.7/addon/nasuni/parameters.md b/docs/auditor/10.7/addon/nasuni/parameters.md
index b7e1600c84..69aa79f5f3 100644
--- a/docs/auditor/10.7/addon/nasuni/parameters.md
+++ b/docs/auditor/10.7/addon/nasuni/parameters.md
@@ -16,14 +16,14 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hostingAuditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.ent erprise.local:9999_). Do not modify the endpoint part (_/ netwrix/ api_ ) |
-| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hostingAuditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.ent erprise.local:9999_). Don't modify the endpoint part (_/ netwrix/ api_ ) |
+| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
-| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account currently logged on. |
+| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account logged on. |
| Password | Provide the password for the selected account. |
| Auditor Monitoring Plan settings | |
-| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Auditor Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Auditor Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
diff --git a/docs/auditor/10.7/addon/nutanixahv/collecteddata.md b/docs/auditor/10.7/addon/nutanixahv/collecteddata.md
index 1496c6a8c7..08cd87c9c5 100644
--- a/docs/auditor/10.7/addon/nutanixahv/collecteddata.md
+++ b/docs/auditor/10.7/addon/nutanixahv/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected by the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.7/addon/nutanixahv/install.md b/docs/auditor/10.7/addon/nutanixahv/install.md
index 02b93b9f01..5b945df2b9 100644
--- a/docs/auditor/10.7/addon/nutanixahv/install.md
+++ b/docs/auditor/10.7/addon/nutanixahv/install.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Deploy the Add-On
-Follow the steps to deploy the Add-On:
-
**Step 1 –** Prepare Auditorfor data processing.
**Step 2 –** Configure message forwarding for Nutanix Prism.
@@ -24,12 +22,12 @@ Follow the steps to deploy the Add-On:
In Auditor client, go to the Integrations section and verify Integration API settings:
-1. Make sure the **Leverage Integration API** is switched to **ON**.
+1. Ensure the **Leverage Integration API** is switched to **ON**.
2. Check the TCP communication port number – default is **9699**.
See the [Prerequisites](/docs/auditor/10.7/api/prerequisites.md) topic for additional information.
-By default, activity records are written to _Netwrix_Auditor_API_ database which is not associated
+By default, activity records are written to _Netwrix_Auditor_API_ database which isn't associated
with a specific monitoring plan.
Optionally, you can create a dedicated monitoring plan in Auditor. In this case, data will be
@@ -146,7 +144,7 @@ topic for information on how to register for a Customer Portal account.
Partners and MSPs who are logged into the Netwrix Partner Portal can download the latest version of
their software products from the My Product page:
[https://www.netwrix.com/par/site/products](https://www.netwrix.com/my_products.html). To receive an
-invitation to the Partner Portal, please contact
+invitation to the Partner Portal, contact
[netwrix.msp@netwrix.com](http://netwrix.msp@netwrix.com/).
## Configure Add-On Parameters
@@ -156,18 +154,18 @@ Open the add-on folder and edit the **settings.xml** file to configure the add-o
| Parameter | Default value | Description |
| ------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| NetwrixAuditorIntegration | | |
-| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (/netwrix/api . . . . ) |
-| CertificateThumbprint | NOCHECK | Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Netwrix Auditor certificate via Windows Certificate Store. - `AB:BB:CC.`—Check Netwrix Auditor Server certificate thumbprint identifier. - `NOCHECK`—Do not check Netwrix Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (/netwrix/api . . . . ) |
+| CertificateThumbprint | NOCHECK | Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Netwrix Auditor certificate via Windows Certificate Store. - `AB:BB:CC.`—Check Netwrix Auditor Server certificate thumbprint identifier. - `NOCHECK`—Don't check Netwrix Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| DateTimeFormat | yyyy-MM-ddTHH:mm:ssZ | Auditor time format. By default, set to zero offset. |
-| MonitoringPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
-| MonitoringPlanItem | — | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item in Auditor in advance. |
+| MonitoringPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, ensure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
+| MonitoringPlanItem | — | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item in Auditor in advance. |
| UserName | Current user credentials | Credentials to access Auditor server. Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor server, specify the account name in the _DOMAIN\username_ format. |
| Password | Current user credentials | Unless specified, the service runs with the current user credentials. Provide a different password if necessary. |
| ARsNumberAtTime | | Maximum number of Audit Records that can be sent to Auditor at a time. |
| ARsSendingPeriodicity | | Periodic time interval for sending Activity Records (in seconds). |
| PauseWhenSendingFailed | | Pause after a failed attempt to send Activity Records (in seconds). |
| **DataCollection** | | |
-| ListenUDPPort | 514 | UDP port for receiving incoming Syslog messages. Make sure that this port is not used by any other add-ons or applications (for example, Netwrix Auditor for Network Devices); otherwise specify another port here. |
+| ListenUDPPort | 514 | UDP port for receiving incoming Syslog messages. Ensure that this port isn't used by any other add-ons or applications (for example, Netwrix Auditor for Network Devices); otherwise specify another port here. |
| StateUpdatingPeriodicity | | Periodic time interval for updating state of clusters (in seconds). |
| EventsReadingPeriodicity | | Periodic time interval for reading events (in seconds). Target endpoint: _/api/nutanix/v2.0/events_ |
| PageLength | | The number of objects loaded with one request. |
diff --git a/docs/auditor/10.7/addon/nutanixahv/overview.md b/docs/auditor/10.7/addon/nutanixahv/overview.md
index 4869593453..80a9ce4846 100644
--- a/docs/auditor/10.7/addon/nutanixahv/overview.md
+++ b/docs/auditor/10.7/addon/nutanixahv/overview.md
@@ -7,12 +7,12 @@ sidebar_position: 150
# Nutanix AHV
Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables
-control over changes, configurations and access in hybrid IT environments to protect data regardless
+control over changes, configurations, and access in hybrid IT environments to protect data regardless
of its location. The platform provides security analytics to detect anomalies in user behavior and
investigate threat patterns before a data breach occurs.
Nutanix AHV is a virtualization platform within the Nutanix Enterprise Cloud architecture. It
-provides facilities for VM deployment, operation and centralized management. Nutanix AHV is a fully
+provides facilities for VM deployment, operation, and centralized management. Nutanix AHV is a fully
integrated component of the Nutanix Enterprise Cloud.
Virtualization teams, Managed Service Providers and other IT professionals need to detect who does
@@ -122,7 +122,7 @@ be then encrypted and stored in the solution configuration.
- By default, the add-on is targeted at a single Nutanix Prism Central/Element server.
- Netwrix add-on must be deployed in the same subnet as Nutanix Prism Central/Element server.
-- Please be aware that monitoring of actions performed on the add-on installation server is not
+- be aware that monitoring of actions performed on the add-on installation server isn't
supported.
### Upgrade Path
diff --git a/docs/auditor/10.7/addon/nutanixahv/troubleshooting.md b/docs/auditor/10.7/addon/nutanixahv/troubleshooting.md
index 2f539f51c8..0e9dbe06dd 100644
--- a/docs/auditor/10.7/addon/nutanixahv/troubleshooting.md
+++ b/docs/auditor/10.7/addon/nutanixahv/troubleshooting.md
@@ -6,18 +6,18 @@ sidebar_position: 50
# Maintenance and Troubleshooting
-If you cannot see collected data in Auditor, check the following:
+If you can't see collected data in Auditor, check the following:
- Service account has sufficient rights to access Auditor.
-- In Auditor settings, go to the **Integrations** section and make sure the **Leverage Integration
+- In Auditor settings, go to the **Integrations** section and ensure the **Leverage Integration
API** is switched to **ON**. Check the communication port number – default is **9699**.
-- If you configured a dedicated monitoring plan, make sure data source monitoring is enabled.
+- If you configured a dedicated monitoring plan, ensure data source monitoring is enabled.
- Verify the parameters you provided in **settings.xml**.
-Also, remember that events from the remote Syslog server (add-on installation server) are not
+Also, remember that events from the remote Syslog server (add-on installation server) aren't
collected.
-Currently, the add-on supports only one Prism installation (Central or Element). To monitor more
+the add-on supports only one Prism installation (Central or Element). To monitor more
than one Prism Central/Element, you can copy the add-on to another folder, configure
**settings.xml** as described in this document and modify **install.ps1** to rename the service:
diff --git a/docs/auditor/10.7/addon/okta/collecteddata.md b/docs/auditor/10.7/addon/okta/collecteddata.md
index f85bec481f..c5c7d3d7e7 100644
--- a/docs/auditor/10.7/addon/okta/collecteddata.md
+++ b/docs/auditor/10.7/addon/okta/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected by the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.7/addon/okta/deployment.md b/docs/auditor/10.7/addon/okta/deployment.md
index d42d6f09b9..3a62f34138 100644
--- a/docs/auditor/10.7/addon/okta/deployment.md
+++ b/docs/auditor/10.7/addon/okta/deployment.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Deploy the Add-On
-Follow the steps to deploy the Add-On.
-
**Step 1 –** Download the distribution package **Netwrix_Auditor_Add-on_for_Okta.zip**.
**Step 2 –** Unpack it to a folder on the computer where you plan to deploy the add-on.
diff --git a/docs/auditor/10.7/addon/okta/overview.md b/docs/auditor/10.7/addon/okta/overview.md
index c6262f9730..609c49e6cf 100644
--- a/docs/auditor/10.7/addon/okta/overview.md
+++ b/docs/auditor/10.7/addon/okta/overview.md
@@ -52,5 +52,5 @@ In case the add-on and Auditor are installed on the same server, no special sett
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.7/addon/overview.md b/docs/auditor/10.7/addon/overview.md
index 3837739a83..1e931d90b7 100644
--- a/docs/auditor/10.7/addon/overview.md
+++ b/docs/auditor/10.7/addon/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 80
# Add-Ons
The [Netwrix Auditor Add-on Store](https://www.netwrix.com/netwrix_addons.html) contains free
-add-ons developed by Netwrix and your peers in the community. The add-ons help you leverage
-integration between your on-premises or cloud applications and Netwrix Auditor.
+add-ons developed by Netwrix and your peers in the community. The add-ons help you integrate
+your on-premises or cloud applications with Netwrix Auditor.
The list of available add-ons keeps growing because with the new RESTful API, the integration
capabilities of Netwrix Auditor are unlimited. Netwrix encourages users to develop add-ons, upload
@@ -17,7 +17,7 @@ them to Netwrix website, and share with community.
Benefits:
- Centralize auditing and reporting of your IT environment — Netwrix unifies auditing of all IT
- systems across your on-premises, cloud or hybrid environment, and enables centralized reporting
+ systems across your on-premises, cloud, or hybrid environment, and enables centralized reporting
for security and compliance.
- Get the most from your SIEM investment — To maximize SIEM value, Netwrix increases the
signal-to-noise ratio and feeds your HP ArcSight, Splunk, IBM QRadar or any other SIEM solution
@@ -52,10 +52,8 @@ Before your start working with the add-on, go through its quick-start guide at
Each guide contains detailed instructions for deploying and running the add-on, as well as
prerequisites and configuration settings. Generic steps are described below.
-Follow the steps to use the add-on.
-
**Step 1 –** Check prerequisites. Since the add-ons work only in combination with Netwrix Auditor,
-make sure that Netwrix Auidtor and its Audit Database are configured, and roles are assigned
+Ensure that Netwrix Auidtor and its Audit Database are configured, and roles are assigned
properly.
**Step 2 –** Specify parameters required for add-on operation. Before running or scheduling the
diff --git a/docs/auditor/10.7/addon/privilegeduserlinux/collecteddata.md b/docs/auditor/10.7/addon/privilegeduserlinux/collecteddata.md
index 6e78bcc77c..243bfc037d 100644
--- a/docs/auditor/10.7/addon/privilegeduserlinux/collecteddata.md
+++ b/docs/auditor/10.7/addon/privilegeduserlinux/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 30
# Work with Collected Data
-Follow the steps to work with collected data:
-
**Step 1 –** Start the Auditor client and navigate to **Search**.
**Step 2 –** Click **Search**.
diff --git a/docs/auditor/10.7/addon/privilegeduserlinux/overview.md b/docs/auditor/10.7/addon/privilegeduserlinux/overview.md
index 4aa57a8770..9f0dc52206 100644
--- a/docs/auditor/10.7/addon/privilegeduserlinux/overview.md
+++ b/docs/auditor/10.7/addon/privilegeduserlinux/overview.md
@@ -16,7 +16,7 @@ On a high level, the add-on works as follows:
1. The add-on listens to the specified UDP ports and captures designated Syslog messages.
- Out of the box, messages from Red Hat Enterprise Linux 7 and 6, SUSE Linux Enterprise Server 12,
+ By default, messages from Red Hat Enterprise Linux 7 and 6, SUSE Linux Enterprise Server 12,
openSUSE 42, and Ubuntu 16 are supported. For other distributions, deployment of the rsyslog
package may be required. You can edit the add-on configuration to extend the captured message
list.
@@ -35,7 +35,7 @@ follows:
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| The Auditor Server side | - The Audit Database settings are configured in Auditor Server. See the [Prerequisites](/docs/auditor/10.7/api/prerequisites.md) and [Audit Database](/docs/auditor/10.7/admin/settings/auditdatabase.md) topics for additional information. - The TCP **9699** port (default Integration API port) is open for inbound connections. - The user writing data to the Audit Database is granted the **Contributor** role in Auditor. See the [Role-Based Access and Delegation](/docs/auditor/10.7/admin/monitoringplans/delegation.md) topic for additional information. Alternatively, you can grant the **Global administrator** role or add the user to the **Netwrix Auditor Administrators** group. In this case, this user will have the most extended permissions in the product. |
| The computer where the service will be installed | - The UDP 514 port is open for inbound connections. - .Net Framework 4.7.2 and above is installed. Review the following Microsoft technical article for additional information on how to install .Net Framework 4.7.2: [Microsoft .NET Framework 4.7.2 offline installer for Windows](https://support.microsoft.com/en-us/topic/microsoft-net-framework-4-7-2-offline-installer-for-windows-05a72734-2127-a15d-50cf-daf56d5faec2). |
-| The target syslog-based platform | The **Syslog daemon** is configured to redirect events. The procedure below explains how to configure redirection: **NOTE:** Red Hat Enterprise Linux 7 and 6, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16 are supported out of the box. For other distributions, deployment of rsyslog package may be required. - On Red Hat Enterprise Linux 7: 1. Open the **/etc/rsyslog.conf** file. 2. Add the following line: `auth.*;authpriv.* @name:514;RSYSLOG_SyslogProtocol23Format` where `name `is a FQDN, NetBIOS name or IP address of the computer where Netwrix Auditor Server is installed. For example: `auth.*;authpriv.* @172.28.18.25:514;RSYSLOG_ SyslogProtocol23Format` 3. Launch the **RHEL console** and execute the following command: `service rsyslog restart`. - On Ubuntu 16: 1. Navigate to the **/etc/rsyslog.d/50-default.conf** file. 2. Add the following line: `auth.*;authpriv.* @name:514;RSYSLOG_SyslogProtocol23Format` where `name `is a FQDN, NetBIOS name or IP address of the computer where Netwrix Auditor Server is installed. For example: `auth.*;authpriv.* @172.28.18.25:514;RSYSLOG_ SyslogProtocol23Format` 3. Launch the **UBUNTU console** and execute the following command: `service rsyslog restart`. |
+| The target syslog-based platform | The **Syslog daemon** is configured to redirect events. The procedure below explains how to configure redirection: **NOTE:** Red Hat Enterprise Linux 7 and 6, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16 are supported by default. For other distributions, deployment of rsyslog package may be required. - On Red Hat Enterprise Linux 7: 1. Open the **/etc/rsyslog.conf** file. 2. Add the following line: `auth.*;authpriv.* @name:514;RSYSLOG_SyslogProtocol23Format` where `name `is a FQDN, NetBIOS name or IP address of the computer where Netwrix Auditor Server is installed. For example: `auth.*;authpriv.* @172.28.18.25:514;RSYSLOG_ SyslogProtocol23Format` 3. Launch the **RHEL console** and execute the following command: `service rsyslog restart`. - On Ubuntu 16: 1. Navigate to the **/etc/rsyslog.d/50-default.conf** file. 2. Add the following line: `auth.*;authpriv.* @name:514;RSYSLOG_SyslogProtocol23Format` where `name `is a FQDN, NetBIOS name or IP address of the computer where Netwrix Auditor Server is installed. For example: `auth.*;authpriv.* @172.28.18.25:514;RSYSLOG_ SyslogProtocol23Format` 3. Launch the **UBUNTU console** and execute the following command: `service rsyslog restart`. |
-See the the [Integration API](/docs/auditor/10.7/api/overview.md) topic for additional information on the
+See the [Integration API](/docs/auditor/10.7/api/overview.md) topic for additional information on the
structure of the Activity Record and the capabilities of the Integration API
diff --git a/docs/auditor/10.7/addon/privilegeduserlinux/parameters.md b/docs/auditor/10.7/addon/privilegeduserlinux/parameters.md
index b1ac95042d..d8557dad81 100644
--- a/docs/auditor/10.7/addon/privilegeduserlinux/parameters.md
+++ b/docs/auditor/10.7/addon/privilegeduserlinux/parameters.md
@@ -16,14 +16,14 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hostingAuditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.ent erprise.local:9999_). Do not modify the endpoint part (_/ netwrix/ api_ ) |
-| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hostingAuditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.ent erprise.local:9999_). Don't modify the endpoint part (_/ netwrix/ api_ ) |
+| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
-| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account currently logged on. |
+| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account logged on. |
| Password | Provide the password for the selected account. |
| Auditor Monitoring Plan settings | |
-| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Auditor Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Auditor Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
diff --git a/docs/auditor/10.7/addon/radius/automate.md b/docs/auditor/10.7/addon/radius/automate.md
index 463df57654..496a86b2f2 100644
--- a/docs/auditor/10.7/addon/radius/automate.md
+++ b/docs/auditor/10.7/addon/radius/automate.md
@@ -14,7 +14,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task
Scheduler**.Select **Create Task**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.7/addon/radius/collecteddata.md b/docs/auditor/10.7/addon/radius/collecteddata.md
index be0186d42d..ad139d2a8a 100644
--- a/docs/auditor/10.7/addon/radius/collecteddata.md
+++ b/docs/auditor/10.7/addon/radius/collecteddata.md
@@ -6,10 +6,8 @@ sidebar_position: 50
# Work with Collected Data
-Auditor provides a convenient interface for reviewing RADIUS server logons. Once the script
-execution completed, you can start analyzing user activity data with Netwrix search.
-
-Follow the steps to see results.
+Auditor provides a convenient interface for reviewing RADIUS server logons. After the script
+execution completes, you can start analyzing user activity data with Netwrix search.
**Step 1 –** Start the Auditor client and navigate to Search.
diff --git a/docs/auditor/10.7/addon/radius/customreport.md b/docs/auditor/10.7/addon/radius/customreport.md
index ab922ade8b..e564fe3c75 100644
--- a/docs/auditor/10.7/addon/radius/customreport.md
+++ b/docs/auditor/10.7/addon/radius/customreport.md
@@ -11,8 +11,6 @@ additional script, **Netwrix_Auditor_Saved_Search_for_RADIUS_Server_Logons.ps1**
the add-on and creates the RADIUS server logons since yesterday custom search-based report in the
Auditor client.
-Follow the steps to create a custom report with the script.
-
**Step 1 –** Copy the **Netwrix_Auditor_Saved_Search_for_RADIUS_Server_Logons.ps1** script to the
Auditor Server.
diff --git a/docs/auditor/10.7/addon/radius/overview.md b/docs/auditor/10.7/addon/radius/overview.md
index 13c6dce56a..813987f94f 100644
--- a/docs/auditor/10.7/addon/radius/overview.md
+++ b/docs/auditor/10.7/addon/radius/overview.md
@@ -25,7 +25,7 @@ sign-in procedures and improve overall security. In a Windows Server environment
is provided by the Network Policy Server (NPS).
In addition to providing user authentication and authorization, a RADIUS server can grant or deny
-access to a connecting device based on network policies. Companies leverage these policies to
+access to a connecting device based on network policies. Companies use these policies to
empower users to connect to the corporate infrastructure using their personal devices, while
disallowing potentially vulnerable and unsafe devices to minimize risk.
@@ -78,5 +78,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.7/addon/radius/parameters.md b/docs/auditor/10.7/addon/radius/parameters.md
index 9be5c91dc4..7458a25474 100644
--- a/docs/auditor/10.7/addon/radius/parameters.md
+++ b/docs/auditor/10.7/addon/radius/parameters.md
@@ -19,7 +19,7 @@ information.
| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., WKS.enterprise.local:9999). |
| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the DOMAIN\username format. The account must be assigned the Global reviewer role in Auditor or be a member of the Netwrix Auditor Client Users group on the computer hosting Auditor Server. |
| NetwrixAuditorPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
-| NetwrixAuditorPlan | – | Unless specified, data is written to **Netwrix\_ Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. **NOTE:** If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
+| NetwrixAuditorPlan | – | Unless specified, data is written to **Netwrix\_ Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. **NOTE:** If you select a plan name in the add-on, ensure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
| RADIUSHost | localhost | Assumes that the script runs on the RADIUS server. If you want to run a script on another machine, provide a name of the computer where RADIUS server resides (e.g., 172.28.6.16, EnterpriseNPS, NPS.enterprise.local). |
| RADIUSUserName | Current user credentials | Unless specified, the script runs with the current user credentials. If you want the script to use another account to access the RADIUS server, specify the account name in the DOMAIN\username format. **NOTE:** The account must be a member of the **Domain Users** group and have the **Manage auditing and security log** right. |
| RADIUSPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
diff --git a/docs/auditor/10.7/addon/radius/powershell.md b/docs/auditor/10.7/addon/radius/powershell.md
index 8f0745c084..75f1a7a5ea 100644
--- a/docs/auditor/10.7/addon/radius/powershell.md
+++ b/docs/auditor/10.7/addon/radius/powershell.md
@@ -11,11 +11,9 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run the script with PowerShell.
-
**Step 1 –** On computer where you want to execute the add-on, start **Windows PowerShell**.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
diff --git a/docs/auditor/10.7/addon/radius/troubleshooting.md b/docs/auditor/10.7/addon/radius/troubleshooting.md
index aaa64f3e10..e3e852b4ae 100644
--- a/docs/auditor/10.7/addon/radius/troubleshooting.md
+++ b/docs/auditor/10.7/addon/radius/troubleshooting.md
@@ -8,5 +8,5 @@ sidebar_position: 70
| Error in PowerShell | Resolution |
| -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| New-Object : Exception calling ".ctor" with "1" argument(s): "Attempted to perform an unauthorized operation." | The account specified for collecting events on the RADIUS server does not have sufficient rights and permissions or the password is incorrect. - Check the password for this account. - Select the account that belongs to the **Domain Users** group and has the **Manage auditing and security log** right in domain where the RADIUS server resides. |
-| New-Object : Exception calling ".ctor" with "1" argument(s): "The RPC server is unavailable" | The firewall on the RADIUS server blocks the script execution. On the server, navigate to the **Help Protect your computer with Windows Firewall** page, select **Advanced Settings** and enable the **Remote Event Log Management (RPC)** inbound rule. |
+| New-Object : Exception calling ".ctor" with "1" arguments: "Attempted to perform an unauthorized operation." | The account specified for collecting events on the RADIUS server doesn't have sufficient rights and permissions or the password is incorrect. - Check the password for this account. - Select the account that belongs to the **Domain Users** group and has the **Manage auditing and security log** right in domain where the RADIUS server resides. |
+| New-Object : Exception calling ".ctor" with "1" arguments: "The RPC server is unavailable" | The firewall on the RADIUS server blocks the script execution. On the server, navigate to the **Help Protect your computer with Windows Firewall** page, select **Advanced Settings** and enable the **Remote Event Log Management (RPC)** inbound rule. |
diff --git a/docs/auditor/10.7/addon/servicenow/alerts.md b/docs/auditor/10.7/addon/servicenow/alerts.md
index 8dd83e904e..d47dddcd16 100644
--- a/docs/auditor/10.7/addon/servicenow/alerts.md
+++ b/docs/auditor/10.7/addon/servicenow/alerts.md
@@ -19,7 +19,7 @@ By default, none of the alerts are integrated with add-on. To instruct the add-o
for alerts, you should enable integration. Netwrix provides a command-line tool for enabling
integration with the add-on.
-**NOTE:** Make sure to turn on alerting in Auditor. You should manually set the state to "**On**"
+**NOTE:** Ensure to turn on alerting in Auditor. You should manually set the state to "**On**"
for all alerts you want to integrate with the add-on.
Perform the following steps to integrate alerts with the add-on:
@@ -36,7 +36,7 @@ C:\Add-on\Netwrix.ITSM.AlertsUploaderTool.exe
| To... | Execute... |
| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Upload alert set shipped with the addon to Auditor | Netwrix.ITSM.AlertsUploaderTool.exe /UploadTemplates Once uploaded, the alerts appear in the **All Alerts** list in Auditor, their names start with "_ITSM add-on_". Make sure to set their state to **"On**" (turn them on) manually. |
+| Upload alert set shipped with the addon to Auditor | Netwrix.ITSM.AlertsUploaderTool.exe /UploadTemplates Once uploaded, the alerts appear in the **All Alerts** list in Auditor, their names start with "_ITSM add-on_". Ensure to set their state to **"On**" (turn them on) manually. |
| Review alert list and their integration status | Netwrix.ITSM.AlertsUploaderTool.exe /List You will see the full list of Auditor alerts, with an enabled or disabled integration status for each alert. |
| Enable integration | Netwrix.ITSM.AlertsUploaderTool.exe /Update "``" Enable where `` is the name of the alert you want to integrate with the add-on. Provide alert names as they appear in Auditor. **NOTE:** You can enable integration with one alert at a time. For example: Netwrix.ITSM.AlertsUploaderTool.exe /Update "ITSM Add-On: User Account Locked Out" Enable |
| Disable integration | Netwrix.ITSM.AlertsUploaderTool.exe /Update "``" Disable where `` is the name of the alert for which you want to disable integration. **NOTE:** You can disable integration with one alert at a time. For example: Netwrix.ITSM.AlertsUploaderTool.exe /Update "ITSM Add-On: User Account Locked Out" Disable |
diff --git a/docs/auditor/10.7/addon/servicenow/deployment.md b/docs/auditor/10.7/addon/servicenow/deployment.md
index d9a95c0a71..b1bf198b6d 100644
--- a/docs/auditor/10.7/addon/servicenow/deployment.md
+++ b/docs/auditor/10.7/addon/servicenow/deployment.md
@@ -6,8 +6,6 @@ sidebar_position: 40
# Deploy the Service
-Follow the steps to deploy the service.
-
**Step 1 –** Locate the add-on folder on the computer where the Auditor Server resides.
**Step 2 –** Run the **install.cmd** file. The file deploys and enables the Auditor **ITSM
diff --git a/docs/auditor/10.7/addon/servicenow/overview.md b/docs/auditor/10.7/addon/servicenow/overview.md
index ab2393a022..63ca4a8f9b 100644
--- a/docs/auditor/10.7/addon/servicenow/overview.md
+++ b/docs/auditor/10.7/addon/servicenow/overview.md
@@ -37,6 +37,6 @@ follows:
| On... | Ensure that... |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| The Auditor Server side | - Auditor version is **9.8** or later. - The Audit Database settings are configured in the Auditor. See the [Audit Database](/docs/auditor/10.7/admin/settings/auditdatabase.md)topic for additional information. - The TCP 9699 port (default Auditor Integration API port) is open for inbound connections. - The user retrieving data from the Audit Database is granted the Global reviewer role in the Auditor or is a member of the Netwrix Auditor Client Users group. Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user will have the most extended permissions in the product. |
-| On the ServiceNow side | - ServiceNow version should be any of the following: - Helsinki - Istanbul - Kingston - London **NOTE:** Currently, Jakarta version has only experimental support. - A new user is created and has sufficient permissions to create tickets and update them. The **itil** role is recommended. If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
+| On the ServiceNow side | - ServiceNow version should be any of the following: - Helsinki - Istanbul - Kingston - London **NOTE:** Jakarta version has only experimental support. - A new user is created and has sufficient permissions to create tickets and update them. The **itil** role is recommended. If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
See the [Integration API](/docs/auditor/10.7/api/overview.md) topic for additional information.
diff --git a/docs/auditor/10.7/addon/servicenow/parameters.md b/docs/auditor/10.7/addon/servicenow/parameters.md
index d574a8a695..87f5ef6391 100644
--- a/docs/auditor/10.7/addon/servicenow/parameters.md
+++ b/docs/auditor/10.7/addon/servicenow/parameters.md
@@ -24,10 +24,10 @@ parameters depending on your execution scenario and security policies.
| **Connection to Netwrix Auditor** | | |
| NetwrixAuditorHost | localhost:9699 | - The add-on runs on the computer where the Auditor Server resides and uses the default Integration API port **9699**. To specify a non-default port, provide a new port number (e.g., _https://localhost:8788_). - The add- on must always run locally, on the computer where the Auditor Server resides. |
| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs under the **LocalSystem** account. If you want the add-on to use another account to connect to the Auditor Server, specify the account name in the _DOMAIN\username_ format. Alternatively, after deploying the **Netwrix Auditor ITSM Integration Service** service, specify an account in its properties. The account must be assigned the Global reviewer role in the Auditor or be a member of the Netwrix Auditor**Administrators** group. The user must have sufficient permissions to create files on the computer. |
-| NetwrixAuditorPassword | – | Provide a password for the account. Unless an account is specified, the service runs under the **LocalSystem** account and does not require a password. |
+| NetwrixAuditorPassword | – | Provide a password for the account. Unless an account is specified, the service runs under the **LocalSystem** account and doesn't require a password. |
| TicketFloodLimit | 10 | Specify the maximum number of standalone tickets the service can create during **TicketFloodInterval**. If a ticket flood limit is reached, the service writes all new alerts into a single ticket. |
| TicketFloodInterval | 3600 | Specify the time period, in seconds. During this time period, the service can create as many tickets as specified in **TicketFloodLimit**. The default value is 3600 seconds, i.e., 1 hour. |
-| ConsolidationInterval | 900 | Specify the time period, in seconds. During this time period, the service does not process similar alerts as they happen but consolidates them before updating open tickets in your ITSM. The default values is 900 seconds, i.e., 15 minutes. This option works in combination with **UpdateTicketOnRepetitiveAlerts** and is helpful if you want to reduce the number of ticket updates on ITSM side. I.e., this option defines the maximum delay for processing alerts and updating existing tickets. Tickets for new alert types are created immediately. For example, a new alert is triggered—the service opens a new incident ticket. The alert keeps firing 20 times more within 10 minutes. Instead of updating the ticket every time, the service consolidates alerts for 15 minutes, and then updates a ticket just ones with all collected data. |
+| ConsolidationInterval | 900 | Specify the time period, in seconds. During this time period, the service doesn't process similar alerts as they happen but consolidates them before updating open tickets in your ITSM. The default values is 900 seconds, i.e., 15 minutes. This option works in combination with **UpdateTicketOnRepetitiveAlerts** and is helpful if you want to reduce the number of ticket updates on ITSM side. I.e., this option defines the maximum delay for processing alerts and updating existing tickets. Tickets for new alert types are created immediately. For example, a new alert is triggered—the service opens a new incident ticket. The alert keeps firing 20 times more within 10 minutes. Instead of updating the ticket every time, the service consolidates alerts for 15 minutes, and then updates a ticket just ones with all collected data. |
| CheckAlertQueueInterval | 5 | Internal parameter. Check and process the alert queue every N seconds; in seconds. |
| UpdateTicketOnRepetitiveAlerts | true | Instead of creating a new ticket, reopen an existing ticket that is in a closed state (be default, closed, canceled, and resolved) if a similar alert occurs within **UpdateInterval**. This option works only when **UpdateTicketOnRepetitiveAlerts** is set to "_true_". **NOTE:** If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
| UpdateInterval | 86400 | Specify the time period, in seconds. If a similar alert occurs in less than N seconds, it is treated as a part of an existing incident. The default value is 86400 seconds, i.e., 24 hours. If an alerts is triggered after the **UpdateInterval** is over, a new ticket is created. |
@@ -36,21 +36,19 @@ parameters depending on your execution scenario and security policies.
| ProcessActivityRecordQueueInterval | 5 | Internal parameter. Process Activity Record queue every N seconds; in seconds. |
| DisplayOnlyFirstActivityRecord | true | Add only the first Activity Record in the work notes, Activity Records that update this ticket will be added as attachments to this ticket. If false, all Activity Records will be displayed in the ticket work notes. |
| **ActivityRecordRequestsRetention** | | |
-| RequestLimit | 5000 | Internal parameter. The maximum number of Activity Record requests the service can store in its internal memory. Once the limit is reached, the service clears Activity Record requests starting with older ones. |
+| RequestLimit | 5000 | Internal parameter. The maximum number of Activity Record requests the service can store in its internal memory. When the limit is reached, the service clears Activity Record requests starting with older ones. |
| RequestLimitInterval | 604800 | Internal parameter. The service can store the Activity Record requests not older than N seconds; in seconds. Older Activity Record requests are cleared. |
| **ActivityRecordWebRequests** | | |
| RequestLimit | 200 | Internal parameter. The maximum number of Activity Records the service can retrieve in a single request. |
| RequestTimeout | 180 | Internal parameter. By default, 3 minutes. Defines the connection timeout. |
| **TicketRequestsRetention** | | |
-| RequestLimit | 300000 | Internal parameter. The maximum number of ticket requests the service can store in its internal memory. Once the limit is reached, the service clears ticket requests starting with older ones. |
+| RequestLimit | 300000 | Internal parameter. The maximum number of ticket requests the service can store in its internal memory. When the limit is reached, the service clears ticket requests starting with older ones. |
| RequestLimitInterval | 604800 | Internal parameter. The service can store the ticket requests not older than N seconds; in seconds. Older tickets requests are cleared. |
**NOTE:** Stop and then restart the service every time you update any of configuration files.
## ServiceNow Parameters
-Follow the steps to define ServiceNow parameters:
-
**Step 1 –** Navigate to your add-on folder and select **ServiceNowSettings.xml**.
**Step 2 –** Define parameters such as ServiceNow connection parameters inside the ``
@@ -61,7 +59,7 @@ section.
| `` parameter | Default value | Description |
| ------------------------ | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| URL | — | Provide a link to your ServiceNow system (e.g., _https://enterprise.service-now.com_). |
-| UserName | — | Specify a user account. Make sure the user has sufficient permissions to create tickets and update them. The **itil** role is recommended. **NOTE:** If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
+| UserName | — | Specify a user account. Ensure the user has sufficient permissions to create tickets and update them. The **itil** role is recommended. **NOTE:** If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
| Password | — | Provide a password. |
**Step 4 –** Review the `` section. The parameters inside this section correspond
@@ -72,7 +70,7 @@ Each `` includes the` ` and` ` pair
ServiceNow ticket field and a value that will be assigned to it. For most parameters, default values
are provided. Add more ticket parameters or update values if necessary.
-**NOTE:** The template remains the same for all alerts and cannot be adjusted per individual alerts.
+**NOTE:** The template remains the same for all alerts and can't be adjusted per individual alerts.
| Name | Value | Description |
| ------------------ | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -81,7 +79,7 @@ are provided. Add more ticket parameters or update values if necessary.
| impact | 1 | Sets **Impact** to "_1 – High_". |
| urgency | 1 | Sets **Urgency** to "_1 – High_". |
| severity | 1 | Sets **Severity** to "_1 – High_". |
-| assignment\_ group | d625dccec0a8016700a22a0 f7900d06 | Sets **Assignment** group to "_Service Desk_". **NOTE:** You cannot use a group name as a value. Provide its guid instead. |
+| assignment\_ group | d625dccec0a8016700a22a0 f7900d06 | Sets **Assignment** group to "_Service Desk_". **NOTE:** You can't use a group name as a value. Provide its guid instead. |
| description | %AlertDescription% %PreviousTicketReference% | Provides an alert description and references to related tickets in **Description**. |
| work_notes | Alert Details: ... | Adds the full alert text to Work notes, including data source, who, what, where, etc. To find out what is included in the alert details, see the **ServiceNowSettings.xml** file. **NOTE:** You can write alert details in the **Additional comments** field instead of Work notes. To do this, rename `work_notes `into `comments`. If you want to write alert details into both fields, create a copy of `` entry containing work_notes and `work_notes` into `comments` tag (e.g., 8 for canceled). |
-| NewState | Defines a ticket status once it is reopened. By default, new. To specify another status, provide its ID in the `` tag (e.g., 1 for new). |
+| NewState | Defines a ticket status when it is reopened. By default, new. To specify another status, provide its ID in the `` tag (e.g., 1 for new). |
**NOTE:** Stop and then restart the service every time you update any of configuration files.
diff --git a/docs/auditor/10.7/addon/siem/activityrecords.md b/docs/auditor/10.7/addon/siem/activityrecords.md
index d48f306e2b..23b070c28e 100644
--- a/docs/auditor/10.7/addon/siem/activityrecords.md
+++ b/docs/auditor/10.7/addon/siem/activityrecords.md
@@ -23,11 +23,9 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters—the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
-
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -69,7 +67,7 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
first run. At the end of the first run, the timestamp will be created, and the next run will start
@@ -90,7 +88,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task
Scheduler**.Task Scheduler.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.7/addon/siem/collecteddata.md b/docs/auditor/10.7/addon/siem/collecteddata.md
index 2a5c298623..2bf782648d 100644
--- a/docs/auditor/10.7/addon/siem/collecteddata.md
+++ b/docs/auditor/10.7/addon/siem/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 40
# Work with Collected Data
-Follow the steps to work with collected data:
-
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.7/addon/siem/configure.md b/docs/auditor/10.7/addon/siem/configure.md
index 1d6eb6d9e5..5573fbc0ad 100644
--- a/docs/auditor/10.7/addon/siem/configure.md
+++ b/docs/auditor/10.7/addon/siem/configure.md
@@ -33,10 +33,10 @@ dynamically calculated EventIDs will be modified and applied incorrectly.
| Parameter | Default value | Description |
| ------------------------------ | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to TRUE. _Object Type - Action_ pair may be identical for several data sources (e.g., Object='User' and Action='Added'); thus, excluding DataSource from calculation may lead to the same EventID (duplicates). See the [Export Activity Records ](/docs/auditor/10.7/addon/siem/activityrecords.md) topic for additional information.. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the **DataSource** field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the **DataSource** field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the **DataSource** field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular **DataSource** does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the **DataSource** field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the **DataSource** field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the **DataSource** field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular **DataSource** doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
## Alerts to Event Log Add-on Settings
diff --git a/docs/auditor/10.7/addon/siem/deployment.md b/docs/auditor/10.7/addon/siem/deployment.md
index e9f15c4fb8..e3f080d498 100644
--- a/docs/auditor/10.7/addon/siem/deployment.md
+++ b/docs/auditor/10.7/addon/siem/deployment.md
@@ -32,7 +32,7 @@ The script will be executed on Auditor Server.
By default, Auditor uses the _LocalSystem_ account to run PowerShell scripts. If you want to use
another account, in the alert settings go to **Response Action**, select the **Use custom
-credentials** checkbox and specify user name and password. Make sure this account has **Log on as
+credentials** checkbox and specify user name and password. Ensure this account has **Log on as
batch job** privilege. See the
[Configure a Response Action for Alert](/docs/auditor/10.7/admin/alertsettings/responseaction.md) topic for
additional information.
diff --git a/docs/auditor/10.7/addon/siem/integrationeventlog.md b/docs/auditor/10.7/addon/siem/integrationeventlog.md
index 9bb6a77b9d..7c82b2c64b 100644
--- a/docs/auditor/10.7/addon/siem/integrationeventlog.md
+++ b/docs/auditor/10.7/addon/siem/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.7/addon/siem/overview.md b/docs/auditor/10.7/addon/siem/overview.md
index 6ce43da0f1..5e60061bc3 100644
--- a/docs/auditor/10.7/addon/siem/overview.md
+++ b/docs/auditor/10.7/addon/siem/overview.md
@@ -50,11 +50,11 @@ follows:
| On... | Ensure that... |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The Auditor Server side | - Auditor version is **9.96** or 10. - The alert response action settings in Auditor Server are configured as follows: - **Take action when alert occurs** is switched **ON** - **Run** field contains the path to Windows PowserShell: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` - **With parameters** field contains the required parameters, including the path to **Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1** file. Example: `-File C:\Netwrix_Auditor_Add-on_for_SIEM\Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1 -NetwrixPathToCsvData` For details on script parameters, see the section below. - **Write data to CSV file** option is selected - **Command line preview** looks like this: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File C:\Netwrix_Auditor_Add-on_for_SIEM\Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1 -NetwrixPathToCsvData {CsvFile}` - By default, the executable file will be launched under the _LocalSystem_ account. If you want to use another account, make sure it has **Log on as batch job** privilege on Netwrix Auditor server. You may want to perform the test run after configuring the script as the alert response action. If so, consider that current user account (logged on to Auditor client) must have local **Administrator** privileges on AuditorServer where the executable file is located. |
+| The Auditor Server side | - Auditor version is **9.96** or 10. - The alert response action settings in Auditor Server are configured as follows: - **Take action when alert occurs** is switched **ON** - **Run** field contains the path to Windows PowserShell: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` - **With parameters** field contains the required parameters, including the path to **Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1** file. Example: `-File C:\Netwrix_Auditor_Add-on_for_SIEM\Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1 -NetwrixPathToCsvData` For details on script parameters, see the section below. - **Write data to CSV file** option is selected - **Command line preview** looks like this: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File C:\Netwrix_Auditor_Add-on_for_SIEM\Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1 -NetwrixPathToCsvData {CsvFile}` - By default, the executable file will be launched under the _LocalSystem_ account. If you want to use another account, ensure it has **Log on as batch job** privilege on Netwrix Auditor server. You may want to perform the test run after configuring the script as the alert response action. If so, consider that current user account (logged on to Auditor client) must have local **Administrator** privileges on AuditorServer where the executable file is located. |
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
## Activity Records to Event Log Add-on
@@ -77,7 +77,7 @@ This add-on works as response action to the alert, as follows:
1. The administrator enables and configured response action for selected alert, as described in the
following topic:
- [Configure a Response Action for Alert](/docs/auditor/10.7/admin/alertsettings/responseaction.md). Make sure
+ [Configure a Response Action for Alert](/docs/auditor/10.7/admin/alertsettings/responseaction.md). Ensure
to provide correct path to the script file and to select the Write data to CSV file option.
2. When the alert is triggered, the script starts - it retrieves audit data (activity record fields)
from the CSV file and processes it into log events. Each event contains the user account, action,
diff --git a/docs/auditor/10.7/addon/siemcefexport/automate.md b/docs/auditor/10.7/addon/siemcefexport/automate.md
index 9750f4d269..ea7f3c6e5c 100644
--- a/docs/auditor/10.7/addon/siemcefexport/automate.md
+++ b/docs/auditor/10.7/addon/siemcefexport/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.7/addon/siemcefexport/collecteddata.md b/docs/auditor/10.7/addon/siemcefexport/collecteddata.md
index eb9595672d..d446366ec3 100644
--- a/docs/auditor/10.7/addon/siemcefexport/collecteddata.md
+++ b/docs/auditor/10.7/addon/siemcefexport/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
-
**Step 1 –** Navigate to the destination folder and open a CEF log file.
**Step 2 –** Review audit data exported from the Audit Database. For example, review this
diff --git a/docs/auditor/10.7/addon/siemcefexport/overview.md b/docs/auditor/10.7/addon/siemcefexport/overview.md
index 77a5276c5e..fc53c415e2 100644
--- a/docs/auditor/10.7/addon/siemcefexport/overview.md
+++ b/docs/auditor/10.7/addon/siemcefexport/overview.md
@@ -46,5 +46,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.7/addon/siemcefexport/powershell.md b/docs/auditor/10.7/addon/siemcefexport/powershell.md
index 26a4c47f31..35d1134bf4 100644
--- a/docs/auditor/10.7/addon/siemcefexport/powershell.md
+++ b/docs/auditor/10.7/addon/siemcefexport/powershell.md
@@ -11,14 +11,11 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
+1. On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
+2. Enter a path to the add-on. Or simply drag and drop the add-on file in the console window.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
-window.
-
-**Step 3 –** Add script parameters. The console will look similar to the following:
+3. Add script parameters. The console will look similar to the following:
Windows PowerShell
@@ -27,14 +24,18 @@ Copyright (C) 2014 Microsoft Corporation. All rights reserved.
PS C:\Users\AddOnUser> C:\Add-ons\Netwrix_Auditor_CEF_Export_Add-on.ps1 -OutputFolder C:\CEF_Export
-NetwrixAuditorHost 172.28.6.15
-**NOTE:** If the script path contains spaces (e.g., _C:\Netwrix Add-ons_), embrace it in double
-quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Add-ons_").
+:::note
+If the script path contains spaces (e.g., _C:\Netwrix Add-ons_), embrace it in double quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Add-ons_").
+:::
-**Step 4 –** Hit **Enter**.
+4. Hit **Enter**.
Depending on the number of Activity Records stored in Auditor Audit Database execution may take a
while. Ensure the script execution completed successfully. The CEF log file will be created in the
-destination folder. Note that details (or 'msg' in CEF terms) exceeding 16000 symbols are trimmed.
+destination folder.
+
+:::note
+Details (or 'msg' in CEF terms) exceeding 16000 symbols are trimmed.
+:::
-Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
-start retrieving new Activity Records.
+Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will start retrieving new Activity Records.
diff --git a/docs/auditor/10.7/addon/siemeventlogexport/automate.md b/docs/auditor/10.7/addon/siemeventlogexport/automate.md
index a038856cad..b6156b66fc 100644
--- a/docs/auditor/10.7/addon/siemeventlogexport/automate.md
+++ b/docs/auditor/10.7/addon/siemeventlogexport/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.7/addon/siemeventlogexport/collecteddata.md b/docs/auditor/10.7/addon/siemeventlogexport/collecteddata.md
index f54d6b1dc3..38c59ad131 100644
--- a/docs/auditor/10.7/addon/siemeventlogexport/collecteddata.md
+++ b/docs/auditor/10.7/addon/siemeventlogexport/collecteddata.md
@@ -6,14 +6,10 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
+1. On the computer where you executed the add-on, navigate to **Start** > **All Programs** > **Event Viewer**.
-**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
-Programs** > **Event Viewer**.
+2. In the **Event Viewer** dialog, navigate to **Event Viewer (local)** > **Applications and Services Logs** > **Netwrix_Auditor_Integration log**.
-**Step 2 –** In the **Event Viewer** dialog, navigate to **Event Viewer (local)** > **Applications
-and Services Logs** > **Netwrix_Auditor_Integration log**.
-
-**Step 3 –** Review events.
+3. Review events.
Now you can augment SIEM with data collected by Auditor.
diff --git a/docs/auditor/10.7/addon/siemeventlogexport/overview.md b/docs/auditor/10.7/addon/siemeventlogexport/overview.md
index 233e58844c..a4e1e3e138 100644
--- a/docs/auditor/10.7/addon/siemeventlogexport/overview.md
+++ b/docs/auditor/10.7/addon/siemeventlogexport/overview.md
@@ -42,6 +42,6 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging the Integration API. Download the latest add- on version in the Add- on Store. See the
[Integration API](/docs/auditor/10.7/api/overview.md) topic for additional information about schema updates.
diff --git a/docs/auditor/10.7/addon/siemeventlogexport/parameters.md b/docs/auditor/10.7/addon/siemeventlogexport/parameters.md
index e4adc18b9d..adaeac0507 100644
--- a/docs/auditor/10.7/addon/siemeventlogexport/parameters.md
+++ b/docs/auditor/10.7/addon/siemeventlogexport/parameters.md
@@ -18,6 +18,6 @@ parameters— the script uses a default value unless a parameter is explicitly d
| Parameter | Default value | Description |
| ---------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add- on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., WKS.enterprise.local:9999). |
+| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., WKS.enterprise.local:9999). |
| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the DOMAIN\username format. **NOTE:** The account must be assigned the **Global reviewer** role in Auditor or be a member of the **Netwrix Auditor Client Users** group on the computer hosting Auditor Server. |
| NetwrixAuditorPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
diff --git a/docs/auditor/10.7/addon/siemeventlogexport/powershell.md b/docs/auditor/10.7/addon/siemeventlogexport/powershell.md
index 4bb7b4194a..1661daae54 100644
--- a/docs/auditor/10.7/addon/siemeventlogexport/powershell.md
+++ b/docs/auditor/10.7/addon/siemeventlogexport/powershell.md
@@ -6,19 +6,13 @@ sidebar_position: 30
# Run the Add-On with PowerShell
-First, provide a path to your add-on followed by script parameters with their values. Each parameter
-is preceded with a dash; a space separates a parameter name from its value. You can skip some
-parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
-modify the parameters as required.
+First, provide a path to your add-on followed by script parameters with their values. Each parameter is preceded with a dash; a space separates a parameter name from its value. You can skip some parameters— the script uses a default value unless a parameter is explicitly defined. If necessary, modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
+1. On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
+2. Enter a path to the add-on. Or simply drag and drop the add-on file in the console window.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
-window.
-
-**Step 3 –** Add script parameters. The console will look similar to the following:
+3. Add script parameters. The console will look similar to the following:
Windows PowerShell
@@ -27,10 +21,11 @@ Copyright (C) 2014 Microsoft Corporation. All rights reserved.
PS C:\Users\AddOnUser> C:\Add-ons\Netwrix_Auditor_Event_Log_Export_Add-on.ps1 - NetwrixAuditorHost
172.28.6.15
-**NOTE:** If the script path contains spaces (e.g., _C:\Netwrix Add-ons_), embrace it in double
-quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Add-ons_").
+:::note
+If the script path contains spaces (e.g., _C:\Netwrix Add-ons_), embrace it in double quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Add-ons_").
+:::
-**Step 4 –** Hit **Enter**.
+4. Hit **Enter**.
Depending on the number of Activity Records stored in Netwrix Auditor Audit Database execution may
take a while. Ensure the script execution completed successfully. The Netwrix Auditor
diff --git a/docs/auditor/10.7/addon/solarwinds/automate.md b/docs/auditor/10.7/addon/solarwinds/automate.md
index 9ff36c90df..c9b8f51278 100644
--- a/docs/auditor/10.7/addon/solarwinds/automate.md
+++ b/docs/auditor/10.7/addon/solarwinds/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.7/addon/solarwinds/collecteddata.md b/docs/auditor/10.7/addon/solarwinds/collecteddata.md
index 6f1f0a7795..44ceb623aa 100644
--- a/docs/auditor/10.7/addon/solarwinds/collecteddata.md
+++ b/docs/auditor/10.7/addon/solarwinds/collecteddata.md
@@ -6,15 +6,11 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
+1. On the computer where you executed the add-on, navigate to **Start** > **All Programs** > **Event Viewer**.
-**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
-Programs** > **Event Viewer**.
+2. In the Event Viewer dialog, navigate to **Event Viewer (local)** > **Applications and Services Logs** > Netwrix Auditor Integration log.
-**Step 2 –** In the Event Viewer dialog, navigate to **Event Viewer (local)** > **Applications and
-Services Logs** >Netwrix Auditor Integration log.
-
-**Step 3 –** Review events.
+3. Review events.
diff --git a/docs/auditor/10.7/addon/solarwinds/integrationeventlog.md b/docs/auditor/10.7/addon/solarwinds/integrationeventlog.md
index a6ef703655..94fca4b38d 100644
--- a/docs/auditor/10.7/addon/solarwinds/integrationeventlog.md
+++ b/docs/auditor/10.7/addon/solarwinds/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.7/addon/solarwinds/overview.md b/docs/auditor/10.7/addon/solarwinds/overview.md
index ffc1351eee..bf76898aee 100644
--- a/docs/auditor/10.7/addon/solarwinds/overview.md
+++ b/docs/auditor/10.7/addon/solarwinds/overview.md
@@ -46,5 +46,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.7/addon/solarwinds/powershell.md b/docs/auditor/10.7/addon/solarwinds/powershell.md
index d99b09e4c5..f519d39736 100644
--- a/docs/auditor/10.7/addon/solarwinds/powershell.md
+++ b/docs/auditor/10.7/addon/solarwinds/powershell.md
@@ -15,8 +15,7 @@ modify the parameters as required.
**Step 1 –** On computer where you want to execute the add-on, start **Windows PowerShell**.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
-window.
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -56,7 +55,7 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
first run. At the end of the first run, the timestamp will be created, and the next run will start
diff --git a/docs/auditor/10.7/addon/splunk/collecteddata.md b/docs/auditor/10.7/addon/splunk/collecteddata.md
index 4e298e671d..dcb6ce3e5e 100644
--- a/docs/auditor/10.7/addon/splunk/collecteddata.md
+++ b/docs/auditor/10.7/addon/splunk/collecteddata.md
@@ -10,79 +10,77 @@ Review the examples below for the possible scenarios on how to work with collect
## Example 1: Search by Index
-Follow the steps to search by index:
+1. Navigate to the Search page of the add-on or Search & Reporting Splunk app
-**Step 1 –** Navigate to the Search page of the add-on or Search & Reporting Splunk app
+2. Enter the search command:
-**Step 2 –** Enter the search command:
+ ```
+ index=``
+ ```
-index=``
+ For example:
-for example:
+ ```
+ index=netwrix
+ ```
-index=netwrix
+3. Press the Last 24 hours button and choose the All time range.
-**Step 3 –** Press the Last 24 hours button and choose All time time range.
+4. Press the search button; you should see list of the events indexed in Splunk.
-**Step 4 –** Press the search button; you should see list of the events currently indexed in Splunk.
+5. Click the arrow button next to any of the returned event to expand the list of parsed fields and confirm that fields are populated properly.
-**Step 5 –** Click on the arrow button next to any of the returned event to expand the list of
-parsed fields and confirm that fields are populated properly.
+If you don't see any fields, ensure that you are running the search in Smart or Verbose mode.
-If you do not see any fields, make sure that you are running the search in Smart or Verbose mode.
+### Get all user account creation events from Microsoft Entra ID
-Follow the steps to get all user account creation events from Microsoft Entra ID (formerly Azure AD)
-ports .
+1. Navigate to the **Search** page of the add-on or **Search & Reporting** Splunk app
-**Step 1 –** Navigate to the **Search** page of the add-on or **Search & Reporting** Splunk app
+2. Enter the search command:
-**Step 2 –** Enter the search command:
+ ```
+ index=netwrix Action=”Added” ObjectType=”user”
+ | table Who Action ObjectType What Where
+ ```
-index=netwrix Action=”Added” ObjectType=”user”
-
-| table Who Action ObjectType What Where
-
-**Step 3 –** Press the Last 24 hours button and choose All time time range.
+3. Press the Last 24 hours button and choose the All time range.
## Example 2: Use Netwrix Auditor Fields in Index Search
-Follow the steps to use Auditor fields in index search:
-
-**Step 1 –** Navigate to the **Search** page of the add-on or **Search & Reporting** Splunk app
-
-**Step 2 –** Enter the search command:
+1. Navigate to the **Search** page of the add-on or **Search & Reporting** Splunk app
-| datamodel `` search
+2. Enter the search command:
-| search sourcetype=netwrix
+ ```
+ | datamodel `` search
+ | search sourcetype=netwrix
+ ```
-for example:
+ For example:
-| datamodel Authentication search
+ ```
+ | datamodel Authentication search
+ | search sourcetype=netwrix
+ ```
-| search sourcetype=netwrix
+3. Press the Last 24 hours button and choose the All time range.
-**Step 3 –** Press the Last 24 hours button and choose All time time range.
+4. Press the search button; you should see list of the events indexed in Splunk and mapped to the selected data model.
-**Step 4 –** Press the search button; you should see list of the events currently indexed in Splunk
-and mapped to the selected data model.
-
-**Step 5 –** Click on the arrow button next to any of the returned event to expand the list of
-parsed fields and confirm that fields are populated properly.
+5. Click the arrow button next to any of the returned event to expand the list of parsed fields and confirm that fields are populated properly.
## Example 3: Use CIM Data Model Search and Data Model Fields
-Follow the steps to get all events for account deletion:
-
-**Step 1 –** Navigate to the Search page of the add-on or Search & Reporting Splunk app
-
-**Step 2 –** Enter the search command:
+### Get all events for account deletion
-| datamodel Change search
+1. Navigate to the Search page of the add-on or Search & Reporting Splunk app
-| search sourcetype=netwrix All_Changes.action=”deleted”
+2. Enter the search command:
-| table All_Changes.vendor_product All_Changes.action All_Changes.src All_Changes.dest
-All_Changes.user All_Changes.object All_Changes.object_attrs
+ ```
+ | datamodel Change search
+ | search sourcetype=netwrix All_Changes.action=”deleted”
+ | table All_Changes.vendor_product All_Changes.action All_Changes.src All_Changes.dest All_Changes.user All_Changes.object All_Changes.object_attrs
+ ```
-**Step 3 –** Press the Last 24 hours button and choose All time time range.
+3. Press the Last 24 hours button and choose the All time range.
diff --git a/docs/auditor/10.7/addon/splunk/datamodelmap.md b/docs/auditor/10.7/addon/splunk/datamodelmap.md
index 42e4e3954c..26f773f782 100644
--- a/docs/auditor/10.7/addon/splunk/datamodelmap.md
+++ b/docs/auditor/10.7/addon/splunk/datamodelmap.md
@@ -9,8 +9,7 @@ sidebar_position: 30
The Splunk Common Information Model (CIM) is installed with an add-on and adds a set of data models
that allow data normalization to simplify search.
-The CIM contains a number of standard data models that can be used for search. Each of them has
-predefined set of standard fields common for different data sources.
+The CIM contains a number of standard data models you can use to search. Each has a predefined set of standard fields common for different data sources.
Netwrix Auditor Add-on for Splunk will map some of the Activity Records that match certain scenario
to the respective CIM data models.
diff --git a/docs/auditor/10.7/addon/splunk/deployment.md b/docs/auditor/10.7/addon/splunk/deployment.md
index 72b32fadee..fea62ffe8f 100644
--- a/docs/auditor/10.7/addon/splunk/deployment.md
+++ b/docs/auditor/10.7/addon/splunk/deployment.md
@@ -10,7 +10,7 @@ sidebar_position: 10
In the Netwrix Auditor client, go to the Integrations section and verify Integration API settings:
-1. Make sure the Leverage Integration API is switched to ON.
+1. Ensure the Leverage Integration API is switched to ON.
2. Check the TCP communication port number – default is 9699.
See the
@@ -19,40 +19,31 @@ for additional information.
## Download the Add-on
-Follow the steps to download the add-on.
+1. Download the distribution package Netwrix_Auditor_Add-on_for_Splunk.zip from [https://www.netwrix.com/add-on_for_splunk.html](https://www.netwrix.com/add-on_for_splunk.html).
-**Step 1 –** Download the distribution package Netwrix_Auditor_Add-on_for_Splunk.zip from the
-following web page:
-[https://www.netwrix.com/add-on_for_splunk.html](https://www.netwrix.com/add-on_for_splunk.html)
-
-**Step 2 –** Unpack it to a folder on the computer from which you can access Splunk Web.
+2. Unpack it to a folder on the computer from which you can access Splunk Web.
## Install the Add-on
-Follow the steps to install the add-on.
-
-**Step 1 –** Login to Splunk Web using Splunk Administrator account.
+1. Log in to Splunk Web using a Splunk Administrator account.
-**Step 2 –** Open the Splunk Apps settings in any of the following ways:
+2. Open the Splunk Apps settings in any of the following ways:
-- On the main Explore Splunk Enterprise screen, click the gear icon at the top of the left **Apps**
- panel:
+ - On the main Explore Splunk Enterprise screen, click the gear icon at the top of the left **Apps** panel:
-
+ 
-- When on any other screen, you can expand the drop-down list at the top panel and choose Manage
- Apps:
+ - When on any other screen, you can expand the dropdown list at the top panel and choose Manage Apps:
- 
+ 
-**Step 3 –** On the **Apps** screen, click Install app from file:
+3. On the **Apps** screen, click Install app from file:
-
+ 
-**Step 4 –** Click Choose File, navigate to the folder where you unpacked the add-on package, select
-the "TA-netwrix-auditor-add-on-for-splunk-1.6.1.spl" file and click Open.
+4. Click Choose File, navigate to the folder where you unpacked the add-on package, select the "TA-netwrix-auditor-add-on-for-splunk-1.6.1.spl" file, and click Open.
-**Step 5 –** Click Upload.
+5. Click Upload.
@@ -66,7 +57,7 @@ The installed add-on should appear in the Apps list in Splunk.
## Prepare for Using Netwrix Auditor Integration API
-Make sure you have the following information required for the add-on configuration:
+Ensure you have the following information required for the add-on configuration:
- User name and password for the account you will be using to access the Netwrix Auditor Integration
API
@@ -75,14 +66,11 @@ Make sure you have the following information required for the add-on configurati
## Configure the Add-on
-Follow the steps to configure the add-on.
-
-**Step 1 –** From the Explore Splunk Enterprise or from the drop-down list on the top Splunk panel,
-open Netwrix Auditor add-on for Splunk and navigate to the Configuration page:
+1. From the Explore Splunk Enterprise or from the dropdown list on the top Splunk panel, open Netwrix Auditor add-on for Splunk and navigate to the Configuration page:
-**Step 2 –** Configure the account:
+2. Configure the account:
1. On the Configuration page, open the Account section.
@@ -93,7 +81,7 @@ open Netwrix Auditor add-on for Splunk and navigate to the Configuration page:
- For the Account name provide a unique name for the account that will be visible to the add-on
users
- In the Username field insert the user name of the account that will be used to access Netwrix
- Auditor Integration API. If a domain account is used, make sure to use the _DOMAIN\User_
+ Auditor Integration API. If a domain account is used, ensure to use the _DOMAIN\User_
format.
- In the Password field insert the account password
@@ -101,7 +89,7 @@ open Netwrix Auditor add-on for Splunk and navigate to the Configuration page:
-**Step 3 –** Configure the Netwrix Auditor Integration API location:
+3. Configure the Netwrix Auditor Integration API location:
1. On the Configuration page open the Add-on Settings section:
@@ -112,21 +100,18 @@ open Netwrix Auditor add-on for Splunk and navigate to the Configuration page:
3. In the Netwrix Auditor API port field provide the TCP port used by Netwrix Auditor Integration
API; by default it is 9699.
- **NOTE:** Make sure that your Netwrix Auditor Integration API is configured to use HTTPS
+ **NOTE:** Ensure that your Netwrix Auditor Integration API is configured to use HTTPS
protocol.
4. Press the **Save** button.
## Configure Data Input
-Splunk uses indexes to store data and manage access to it. While you can send Netwrix Auditor data
-to one of the existing indexes it is strongly recommended to create a separate index.
+Splunk uses indexes to store data and manage access to it. While you can send Netwrix Auditor data to one of the existing indexes, it's strongly recommended to create a separate index.
-Follow the steps to configure data input.
+1. Create a new index to store data from Netwrix Auditor:
-**Step 1 –** Create a new index to store data from Netwrix Auditor:
-
-1. In Splunk expand the Settings drop-down menu and click on the Indexes option under the DATA
+1. In Splunk expand the Settings dropdown menu and click the Indexes option under the DATA
section.
2. Press the **New Index** button to create an index.
3. Provide the new index parameters:
@@ -134,17 +119,14 @@ Follow the steps to configure data input.
- Index name — this parameter will be used in the search.
- App — points where the index configuration is stored; Choosing **Search & Reporting** is
recommended.
- - Check if you need to provide custom location for the Home, Cold and Thawed paths. By default
- they are in the Splunk program folder.
+ - Check if you need to provide a custom location for the Home, Cold, and Thawed paths. By default, they are in the Splunk program folder.
- Set the Max Size of Entire Index to match the expected volume of logs from Netwrix Auditor.
- By default, Splunk deletes old events when the size of the index exceeds its max value. If you
want Splunk to archive them instead specify the Frozen Path.
- Please refer to the
- [Managing Indexers and Clusters of Indexers](https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Aboutmanagingindexes)
- manual for additional details on indexes.
+ Refer to the [Managing Indexers and Clusters of Indexers](https://docs.splunk.com/Documentation/Splunk/8.1.0/Indexer/Aboutmanagingindexes) manual for additional details on indexes.
-**Step 2 –** Create a data input:
+2. Create a data input:
1. Open Netwrix Auditor add-on for Splunk and go to the **Inputs** section.
@@ -166,25 +148,16 @@ Follow the steps to configure data input.
**CAUTION:** This field should never be empty.
- Checkpoint type specifies location for continuation mark data. File is the recommended option.
- Do not change this setting unless advised accordingly by your Splunk Administrator.
+ Don't change this setting unless advised accordingly by your Splunk Administrator.
4. Click the **Add** button.
## Upgrade Procedure
-If you were using the older (Windows event log-based) version of Netwrix Auditor add-on for Splunk
-and plan to migrate to the new version, remember to take the additional steps described below. They
-will help to ensure imported data consistency and avoid excessive operations. Otherwise, the new
-add-on will pull Netwrix Auditor’s activity data that had already been imported into your Splunk
-system by the old add-on.
-
-Follow the steps to upgrade the add-on.
+If you were using the older (Windows event log-based) version of Netwrix Auditor add-on for Splunk and plan to migrate to the new version, take the additional steps described below. They will help ensure imported data consistency and avoid excessive operations. Otherwise, the new add-on will pull Netwrix Auditor activity data that had already been imported into your Splunk system by the old add-on.
-**Step 1 –** Stop the old version of Netwrix Auditor add-on for Splunk. You can do this with the
-Windows Scheduled Tasks.
+1. Stop the old version of Netwrix Auditor add-on for Splunk. You can do this with Windows Scheduled Tasks.
-**Step 2 –** Locate the Netwrix_Auditor_Activity_Records_to_Event_Log_Add-on_Cookie.bin file in the
-installation directory of the old add-on for Splunk. Store that file content to a safe location.
+2. Locate the Netwrix_Auditor_Activity_Records_to_Event_Log_Add-on_Cookie.bin file in the installation directory of the old add-on for Splunk and store its content to a safe location.
-**Step 3 –** Install the new add-on. When prompted for Continuation Mark, enter that
-Netwrix*Auditor* Activity_Records_to_Event_Log_Add-on_Cookie.bin file content.
+3. Install the new add-on. When prompted for Continuation Mark, enter the content from the Netwrix_Auditor_Activity_Records_to_Event_Log_Add-on_Cookie.bin file.
diff --git a/docs/auditor/10.7/addon/splunk/overview.md b/docs/auditor/10.7/addon/splunk/overview.md
index c738d44361..dfe96f6c67 100644
--- a/docs/auditor/10.7/addon/splunk/overview.md
+++ b/docs/auditor/10.7/addon/splunk/overview.md
@@ -6,10 +6,7 @@ sidebar_position: 250
# Splunk
-Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables
-control over changes, configurations and access in hybrid IT environments to protect data regardless
-of its location. The platform provides security analytics to detect anomalies in user behavior and
-investigate threat patterns before a data breach occurs.
+Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables control over changes, configurations, and access in hybrid IT environments to protect data regardless of its location. The platform provides security analytics to detect anomalies in user behavior and investigate threat patterns before a data breach occurs.
Splunk is a log management solution that enables search and visualization of data collected from the
company's IT assets.
@@ -62,8 +59,7 @@ index.
-To learn more about Netwrix Auditor activity records, see the
-[Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md) topic for additional information.
+See [Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md) for details on Netwrix Auditor activity records.
For this data to be provided to Splunk, it adds a new Splunk source type, performing additional data
parsing and field extraction. The audit data is also mapped into the Common Information Model (CIM)
@@ -116,7 +112,7 @@ follows:
### Considerations and limitations
-- If the information is not available in the activity record received from Auditor, it will also not
+- If the information isn't available in the activity record received from Auditor, it will also not
be available in Splunk.
- CIM might not have data models for some of the activity records received from Auditor; such
information can only be accessed in Splunk using search by index.
diff --git a/docs/auditor/10.7/addon/splunk/troubleshooting.md b/docs/auditor/10.7/addon/splunk/troubleshooting.md
index ce843940f6..a911ca2fc3 100644
--- a/docs/auditor/10.7/addon/splunk/troubleshooting.md
+++ b/docs/auditor/10.7/addon/splunk/troubleshooting.md
@@ -6,27 +6,25 @@ sidebar_position: 40
# Maintenance and Troubleshooting
-Splunk records service logs to the \_internal index. Follow the steps to troubleshoot data input
-from Netwrix Auditor API:
+Splunk records service logs to the \_internal index.
-**Step 1 –** Navigate to the Search page of the add-on or Search & Reporting Splunk app.
+1. Navigate to the Search page of the add-on or Search & Reporting Splunk app.
-**Step 2 –** Enter the search command:
+2. Enter the search command:
-```
-index=_internal ""
-```
+ ```
+ index=_internal ""
+ ```
-For example:
+ For example:
-```
-index=_internal ""
-```
+ ```
+ index=_internal ""
+ ```
-**Step 3 –** Press the Last 24 hours button and choose Last 15 minutes time range.
+3. Press the Last 24 hours button and choose Last 15 minutes time range.
-**Step 4 –** Press the search button; you should see list of the events with Splunk service
-information.
+4. Press the search button; you should see list of the events with Splunk service information.
When the add-on operates normally there should be no errors and the following types of events should
appear regularly:
diff --git a/docs/auditor/10.7/admin/alertsettings/create/create.md b/docs/auditor/10.7/admin/alertsettings/create/create.md
index 7435171975..f2063466db 100644
--- a/docs/auditor/10.7/admin/alertsettings/create/create.md
+++ b/docs/auditor/10.7/admin/alertsettings/create/create.md
@@ -18,22 +18,19 @@ topic for additional information.
## Create a Custom Alert
-Follow the steps to create a custom alert.
-
-**Step 1 –** On the main Auditor page, click the Alert settings link under the Configuration section
-on the left:
+1. On the main Auditor page, click the Alert settings link under the Configuration section on the left:
See the [Navigation](/docs/auditor/10.7/admin/navigation/overview.md) topic for additional information.
-**Step 2 –** In the All Alerts window, click Add. Configure the following:
+2. In the All Alerts window, click Add. Configure the following:
| Option | Description |
| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| General | - Specify a name and enter the description for the new alert.
**NOTE:** Make sure that the Send alert when the action occurs option is enabled. Otherwise, the new alert will be disabled. - Email subject — Specify the subject of the email. It is possible to insert variables into the subject line. You can choose between "_Who_", "_What_" and"_Where_" variables. Consider the following:
- Only one variable of each type can be added
- You need to cut off the full path from the object names in "_What_" alert and leave only the actual name. For example, "_\com\Corp\Users\Departments\IT\Username_" should be just "_Username_". If you want to get back to the default Email subject line, click the **Restore Default** button.
- Apply tags — Create a set of tags to more efficiently identify and sort your alerts. Select Edit under Apply tags to associate tags with your alert. Later, you can quickly find an alert of interest using Filter by tags in the upper part of the All Alerts window. To see a full list of alerts ever created in the product, navigate to Settings > Tags.
|
-| Recipients | Select alert recipients. Click Add Recipient and select alert delivery type: - Email — Specify the email address where notifications will be delivered. You can add as many recipients as necessary.
**_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. - SMS-enabled email — Netwrix uses the sms gateway technology to deliver notifications to a phone number assigned to a dedicated email address. Specify email address to receive SMS notifications. Make sure that your carrier supports sms to email gateway technology.
|
-| Filters | Apply a set of filters to narrow events that trigger a new alert. Alerts use the same interface and logic as search. - Filter — Select general type of filter (e.g., "Who", "Data Source", "Monitoring plan", etc.)
- Operator — Configure match types for selected filter (e.g., "Equals", "Does not contain", etc.)
- Value — Specify filter value. See the [View and Search Collected Data](/docs/auditor/10.7/admin/search/overview.md) topic for additional information on how to create and modify filters. The Filters section contains required fields highlighted with red. Once you completed all filters, click Preview on the right pane to see search-based list of events that will trigger your alert. 
|
-| Thresholds | If necessary, enable threshold to trigger the new alert. In this case, a single alert will be sent instead of many alerts. This can be helpful when Auditor detects many activity records matching the filters you specified. Slide the switch under the Send alert when the threshold is exceeded option and configure the following: - Limit alerting to activity records with the same... — Select a filter in the drop-down list (e.g., who). Note that, Auditor will search for activity records with the same value in the filter you selected. Only alerts grouped by the Who parameter can be included in the Behavior Anomalies list. Mind that in this case, the product does not summarize risk scores and shows the value you associated with this alert. This may significantly reduce risk score accuracy.
- Send alert for `<...>` activity records within `<...>` seconds — Select a number of changes that occurred in a given period (in seconds). For example, you want to receive an alert on suspicious activity. You select "_Action_" in the Limit alerting to activity records with the same list and specify a number of actions to be considered an unexpected behavior: _1000_ changes in _60_ seconds. When the selected threshold exceeded, an alert will be delivered to the specified recipients: one for every 1000 removals in 60 seconds, one for every 1000 failed removals in 60 seconds. So you can easily discover what is going on in your IT infrastructure.
|
-| Risk Score | - Slide the switch to On under Include this alert in Behavior Anomalies assessment. See the [Behavior Anomalies](/docs/auditor/10.7/admin/behavioranomalies/overview.md) topic for additional information.
- Associate a risk score with the alert — Assign a risk score based on the type of anomaly and the severity of the deviation from the normal behavior. An action's risk score is a numerical value from 1 (Low) to 100 (High) that designates the level of risk with 100 being the riskiest and 1 the least risky. These are general guidelines you can adopt when setting a risk score:
- High score — Assign to an action that requires your immediate response (e.g., adding account to a privileged group). Configure a non-threshold alert with email recipients.
- Above medium score — Assign to a repetitive action occurring during a short period of time. While a standalone action is not suspicious, multiple actions merit your attention (e.g., mass deletions from a SharePoint site). Configure a threshold-based alert with email recipients.
- Low score — Assign to an infrequent action. While a single action is safe, multiple occurrences aggregated over a long period of time may indicate a potential in-house bad actor (e.g., creation of potentially harmful files on a file share). Configure a non-threshold alert, email recipients are optional but make sure to regularly review the Behavior Anomalies dashboard.
- Low score — Assign to a repetitive action that does not occur too often (e.g., rapid logons). Multiple occurrences of action sets may indicate a potential in-house bad actor or account compromise. Configure a threshold-based alert, email recipients are optional but make sure to regularly review the Behavior Anomalies dashboard.
|
+| General | - Specify a name and enter the description for the new alert.
**NOTE:** Ensure that the Send alert when the action occurs option is enabled. Otherwise, the new alert will be disabled. - Email subject — Specify the subject of the email. You can insert variables into the subject line from "_Who_", "_What_", and "_Where_". Consider the following:
- Only one variable of each type can be added
- You need to cut off the full path from the object names in "_What_" alert and leave only the actual name. For example, "_\com\Corp\Users\Departments\IT\Username_" should be just "_Username_". If you want to get back to the default Email subject line, click the **Restore Default** button.
- Apply tags — Create a set of tags to more efficiently identify and sort your alerts. Select Edit under Apply tags to associate tags with your alert. Later, you can quickly find an alert of interest using Filter by tags in the upper part of the All Alerts window. To see a full list of alerts ever created in the product, navigate to Settings > Tags.
|
+| Recipients | Select alert recipients. Click Add Recipient and select alert delivery type: - Email — Specify the email address where notifications will be delivered. You can add as many recipients as necessary.
**_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. - SMS-enabled email — Netwrix uses the sms gateway technology to deliver notifications to a phone number assigned to a dedicated email address. Specify email address to receive SMS notifications. ensure that your carrier supports sms to email gateway technology.
|
+| Filters | Apply a set of filters to narrow events that trigger a new alert. Alerts use the same interface and logic as search. - Filter — Select general type of filter (e.g., "Who", "Data Source", "Monitoring plan", etc.)
- Operator — Configure match types for selected filter (e.g., "Equals", "Doesn't contain", etc.)
- Value — Specify filter value. See the [View and Search Collected Data](/docs/auditor/10.7/admin/search/overview.md) topic for additional information on how to create and modify filters. The Filters section contains required fields highlighted with red. After you complete all filters, click Preview on the right pane to see search-based list of events that will trigger your alert. 
|
+| Thresholds | If necessary, enable threshold to trigger the new alert. In this case, a single alert will be sent instead of many alerts. This can be helpful when Auditor detects many activity records matching the filters you specified. Slide the switch under the Send alert when the threshold is exceeded option and configure the following: - Limit alerting to activity records with the same... — Select a filter in the dropdown list (e.g., who). Auditor will search for activity records with the same value in the filter you selected. Only alerts grouped by the Who parameter can be included in the Behavior Anomalies list. Be aware that in this case, the product doesn't summarize risk scores and shows the value you associated with this alert, which may significantly reduce risk score accuracy.
- Send alert for `<...>` activity records within `<...>` seconds — Select a number of changes that occurred in a given period (in seconds). For example, you want to receive an alert on suspicious activity. You select "_Action_" in the Limit alerting to activity records with the same list and specify a number of actions to be considered an unexpected behavior: _1000_ changes in _60_ seconds. When the selected threshold exceeded, an alert will be delivered to the specified recipients: one for every 1000 removals in 60 seconds, one for every 1000 failed removals in 60 seconds. So you can easily discover what is going on in your IT infrastructure.
|
+| Risk Score | - Slide the switch to On under Include this alert in Behavior Anomalies assessment. See the [Behavior Anomalies](/docs/auditor/10.7/admin/behavioranomalies/overview.md) topic for additional information.
- Associate a risk score with the alert — Assign a risk score based on the type of anomaly and the severity of the deviation from the normal behavior. An action's risk score is a numerical value from 1 (Low) to 100 (High) that designates the level of risk with 100 being the riskiest and 1 the least risky. These are general guidelines you can adopt when setting a risk score:
- High score — Assign to an action that requires your immediate response (e.g., adding account to a privileged group). Configure a non-threshold alert with email recipients.
- Above medium score — Assign to a repetitive action occurring during a short period of time. While a standalone action isn't suspicious, multiple actions merit your attention (e.g., mass deletions from a SharePoint site). Configure a threshold-based alert with email recipients.
- Low score — Assign to an infrequent action. While a single action is safe, multiple occurrences aggregated over a long period of time may indicate a potential in-house bad actor (e.g., creation of potentially harmful files on a file share). Configure a non-threshold alert, email recipients are optional but ensure to regularly review the Behavior Anomalies dashboard.
- Low score — Assign to a repetitive action that doesn't occur too often (e.g., rapid logons). Multiple occurrences of action sets may indicate a potential in-house bad actor or account compromise. Configure a threshold-based alert, email recipients are optional but ensure to regularly review the Behavior Anomalies dashboard.
|
| Response Action | You can instruct Auditor to perform a response action when the alert occurs — for example, start an executable file (command, batch file, or other) that will remediate the issue, or open a ticket with the help desk, and so on. For that, you will need an executable file stored locally on the Auditor server. Slide the switch to turn the feature **ON**, and see the [Configure a Response Action for Alert](/docs/auditor/10.7/admin/alertsettings/responseaction.md) topic for additional information. |
diff --git a/docs/auditor/10.7/admin/alertsettings/create/createeventlog.md b/docs/auditor/10.7/admin/alertsettings/create/createeventlog.md
index 6edaf2eed4..d824f70d3f 100644
--- a/docs/auditor/10.7/admin/alertsettings/create/createeventlog.md
+++ b/docs/auditor/10.7/admin/alertsettings/create/createeventlog.md
@@ -6,28 +6,19 @@ sidebar_position: 10
# Create Alerts for Event Log
-Alerts are configurable notifications triggered by certain events and sent to the specified
-recipients. You can enable or disable, and modify existing alerts, and create new alerts. To do it,
-click Configure next to Alerts.
+Alerts are configurable notifications triggered by certain events and sent to the specified recipients. You can enable or disable, modify existing alerts, and create new alerts. To do it, click Configure next to Alerts.
-Follow the steps to create new alert.
+1. In the Alerts window, click Add to start a new alert.
-**Step 1 –** In the Alerts window, click Add to start new alert.
+2. On the Alert Properties step, specify the alert name and enter an alert description (optional). Specify the number of alerts per email. Grouped alerts for different computers will be delivered in separate email messages. This value is set to 1 by default, which means each alert will be delivered as a separate email message.
-**Step 2 –** On the Alert Properties step, specify the alert name and enter alert description
-(optional). Specify the number alerts per email. Grouped alerts for different computers will be
-delivered in separate email messages. This value is set to 1 by default, which means that each alert
-will be delivered as a separate email message.
+3. On the Notifications step, configure email notifications and customize the notification template if needed. Click Edit next to Customize notifications template and modify the template by deleting or inserting information fields.
-**Step 3 –** On the Notifications step, configure email notifications and customize the notification
-template, if needed. Click Edit next to Customize notifications template. Edit the template by
-deleting or inserting information fields.
+ The %ManagedObjectName% variable will be replaced with your monitoring plan name.
-The %ManagedObjectName% variable will be replaced with your monitoring plan name.
+4. On the Event filters step, specify an event that will trigger the alert.
-**Step 4 –** On the Event filters step, specify an event that will trigger the alert.
-
-**Step 5 –** Complete the Event Filters wizard. Complete the following fields:
+5. Complete the Event Filters wizard by filling the following fields:
- In the Event tab:
@@ -35,7 +26,7 @@ The %ManagedObjectName% variable will be replaced with your monitoring plan name
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | Specify the filter name. |
| Description | Enter the description for this filter (optional). |
- | Event Log | Select an event log from the drop-down list. You will be alerted on events from this event log. You can also input a different event log. To find out a log’s name, navigate to Start > Windows Administrative Tools > **Event Viewer** > **Applications and Services Logs** > Microsoft > Windows and expand the required Log_Name node, right-click the file under it and select Properties. Find the event log’s name in the Full Name field. Auditor does not collect the Analytic and Debug logs, so you cannot configure alerts for these logs. You can use a wildcard (\*). In this case you will be alerted on events from all Windows logs except for the ones mentioned above. |
+ | Event Log | Select an event log from the dropdown list. You will be alerted on events from this event log. You can also input a different event log. To find out a log’s name, navigate to Start > Windows Administrative Tools > **Event Viewer** > **Applications and Services Logs** > Microsoft > Windows and expand the required Log_Name node, right-click the file under it and select Properties. Find the event log’s name in the Full Name field. Auditor doesn't collect the Analytic and Debug logs, so you can't configure alerts for these logs. You can use a wildcard (\*). In this case you will be alerted on events from all Windows logs except for the ones mentioned above. |
- In the Event Fields tab:
@@ -54,6 +45,6 @@ The %ManagedObjectName% variable will be replaced with your monitoring plan name
| Option | Description |
| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
- | Consider the following event Insertion Strings | Specify this parameter if you want to receive alerts on events containing a specific string in the EventData. You can use a wildcard (\*). Click Add and specify Insertion String. |
+ | Consider the following event Insertion Strings | Specify this parameter if you want to receive alerts on events containing a specific string in the EventData. You can use a wildcard (\*). Click Add and specify the Insertion String. |
-**Step 6 –** Click OK to save the changes and close the Event Filters dialog.
+6. Click OK to save the changes and close the Event Filters dialog.
diff --git a/docs/auditor/10.7/admin/alertsettings/create/createhealthstatus.md b/docs/auditor/10.7/admin/alertsettings/create/createhealthstatus.md
index 2fd65dee82..9e3ff3ce91 100644
--- a/docs/auditor/10.7/admin/alertsettings/create/createhealthstatus.md
+++ b/docs/auditor/10.7/admin/alertsettings/create/createhealthstatus.md
@@ -16,13 +16,13 @@ data on Auditor health status events. See the topic for additional information.
**Step 1 –** Start Netwrix Auditor Event Log Manager and create the new monitoring plan.
-**Step 2 –** Make sure that the Enable event log collection checkbox is selected. Specify the name
+**Step 2 –** ensure that the Enable event log collection checkbox is selected. Specify the name
for the new plan, for example, _"\_Netwrix Auditor \_Health Status"_.
**Step 3 –** Navigate to the Monitored computers list and add a server where the Auditor server
resides.
-**Step 4 –** On the General tab, click Configure next to Alerts. Make sure the predefined alerts are
+**Step 4 –** On the General tab, click Configure next to Alerts. Ensure the predefined alerts are
disabled. Click Add to create anew alert.
**Step 5 –** In the Alert Properties wizard, specify the alert name and enter alert description
diff --git a/docs/auditor/10.7/admin/alertsettings/create/createmailboxaccess.md b/docs/auditor/10.7/admin/alertsettings/create/createmailboxaccess.md
index 6fd8953c3c..0546195eba 100644
--- a/docs/auditor/10.7/admin/alertsettings/create/createmailboxaccess.md
+++ b/docs/auditor/10.7/admin/alertsettings/create/createmailboxaccess.md
@@ -13,37 +13,25 @@ need to create a monitoring plan for auditing event logs.
## Create Alerts for Non-Owner Mailbox Access Events
-The procedure below describes the basic steps, required for creation of a monitoring plan that will
-be used to collect data on non-owner mailbox access events. See
-[Event Log Manager](/docs/auditor/10.7/tools/eventlogmanager/eventlogmanager.md) topic for additional information.
+The procedure below describes the basic steps required to create a monitoring plan for collecting data on non-owner mailbox access events. See [Event Log Manager](/docs/auditor/10.7/tools/eventlogmanager/eventlogmanager.md) for additional information.
-Follow the steps to create alert for non-owner mailbox access events.
+1. Create a monitoring plan in Netwrix Auditor Event Log Manager.
-**Step 1 –** Create a monitoring plan in Netwrix Auditor Event Log Manager.
+2. Ensure that the Enable event log collection checkbox is selected. Specify a name for the new plan, for example, "_Non-owner mailbox access auditing_".
-**Step 2 –** Make sure that the Enable event log collection checkbox is selected. Specify the name
-for the new plan, for example, "_Non-owner mailbox access auditing_".
+3. Navigate to the Monitored computers list and add the server where your Exchange organization resides.
-**Step 3 –** Navigate to the Monitored computers list and add a server where your Exchange
-organization resides.
+4. On the General tab, click Configure next to Alerts. Ensure the predefined alerts are disabled and click Add to create an alert for non-owner mailbox access events.
-**Step 4 –** On the General tab, click Configure next to Alerts. Make sure the predefined alerts are
-disabled. Click Add to create an alert for non-owner mailbox access event.
+5. In the Alert Properties wizard, specify the alert name and enter an alert description (optional). Specify the number of alerts per email. Grouped alerts for different computers will be delivered in separate email messages. This value is set to 1 by default, which means each alert will be delivered as a separate email message.
-**Step 5 –** In the Alert Properties wizard, specify the alert name and enter alert description
-(optional). Specify the number alerts per email. Grouped alerts for different computers will be
-delivered in separate email messages. This value is set to 1 by default, which means that each alert
-will be delivered as a separate email message.
+6. Specify the alert recipient if you want the alert delivered to a non-default email address.
-**Step 6 –** Specify alert recipient if you want the alert to be delivered to a non-default email.
+7. Navigate to Event Filters and click Add to specify an event that will trigger the alert.
-**Step 7 –** Navigate to Event Filters and click Add to specify an event that will trigger the
-alert.
+8. Complete the Event Filter dialog.
-**Step 8 –** Complete the Event Filter dialog.
-
-- In the Event tab, specify the filter name and description. In the Event Log field enter _"Netwrix
- Non-Owner Mailbox Access Agent"_.
+ - In the Event tab, specify the filter name and description. In the Event Log field, enter _"Netwrix Non-Owner Mailbox Access Agent"_.
- In the Event Fields tab, complete the following fields:
@@ -67,27 +55,21 @@ alert.
- Source—Enter _"Netwrix Non-Owner Mailbox Access Agent"_.
-- In the Insertion Strings tab, select Consider the following event Insertion Strings to receive
- alerts on events containing a specific string in the EventData. Click Add and specify the
- Insertion String.
+ - In the Insertion Strings tab, select Consider the following event Insertion Strings to receive alerts on events containing a specific string in the EventData. Click Add and specify the Insertion String.
-**Step 9 –** Click OK to save the changes and close the Event Filters dialog.
+9. Click OK to save the changes and close the Event Filters dialog.
-**Step 10 –** In the Netwrix Auditor Event Log Manager wizard, navigate to Notifications and specify
-the email address where notifications will be delivered.
+10. In the Netwrix Auditor Event Log Manager wizard, navigate to Notifications and specify the email address where notifications will be delivered.
-**_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified
-email address and inform you if any problems are detected.
+ **RECOMMENDED:** Click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected.
-**Step 11 –** Click Edit next to Audit Archiving Filters step, in the Inclusive Filters section
-clear the filters you do not need, click Add and specify the following information:
+11. Click Edit next to Audit Archiving Filters step. In the Inclusive Filters section, clear the filters you don't need, click Add, and specify the following information:
-- The filter name and description (e.g., Non-owner mailbox access event)
-- In Event Log, enter _"Netwrix Non-Owner Mailbox Access Agent"_.
-- In Write to, select Long-Term Archive. The events will be saved into the local repository.
+ - The filter name and description (e.g., Non-owner mailbox access event)
+ - In Event Log, enter _"Netwrix Non-Owner Mailbox Access Agent"_
+ - In Write to, select Long-Term Archive. The events will be saved to the local repository.
-**Step 12 –** Click Save. If an event occurs that triggers an alert, an email notification will be
-sent immediately to the specified recipients.
+12. Click Save. When an event occurs that triggers an alert, an email notification will be sent immediately to the specified recipients.
## Review Event Description
diff --git a/docs/auditor/10.7/admin/alertsettings/dashboard.md b/docs/auditor/10.7/admin/alertsettings/dashboard.md
index 9edab38871..fc9c99673f 100644
--- a/docs/auditor/10.7/admin/alertsettings/dashboard.md
+++ b/docs/auditor/10.7/admin/alertsettings/dashboard.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Alerts Overview Dashboard
-Aggregated statistics on the alerts is provided in the Alerts overview widget. It displays currently
+Aggregated statistics on the alerts is provided in the Alerts overview widget. It displays
triggered alerts with detailed information.
To view the dashboard, on the main Auditor page, click the Alerts tile.
@@ -25,9 +25,7 @@ The dashboard includes the following widgets:
-Clicking any tile except for Risk score by top 5 users drills down to the Alert history dashboard
-that provides users with the detailed information about the latest alerts triggered in their IT
-infrastructure enriched with the actionable chart and timeline.
+Clicking any tile except Risk score by top 5 users opens the Alert history dashboard, which provides detailed information about the latest alerts triggered in your IT infrastructure, including an actionable chart and timeline.
diff --git a/docs/auditor/10.7/admin/alertsettings/manage.md b/docs/auditor/10.7/admin/alertsettings/manage.md
index d3d81ef6c4..4d0e27c6bf 100644
--- a/docs/auditor/10.7/admin/alertsettings/manage.md
+++ b/docs/auditor/10.7/admin/alertsettings/manage.md
@@ -6,11 +6,7 @@ sidebar_position: 30
# Manage Alerts
-For your convenience, Netwrix provides you with a set of predefined alerts that are commonly used
-for IT infrastructure monitoring. The out-of-the-box alerts include those that help you detect
-suspicious activity and inform you on critical changes to your environment. The alerts contain
-pre-configured filters and in most cases you only need to enable an alert and select who will
-receive notifications.
+For your convenience, Netwrix provides you with a set of predefined alerts commonly used for IT infrastructure monitoring. These default alerts help you detect suspicious activity and inform you of critical changes to your environment. Most predefined alerts include pre-configured filters, so you typically only need to enable an alert and select recipients.
You can add any elements (a dashboard, report, alert, risk, etc.) to the Auditor Home screen to
access them instantly. See the [Navigation](/docs/auditor/10.7/admin/navigation/overview.md) and
diff --git a/docs/auditor/10.7/admin/alertsettings/overview.md b/docs/auditor/10.7/admin/alertsettings/overview.md
index 254faa7313..d23ff6ed2e 100644
--- a/docs/auditor/10.7/admin/alertsettings/overview.md
+++ b/docs/auditor/10.7/admin/alertsettings/overview.md
@@ -6,10 +6,7 @@ sidebar_position: 70
# Alerts
-If you want to be notified about suspicious activity, you can configure alerts that will be
-triggered by specific events. Alerts are sent after the specified action has been detected. Alerts
-are helpful if you want to be notified about actions critical to your organization security and have
-to mitigate risks once the suspicious action occurs.
+If you want to be notified about suspicious activity, you can configure alerts to be triggered by specific events. Alerts are sent after the specified action is detected. This helps you respond to critical actions and mitigate risks after suspicious activity occurs.
Review the following to take advantage of the Alerts functionality:
@@ -28,13 +25,12 @@ The example alert is triggered when a new user is created in the monitored domai
## Tags
-Netwrix Auditor allows you to apply tags when creating an alert. Applying tags to alerts allows you
-to distinguish one alert from another or create groups of similar alerts.
+Apply tags when creating an alert to distinguish one alert from another or create groups of similar alerts. Tags help organize related alerts.
-The Tags page contains a complete list of alerts that were created in the product. Currently, you
-cannot assign or create tags on this page.
+The Tags page contains a complete list of alerts that were created in the product. you
+can't assign or create tags on this page.
To apply tags to an alert, navigate to alert settings and locate the Apply tags section on the
General tab. See the [Create Alerts](/docs/auditor/10.7/admin/alertsettings/create/create.md) topic to receive information about tags applying.
diff --git a/docs/auditor/10.7/admin/alertsettings/responseaction.md b/docs/auditor/10.7/admin/alertsettings/responseaction.md
index 0c811d4ba0..d658653c70 100644
--- a/docs/auditor/10.7/admin/alertsettings/responseaction.md
+++ b/docs/auditor/10.7/admin/alertsettings/responseaction.md
@@ -19,29 +19,19 @@ Response Action settings contain the following configuration options:
- With parameters – If your script contains parameters, specify them here
- Working directory – If you need to specify a working directory for your script to perform the
operation, insert the path here
-- Write data to CSV file – If this checkbox is selected, Netwrix Auditor will save activity records
- in a CSV file. You can use it to pass information into your response action to receive a more
- targeted response.
-- Limit row count in a file to – Select the desired number of rows you want for the file
+- Write data to CSV file – If this checkbox is selected, Netwrix Auditor will save activity records in a CSV file. You can use it to pass information into your response action to receive a more targeted response.
+- Limit row count in a file to – Specify the number of rows to include in the file
- Use custom credentials – Enter the username and password if you want the script to be run as an
account different from LocalSystem
-- Command line preview – Showing a preview of the command line script. Click **Test run** button to
- test its performance.
+- Command line preview – Shows a preview of the command line script. Click **Test run** to test its performance.
-Follow the steps to configure the required settings in the Response Action tab of the alert
-properties.
+1. Turn the switch to On if you want a response action to be taken when the alert occurs.
-**Step 1 –** Turn the switch to On if you want a response action to be taken when the alert occurs.
+2. In the Run field, specify the path to the executable file (_.exe_, _.cmd_, _.bat_; for _.ps1_ files, see step 3 below). The file must be located on the machine where Netwrix Auditor server runs.
-**Step 2 –** In the Run field, specify the path to the executable file (_.exe_, ._cmd_, _.bat_; for
-_.ps1_ files see step 3 below). The file must be located on the machine where Netwrix Auditor server
-runs.
+3. In the With parameters field, enter the parameters to be used by the executable file. Use a space character as a separator.
-**Step 3 –** In the With parameters field, enter the parameters to be used by the executable file.
-Use space character as a separator.
-
-**Step 4 –** To run _.exe_, _.cmd_ and _.bat_ files, you can enter the path to your command-line or
-batch file directly in the Run field, for example:
+4. To run _.exe_, _.cmd_, and _.bat_ files, you can enter the path to your command-line or batch file directly in the Run field. For example:
@@ -53,39 +43,26 @@ script. For example:
-Unless you select to Write data to CSV file, Auditor will also pass the following parameters to the
-command line:
+Unless you select Write data to CSV file, Auditor will also pass the following parameters to the command line:
- _AlertID_ — alert ID
- _RecordID_ — ID of the activity record that triggered the alert
-Selecting Write data to CSV file will change this behavior, as described in the Configure a Response
-Action for Alert section below.
+Selecting Write data to CSV file will change this behavior.
-**Step 5 –** In the Working directory field, specify path to the working directory of the executable
-file on NAuditor server.
+5. In the Working directory field, specify the path to the working directory of the executable file on the Auditor server.
-**Step 6 –** In the Working directory field, specify path to the working directory of the executable
-file on NAuditor server.
+6. In the Working directory field, specify the path to the working directory of the executable file on the Auditor server.
-If you leave this field empty, then the path to the file specified in the Run field will be used as
-a working directory. As shown in the example with the _.ps_ file, this may be the system directory.
-So, to avoid system directory cluttering, it is recommended not to leave the Working directory field
-empty but to explicitly specify the directory where your executable file is located, or a dedicated
-directory for that purpose. In the latter case, make sure the directory exists on Auditor server.
+If you leave this field empty, the path specified in the Run field will be used as the working directory. As shown in the PowerShell example, this may be a system directory. To avoid system directory clutter, specify the directory where your executable file is located or a dedicated directory. Ensure the directory exists on the Auditor server.
-**Step 7 –** Write data to CSV file — select this option if you want Auditor to locate the activity
-records associated with the alert, and write the record fields and their values in a structured way
-to a ._csv_ file. For each new alert being created, this option is selected by default, as well as
-for the predefined alerts installed with Auditor.
+7. **Write data to CSV file** — Select this option if you want Auditor to locate the activity records associated with the alert and write the record fields and their values to a _.csv_ file. This option is selected by default for new alerts and predefined alerts installed with Auditor.
-After the upgrade, all alerts with previously configured response action will have this option
-cleared.
+ After an upgrade, all alerts with previously configured response actions will have this option cleared.
-**Step 8 –** Limit row count in a file to `` — limit the number of rows (activity records) to be
-written to a single ._csv_ file. Enter a value from _1_ to _1000_.
+8. **Limit row count in a file to ``** — Limit the number of rows (activity records) written to a single _.csv_ file. Enter a value from 1 to 1000.
-Learn more about how these options work in the Configure a Response Action for Alert section.
+For more information on these options, see the Response Action settings section below.
By default, the executable file will be launched under the _LocalSystem_ account. If you want to use
another account, select the Use custom credentials checkbox and specify user name and password. Make
@@ -113,14 +90,14 @@ After the test run, you will get a notification message with the exit code. Typi
follows:
- **0** — the response action completed successfully
-- Any other value — the response action was not a success
+- Any other value — the response action wasn't a success
**_RECOMMENDED:_** Apply similar logic if you plan to use custom exit codes in your response action
script.
Same exit codes will be returned by response action regular runs.
-If the action is not a success (exit code is not 0), the program will try to perform response action
+If the action isn't a success (exit code isn't 0), the program will try to perform response action
again (up to 200 times) with increasing time interval.
## Write Data to a CSV File
@@ -142,9 +119,4 @@ create 5 CSV files, with 10 records in each chunk. Also notice that the response
launched once for every such chunk (5 times in this example), and will retrieve multiple activity
records per launch (not more than the specified limit, i.e. 10 records in this example).
-A CSV file is named using the timestamp and GUID and stored in the subfolder of Netwrix Auditor
-working folder (by default, _%ProgramData%\Netwrix
-Auditor\AuditCore\AuditArchive\AlertsToolLauncher\Csv_). Note that a CSV file will exist only while
-the executable file is running – after the execution is completed, the CSV file will be deleted. So
-if you plan, for example, to obtain some data from that file for further processing, you may need to
-copy it to a permanent location in a timely manner, e.g., using a script.
+A CSV file is named using the timestamp and GUID and stored in the subfolder of the Netwrix Auditor working folder (by default, _%ProgramData%\Netwrix Auditor\AuditCore\AuditArchive\AlertsToolLauncher\Csv_). A CSV file exists only while the executable file is running—after execution completes, the CSV file is deleted. If you need to obtain data from the file for further processing, copy it to a permanent location in a timely manner (for example, using a script).
diff --git a/docs/auditor/10.7/admin/behavioranomalies/dashboard.md b/docs/auditor/10.7/admin/behavioranomalies/dashboard.md
index 9f666368f6..314cb7f7ab 100644
--- a/docs/auditor/10.7/admin/behavioranomalies/dashboard.md
+++ b/docs/auditor/10.7/admin/behavioranomalies/dashboard.md
@@ -6,8 +6,7 @@ sidebar_position: 10
# Review Behavior Anomalies Dashboard
-To review the Behavior Anomalies dashboard, process and filter anomalies in user profiles, you must
-be assigned the Global administrator or Global reviewer role in the product. See the
+To review the Behavior Anomalies dashboard, process, and filter anomalies in user profiles, you must be assigned the Global administrator or Global reviewer role in the product. See the
[Role-Based Access and Delegation](/docs/auditor/10.7/admin/monitoringplans/delegation.md) topic for additional
information.
@@ -17,9 +16,7 @@ access them instantly. See the [Navigation](/docs/auditor/10.7/admin/navigation/
To review the Behavior Anomalies dashboard:
-On the main Auditor page, click
-
-on the left.
+On the main Auditor page, click the  on the left.
@@ -30,9 +27,7 @@ The dashboards includes the following sections:
chart, click the pie chart icon in the upper left corner of the page.
- The user list with all users who provoked alerts and their total risk scores.
-Once you reviewed the general anomaly trend and identified users that merit your special attention,
-review their profiles and process anomalies. Click View Profile next to a user name to dive into
-user activity and investigate each action in details.
+After reviewing the general anomaly trend and identifying users that merit your special attention, review their profiles and process anomalies. Click View Profile next to a user name to view user activity and investigate each action in detail.
[Review User Profiles and Process Anomalies](/docs/auditor/10.7/admin/behavioranomalies/userprofile.md)
[Review User Profiles and Process Anomalies](/docs/auditor/10.7/admin/behavioranomalies/userprofile.md)
diff --git a/docs/auditor/10.7/admin/behavioranomalies/overview.md b/docs/auditor/10.7/admin/behavioranomalies/overview.md
index 24a4052a72..8c056060f5 100644
--- a/docs/auditor/10.7/admin/behavioranomalies/overview.md
+++ b/docs/auditor/10.7/admin/behavioranomalies/overview.md
@@ -6,10 +6,7 @@ sidebar_position: 80
# Behavior Anomalies
-Netwrix Auditor enables you to detect behavior anomalies in your IT environment, such as activity
-surges or mass deletions of archived data. As you investigate suspicious activity and review
-incidents, you can identify intruders or in-house bad actors who keep violating your company's
-security policies.
+Use Netwrix Auditor to detect behavior anomalies in your IT environment, such as activity surges or mass deletions of archived data. As you investigate suspicious activity and review incidents, you can identify intruders or in-house bad actors who violate your company's security policies.
The behavior anomalies assessment extends the alerting functionality and provides both a high-level
visualization and a detailed history of malicious user activity. While alerts notify you on a single
@@ -25,23 +22,16 @@ On a high level, your behavior anomalies assessment workflow can be described as
between 1 and 100 points, reflects how critical the action is for your organization.
[Risk Score](/docs/auditor/10.7/admin/alertsettings/create/create.md)how to set a risk score for an alert.
- Although Netwrix industry experts suggest risk scores for alerts that are provided
- out-of-the-box, you can easily tailor these scores to your organization needs and priorities.
- You can always adjust risk scores over time as you become more aware of behavior patterns and
- anomalous actions in your environment.
+ Although Netwrix industry experts suggest risk scores for default alerts, you can easily tailor these scores to your organization's needs and priorities. You can adjust risk scores over time as you become more aware of behavior patterns and anomalous actions in your environment.
-2. Each action that provokes an alert is treated as anomaly. Once the anomaly is detected, it
- appears on a dashboard's timeline and its risk score is added to the user's total score.
-3. Every now and then, you review the Behavior Anomalies dashboard—the risk score timeline with
- anomaly surges, and the most active users. The general rule of thumb is: the more risk score
- points the user has the more he or she merits your attention.
+2. Each action that provokes an alert is treated as an anomaly. When the anomaly is detected, it appears on the dashboard timeline and its risk score is added to the user's total score.
+
+3. Regularly review the Behavior Anomalies dashboard—the risk score timeline with anomaly surges and the most active users. The more risk score points a user has, the more attention they merit.
[Review Behavior Anomalies Dashboard](/docs/auditor/10.7/admin/behavioranomalies/dashboard.md)
-4. To learn more about user activity, you can drill-down to a user profile to review all alerts
- provoked by this user. As you review anomalies and mitigate risks, the user's total score
- reduces. [Review User Profiles and Process Anomalies](/docs/auditor/10.7/admin/behavioranomalies/userprofile.md)
+4. View details of a user's activity by opening their profile to review all alerts they triggered. As you review anomalies and mitigate risks, the user's total score decreases. [Review User Profiles and Process Anomalies](/docs/auditor/10.7/admin/behavioranomalies/userprofile.md)
The purpose of the dashboard is to keep risks low and help you spot and address issues as they
-occur. The risk score assigned to a user does not qualify him or her as a bad actor but rather
+occur. The risk score assigned to a user doesn't qualify him or her as a bad actor but rather
brings your attention to behavior patterns. Depending on the role in your organization, users might
have different safe levels while you should make your priority to review the anomalies on time, stay
focused, and proactively mitigate risks.
diff --git a/docs/auditor/10.7/admin/behavioranomalies/tips.md b/docs/auditor/10.7/admin/behavioranomalies/tips.md
index 19581e80cb..60c1541ae8 100644
--- a/docs/auditor/10.7/admin/behavioranomalies/tips.md
+++ b/docs/auditor/10.7/admin/behavioranomalies/tips.md
@@ -16,7 +16,7 @@ helpful when configuring scoring settings and reviewing behavior anomalies.
rights elevation or suspicious access attempts?
Try to review user tasks—you may find out that the anomaly the user keeps provoking is a genuine
- part of his or her daily routine. For example, the office staff should not reset passwords for
+ part of his or her daily routine. For example, the office staff shouldn't reset passwords for
other accounts while this is a basic task for a system administrator. In this case, review your
alert settings and exclude the user from the alert filters.
@@ -30,6 +30,6 @@ helpful when configuring scoring settings and reviewing behavior anomalies.
- Is anyone who is charge of "Failed..." anomaly a bad actor?
Anyone can forget a password or accidentally try to access some data in a wrong folder. Such
- users are not subject to immediate prosecution unless they do not provoke repetitive alerts. The
+ users aren't subject to immediate prosecution unless they don't provoke repetitive alerts. The
best practice is to review user profile after some time and check if there are any threat
patterns in user behavior.
diff --git a/docs/auditor/10.7/admin/behavioranomalies/userprofile.md b/docs/auditor/10.7/admin/behavioranomalies/userprofile.md
index 0b0ce05370..002dc8b110 100644
--- a/docs/auditor/10.7/admin/behavioranomalies/userprofile.md
+++ b/docs/auditor/10.7/admin/behavioranomalies/userprofile.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Review User Profiles and Process Anomalies
-The user profile enables you to investigate user behavior and take a closer look at anomalies.
+Use the user profile to investigate user behavior and examine anomalies in detail.
To view a user profile
@@ -19,7 +19,7 @@ The user profile page contains the following sections:
- User data with the name and the total risk score. Click Show user activity below the total risk
score, to launch the Interactive Search in a new window. Use it to see all user actions, including
- those that were not treated as anomalies.
+ those that weren't treated as anomalies.
- The Risk score timeline that demonstrates anomalous activity surges. Modify the timeframe to
narrow down the results.
- The Risk score by top five alerts chart that outlines the most frequent anomalies provoked by
@@ -27,12 +27,10 @@ The user profile page contains the following sections:
- The anomalies list displays details for each anomaly: the alert that was triggered, the date and
time, the risk score and anomaly status.
- Double-click an entry to see more details: who did what, when and where the action was made,
- etc. Navigate to Linked actions and click Show user activity or Show this activity record to
- invoke Interactive Search and see all user actions or a specific action correspondingly.
+ Double-click an entry to view details: who did what, when, and where the action was made. Navigate to Linked actions and click Show user activity or Show this activity record to invoke Interactive Search and view all user actions or a specific action.
Netwrix Auditor shows only the top 2,000 anomalies. Modify the timeframe or hide reviewed anomalies,
-and then click Refresh to see more anomalies.
+and then click Refresh to display additional anomalies.
## Process Anomalies and Reduce Risk Score
@@ -50,9 +48,7 @@ To change an anomaly status
-Once the anomaly is reviewed, it disappears from the timeline and chart, and its associated risk
-score is taken from user's total score. The reviewed anomalies supplement the status with the
-reviewer name and date (e.g., _Reviewed by CORP\Administrator (10/02/2017 10:12:03 AM)_).
+After an anomaly is reviewed, it disappears from the timeline and chart, and its associated risk score is removed from the user's total score. The reviewed anomalies include the reviewer name and date in the status (e.g., _Reviewed by CORP\Administrator (10/02/2017 10:12:03 AM)_).
You can always revert changes and assign the Active status back.
@@ -60,23 +56,20 @@ To process all anomalies
- In the Actions section, select Mark all as reviewed.
-In this case, all anomalies that are currently in view will be set to _"reviewed"_. Perform this
+In this case, all anomalies that are in view will be set to _"reviewed"_. Perform this
operation only with a proper justification. Since Netwrix Auditor shows only the top 2,000
-anomalies, make sure to click Refresh to check if there are more anomalies to be reviewed.
+anomalies, ensure to click Refresh to check if there are more anomalies to be reviewed.
-The anomalies that are excluded from view by filters are not affected by the Mark all as reviewed
+The anomalies that are excluded from view by filters aren't affected by the Mark all as reviewed
action.
## Customize Anomalies List
By default, all anomalies are in view. The Filters section helps you show or hide anomalies.
-Click Customize view and clear the checkboxes next to alert names, if you do not want to see
+Click Customize view and clear the checkboxes next to alert names, if you don't want to see
anomalies associated with them.
-When you hide an alert from view, its associated anomalies will no longer be displayed on a
-timeline, chart, or in the list but the user total score will remain unchanged. Note that hidden
-anomalies cannot be reviewed in bulk with the Mark all as reviewed action.
+When you hide an alert from view, its associated anomalies will no longer be displayed on the timeline, chart, or in the list, but the user's total score will remain unchanged. Hidden anomalies can't be reviewed in bulk with the Mark all as reviewed action.
-Hide reviewed anomalies enables you to modify the anomalies list so that you can focus on active
-anomalies only. To see reviewed anomalies, click Show reviewed anomalies.
+Use the Hide reviewed anomalies option to modify the anomalies list and focus on active anomalies only. To view reviewed anomalies, click Show reviewed anomalies.
diff --git a/docs/auditor/10.7/admin/compliancemappings.md b/docs/auditor/10.7/admin/compliancemappings.md
index 3a24e44e4d..dbfb283bc5 100644
--- a/docs/auditor/10.7/admin/compliancemappings.md
+++ b/docs/auditor/10.7/admin/compliancemappings.md
@@ -6,11 +6,6 @@ sidebar_position: 100
# Compliance Mappings
-This tile contains links to the practical guides on how to comply with different standards using
-Netwrix Auditor. The guides were prepared by Netwrix industry experts and contain full information
-about most popular compliance standards. Clicking the 'Learn more...' link under a desired standard
-opens the page on the Netwrix website. Here you can review a brief description of each compliance
-standard supported by the product and download E book containing detailed requirements for the
-standards.
+This tile contains links to practical guides on how to comply with different standards using Netwrix Auditor. Netwrix industry experts prepared these guides with full information about the most popular compliance standards. Clicking the link under a standard opens the page on the Netwrix website where you can review a description of the standard and download an E-book with detailed requirements.
diff --git a/docs/auditor/10.7/admin/healthstatus/dashboard/activityrecordstatistics.md b/docs/auditor/10.7/admin/healthstatus/dashboard/activityrecordstatistics.md
index 45a46a6e17..b7dad35edd 100644
--- a/docs/auditor/10.7/admin/healthstatus/dashboard/activityrecordstatistics.md
+++ b/docs/auditor/10.7/admin/healthstatus/dashboard/activityrecordstatistics.md
@@ -6,21 +6,18 @@ sidebar_position: 10
# Activity Records Statistics
-Aggregated statistics on the activity records is provided in the Activity records by date widget.
-The chart shows the number of activity records produced by your data sources, collected and saved by
-Netwrix Auditor during the last 7 days. This data can help you to assess the activity records
-generation intensity in your IT infrastructure, and product load.
+The Activity records by date widget provides aggregated statistics on activity records. The chart shows the number of activity records produced by your data sources, collected, and saved by Netwrix Auditor during the last 7 days. This data helps you assess activity record generation intensity in your IT infrastructure and product load.
After you click View details, the Activity Records Statistics window will be displayed.
By default, statistics on activity records processing is grouped by Monitoring plan and presented
-for the Last 7 days. To modify the timeframe, use the drop-down list in the upper right corner.
+for the Last 7 days. To modify the timeframe, use the dropdown list in the upper right corner.
Other fields provide the following information: data source that produces activity records, with
date and time of the last collected record, and the overall number of records collected and uploaded
to the corresponding Audit database during the specified timeframe.
-If the data sources processed by a monitoring plan did not produce any activity records during the
+If the data sources processed by a monitoring plan didn't produce any activity records during the
specified timeframe, this monitoring plan will not appear in the list.
diff --git a/docs/auditor/10.7/admin/healthstatus/dashboard/databasestatistics.md b/docs/auditor/10.7/admin/healthstatus/dashboard/databasestatistics.md
index a27b837221..e51629917e 100644
--- a/docs/auditor/10.7/admin/healthstatus/dashboard/databasestatistics.md
+++ b/docs/auditor/10.7/admin/healthstatus/dashboard/databasestatistics.md
@@ -12,7 +12,7 @@ adjust retention accordingly. The widget displays the name of default SQL Server
all Netwrix Auditor databases, the overall database capacity at the moment and its change over the
last day (24 hours).
-Transaction logs size is not included in the calculations.
+Transaction logs size isn't included in the calculations.
After you click View details, the following information will be displayed for the specified SQL
Server instance:
@@ -34,7 +34,7 @@ instance of the SQL Server:
The following capacity metrics are displayed for each database:
- **State**—database state summary
-- **Size**—current database size (logs are not included)
+- **Size**—current database size (logs aren't included)
- **Activity records**—number of the activity records stored in the database at the moment
After you expand the database node, the detailed database properties will be shown:
@@ -58,5 +58,4 @@ You can use the Search field, or apply a filter to display the information you n
the Apply Filters dialog you can select the Show only plans with issues to display only the
monitoring plans that require attention and corrective actions.
-This information will help you to troubleshoot the product operation, detect and eliminate the root
-cause of the monitoring errors, providing for auditing continuity and compliance.
+This information helps you troubleshoot product operation, detect, and eliminate the root cause of monitoring errors, ensuring auditing continuity and compliance.
diff --git a/docs/auditor/10.7/admin/healthstatus/dashboard/healthlog.md b/docs/auditor/10.7/admin/healthstatus/dashboard/healthlog.md
index 07aba7dd8f..8e2bf3cc87 100644
--- a/docs/auditor/10.7/admin/healthstatus/dashboard/healthlog.md
+++ b/docs/auditor/10.7/admin/healthstatus/dashboard/healthlog.md
@@ -42,7 +42,7 @@ There are three types of events that can be logged:
| Event Type | Description |
| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Information | An event that describes the successful operation beginning or completion. For example, the product successfully completed data collection for a monitoring plan. |
-| Warning | An event that is not necessarily significant, but may indicate a possible future problem. For example, the product failed to process a domain controller. |
+| Warning | An event that isn't necessarily significant, but may indicate a possible future problem. For example, the product failed to process a domain controller. |
| Error | An event that indicates a significant problem such as loss of data or loss of functionality. For example, the product failed to retrieve settings for your data source. |
Review the following:
@@ -58,13 +58,9 @@ If you want to monitor Auditor health status in more depth, you can do the follo
## Inspect Events in Health Log
-Follow the steps o inspect events in Netwrix Auditor health log
+1. On the main Auditor page, select the Health status tile and click Open health log in the Health log dashboard widget.
-**Step 1 –** On the main Auditor page, select the Health status tile, then in the Health log
-dashboard widget click Open health log.
-
-**Step 2 –** Select an entry to review it in details. You can also copy event details. Select the
-event in the list and click Copy details at the bottom of the window.
+2. Select an entry to review its details. You can also copy event details by selecting the event in the list and clicking Copy details at the bottom of the window.
For your convenience, Auditor provides you with filters so that you can narrow down the number of
events on the screen and focus on those that matter most. For example, warnings on failed data
@@ -72,11 +68,9 @@ collection or events of an important monitoring plan.
### Filter Events
-Follow the steps to filter events.
-
-**Step 1 –** Select Filters in the upper part of the Netwrix Auditor Health Log window.
+1. Select Filters in the upper part of the Netwrix Auditor Health Log window.
-**Step 2 –** Complete the following fields:
+2. Complete the following fields:
| Option | Description |
| --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -84,8 +78,8 @@ Follow the steps to filter events.
| Event level | Select level of the events that you want to be displayed. |
| Event source | Select services and applications whose events you want to view. |
| Monitoring plan | Select to display events from one or several monitoring plans. |
-| Item name | Select to display events from the certain item(s) you need. |
-| Event ID | Enter event ID number or range of event IDs separated by commas. For example, 1, 3, 5-99. You can also exclude unwanted event IDs from being displayed. Type the minus sign before selected event ID. For example, -76. |
+| Item name | Select to display events from the certain items you need. |
+| Event ID | Enter an event ID number or a range of event IDs separated by commas (for example, 1, 3, 5-99). You can also exclude unwanted event IDs from being displayed by entering the minus sign before the event ID (for example, -76). |
diff --git a/docs/auditor/10.7/admin/healthstatus/dashboard/monitoringoverview.md b/docs/auditor/10.7/admin/healthstatus/dashboard/monitoringoverview.md
index 7598d4122c..a7427e1c3a 100644
--- a/docs/auditor/10.7/admin/healthstatus/dashboard/monitoringoverview.md
+++ b/docs/auditor/10.7/admin/healthstatus/dashboard/monitoringoverview.md
@@ -12,7 +12,7 @@ displays current statuses of all monitoring plans:
- Ready (green indicator)—The monitoring plans (one or several) successfully processed the data
sources with all their items and are ready for the next run.
- Pay attention (yellow indicator)—The monitoring plans (one or several) require your attention, as
- some items were not processed completely but only partially. This status applies to the monitoring
+ some items weren't processed completely but only partially. This status applies to the monitoring
plans targeted at Logon Activity and Windows File Server. See the table below for details.
- Take action (red indicator)—Any data source or item in the monitoring plan (one or several) was
processed with errors.
@@ -27,21 +27,21 @@ and items their current status is depicted as follows:
| Entity | Status | Description |
| --------------- | ------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Data source | Disabled | A data source can be disabled manually via its settings (by switching Monitor this data source and collect activity data to OFF), or automatically, if the license is not valid any more (for example, the count of licensed objects was exceeded, or the trial period has expired). |
+| Data source | Disabled | A data source can be disabled manually via its settings (by switching Monitor this data source and collect activity data to OFF), or automatically, if the license isn't valid any more (for example, the count of licensed objects was exceeded, or the trial period has expired). |
| Empty | No items have been added to this data source yet. | |
| Enabled | Monitor this data source and collect activity data is set to ON in the data source settings. | |
-| Not available | The monitoring plan is corrupted and cannot process its data sources, so it is recommended to remove it and create anew. | |
-| Not responding | Data collector for this data source is not responding. The underlying items will not be displayed for such data source. | |
+| Not available | The monitoring plan is corrupted and can't process its data sources, so it is recommended to remove it and create anew. | |
+| Not responding | Data collector for this data source isn't responding. The underlying items will not be displayed for such data source. | |
| Working | The data source is being processed at the moment. | |
| (not displayed) | The data source status is unknown. | |
| Item | Pay attention | The item was processed with some issues (non-critical). This status applies to the monitoring plans targeted at Logon Activity and Windows File Server. It means that data collection from at least one entity completed with errors. For example, a MyFileServer item included in the File Server monitoring plan contains all CIFS shares hosted on the MyFileServer computer. If any of these shares was processed with errors while others were processed successfully, the processing of the whole MyFileServer item will be considered partially completed, and the monitoring plan will have a yellow indicator, requiring your attention. Click the Details link to examine the product log. |
| Ready | The item was processed successfully and is ready for the next run of data collection. | |
-| Take action | Critical error(s) occurred while processing this item. Click the Details link to examine the product log. | |
+| Take action | Critical errors occurred while processing this item. Click the Details link to examine the product log. | |
| Working | The item is being processed at the moment. | |
You can use the Search field, or apply a filter to display the information you need. For example, in
the Apply Filters dialog you can select the Show only plans with issues to display only the
monitoring plans that require attention and corrective actions.
-This information will help you to troubleshoot the product operation, detect and eliminate the root
+This information will help you to troubleshoot the product operation, detect, and eliminate the root
cause of the monitoring errors, providing for auditing continuity and compliance.
diff --git a/docs/auditor/10.7/admin/healthstatus/dashboard/overview.md b/docs/auditor/10.7/admin/healthstatus/dashboard/overview.md
index ba83eb9198..694283c6f7 100644
--- a/docs/auditor/10.7/admin/healthstatus/dashboard/overview.md
+++ b/docs/auditor/10.7/admin/healthstatus/dashboard/overview.md
@@ -9,8 +9,8 @@ sidebar_position: 10
New Health Status dashboard facilitates Auditor maintenance and troubleshooting tasks, providing IT
specialists with at-a-glance view on the most critical factors: data collection performance, product
health and storage capacity. The dashboard comprises a set of widgets that display the status of
-these aspects using aggregated statistics and charts. Nearly each widget allows you to drill down to
-the detailed information on the aspect you are interested in.
+these aspects using aggregated statistics and charts. Nearly each widget provides detailed information on
+the aspect you're interested in.
To view the dashboard, on the main Auditor page, click the Health status tile located in the
Configuration section.
diff --git a/docs/auditor/10.7/admin/healthstatus/networktrafficcompression.md b/docs/auditor/10.7/admin/healthstatus/networktrafficcompression.md
index 1ff4665c84..8f0b1da8a3 100644
--- a/docs/auditor/10.7/admin/healthstatus/networktrafficcompression.md
+++ b/docs/auditor/10.7/admin/healthstatus/networktrafficcompression.md
@@ -19,7 +19,7 @@ So, network traffic compression helps to increase scalability and optimize netwo
Its key capabilities are as follows:
-- Allows Auditor to collect detailed metrics for the servers, log files, hardware and individual
+- Collects detailed metrics for the servers, log files, hardware, and individual
processes
- Collects audit data with no recognizable load on the server
- Communicates with Netwrix Auditor Server at predefined intervals, relaying data back to a central
diff --git a/docs/auditor/10.7/admin/healthstatus/overview.md b/docs/auditor/10.7/admin/healthstatus/overview.md
index 6a92df3068..f4dd2e5701 100644
--- a/docs/auditor/10.7/admin/healthstatus/overview.md
+++ b/docs/auditor/10.7/admin/healthstatus/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# Netwrix Auditor Operations and Health
-This topic describes how you can monitor Auditor operations, health and resource usage. See the
+This topic describes how you can monitor Auditor operations, health, and resource usage. See the
following topics for additional information:
- [Health Status Dashboard](/docs/auditor/10.7/admin/healthstatus/dashboard/overview.md)
diff --git a/docs/auditor/10.7/admin/healthstatus/selfaudit.md b/docs/auditor/10.7/admin/healthstatus/selfaudit.md
index 080840ec49..aca3dd72e8 100644
--- a/docs/auditor/10.7/admin/healthstatus/selfaudit.md
+++ b/docs/auditor/10.7/admin/healthstatus/selfaudit.md
@@ -6,10 +6,10 @@ sidebar_position: 20
# Self-Audit
-Built-in Netwrix Auditor self-audit allows you to track changes to the product configuration,
-including monitoring plans, data sources, audit scope and details about it (before-after values).
-This helps you to ensure that monitoring scope is complete and changed only in line with the
-workflows adopted by our organization.
+Built-in Netwrix Auditor self-audit tracks changes to the product configuration,
+including monitoring plans, data sources, audit scope, and details about it (before-after values).
+This helps ensure that monitoring scope is complete and changed only in line with the
+workflows adopted by your organization.
The corresponding option is available on the General tab of Netwrix AuditorSettings. By default, the
**Collect data for self-audit checkbox** is selected (enabled).
@@ -20,8 +20,6 @@ The corresponding option is available on the General tab of Netwrix AuditorSetti
All Auditor self-audit Activity Records can be found quickly using AuditIntelligence Search.
-Follow the steps to search for self-audit results.
-
**Step 1 –** In Auditor, navigate to Search.
**Step 2 –** Set the Data source filter to **Self-audit**.
@@ -38,11 +36,9 @@ the [View and Search Collected Data](/docs/auditor/10.7/admin/search/overview.md
### Review Auditor Self-Audit Report
-Also, there is a new Netwrix Auditor Self-Audit report available under Organization Level Reports in
+A Netwrix Auditor Self-Audit report is available under Organization Level Reports in
the predefined set of reports. This report shows detailed information on changes to Auditor
-monitoring plans, data sources and audited items.
-
-Follow the steps to review the Self-audit report.
+monitoring plans, data sources, and audited items.
**Step 1 –** In Auditor, navigate to Reports > Organization Level Reports.
diff --git a/docs/auditor/10.7/admin/healthstatus/summaryemail.md b/docs/auditor/10.7/admin/healthstatus/summaryemail.md
index 1fd7309a8a..e210fd70eb 100644
--- a/docs/auditor/10.7/admin/healthstatus/summaryemail.md
+++ b/docs/auditor/10.7/admin/healthstatus/summaryemail.md
@@ -21,4 +21,4 @@ The email looks like shown below:
The Monitoring Overview section of the email provides detail information only for the monitoring
-plans with issues. Successfully completed monitoring plans are not included.
+plans with issues. Successfully completed monitoring plans aren't included.
diff --git a/docs/auditor/10.7/admin/healthstatus/troubleshooting.md b/docs/auditor/10.7/admin/healthstatus/troubleshooting.md
index 6ed3f860bd..015b058111 100644
--- a/docs/auditor/10.7/admin/healthstatus/troubleshooting.md
+++ b/docs/auditor/10.7/admin/healthstatus/troubleshooting.md
@@ -9,7 +9,7 @@ sidebar_position: 50
This section provides instructions on how to troubleshoot issues that you may encounter while using
Netwrix Auditor.
-If your issue is not listed in the table below, try searching
+If your issue isn't listed in the table below, try searching
[Netwrix Knowledge Base](https://helpcenter.netwrix.com/).
If you need assistance from the Technical Support team, you can open a ticket using the Customer
@@ -17,13 +17,13 @@ portal as described in the Creating a ticket with Customer portal section.
| Issue | Reason and solution |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| I cannot connect/logon to Auditor. | 1. You may have insufficient permissions. Contact your Auditor Global administrator to make sure that your account is delegated control of the product. 2. You are trying to connect to a remote Auditor specified by its IP address while the NTLM authentication is disabled. Try specifying a server by its name (e.g., EnterpriseWKS). |
-| I do not receive any results while searching audit data or generating reports, or I am sure that some data is missing. | 1. No changes were detected. 2. You do not have sufficient permissions to review intelligence data. Contact your Global administrator. 3. Review your filter settings and make sure that your filters are properly configured. Try modifying your search. 4. You are looking for changes that occurred more than 180 days ago. These changes are no longer available for reporting and running searches. Ask your Auditor Global administrator to import audit data for a required date range from the Long-Term Archive. 5. Data collection for this monitoring plan might not have been launched two times yet or there was no data collection after this change; therefore, audit data has not been written to the Audit Database yet. 6. Some settings in Auditor are configured incorrectly. Contact your Auditor administrator to make sure that: - The monitoring plan you want to audit is properly configured, and the monitoring is enabled for each data source individually. - Audit Database settings are properly configured for each data source individually and Disable security intelligence and make data available only in activity summaries is cleared. Netwrix recommends to store all audit data on the same default SQL Server instance. |
-| "No plans found" text in the Monitoring plan field. | Contact your Auditor Global administrator or Configurator to make sure that the monitoring plans exist and are properly configured. |
-| I see a blank window instead of a report. | Contact your Auditor Global administrator to make sure that you are granted sufficient permissions on the Report Server. To view reports in a web browser - Open a web browser and type the Report Manager URL (found under Settings>**Audit Database**). In the page that opens, navigate to the report you want to generate and click the report name. You can modify the report filters and click View Report to apply them. |
-| I configured report subscription to be uploaded to a file server, but cannot find it / cannot access it. | Subscriptions can be uploaded either to a file share (e.g., _\\filestorage\reports_) or to a folder on the computer where Auditor Server is installed. To access these reports, you must be granted the Read permission. |
-| When trying to collect event data from Active Directory domain, an error message like this appears in Netwrix Health Log: _Monitoring Plan: `` The following error has occurred while processing '``': Error collecting the security log of the domain ``. Failed to process the domain controller `` due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it_. | This may happen due to Secondary Logon Service disabled state. To collect event data from the domain, this service must be up and running. Open its properties and start the service. |
-| The 'Workstation' field in search, reports, and Activity Summary is reported as 'unknown' | For the full list of possible reasons, please refer to the following Netwrix Knowledge Base article: [Why is the "Workstation" field reported as "unknown"?](/docs/kb/auditor/reports-alerts-and-notifications/report-generation/workstation-field-reported-as-unknown) |
+| You can't log on to Auditor. | 1. You may have insufficient permissions. Contact your Auditor Global administrator to ensure that your account is delegated control of the product. 2. You are trying to connect to a remote Auditor specified by its IP address while the NTLM authentication is disabled. Try specifying a server by its name (e.g., EnterpriseWKS). |
+| You don't receive any results while searching audit data or generating reports, or you're sure that some data is missing. | 1. No changes were detected. 2. You don't have sufficient permissions to review intelligence data. Contact your Global administrator. 3. Review your filter settings and ensure that your filters are properly configured. Try modifying your search. 4. You are looking for changes that occurred more than 180 days ago. These changes are no longer available for reporting and running searches. Ask your Auditor Global administrator to import audit data for a required date range from the Long-Term Archive. 5. Data collection for this monitoring plan might not have been launched two times yet or there was no data collection after this change; therefore, audit data has not been written to the Audit Database yet. 6. Some settings in Auditor are configured incorrectly. Contact your Auditor administrator to ensure that: - The monitoring plan you want to audit is properly configured, and the monitoring is enabled for each data source individually. - Audit Database settings are properly configured for each data source individually and Disable security intelligence and make data available only in activity summaries is cleared. Netwrix recommends to store all audit data on the same default SQL Server instance. |
+| "No plans found" text in the Monitoring plan field. | Contact your Auditor Global administrator or Configurator to ensure that the monitoring plans exist and are properly configured. |
+| You see a blank window instead of a report. | Contact your Auditor Global administrator to ensure that you are granted sufficient permissions on the Report Server. To view reports in a web browser - Open a web browser and enter the Report Manager URL (found under Settings>**Audit Database**). In the page that opens, navigate to the report you want to generate and click the report name. You can modify the report filters and click View Report to apply them. |
+| You configured report subscription to be uploaded to a file server, but can't find it or can't access it. | Subscriptions can be uploaded either to a file share (e.g., _\\filestorage\reports_) or to a folder on the computer where Auditor Server is installed. To access these reports, you must be granted the Read permission. |
+| When trying to collect event data from Active Directory domain, an error message like this appears in Netwrix Health Log: _Monitoring Plan: `` The following error has occurred while processing '``': Error collecting the security log of the domain ``. Failed to process the domain controller `` due to the following error: The service can't be started, either because it is disabled or because it has no enabled devices associated with it_. | This may happen due to Secondary Logon Service disabled state. To collect event data from the domain, this service must be running. Open its properties and start the service. |
+| The 'Workstation' field in search, reports, and Activity Summary is reported as 'unknown' | For the full list of possible reasons, see the Netwrix Knowledge Base article [Why is the "Workstation" field reported as "unknown"?](/docs/kb/auditor/reports-alerts-and-notifications/report-generation/workstation-field-reported-as-unknown) |
## Creating a ticket with Customer portal
diff --git a/docs/auditor/10.7/admin/monitoringplans/activedirectory/overview.md b/docs/auditor/10.7/admin/monitoringplans/activedirectory/overview.md
index bab18a4e11..fd32f3c0c9 100644
--- a/docs/auditor/10.7/admin/monitoringplans/activedirectory/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/activedirectory/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Active Directory
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
@@ -24,15 +24,15 @@ Complete the following fields:
| -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
-| Monitor Active Directory partitions | Select which of your Active Directory environment partitions you want to audit. By default, Auditor only tracks changes to the Domain partition and the Configuration partition of the audited domain. If you also want to audit changes to the Schema partition, or to disable auditing of changes to the Configuration partition, select one of the following: - Domain—Stores users, computers, groups and other objects. Updates to this partition are replicated only to domain controllers within the domain. - Configuration—Stores configuration objects for the entire forest. Updates to this partition are replicated to all domain controllers in the forest. Configuration objects store the information on sites, services, directory partitions, etc. - Schema—Stores class and attribute definitions for all existing and possible Active Directory objects. Updates to this partition are replicated to all domain controllers in the forest. You cannot disable auditing the Domain partition for changes. |
+| Monitor Active Directory partitions | Select which of your Active Directory environment partitions you want to audit. By default, Auditor only tracks changes to the Domain partition and the Configuration partition of the audited domain. If you also want to audit changes to the Schema partition, or to disable auditing of changes to the Configuration partition, select one of the following: - Domain—Stores users, computers, groups, and other objects. Updates to this partition are replicated only to domain controllers within the domain. - Configuration—Stores configuration objects for the entire forest. Updates to this partition are replicated to all domain controllers in the forest. Configuration objects store the information on sites, services, directory partitions, etc. - Schema—Stores class and attribute definitions for all existing and possible Active Directory objects. Updates to this partition are replicated to all domain controllers in the forest. You can't disable auditing the Domain partition for changes. |
| Detect additional details | Specify additional information to include in reports and activity summaries. Select Group membershipif you want to include Group membership of the account under which the change was made. |
| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
-| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. See the [Active Directory](/docs/auditor/10.7/configuration/activedirectory/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
+| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [Active Directory](/docs/auditor/10.7/configuration/activedirectory/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your Active Directory domain configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.7/admin/reports/types/stateintime/overview.md) topic for additional information. The product updates the latest snapshot on the regular basis to keep users up-to-date on actual system state. Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. For that, in the Manage historical snapshots section, click **Manage** and select the snapshots that you want to import. To import snapshots, you must be assigned the Global administrator or the Global reviewer role . Move the selected snapshots to the Snapshots available for reporting list using the arrow button. When finished, click **OK**. |
| Users | |
-| Specify monitoring restrictions | Specify user accounts to exclude from data collection (and, therefore, search results, reports and Activity Summaries). To add a user to the exclusion list, click Add, then provide the user name in the _domain\user_ format. Consider the following: - Use NetBIOS format for domain name: _mydomain_ - Some audit data (events) may contain _System_ as the user (initiator) account name. To exclude such data, specify "_System_" when adding a user name here. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify user accounts to exclude from data collection (and, therefore, search results, reports, and Activity Summaries). To add a user to the exclusion list, click Add, then provide the user name in the _domain\user_ format. Consider the following: - Use NetBIOS format for domain name: _mydomain_ - Some audit data (events) may contain _System_ as the user (initiator) account name. To exclude such data, specify "_System_" when adding a user name here. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
| Objects | |
-| Specify monitoring restrictions | Specify restrictions for the objects to monitor in your Active Directory. Use them to create the lists of specific objects to include and / or exclude from the monitoring scope (and, therefore, search results, reports and Activity Summaries). The following options are available: - Monitor all objects - **Include these objects** - **Exclude these objects** To create a list of inclusions / exclusions, click Add and enter object path using one of the following formats: - Canonical name, for example: _mydomain.local/Computers/filesrv01_ OR - Object path as shown in the "_What_" column of reports and search results, for example: _\local\mydomain\Computers\filesrv01_ You can use a wildcard (\*) to replace any number of characters in the path. See the examples below for more information. |
+| Specify monitoring restrictions | Specify restrictions for the objects to monitor in your Active Directory. Use them to create the lists of specific objects to include and / or exclude from the monitoring scope (and, therefore, search results, reports, and Activity Summaries). The following options are available: - Monitor all objects - **Include these objects** - **Exclude these objects** To create a list of inclusions / exclusions, click Add and enter object path using one of the following formats: - Canonical name, for example: _mydomain.local/Computers/filesrv01_ OR - Object path as shown in the "_What_" column of reports and search results, for example: _\local\mydomain\Computers\filesrv01_ You can use a wildcard (\*) to replace any number of characters in the path. See the examples below for more information. |
@@ -52,7 +52,7 @@ _OU_, except for the objects whose path begins with _enterprise.local/OU/BO_. Th
however, will not be monitored, meaning that, for example, its renaming will not be reported.
In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more
-granular audit data. Note that the new monitoring scope restrictions apply together with previous
+granular audit data. The new monitoring scope restrictions apply together with previous
exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic
for additional information.
@@ -62,7 +62,7 @@ This topic applies to auditing Active Directory only.
Active Directory environment consists of the following directory partitions:
-- Domain partition — Stores users, computers, groups and other objects. Updates to this partition
+- Domain partition — Stores users, computers, groups, and other objects. Updates to this partition
are replicated only to domain controllers within the domain.
- Configuration partition — Stores configuration objects for the entire forest. Updates to this
partition are replicated to all domain controllers in the forest. Configuration objects store the
@@ -75,7 +75,7 @@ By default, Netwrix Auditor only tracks changes to the Domain partition and the
partition of the audited domain. If you also want to audit changes to the Schema partition, or to
disable auditing of changes to the Configuration partition do the following:
-You cannot disable auditing the Domain partition for changes.
+You can't disable auditing the Domain partition for changes.
To enable auditing of the Configuration and Schema partitions
@@ -93,11 +93,11 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify AD container | Specify a whole AD domain, OU or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you do not want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers does not include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
+| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. Starting with version 10.7, you can implement the integration between Netwrix Auditor and Netwrix Privilege Secure. See the [Netwrix Privilege Secure](/docs/auditor/10.7/admin/settings/privilegesecure.md) topic for additional information. Refer to the [Permissions for Active Directory Auditing](/docs/auditor/10.7/configuration/activedirectory/permissions.md) topic for more information on using Netwrix Privilege Secure as an account for data collection. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Containers and Computers | |
| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU or container. - Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) are not supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU, or container. - Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports, and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) aren't supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
## Domain
@@ -110,8 +110,7 @@ Complete the following fields:
Refer to the
[Permissions for Active Directory Auditing](/docs/auditor/10.7/configuration/activedirectory/permissions.md)
-topic for more information on using Netwrix Privilege Secure as an account for data collection.
-
+topic for more information on using Netwrix Privilege Secure
## Use Netwrix Privilege Secure as a Data Collecting Account
Starting with version 10.7, you can use Netwrix Privilege Secure to manage the account for
@@ -121,9 +120,9 @@ integration and supported data sources. In this case, the credentials will not b
Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring
password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
+ as an account for data collection.
-**Step 1 –** Select the desired item.
+**Step 1 –** Select an item to monitor.
**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
collection.
@@ -132,8 +131,8 @@ collection.
**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
Credential-based is the default option. Refer to the
-[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+[Netwrix Privilege Secure Access Policies](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
+documentation for more information.
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
@@ -144,7 +143,7 @@ sources.
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.7/admin/monitoringplans/activedirectory/scope.md b/docs/auditor/10.7/admin/monitoringplans/activedirectory/scope.md
index 63e45e2727..f26ab0bee1 100644
--- a/docs/auditor/10.7/admin/monitoringplans/activedirectory/scope.md
+++ b/docs/auditor/10.7/admin/monitoringplans/activedirectory/scope.md
@@ -13,8 +13,6 @@ Directory monitoring scope. You can apply restrictions to monitoring scope via t
**_RECOMMENDED:_** Configure monitoring scope restrictions on the Active Directory monitoring plan
page. See the [Active Directory](/docs/auditor/10.7/admin/monitoringplans/activedirectory/overview.md) topic for additional information.
-Follow the steps to exclude data from the Active Directory monitoring scope:
-
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Active Directory Auditing_
folder.
@@ -26,9 +24,9 @@ folder.
| File | Description | Syntax |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| addprops.txt | Contains a list of properties that should be included for newly created AD objects. When a new object is added, Auditor does not show any data in the Details column in the Activity Summary emails. If you want to see the information on certain attributes of a newly created object, specify these attributes in this file. | `Object type:property:` For example, to show a group description on this group’s creation, add the following line: `group:description:` |
-| allowedpathlist.txt | Contains a list of AD paths to be included in Activity Summaries, reports, and search results. | `Path` The path must be provided in the same format as it is displayed in the What column. For example, if you only want to monitor specific OU(s) in the AD domain, but not the entire domain. You can put a wildcard (\*) in the omitpathlist.txt file to exclude all paths, and then specify the OU(s) you want to monitor in the allowedpathlist.txt file. Adding the widlcard (\*) to omitpathlist.txt will not allow Netwrix Auditor to run AD state-in-time data collection. |
-| omitallowedpathlist.txt | Contains a list of AD paths to be excluded from Activity Summaries, reports, and search results. This file can be used if you want to exclude certain paths inside those specified in the allowedpathlist.txt file. | `Path` The path must be provided in the same format as it is displayed in the What column. For example, you can put a wildcard (\*) in the omitpathlist.txt file to exclude all paths, then specify the OU(s) you want to monitor in the allowedpathlist.txt file, and then specify the paths you want to exclude from within them in the omitallowedpathlist.txt file. Adding the widlcard (\*) to omitpathlist.txt will not allow Netwrix Auditor to run AD state-in-time data collection. |
+| addprops.txt | Contains a list of properties that should be included for newly created AD objects. When a new object is added, Auditor doesn't show any data in the Details column in the Activity Summary emails. If you want to see the information on certain attributes of a newly created object, specify these attributes in this file. | `Object type:property:` For example, to show a group description on this group’s creation, add the following line: `group:description:` |
+| allowedpathlist.txt | Contains a list of AD paths to be included in Activity Summaries, reports, and search results. | `Path` The path must be provided in the same format as it is displayed in the What column. For example, if you only want to monitor specific OUs in the AD domain, but not the entire domain. You can put a wildcard (\*) in the omitpathlist.txt file to exclude all paths, and then specify the OUs you want to monitor in the allowedpathlist.txt file. Adding the widlcard (\*) to omitpathlist.txt will not allow Netwrix Auditor to run AD state-in-time data collection. |
+| omitallowedpathlist.txt | Contains a list of AD paths to be excluded from Activity Summaries, reports, and search results. This file can be used if you want to exclude certain paths inside those specified in the allowedpathlist.txt file. | `Path` The path must be provided in the same format as it is displayed in the What column. For example, you can put a wildcard (\*) in the omitpathlist.txt file to exclude all paths, then specify the OUs you want to monitor in the allowedpathlist.txt file, and then specify the paths you want to exclude from within them in the omitallowedpathlist.txt file. Adding the widlcard (\*) to omitpathlist.txt will not allow Netwrix Auditor to run AD state-in-time data collection. |
| omitexchangeserverlist.txt | Specify the Microsoft Exchange 2010 servers to be excluded from data collection. | `FQDN_server_name` **NOTE:** You can use the wildcard (\*) when specifying servers for exclusion. |
| omitobjlist.txt | Contains a list of object types to be excluded from Activity Summaries, reports, and search results. | `Object type` For example, to omit changes to the printQueue object, add the following line: `printQueue`. |
| omitpathlist.txt | Contains a list of AD paths to be excluded from Activity Summaries, reports, and search results. | `Path` The path must be provided in the same format as it is displayed in the What column. For example, to exclude changes to the Service Desk OU, add the following line: `*\Service Desk\*`. |
@@ -36,9 +34,9 @@ folder.
| omitreporterrors.txt | Contains a list of errors to be excluded from Netwrix Health Log. Thus, these errors will not appear in the Activity Summary emails. | `Error message text` For example, if you have advanced audit settings applied to your domain controllers policy, the following error will be returned in the Activity Summary emails: `Auditing of Directory Service Access is not enabled for this DC. Adjust the audit policy settings using the Active Directory Audit Configuration Wizard or see the product documentation for more information.` Add the text of this error message to this file to stop getting it in the Activity Summary emails. |
| omitsnapshotpathlist.txt | Contains a list of AD paths to be excluded from AD snapshots. | `Path` The path must be provided in the same format as it is displayed in the What column. For example, to exclude data on the Disabled Accounts OU from the Snapshot report, add the following line:` *\Disabled Accounts*`. |
| omitstorelist.txt | Contains a list of object types and properties to be excluded from AD snapshots. | `object_type.property_name` If there is no separator (.) between an object type and a property, the whole entry is treated as an object type. For example to exclude data on the AD adminDescription property, add the following line: `*.adminDescription`. |
-| omituserlist.txt | Contains a list of users you want to exclude from search results, reports and Activity Summaries. | `domain\username` For example, `*\administrator`. |
-| processaddedprops.txt | Contains a list of properties that should be included for newly created AD objects. When a new object is created, Auditor does not show any data in the Details column in reports. If you want to see the information on certain attributes of a newly created object, specify these attributes in this file. | `object type:property:` For example, if you want a user’s Description property to be displayed in the reports when a user is added, add the following line: `User:Description:` |
-| processdeletedprops.txt | Contains a list of properties that should be included for deleted AD objects. When an object is deleted, Auditor does not show any data in the Details column in reports. If you want to see the information on certain attributes of a deleted object, specify these attributes in this file. | `object type:property:` For example, if you want a user’s Description property to be displayed in the reports when a user is deleted, add the following line: `User:Description:` |
+| omituserlist.txt | Contains a list of users you want to exclude from search results, reports, and Activity Summaries. | `domain\username` For example, `*\administrator`. |
+| processaddedprops.txt | Contains a list of properties that should be included for newly created AD objects. When a new object is created, Auditor doesn't show any data in the Details column in reports. If you want to see the information on certain attributes of a newly created object, specify these attributes in this file. | `object type:property:` For example, if you want a user’s Description property to be displayed in the reports when a user is added, add the following line: `User:Description:` |
+| processdeletedprops.txt | Contains a list of properties that should be included for deleted AD objects. When an object is deleted, Auditor doesn't show any data in the Details column in reports. If you want to see the information on certain attributes of a deleted object, specify these attributes in this file. | `object type:property:` For example, if you want a user’s Description property to be displayed in the reports when a user is deleted, add the following line: `User:Description:` |
| propnames.txt | Contains a list of human-readable names for object types and properties to be displayed in Activity Summaries, reports, and search results. | `classname.attrname= intelligiblename` For example, if you want the adminDescription property to be displayed in the reports as Admin Screen Description, add the following line: `*.adminDesciption=Admin Screen Description` |
## Example
diff --git a/docs/auditor/10.7/admin/monitoringplans/activitysummaryemail.md b/docs/auditor/10.7/admin/monitoringplans/activitysummaryemail.md
index 124758da16..cb67245c0c 100644
--- a/docs/auditor/10.7/admin/monitoringplans/activitysummaryemail.md
+++ b/docs/auditor/10.7/admin/monitoringplans/activitysummaryemail.md
@@ -12,7 +12,7 @@ data sources an Activity Summary is generated daily at 3:00 AM and delivered to
recipients. You can also launch data collection and Activity Summary generation manually.
Notifications on user activity and event log collection (Event Log Collection Status) are a bit
-different and do not show changes.
+different and don't show changes.
The following Activity Summary example applies to Active Directory. Other Activity Summaries
generated and delivered by Netwrix Auditor will vary slightly depending on the data source.
diff --git a/docs/auditor/10.7/admin/monitoringplans/adfs.md b/docs/auditor/10.7/admin/monitoringplans/adfs.md
index 22bf82ff9a..ae38e3d9d8 100644
--- a/docs/auditor/10.7/admin/monitoringplans/adfs.md
+++ b/docs/auditor/10.7/admin/monitoringplans/adfs.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Active Directory Federation Services
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data collection
@@ -24,8 +24,8 @@ Complete the following fields:
| -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
| Schedule AD FS logons collection | Specify period for AD FS logons collection. |
-| Specify data collection method | You can enable network traffic compression. If enabled, a Compression Service will be automatically launched on the audited computer, collecting and pre-filtering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
-| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. For a full list of audit settings required to collect comprehensive audit data and instructions on how to configure them, refer to [AD FS](/docs/auditor/10.7/configuration/activedirectoryfederatedservices/overview.md). |
+| Specify data collection method | You can enable network traffic compression. If enabled, a Compression Service will be automatically launched on the audited computer, collecting and pre-filtering data. This significantly improves data transfer and minimizes the impact on target computer performance. |
+| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. For a full list of audit settings required to collect comprehensive audit data and instructions on how to configure them, refer to [AD FS](/docs/auditor/10.7/configuration/activedirectoryfederatedservices/overview.md). |
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the **Data source** list. As a next step, click **Add item** to specify an
@@ -35,12 +35,12 @@ topic for additional information.
## Federation Server
If you are going to audit an entire AD FS farm, consider adding all AD FS server one by one as items
-to your monitoring plan. Otherwise, your audit scope may contain warnings, errors or incomplete
+to your monitoring plan. Otherwise, your audit scope may contain warnings, errors, or incomplete
data.
Complete the following fields:
| Option | Description |
| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Specify AD FS federation server | Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
+| Specify AD FS federation server | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
diff --git a/docs/auditor/10.7/admin/monitoringplans/create.md b/docs/auditor/10.7/admin/monitoringplans/create.md
index 8d9056922f..7a649c80aa 100644
--- a/docs/auditor/10.7/admin/monitoringplans/create.md
+++ b/docs/auditor/10.7/admin/monitoringplans/create.md
@@ -13,7 +13,7 @@ Users with the _Configurator_ role can create plans only within a delegated fold
To start creating a plan, do any of the following:
- On the main Auditor page, in the Quick Start section, click the tile with a data source of your
- choice, e.g., Active Directory. If you need a data source that is not listed on the main page,
+ choice, e.g., Active Directory. If you need a data source that isn't listed on the main page,
click All data sources.
- On the main Auditor page, in the Configuration section, click the Monitoring Plans tile. On the
Monitoring Plans page, select Add Plan.
@@ -44,15 +44,15 @@ general settings for data collection.
| Option | Description |
| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Specify the account for collecting data | If applicable, you can create a data collecting account in the following ways: - Not specified – Select this option if you want to choose the Netwrix Privilege Secure as the data collecting account for the Monitoring Plan. See the [Netwrix Privilege Secure](/docs/auditor/10.7/admin/settings/privilegesecure.md) topic for additional information. - User/password – Provide a username and password for the account that Auditor will use to collect data. By default, the user name is prepopulated with your account name. - gMSA – Use the group Managed Service Account (gMSA) as data collecting account. For more details about gMSA usage, see the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.7/requirements/gmsa.md) topic. **NOTE:** If you want to audit network devices or Microsoft Entra ID (formerly Azure AD)/Office 365 infrastructure, you need to use _not specified_ account. Make sure the account has sufficient permissions to collect data. For a full list of the rights and permissions, and instructions on how to configure them, refer to the[Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md). Netwrix recommends creating a special service account with extended permissions. When you configure a monitoring plan for the first time, the account you specify for data collection will be set as default. |
+| Specify the account for collecting data | If applicable, you can create a data collecting account in the following ways: - Not specified – Select this option if you want to choose the Netwrix Privilege Secure as the data collecting account for the Monitoring Plan. See the [Netwrix Privilege Secure](/docs/auditor/10.7/admin/settings/privilegesecure.md) topic for additional information. - User/password – Provide a username and password for the account that Auditor will use to collect data. By default, the user name is prepopulated with your account name. - gMSA – Use the group Managed Service Account (gMSA) as data collecting account. For more details about gMSA usage, see the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.7/requirements/gmsa.md) topic. **NOTE:** If you want to audit network devices or Microsoft Entra ID (formerly Azure AD)/Office 365 infrastructure, you need to use _not specified_ account. Ensure the account has sufficient permissions to collect data. For a full list of the rights and permissions, and instructions on how to configure them, refer to the[Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md). Netwrix recommends creating a special service account with extended permissions. When you configure a monitoring plan for the first time, the account you specify for data collection will be set as default. |
| Enable network traffic compression | If selected, this option instructs Auditor to deploy a special utility that will run on the audited computers and do the following: - Collect and pre-filter audit data - Compress data and forward it to Auditor Server. This approach helps to optimize load balance and reduce network traffic. So, using this option can be recommended especially for distributed networks with remote locations that have limited bandwidth. See the [Network Traffic Compression](/docs/auditor/10.7/admin/healthstatus/networktrafficcompression.md) topic for additional information. |
-| Adjust audit settings automatically | Auditor can configure audit settings in your environment automatically. Select Adjust audit settings automatically. In this case, Auditor will continually check and enforce the relevant audit policies. For some data sources (currently, Active Directory and Logon Activity) you will be offered to launch a special utility that will detect current audit settings, check them against requirements and then adjust them automatically. See the [Audit Configuration Assistant](/docs/auditor/10.7/tools/auditconfigurationassistant.md) topic for additional information. You may also want to apply audit settings via GPO (for example, for Windows Servers). Auditor has certain limitations when configuring audit settings for NetApp and Dell Data Storage. See the [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) topic for additional information. If any conflicts are detected with your current settings, automatic audit configuration will not be performed. Select this option if you want to audit file shares on NetApp Data ONTAP 7 and 8 in 7-mode. For NetApp Clustered Data ONTAP 8 and ONTAP 9, only audit settings for file shares can be configured automatically, other settings must be applied manually. If you plan to monitor EMC Isilon, clear the checkbox. Currently, Auditor cannot configure audit on Dell Isilon appliances automatically. If you want to audit Dell VNX/VNXe, select Adjust audit settings automatically, but only audit settings for file shares will configured, the rest of settings must be configured manually. For a full list of audit settings and instructions on how to configure them manually, see the [Supported Data Sources](/docs/auditor/10.7/requirements/supporteddatasources/supporteddatasources.md) for additional information. |
+| Adjust audit settings automatically | Auditor can configure audit settings in your environment automatically. Select Adjust audit settings automatically. In this case, Auditor will continually check and enforce the relevant audit policies. For some data sources (Active Directory and Logon Activity) you will be offered to launch a special utility that will detect current audit settings, check them against requirements and then adjust them automatically. See the [Audit Configuration Assistant](/docs/auditor/10.7/tools/auditconfigurationassistant.md) topic for additional information. You may also want to apply audit settings via GPO (for example, for Windows Servers). Auditor has certain limitations when configuring audit settings for NetApp and Dell Data Storage. See the [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) topic for additional information. If any conflicts are detected with your current settings, automatic audit configuration will not be performed. Select this option if you want to audit file shares on NetApp Data ONTAP 7 and 8 in 7-mode. For NetApp Clustered Data ONTAP 8 and ONTAP 9, only audit settings for file shares can be configured automatically, other settings must be applied manually. If you plan to monitor EMC Isilon, clear the checkbox. Auditor can't configure audit on Dell Isilon appliances automatically. If you want to audit Dell VNX/VNXe, select Adjust audit settings automatically, but only audit settings for file shares will configured, the rest of settings must be configured manually. For a full list of audit settings and instructions on how to configure them manually, see the [Supported Data Sources](/docs/auditor/10.7/requirements/supporteddatasources/supporteddatasources.md) for additional information. |
| Launch Audit Configuration Assistant | Click to launch a specially intended utility that will assess your environment readiness for monitoring and adjust audit settings, if necessary. The tool will be launched in a new window. See the [Audit Configuration Assistant](/docs/auditor/10.7/tools/auditconfigurationassistant.md) topic for additional information. |
| Collect data for state-in-time reports | State-in-time reports are based on the daily configuration snapshots of your audited systems; they help you to analyze particular aspects of the environment. State-in-time configuration snapshots are also used for IT risks assessment metrics and reports. This data collection option is available if you are creating a monitoring plan for any of the following data sources: - Active Directory - File Servers - Windows Server - Group Policy - SharePoint - SharePoint Online - Exchange Online - SQL Server - VMware See the [State–In–Time Reports](/docs/auditor/10.7/admin/reports/types/stateintime/overview.md) and [IT Risk Assessment Overview ](/docs/auditor/10.7/admin/riskassessment/overview.md) topics for additional information. |
## Default SQL Server Instance
-To provide searching, alerting and reporting capabilities, Auditor needs an SQL Server where audit
+To provide searching, alerting, and reporting capabilities, Auditor needs an SQL Server where audit
data will be stored in the databases. To store data from the data sources included in the monitoring
plan, the wizard creates an Audit Database for each plan. At this step, you should specify the
default SQL Server instance that will host Auditor databases. See the
@@ -69,15 +69,15 @@ plans.
Select one of the following options:
- Disable security intelligence and make data available only in activity summaries — select this
- option if you do not want audit data to be written to the Audit Database. In this case, data will
- be available only in Activity Summary emails. Alerts, reports and search capabilities will not be
+ option if you don't want audit data to be written to the Audit Database. In this case, data will
+ be available only in Activity Summary emails. Alerts, reports, and search capabilities will not be
supported.
If you later clear this option to start saving data to the database, consider that already
collected audit data will not be imported in that database.
- Install a new instance of Microsoft SQL Server Express automatically — this option is available at
- the first run of the wizard. It allows you to deploy SQL Server 2016 SP2 Express with Advanced
+ the first run of the wizard. It deploys SQL Server 2016 SP2 Express with Advanced
Services on the local machine. This SQL Server will be used as default host for Auditor databases.
It is strongly recommended that you plan for your databases first, as described in
@@ -94,7 +94,7 @@ Select one of the following options:
| Option | Description |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
- | SQL Server instance | Specify the name of the SQL Server instance to store audit data. If you have more than one Auditor Server running in your network, make sure to configure them to use different SQL Server instances. The same SQL Server instance cannot be used to store audit data collected by several Auditor Servers. |
+ | SQL Server instance | Specify the name of the SQL Server instance to store audit data. If you have more than one Auditor Server running in your network, ensure to configure them to use different SQL Server instances. The same SQL Server instance can't be used to store audit data collected by several Auditor Servers. |
| Authentication | Select the authentication type you want to use to connect to the SQL Server instance: - Windows authentication - SQL Server authentication |
| User name | Specify the account to be used to connect to the SQL Server instance. This account must be granted the **database owner (db_owner)** role and the dbcreator server role. |
| Password | Enter a password. |
@@ -121,10 +121,10 @@ Configure the following:
| Setting | Description |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Disable security intelligence ... | Only select this option if you do not want your data to be stored in the database. In this case, you will only be able to receive activity summaries. Reporting and alerting capabilities will not be provided. To store data to the database, leave this check box cleared. |
+| Disable security intelligence ... | Only select this option if you don't want your data to be stored in the database. In this case, you will only be able to receive activity summaries. Reporting and alerting capabilities will not be provided. To store data to the database, leave this checkbox cleared. |
| Database | Default database name is _Netwrix_Auditor_``_. It is recommended that you enter a meaningful name for the database here. It may include the data source type (e.g. \_Exchange_Audit_Data_ or _OracleSrv02_Audit_Data_), or so. If you decided to use the existing SQL Server instance instead of dedicated, you may want to use _Netwrix_Auditor_ prefix to distinguish Netwrix Auditor databases from others. |
| Use default SQL Server settings | Select this option if you want Auditor to connect to the SQL Server instance using the default settings you specified at the Default SQL Server Instance step. |
-| Specify custom connection parameters | Select this option to use custom credentials when connecting to SQL Server. Specify authentication method and the account that Auditor will use. Make sure this account has sufficient rights to connect to SQL Server and work with the databases. |
+| Specify custom connection parameters | Select this option to use custom credentials when connecting to SQL Server. Specify authentication method and the account that Auditor will use. Ensure this account has sufficient rights to connect to SQL Server and work with the databases. |
Auditor will connect to the default SQL Server instance and create a database with the specified
name on it.
@@ -136,12 +136,12 @@ server used for reporting) are available on the Audit Database page of Auditor s
## SMTP Server Settings
When you create the first monitoring plan, you are prompted to specify the email settings that will
-be used for activity and health summaries, reports and alerts delivery. For the monitoring plans
+be used for activity and health summaries, reports, and alerts delivery. For the monitoring plans
that follow, Netwrix Auditor will automatically detect SMTP settings; however, for your first plan
you should provide them manually. See the [Notifications](/docs/auditor/10.7/admin/settings/notifications.md) topic for
additional information.
-You can skip this step if you do not want to receive email notifications, or configure SMTP settings
+You can skip this step if you don't want to receive email notifications, or configure SMTP settings
later, as described in the related section.
## Email Notification Recipients
@@ -168,13 +168,13 @@ plan wizard, select the Add item now checkbox. See the
[Add Items for Monitoring](datasources.md#add-items-for-monitoring) topic for additional
information.
-A monitoring plan cannot collect data until at least one item is specified.
+A monitoring plan can't collect data until at least one item is specified.
Some data sources require additional system components and updates to be installed on your computer.
In this case, Auditor will inform you and prompt you to check data source prerequisites instead of
adding an item.
-Once you complete the wizard, you can:
+After you complete the wizard, you can:
- Add items to your plan
- Add more data sources
diff --git a/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md b/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md
index 96bf412891..09eef72187 100644
--- a/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md
+++ b/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Data Collecting Account
This is a service account that Auditor uses to collect audit data from the monitored items, such as
-domains, OUs and servers. Netwrix recommends the creation of a dedicated service account for that
+domains, OUs, and servers. Netwrix recommends the creation of a dedicated service account for that
purpose. Depending on the data source your monitoring plan will process, the account must meet the
corresponding requirements in the table below.
@@ -63,8 +63,6 @@ data source.
Once a Data Collecting Account has been configured, you can always update the password for this
account in Netwrix Auditor.
-Follow the steps to update credentials for the accounts used by Auditor:
-
**Step 1 –** On the Auditor home page, navigate to **Settings**.
**Step 2 –** Locate the General tab.
diff --git a/docs/auditor/10.7/admin/monitoringplans/datasources.md b/docs/auditor/10.7/admin/monitoringplans/datasources.md
index 7407e36bfa..8f04f8d796 100644
--- a/docs/auditor/10.7/admin/monitoringplans/datasources.md
+++ b/docs/auditor/10.7/admin/monitoringplans/datasources.md
@@ -10,18 +10,16 @@ You can fine-tune data collection for each data source. Settings that you config
source will be applied to all items belonging to that data source. Using data source settings, you
can, for example:
-- Enable state-in-time data collection (currently supported for several data sources)
+- Enable state-in-time data collection (supported for several data sources)
- Depending on the data source, customize the monitoring scope (e.g., enable read access auditing,
monitoring of failed attempts)
-To add, modify and remove data sources, enable or disable monitoring, you must be assigned the
+To add, modify, and remove data sources, enable or disable monitoring, you must be assigned the
Global administrator role in the product or the Configurator role on the plan. See the
[Role-Based Access and Delegation](/docs/auditor/10.7/admin/monitoringplans/delegation.md) topic for additional information.
## Modify Data Source Settings
-Follow the steps to modify data source settings.
-
**Step 1 –** Select the monitoring plan you need and click **Edit**.
**Step 2 –** Within the monitoring plan window, highlight the data source (the first one is the row
@@ -58,8 +56,6 @@ needed.
## Add a Data Source to an Existing Plan
-Follow the steps to add a data source to existing plan.
-
**Step 1 –** Select the monitoring plan you need and click Edit.
**Step 2 –** In the right pane, select Add data source.
@@ -72,7 +68,7 @@ Follow the steps to add a data source to existing plan.
## Add Items for Monitoring
-Once you completed monitoring plan wizard and specified data sources, add items for monitoring. You
+After you complete the monitoring plan wizard and specify data sources, add items for monitoring. You
can add as many items for a data source as you want. In this case, all items will share settings you
specified for this data source.
@@ -93,11 +89,9 @@ associated with your data source.
| Windows Server User Activity | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) [AD Container](activedirectory/overview.md#ad-container) [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) |
| Netwrix API | [Integration API](/docs/auditor/10.7/api/overview.md) |
-To add, modify and remove items, you must be assigned the Global administrator role in the product
+To add, modify, and remove items, you must be assigned the Global administrator role in the product
or the **Configurator** role on the plan. See the
-[Role-Based Access and Delegation](/docs/auditor/10.7/admin/monitoringplans/delegation.md)topic for additional information.
-
-Follow the steps to add a new item to a data source:
+[Role-Based Access and Delegation](/docs/auditor/10.7/admin/monitoringplans/delegation.md) topic for additional information.
**Step 6 –** Navigate to your plan settings.
@@ -118,32 +112,34 @@ monitoring scope can be configured on the Data Source and/or Item levels. the se
examples on how to use omit functionality in Auditor.
In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more
-granular audit data. Note that the new monitoring scope restrictions apply together with previous
-exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for
-additional information.
+granular audit data.
+
+:::note
+The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md) topic for additional information.
+:::
| Use case | Related documentation |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Active Directory** | |
-| I want to omit all activity by a specific service account or service accounts with specific naming pattern. | [Active Directory](/docs/auditor/10.7/admin/monitoringplans/activedirectory/overview.md) |
+| You want to omit all activity by a specific service account or service accounts with a specific naming pattern. | [Active Directory](/docs/auditor/10.7/admin/monitoringplans/activedirectory/overview.md) |
| If Netwrix user is responsible just for a limited scope within corporate AD, s/he needs to omit everything else. | [Active Directory](/docs/auditor/10.7/admin/monitoringplans/activedirectory/overview.md) - Always both activity and state in time data are omitted. - In group/Not in group filters don't not process groups from omitted OUs. |
| **Logon Activity** | |
-| I want to omit domain logons by a specific service account or service accounts with specific naming pattern. | [Logon Activity](/docs/auditor/10.7/admin/monitoringplans/logonactivity/overview.md) |
+| You want to omit domain logons by a specific service account or service accounts with a specific naming pattern. | [Logon Activity](/docs/auditor/10.7/admin/monitoringplans/logonactivity/overview.md) |
| **File Servers** (including Windows file server, Dell, NetApp, Nutanix File server) | |
-| I have a server named _StationWin16_ where I can't install .Net 4.5 in OU where I keep all member servers. I want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) |
-| A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Then, s/he does not want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) |
-| A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Then, s/he does not want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) |
-| A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Netwrix Auditor to collect State-in-Time data for this folder. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) |
-| I want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) |
+| You have a server named _StationWin16_ where you can't install .Net 4.5 in the OU where you keep all member servers. You want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) |
+| A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Then, s/he doesn't want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) |
+| A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Then, s/he doesn't want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) |
+| A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Netwrix Auditor to collect State-in-Time data for this folder. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) |
+| You want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) |
| **SQL Server** | |
-| I want to know if _corp\administrator_ user is messing with SQL data. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) |
-| As a Auditor administrator I want to exclude the _domain\nwxserviceaccount_ service account activity from SQL server audit so that I get reports without changes made by automatic systems. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) |
-| As a Auditor administrator I want to exclude all changes performed by _MyCustomTool_. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) |
+| You want to know if the _corp\administrator_ user is messing with SQL data. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) |
+| As an Auditor administrator, you want to exclude the _domain\nwxserviceaccount_ service account activity from SQL server audit so that you get reports without changes made by automatic systems. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) |
+| As an Auditor administrator, you want to exclude all changes performed by _MyCustomTool_. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) |
| **SharePoint** | |
-| I want to exclude the _domain\nwxserviceaccount_ account from data collection as it produces standard activity that doesn't require monitoring. | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) |
-| As a Auditor Administrator I want to exclude shared _PublicList_ from read audit. | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) |
+| You want to exclude the _domain\nwxserviceaccount_ account from data collection as it produces standard activity that doesn't require monitoring. | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) |
+| As an Auditor Administrator, you want to exclude shared _PublicList_ from read audit. | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) |
| Windows Server | |
-| I have a server named StationWin16 where I can't install .Net 4.5 in OU where I keep all member servers. I want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) |
-| I want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) |
+| You have a server named StationWin16 where you can't install .Net 4.5 in the OU where you keep all member servers. You want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) |
+| You want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md) |
| VMware | |
-| I have a virtual machine named "testvm" I use for testing purposes, so I want to exclude it from being monitored. | [VMware ESX/ESXi/vCenter](vmware/overview.md#vmware-esxesxivcenter) |
+| You have a virtual machine named "testvm" used for testing purposes, so you want to exclude it from being monitored. | [VMware ESX/ESXi/vCenter](vmware/overview.md#vmware-esxesxivcenter) |
diff --git a/docs/auditor/10.7/admin/monitoringplans/delegation.md b/docs/auditor/10.7/admin/monitoringplans/delegation.md
index 23cdd3948a..2b3c547a51 100644
--- a/docs/auditor/10.7/admin/monitoringplans/delegation.md
+++ b/docs/auditor/10.7/admin/monitoringplans/delegation.md
@@ -7,7 +7,7 @@ sidebar_position: 230
# Role-Based Access and Delegation
Security and awareness of _who_ has access to _what_ is crucial for every organization. Besides
-notifying you on _who_ changed _what_, _when_ and _where_, and _who_ has access to _what_ in your IT
+notifying you on _who_ changed _what_, _when_, and _where_, and _who_ has access to _what_ in your IT
infrastructure, Netwrix pays attention to safety of its own configuration and collected data.
To keep the monitoring process secure, Netwrix suggests configuring role-based access. Delegating
@@ -21,7 +21,7 @@ Roles are described briefly in the table below and explained in detail in the ne
| Role | Access level | Recommended use |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Global administrator | Full control. Access to global settings, monitoring plan configuration, collected data, access delegation, etc. | The role should be assigned to a very limited number of employees—typically, only the owner of the Auditor Server host in your environment. By default, the user who installed Auditor is assigned the Global administrator role. All members of the local Administrators group are Global administrators too. |
-| Configurator | Access to monitoring plan configuration within the delegated scope: a monitoring plan or a folder with monitoring plans | The role is appropriate for system administrators, infrastructure engineers, and members of operations team who manage network and services in your organization but should not have access to sensitive data. |
+| Configurator | Access to monitoring plan configuration within the delegated scope: a monitoring plan or a folder with monitoring plans | The role is appropriate for system administrators, infrastructure engineers, and members of operations team who manage network and services in your organization but shouldn't have access to sensitive data. |
| Global reviewer | Access to all data collected by Auditor and intelligence and visibility features. | The role is appropriate for key employees who need to review audit data collected across various data sources—typically, IT managers, chief information security officer, and so on. |
| Reviewer | Access to data collected by Auditor and intelligence and visibility features within the delegated scope. | The role is appropriate for members of security team and helpdesk personnel who are responsible for mitigating risks in a certain sector of your environment (e.g., domain, file share). This role is granted to specialists who use the Integration API to retrieve data from the Audit Database. |
| Contributor | Write access to Auditor Server and Audit Database. | This service role is granted to specialists who use the Integration API to write data to the Audit Database. This role is also granted to service accounts or any accounts used for interaction with Auditor Server (e.g., add-on scripts). |
@@ -31,14 +31,14 @@ Roles are described briefly in the table below and explained in detail in the ne
| Feature | Global administrator | Global reviewer | Reviewer | Configurator | Contributor |
| --------------------------------------------------------------------------------------------- | -------------------- | ----------------------------------------------- | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | ------------------- |
| Launch Auditor client | + | + | + | + | + |
-| Delegate control, grant and revoke permissions | + | – | – | – | – |
+| Delegate control, grant, and revoke permissions | + | – | – | – | – |
| View global settings | + | Some | Some | Some | Some |
| Modify global settings (including default Audit Database, licenses, retention settings, etc.) | + | – | – | – | – |
| Monitoring plan configuration | | | | | |
| List folders | + | + | + | + | + |
-| Add, remove, rename folders | + | – | – | Some Only under assigned folders provided that directly assigned roles do not conflict. | – |
+| Add, remove, rename folders | + | – | – | Some Only under assigned folders provided that directly assigned roles don't conflict. | – |
| List monitoring plans, review status | + | + | + | + | + |
-| Add, remove, rename monitoring plans | + | – | – | Some Only under assigned folders provided that directly assigned roles do not conflict. | – |
+| Add, remove, rename monitoring plans | + | – | – | Some Only under assigned folders provided that directly assigned roles don't conflict. | – |
| Modify monitoring plan settings | + | Some Add and remove Activity Summary recipients | Some Add and remove Activity Summary recipients within the delegated scope | Some Restricted to the delegated scope (folder or monitoring plan) | – |
| List data sources and items in monitoring plan | + | + | + | + | + |
| Add, modify, remove data sources, enable or disable auditing | + | – | – | Some Restricted to the delegated scope (folder or monitoring plan) | – |
@@ -71,8 +71,8 @@ Roles are described briefly in the table below and explained in detail in the ne
Netwrix Auditor allows assigning roles on the product as a whole, or within a specific _scope_. A
scope can be limited to a single monitoring plan or to the contents of a folder. This helps to
ensure that only authorized personnel has access to the relevant data. For example, database
-administrators (DBAs) should not access Active Directory management data, and domain administrators
-do not need permissions to view database schema changes or update data collection settings, and so
+administrators (DBAs) shouldn't access Active Directory management data, and domain administrators
+don't need permissions to view database schema changes or update data collection settings, and so
on.
### Understanding Scopes
@@ -85,8 +85,6 @@ Scopes for different Auditor roles are as follows:
| Folder level | Configurator Reviewer |
| Plan level | Configurator Reviewer |
-Follow the steps to delegate control to some scope, review, or revoke assigned roles.
-
**Step 1 –** On the main Auditor page, navigate to the **Monitoring Plans** section.
**Step 2 –** Browse your monitoring plans tree and select the scope you want to delegate to a user
@@ -137,8 +135,6 @@ users to these groups on the computer where Auditor Server resides.
Users will be granted roles with extended permissions. You may need to limit their scope to a
specific monitoring plan.
-Follow the steps to add an account to a group.
-
**Step 1 –** On the computer where Auditor Server is installed, start the Local Users and Computers
snap-in.
@@ -165,7 +161,7 @@ However, in some cases, organizations need to provide certain employees with acc
of audit data. For example, an auditor might need to review particular access reports once or twice
a year. You can provide these users (recipients) with means to review the data they need without
actually running Auditor. This ensures that dedicated specialists have access to the data while
-preventing data breaches and ensuring that sensitive data is not being distributed across the whole
+preventing data breaches and ensuring that sensitive data isn't being distributed across the whole
company.
Netwrix recommends granting limited access permissions to employees who need to:
@@ -178,6 +174,6 @@ To grant limited access to audit data, you can:
| Do.. | Recommended use |
| ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Schedule email report subscriptions | This is helpful when you want to share information with a group of employees, external consultants, auditors, and so on. Reports are sent according to a specified schedule and recipients can review them, but they do not have any other means to access audit data. Basically, this option is enough for employees who are interested in a high-level summary—for example, an auditor who performs monthly access rights attestation on critical folders or a senior manager. |
+| Schedule email report subscriptions | This is helpful when you want to share information with a group of employees, external consultants, auditors, and so on. Reports are sent according to a specified schedule and recipients can review them, but they don't have any other means to access audit data. Basically, this option is enough for employees who are interested in a high-level summary—for example, an auditor who performs monthly access rights attestation on critical folders or a senior manager. |
| Publish reports to file shares | This scenario works great for a helpdesk with several departments. Assume, each department has its own field of responsibility and must not disclose information to other departments. You can configure Auditor to publish reports to folders that can be accessed by employees from a specific department only. You might set up the following folders and permissions: - The user support team has access to a folder with reports on account lockouts and password resets. - File server helpdesk personnel have access to a different folder with daily reports listing all file removals. - The helpdesk supervisor has access to both folders. |
-| Configure alerts | This is helpful for rare occasions when you have to notify some senior specialists about critical system state that has to be addressed immediately, e.g., CISO must mitigate risks in the event of massive deletions in the sensitive data storage. |
+| Configure alerts | This is helpful for rare occasions when you have to notify some senior specialists about critical system state that has to be addressed immediately, e.g., CISO must mitigate risks if there are massive deletions in the sensitive data storage. |
diff --git a/docs/auditor/10.7/admin/monitoringplans/exchange/overview.md b/docs/auditor/10.7/admin/monitoringplans/exchange/overview.md
index afc6790d57..9e6cfd37e4 100644
--- a/docs/auditor/10.7/admin/monitoringplans/exchange/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/exchange/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 70
# Exchange
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
@@ -24,8 +24,8 @@ Complete the following fields:
| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
| Detect additional details | Specify additional information to include in reports and activity summaries. Select Group membershipif you want to include Group membership of the account under which the change was made. |
-| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
-| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. See the [Exchange](/docs/auditor/10.7/configuration/exchange/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
+| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting, and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
+| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [Exchange](/docs/auditor/10.7/configuration/exchange/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
| Collect data on non-owner access to mailboxes | Enable monitoring of unauthorized access to mailboxes within your Exchange Online organization. Configure the following: - Notify users if someone gained access to their mailboxes — Select this checkbox if you want to notify users on non-owner access events to their mailboxes. - Notify only specific users — Select this checkbox and click Add Recipient to specify the list of users who will receive notifications on non-owner access to their mailboxes. Users not included in this list will not be notified. - Enable automatic audit configuration— If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. See the [Exchange](/docs/auditor/10.7/configuration/exchange/overview.md) and [Exchange Online](/docs/auditor/10.7/configuration/microsoft365/exchangeonline/overview.md) topics for additional information about the audit settings required for Auditor to collect comprehensive audit data and instructions on how to configure them. If you select to automatically configure audit in the target environment, your current audit settings will be checked on each data collection and adjusted if necessary. |
Review your data source settings and click **Add** to go back to your plan. The newly created data
diff --git a/docs/auditor/10.7/admin/monitoringplans/exchange/scope.md b/docs/auditor/10.7/admin/monitoringplans/exchange/scope.md
index 0b9be8407c..e53c7fa6a5 100644
--- a/docs/auditor/10.7/admin/monitoringplans/exchange/scope.md
+++ b/docs/auditor/10.7/admin/monitoringplans/exchange/scope.md
@@ -12,7 +12,7 @@ scope. In addition, you can exclude data from non-owner access auditing.
- Exchange Monitoring Scope
- To exclude users or mailboxes from the Mailbox Access monitoring scope
-Follow the steps to exclude data from the Exchange monitoring scope:
+ data from the Exchange monitoring scope:
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Active Directory Auditing_
folder.
@@ -30,17 +30,17 @@ folder.
| omitobjlist_ecr.txt | Contains a list of human-readable names of object classes to be excluded from change reports. | `Classname` For example: `exchangeAdminService` `msExchMessageDeliveryConfig` `Exchange_DSAccessDC` |
| omitpathlist_ecr.txt | Contains a list of AD paths to be excluded from change reports. | `Path` For example: `*\Microsoft Exchange System Objects\SystemMailbox*` |
| omitproplist_ecr.txt | Contains a list of object types and properties to be excluded from change reports. | `object_type.property_name` If there is no separator (.) between an object type and a property, the whole entry is treated as an object type. For example: `msExchSystemMailbox.*` `*.msExchEdgeSyncCredential` `*.msExchMailboxMoveTargetMDBLink` `*.adminDescription` |
-| omitreporterrors_ecr.txt | Contains a list of errors to be excluded from Activity Summaries. | `Error message text` For example, to omit the error “The HTTP service used by Public Folders is not available, possible causes are that Public stores are not mounted and the Information Store service is not running. ID no: c1030af3”, add `*c1030af3*` to the file. |
+| omitreporterrors_ecr.txt | Contains a list of errors to be excluded from Activity Summaries. | `Error message text` For example, to omit the error “The HTTP service used by Public Folders isn't available, possible causes are that Public stores aren't mounted and the Information Store service isn't running. ID no: c1030af3”, add `*c1030af3*` to the file. |
| omitstorelist_ecr.txt | Contains a list of classes and attributes names to be excluded from Exchange snapshots. | `object_type.property_name` If there is no separator (.) between an object type and a property, the whole entry is treated as an object type. For example: `Exchange_Server.AdministrativeGroup` `Exchange_Server.AdministrativeNote` `Exchange_Server.CreationTime` |
| propnames_ecr2007.txt | Contains a list of human-readable names for object classes and attributes of Exchange 2007 to be displayed in change reports. | `classname.attrname= intelligiblename` For example: `msExchMDBAvailabilityGroup= Database Availability Group` |
To exclude users or mailboxes from the Mailbox Access monitoring scope
-Auditor allows specifying users and mailboxes that you do not want to monitor for non-owner mailbox
+Auditor allows specifying users and mailboxes that you don't want to monitor for non-owner mailbox
access events. To do this, edit the mailboxestoexclude.txt, userstoexclude.txt, and
agentomitusers.txt files.
-Follow the steps to exclude data from Exchange Online monitoring scope
+ data from Exchange Online monitoring scope
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Non-owner Mailbox Access
Reporter for Exchange_ folder.
@@ -57,7 +57,7 @@ specify mailboxes.
| File | Description | Syntax |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| mailboxestoexclude.txt | This file contains a list of mailboxes and folders that must be excluded from data collection. | Each entry must be a separate line. Wildcards (\*) can be used to replace any number of characters. - To exclude the certain user's mailbox, enter `username@domainname` , e.g.`john.smith@acme.com` - To exclude the certian folder, enter `username@domainname/foldername` , e.g. `john.smith@acme.com/Drafts ` - Use \*to exclude multiple mailboxes or folders, e.g. `*/foldername` will exclude the specified folder when processing all mailboxes. Examples: `*admin*@corp.com` `*/Drafts` - exclude _Drafts_ folder (for all mailboxes) `*/Testfolder/*` - exclude subfolders of _Testfolder_ (for all mailboxes) |
+| mailboxestoexclude.txt | This file contains a list of mailboxes and folders that must be excluded from data collection. | Each entry must be a separate line. Use wildcards (\*) to replace any number of characters. - To exclude the certain user's mailbox, enter `username@domainname` , e.g.`john.smith@acme.com` - To exclude the certian folder, enter `username@domainname/foldername` , e.g. `john.smith@acme.com/Drafts ` - Use \*to exclude multiple mailboxes or folders, e.g. `*/foldername` will exclude the specified folder when processing all mailboxes. Examples: `*admin*@corp.com` `*/Drafts` - exclude _Drafts_ folder (for all mailboxes) `*/Testfolder/*` - exclude subfolders of _Testfolder_ (for all mailboxes) |
| mailboxestoinclude.txt | This file contains a list of mailboxes that must be included when collecting data. For the mailboxes added to this list, the reports will contain only non-owner access events. | Specify email address to be included in the list as `username@domainname.` Example: `analyst@enterprise.com` |
| userstoexclude.txt | This file contains a list of users who must be excluded from reports if they perform non-owner access attempt for mailboxes (audit data on these users will still be stored in the state-in-time snapshots). If a user is removed from this list, the information on this user’s actions can be viewed with the Report Viewer. | `DOMAIN\username` |
| agentomitusers.txt | This file contains a list of users who must be excluded from reports and snapshots. If a user is removed from this list, audit data on this user will only be available after the next data collection. Writing new users to this file affects reports and snapshots only if Network traffic compression is enabled. | `DOMAIN\username` |
diff --git a/docs/auditor/10.7/admin/monitoringplans/exchangeonline/overview.md b/docs/auditor/10.7/admin/monitoringplans/exchangeonline/overview.md
index 3365da60da..2a096c4caa 100644
--- a/docs/auditor/10.7/admin/monitoringplans/exchangeonline/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/exchangeonline/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# Exchange Online
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**:::note** Before configuring your monitoring plan, read, and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
@@ -25,7 +25,7 @@ This instruction shows how to collect audit data from the Microsoft 365 tenant.
If you plan to use modern authentication, see the
[Configuring Microsoft Entra ID App for Auditing Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md#configuring-microsoft-entra-id-app-for-auditing-microsoft-entra-id)
topic for additional information on how to prepare Microsoft Entra ID app with required permissions.
-Make sure you have the following at hand:
+Ensure you have the following at hand:
- Tenant name
- For modern authentication: Application (client) ID
@@ -35,14 +35,14 @@ Make sure you have the following at hand:
Types of data that can be collected by Netwrix Auditor from the Microsoft 365 tenant depend on the
authentication option you choose.
-Follow the steps to configure Office 365 tenant as a monitored item.
+## Configure Office 365 tenant as a monitored item
**Step 1 –** On the **General** page of the item properties, specify **Tenant name**:
- If you are going to use **Basic authentication**, you can proceed to the next step – **Tenant
name** will be filled in automatically after it.
-- **NOTE:** Basic authentication is no longer possible for Exchange Online. For the already existing
+- **:::note** Basic authentication is no longer possible for Exchange Online. For the already existing
tenants it is still possible to use basic authentication for SharePoint Online and Microsoft Entra
ID monitoring.
@@ -52,7 +52,7 @@ Follow the steps to configure Office 365 tenant as a monitored item.
-If you are using a government tenant, please click the **Tenant Environment** tab and select the
+If you are using a government tenant, click the **Tenant Environment** tab and select the
desired tenant environment.
**Step 2 –** Select authentication method that will be used when accessing Office 365 services:
@@ -63,7 +63,7 @@ desired tenant environment.
- Enter **User name** and **password**; use any of the following formats: _user@domain.com_ or
_user@domain.onmicrosoft.com_.
- The **Tenant name** field then will be filled in automatically.
- - Make sure this user account has sufficient access rights. See
+ - Ensure this user account has sufficient access rights. See
[Using Basic Authentication with Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/basicauth.md)
topic for additional information.
diff --git a/docs/auditor/10.7/admin/monitoringplans/exchangeonline/scope.md b/docs/auditor/10.7/admin/monitoringplans/exchangeonline/scope.md
index 0bc6cb9e14..3a5eb21241 100644
--- a/docs/auditor/10.7/admin/monitoringplans/exchangeonline/scope.md
+++ b/docs/auditor/10.7/admin/monitoringplans/exchangeonline/scope.md
@@ -9,7 +9,7 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Exchange
Online monitoring scope.
-Follow the steps to exclude data from Exchange Online monitoring scope:
+ exclude data from Exchange Online monitoring scope:
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Exchange Online Auditing_
folder.
@@ -25,4 +25,4 @@ folder.
| omitlist.txt | The file contains a list of changes performed by cmdlets. To exclude a change from reports, search results and Activity Summaries, specify name of a cmdlet and the attribute that is changed by the selected cmdlet. | `cmdlet` For example: `Enable-OrganizationCustomization` `New-AdminAuditLogSearch` `New-MailboxAuditLogSearch` `cmdlet.param` For example: `*.Identity` `*.DomainController` `*.Organization` `*.IgnoreDefaultScope` `*.Force` `*.Confirm` `*.Password` `*-ManagementRoleEntry.Parameters` `Remove-PublicFolder.Recurse` |
| omitpathlist.txt | Contains a list of paths to be excluded from reports, search results and Activity Summaries. | `path` For example: `SystemMailbox{*}` `DiscoverySearchMailbox{*}` `FederatedEmail.*` You can use a wildcard (\*) to replace any number of characters in the path. |
| omituserlist.txt | Contains a list of user names to be excluded from reports, search results and Activity Summaries. | `domain\user` For example: `Enterprise\analyst` `email address` For example: `analyst@Enterprise.onmicrosoft.com` |
-| propnames.txt | Contains a list of human-readable names for object classes and their and their properties to be displayed in search results, reports and Activity Summaries. | `cmdletobject=friendlyname` `cmdlet.param=friendlyname` For example: `RoleGroupMember = Role Group` `UMHuntGroup = Unified Messaging Hunt Group` |
+| propnames.txt | Contains a list of human-readable names for object classes and their and their properties to be displayed in search results, reports, and Activity Summaries. | `cmdletobject=friendlyname` `cmdlet.param=friendlyname` For example: `RoleGroupMember = Role Group` `UMHuntGroup = Unified Messaging Hunt Group` |
diff --git a/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md b/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md
index cb365cc132..3dd2cc62cd 100644
--- a/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/fileservers/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 90
# File Servers
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**:::note** Before configuring your monitoring plan, read, and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
@@ -37,12 +37,12 @@ Complete the following fields:
Actions reported by Auditor vary depending on the file server type and the audited object (file, folder, or share). The changes include creation, modification, deletion, moving, etc. To track the copy action, enable successful read access and change auditing.
-- Specify data collection method – You can enable network traffic compression. If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance.
+- Specify data collection method – You can enable network traffic compression. If enabled, a Compression Service will be automatically launched on the audited computer, collecting, and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance.
To collect data from 32-bit operating systems, network traffic compression must be disabled.
To collect data from Windows Failover Cluster, network traffic compression must be enabled.
- Configure audit settings – You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed.
-Do not select the checkbox if you want to configure audit settings manually. Some settings cannot be configured automatically. The product has the following limitations depending on your file server type
+Don't select the checkbox if you want to configure audit settings manually. Some settings can't be configured automatically. The product has the following limitations depending on your file server type
| File Server | SACL Check | SACL Adjust | Policy Check | Policy Adjust | Log Check | Log Adjust |
|-----------------------------------------|------------|-------------|--------------|---------------|-----------|------------|
@@ -55,7 +55,7 @@ Do not select the checkbox if you want to configure audit settings manually. Som
- Collect data for state-in-time reports – Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation.
When auditing file servers, changes to effective access permissions can be tracked in addition to audit permissions. By default, Combination of file and share permissions is tracked. File permissions define who has access to local files and folders. Share permissions provide or deny access to the same resources over the network. The combination of both determines the final access permissions for a shared folder—the more restrictive permissions are applied. Upon selecting Combination of file and share permissions only the resultant set will be written to the Audit Database. Select File permissions option too if you want to see difference between permissions applied locally and the effective file and share permissions set. To disable auditing of effective access, unselect all checkboxes under Include details on effective permissions.
-In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select day(s) of week you want your snapshot to be collected.
+In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select days of week you want your snapshot to be collected.
In the Manage historical snapshots section, you can click Manage and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past.
You must be assigned the Global administrator or the Global reviewer role to import snapshots.
Move the selected snapshots to the Snapshots available for reporting list using the arrow button.
@@ -63,11 +63,15 @@ The product updates the latest snapshot on the regular basis to keep users up to
- Users
-- Specify monitoring restrictions – Select the users to be excluded from search results, reports and Activity Summaries. To add users to the list, click Add and provide user name in the domain\user format: *mydomain\user1*.
+- Specify monitoring restrictions – Select the users to be excluded from search results, reports, and Activity Summaries. To add users to the list, click Add and provide user name in the domain\user format: *mydomain\user1*.
- Use NetBIOS domain name format.
- To exclude events containing “System” instead of initiator's account name in the “Who” column, enter "System" value to the list.
-In addition to the restrictions for a monitoring plan, you can use the *.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the *.txt files.
+In addition to the restrictions for a monitoring plan, you can use the *.txt files to collect more granular audit data.
+
+:::note
+The new monitoring scope restrictions apply together with previous exclusion settings configured in the *.txt files.
+:::
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the Data source list. As a next step, click Add item to specify an object for
@@ -89,7 +93,7 @@ shares (_D$, E$_), etc. will not be monitored. See the
[Add Items for Monitoring](/docs/auditor/10.7/admin/monitoringplans/datasources.md#add-items-for-monitoring) topic for additional
information.
-_Remember,_ before adding your monitored items, examine the considerations, limitations and
+_Remember,_ before adding your monitored items, examine the considerations, limitations, and
recommendations provided in the following sections:
- [DFS-Related Constraints](/docs/auditor/10.7/configuration/fileservers/windows/overview.md#dfs-related-constraints)
@@ -106,11 +110,11 @@ Complete the following fields:
| Option | Description |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify Dell VNX/VNXe, Celerra or Unity storage array | Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
+| Specify Dell VNX/VNXe, Celerra, or Unity storage array | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Scope | |
| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. See the Fine-tune Monitoring Scope for additional information on how to narrow your monitoring scope. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. See the Fine-tune Monitoring Scope for additional information on how to narrow your monitoring scope. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
### Fine-tune Monitoring Scope
@@ -123,20 +127,16 @@ You can also create lists of specific file shares to include and/or exclude from
#### Include a File Share
-Follow the steps to include a file share.
-
**Step 1 –** Under Specify monitoring restrictions, select Specific file shares.
**Step 2 –** Click Add Inclusion.
**Step 3 –** Provide UNC path to a shared resource. For example: _NewStation\Shared._
-**Step 4 –** Do not specify a default file share mapped to a local drive (e.g., \\Server\e$).
+**Step 4 –** Don't specify a default file share mapped to a local drive (e.g., \\Server\e$).
#### Exclude Specific Data
-Follow the steps to exclude specific data.
-
Click Add Exclusion. Then, in the Specify Filters dialog, do the following:
**Step 5 –** Provide the path to the file share where you are going to exclude some audit data. Use
@@ -144,18 +144,16 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
**Step 6 –** You can use a wildcard (\*) only if you need to exclude user activity on this file
-share. For other data types (_state-in-time_ or _all data_) wildcards are not supported. This refers
+share. For other data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers
to the specified shared folder, its subfolders and files.
**Step 7 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
-
-**Follow the steps to exclude specific user activity.**
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **:::note** In this case,Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **:::note** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
**Step 1 –** Specify what user accounts should be excluded:
@@ -167,7 +165,7 @@ to the specified shared folder, its subfolders and files.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_.
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_.
@@ -187,7 +185,7 @@ Complete the following fields:
| File Share UNC path to audit logs | Path to the file share located on a Dell Isilon with event log files (e.g., _\\srv\netwrix_audit$\logs_). |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Scope | |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. See the Fine-tune Monitoring ScopeFine-tune Monitoring Scopetopic for additional information about how to narrow your monitoring scope. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. See the Fine-tune Monitoring ScopeFine-tune Monitoring Scopetopic for additional information about how to narrow your monitoring scope. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
### Configure the Scope
@@ -201,20 +199,16 @@ following for additional information:
### Add Inclusion
-Follow the steps to add inclusion.
-
**Step 1 –** Under Specify monitoring restrictions, select Specific file shares.
**Step 2 –** Click Add Inclusion.
**Step 3 –** Provide UNC path to a shared resource. For example: _NewStation\Shared._
-Do not specify a default file share mapped to a local drive (e.g., \\Server\e$).
+Don't specify a default file share mapped to a local drive (e.g., \\Server\e$).
### Add Exclusion
-Follow the steps to add exclusion.
-
Click Add Exclusion. Then, in the Specify Filters dialog, do the following:
**Step 4 –** Provide the path to the file share where you are going to exclude some audit data. Use
@@ -222,18 +216,16 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
**Step 5 –** You can use a wildcard (\*) only if you need to exclude user activity on this file
-share. For other data types (_state-in-time_ or _all data_) wildcards are not supported. This refers
+share. For other data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers
to the specified shared folder, its subfolders and files.
**Step 6 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
-
-**Follow the steps to exclude specific user activity.**
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **:::note** In this case,Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **:::note** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
**Step 1 –** Specify what user accounts should be excluded:
@@ -245,7 +237,7 @@ to the specified shared folder, its subfolders and files.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_.
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_.
@@ -259,16 +251,16 @@ Complete the following fields:
| Option | Description |
| ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify NetApp file server | Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
+| Specify NetApp file server | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
| File share UNC path to audit logs | Select one of the following: - Detect automatically—If selected, a shared resource will be detected automatically. - Use this path—UNC path to the file share located on a NetApp Filer with event log files (e.g., _\\CORP\ETC$\log_). |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| ONTAPI/ONTAP REST API | |
-| Specify protocol for accessing ONTAPI/ONTAP REST API | Select one of the following: - Detect automatically—If selected, a connection protocol will be detected automatically. - HTTP - HTTPS Refer to [Netwrix Auditor Installation and Configuration Guide](https://www.netwrix.com/download/documents/Netwrix_Auditor_Installation_Configuration_Guide.pdf) for detailed instructions on how to enable HTTP or HTTPS admin access. NOTE: ONTAP REST API works only over HTTPS protocol |
-| Specify management interface | Select management interface to connect to ONTAPI/ONTAP REST API. If you want to use custom management interface for ONTAPI/ONTAP REST API, select Custom and provide a server name by entering its FQDN, NETBIOS or IP address. |
+| Specify protocol for accessing ONTAPI/ONTAP REST API | Select one of the following: - Detect automatically—If selected, a connection protocol will be detected automatically. - HTTP - HTTPS Refer to [Netwrix Auditor Installation and Configuration Guide](https://www.netwrix.com/download/documents/Netwrix_Auditor_Installation_Configuration_Guide.pdf) for detailed instructions on how to enable HTTP or HTTPS admin access. :::note ONTAP REST API works only over HTTPS protocol |
+| Specify management interface | Select management interface to connect to ONTAPI/ONTAP REST API. If you want to use custom management interface for ONTAPI/ONTAP REST API, select Custom and provide a server name by entering its FQDN, NETBIOS, or IP address. |
| Specify account for connecting to ONTAPI/ONTAP REST API | Select an account to connect to NetApp and collect data through ONTAPI/ONTAP REST API. If you want to use a specific account (other than the one you specified on the General tab), select **Custom** and enter credentials. The credentials are case sensitive. Take into consideration that even if a custom account is specified, the account selected on the General tab must be a member of the Builtin\Administrators group and have sufficient permissions to access audit logs shared folder and audited shares. [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) |
| Scope | |
-| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. **CAUTION:** Monitoring of non-default hidden shares is not supported for NetApp servers in 7-mode. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. Configure Scope how to narrow your monitoring scope. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
+| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. **CAUTION:** Monitoring of non-default hidden shares isn't supported for NetApp servers in 7-mode. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. Configure Scope how to narrow your monitoring scope. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
### Configure Scope
@@ -279,20 +271,16 @@ following for additional information:
### Add Inclusion
-Follow the steps to add inclusion.
-
**Step 1 –** Under Specify monitoring restrictions, select Specific file shares.
**Step 2 –** Click Add Inclusion.
**Step 3 –** Provide UNC path to a shared resource. For example: _NewStation\Shared._
-NOTE: Do not specify a default file share mapped to a local drive (e.g., \\Server\e$).
+:::note Don't specify a default file share mapped to a local drive (e.g., \\Server\e$).
### Add Exclusion
-Follow the steps to add exclusion.
-
Click Add Exclusion. Then, in the Specify Filters dialog, do the following:
**Step 4 –** Provide the path to the file share where you are going to exclude some audit data. Use
@@ -300,18 +288,16 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
**Step 5 –** You can use a wildcard (\*) only if you need to exclude user activity on this file
-share. For other data types (_state-in-time_ or _all data_) wildcards are not supported. This refers
+share. For other data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers
to the specified shared folder, its subfolders and files.
**Step 6 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
-
-**Follow the steps to exclude specific user activity.**
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **:::note** In this case,Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **:::note** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
**Step 1 –** Specify what user accounts should be excluded:
@@ -323,7 +309,7 @@ to the specified shared folder, its subfolders and files.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_.
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_.
@@ -332,7 +318,7 @@ settings.
## Nutanix Files
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**:::note** Before configuring your monitoring plan, read, and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
@@ -357,13 +343,13 @@ Complete the following fields:
Actions reported by Auditor vary depending on the file server type and the audited object (file, folder, or share). The changes include creation, modification, deletion, moving, etc. To track the copy action, enable successful read access and change auditing.
-- Specify data collection method – You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance.
+- Specify data collection method – You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting, and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance.
-- Configure audit settings – You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. See the [Supported Data Sources](/docs/auditor/10.7/requirements/supporteddatasources/supporteddatasources.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. Netwrix Auditor can configure the following settings:
+- Configure audit settings – You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [Supported Data Sources](/docs/auditor/10.7/requirements/supporteddatasources/supporteddatasources.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. Netwrix Auditor can configure the following settings:
- Policy Check
- Policy Adjust
-- Collect data for state-in-time reports – Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.7/admin/reports/types/stateintime/overview.md) topic for additional information. When auditing file servers, changes to effective access permissions can be tracked in addition to audit permissions. By default, Combination of file and share permissions is tracked. File permissions define who has access to local files and folders. Share permissions provide or deny access to the same resources over the network. The combination of both determines the final access permissions for a shared folder—the more restrictive permissions are applied. Upon selecting Combination of file and share permissions only the resultant set will be written to the Audit Database. Select File permissions option too if you want to see difference between permissions applied locally and the effective file and share permissions set. To disable auditing of effective access, unselect all checkboxes under Include details on effective permissions. In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select day(s) of week you want your snapshot to be collected. In the Manage historical snapshots section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must be assigned the Global administrator or the Global reviewer role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot on the regular basis to keep users up to date on actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database.
+- Collect data for state-in-time reports – Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.7/admin/reports/types/stateintime/overview.md) topic for additional information. When auditing file servers, changes to effective access permissions can be tracked in addition to audit permissions. By default, Combination of file and share permissions is tracked. File permissions define who has access to local files and folders. Share permissions provide or deny access to the same resources over the network. The combination of both determines the final access permissions for a shared folder—the more restrictive permissions are applied. Upon selecting Combination of file and share permissions only the resultant set will be written to the Audit Database. Select File permissions option too if you want to see difference between permissions applied locally and the effective file and share permissions set. To disable auditing of effective access, unselect all checkboxes under Include details on effective permissions. In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select days of week you want your snapshot to be collected. In the Manage historical snapshots section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must be assigned the Global administrator or the Global reviewer role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot on the regular basis to keep users up to date on actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database.
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the **Data source** list. As a next step, click **Add item** to specify an
@@ -376,14 +362,14 @@ Complete the following fields:
| Option | Description |
| -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **General** | |
-| Specify Nutanix File Server | Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. If you need to audit a 3-node cluster, it is recommended to use FQDN or NETBIOS name. |
+| Specify Nutanix File Server | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. If you need to audit a 3-node cluster, it is recommended to use FQDN or NETBIOS name. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for more information. |
| Specify listening port for incoming connections | Provide the name of the TCP port to listen to notifications on the operations with Nutanix file shares. Default is **9898**. For details on how to open the port, refer to the [Nutanix Ports](/docs/auditor/10.7/configuration/fileservers/nutanix/ports.md) topic. |
| **Nutanix File Server REST API** | |
| Specify account for connecting to Nutanix File Server REST API | Specify the account that will be used to connect to Nutanix REST API. This account should have sufficient privileges on the Nutanix File Server. For details, refer to [Create User Account to Access Nutanix REST API](/docs/auditor/10.7/configuration/fileservers/nutanix/useraccount.md). |
| **Scope** | |
| Monitor hidden shares | By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. Refer to Configure Scope for detailed instructions on how to configure your monitoring scope. Currently, auditing is available for SMB shares only. Auditing of NFS shares is not supported due to known limitations. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. Refer to Configure Scope for detailed instructions on how to configure your monitoring scope. auditing is available for SMB shares only. Auditing of NFS shares isn't supported due to known limitations. |
### Configure Scope
@@ -394,20 +380,16 @@ following for additional information:
### Add Inclusion
-Follow the steps to add inclusion.
-
**Step 1 –** Under Specify monitoring restrictions, select Specific file shares.
**Step 2 –** Click Add Inclusion.
**Step 3 –** Provide UNC path to a shared resource. For example: _NewStation\Shared._
-Do not specify a default file share mapped to a local drive (e.g., \\Server\e$).
+Don't specify a default file share mapped to a local drive (e.g., \\Server\e$).
### Add Exclusion
-Follow the steps to add exclusion.
-
Click Add Exclusion. Then, in the Specify Filters dialog, do the following:
**Step 4 –** Provide the path to the file share where you are going to exclude some audit data. Use
@@ -415,18 +397,16 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
**Step 5 –** You can use a wildcard (\*) only if you need to exclude user activity on this file
-share. For other data types (_state-in-time_ or _all data_) wildcards are not supported. This refers
+share. For other data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers
to the specified shared folder, its subfolders and files.
**Step 6 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
-
-**Follow the steps to exclude specific user activity.**
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **:::note** In this case,Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **:::note** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
**Step 1 –** Specify what user accounts should be excluded:
@@ -438,7 +418,7 @@ to the specified shared folder, its subfolders and files.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_.
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_.
@@ -452,13 +432,13 @@ Complete the following fields:
| Option | Description |
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| General | |
-| Specify a file server | Provide UNC path to a file server. See the section below for special considerations. Do not specify a default file share mapped to a local drive (e.g., \\Server\e$). |
+| Specify a file server | Provide UNC path to a file server. See the section below for special considerations. Don't specify a default file share mapped to a local drive (e.g., \\Server\e$). |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Event Collection | |
| Specify a host or network resource | Provide UNC path to a file server or an IP range of servers you want to get activity events from. You can select to collect event data from the same server or provide a custom server or IP range. |
| Specify port and protocol for incoming connections | Use **Port** and **Protocol** to provide the port required for incoming connections (default is **UDP port 514**). |
| Scope | |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. |
## Synology
@@ -467,10 +447,10 @@ Complete the following fields:
| Option | Description |
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| General | |
-| Specify a file server | Provide UNC path to a file server. See the section below for special considerations. Do not specify a default file share mapped to a local drive (e.g., \\Server\e$). |
+| Specify a file server | Provide UNC path to a file server. See the section below for special considerations. Don't specify a default file share mapped to a local drive (e.g., \\Server\e$). |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Event Collection | |
| Specify a host or network resource | Provide UNC path to a file server or an IP range of servers you want to get activity events from. You can select to collect event data from the same server or provide a custom server or IP range. |
| Specify port and protocol for incoming connections | Use **Port** and **Protocol** to provide the port required for incoming connections (default is **UDP port 514**). |
| Scope | |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. |
diff --git a/docs/auditor/10.7/admin/monitoringplans/fileservers/scope.md b/docs/auditor/10.7/admin/monitoringplans/fileservers/scope.md
index dcac4dcbb5..a11e273cc6 100644
--- a/docs/auditor/10.7/admin/monitoringplans/fileservers/scope.md
+++ b/docs/auditor/10.7/admin/monitoringplans/fileservers/scope.md
@@ -19,7 +19,7 @@ lists), as explained below.
Monitoring scope restrictions set up in the UI will apply together with the exclusion settings
configured in the \*.txt files.
-**Follow the steps to exclude data from file server monitoring scope:**
+****
**Step 1 –** Navigate to the "_%Netwrix Auditor installation folder%\File Server Auditing_" folder.
@@ -31,10 +31,10 @@ configured in the \*.txt files.
| File | Description | Syntax |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| omitcollectlist.txt | Contains a list of objects to be excluded from being monitored. | `Monitoring plan name,server name, resource path` Wildcards are not supported for the Server Name field. To disable filtering for this field, specify an empty string. For example: `*,,\\\\*\\System Volume Information*` |
+| omitcollectlist.txt | Contains a list of objects to be excluded from being monitored. | `Monitoring plan name,server name, resource path` Wildcards aren't supported for the Server Name field. To disable filtering for this field, specify an empty string. For example: `*,,\\\\*\\System Volume Information*` |
| omiterrors.txt | Contains a list of errors and warnings to be omitted from logging to the Netwrix Auditor System Health event log. | `Monitoring plan name,server name,error text` For example: `*,productionserver1.corp.local, *Access is denied*` |
-| omitreportlist.txt | Contains a list of objects to be excluded from _Search_, _Reports_ and "_Activity Summary_" emails. In this case audit data is still being collected. | `Monitoring plan name,action,who,object type,resource path,property name` Wildcards are not supported for the action and property name fields. To disable filtering for these fields, specify an empty string. For example: `*,,CORP\\jsmith,*,*,` |
-| omitstorelist.txt | Contains a list of objects to be excluded from being stored to the "_Audit Archive_" and showing up in _Search_ and all types of _Reports_. In this case audit data is still being collected. | `Monitoring plan name,action,who ,object type,resource path,property name` Wildcards are not supported for the Change Type and Property Name fields. To disable filtering for these fields, specify an empty string. For example: `*,,*,*,\\\\productionserver1.corp.local\\builds\\*, Attributes` |
+| omitreportlist.txt | Contains a list of objects to be excluded from _Search_, _Reports_, and "_Activity Summary_" emails. In this case audit data is still being collected. | `Monitoring plan name,action,who,object type,resource path,property name` Wildcards aren't supported for the action and property name fields. To disable filtering for these fields, specify an empty string. For example: `*,,CORP\\jsmith,*,*,` |
+| omitstorelist.txt | Contains a list of objects to be excluded from being stored to the "_Audit Archive_" and showing up in _Search_ and all types of _Reports_. In this case audit data is still being collected. | `Monitoring plan name,action,who ,object type,resource path,property name` Wildcards aren't supported for the Change Type and Property Name fields. To disable filtering for these fields, specify an empty string. For example: `*,,*,*,\\\\productionserver1.corp.local\\builds\\*, Attributes` |
| omitstoreprocesslist.txt | Contains a list of processes to be excluded from being stored to the "_Audit Archive_" and showing up in _Search_ and all types of _Reports_. | `Monitoring plan name,resource path, executable path` Only local applications can be excluded. For example: `*,*,*notepad.exe` |
## Windows File Share
@@ -44,7 +44,7 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| General | |
-| Specify Windows file share | Provide UNC path to a shared resource. See the section below for special considerations. Do not specify a default file share mapped to a local drive (e.g., \\Server\e$). |
+| Specify Windows file share | Provide UNC path to a shared resource. See the section below for special considerations. Don't specify a default file share mapped to a local drive (e.g., \\Server\e$). |
| Specify the account for collecting data | |
| Scope | |
| Specify monitoring restrictions | Refer to Configure Scope for detailed instructions on how to narrow your monitoring scope. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. |
@@ -60,18 +60,16 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
**Step 4 –** You can use a wildcard (\*) only if you need to exclude user activity on this file
-share. For other data types (_state-in-time_ or _all data_) wildcards are not supported. This refers
+share. For other data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers
to the specified shared folder, its subfolders and files.
**Step 5 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| **State-in-Time** | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
-
-**Follow the steps to exclude specific user activity.**
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **:::note** In this case,Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| **State-in-Time** | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **:::note** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
**Step 1 –** Specify what user accounts should be excluded:
@@ -83,7 +81,7 @@ to the specified shared folder, its subfolders and files.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_.
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_.
diff --git a/docs/auditor/10.7/admin/monitoringplans/fileservers/windowsfileserver.md b/docs/auditor/10.7/admin/monitoringplans/fileservers/windowsfileserver.md
index c7a466f5b3..f6550a4187 100644
--- a/docs/auditor/10.7/admin/monitoringplans/fileservers/windowsfileserver.md
+++ b/docs/auditor/10.7/admin/monitoringplans/fileservers/windowsfileserver.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Windows File Server
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**:::note** Before configuring your monitoring plan, read, and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
@@ -22,10 +22,10 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify Windows file share | Provide UNC path to a shared resource. See the section below for special considerations. Do not specify a default file share mapped to a local drive (e.g., \\Server\e$). |
+| Specify Windows file share | Provide UNC path to a shared resource. See the section below for special considerations. Don't specify a default file share mapped to a local drive (e.g., \\Server\e$). |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. Starting with version 10.7, you can implement the integration between Netwrix Auditor and Netwrix Privilege Secure. See the [Netwrix Privilege Secure](/docs/auditor/10.7/admin/settings/privilegesecure.md) topic for additional information. |
| Scope | |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. See the Configure Scope topic for additional information on how to narrow your monitoring scope. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. See the Configure Scope topic for additional information on how to narrow your monitoring scope. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
### Configure Scope
@@ -38,18 +38,16 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
**Step 2 –** You can use a wildcard (\*) only if you need to exclude user activity on this file
-share. For other data types (_state-in-time_ or _all data_) wildcards are not supported. This refers
+share. For other data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers
to the specified shared folder, its subfolders and files.
**Step 3 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
-
-**Follow the steps to exclude specific user activity.**
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **:::note** In this case,Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **:::note** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
**Step 1 –** Specify what user accounts should be excluded:
@@ -61,7 +59,7 @@ to the specified shared folder, its subfolders and files.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_.
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_.
@@ -101,11 +99,11 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify AD container | Specify a whole AD domain, OU or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you do not want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers does not include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
+| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. Starting with version 10.7, you can implement the integration between Netwrix Auditor and Netwrix Privilege Secure. See the [Netwrix Privilege Secure](/docs/auditor/10.7/admin/settings/privilegesecure.md) topic for additional information. Refer to the [Permissions for Active Directory Auditing](/docs/auditor/10.7/configuration/activedirectory/permissions.md) topic for more information on using Netwrix Privilege Secure as an account for data collection. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Containers and Computers | |
| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU or container. - Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) are not supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU, or container. - Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) aren't supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
## IP Range
@@ -122,7 +120,7 @@ Complete the following fields:
## Computer
For evaluation purposes, Netwrix recommends selecting Computer as an item for a monitoring plan.
-Once the product is configured to collect data from the specified items, audit settings (including
+After product is configured to collect data from the specified items, audit settings (including
Core and Compression services installation) will be applied to all computers within AD Container or
IP Range.
@@ -131,11 +129,11 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| General | |
-| Specify a computer | Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
+| Specify a computer | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select account type you want to use and enter credentials. The following choices are available: - User/password. The account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. - Group Managed Service Account (gMSA). You should specify only the account name in the domain\account$ format. See the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.7/requirements/gmsa.md) topic for additional information. - Netwrix Privilege Secure. Starting with version 10.7, you can implement the integration between Netwrix Auditor and Netwrix Privilege Secure. See the [Netwrix Privilege Secure](/docs/auditor/10.7/admin/settings/privilegesecure.md) topic for additional information. |
| Scope | |
| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. |
### Configure Scope
@@ -152,18 +150,16 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
You can use a wildcard (\*) only if you need to exclude user activity on this file share. For other
-data types (_state-in-time_ or _all data_) wildcards are not supported. This refers to the specified
+data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers to the specified
shared folder, its subfolders and files.
**Step 2 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. In this case,Netwrix Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| State-in-Time | Select to configure Netwrix Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Netwrix Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
-
-Follow the steps to exclude specific user activity.
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. In this case,Netwrix Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| State-in-Time | Select to configure Netwrix Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Netwrix Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
**Step 1 –** Specify what user accounts should be excluded:
@@ -175,7 +171,7 @@ Follow the steps to exclude specific user activity.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_
@@ -190,9 +186,8 @@ integration and supported data sources. In this case, the credentials will not b
Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring
password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
-**Step 1 –** Select the desired item.
+**Step 1 –** Select the item to audit.
**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
collection.
@@ -202,18 +197,18 @@ collection.
**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
Credential-based is the default option. Refer to the
[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+information about Access Policies.
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
-**NOTE:** Netwrix recommends using different credentials for different monitoring plans and data
+**:::note** Netwrix recommends using different credentials for different monitoring plans and data
sources.
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.7/admin/monitoringplans/finetune.md b/docs/auditor/10.7/admin/monitoringplans/finetune.md
index cc3a2f13e1..09ba4340e5 100644
--- a/docs/auditor/10.7/admin/monitoringplans/finetune.md
+++ b/docs/auditor/10.7/admin/monitoringplans/finetune.md
@@ -6,7 +6,7 @@ sidebar_position: 210
# Fine-Tune Your Plan and Edit Settings
-At any time, you can review your plan settings and fine-tune Audit Database, notification and data
+At any time, you can review your plan settings and fine-tune Audit Database, notification, and data
collection settings.
To modify most plan settings, you must be assigned the Global administrator role in the product or
@@ -14,7 +14,7 @@ the Configurator role on the plan. The Global reviewer or this plan's Reviewer c
Summary recipients. See the [Role-Based Access and Delegation](/docs/auditor/10.7/admin/monitoringplans/delegation.md) topic for additional
information.
-Follow the steps to edit your plan settings:
+ edit your plan settings:
**Step 1 –** Select a plan in the All Monitoring Plans list and click Edit.
@@ -27,11 +27,11 @@ Follow the steps to edit your plan settings:
| General | |
| Name Description | Update a plan name or its description. |
| Data Collection | |
-| Specify the account for collecting data - Not specified - User/Password - gMSA | Specify a new user name and a password for the account that Auditor will use to collect data. Make sure the account has sufficient permissions to collect data. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information about the rights and permissions, and instructions on how to configure them. |
+| Specify the account for collecting data - Not specified - User/Password - gMSA | Specify a new user name and a password for the account that Auditor will use to collect data. Ensure the account has sufficient permissions to collect data. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information about the rights and permissions, and instructions on how to configure them. |
| Audit Database | |
| Disable security intelligence and make data available only in activity summaries | Keep this checkbox cleared if you want Auditor to write data to the Audit Database. |
| Use default SQL Server settings | Select this checkbox to write data to a SQL Server instance with connection parameters as shown in **Settings** > **Audit Database**. See the [Audit Database](/docs/auditor/10.7/admin/settings/auditdatabase.md) topic for additional information. |
-| Specify custom connection parameters | Specify this option to use non-default settings (e.g., use a different authentication method or user). Make sure to store data on the same SQL Server instance. Otherwise some data may become unavailable for search and reporting. |
+| Specify custom connection parameters | Specify this option to use non-default settings (e.g., use a different authentication method or user). Ensure to store data on the same SQL Server instance. Otherwise some data may become unavailable for search and reporting. |
| Notifications | |
| Specify Activity Summary delivery schedule | Configure how often you want to receive an Activity Summary. By default, it is delivered once a day, at 3 AM. You can specify custom delivery time and frequency (e.g., every 6 hours starting 12 AM — at 12 AM, 6 AM, 12 PM, 6 PM). |
| Customize notifications | By default, Activity Summary lists changes and activity in email body. For most data sources, if an Activity Summaries contains more than 1,000 activity records, these records are sent as a CSV attachment, bigger attachments are compressed in ZIP files. - Attach Activity Summary as a CSV file — You can configure Auditor to always send emails with attachments instead of listing activity and changes in email body. - Compress attachment before sending — You can configure Auditor to always compress attachments in a ZIP file, irrespective of its size and number of activity records. |
diff --git a/docs/auditor/10.7/admin/monitoringplans/grouppolicy/overview.md b/docs/auditor/10.7/admin/monitoringplans/grouppolicy/overview.md
index b7ee4a2b3a..9750b35689 100644
--- a/docs/auditor/10.7/admin/monitoringplans/grouppolicy/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/grouppolicy/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 100
# Group Policy
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read, and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
@@ -25,8 +25,8 @@ Complete the following fields:
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
| Prerequisites | Netwrix Auditor will automatically look up additional system components and prompt you to install those that are missing. In case all required components have been already installed, this section will be omitted. See the [Other Components](/docs/auditor/10.7/requirements/software.md#other-components) topic for additional information. |
| Detect additional details | Specify additional information to include in reports and activity summaries. Select Group membershipif you want to include Group membership of the account under which the change was made. |
-| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
-| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. See the [Group Policy](/docs/auditor/10.7/configuration/grouppolicy/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
+| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting, and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
+| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [Group Policy](/docs/auditor/10.7/configuration/grouppolicy/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the **Data source** list. As a next step, click **Add item** to specify an
@@ -52,9 +52,9 @@ integration and supported data sources. In this case, the credentials will not b
Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring
password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
+ use Netwrix Privilege Secure as an account for data collection.
-**Step 1 –** Select the desired item.
+**Step 1 –** Select the item to audit.
**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
collection.
@@ -64,7 +64,7 @@ collection.
**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
Credential-based is the default option. Refer to the
[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+information about Access Policies.
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
@@ -75,7 +75,7 @@ sources.
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.7/admin/monitoringplans/grouppolicy/scope.md b/docs/auditor/10.7/admin/monitoringplans/grouppolicy/scope.md
index 599368ba01..e61a123bb5 100644
--- a/docs/auditor/10.7/admin/monitoringplans/grouppolicy/scope.md
+++ b/docs/auditor/10.7/admin/monitoringplans/grouppolicy/scope.md
@@ -10,7 +10,7 @@ You can fine-tune Netwrix Auditor by specifying data that you want to exclude fr
monitoring scope. To do it, edit the omitobjlist_gp.txt, omitproplist_gp.txt and omituserlist_gp.txt
files.
-Follow the steps to exclude data from the Group Policy monitoring scope:
+ exclude data from the Group Policy monitoring scope:
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Active Directory Auditing_
folder.
diff --git a/docs/auditor/10.7/admin/monitoringplans/logonactivity/overview.md b/docs/auditor/10.7/admin/monitoringplans/logonactivity/overview.md
index 2387412238..852953b350 100644
--- a/docs/auditor/10.7/admin/monitoringplans/logonactivity/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/logonactivity/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# Logon Activity
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read, and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
@@ -25,10 +25,10 @@ Complete the following fields:
| General | |
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
| Fine-tune logon activity monitoring | Specify interval for Netwrix Auditor to collect data on logon activity and add successful non-interactive logons to your auditing scope, if necessary. |
-| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
-| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. See the [Logon Activity](/docs/auditor/10.7/configuration/logonactivity/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
+| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting, and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
+| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [Logon Activity](/docs/auditor/10.7/configuration/logonactivity/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
| Users | |
-| Specify monitoring restrictions | Select the users to be excluded from search results, reports and Activity Summaries. To add users to the list, click Add. Then, provide the user name in the domain\user format. For example: _mydomain\user1_. Consider the following: - Use NetBIOS domain name format. - You can provide the "_System_" value to exclude events containing the “_System_” instead of an account name in the “_Who_” column. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Select the users to be excluded from search results, reports, and Activity Summaries. To add users to the list, click Add. Then, provide the user name in the domain\user format. For example: _mydomain\user1_. Consider the following: - Use NetBIOS domain name format. - You can provide the "_System_" value to exclude events containing the “_System_” instead of an account name in the “_Who_” column. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the **Data source** list. As a next step, click **Add item** to specify an
@@ -54,9 +54,9 @@ integration and supported data sources. In this case, the credentials will not b
Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring
password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
+ use Netwrix Privilege Secure as an account for data collection.
-**Step 1 –** Select the desired item.
+**Step 1 –** Select the item to audit.
**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
collection.
@@ -66,7 +66,7 @@ collection.
**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
Credential-based is the default option. Refer to the
[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+information about Access Policies.
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
@@ -77,7 +77,7 @@ sources.
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.7/admin/monitoringplans/logonactivity/scope.md b/docs/auditor/10.7/admin/monitoringplans/logonactivity/scope.md
index 24f06abb21..3d59b03d3a 100644
--- a/docs/auditor/10.7/admin/monitoringplans/logonactivity/scope.md
+++ b/docs/auditor/10.7/admin/monitoringplans/logonactivity/scope.md
@@ -9,7 +9,7 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Logon
Activity monitoring scope.
-Follow the steps to exclude data from the Logon Activity monitoring scope:
+ exclude data from the Logon Activity monitoring scope:
**Step 1 –** Navigate to the _%working folder%\\NLA\Settings_ folder and locate your monitoring plan
GUID.
diff --git a/docs/auditor/10.7/admin/monitoringplans/microsoftentraid/overview.md b/docs/auditor/10.7/admin/monitoringplans/microsoftentraid/overview.md
index 90e7ce0f2b..ac94882c1d 100644
--- a/docs/auditor/10.7/admin/monitoringplans/microsoftentraid/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/microsoftentraid/overview.md
@@ -6,8 +6,10 @@ sidebar_position: 60
# Microsoft Entra ID
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+:::note
+Before configuring your monitoring plan, read and complete the instructions in
the following topics:
+:::
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
collection and activity monitoring configure necessary protocols and ports for inbound and
@@ -54,7 +56,7 @@ This instruction shows how to collect audit data from the Microsoft 365 tenant.
If you plan to use modern authentication, see the
[Configuring Microsoft Entra ID App for Auditing Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md#configuring-microsoft-entra-id-app-for-auditing-microsoft-entra-id)
topic for additional information on how to prepare Microsoft Entra ID app with required permissions.
-Make sure you have the following at hand:
+Ensure you have the following at hand:
- Tenant name
- For modern authentication: Application (client) ID
@@ -64,16 +66,16 @@ Make sure you have the following at hand:
Types of data that can be collected by Netwrix Auditor from the Microsoft 365 tenant depend on the
authentication option you choose.
-Follow the steps to configure Office 365 tenant as a monitored item.
+## Configure Office 365 Tenant as a Monitored Item
-**Step 1 –** On the **General** page of the item properties, specify **Tenant name**:
+1. On the **General** page of the item properties, specify **Tenant name**:
- If you are going to use **Basic authentication**, you can proceed to the next step – **Tenant
name** will be filled in automatically after it.
-- **NOTE:** Basic authentication is no longer possible for Exchange Online. For the already existing
- tenants it is still possible to use basic authentication for SharePoint Online and Microsoft Entra
- ID monitoring.
+:::note
+Basic authentication is no longer possible for Exchange Online. For existing tenants, you can still use basic authentication for SharePoint Online and Microsoft Entra ID monitoring.
+:::
- If you are going to use **Modern authentication**, paste the obtained name. See the
[Using Modern Authentication with Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md)
@@ -81,10 +83,10 @@ Follow the steps to configure Office 365 tenant as a monitored item.
-If you are using a government tenant, please click the **Tenant Environment** tab and select the
-desired tenant environment.
+If you are using a government tenant, click the **Tenant Environment** tab and select the
+tenant environment you want to use.
-**Step 2 –** Select authentication method that will be used when accessing Office 365 services:
+2. Select the authentication method that will be used when accessing Office 365 services:
- Basic authentication:
@@ -92,7 +94,7 @@ desired tenant environment.
- Enter **User name** and **password**; use any of the following formats: _user@domain.com_ or
_user@domain.onmicrosoft.com_.
- The **Tenant name** field then will be filled in automatically.
- - Make sure this user account has sufficient access rights. See
+ - Ensure this user account has sufficient access rights. See
[Using Basic Authentication with Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/basicauth.md)
topic for additional information.
@@ -109,7 +111,7 @@ desired tenant environment.
[Using Modern Authentication with Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md)
for additional information.
-**Step 3 –** Click the **Add** button.
+3. Click the **Add** button.
@@ -132,30 +134,30 @@ integration and supported data sources. In this case, the credentials will not b
Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring
password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
+## Use Netwrix Privilege Secure as a Data Collecting Account
-**Step 1 –** Select the desired item.
+1. Select the monitoring plan item.
-**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
-collection.
+2. In the item configuration menu, select Netwrix Privilege Secure as an option for data collection.
-**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
-Credential-based is the default option. Refer to the
+3. Select the type of Access Policy you want to use in Netwrix Privilege Secure.
+Credential-based is the default option. See the
[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+documentation for details on Access Policies.
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
-**NOTE:** Netwrix recommends using different credentials for different monitoring plans and data
-sources.
+:::note
+Netwrix recommends using different credentials for different monitoring plans and data sources.
+:::
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.7/admin/monitoringplans/microsoftentraid/scope.md b/docs/auditor/10.7/admin/monitoringplans/microsoftentraid/scope.md
index d3c17bb8b8..289c303b0c 100644
--- a/docs/auditor/10.7/admin/monitoringplans/microsoftentraid/scope.md
+++ b/docs/auditor/10.7/admin/monitoringplans/microsoftentraid/scope.md
@@ -9,11 +9,11 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Microsoft
Entra ID (formerly Azure AD) monitoring scope or modify the way it will be displayed.
-Follow the steps to exclude data from the Microsoft Entra ID monitoring scope:
+## Exclude Data from the Microsoft Entra ID Monitoring Scope
-**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Azure AD Auditing_ folder.
+1. Navigate to the _%Netwrix Auditor installation folder%\Azure AD Auditing_ folder.
-**Step 2 –** Edit the \*.txt files, based on the following guidelines:
+2. Edit the \*.txt files based on the following guidelines:
- Each entry must be a separate line.
- A wildcard (\*) is supported. You can use \* for cmdlets and their parameters.
@@ -21,11 +21,11 @@ Follow the steps to exclude data from the Microsoft Entra ID monitoring scope:
| File | Description | Syntax |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
-| adomiteventuserlist.txt | Contains a list of users whose user names you want to exclude from Microsoft Entra ID search results, reports and Activity Summaries. The rest of change details (action, object type, etc.) will be reported, but the Who value will be "system". | user@tenant.com |
-| exomiteventuserlist.txt | Contains a list of Exchange whose user names you want to exclude from Microsoft Entra ID search results, reports and Activity Summaries. The rest of change details (action, object type, etc.) will be reported, but the Who value will be "system". This list omits changes made by users through Exchange admin center. | user@tenant.com |
+| adomiteventuserlist.txt | Contains a list of users whose user names you want to exclude from Microsoft Entra ID search results, reports, and Activity Summaries. The rest of change details (action, object type, etc.) will be reported, but the Who value will be "system". | user@tenant.com |
+| exomiteventuserlist.txt | Contains a list of Exchange whose user names you want to exclude from Microsoft Entra ID search results, reports, and Activity Summaries. The rest of change details (action, object type, etc.) will be reported, but the Who value will be "system". This list omits changes made by users through Exchange admin center. | user@tenant.com |
| maapioperationtypes.txt | Contains an overall list of object types that will be displayed in search results, reports, and Activity Summaries for each particular operation. By default, the list contains mapping for the most frequent operations (e.g., add user, update policy, remove member). The rest will be reported with Microsoft Entra ID object type. | operation = object type For example: add owner to group = Group |
-| omitproplist.txt | Contains a list of object classes and attributes to be excluded from Microsoft Entra ID search results, reports and Activity Summaries. | classname.attrname If there is no full stop, the entire line is considered a class name. |
-| omitUPNlist.txt | Specify the user principal name for objects you want to exclude from Microsoft Entra ID search results, licenses, reports and SITs. | user@tenant.com **NOTE:** Wildcard \* is supported and can replace any number of characters. |
+| omitproplist.txt | Contains a list of object classes and attributes to be excluded from Microsoft Entra ID search results, reports, and Activity Summaries. | classname.attrname If there is no full stop, the entire line is considered a class name. |
+| omitUPNlist.txt | Specify the user principal name for objects you want to exclude from Microsoft Entra ID search results, licenses, reports, and SITs. | user@tenant.com :::note Wildcard \* is supported and can replace any number of characters. ::: |
| omituserlist.txt | Contains a list of users you want to exclude from Microsoft Entra ID search results, Microsoft Entra ID Changes reports and Activity Summaries. | user@tenant.com |
| propnames.txt | Contains a list of human-readable names for object types and attributes to be displayed in search results, reports, and Activity Summaries. | object=friendlyname object.property=friendlyname For example: \*.PasswordChanged = Password Changed |
| proptypes.txt | Defines how values will be displayed in the Details columns in Microsoft Entra ID search results, reports, and Activity Summaries. | For example: \*.Role.DisplayName = MultiValued |
diff --git a/docs/auditor/10.7/admin/monitoringplans/msteams.md b/docs/auditor/10.7/admin/monitoringplans/msteams.md
index a1cd059141..f288cb4636 100644
--- a/docs/auditor/10.7/admin/monitoringplans/msteams.md
+++ b/docs/auditor/10.7/admin/monitoringplans/msteams.md
@@ -6,8 +6,10 @@ sidebar_position: 120
# MS Teams
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+:::note
+Before configuring your monitoring plan, read and complete the instructions in
the following topics:
+:::
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data collection
and activity monitoring configure necessary protocols and ports for inbound and outbound
@@ -25,7 +27,7 @@ This instruction shows how to collect audit data from the Microsoft 365 tenant.
If you plan to use modern authentication, see the
[Configuring Microsoft Entra ID App for Auditing Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md#configuring-microsoft-entra-id-app-for-auditing-microsoft-entra-id)
topic for additional information on how to prepare Microsoft Entra ID app with required permissions.
-Make sure you have the following at hand:
+Ensure you have the following at hand:
- Tenant name
- For modern authentication: Application (client) ID
@@ -35,16 +37,16 @@ Make sure you have the following at hand:
Types of data that can be collected by Netwrix Auditor from the Microsoft 365 tenant depend on the
authentication option you choose.
-Follow the steps to configure Office 365 tenant as a monitored item.
+## Configure Office 365 Tenant as a Monitored Item
-**Step 1 –** On the **General** page of the item properties, specify **Tenant name**:
+1. On the **General** page of the item properties, specify **Tenant name**:
- If you are going to use **Basic authentication**, you can proceed to the next step – **Tenant
name** will be filled in automatically after it.
-- **NOTE:** Basic authentication is no longer possible for Exchange Online. For the already existing
- tenants it is still possible to use basic authentication for SharePoint Online and Microsoft Entra
- ID monitoring.
+:::note
+Basic authentication is no longer possible for Exchange Online. For existing tenants, you can still use basic authentication for SharePoint Online and Microsoft Entra ID monitoring.
+:::
- If you are going to use **Modern authentication**, paste the obtained name. See the
[Using Modern Authentication with Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md)
@@ -52,10 +54,10 @@ Follow the steps to configure Office 365 tenant as a monitored item.
-If you are using a government tenant, please click the **Tenant Environment** tab and select the
-desired tenant environment.
+If you are using a government tenant, click the **Tenant Environment** tab and select the
+tenant environment you want to use.
-**Step 2 –** Select authentication method that will be used when accessing Office 365 services:
+2. Select the authentication method that will be used when accessing Office 365 services:
- Basic authentication:
@@ -63,7 +65,7 @@ desired tenant environment.
- Enter **User name** and **password**; use any of the following formats: _user@domain.com_ or
_user@domain.onmicrosoft.com_.
- The **Tenant name** field then will be filled in automatically.
- - Make sure this user account has sufficient access rights. See
+ - Ensure this user account has sufficient access rights. See
[Using Basic Authentication with Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/basicauth.md)
topic for additional information.
@@ -80,7 +82,7 @@ desired tenant environment.
[Using Modern Authentication with Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md)
for additional information.
-**Step 3 –** Click the **Add** button.
+3. Click the **Add** button.
@@ -88,7 +90,7 @@ You can use a single account to collect audit data for different Office 365 serv
Entra ID, Exchange Online, SharePoint Online); however, Netwrix recommends that you specify
individual credentials for each of them.
-**Step 4 –** Complete the following fields:
+4. Complete the following fields:
| Option | Description |
| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
diff --git a/docs/auditor/10.7/admin/monitoringplans/networkdevices.md b/docs/auditor/10.7/admin/monitoringplans/networkdevices.md
index 21d6d8438a..db6825cac3 100644
--- a/docs/auditor/10.7/admin/monitoringplans/networkdevices.md
+++ b/docs/auditor/10.7/admin/monitoringplans/networkdevices.md
@@ -6,8 +6,10 @@ sidebar_position: 130
# Network Devices
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+:::note
+Before configuring your monitoring plan, read and complete the instructions in
the following topics:
+:::
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data collection
and activity monitoring configure necessary protocols and ports for inbound and outbound
@@ -44,7 +46,7 @@ Complete the following fields:
| Option | Description |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify syslog host or network source | Select one of the following: - Host or network source name — Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. - IP Range — Specify an IP range for the audited computers. To exclude computers from within the specified range, click **Exclude**. Enter the IP subrange you want to exclude, and click **Add**. |
+| Specify syslog host or network source | Select one of the following: - Host or network source name — Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. - IP Range — Specify an IP range for the audited computers. To exclude computers from within the specified range, click **Exclude**. Enter the IP subrange you want to exclude, and click **Add**. |
| Specify port and protocol for incoming connections | Use **Port** and **Protocol** to provide the port required for incoming connections (default is **UDP port 514**). |
| Devices | |
| Configure monitoring rules for required network devices: - Cisco (ASA, IOS, FTD, Meraki) - Fortinet (FortiGate FortiOS) - Juniper (Junos OS) - Palo Alto (PAN-OS) - Sonic Wall (NS, SMA, WAF) - HPE (ArubaOS) - Pulse Secure | |
diff --git a/docs/auditor/10.7/admin/monitoringplans/oracle/overview.md b/docs/auditor/10.7/admin/monitoringplans/oracle/overview.md
index 545a46c94e..67de97f965 100644
--- a/docs/auditor/10.7/admin/monitoringplans/oracle/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/oracle/overview.md
@@ -6,8 +6,10 @@ sidebar_position: 140
# Oracle Database
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+:::note
+Before configuring your monitoring plan, read and complete the instructions in
the following topics:
+:::
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
collection and activity monitoring configure necessary protocols and ports for inbound and
@@ -43,7 +45,7 @@ Complete the following fields:
| Option | Description |
| ------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Connection type | Select how the product connects to Oracle Database: - Oracle Database instance – select if you want to connect to a database by instance name. - Oracle Wallet – select if you want to use Oracle Wallet – password-protected container used to store authentication and signing credentials, including private keys, certificates, and trusted certificates needed by SSL. |
-| Instance name | Provide connection details in the following format: _host:port/service_name._ Make sure audit settings are configured for your Oracle Database instance. |
+| Instance name | Provide connection details in the following format: _host:port/service_name._ ensure audit settings are configured for your Oracle Database instance. |
| Wallet alias | Provide the alias you set while creating wallet. For example, "_MyOracle_". Alias name in Netwrix Auditor should exactly match the alias in the `tnsnames.ora` file. [Configure Oracle Instant Client for HTTP Proxy Connections](/docs/auditor/10.7/configuration/oracle/wallet.md#configure-oracle-instant-client-for-http-proxy-connections) |
| Specify the account for collecting data For Oracle Database instance connection type only. | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
@@ -62,7 +64,7 @@ On a high level, data collection process for Oracle databases works as follows:
- Creates a monitoring plan in Netwrix Auditor, specifying the service account (prepared at
step 1) as a data collecting account in the Monitoring Plan wizard. Then s/he adds items to
the monitoring plan – these are Oracle Databases to collect data from.
- - Configures alerts related to Oracle data source. Current version does not include predefined
+ - Configures alerts related to Oracle data source. Current version doesn't include predefined
alerts for that data source, so follow the [Create Alerts](/docs/auditor/10.7/admin/alertsettings/create/create.md)
section to create and configure the necessary alerts.
diff --git a/docs/auditor/10.7/admin/monitoringplans/oracle/scope.md b/docs/auditor/10.7/admin/monitoringplans/oracle/scope.md
index ebf87a982b..91e65401be 100644
--- a/docs/auditor/10.7/admin/monitoringplans/oracle/scope.md
+++ b/docs/auditor/10.7/admin/monitoringplans/oracle/scope.md
@@ -9,15 +9,15 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying users that you want to exclude from the Oracle
Database monitoring scope.
-Follow the steps to exclude data from the Oracle Database monitoring scope:
+## Exclude Data from the Oracle Database Monitoring Scope
-**Step 1 –** In Auditor, navigate to your Oracle Database monitoring plan and click Edit.
+1. In Auditor, navigate to your Oracle Database monitoring plan and click Edit.
-**Step 2 –** In the right pane, select Edit data source.
+2. In the right pane, select Edit data source.
-**Step 3 –** Navigate to Users tab and click Add next to Exclude.
+3. Navigate to Users tab and click Add next to Exclude.
-**Step 4 –** In the Add User dialog, type name of the user you want to exclude and select its type
+4. In the Add User dialog, type name of the user you want to exclude and select its type
(OS user or Database user).
-**Step 5 –** Click Add to exclude selected user from being monitored.
+5. Click Add to exclude selected user from being monitored.
diff --git a/docs/auditor/10.7/admin/monitoringplans/overview.md b/docs/auditor/10.7/admin/monitoringplans/overview.md
index 38db21d371..ca4e8a9f3f 100644
--- a/docs/auditor/10.7/admin/monitoringplans/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/overview.md
@@ -6,8 +6,10 @@ sidebar_position: 30
# Monitoring Plans
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+:::note
+Before configuring your monitoring plan, read and complete the instructions in
the following topics:
+:::
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data collection
and activity monitoring configure necessary protocols and ports for inbound and outbound
@@ -23,32 +25,32 @@ monitoring plan.
A monitoring plan defines data collection, notification, and storage settings.
-To start collecting data, and add items to its scope.
+To start collecting data and add items to its scope.
-Follow the steps to collect data from your environment.
+## Collect Data from Your Environment
-**Step 1 –** Create a monitoring plan with the wizard. Select the data source when you start the
-monitoring plan wizard, and its initial settings are configured at the wizard steps. See the
+1. Create a monitoring plan with the wizard. Select the data source when you start the
+monitoring plan wizard and its initial settings are configured at the wizard steps. See the
[Create a New Monitoring Plan](/docs/auditor/10.7/admin/monitoringplans/create.md) topic for additional information.
-**Step 2 –** Fine-tune data source settings, if necessary: use the data source properties to modify
+2. Fine-tune data source settings, if necessary: use the data source properties to modify
data collection settings, customize the monitoring scope, and more.
-**Step 3 –** Add items to be monitored. An item is a specific object you want to audit, e.g., a
-VMware server or a SharePoint farm. As soon as the item is added, to the monitoring plan, Auditor
+3. Add items to be monitored. An item is a specific object you want to audit, for example, a
+VMware server or a SharePoint farm. As soon as the item is added to the monitoring plan, Auditor
starts collecting data from it. See the
[Add Items for Monitoring](datasources.md#add-items-for-monitoring) topic for additional
information.
-**Step 4 –** To view and modify your plans, in the main Auditor window click the Monitoring Plans
-tile, then expand the All Monitoring Plans tree.
+4. To view and modify your plans, in the main Auditor window click the **Monitoring Plans**
+tile, then expand the **All Monitoring Plans** tree.
| To.. | Do.. |
| --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| See how data collection goes on | Click on a plan name. You will see all data sources included in the plan and data collection status for each data source. |
+| See how data collection goes on | Click a plan name. You will see all data sources included in the plan and data collection status for each data source. |
| Start data collection manually | 1. Select a plan and click Edit. 2. In the monitoring plan window, click Update in the right pane. Data collection will be started (status for the data sources will be displayed as _Working_). Do the same if you need to generate Activity Summary with the latest changes. |
| View collected data | 1. Select a plan and click Edit. 2. In the right pane, go to the Intelligence section (in the bottom) and click Search. The search page will appear, displaying the collected data filtered out accordingly (i.e. provided by this monitoring plan). |
-| Modify plan settings, add or delete data sources, add or delete items | Select a plan and click Edit. On the page that opens, review your plan settings. Then follow the instructions described in these sections: - [Add Items for Monitoring](/docs/auditor/10.7/admin/monitoringplans/datasources.md) - [Fine-Tune Your Plan and Edit Settings](/docs/auditor/10.7/admin/monitoringplans/finetune.md) |
+| Modify plan settings, add or delete data sources, and add or delete items | Select a plan and click Edit. On the page that opens, review your plan settings. Then follow the instructions described in these sections: - [Add Items for Monitoring](/docs/auditor/10.7/admin/monitoringplans/datasources.md) - [Fine-Tune Your Plan and Edit Settings](/docs/auditor/10.7/admin/monitoringplans/finetune.md) |
| Assign roles | Click Delegate to review current delegations and assign roles. You can delegate control over a monitoring plan to another administrator, or grant read access—Reviewer role—to the data collected by this plan. To simplify delegation, you can further organize the monitoring plans into folders. See the [Role-Based Access and Delegation](/docs/auditor/10.7/admin/monitoringplans/delegation.md) topic for additional information. |
## Using historical data
@@ -65,18 +67,18 @@ the historical snapshots to the database.
To import snapshots, you must be assigned the _Global administrator_ or the _Global reviewer_ role.
-Follow the steps to import historical snapshots.
+## Import Historical Snapshots
-**Step 1 –** Select the monitoring plan you need.
+1. Select the monitoring plan you need.
-**Step 2 –** Select the required data source and click **Edit data source** on the right to open its
+2. Select the required data source and click **Edit data source** on the right to open its
properties.
-**Step 3 –** Click **General** on the left.
+3. Click **General** on the left.
-**Step 4 –** In the **Manage historical snapshots** section, click **Manage**.
+4. In the **Manage historical snapshots** section, click **Manage**.
-**Step 5 –** In the **Manage Snapshots** window, select the snapshots that you want to import — use
+5. In the **Manage Snapshots** window, select the snapshots that you want to import. Use
the arrows to move the selected snapshots to the **Snapshots available for reporting** list. When
finished, click **OK**.
diff --git a/docs/auditor/10.7/admin/monitoringplans/overview_1.md b/docs/auditor/10.7/admin/monitoringplans/overview_1.md
index 0518da3817..a34e3ad819 100644
--- a/docs/auditor/10.7/admin/monitoringplans/overview_1.md
+++ b/docs/auditor/10.7/admin/monitoringplans/overview_1.md
@@ -6,8 +6,10 @@ sidebar_position: 180
# User Activity
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+:::note
+Before configuring your monitoring plan, read and complete the instructions in
the following topics:
+:::
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
collection and activity monitoring configure necessary protocols and ports for inbound and
@@ -88,7 +90,7 @@ To exclude the Notepad application window with "_Document1_" open, add the follo
## Computer
For evaluation purposes, Netwrix recommends selecting Computer as an item for a monitoring plan.
-Once the product is configured to collect data from the specified items, audit settings (including
+After the product is configured to collect data from the specified items, audit settings (including
Core and Compression services installation) will be applied to all computers within AD Container or
IP Range.
@@ -97,7 +99,7 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify a computer | Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
+| Specify a computer | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select account type you want to use and enter credentials. The following choices are available: - User/password. The account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. - Group Managed Service Account (gMSA). You should specify only the account name in the domain\account$ format. See the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.7/requirements/gmsa.md) topic for additional information. |
## IP Range
@@ -117,5 +119,5 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify AD container | Specify a whole AD domain, OU or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you do not want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers does not include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
+| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
diff --git a/docs/auditor/10.7/admin/monitoringplans/sharepoint/overview.md b/docs/auditor/10.7/admin/monitoringplans/sharepoint/overview.md
index 8a1928b9bf..447b0bc265 100644
--- a/docs/auditor/10.7/admin/monitoringplans/sharepoint/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/sharepoint/overview.md
@@ -6,8 +6,10 @@ sidebar_position: 150
# SharePoint
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+:::note
+Before configuring your monitoring plan, read and complete the instructions in
the following topics:
+:::
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
collection and activity monitoring configure necessary protocols and ports for inbound and
@@ -24,20 +26,22 @@ Complete the following fields:
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
| Detect additional details | Specify additional information to include in reports and activity summaries. Select Group membershipif you want to include Group membership of the account under which the change was made. |
-| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. See the [SharePoint](/docs/auditor/10.7/configuration/sharepoint/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
-| Collect data for state-in-time reports | Configure Netwrix Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.7/admin/reports/types/stateintime/overview.md) topic for additional information. In the **Manage historical snapshots** section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must be assigned the **Global administrator** or the **Global reviewer** role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot on the regular basis to keep users up to date on actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor . If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. |
+| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [SharePoint](/docs/auditor/10.7/configuration/sharepoint/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
+| Collect data for state-in-time reports | Configure Netwrix Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.7/admin/reports/types/stateintime/overview.md) topic for additional information.
+::: In the **Manage historical snapshots** section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must be assigned the **Global administrator** or the **Global reviewer** role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot on the regular basis to keep users up to date on actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor . If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. |
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the **Data source** list. As a next step, click **Add item** to specify an
object for monitoring. See the
[Add Items for Monitoring](/docs/auditor/10.7/admin/monitoringplans/datasources.md#add-items-for-monitoring) topic for additional
information.
+:::
## Troubleshoot SharePoint Auditing
| Problem | Description | KB article |
| ------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The "Timeout Expired" error appears during the agent's deployment. | The agent failed to be deployed due to one of the following reasons: - One or several servers are unreachable - The SPAdminV4 service is not started on any of the servers. - The servers within the farm are located in different time zones. - Your SharePoint farm exceeds the recommended capacity limits. Increase DeployTimeout value in _%ProgramData%\Netwrix\NetwrixAuditor for SharePoint\ Configuration\ ``\ Commonsettings.config_ and restart the agent service. | Refer to the [Timeout Expired Error on SharePoint Core Service Deployment](/docs/kb/auditor/configuration-and-setup/sharepoint-and-teams-auditing/timeout-expired-error-on-sharepoint-core-service-deployment) Knowledge Base article for the solution. |
+| The "Timeout Expired" error appears during the agent's deployment. | The agent failed to be deployed due to one of the following reasons: - One or several servers are unreachable - The SPAdminV4 service isn't started on any of the servers. - The servers within the farm are located in different time zones. - Your SharePoint farm exceeds the recommended capacity limits. Increase DeployTimeout value in _%ProgramData%\Netwrix\NetwrixAuditor for SharePoint\ Configuration\ ``\ Commonsettings.config_ and restart the agent service. | Refer to the [Timeout Expired Error on SharePoint Core Service Deployment](/docs/kb/auditor/configuration-and-setup/sharepoint-and-teams-auditing/timeout-expired-error-on-sharepoint-core-service-deployment) Knowledge Base article for the solution. |
## SharePoint Farm
@@ -47,13 +51,19 @@ Complete the following fields:
| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
| Specify SharePoint farm for monitoring | Enter the SharePoint Central Administration website URL. |
-| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
+| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information.
+::: |
| Core Service | |
-| Deploy Netwrix Auditor for SharePoint Core Service | Select deployment method for the Core Service. Select one of the following: - Automatically—The installation will run under the account used to collect data on the SharePoint farm wizard completion. Prior to the Netwrix Auditor for SharePoint Core Service installation, review the following prerequisites and make sure that: - Netwrix Auditor for SharePoint Core Service is going to be installed on the computer that hosts SharePoint Central Administration in the audited SharePoint farm. - [.Net Framework 3.5 SP1](http://www.microsoft.com/en-us/download/details.aspx?id=22) is installed on the computer that hosts SharePoint Central Administration in the audited SharePoint farm. - The SharePoint Administration (SPAdminV4) service is started on the target computer. See [SharePoint](/docs/auditor/10.7/configuration/sharepoint/overview.md) for more information. - The user that is going to run the Core Service installation: - Is a member of the local Administrators group on SharePoint server, where the Core Service will be deployed. - Is granted the SharePoint_Shell_Access role on SharePoint SQL Server configuration database. See [Permissions for SharePoint Auditing](/docs/auditor/10.7/configuration/sharepoint/permissions.md) topic for more information. - Manually—See the [Netwrix Auditor Installation and Configuration Guide](https://www.netwrix.com/download/documents/Netwrix_Auditor_Installation_Configuration_Guide.pdf) for more information. During the Netwrix Auditor for SharePoint Core Service installation / uninstallation your SharePoint sites may be unavailable. |
+| Deploy Netwrix Auditor for SharePoint Core Service | Select deployment method for the Core Service. Select one of the following: - Automatically—The installation will run under the account used to collect data on the SharePoint farm wizard completion. Before the Netwrix Auditor for SharePoint Core Service installation, review the following prerequisites and ensure that: - Netwrix Auditor for SharePoint Core Service is going to be installed on the computer that hosts SharePoint Central Administration in the audited SharePoint farm. - [.Net Framework 3.5 SP1](http://www.microsoft.com/en-us/download/details.aspx?id=22) is installed on the computer that hosts SharePoint Central Administration in the audited SharePoint farm. - The SharePoint Administration (SPAdminV4) service is started on the target computer. See [SharePoint](/docs/auditor/10.7/configuration/sharepoint/overview.md) for more information.
+::: - The user that is going to run the Core Service installation: - Is a member of the local Administrators group on SharePoint server, where the Core Service will be deployed. - Is granted the SharePoint_Shell_Access role on SharePoint SQL Server configuration database. See [Permissions for SharePoint Auditing](/docs/auditor/10.7/configuration/sharepoint/permissions.md) topic for more information.
+::: - Manually—See the [Netwrix Auditor Installation and Configuration Guide](https://www.netwrix.com/download/documents/Netwrix_Auditor_Installation_Configuration_Guide.pdf) for more information.
+::: During the Netwrix Auditor for SharePoint Core Service installation / uninstallation your SharePoint sites may be unavailable. |
| Changes | |
| Audit SharePoint farm configuration changes | Configuration changes are always audited. |
-| Audit SharePoint permissions and content changes | Select change types to be audited with Netwrix Auditor. Netwrix Auditor allows auditing the entire SharePoint farm. Alternatively, you can limit the auditing scope to separate web applications and site collections. To do it, select Specific SharePoint objects and do one of the following: - Click Add, provide the URL to web application or site collection and select object type (Web application or Site collection). - Click Import, select object type (Web application or Site collection), encoding type, and browse for a file that contains a list of web applications and sites. Netwrix Auditor ignores changes to system data (e.g., hidden and system lists or items are not audited). Netwrix Auditor also ignores the content changes to sites and objects on the site collections located on Central Administration web application, but the security changes that occurred there are tracked and reported anyway. |
+| Audit SharePoint permissions and content changes | Select change types to be audited with Netwrix Auditor. Netwrix Auditor allows auditing the entire SharePoint farm. Alternatively, you can limit the auditing scope to separate web applications and site collections. To do it, select Specific SharePoint objects and do one of the following: - Click Add, provide the URL to web application or site collection and select object type (Web application or Site collection). - Click Import, select object type (Web application or Site collection), encoding type, and browse for a file that contains a list of web applications and sites. Netwrix Auditor ignores changes to system data (e.g., hidden and system lists or items aren't audited). Netwrix Auditor also ignores the content changes to sites and objects on the site collections located on Central Administration web application, but the security changes that occurred there are tracked and reported anyway. |
| Activity | |
-| Specify monitoring restrictions | Specify restriction filters to narrow your SharePoint monitoring scope (search results, reports and Activity Summaries). For example, you can exclude site collections document libraries and lists from being audited as they contain public non sensitive data. All filters are applied using AND logic. Click Add and complete the following fields: - User – provide the name of the user as shown in the "_Who_" column of reports and Activity Summaries. Example: _mydomain\user1_. - Object URL – provide URL of the objects as shown in the "_What_" column of reports and Activity Summaries. Example: _http://sitecollection/list/document.docx_. - Action Type – select what types of actions performed by selected users under the object you want to monitor. Available values: _All_, _Changes_, _Reads_. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your SharePoint monitoring scope (search results, reports, and Activity Summaries). For example, you can exclude site collections document libraries and lists from being audited as they contain public non sensitive data. All filters are applied using AND logic. Click Add and complete the following fields: - User – provide the name of the user as shown in the "_Who_" column of reports and Activity Summaries. Example: _mydomain\user1_. - Object URL – provide URL of the objects as shown in the "_What_" column of reports and Activity Summaries. Example: _http://sitecollection/list/document.docx_. - Action Type – select what types of actions performed by selected users under the object you want to monitor. Available values: _All_, _Changes_, _Reads_. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. :::note
+The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information.
+::: |
| Read Access | |
| Audit SharePoint read access | Configure Netwrix Auditor to track read access to lists and list items within your SharePoint farm except for Central Administration web sites. Select Sites only if you want to enable read access auditing on SharePoint sites only. Enable Sites and subsites to track read access on each subsite. Then, do one of the following: - Click Add and provide URL to a SharePoint site. - Click Import, select encoding type, and browse for a file that contains a list of sites. Read access auditing significantly increases the number of events generated on your SharePoint and the amount of data written to the AuditArchive. |
diff --git a/docs/auditor/10.7/admin/monitoringplans/sharepoint/scope.md b/docs/auditor/10.7/admin/monitoringplans/sharepoint/scope.md
index 870bfe7dad..ab8b5ab0ad 100644
--- a/docs/auditor/10.7/admin/monitoringplans/sharepoint/scope.md
+++ b/docs/auditor/10.7/admin/monitoringplans/sharepoint/scope.md
@@ -9,15 +9,15 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the SharePoint
monitoring scope.
-Follow the steps to exclude data from the SharePoint monitoring scope:
+## Exclude Data from the SharePoint Monitoring Scope
-**Step 1 –** Navigate to the _%working folder%\Netwrix Auditor for SharePoint\Configuration\GUID_
+1. Navigate to the _%working folder%\Netwrix Auditor for SharePoint\Configuration\GUID_
folder, where omit lists are located.
If you have several monitoring plans for monitoring SharePoint farms, configure omit lists for each
monitoring plan separately.
-**Step 2 –** Edit the \*.txt files, based on the following guidelines:
+2. Edit the \*.txt files based on the following guidelines:
- Each entry must be a separate line.
- A wildcard (\*) is supported. You can use \* for cmdlets and their parameters.
@@ -29,7 +29,7 @@ monitoring plan separately.
| omitscreadaccesslist.txt | Contains a list of site collections for which the product will not monitor read access attempts. | `http(s)://URL` Enter the root web site URLs. If you have alternate access mapping configured in your SharePoint farm, and one web application has different URLs for different zones, you can use any of these URLs to specify a child site collection. For example: `http://sharepointsrv:3333/` |
| omitscstorelist.txt | Contains a list of site collections to be excluded from audit data collection. | `http(s)://URL` Enter the root web site URLs. If you have alternate access mapping configured in your SharePoint farm, and one web application has different URLs for different zones, you can use any of these URLs to specify a child site collection. For example: `https://siteColl*` |
| omitsitscstorelist.txt | Lists site collections to exclude from being monitored and reported in state-in-time report. | `http(s)://URL` Enter root web site URLs. If you have alternate access mapping configured in your SharePoint farm, and one web application has different URLs for different zones, you can use any of these URLs to specify a child site collection. You can use a wildcard (\*) to replace any number of characters. Examples: `http://siteCollection1:3333/ `````` https://siteColl*` |
-| omitsitstorelist.txt | Contains SharePoint lists and list items that you want to exclude from being audited. | URI Reference URI Reference does not include site collection URL. For example, to exclude the list item with URL _http://sitecollection/list/document.docx_, specify only "_list/document.docx_" instead of full URL. Wildcard (\*) is supported to replace any number of characters. Examples: `*list/document.docx `````` */_catalogs/* `````` */_vti_inf.html `````` */Style Library* `````` */SitePages*` |
+| omitsitstorelist.txt | Contains SharePoint lists and list items that you want to exclude from being audited. | URI Reference URI Reference doesn't include site collection URL. For example, to exclude the list item with URL _http://sitecollection/list/document.docx_, specify only "_list/document.docx_" instead of full URL. Wildcard (\*) is supported to replace any number of characters. Examples: `*list/document.docx `````` */_catalogs/* `````` */_vti_inf.html `````` */Style Library* `````` */SitePages*` |
| omituserviewstorelist.txt | Contains a list of user or service accounts to be excluded from read access monitoring. | `Login name` For example: SHAREPOINT\System |
| omitviewstorelist.txt | Contains lists and list items to be excluded from being monitored for read access. | `URI Reference ` Only specify URI reference to a list or list item without `https:\\` part. For example: `*list/document.docx` |
| omitwastorelist.txt | Contains a list of web applications to be excluded from audit data collection. | `http(s)://URL` Enter the root web site URLs. If you have alternate access mapping configured in your SharePoint farm, and one web application has different URLs for different zones, you can use any of these URLs. For example: `http://webApplication1:3333/` |
diff --git a/docs/auditor/10.7/admin/monitoringplans/sharepointonline/overview.md b/docs/auditor/10.7/admin/monitoringplans/sharepointonline/overview.md
index 82c909b261..916034f8e4 100644
--- a/docs/auditor/10.7/admin/monitoringplans/sharepointonline/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/sharepointonline/overview.md
@@ -6,8 +6,10 @@ sidebar_position: 160
# SharePoint Online
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+:::note
+Before configuring your monitoring plan, read and complete the instructions in
the following topics:
+:::
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
collection and activity monitoring configure necessary protocols and ports for inbound and
@@ -25,7 +27,7 @@ This instruction shows how to collect audit data from the Microsoft 365 tenant.
If you plan to use modern authentication, see the
[Configuring Microsoft Entra ID App for Auditing Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md#configuring-microsoft-entra-id-app-for-auditing-microsoft-entra-id)
topic for additional information on how to prepare Microsoft Entra ID app with required permissions.
-Make sure you have the following at hand:
+Ensure you have the following at hand:
- Tenant name
- For modern authentication: Application (client) ID
@@ -35,16 +37,16 @@ Make sure you have the following at hand:
Types of data that can be collected by Netwrix Auditor from the Microsoft 365 tenant depend on the
authentication option you choose.
-Follow the steps to configure Office 365 tenant as a monitored item.
+## Configure Office 365 Tenant as a Monitored Item
**Step 1 –** On the **General** page of the item properties, specify **Tenant name**:
- If you are going to use **Basic authentication**, you can proceed to the next step – **Tenant
name** will be filled in automatically after it.
-- **NOTE:** Basic authentication is no longer possible for Exchange Online. For the already existing
- tenants it is still possible to use basic authentication for SharePoint Online and Microsoft Entra
- ID monitoring.
+:::note
+Basic authentication is no longer possible for Exchange Online. For already existing tenants, basic authentication is still possible for SharePoint Online and Microsoft Entra ID monitoring.
+:::
- If you are going to use **Modern authentication**, paste the obtained name. See the
[Using Modern Authentication with Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md)
@@ -52,7 +54,7 @@ Follow the steps to configure Office 365 tenant as a monitored item.
-If you are using a government tenant, please click the **Tenant Environment** tab and select the
+If you are using a government tenant, click the **Tenant Environment** tab and select the
desired tenant environment.
**Step 2 –** Select authentication method that will be used when accessing Office 365 services:
@@ -63,7 +65,7 @@ desired tenant environment.
- Enter **User name** and **password**; use any of the following formats: _user@domain.com_ or
_user@domain.onmicrosoft.com_.
- The **Tenant name** field then will be filled in automatically.
- - Make sure this user account has sufficient access rights. See
+ - Ensure this user account has sufficient access rights. See
[Using Basic Authentication with Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/basicauth.md)
topic for additional information.
diff --git a/docs/auditor/10.7/admin/monitoringplans/sharepointonline/scope.md b/docs/auditor/10.7/admin/monitoringplans/sharepointonline/scope.md
index a8287366c0..836b3ce774 100644
--- a/docs/auditor/10.7/admin/monitoringplans/sharepointonline/scope.md
+++ b/docs/auditor/10.7/admin/monitoringplans/sharepointonline/scope.md
@@ -9,15 +9,15 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the SharePoint
Online monitoring scope.
-Follow the steps to exclude data from the SharePoint monitoring scope:
+## Exclude Data from the SharePoint Online Monitoring Scope
-**Step 1 –** Navigate to the _%ProgramData%\Netwrix Auditor\Netwrix Auditor for SharePoint
+1. Navigate to the _%ProgramData%\Netwrix Auditor\Netwrix Auditor for SharePoint
Online\Configuration_ folder and locate your monitoring plan.
If you have several monitoring plans for monitoring SharePoint Online, configure omitlists for each
monitoring plan separately.
-**Step 2 –** Edit the \*.txt files, based on the following guidelines:
+2. Edit the \*.txt files based on the following guidelines:
- Each entry must be a separate line.
- A wildcard (\*) is supported. You can use \* for cmdlets and their parameters.
@@ -30,4 +30,4 @@ monitoring plan separately.
| omitreadstorelist.txt | Contains the SharePoint Online lists, documents, etc., to be excluded from being monitored for read access. | `https://URL` For example: `https://Corp.sharepoint.com/*` `*list/document.docx` |
| omituserreadstorelist.txt | Contains a list of user accounts to be excluded from read access monitoring. | Provide user name in the UPN format. For example: `account@example.*.com` |
| OmitSitScStoreList.txt | Contains a list of SharePoint Online site collections to be excluded from state-in-time data collection. | Enter root web site URLs. For example: `https://URL` |
-| OmitSitStoreList.txt | Contains SharePoint Online lists and list items to be excluded from state-in-time data collection. | Enter list or list item URI (Unique resource identifier, or endpoint) reference. Note that URI Reference does not include site collection URL. For example, to exclude a list item with the `https://sitecollection.sharepoint.com/list/document.docx`, URL, you should specify the corresponding endpoint (URI), i.e. `list/document.docx`. |
+| OmitSitStoreList.txt | Contains SharePoint Online lists and list items to be excluded from state-in-time data collection. | Enter list or list item URI (Unique resource identifier, or endpoint) reference. :::note URI Reference doesn't include site collection URL. For example, to exclude a list item with the `https://sitecollection.sharepoint.com/list/document.docx` URL, specify the corresponding endpoint (URI), i.e. `list/document.docx`. ::: |
diff --git a/docs/auditor/10.7/admin/monitoringplans/sqlserver/items.md b/docs/auditor/10.7/admin/monitoringplans/sqlserver/items.md
index 4ae7073e6d..41109ac3cf 100644
--- a/docs/auditor/10.7/admin/monitoringplans/sqlserver/items.md
+++ b/docs/auditor/10.7/admin/monitoringplans/sqlserver/items.md
@@ -14,7 +14,7 @@ Perform the following steps to add an item to the SQL Server monitoring plan.
**Step 3 –** Click **Add Item**.
-**Step 4 –** Select one of the items from the drop-down list:
+**Step 4 –** Select one of the items from the dropdown list:
- SQL Server Instance
- SQL Server Availability Group
@@ -32,8 +32,7 @@ Complete the following fields:
| Specify SQL Server instance | Specify the name of the SQL Server instance. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
-Use a combination of server role, environment, instance name (including "DEFAULT" for default
-instances), and a unique identifier.
+Use a combination of server role, environment, instance name (including "DEFAULT" for default instances), and a unique identifier.
Example:
@@ -41,9 +40,11 @@ Example:
- Development named instance: DEV-SQL-01\DEVINSTANCE
- Test named instance on a specific port: TEST-SQL-01\TESTINSTANCE:1440
-**NOTE:** When dealing with SQL Server instances, Always On Availability Group (AG) instances, and a
+:::note
+When dealing with SQL Server instances, Always On Availability Group (AG) instances, and a
mix of default and non-default instances along with specified ports, it's important to craft names
that provide clear identification.
+:::
## SQL Server Availability Group
@@ -51,7 +52,7 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Availability group listener | Provide a name of an availability group listener in FQDN or NetBIOS format. The listener is a virtual network name (VNN) that you can connect to in order to access a database in a primary or secondary replica of an Always On availability group. A listener allows you to connect to a replica without having to know the physical instance name of the SQL Server. Ensure that the requirements to the DNS name and Windows permissions requirements are met. See [Configure a listener for an Always On availability group](https://docs.microsoft.com/en-us/sql/database-engine/availability-groups/windows/create-or-configure-an-availability-group-listener-sql-server?view=sql-server-ver15) for additional information. |
+| Availability group listener | Provide a name of an availability group listener in FQDN or NetBIOS format. The listener is a virtual network name (VNN) that you can connect to access a database in a primary or secondary replica of an Always On availability group. A listener lets you connect to a replica without having to know the physical instance name of the SQL Server. Ensure that the requirements to the DNS name and Windows permissions requirements are met. See [Configure a listener for an Always On availability group](https://docs.microsoft.com/en-us/sql/database-engine/availability-groups/windows/create-or-configure-an-availability-group-listener-sql-server?view=sql-server-ver15) for additional information. |
| Availability group name | Enter a name of your SQL Server availability group. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
diff --git a/docs/auditor/10.7/admin/monitoringplans/sqlserver/overview.md b/docs/auditor/10.7/admin/monitoringplans/sqlserver/overview.md
index 3869601495..60646d287a 100644
--- a/docs/auditor/10.7/admin/monitoringplans/sqlserver/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/sqlserver/overview.md
@@ -6,8 +6,10 @@ sidebar_position: 170
# SQL Server
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+:::note
+Before configuring your monitoring plan, read and complete the instructions in
the following topics:
+:::
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
collection and activity monitoring configure necessary protocols and ports for inbound and
@@ -41,7 +43,7 @@ On the **General** tab, you can configure the following settings for SQL Server
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
| Monitor SQL Server configuration changes | Always enabled, as SQL Server configuration changes are always monitored. |
| Monitor SQL Server logon activity | Specify what types of logon events you want to monitor: successful or failed, performed through Windows and SQL authentication. - Failed logons - Successfullogons |
-| Collect data for state-in-time reports | Configure Netwrix Auditor to store the snapshots of your SQL Server instance configuration — you will require them for state-in-time reports generation. See [State–In–Time Reports](/docs/auditor/10.7/admin/reports/types/stateintime/overview.md) for more information. **CAUTION:** The State-in-Time functionality is not available for SQL Server Availability Groups. The product updates the latest snapshot on the regular basis to keep users up-to-date on actual system state. Only the latest snapshot is available for reporting in Netwrix Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. To import snapshots, you must be assigned the Global administrator or the Global reviewer role in Netwrix Auditor. 1. In the Manage historical snapshots section, click **Manage** and select the snapshots that you want to import. 2. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. 3. When finished, click **OK**. See also [Using historical data](/docs/auditor/10.7/admin/monitoringplans/overview.md#using-historical-data). |
+| Collect data for state-in-time reports | Configure Netwrix Auditor to store the snapshots of your SQL Server instance configuration — you will require them for state-in-time reports generation. See [State–In–Time Reports](/docs/auditor/10.7/admin/reports/types/stateintime/overview.md) for more information. **CAUTION:** The State-in-Time functionality isn't available for SQL Server Availability Groups. The product updates the latest snapshot on the regular basis to keep users up-to-date on actual system state. Only the latest snapshot is available for reporting in Netwrix Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. To import snapshots, you must be assigned the Global administrator or the Global reviewer role in Netwrix Auditor. 1. In the Manage historical snapshots section, click **Manage** and select the snapshots that you want to import. 2. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. 3. When finished, click **OK**. See also [Using historical data](/docs/auditor/10.7/admin/monitoringplans/overview.md#using-historical-data). |
## Users
@@ -51,25 +53,25 @@ On the **Users** tab, you can configure the following settings for SQL Server da
| Options | Description |
| ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Specify users to track their activity | Select the option you need to fine-tune your SQL Server monitoring scope. - **Monitor all users** - **Include only users matching these criteria** - **Exclude users matching these criteria** For example, you may need to track only actions performed by administrative accounts, or exclude the activity initiated by ordinary applications. If so, data should be filtered accordingly before it appears in search results, reports and Activity Summaries. You can create either inclusion or exclusion lists. All filters are applied using AND logic. To create a filter for user activity monitoring, select the related option and click the button on the right. Specify the following: - User — enter the initiator's account as it appears in the "_Who_" column of reports and Activity Summaries, for example: _mydomain\user1_. For events containing “_System_” in the “_Who_” column you can enter "_System_" . - Workstation where activity was initiated — enter the workstation name as it is shown in the "_Workstation_" column of reports and Activity Summaries, for example: _StationWin2016_. - Application that initiated the activity — enter the application name as shown next to "_Application name_" in details of reports and Activity Summaries. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify users to track their activity | Select the option you need to fine-tune your SQL Server monitoring scope. - **Monitor all users** - **Include only users matching these criteria** - **Exclude users matching these criteria** For example, you may need to track only actions performed by administrative accounts, or exclude the activity initiated by ordinary applications. If so, data should be filtered accordingly before it appears in search results, reports, and Activity Summaries. You can create either inclusion or exclusion lists. All filters are applied using AND logic. To create a filter for user activity monitoring, select the related option and click the button on the right. Specify the following: - User — enter the initiator's account as it appears in the "_Who_" column of reports and Activity Summaries, for example: _mydomain\user1_. For events containing “_System_” in the “_Who_” column you can enter "_System_" . - Workstation where activity was initiated — enter the workstation name as it is shown in the "_Workstation_" column of reports and Activity Summaries, for example: _StationWin2016_. - Application that initiated the activity — enter the application name as shown next to "_Application name_" in details of reports and Activity Summaries. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
## Data
On the **Data** tab, you can configure the following settings for SQL Server data source.
_Remember,_ when auditing SQL Server availability on groups, the only supported data collection mode
-is the 'Do not use triggers' mode.
+is the 'Don't use triggers' mode.
| Option | Description |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| --- | --- |
| --- | --- |
-| Monitor changes to data in the database tables | Enable monitoring of changes to data stored in the database tables hosted on the SQL Server. If you plan to enable this option, make sure the account that runs the _SQL Server service_ on the monitored instance has at least _read_ permissions in the Active Directory domain (e.g., it does not run under a local user account). Otherwise, enabling this option may lead to issues when altering databases on the monitored SQL Server instances. |
+| Monitor changes to data in the database tables | Enable monitoring of changes to data stored in the database tables hosted on the SQL Server. If you plan to enable this option, ensure the account that runs the _SQL Server service_ on the monitored instance has at least _read_ permissions in the Active Directory domain (e.g., it doesn't run under a local user account). Otherwise, enabling this option may lead to issues when altering databases on the monitored SQL Server instances. |
| **Data collection mode** | |
-| Do not use triggers | Default mode for a new installation of Netwrix Auditor. Data will be collected using the SQL Server traces. This mode allows you to get a sufficient level of detail in the reports and search results without producing additional load on your SQL Server instance. Thus, it is recommended for highly-transactional servers. When using this mode, consider that the "_What_" field of the Activity Record with "_Object type_" = "_Data_" may show incorrect data. The issues occur because the product applies data categories to an entire SQL Server table and not to rows. |
-| Use triggers for detailed monitoring | However, if you require a very detailed reporting on the data changes, you can select this mode. It will be also selected by default if you are upgrading your Netwrix Auditor deployment. Data will be collected using a set of triggers. For more information on this technology, see [https://kb.netwrix.com/728](https://kb.netwrix.com/728) . It is recommended to use this setting carefully, as collecting large amount of details from a highly-transactional server may affect its performance. Using this mode may lead to issues when altering databases on the monitored SQL Server instances. The issues occur only if the SQL Server service account does not have _Read_ permissions in the Active Directory domain (e.g., a local user account). When using this mode, consider that the "_What_" field of the Activity Record with "_Object type_" = "_Data_" may show incorrect data. The issues occur because the product applies data categories to an entire SQL Server table and not to rows. Switching from the configured triggerless mode may lead to a data loss. The workaround is to force data collection right after enabling the triggers. |
+| Don't use triggers | Default mode for a new installation of Netwrix Auditor. Data will be collected using the SQL Server traces. This mode lets you get a sufficient level of detail in the reports and search results without producing additional load on your SQL Server instance. Thus, it is recommended for highly-transactional servers. When using this mode, consider that the "_What_" field of the Activity Record with "_Object type_" = "_Data_" may show incorrect data. The issues occur because the product applies data categories to an entire SQL Server table and not to rows. |
+| Use triggers for detailed monitoring | However, if you require a very detailed reporting on the data changes, you can select this mode. It will be also selected by default if you are upgrading your Netwrix Auditor deployment. Data will be collected using a set of triggers. For more information on this technology, see [https://kb.netwrix.com/728](https://kb.netwrix.com/728) . It is recommended to use this setting carefully, as collecting large amount of details from a highly-transactional server may affect its performance. Using this mode may lead to issues when altering databases on the monitored SQL Server instances. The issues occur only if the SQL Server service account doesn't have _Read_ permissions in the Active Directory domain (e.g., a local user account). When using this mode, consider that the "_What_" field of the Activity Record with "_Object type_" = "_Data_" may show incorrect data. The issues occur because the product applies data categories to an entire SQL Server table and not to rows. Switching from the configured triggerless mode may lead to a data loss. The workaround is to force data collection right after enabling the triggers. |
| Changes (per transaction) to collect and report: | Specify how many changes per a database transaction you want to be collected. For example, you can limit this number to 10 changes per transaction, or collect all changes. It is recommended to adjust this setting carefully, as collecting large number of changes from a highly-transactional server may affect its performance. |
-| Monitoring rules | To specify what data changes must be monitored, create at least one **inclusion rule**. Exclusion rules are optional. Click **Add Rule** and configure the following:  - Type — Select rule type: include or exclude. - Server — Specify a name of the monitored SQL Server instance where the required database resides. Use the _server_name\instance_name_ format, for example, _SQLsrv11\SQLExpress2016_. **NOTE:** If you are going to configure monitoring rules for SQL Server Availability Groups, provide the name of your Availability Group item in this field. - Database — Specify the database whose data changes you want to monitor. - Table — Specify database table to monitor. - Column—Specify table column name. The following column types are currently not supported: `text, ntext, image, binary, varbinary, timestamp, sql_variant`. These filters will be applied using AND logic. Wildcard (\*) is supported and can be used to replace any number of characters. |
+| Monitoring rules | To specify what data changes must be monitored, create at least one **inclusion rule**. Exclusion rules are optional. Click **Add Rule** and configure the following:  - Type — Select rule type: include or exclude. - Server — Specify a name of the monitored SQL Server instance where the required database resides. Use the _server_name\instance_name_ format, for example, _SQLsrv11\SQLExpress2016_. **NOTE:** If you are going to configure monitoring rules for SQL Server Availability Groups, provide the name of your Availability Group item in this field. - Database — Specify the database whose data changes you want to monitor. - Table — Specify database table to monitor. - Column—Specify table column name. The following column types aren't supported: `text, ntext, image, binary, varbinary, timestamp, sql_variant`. These filters will be applied using AND logic. Wildcard (\*) is supported and lets you replace any number of characters. |
## Audit SELECT
@@ -83,4 +85,4 @@ audited.
| --- | --- |
| --- | --- |
| Audit successful SELECT statements | Enable monitoring of successful SELECT statements for the database tables. Successful SELECT statement execution will be reported as Read operation on the database table. Auditing SELECT statements will increase the amount of data collected from the SQL Server instance and stored to long-term archive and audit database. Plan for your resources accordingly. |
-| Monitoring rules | To specify what data changes will be monitored, you must create at least one **inclusion rule**. Exclusion rules are optional. Click **Add Inclusion** and specify the following:  - Server — specify target SQL Server instance in the server\instance format. **NOTE:** If you are going to configure monitoring rules for SQL Server Availability Groups, provide the name of your Availability Group item in this field. - Database — specify target database - Schema — specify database schema - Table — specify database table you will monitor Wildcard (\*) is supported and can be used to replace any number of characters. Filters will be applied using AND logic, that is, only SELECT statements matching all specified criteria will be monitored. So, in the example above, the program will track and report only the successful SELECT statements executed against the _Applicants_ table of the _HR2019_ database with _Custom_ schema, hosted on the _SQLsrv02\TestInstance_. When finished, click **Add**. If needed, configure the exclusion rules in a similar way. |
+| Monitoring rules | To specify what data changes will be monitored, you must create at least one **inclusion rule**. Exclusion rules are optional. Click **Add Inclusion** and specify the following:  - Server — specify target SQL Server instance in the server\instance format. **NOTE:** If you are going to configure monitoring rules for SQL Server Availability Groups, provide the name of your Availability Group item in this field. - Database — specify target database - Schema — specify database schema - Table — specify database table you will monitor Wildcard (\*) is supported and lets you replace any number of characters. Filters will be applied using AND logic, that is, only SELECT statements matching all specified criteria will be monitored. So, in the example above, the program will track and report only the successful SELECT statements executed against the _Applicants_ table of the _HR2019_ database with _Custom_ schema, hosted on the _SQLsrv02\TestInstance_. When finished, click **Add**. If needed, configure the exclusion rules in a similar way. |
diff --git a/docs/auditor/10.7/admin/monitoringplans/sqlserver/scope.md b/docs/auditor/10.7/admin/monitoringplans/sqlserver/scope.md
index 5452b99009..cbe64aa553 100644
--- a/docs/auditor/10.7/admin/monitoringplans/sqlserver/scope.md
+++ b/docs/auditor/10.7/admin/monitoringplans/sqlserver/scope.md
@@ -9,11 +9,11 @@ sidebar_position: 20
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the SQL Server
monitoring scope.
-Follow the steps to exclude data from the SQL Server monitoring scope.
+## Exclude Data from the SQL Server Monitoring Scope
-**Step 1 –** Navigate to the _%Netwrix Auditor install folder%\SQL Server Auditing_ folder.
+1. Navigate to the _%Netwrix Auditor install folder%\SQL Server Auditing_ folder.
-**Step 2 –** Edit the \*.txt files, based on the following guidelines:
+2. Edit the \*.txt files based on the following guidelines:
- Each entry must be a separate line.
- A wildcard (\*) is supported. You can use \* for cmdlets and their parameters.
@@ -21,12 +21,12 @@ Follow the steps to exclude data from the SQL Server monitoring scope.
| File | Description | Syntax |
| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| omitarlist.txt | Lists activity records to exclude from showing up in reports, search, and activity summaries. This omit list does not affect triggerless data collection mode, SELECT statements auditing and SQL logons monitoring. Use the _omitlogonlist.txt_ to exclude SQL logons from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | Specify the following fields of the activity records to exclude: `Monitoring plan name, `````` SQL Server instance,object type, `````` account,workstation,application name` Wildcard (\*) is supported and can replace any number of characters. For the account, workstation, application name fields, you can specify a mixed expression that contains both a value and a wildcard (e.g., Admin\*). For example: `SQLPlan,Ent-SQL,Table,guest,WksSQL,MyInternalApp` |
+| omitarlist.txt | Lists activity records to exclude from showing up in reports, search, and activity summaries. This omit list doesn't affect triggerless data collection mode, SELECT statements auditing and SQL logons monitoring. Use the _omitlogonlist.txt_ to exclude SQL logons from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | Specify the following fields of the activity records to exclude: `Monitoring plan name, `````` SQL Server instance,object type, `````` account,workstation,application name` Wildcard (\*) is supported and can replace any number of characters. For the account, workstation, application name fields, you can specify a mixed expression that contains both a value and a wildcard (e.g., Admin\*). For example: `SQLPlan,Ent-SQL,Table,guest,WksSQL,MyInternalApp` |
| omiterrorlist.txt | Contains a list of errors and warnings to be excluded from logging to the Netwrix Auditor System Health event log. | Monitoring plan name,item name,error text Wildcard (\*) is supported and can replace any number of characters. For example: \*,sqlserver1.corp.local, \*Access is denied\* |
| omitlogonlist.txt | Contains a list of logons to exclude from monitoring. | `monitoring plan name,SQL Server instance,logon type,account,workstation,application name` For the `account`, `workstation`, `application name` fields, you can specify a mixed expression that contains both a value and a wildcard (e.g., `Admin*`). The following logon types are supported: - `NtLogon `— Successful logon attempt made through Windows authentication. - `SqlLogon `— Successful logon attempt made through SQL Server authentication. - `NtFailedLogon `— Failed logon attempt made through Windows authentication. - `SqlFailedLogon `— Failed logon attempt made through SQL Server authentication. For example: `DB_M0,Ent-SQL,SQLFailedLogon,guest,WksSQL,MyInternalApp` |
-| omitobjlist.txt | Contains a list of object to exclude from showing up in reports, search results and activity summaries. Audit data, however, will still be collected and saved to Long-Term Archive. This omit list does not affect SELECT statements auditing, data changes auditing and logon activity auditing. Use the _omitlogonlist.txt_ to exclude logon activity from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | `object_type_name` Available object types can be found in the "Object type" column in reports. For example: `Database` `Column` |
-| omitpathlist.txt | Specify the resource paths to objects that you want to exclude from showing up in search, reports and activity summaries. Audit data, however, will still be collected and saved to Long-Term Archive. This omit list does not affect triggerless data collection mode, SELECT statements auditing and logon activity auditing. Use the _omitlogonlist.txt_ to exclude logon activity from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | `server_instance:resource_path` where: - `server_instance` — SQL Server instance, use \* for all servers - `resource_path` — resource path as shown in the "**What**" column of SQL Server report, or in search results Wildcard \* is supported and can replace any part of the path. For example, to exclude information about databases whose names start with "tmp" on the SQL Server instance "PROD.SQL2012": `PROD.SQL2012:Databases\tmp*`. |
-| omitproplist.txt | Contains a list of attributes to be excluded from being monitored and stored to the Audit Archive. | `object_type_name.property_name.attribute_name` where: - `object_type_name`—Can be found in the found in the Object Type column in change reports. - `property_name`—Can be found in the Details column (property name is bold). - `attribute_name`—Can be found in the Details column (attribute name is not bold). If an object does not have an attribute name, use the \* character. For example to exclude information about the Size attribute of the Database File property in all databases: `Database.Database File.Size`. |
-| omitstorelist.txt | Contains a list of SQL Server objects that you want to exclude from data collection and reporting. This list is only relevant to operations with SQL Server objects; it does not affect triggerless data collection mode, SELECT statements auditing and logon activity auditing. To configure exclusions for logon activity auditing (Windows or SQL logons), use the _omitlogonlist.txt_. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | `server_instance:resource_path` where: - `server_instance` — SQL Server instance. For all instances, use wildcard (\*). - ` resource_path` — path as shown in the "**What**" column of SQL Server report, or in search results. Wildcard (\*) can be used to replace any number of characters. For example, to exclude information about server roles on the SQL Server instances whose names start with _njsqlsrv23_, enter: `njsqlsrv23*:Security\Server Roles\*` |
-| omittracelist.txt | If you do not want the product to enable SQL tracing on some of your SQL Server instances, specify their names in this omitlist. In this case the "Who", "Workstation" and "When" values will not be reported correctly (except for content changes). This omit list does not affect triggerless data collection mode, SELECT statements auditing and logon activity auditing. Use the _omitlogonlist.txt_ to exclude logon activity from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | Enter the name of SQL Server instance, use \* for all servers: `server\instance name` Wildcard (\*) is supported and can replace any number of characters, e.g., MYSERVER_SQL\* Examples: \* \*\SQLExpress MYSERVER\\\* |
+| omitobjlist.txt | Contains a list of object to exclude from showing up in reports, search results and activity summaries. Audit data, however, will still be collected and saved to Long-Term Archive. This omit list doesn't affect SELECT statements auditing, data changes auditing and logon activity auditing. Use the _omitlogonlist.txt_ to exclude logon activity from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | `object_type_name` Available object types can be found in the "Object type" column in reports. For example: `Database` `Column` |
+| omitpathlist.txt | Specify the resource paths to objects that you want to exclude from showing up in search, reports and activity summaries. Audit data, however, will still be collected and saved to Long-Term Archive. This omit list doesn't affect triggerless data collection mode, SELECT statements auditing and logon activity auditing. Use the _omitlogonlist.txt_ to exclude logon activity from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | `server_instance:resource_path` where: - `server_instance` — SQL Server instance, use \* for all servers - `resource_path` — resource path as shown in the "**What**" column of SQL Server report, or in search results Wildcard \* is supported and can replace any part of the path. For example, to exclude information about databases whose names start with "tmp" on the SQL Server instance "PROD.SQL2012": `PROD.SQL2012:Databases\tmp*`. |
+| omitproplist.txt | Contains a list of attributes to be excluded from being monitored and stored to the Audit Archive. | `object_type_name.property_name.attribute_name` where: - `object_type_name`—Can be found in the found in the Object Type column in change reports. - `property_name`—Can be found in the Details column (property name is bold). - `attribute_name`—Can be found in the Details column (attribute name isn't bold). If an object doesn't have an attribute name, use the \* character. For example to exclude information about the Size attribute of the Database File property in all databases: `Database.Database File.Size`. |
+| omitstorelist.txt | Contains a list of SQL Server objects that you want to exclude from data collection and reporting. This list is only relevant to operations with SQL Server objects; it doesn't affect triggerless data collection mode, SELECT statements auditing and logon activity auditing. To configure exclusions for logon activity auditing (Windows or SQL logons), use the _omitlogonlist.txt_. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | `server_instance:resource_path` where: - `server_instance` — SQL Server instance. For all instances, use wildcard (\*). - ` resource_path` — path as shown in the "**What**" column of SQL Server report, or in search results. Wildcard (\*) can be used to replace any number of characters. For example, to exclude information about server roles on the SQL Server instances whose names start with _njsqlsrv23_, enter: `njsqlsrv23*:Security\Server Roles\*` |
+| omittracelist.txt | If you don't want the product to enable SQL tracing on some of your SQL Server instances, specify their names in this omitlist. In this case the "Who", "Workstation" and "When" values will not be reported correctly (except for content changes). This omit list doesn't affect triggerless data collection mode, SELECT statements auditing and logon activity auditing. Use the _omitlogonlist.txt_ to exclude logon activity from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | Enter the name of SQL Server instance, use \* for all servers: `server\instance name` Wildcard (\*) is supported and can replace any number of characters, e.g., MYSERVER_SQL\* Examples: \* \*\SQLExpress MYSERVER\\\* |
| propnames.txt | Contains a list of human-readable names for object types and properties to be displayed in the change reports. | `object_type_name.property_name=friendlyname` For example: `*.Date modified=Modification Time` |
diff --git a/docs/auditor/10.7/admin/monitoringplans/vmware/overview.md b/docs/auditor/10.7/admin/monitoringplans/vmware/overview.md
index 8060d4ec32..73e0e7be9d 100644
--- a/docs/auditor/10.7/admin/monitoringplans/vmware/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/vmware/overview.md
@@ -6,8 +6,10 @@ sidebar_position: 190
# VMware
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+:::note
+Before configuring your monitoring plan, read and complete the instructions in
the following topics:
+:::
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
collection and activity monitoring configure necessary protocols and ports for inbound and
@@ -26,7 +28,7 @@ For this data source, specify the options you need:
| Monitor VMware configuration changes | Configuration changes are always monitored for VMware data source. See the Data Collection from VMware Servers topic for additional information. |
| Monitor VMware logon activity | Specify what types of logon events you want to monitor for VMware infrastructure. |
| Monitor SSO users/groups on vCenter and Local users on ESXi sever | Select Enable monitoring if you want to audit the following users and groups: - vCenter Single Sign-On (SSO) Users. The product collects data from vCenter. - Localos users. For these users, the product collects data from ESXi and vCenter. - VMware groups. The product collects data from vCenter. To audit users and groups, vCenter 6.5 and above required. Check that your data collecting account has all required rights and permissions. See the [Permissions for VMware Server Auditing ](/docs/auditor/10.7/configuration/vmware/permissions.md) topic for additional information. |
-| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your VMware system configuration required for further state-in-time reports generation. The product updates the latest snapshot on the regular basis to keep users up-to-date on actual system state. Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. To import snapshots, you must be assigned the Global administrator or the Global reviewer role . Follow the steps to import snapshots. **Step 1 –** In the Manage historical snapshots section, click Manage. **Step 2 –** Select the snapshots that you want to import. **Step 3 –** Move the selected snapshots to the Snapshots available for reporting list using the arrow button. **Step 4 –** When finished, click OK. |
+| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your VMware system configuration required for further state-in-time reports generation. The product updates the latest snapshot on the regular basis to keep users up-to-date on actual system state. Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. To import snapshots, you must be assigned the Global administrator or the Global reviewer role. **Step 1 –** In the Manage historical snapshots section, click Manage. **Step 2 –** Select the snapshots that you want to import. **Step 3 –** Move the selected snapshots to the Snapshots available for reporting list using the arrow button. **Step 4 –** When finished, click OK. |
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the **Data source** list. As a next step, click **Add item** to specify an
@@ -50,7 +52,7 @@ Netwrix administrator does the following:
- Creates a monitoring plan in Netwrix Auditor, specifying the service account (prepared at step 1)
as a data collecting account in the **Monitoring Plan wizard**. Then s/he adds items to the
monitoring plan – these are VMware servers to collect data from.
-- Configures alerts related to VMware data source. Current version does not include predefined
+- Configures alerts related to VMware data source. Current version doesn't include predefined
alerts for that data source, so follow the [Create Alerts](/docs/auditor/10.7/admin/alertsettings/create/create.md) to
create and configure the necessary alerts.
@@ -94,4 +96,4 @@ Complete the following fields:
| Specify VMware ESX, ESXi, or vCenter for monitoring | Specify the ESX or ESXi host URL, or vCenter Server URL. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See [Permissions for VMware Server Auditing ](/docs/auditor/10.7/configuration/vmware/permissions.md)topic for more information. |
| **Virtual Machines** | |
-| Specify monitoring restrictions | Select the virtual machines to be excluded from search results, reports and Activity Summaries. To add VMs to the list, click Add. Then provide the full path of the machine to exclude. Consider the following: - To exclude a single VM, provide its full path as shown in the "_What_" column of reports and Activity Summary, for example: _Vcenters\VCenterServer021\VMs\vm01_. - To exclude several VMs, you can define a mask using a wildcard, for example: - _\*\TestVM\*_ — exclude VMs with names starting with _TestVM_ (e.g., _TestVM01, TestVM_new_), located anywhere. - _\*TestVM\*_ — exclude VMs with names containing _TestVM_ (e.g., _MyTestVM02_). In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Select the virtual machines to be excluded from search results, reports, and Activity Summaries. To add VMs to the list, click Add. Then provide the full path of the machine to exclude. Consider the following: - To exclude a single VM, provide its full path as shown in the "_What_" column of reports and Activity Summary, for example: _Vcenters\VCenterServer021\VMs\vm01_. - To exclude several VMs, you can define a mask using a wildcard, for example: - _\*\TestVM\*_ — exclude VMs with names starting with _TestVM_ (e.g., _TestVM01, TestVM_new_), located anywhere. - _\*TestVM\*_ — exclude VMs with names containing _TestVM_ (e.g., _MyTestVM02_). In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
diff --git a/docs/auditor/10.7/admin/monitoringplans/vmware/scope.md b/docs/auditor/10.7/admin/monitoringplans/vmware/scope.md
index 8b0de504fd..632deb238c 100644
--- a/docs/auditor/10.7/admin/monitoringplans/vmware/scope.md
+++ b/docs/auditor/10.7/admin/monitoringplans/vmware/scope.md
@@ -9,11 +9,11 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying various data types that you want to exclude/include
from/in the VMware reports.
-Follow the steps to exclude data from the VMware monitoring scope:
+## Exclude Data from the VMware Monitoring Scope
-**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Vmware Auditing_ folder.
+1. Navigate to the _%Netwrix Auditor installation folder%\Vmware Auditing_ folder.
-**Step 2 –** Edit the \*.txt files, based on the following guidelines:
+2. Edit the \*.txt files based on the following guidelines:
- Each entry must be a separate line.
- A wildcard (\*) is supported. You can use \* for cmdlets and their parameters.
diff --git a/docs/auditor/10.7/admin/monitoringplans/windows/overview.md b/docs/auditor/10.7/admin/monitoringplans/windows/overview.md
index bf39755a0c..66adad25ab 100644
--- a/docs/auditor/10.7/admin/monitoringplans/windows/overview.md
+++ b/docs/auditor/10.7/admin/monitoringplans/windows/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 200
# Windows Server
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) – To ensure successful data
@@ -26,10 +26,10 @@ Complete the following fields:
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
| Monitor changes to system components | Select the system components that you want to audit for changes. Review the following for additional information: - General computer settings—Enables auditing of general computer settings. For example, computer name or workgroup changes. - Hardware—Enables auditing of hardware devices configuration. For example, your network adapter configuration changes. - Add/Remove programs—Enables auditing of installed and removed programs. For example, Microsoft Office package has been removed from the audited Windows Server. - Services—Enables auditing of started/stopped services. For example, the Windows Firewall service stopped. - Audit policies—Enables auditing of local advanced audit policies configuration. For example, the Audit User Account Management advanced audit policy is set to "_Failure_". - DHCP configuration—Enables auditing of DHCP configuration changes. - Scheduled tasks—Enables auditing of enabled / disabled / modified scheduled tasks. For example, the GoogleUpdateTaskMachineUA scheduled task trigger changes. - Local users and groups—Enables auditing of local users and groups. For example, an unknown user was added to the Administrators group. - DNS configuration—Enables auditing of your DNS configuration changes. For example, your DNS security parameters' changes. - DNS resource records—Enables auditing of all types of DNS resource records. For example, A-type resource records (Address record) changes. - File shares—Enables auditing of created / removed / modified file shares and their properties. For example, a new file share was created on the audited Windows Server. - Removable media—Enables auditing of USB thumb drives insertion. |
| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
-| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. See the [Windows Server](/docs/auditor/10.7/configuration/windowsserver/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
-| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.7/admin/reports/types/stateintime/overview.md) topic for additional information. When auditing file servers, changes to effective access permissions can be tracked in addition to audit permissions. By default, Combination of file and share permissions is tracked. File permissions define who has access to local files and folders. Share permissions provide or deny access to the same resources over the network. The combination of both determines the final access permissions for a shared folder—the more restrictive permissions are applied. Upon selecting Combination of file and share permissions only the resultant set will be written to the Audit Database. Select File permissions option too if you want to see difference between permissions applied locally and the effective file and share permissions set. To disable auditing of effective access, unselect all checkboxes under Include details on effective permissions. In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select day(s) of week you want your snapshot to be collected. In the Manage historical snapshots section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must be assigned the Global administrator or the Global reviewer role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot on the regular basis to keep users up to date on actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. |
+| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [Windows Server](/docs/auditor/10.7/configuration/windowsserver/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
+| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.7/admin/reports/types/stateintime/overview.md) topic for additional information. When auditing file servers, changes to effective access permissions can be tracked in addition to audit permissions. By default, Combination of file and share permissions is tracked. File permissions define who has access to local files and folders. Share permissions provide or deny access to the same resources over the network. The combination of both determines the final access permissions for a shared folder—the more restrictive permissions are applied. Upon selecting Combination of file and share permissions only the resultant set will be written to the Audit Database. Select File permissions option too if you want to see difference between permissions applied locally and the effective file and share permissions set. To disable auditing of effective access, unselect all checkboxes under Include details on effective permissions. In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select days of week you want your snapshot to be collected. In the Manage historical snapshots section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must be assigned the Global administrator or the Global reviewer role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot on the regular basis to keep users up to date on actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. |
| Activity | |
-| Specify monitoring restrictions | Specify restriction filters to narrow your Windows Server monitoring scope (search results, reports and Activity Summaries). For example, you can exclude system activity on a particular objects on all computers. All filters are applied using AND logic. Click Add and complete the following fields: - User who initiated the change: – provide the name of the user whose changes you want to ignore as shown in the "_Who_" column of reports and Activity Summaries. Example: _mydomain\user1_. You can provide the "_System_" value to exclude events containing the “_System_” instead of an account name in the “_Who_” column. - Windows Server which setting was changed: – provide the name of the server in your IT infrastructure whose changes you want to ignore as shown in the "_What_" column of reports and Activity Summaries. Example: _winsrv2016-01.mydomain.local_. - Setting changed: – provide the name for unwanted settings as shown in the "_What_" column in reports and Activity Summaries. Example: _System Properties\*_. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your Windows Server monitoring scope (search results, reports, and Activity Summaries). For example, you can exclude system activity on a particular objects on all computers. All filters are applied using AND logic. Click Add and complete the following fields: - User who initiated the change: – provide the name of the user whose changes you want to ignore as shown in the "_Who_" column of reports and Activity Summaries. Example: _mydomain\user1_. You can provide the "_System_" value to exclude events containing the “_System_” instead of an account name in the “_Who_” column. - Windows Server which setting was changed: – provide the name of the server in your IT infrastructure whose changes you want to ignore as shown in the "_What_" column of reports and Activity Summaries. Example: _winsrv2016-01.mydomain.local_. - Setting changed: – provide the name for unwanted settings as shown in the "_What_" column in reports and Activity Summaries. Example: _System Properties\*_. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the **Data source** list. As a next step, click **Add item** to specify an
@@ -71,11 +71,11 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify AD container | Specify a whole AD domain, OU or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you do not want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers does not include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
+| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. Starting with version 10.7, you can implement the integration between Netwrix Auditor and Netwrix Privilege Secure. See the [Netwrix Privilege Secure](/docs/auditor/10.7/admin/settings/privilegesecure.md) topic for additional information. Refer to the [Permissions for Active Directory Auditing](/docs/auditor/10.7/configuration/activedirectory/permissions.md) topic for more information on using Netwrix Privilege Secure as an account for data collection. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.7/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Containers and Computers | |
| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU or container. - Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) are not supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU, or container. - Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) aren't supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md)topic for additional information. |
## Use Netwrix Privilege Secure as a Data Collecting Account
@@ -86,19 +86,19 @@ integration and supported data sources. In this case, the credentials will not b
Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring
password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
+To use Netwrix Privilege Secure as an account for data collection:
-**Step 1 –** Select the desired item.
+1. Select the item you want.
-**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
+2. In the item configuration menu, select Netwrix Privilege Secure as an option for data
collection.
-**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
+3. Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
Credential-based is the default option. Refer to the
[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+documentation for details about Access Policies.
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
@@ -109,7 +109,7 @@ sources.
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.7/admin/monitoringplans/windows/scope.md b/docs/auditor/10.7/admin/monitoringplans/windows/scope.md
index c74c2a2d14..d85db42ef9 100644
--- a/docs/auditor/10.7/admin/monitoringplans/windows/scope.md
+++ b/docs/auditor/10.7/admin/monitoringplans/windows/scope.md
@@ -9,11 +9,11 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Windows
Server monitoring scope.
-Follow the steps to exclude data from the Windows Server monitoring scope:
+## Exclude Data from the Windows Server Monitoring Scope
-**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Windows Server Auditing_ folder.
+1. Navigate to the _%Netwrix Auditor installation folder%\Windows Server Auditing_ folder.
-**Step 2 –** Edit the \*.txt files, based on the following guidelines:
+2. Edit the \*.txt files, based on the following guidelines:
- Each entry must be a separate line.
- Wildcards (\* and ?) are supported. A backslash (\) must be put in front of (\*), (?), (,), and
@@ -22,8 +22,8 @@ Follow the steps to exclude data from the Windows Server monitoring scope:
| File | Description | Syntax |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| omitcollectlist.txt | Contains a list of objects and their properties to be excluded from being monitored. If you want to restart monitoring these objects, remove them from the omitcollectlist.txt and run data collection at least twice. | `monitoring plan name,server name,class name,property name,property value` `class name` is a mandatory parameter, it cannot be replaced with a wildcard. `property name` and `property value` are optional, but cannot be replaced with wildcards either. For example: `#*,server,MicrosoftDNS_Server `````` #*,*,StdServerRegProv` |
+| omitcollectlist.txt | Contains a list of objects and their properties to be excluded from being monitored. If you want to restart monitoring these objects, remove them from the omitcollectlist.txt and run data collection at least twice. | `monitoring plan name,server name,class name,property name,property value` `class name` is a mandatory parameter, it can't be replaced with a wildcard. `property name` and `property value` are optional, but can't be replaced with wildcards either. For example: `#*,server,MicrosoftDNS_Server `````` #*,*,StdServerRegProv` |
| omiterrors.txt | Contains a list of errors/warnings to be omitted from logging to the Netwrix Auditor System Health event log. | `monitoring plan name,server name,error text` For example: `*,productionserver1.corp.local,*Access is denied*` |
| omitreportlist.txt | Contains a list of objects to be excluded from reports and Activity Summary emails. In this case audit data is still being collected. | `monitoring plan name,who,where,object type,what,property name` For example: `*,CORP\\jsmith,*,*,*,*` |
-| omitsitcollectlist.txt | Contains a list of objects to be excluded from State-in-time reports. | `monitoring planname,server name,class name,property name,property value` `class name` is a mandatory parameter, it cannot be replaced with a wildcard. `property name` and `property value` are optional, but cannot be replaced with wildcards either. For example: `*,server,MicrosoftDNS_Server` `*,*,StdServerRegProv` |
+| omitsitcollectlist.txt | Contains a list of objects to be excluded from State-in-time reports. | `monitoring planname,server name,class name,property name,property value` `class name` is a mandatory parameter, it can't be replaced with a wildcard. `property name` and `property value` are optional, but can't be replaced with wildcards either. For example: `*,server,MicrosoftDNS_Server` `*,*,StdServerRegProv` |
| omitstorelist.txt | Contains a list of objects to be excluded from being stored to the Audit Archive and showing up in reports. In this case audit data is still being collected. | `monitoring plan name,who,where,object type,what,property name` For example: `*,*,*,Scheduled task,Scheduled Tasks\\User_Feed_Synchronization*,*` |
diff --git a/docs/auditor/10.7/admin/navigation/customizeexamples.md b/docs/auditor/10.7/admin/navigation/customizeexamples.md
index d8275c667d..7fd2ff2ef7 100644
--- a/docs/auditor/10.7/admin/navigation/customizeexamples.md
+++ b/docs/auditor/10.7/admin/navigation/customizeexamples.md
@@ -10,16 +10,16 @@ Here are several examples of why and how you might customize the Netwrix Auditor
## View Report and Add to Favorites
-Follow the steps to view a report and add it to the list of Favorites.
+## View Report and Add to Favorites
-**Step 1 –** On the main Auditor page, click the Reports tile in the upper left corner.
+1. On the main Auditor page, click the Reports tile in the upper left corner.
-**Step 2 –** Open a report you are interested in; for example, Account Permissions in Active
+2. Open a report you are interested in; for example, Account Permissions in Active
Directory:
-**Step 3 –** Click the report menu (three dots) to the right and select Add to favorites.
+3. Click the report menu (three dots) to the right and select Add to favorites.
(Alternatively, click the star icon in the upper right corner of the report description.)
The report is added to the Favorite reports section on the home page and you can run it instantly.
@@ -28,21 +28,21 @@ The report is added to the Favorite reports section on the home page and you can
## Run Search and Create Alert
-Follow the steps to run search and create the alert based on the search filters.
+## Run Search and Create Alert
-**Step 1 –** On the main Auditor page, click the Search Activity Records tile.
+1. On the main Auditor page, click the Search Activity Records tile.
-**Step 2 –** Specify search filters to narrow your search results. See the
+2. Specify search filters to narrow your search results. See the
[Use Filters in Simple Mode](/docs/auditor/10.7/admin/search/filtersimple.md) topic for additional information.
-**Step 3 –** Click Search.
+3. Click Search.
-**Step 4 –** Review your search results.
+4. Review your search results.
-**Step 5 –** Navigate to Tools and click Create alert to get instant email or SMS notifications on
+5. Navigate to Tools and click Create alert to get instant email or SMS notifications on
suspicious activity that matches your current search criteria.
-**Step 6 –** Specify a name for the new alert. See the
+6. Specify a name for the new alert. See the
[Create Alerts](/docs/auditor/10.7/admin/alertsettings/create/create.md)topic for additional information.
Now, whenever there is activity that matches your search criteria, the appropriate people will
@@ -51,15 +51,15 @@ on the home page, which opens the Alerts overview dashboard.
## Review and Pin Risks
-Follow the steps to review risks and pin important ones to the Home Screen.
+## Review and Pin Risks
-**Step 1 –** On the main Auditor page, click the Risk Assessment tile.
+1. On the main Auditor page, click the Risk Assessment tile.
-**Step 2 –** Review the Risk Assessment Overview dashbord and select the risk you are interested in,
+2. Review the Risk Assessment Overview dashbord and select the risk you are interested in,
such as "_User Accounts with administrative permissions_". See the
[IT Risk Assessment Overview ](/docs/auditor/10.7/admin/riskassessment/overview.md) topic for additional information.
-**Step 3 –** To access this risk quickly, pin it to the home page, as follows:
+3. To access this risk quickly, pin it to the home page, as follows:
1. On the main product page, click Customize.
2. Click Add tile.
@@ -68,11 +68,11 @@ such as "_User Accounts with administrative permissions_". See the
-**Step 4 –** Click Add.
+4. Click Add.
The selected risks group is added to the home screen.
-## What is Next?
+## Personalize the Home Screen
Personalize the home page of the product depending on your business needs. Review the customization
settings and collect only required tiles for quick access on the Auditor home page. See the
diff --git a/docs/auditor/10.7/admin/navigation/customizefavorite.md b/docs/auditor/10.7/admin/navigation/customizefavorite.md
index af3d7d0d25..04392a3aad 100644
--- a/docs/auditor/10.7/admin/navigation/customizefavorite.md
+++ b/docs/auditor/10.7/admin/navigation/customizefavorite.md
@@ -6,21 +6,21 @@ sidebar_position: 30
# Customizing Favorite Reports
-The Favorite reports tile displays a shortened list of your favorite reports. To view, edit or
+The Favorite reports tile displays a shortened list of your favorite reports. To view, edit, or
update the full list, click View all.
-The Home > Reports page opens. This page includes several folders: Favorites, Predefined, Compliance
+The Home > Reports page opens. This page includes several folders: Favorites, Predefined, Compliance,
and Custom. Favorite reports are located in the Favorites folder.
-Follow the steps to add or remove a Favorite report
+## Add or Remove a Favorite Report
-**Step 1 –** Locate the desired report in one of the other folders.
+1. Locate the report you want in one of the other folders.
-**Step 2 –** Click the name of the report to view its description.
+2. Click the name of the report to view its description.
-**Step 3 –** To change whether the report is a favorite, click the star icon in the upper right-hand
+3. To change whether the report is a favorite, click the star icon in the upper right-hand
corner of the report description.
diff --git a/docs/auditor/10.7/admin/navigation/customizehome.md b/docs/auditor/10.7/admin/navigation/customizehome.md
index b2a3c2f8e5..3030974407 100644
--- a/docs/auditor/10.7/admin/navigation/customizehome.md
+++ b/docs/auditor/10.7/admin/navigation/customizehome.md
@@ -14,63 +14,66 @@ make to the home screen.
## Add a Tile to the Home Screen
-Follow the steps to add tile on the Home Screen.
+## Add a Tile to the Home Screen
+
+1. Click Customize in the upper right corner of the home screen.
-**Step 1 –** Click Customize in the upper right corner of the home screen.
+2. Select Add tile.
-**Step 2 –** Select Add tile.
+Either search for the tile you want by name, or select it from the list of tiles.
-Either search for the tile you want by name, or select it from the list of tiles. Note that tiles
-are grouped into menus; to view all tiles within a menu, check Show all menu tiles.
+:::note
+Tiles are grouped into menus; to view all tiles within a menu, check **Show all menu tiles**.
+:::
-**Step 3 –** Click Add and the selected tile appears on the home screen.
+3. Click Add and the selected tile appears on the home screen.
-**Step 4 –** Drag and drop it to the desired location.
+4. Drag and drop it to the location you want.
-**Step 5 –** Click Apply.
+5. Click Apply.
## Remove a Tile from the Home Screen
-Follow the steps to remove a tile from the Home Screen.
+## Remove a Tile from the Home Screen
-**Step 1 –** Click Customize in the upper right corner of the home screen.
+1. Click Customize in the upper right corner of the home screen.
-**Step 2 –** Select the tile you want to remove.
+2. Select the tile you want to remove.
-**Step 3 –** Click **close (x)**:
+3. Click **close (x)**:
-**Step 4 –** Click Apply.
+4. Click Apply.
## Resize a Tile on the Home Screen
You can change the size of the tile to plan your screen placement and view detailed information on
what you are interested in. There are several types of size: small, medium, wide, large, extra
large, extra tall. However, not every tile supports all types of sizes. Tiles with graphic
-information have medium, large and extra large sizes. These sizes provide more screen space,
+information have medium, large, and extra large sizes. These sizes provide more screen space,
resulting in a better visual representation of data. Additionally, tiles with less information have
small and wide sizes. They are designed to open separate windows, providing easy access to features
such as search, reports, and live news updates.
-Follow the steps to resizea tile.
+## Resize a Tile on the Home Screen
-**Step 1 –** Click Customize in the upper right corner of the home screen.
+1. Click Customize in the upper right corner of the home screen.
-**Step 2 –** Select the tile you want to resize.
+2. Select the tile you want to resize.
-**Step 3 –** Click the **resize** button:
+3. Click the **resize** button:
-**Step 4 –** Select the preferred size from the drop-down list.
+4. Select the preferred size from the dropdown list.
## Restore the Default View
-Follow the steps to restore the default Home Screen view.
+## Restore the Default View
-**Step 1 –** Click Customize in the upper right corner of the Home Screen.
+1. Click Customize in the upper right corner of the Home Screen.
-**Step 2 –** Click Restore default.
+2. Click Restore default.
Your configuration and data will be preserved during this operation.
diff --git a/docs/auditor/10.7/admin/navigation/overview.md b/docs/auditor/10.7/admin/navigation/overview.md
index acffd74684..c0272607c5 100644
--- a/docs/auditor/10.7/admin/navigation/overview.md
+++ b/docs/auditor/10.7/admin/navigation/overview.md
@@ -13,7 +13,7 @@ illustrates the customization process with several common scenarios.
## Home Screen Tiles
-Home Screen Tiles in the Netwrix Auditor provide an interface that allows users to access main
+Home Screen Tiles in the Netwrix Auditor provide an interface that lets you access main
information. The following tiles are displayed on the initially configured Home Screen:
- Welcome to Netwrix Auditor Tile
@@ -65,8 +65,8 @@ following links:
| Option | Description |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Monitoring plans | Opens the Monitoring plans wizard, where you can add, edit and delete monitoring plans, as well as group them into folders. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md) topic for additional information. |
-| Subscriptions | Opens the Subscriptions wizard, which enables you to subscribe to Auditor reports and searches, so you can easily stay informed about what is going on in your infrastructure. See the [Subscriptions](/docs/auditor/10.7/admin/subscriptions/overview.md) topic for additional information. |
+| Monitoring plans | Opens the Monitoring plans wizard, where you can add, edit, and delete monitoring plans, as well as group them into folders. See the [Monitoring Plans](/docs/auditor/10.7/admin/monitoringplans/overview.md) topic for additional information. |
+| Subscriptions | Opens the Subscriptions wizard, which lets you subscribe to Auditor reports and searches, so you can easily stay informed about what is going on in your infrastructure. See the [Subscriptions](/docs/auditor/10.7/admin/subscriptions/overview.md) topic for additional information. |
| Alert settings | Opens the All Alerts wizard, where you can create, edit, and enable or disable alerts on critical events in your environment. See the [Alerts](/docs/auditor/10.7/admin/alertsettings/overview.md)topic for additional information. |
## Risk Assessment, Compliance Mapping, Live News, and Health Tiles
@@ -74,14 +74,14 @@ following links:
| Tile | Description |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| RISK ASSESSMENT | Opens the Risk Assessment Overview dashboard, which identifies possible configuration issues in your environment that could impact security. See the [IT Risk Assessment Overview ](/docs/auditor/10.7/admin/riskassessment/overview.md) topic for additional information. |
-| COMPLIANCE MAPPING | Enables you to review how Auditor can help you comply common standards and regulations. See the [Compliance Mappings](/docs/auditor/10.7/admin/compliancemappings.md) topic for additional information. |
+| COMPLIANCE MAPPING | Review how Auditor helps you comply with common standards and regulations. See the [Compliance Mappings](/docs/auditor/10.7/admin/compliancemappings.md) topic for additional information. |
| LIVE NEWS | Shows the latest Netwrix news, including product updates. |
-| HEALTH STATUS | Opens the Health Status dashboard, which provides at-a-glance insight into product health, data collection, storage and more. See the [Health Status Dashboard](/docs/auditor/10.7/admin/healthstatus/dashboard/overview.md) topic for additional information. |
+| HEALTH STATUS | Opens the Health Status dashboard, which provides at-a-glance insight into product health, data collection, storage, and more. See the [Health Status Dashboard](/docs/auditor/10.7/admin/healthstatus/dashboard/overview.md) topic for additional information. |
| ALERTS HISTORY | Clicking this tile opens the Alerts History dashboard, which provides detailed information about the latest alerts triggered in your IT infrastructure, enriched with actionable charts and timelines. See the [Alerts Overview Dashboard](/docs/auditor/10.7/admin/alertsettings/dashboard.md) topic for additional information. |
## Favorite Reports
-Initially, the Favorite Reports tile lists the reports that our customers use most frequently. You
+Initially, the Favorite Reports tile lists the reports that the customers use most frequently. You
can add and remove reports to reflect your needs and interests. If you have more favorite reports
than can fit in the tile, simply click **View all** to see the complete list. See the
[Customizing Favorite Reports](/docs/auditor/10.7/admin/navigation/customizefavorite.md) topic for additional information.
diff --git a/docs/auditor/10.7/admin/navigation/recommendations.md b/docs/auditor/10.7/admin/navigation/recommendations.md
index 80eb114e8d..102e4d1dc1 100644
--- a/docs/auditor/10.7/admin/navigation/recommendations.md
+++ b/docs/auditor/10.7/admin/navigation/recommendations.md
@@ -7,21 +7,21 @@ sidebar_position: 10
# Recommendations
This section covers the Recommendations interface that contains detailed guidance on the Auditor
-usage patterns. Once you installed the product, configured your IT infrastructure, and prepared
+usage patterns. After you have installed the product, configured your IT infrastructure, and prepared
Netwrix Service Accounts, you can start collecting data and review it with Netwrix Auditor. The
recommendations are based on your current product configuration and help you to experience the
Auditor capabilities in earnest.
-Follow the steps to review the recommendations provided by Netwrix industry experts.
+## Review Recommendations provided by Netwrix industry experts.
-**Step 1 –** On the Auditor home page, click the **Recommendations** tile.
+1. On the Auditor home page, click the **Recommendations** tile.
-**Step 2 –** Review the recommendations applicable to your current Auditor configuration and take
+2. Review the recommendations applicable to your current Auditor configuration and take
required steps.
-Once the required steps are done, the recommendation goes to the '**Complete**' list. You can move
+After the required steps are done, the recommendation goes to the '**Complete**' list. You can move
it back to the active state any time you want by clicking the **Move to active** link.
## Available Recommendations
@@ -99,15 +99,15 @@ For completed recommendations, you can configure the retention period to keep th
select their categories for further displaying on the tile. If you want to proceed with a completed
recommendation, click the '**Move to active**' link below the recommendation.
-Follow the steps to manage recommendations:
+## Manage Recommendations
-**Step 1 –** On the Auditor home page, click the **Recommendations** tile.
+1. On the Auditor home page, click the **Recommendations** tile.
-**Step 2 –** Click **Settings** at the bottom.
+2. Click **Settings** at the bottom.
-**Step 3 –** In the Manage recommendations dialog, do the following:
+3. In the Manage recommendations dialog, do the following:
- Keep completed recommendations: `<30>` days – Specify time period in days to keep the completed
recommendations visible. The default period is set to 30 days.
diff --git a/docs/auditor/10.7/admin/reports/custom.md b/docs/auditor/10.7/admin/reports/custom.md
index 81b6f136a0..7745302bb7 100644
--- a/docs/auditor/10.7/admin/reports/custom.md
+++ b/docs/auditor/10.7/admin/reports/custom.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Custom Search-Based Reports
-Netwrix Auditor allows you to save your favorite searches as reports to access them instantly. For
+Netwrix Auditor lets you save your favorite searches as reports to access them instantly. For
your convenience, the product provides predefined templates for some popular usage scenarios. You
can save your custom report or use one of the templates provided by Netwrix. Navigate to Reports →
Custom to review these reports. Click View to generate the selected report.
@@ -38,7 +38,7 @@ Review the following for additional information:
audit data.
3. Navigate to Tools and select Save as report.
-4. In the Specify a name for your custom report dialog, specify a name. Make sure to specify a
+4. In the Specify a name for your custom report dialog, specify a name. Ensure to specify a
unique name.
## To modify a custom report
diff --git a/docs/auditor/10.7/admin/reports/reviewstatus.md b/docs/auditor/10.7/admin/reports/reviewstatus.md
index b4c318bc35..45d40dd1be 100644
--- a/docs/auditor/10.7/admin/reports/reviewstatus.md
+++ b/docs/auditor/10.7/admin/reports/reviewstatus.md
@@ -8,9 +8,9 @@ sidebar_position: 20
Change management is one of the critical processes for many companies referring to such areas as
requesting, planning, implementing, and evaluating changes to various systems. For your change
-management workflow, Netwrix Auditor offers several reports with interactive capabilities – not only
-they list changes in your infrastructure but also allow you to track, analyze, assign appropriate
-status and comment on these changes.
+management workflow, Netwrix Auditor offers several reports with interactive capabilities. These reports
+list changes in your infrastructure, and let you track, analyze, assign appropriate status, and comment
+on these changes.
This capability can supplement your organization's workflow of monitoring and resolving potential
issues through the following automated course of action:
@@ -21,7 +21,7 @@ issues through the following automated course of action:
3.
In the **Review status** dialog for selected change, set its status to In Review and provide a
reason.
-3. Once the change has been approved of, or rolled back, you can set its status to Resolved.
+3. After the change has been approved or rolled back, you can set its status to Resolved.
This capability is supported for the following reports:
diff --git a/docs/auditor/10.7/admin/reports/types/compliance.md b/docs/auditor/10.7/admin/reports/types/compliance.md
index 58803543e8..3530538b40 100644
--- a/docs/auditor/10.7/admin/reports/types/compliance.md
+++ b/docs/auditor/10.7/admin/reports/types/compliance.md
@@ -21,8 +21,7 @@ standards and regulations, including but not limited to:
- SOX
- CJIS
-Each compliance folder provides overview on a selected standard, to read it, click on the folder
-name. Click Read More to learn more about mapping between these standards and Auditor reports.
+Each compliance folder provides an overview of a selected standard and shows how Auditor reports map to that standard. Click the folder name to view the overview and mapping.
In the report filters, select a monitoring plan you want to generate a report for. To review data
sources and items included in each plan, navigate to the Monitoring Plans section.
diff --git a/docs/auditor/10.7/admin/reports/types/datadiscoveryclassification.md b/docs/auditor/10.7/admin/reports/types/datadiscoveryclassification.md
index 9dbca2c57e..ab833b7181 100644
--- a/docs/auditor/10.7/admin/reports/types/datadiscoveryclassification.md
+++ b/docs/auditor/10.7/admin/reports/types/datadiscoveryclassification.md
@@ -6,8 +6,6 @@ sidebar_position: 30
# Data Discovery and Classification Reports
-Follow the steps to review Data Discovery and Classification reports:
-
**Step 1 –** Navigate to **Reports** > **Data Discovery and Classification** and select a report you
are interested in.
@@ -34,10 +32,10 @@ The table below lists the reports available for Data Discovery and Classificatio
| Activity Related to Sensitive Data Objects | This report shows changes and read operations on SharePoint sites and documents that contain sensitive information. Use this report to detect suspicious activity around your sensitive data. |
| State-in-time reports | |
| Sensitive Data Objects by Site Collection | For each SharePoint site collection listed, this report shows the categories of sensitive data stored there and the number of documents in each category. Use this report to reveal the number of sensitive files stored in your SharePoint site collections. |
-| Sensitive Data Objects | For each site collection listed, this report shows the SharePoint objects (sites, lists and documents) that have been classified as containing sensitive information. Use this report to plan and control data protection measures for sensitive information stored on your SharePoint. |
-| Sensitive Data Object Permissions | For each SharePoint object (site, list or document) listed, this report shows the user accounts that have access to this object, their effective permissions and how those permissions were granted (for example, permissions can be granted directly, via group membership or using SharePoint policy). Use this report to control access to SharePoint objects that contain sensitive data. |
-| Overexposed Sensitive Data Objects | For each user account listed, this report shows the SharePoint objects (sites, lists and documents) containing sensitive data that the user can access based on their effective permissions. Use this report to identify overexposed data and plan measures to mitigate your risk. |
-| Most Exposed Sensitive Data Objects | Lists the SharePoint objects (sites, lists and documents) containing sensitive data that can be accessed by the most users (or even Everyone), based on effective permissions. Use this report to identify data at high risk and plan corrective actions. |
+| Sensitive Data Objects | For each site collection listed, this report shows the SharePoint objects (sites, lists, and documents) that have been classified as containing sensitive information. Use this report to plan and control data protection measures for sensitive information stored on your SharePoint. |
+| Sensitive Data Object Permissions | For each SharePoint object (site, list, or document) listed, this report shows the user accounts that have access to this object, their effective permissions and how those permissions were granted (for example, permissions can be granted directly, via group membership, or using SharePoint policy). Use this report to control access to SharePoint objects that contain sensitive data. |
+| Overexposed Sensitive Data Objects | For each user account listed, this report shows the SharePoint objects (sites, lists, and documents) containing sensitive data that the user can access based on their effective permissions. Use this report to identify overexposed data and plan measures to mitigate your risk. |
+| Most Exposed Sensitive Data Objects | Lists the SharePoint objects (sites, lists, and documents) containing sensitive data that can be accessed by the most users (or even Everyone), based on effective permissions. Use this report to identify data at high risk and plan corrective actions. |
## Requirements for Data Discovery and Classification Reports
diff --git a/docs/auditor/10.7/admin/reports/types/enterprise.md b/docs/auditor/10.7/admin/reports/types/enterprise.md
index 01d2eba0ec..779b619889 100644
--- a/docs/auditor/10.7/admin/reports/types/enterprise.md
+++ b/docs/auditor/10.7/admin/reports/types/enterprise.md
@@ -6,9 +6,9 @@ sidebar_position: 10
# Enterprise Overview Dashboard
-Enterprise Overview dashboard provide a high-level overview of activity trends by date, user,
-server, object type or audited system in your IT infrastructure. They allow you to see the activity
-trends by date, user, object type, server or audited IT system, and drill through to detailed
+Enterprise Overview dashboard provides a high-level overview of activity trends by date, user,
+server, object type, or audited system in your IT infrastructure. You can see activity
+trends by date, user, object type, server, or audited IT system, and drill through to detailed
reports for further analysis. The Enterprise diagram aggregates data on all Managed Objects and all
audited systems, while system-specific diagrams provide quick access to important statistics within
one audited system.
@@ -24,7 +24,7 @@ The current version of Netwrix Auditor contains the following diagrams:
- VMware
- Windows Server
-If you are sure that some audit data is missing (e.g., you do not see information on your file
+If you are sure that some audit data is missing (e.g., you don't see information on your file
servers in reports and search results), verify that the Audit Database settings are configured and
that data is written to databases that reside on the default SQL Server instance.
@@ -36,7 +36,7 @@ All diagrams provide the drill-down functionality, which means that by clicking
will be redirected to a report with the corresponding filtering and grouping of data that renders
the next level of detail.
-Follow the steps to review a diagram:
+To review a diagram, follow these steps:
- On the Auditor home screen, click the **Reports** tile and open the Enterprise Overview section.
Click a tile to open a corresponding diagram.
diff --git a/docs/auditor/10.7/admin/reports/types/overview.md b/docs/auditor/10.7/admin/reports/types/overview.md
index 60d2be6a03..e128d19cbf 100644
--- a/docs/auditor/10.7/admin/reports/types/overview.md
+++ b/docs/auditor/10.7/admin/reports/types/overview.md
@@ -10,8 +10,8 @@ Netwrix Auditor is shipped with 250+ ready-to-use reports designed by Netwrix in
find a report that is right for you, check out the predefined report types available in the product.
- Enterprise Overview—A dashboard with a set of widgets that provide quick access to important
- statistics across the audited IT infrastructure. They allow you to see the activity trends by
- date, user, data source, server or audited IT system, and drill through to detailed reports for
+ statistics across the audited IT infrastructure. You can see activity trends by
+ date, user, data source, server, or audited IT system, and drill through to detailed reports for
further analysis. The Enterprise Overview dashboard aggregates the information on changes from all
data sources and provides a centralized overview. System-specific dashboards reflect all changes
across all monitoring plans where audit of this target system is enabled. See the
@@ -27,13 +27,13 @@ find a report that is right for you, check out the predefined report types avail
drill through to detailed reports for further analysis.
- Change and activity reports—System-specific reports that aggregate audit data for a specific data
source within specified monitoring plans. These reports show detailed data on changes and activity
- and provide grouping, sorting and filtering capabilities. Each report has a different set of
+ and provide grouping, sorting, and filtering capabilities. Each report has a different set of
filters allowing you to manage collected data in the most convenient way. See the
[Change and Activity Reports](/docs/auditor/10.7/admin/reports/types/activity.md) topic for additional information.
- State-in-time reports—System-specific reports that aggregate data for a specific data source
within a specified individual monitoring plan and allow reviewing the point-in-time state of the
data source. These reports are based on daily snapshots and help you paint a picture of your
- system configuration at a specific moment in time. Currently, the Windows Server State-in-Time
+ system configuration at a specific moment in time. the Windows Server State-in-Time
report set provides baselining functionality that help identify aberrant servers. See the
[State–In–Time Reports](/docs/auditor/10.7/admin/reports/types/stateintime/overview.md) topic for additional information.
- Changes with video reports—Windows server-based reports that provide video recordings of user
diff --git a/docs/auditor/10.7/admin/reports/types/stateintime/activedirectory.md b/docs/auditor/10.7/admin/reports/types/stateintime/activedirectory.md
index ce0e313fa1..acc4c93ebb 100644
--- a/docs/auditor/10.7/admin/reports/types/stateintime/activedirectory.md
+++ b/docs/auditor/10.7/admin/reports/types/stateintime/activedirectory.md
@@ -10,7 +10,7 @@ Examine the Active Directory state-in-time data on the user account attributes:
- User Accounts - Attributes
-To instruct Netwrix Auditor to collect data needed for the report, make sure that **Collect data for
+To instruct Netwrix Auditor to collect data needed for the report, ensure that **Collect data for
state-in-time reports** option is selected in the corresponding monitoring plan properties. See the
[Settings for Data Collection](/docs/auditor/10.7/admin/monitoringplans/create.md#settings-for-data-collection)
topic for additional information.
@@ -43,9 +43,11 @@ topic for additional information.
6. If you have more than 2000 entities within the report scope, sorting might work incorrectly.
Apply filters to narrow your report scope.
-Please consider that if you are going to export the report in .csv format or want to subscribe to
+consider that if you are going to export the report in .csv format or want to subscribe to
the .csv report, the file will contain the full list of available attributes regardless of which
-filters you specified. Note that unseleted attributes have no values.
+filters you specified. :::note
+Unselected attributes have no values.
+:::
### Filters
@@ -61,7 +63,7 @@ filters and values:
### Reported Data
-For the account(s) you selected using filters, the summary section includes:
+For the accounts you selected using filters, the summary section includes:
- **Total account count** — total number of accounts that meet selected filtering criteria.
- **Enabled accounts** —total number of enabled accounts that meet selected filtering criteria.
@@ -99,7 +101,7 @@ The following account attributes are reported:
| ZIP/postal code | Equals the Postal-Code attribute. See the corresponding Microsoft article for more information: [Postal-Code attribute](https://docs.microsoft.com/en-us/windows/win32/adschema/a-postalcode). | Example: _61441_ | + |
| Country/region | Shows the country/region in which the user is located. | Example: _Ireland_ | + |
| Security | | | |
-| Account cannot be delegated | Shows whether the account can be delegated or not based on the User-Account-Control attribute. See the corresponding Microsoft article for more information: [User-Account-Control attribute](https://docs.microsoft.com/en-us/windows/win32/adschema/a-useraccountcontrol). | Yes No | + |
+| Account can't be delegated | Shows whether the account can be delegated or not based on the User-Account-Control attribute. See the corresponding Microsoft article for more information: [User-Account-Control attribute](https://docs.microsoft.com/en-us/windows/win32/adschema/a-useraccountcontrol). | Yes No | + |
| Account expiration date | Equals the Account-Expires attribute. See the corresponding Microsoft article for more information: [Account-Expires attribute](https://docs.microsoft.com/en-us/windows/win32/adschema/a-accountexpires). | Date | – |
| Password age | Shows password age for the account based on the Pwd-Last-Set attribute. See the corresponding Microsoft article for more information: [Pwd-Last-Set attribute](https://docs.microsoft.com/en-us/windows/win32/adschema/a-pwdlastset). | Number of days N/A — if password never set When the filter applied, the report shows above or equal results | + |
| Password expired | Shows whether the account has the "_Password expired_" flag set under the AccountControl attribute. | Yes No | + |
@@ -107,7 +109,7 @@ The following account attributes are reported:
| Never – if password never set | + | | |
| Password never expires | Shows whether the account has the "_Password never expires_" flag set on the Account tab in properties. | Yes No | + |
| Password not required | Shows whether the account has the "_Password not required_" flag set under the AccountControl attribute. Such account may have empty password. | Yes No | + |
-| User cannot change password | Shows whether the account has the "_User cannot change password_" flag set on the Account tab in properties. | Yes No | + |
+| User can't change password | Shows whether the account has the "_User can't change password_" flag set on the Account tab in properties. | Yes No | + |
| User must change password | Shows whether the account has the "_User must change password_" flag set on the Account tab in properties. | Yes No | + |
| Other | | | |
| Creation date | Shows account creation date. | Date | – |
@@ -128,7 +130,7 @@ account.
### Usage Example
-An IT administrators wants to find all user accounts from the OU named _Finance_ that are currently
+An IT administrators wants to find all user accounts from the OU named _Finance_ that are
locked out and disabled with information about their managers to contact them in case of any
questions. This OU is included in the monitoring plan named _Active Directory Monitoring_. They need
to set report filters as follows:
diff --git a/docs/auditor/10.7/admin/reports/types/stateintime/fileservers.md b/docs/auditor/10.7/admin/reports/types/stateintime/fileservers.md
index 8e1108aa25..eda6713dc3 100644
--- a/docs/auditor/10.7/admin/reports/types/stateintime/fileservers.md
+++ b/docs/auditor/10.7/admin/reports/types/stateintime/fileservers.md
@@ -11,7 +11,7 @@ generation.
## Limitations
-1. For the following File Server State-in-Time reports wildcard _%_ is not supported for the
+1. For the following File Server State-in-Time reports wildcard _%_ isn't supported for the
"_Object Path_" field:
- Account permissions
diff --git a/docs/auditor/10.7/admin/reports/types/stateintime/microsoftentraid.md b/docs/auditor/10.7/admin/reports/types/stateintime/microsoftentraid.md
index bae7baa4e0..8cc955e3cc 100644
--- a/docs/auditor/10.7/admin/reports/types/stateintime/microsoftentraid.md
+++ b/docs/auditor/10.7/admin/reports/types/stateintime/microsoftentraid.md
@@ -6,11 +6,11 @@ sidebar_position: 20
# Microsoft Entra ID State-In-Time Reports
-To instruct Netwrix Auditor to collect data needed for the report, make sure that Collect data for
+To instruct Netwrix Auditor to collect data needed for the report, ensure that Collect data for
state-in-time reports option is selected in the corresponding monitoring plan properties. See
[Create a New Monitoring Plan](/docs/auditor/10.7/admin/monitoringplans/create.md).
-**NOTE:** For Microsoft Entra ID, only the current date snapshot can be used for Reports.
+**NOTE:** For Microsoft Entra ID, you can only use the current date snapshot for Reports.
## User Accounts - Attributes
@@ -52,7 +52,7 @@ filters and values:
### Reported Data
-For the account(s) you selected using filters, the summary section includes:
+For the accounts you selected using filters, the summary section includes:
- Total account count — total number of accounts that meet selected filtering criteria.
@@ -73,7 +73,7 @@ The following account attributes are reported:
| Country | country | Example: "_US_" | The country/region in which the user is located. Example: "US" or "UK". Maximum length 128. |
| Creation date | createdDateTime | 1/21/2021 4:08:00 PM | The created date of the user object. |
| Department | department | Example: "_Accounting and Finance_" | The name for the department in which the user works. Maximum length is 64 characters. |
-| Display name | displayName | Example: "_John Smith_" | The name displayed in the address book for the user. This is usually the combination of the user's first name, middle initial and last name. This property is required when a user is created and it cannot be cleared during updates. Maximum length is 256 characters. |
+| Display name | displayName | Example: "_John Smith_" | The name displayed in the address book for the user. This is usually the combination of the user's first name, middle initial and last name. This property is required when a user is created and it can't be cleared during updates. Maximum length is 256 characters. |
| First name | givenName | Example: "_John_" | The given name (first name) of the user. Maximum length is 64 characters. |
| Is licensed | – | – | – |
| Last DirSync time | onPremisesLastSyncDateTime | Example: _3/20/2021 2:13:00 PM_ | M Indicates the last time at which the object was synchronized with the on-premises directory; for example: "2013- 02- 16T03:04:54Z". The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. |
@@ -86,8 +86,8 @@ The following account attributes are reported:
| Password never expires | passwordPolicies | Yes/No | Specifies password policies for the user. This value is an enumeration with one possible value being "DisableStrongPassword", which allows weaker passwords than the default policy to be specified. "DisablePasswordExpiration" can also be specified. The two may be specified together; for example: "DisablePasswordExpiration, DisableStrongPassword". |
| Phone number | businessPhones | Example: _+1-202-555-155_ | The telephone numbers for the user. Although this is a string collection, only one number can be set for this property. |
| Role membership | – | Example: "_Exchange Service Administrator, Company Administrator_" | – |
-| Sign in names | identities | _Example: "user_company.com#EXT#@officenwxqc.onmicrosoft.com"_ | Represents the identities that can be used to sign into this user account. An identity can be provided by Microsoft (also known as a local account), by organizations, or by social identity providers such as Facebook, Google, and Microsoft, and tied to a user account. May contain multiple items with the same signInType value. https://docs.microsoft.com/en- us/graph/api/resources/objectid entity?view=graph-rest-1.0 |
+| Sign in names | identities | _Example: "user_company.com#EXT#@officenwxqc.onmicrosoft.com"_ | Represents the identities you can use to sign into this user account. An identity can be provided by Microsoft (also known as a local account), by organizations, or by social identity providers such as Facebook, Google, and Microsoft, and tied to a user account. May contain multiple items with the same signInType value. https://docs.microsoft.com/en- us/graph/api/resources/objectid entity?view=graph-rest-1.0 |
| Strong password required | passwordPolicies | Yes/No | Specifies password policies for the user. This value is an enumeration with one possible value being "DisableStrongPassword", which allows weaker passwords than the default policy to be specified. "DisablePasswordExpiration" can also be specified. The two may be specified together; for example: "DisablePasswordExpiration, DisableStrongPassword". |
| Title | jobTitle | Example: "_Business development manager_" | The user's job title. Max length is 128. |
| User principal name | userPrincipalName | Example: "_user_company.com#EXT#@officenwxqc.onmicrosoft.com_" | The user principal name (UPN) of wxq the user. The UPN is an Internet- style login name for the user based on the Internet standard RFC 822. By convention, this should map to the user's email name. The general format is alias@domain, where the domain must be present in the tenant's collection of verified domains. This property is required when a user is created. The verified domains for the tenant can be accessed from the verifiedDomains property of organization. NOTE: While this property can contain accent characters, they can cause access issues to first-party applications for the user. |
-| User type | userType | Example: "_Member_" | A string value that can be used to classify user types in your directory, such as "Member" and "Guest". |
+| User type | userType | Example: "_Member_" | A string value that you can use to classify user types in your directory, such as "Member" and "Guest". |
diff --git a/docs/auditor/10.7/admin/reports/types/stateintime/overview.md b/docs/auditor/10.7/admin/reports/types/stateintime/overview.md
index c0906e30d5..7ad39d4fa8 100644
--- a/docs/auditor/10.7/admin/reports/types/stateintime/overview.md
+++ b/docs/auditor/10.7/admin/reports/types/stateintime/overview.md
@@ -10,7 +10,7 @@ The state-in-time reports functionality allows generating reports on the system'
specific moment of time in addition to change and activity reports. State-in-time reports are based
on the daily configuration snapshots, and reflect a particular aspect of the audited environment.
-This functionality is currently available for the following data sources:
+This functionality is available for the following data sources:
- Active Directory
- Microsoft Entra ID
@@ -24,7 +24,7 @@ This functionality is currently available for the following data sources:
- Group Policy
- VMware
-**NOTE:** The State-in-Time functionality is not available for SQL Server Availability Groups.
+**NOTE:** The State-in-Time functionality isn't available for SQL Server Availability Groups.
To provide data for state-in-time reports, remember to select the **Collect data for state-in-time
reports** option when you configure a monitoring plan for the selected data source. See the
@@ -51,9 +51,9 @@ corresponding snapshot from the Snapshot Date filter.
To be able to generate reports based on different snapshots, ask your Auditor Global administrator
to import historical snapshots to the Audit Database, otherwise only the Current Session option is
-available in the drop-down list.
+available in the dropdown list.
-**NOTE:** Importing historical snapshots is not available for Office 365.
+**NOTE:** Importing historical snapshots isn't available for Office 365.
When auditing file servers, changes to both access and audit permissions are tracked. To exclude
information on access permissions, contact your Auditor Global administrator or Configurator of this
@@ -61,7 +61,7 @@ plan.
## Baseline Reports
-Most reports in Windows Server—State-in-Time folder allow you to specify baselines. A _baseline_
+Most reports in Windows Server—State-in-Time folder let you specify baselines. A _baseline_
defines a certain safe level or state. If a server parameter falls below it, it is a considered a
threat or at least merits your special attention. With baselines specified right in report filters,
you can easily identify servers that are different from your corporate policies or best practices.
diff --git a/docs/auditor/10.7/admin/reports/types/stateintime/sqlroles.md b/docs/auditor/10.7/admin/reports/types/stateintime/sqlroles.md
index ed131cf954..90f184f765 100644
--- a/docs/auditor/10.7/admin/reports/types/stateintime/sqlroles.md
+++ b/docs/auditor/10.7/admin/reports/types/stateintime/sqlroles.md
@@ -4,10 +4,10 @@ This report shows the server-level fixed and custom roles for the selected SQL S
grouped by role name. The details for each role include its name, type, and a list of the effective
role members and member types. Use this report to control role membership and permissions.
-To read more about SQL server-level roles, refer to
-[this Microsoft article](https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles?view=sql-server-ver15).
+For details about SQL server-level roles, see the
+[Microsoft documentation](https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles?view=sql-server-ver15).
-To instruct Netwrix Auditor to collect data needed for this report, make sure that **Collect data
+To instruct Netwrix Auditor to collect data needed for this report, ensure that **Collect data
for state-in-time reports** option is selected in the monitoring plan properties. See Settings for
Data Collection in the monitoring plan documentation.
@@ -42,7 +42,7 @@ This report has the following filters:
UTC-08:00.
- **Snapshot date** —select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in the SQL Server monitoring plan
documentation.
- **Item**— name of the SQL Server instance monitored with selected monitoring plan.
@@ -52,7 +52,7 @@ This report has the following filters:
## Considerations and limitations
-- Reporting for case-sensitive SQL Servers and databases is not supported.
+- Reporting for case-sensitive SQL Servers and databases isn't supported.
## Related reports
diff --git a/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlaccountpermissions.md b/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlaccountpermissions.md
index f0f873bc5e..1f4fca0df6 100644
--- a/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlaccountpermissions.md
+++ b/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlaccountpermissions.md
@@ -51,7 +51,7 @@ This report has the following filters:
value is filled in automatically.
- **Snapshot date** —select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in
[SQL Server](/docs/auditor/10.7/admin/monitoringplans/sqlserver/overview.md)
- **Item**— name of the SQL Server instance monitored with selected monitoring plan.
@@ -70,7 +70,7 @@ This report has the following filters:
## Considerations and limitations
-- Reporting for case-sensitive SQL Servers and databases is not supported.
+- Reporting for case-sensitive SQL Servers and databases isn't supported.
- Permissions for INFORMATION*SCHEMA granted via \_master db* will not be reported.
- The report will not show the RESTORE capability for the database owner.
diff --git a/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqldatabases.md b/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqldatabases.md
index 171c57873e..cba5b603a2 100644
--- a/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqldatabases.md
+++ b/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqldatabases.md
@@ -58,7 +58,7 @@ This report has the following filters:
## Considerations and recommendations
-Reporting for case-sensitive SQL Servers and databases is not supported.
+Reporting for case-sensitive SQL Servers and databases isn't supported.
## Usage example
diff --git a/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlmeansgranted.md b/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlmeansgranted.md
index 810a6e9358..8504e7515d 100644
--- a/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlmeansgranted.md
+++ b/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlmeansgranted.md
@@ -13,7 +13,7 @@ investigate how permissions are granted.
Supported object types and attributes are listed in the
[SQL Server](/docs/auditor/10.7/configuration/sqlserver/overview.md) section.
-To instruct Netwrix Auditor to collect data needed for this report, make sure that **Collect data
+To instruct Netwrix Auditor to collect data needed for this report, ensure that **Collect data
for state-in-time reports** option is selected in the monitoring plan properties.
@@ -49,7 +49,7 @@ The detailed information under summary includes:
- **Type**— the security principal type, e.g. _Server role_.
- **Grant** —the set of permissions granted to this account on the selected object by all means.
-Covering rules do not need to be applied, since **Grant** permissions are reported automatically
+Covering rules don't need to be applied, since **Grant** permissions are reported automatically
using these rules.
## Filters
@@ -62,7 +62,7 @@ This report has the following filters:
value is filled in automatically.
- **Snapshot date** —select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in the SQL Server monitoring plan
documentation.
- **Item**—name of the SQL Server instance monitored with selected monitoring plan.
@@ -77,11 +77,11 @@ This report has the following filters:
## Considerations and limitations
-- Reporting is not supported for the following objects:
+- Reporting isn't supported for the following objects:
- Case-sensitive SQL Servers and databases
- Read-only Filegroups
- Contained databases.
-- Permissions assigned using **With Grant option** are not reported (see
+- Permissions assigned using **With Grant option** aren't reported (see
[this Microsoft article](https://docs.microsoft.com/en-us/sql/t-sql/statements/grant-object-permissions-transact-sql?view=sql-server-ver15)
on that means).
- When calculating effective rights and permissions, the following will not be considered:
@@ -95,7 +95,7 @@ This report has the following filters:
When examining the **Object Permissions in SQL Server** report, database administrators in the
_Corp_ organization discovered that the accounts with Contractor job title has access to the
-**SQLSrv01\SQLServer2016** instance. To explore how this could happen, they drilled down to the
+**SQLSrv01\SQLServer2016** instance. To explore how this could happen, they navigated to the
**SQL Server Means Granted** report for that account by clicking the link in the **Means granted**
field for that account.
diff --git a/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlobjectpermissions.md b/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlobjectpermissions.md
index a76ea56ff8..78df1c996e 100644
--- a/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlobjectpermissions.md
+++ b/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlobjectpermissions.md
@@ -43,7 +43,7 @@ The detailed information under summary includes:
- **Effective grant** —the effective set of permissions granted to this account on the selected
object.
-Covering rules do not need to be applied, since **Effective grant** permissions are reported
+Covering rules don't need to be applied, since **Effective grant** permissions are reported
automatically using these rules.
## Filters
@@ -56,7 +56,7 @@ This report has the following filters:
value is filled in automatically.
- **Snapshot date** —select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in the
[SQL Server](/docs/auditor/10.7/admin/monitoringplans/sqlserver/overview.md) topic.
- **Item**—name of the SQL Server instance monitored with selected monitoring plan.
@@ -77,7 +77,7 @@ This report has the following filters:
## Considerations and limitations
-- Reporting for case-sensitive SQL Servers and databases is not supported.
+- Reporting for case-sensitive SQL Servers and databases isn't supported.
- The report will not show the RESTORE capability for the database owner.
- When calculating effective rights and permissions, the following will not be considered:
@@ -96,7 +96,7 @@ This report has the following filters:
## Usage example
-Database administrators need to discover who currently has access permissions to **FinReports**
+Database administrators need to discover who has access permissions to **FinReports**
database stored on the **SQLSrv01\SQLServer2016** instance. This instance is included in the
monitoring plan named _SQL Servers Monitoring_.
diff --git a/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlserveroverview.md b/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlserveroverview.md
index a61861eea0..399652270a 100644
--- a/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlserveroverview.md
+++ b/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlserveroverview.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# SQL Server State-In-Time Reports
-These are reports on the SQL Server state-in-time data, including roles, permissions and other
+These are reports on the SQL Server state-in-time data, including roles, permissions, and other
configuration settings:
- [Account Permissions in SQL Server](/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlaccountpermissions.md)
@@ -15,7 +15,7 @@ configuration settings:
- [SQL Server Means Granted](/docs/auditor/10.7/admin/reports/types/stateintime/sqlserveroverview/sqlmeansgranted.md)
- [SQL Server-Level Roles](/docs/auditor/10.7/admin/reports/types/stateintime/sqlroles.md)
-To instruct Netwrix Auditor to collect data needed for these reports, make sure that **Collect data
+To instruct Netwrix Auditor to collect data needed for these reports, ensure that **Collect data
for state-in-time reports** option is selected in the corresponding monitoring plan properties. See
the [Settings for Data Collection](/docs/auditor/10.7/admin/monitoringplans/create.md#settings-for-data-collection)
topic for additional information. By default, data collection will run daily at 4 AM.
diff --git a/docs/auditor/10.7/admin/reports/types/stateintime/vmware.md b/docs/auditor/10.7/admin/reports/types/stateintime/vmware.md
index 7fb8af50a3..ec31d7c5c7 100644
--- a/docs/auditor/10.7/admin/reports/types/stateintime/vmware.md
+++ b/docs/auditor/10.7/admin/reports/types/stateintime/vmware.md
@@ -13,7 +13,7 @@ permissions:
- Detailed Account Permissions in vCenter
- Object Permissions in vCenter
-To instruct Netwrix Auditor to collect data needed for these reports, make sure that **Collect data
+To instruct Netwrix Auditor to collect data needed for these reports, ensure that **Collect data
for state-in-time reports** option is selected in the corresponding monitoring plan properties. See
the [Settings for Data Collection](/docs/auditor/10.7/admin/monitoringplans/create.md#settings-for-data-collection)
topic for more information.
@@ -41,7 +41,7 @@ filters and values:
- Time zone — is set automatically.
- **Snapshot date** —select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in
[VMware](/docs/auditor/10.7/admin/monitoringplans/vmware/overview.md)
- Item — name of the item within your monitoring plan.
@@ -77,7 +77,7 @@ filters and values:
- Time zone — is set automatically.
- **Snapshot date** —select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in
[VMware](/docs/auditor/10.7/admin/monitoringplans/vmware/overview.md)
- Item — name of the item within your monitoring plan.
@@ -110,7 +110,7 @@ filters and values:
- Time zone — is set automatically.
- **Snapshot date** —select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in
[VMware](/docs/auditor/10.7/admin/monitoringplans/vmware/overview.md)
- Item — name of the item within your monitoring plan.
diff --git a/docs/auditor/10.7/admin/reports/types/userbehavior.md b/docs/auditor/10.7/admin/reports/types/userbehavior.md
index 5be4292bef..6c261ed367 100644
--- a/docs/auditor/10.7/admin/reports/types/userbehavior.md
+++ b/docs/auditor/10.7/admin/reports/types/userbehavior.md
@@ -14,7 +14,7 @@ identify vulnerabilities and easily answer questions such as:
- Have there been any unusual spikes in failed activity?
- Who is active outside of business hours and what are they doing?
- Has anyone put harmful files on corporate data storage?
-- Are there any files likely to contain credentials, Social Security numbers, PHI or other sensitive
+- Are there any files likely to contain credentials, Social Security numbers, PHI, or other sensitive
data?
Analytics reports can be found in the User Behavior and Blind Spot Analysis folder under the
@@ -22,7 +22,7 @@ Predefined node.
-If you are sure that some audit data is missing (e.g., you do not see information on your file
+If you are sure that some audit data is missing (e.g., you don't see information on your file
servers in reports and search results), verify that the Audit Database settings are configured and
that data is written to databases that reside on the default SQL Server instance.
diff --git a/docs/auditor/10.7/admin/reports/view.md b/docs/auditor/10.7/admin/reports/view.md
index 9362e31f64..6e48ea2254 100644
--- a/docs/auditor/10.7/admin/reports/view.md
+++ b/docs/auditor/10.7/admin/reports/view.md
@@ -41,7 +41,7 @@ To learn how to subscribe to a report, see [Create Subscriptions](/docs/auditor/
If no data is displayed in the report, you may need to do the following:
-1. Make sure that the Audit Database settings are configured properly in the monitoring plan, and
+1. Ensure that the Audit Database settings are configured properly in the monitoring plan, and
that data is written to databases that reside on the default SQL Server instance. See the
[Audit Database](/docs/auditor/10.7/admin/settings/auditdatabase.md) topic for additional information.
2. For SSRS-based reports - verify that SSRS (SQL Server Reporting Services) settings are configured
@@ -53,8 +53,8 @@ If no data is displayed in the report, you may need to do the following:
## Customize Report with Filters
-Report filters allow you to display changes matching certain criteria. For example, you can filter
-changes by audited domain or object type. Filtering does not delete changes, but modifies the report
+Report filters let you display changes matching certain criteria. For example, you can filter
+changes by audited domain or object type. Filtering doesn't delete changes, but modifies the report
view allowing you to see changes you are interested in. Filters can be found in the upper part of
the Preview Report page.
@@ -67,10 +67,10 @@ To apply filters
Wildcards are supported. For example, type _%corp\administrator%_ in the in the Who domain\user
field if you want to view changes made by the corp\administrator user only .
-Do not use % in the exclusive filters (e.g., Who (Exclude domain\user)). Otherwise, you will receive
+Don't use % in the exclusive filters (e.g., Who (Exclude domain\user)). Otherwise, you will receive
an empty report.
-_escape_characters_ are not supported.
+_escape_characters_ aren't supported.
The example below applies to the All Changes by Server report and shows the before and after views
of the report. The filters may vary slightly depending on the audited system and report type.
diff --git a/docs/auditor/10.7/admin/riskassessment/dashboard.md b/docs/auditor/10.7/admin/riskassessment/dashboard.md
index 5cd54b4264..6726e68001 100644
--- a/docs/auditor/10.7/admin/riskassessment/dashboard.md
+++ b/docs/auditor/10.7/admin/riskassessment/dashboard.md
@@ -38,7 +38,7 @@ button.
Default threshold values for risk levels are set in accordance with recommendations of
Netwrixindustry experts, as described in the [How Risk Levels Are Estimated ](/docs/auditor/10.7/admin/riskassessment/levels.md) topic. They
can be, however, easily customized to reflect your organization's internal security policies and
-standards. Follow the steps to customize the metrics.
+standards. To customize the metrics:
**Step 1 –** In the dashboard pane, select the metric you need and in the **Actions** section on the
right click Modify thresholds.
diff --git a/docs/auditor/10.7/admin/riskassessment/levels.md b/docs/auditor/10.7/admin/riskassessment/levels.md
index afe40e9b97..65c8ae0378 100644
--- a/docs/auditor/10.7/admin/riskassessment/levels.md
+++ b/docs/auditor/10.7/admin/riskassessment/levels.md
@@ -66,7 +66,7 @@ The following signs are used to define risk level intervals and threshold values
| Data | | |
| Files and folders accessible by Everyone | Files and folders shared with _Everyone_ security group /Overall number of shared folders (%) | - ≤ 1% — Low - (1% – 5%) — Medium - ≥ 5% — High |
| Sensitive data shared with Everyone | Number of sensitive files shared with the security groups "Everyone" and "Authenticated" / Total number of sensitive files (%). | - 0% — Low - (1% – 2%) — Medium - ≥ 2% — High |
-| Sensitive files shared with external users | Number of sensitive files shared with external users / Total number of sensitive files (%). Sharing sensitive data with external users (authenticated users who are not members of your Office 365 organization) may lead to data leaks. To reduce the risk of data leaks and non-compliance, control data sharing to external users. | - ≤ 5% — Low - (5% – 10%) — Medium - ≥ 10% — High |
+| Sensitive files shared with external users | Number of sensitive files shared with external users / Total number of sensitive files (%). Sharing sensitive data with external users (authenticated users who aren't members of your Office 365 organization) may lead to data leaks. To reduce the risk of data leaks and non-compliance, control data sharing to external users. | - ≤ 5% — Low - (5% – 10%) — Medium - ≥ 10% — High |
| Sensitive files shared with anonymous users | Number of sensitive files shared with anonymous users / Total number of sensitive files (%). Files may be shared with any users outside the Office 365 organization, so that any user with the link can access the file. This may lead to your sensitive content being highly exposed. To reduce the risk of data leaks, control data sharing to anonymous users. | - 0% — Low - (0% – 2%) — Medium - ≥ 2% — High |
| Sensitive documents accessible by Everyone | Number of sensitive documents accessible by Everyone or similar groups / Total number of sensitive documents (%). Only designated personnel should have access to your sensitive data. Thus, only public data should be accessible by the following predefined Office 365 groups: - Everyone - Everyone Except External Users - All Authenticated Users - All Forms Users - All Users | - 0% — Low - (0% – 5%) — Medium - ≥ 5% — High |
| File and folder names containing sensitive data | Number of files and folders with names that suggest they contain sensitive data | - 0 — Low - 1 — Medium - > 1 — High |
diff --git a/docs/auditor/10.7/admin/riskassessment/overview.md b/docs/auditor/10.7/admin/riskassessment/overview.md
index bb12269a66..3a8a969e3f 100644
--- a/docs/auditor/10.7/admin/riskassessment/overview.md
+++ b/docs/auditor/10.7/admin/riskassessment/overview.md
@@ -60,8 +60,8 @@ have at least one item added. See the following table for the certain reports:
connection. To check configuration status, go to Settings > Sensitive Data Discovery. See
[Sensitive Data Discovery ](/docs/auditor/10.7/admin/settings/sensitivedatadiscovery.md)for more information.
-**NOTE:** Right after setting up the integration the drill down reports might be empty, while the
-risk indicator is already completed. Please wait until Auditor gets all the information from Netwrix
+**NOTE:** Right after setting up the integration, detailed reports might be empty, while the
+risk indicator is already completed. wait until Auditor gets all the information from Netwrix
Data Classification it needs.
## Required Monitoring Plan Settings
@@ -78,16 +78,16 @@ To verify the necessary settings of the existing plan
1. Select the monitoring plan you need and click the **Edit** button.
2. In the right pane of the dialog displayed, select Edit settings from the Monitoring plan section.
-3. Go to the Audit Database section and make sure that Disable security intelligence ... checkbox is
+3. Go to the Audit Database section and ensure that Disable security intelligence ... checkbox is
cleared. This will instruct Netwrix Auditor to store data to both Long-Term Archive and audit
database:
-4. Save the settings and return to the window with the monitoring plan details. Make sure you have
+4. Save the settings and return to the window with the monitoring plan details. Ensure you have
at least one monitored item in the plan. If necessary, add an item.
5. Select the data source you need (for example, Active Directory) and click Edit data source from
the Data source section on the right.
-6. Make sure that:
+6. Ensure that:
1. Monitor this data source and collect activity data is switched ON.
2. Collect data for state-in-time reports is switched ON.
7. Save the settings and close the dialog.
diff --git a/docs/auditor/10.7/admin/search/filteradvanced.md b/docs/auditor/10.7/admin/search/filteradvanced.md
index 89c4f6f791..a7a7ef4c5d 100644
--- a/docs/auditor/10.7/admin/search/filteradvanced.md
+++ b/docs/auditor/10.7/admin/search/filteradvanced.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Use Filters in Advanced Mode
-Netwrix Auditor provides an advanced set of filters and match type operators that enable you to
+Netwrix Auditor provides an advanced set of filters and match type operators that let you
customize your searches even more precisely.
Switch to Advanced mode to review your current search in details and modify it if necessary. Click
@@ -32,17 +32,17 @@ information:
| Item | Limits your search to the selected item only. This filter can be helpful if you have several items of the same type in your monitoring plan (e.g., two Active Directory domains). Specify the name from the Value list or type it yourself. | Your monitoring plan is configured to track domains and includes your secured corporate domain and a domain for temporary employees. You are investigating who logged in your secured corporate domain outside business hours. You can set the Item filter to this domain name to limit the search results and exclude logons to computers from a less important domain. |
| Working hours | Limits your search results to entries that occurred within the specified hours. You can use this filter together with When if you need, for example, to search for activity in the non-business hours during the last week. | You are investigating an incident and want to know who accessed sensitive data outside business hours. You can set this filter as Not equal to and specify the time interval from 8:00 AM to 6:00 PM. Filtered data will include only operations that occurred outside this interval, that is, during non-business hours. |
| Data categories | Limits your search results to entries that contain sensitive data complying with a classification rule. You can use this filter together with Equal to PCIDSS to, for example, search for sensitive files that contain data regulated by the PCIDSS. | You are searching all documents containing cardholder data that can potentially be mapped with the PCIDSS compliance standard. You can set this filter as equal to and specify the value as PCIDSS. Filtered data will contain only files that match this criteria. This filter shows activity records collected from the following data sources: Windows File Servers, SharePoint, SharePoint Online. |
-| Details | Limits your search results to entries that contain the specified information in the Details column. The Details column normally contains data specific to your target, e.g., assigned permissions, before and after values, start and end dates. This filter can be helpful when you are looking for a unique entry. | You discovered that a registry key was updated to "242464". Now you want to investigate who made the change and what the value was before. You can set the Details filter to 242464 to find this change faster. |
+| Details | Limits your search results to entries that contain the specified information in the Details column. The Details column normally contains data specific to your target, e.g., assigned permissions, before and after values, and start and end dates. This filter can be helpful when you are looking for a unique entry. | You discovered that a registry key was updated to "242464". Now you want to investigate who made the change and what the value was before. You can set the Details filter to 242464 to find this change faster. |
| Before* | Limits your search results to entries that contain the specified before value in the Details column. | You are investigating an incident in which the SAM-account-name attribute was changed for an account in your Active Directory domain. You can set the Before filter to the previous name (e.g., John2000) to find the new name faster. |
| After* | Limits your search results to entries that contain the specified after value in the Details column. | You are investigating a security incident and want to know who enabled a local Administrator account on your Windows Server. You can set the After filter to this account's current state (e.g., Enabled) to find this change faster. |
| Everywhere | Limits your search results to entries that contain the specified value in any column. | You are investigating a security incident. You have already identified the intruder (e.g., BadActor) and now you want to see all actions made by the intruder's account or with it. Since the intruder can be the actor (Who), the object (What), or can even show up in details, set the Everywhere filter to the intruder's name. |
\* If you plan to audit an SQL Server for data changes and browse the results using 'Before' and
-'After' filter values, make sure that the audited SQL database tables have a primary key (or a
+'After' filter values, ensure that the audited SQL database tables have a primary key (or a
unique column). Otherwise, 'Before' and 'After' values will not be reported.
\* – If you plan to audit an SQL Server for data changes and browse the results using 'Before' and
-'After' filter values, make sure that the audited SQL database tables have a primary key (or a
+'After' filter values, ensure that the audited SQL database tables have a primary key (or a
unique column). Otherwise, 'Before' and 'After' values will not be reported.
## Search Conditions
@@ -53,22 +53,22 @@ example, Contains, Starts with, and so on.
-The following operators can be used to specify search conditions:
+The following operators lets you specify search conditions:
| Operator | Description | Example |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Contains | This operator shows all entries that contain a value specified in the filter. | If you set the Who filter to contains _John_, you will get the following results: _Domain1\John_, _Domain1\Johnson_, _Domain2\Johnny_, _John@domain.com_. |
-| Equals | This operator shows all entries with the exact value specified. Make sure to provide a full object name or path. To apply this operator when adding filters in the Simple mode, provide a value in quotation marks (e.g., _"Domain1\John"_). | Use this operator if you want to get precise results, e.g., _\\FS\Share\NewPolicy.docx_. |
+| Contains | This operator shows all entries that contain a value specified in the filter. This operator lets you perform a search. | If you set the Who filter to contains _John_, you will get the following results: _Domain1\John_, _Domain1\Johnson_, _Domain2\Johnny_, _John@domain.com_. |
+| Equals | This operator shows all entries with the exact value specified. Ensure to provide a full object name or path. To apply this operator when adding filters in the Simple mode, provide a value in quotation marks (e.g., _"Domain1\John"_). | Use this operator if you want to get precise results, e.g., _\\FS\Share\NewPolicy.docx_. |
| Not equal to | This operator shows all entries except those with the exact value specified. In the Search field in the Simple mode, this operator appears as not, e.g., Who not for the Who filter. | If you set the Who filter to not equal to _Domain1\John_, you will exclude the exact user specified and find all changes performed by other users, e.g., _Domain1\Johnson, Domain2\John_. |
| Starts with | This operator shows all entries that start with the specified value. | If you set the Who filter to starts with _Domain1\John_, you will find all changes performed by _Domain1\John_, _Domain1\Johnson_, and _Domain1\Johnny_. |
| Ends with | This operator shows all entries that end with the exact specified value. | If you set the Who filter to ends with _John_, you will find all changes performed by _Domain1\John_, _Domain2\Dr.John_, _Domain3\John_. |
-| Does not contain | This operator shows all entries except those that contain the specified value. In the Search field in the Simple mode, this operator appears as not, e.g., Who not for the Who filter. | If you set the Who filter to does not contain _John_, you will exclude the following users: _Domain1\John_, _Domain2\Johnson_, and _Johnny@domain.com_. |
+| Doesn't contain | This operator shows all entries except those that contain the specified value. In the Search field in the Simple mode, this operator appears as not, e.g., Who not for the Who filter. | If you set the Who filter to doesn't contain _John_, you will exclude the following users: _Domain1\John_, _Domain2\Johnson_, and _Johnny@domain.com_. |
| In group | This operator relates to the Who filter. It instructs Netwrix Auditor to show only data for the accounts included in the specified group. | If you set the In group condition for Who filter to _Domain\Administrators_, only the data for the accounts included in that group will be displayed. |
| Not in group | This operator relates to the Who filter. It instructs Netwrix Auditor to show only data for the accounts not included in the specified group. | If you set the Not in group condition for Who filter to _Domain\Administrators_, only the data for the accounts not included in that group will be displayed. |
When you add a new search filter, the Contains operator is used by default.
-To modify conditions for the selected filters, make sure you have switched to the Advanced search
+To modify conditions for the selected filters, ensure you have switched to the Advanced search
mode.
diff --git a/docs/auditor/10.7/admin/search/filtersimple.md b/docs/auditor/10.7/admin/search/filtersimple.md
index 77444aab06..4f3b0e8f16 100644
--- a/docs/auditor/10.7/admin/search/filtersimple.md
+++ b/docs/auditor/10.7/admin/search/filtersimple.md
@@ -13,8 +13,8 @@ Filters are used to narrow your search results. To create a unique set of filter
- Specify several values in the same filter to search for any of them (e.g., Action: Modified
or Action: Removed). To do this, select a filter again and specify a new value.
- Spaces do not separate values, so the whole expression will be included in your search as a
- single value. For example, if you want to search for any of three names, do not enter **Anna
+ Spaces don't separate values, so the whole expression will be included in your search as a
+ single value. For example, if you want to search for any of three names, don't enter **Anna
Mark Bill** but instead create a separate filter entry for each name.
## Filter Types
@@ -24,16 +24,16 @@ Filters are used to narrow your search results. To create a unique set of filter
| Who | Filter data by user (initiator) account. Specify an account name (e.g., John) to find all entries containing it (e.g., `Domain1\John`, `Domain1\Johnson`, `Domain2\Johnny`, `John@domain.com`). For exact match, use quotation marks and provide a user name in Domain\User or UPN format (e.g., `Domain1\John` or `John@domain.com`) . |
| Action | Filter data by action type (Added, Removed, etc.) Select an action type from the list (Added, Removed, Modified, Read). For additional actions, navigate to the Advanced mode. See the [Use Filters in Advanced Mode](/docs/auditor/10.7/admin/search/filteradvanced.md) topic for additional information. |
| What | Specify an object name (e.g., _Policy_) to find all entries containing it (e.g., _HiSecPolicy_, `\\FileSserver\Share\NewFolder\NewPolicy.docx`, `http://sharepoint/sites/collection1/Lists/Policy`). Netwrix Auditor searches across all data sources. For an exact match, use quotation marks and provide an object name in the format that is typical for your data source (e.g., `HiSecPolicy`). |
-| When | Filter data by the time interval when the change occurred. Specify a timeframe or provide a custom date range. Netwrix Auditor allows you to see changes that occurred today, yesterday, in the last 7 or 30 days, or within the specified date range. |
+| When | Filter data by the time interval when the change occurred. Specify a timeframe or provide a custom date range. You can see changes in Netwrix Auditor that occurred today, yesterday, in the last 7 or 30 days, or within the specified date range. |
| Where | Specify a resource name (e.g., _Enterprise_) to find all entries containing it (e.g., `Enterprise-SQL`, `FileStorage.enterprise.local`). The resource name can be a FQDN or NETBIOS server name, Active Directory domain or container, SQL Server instance, SharePoint farm, VMware host, etc. Netwrix Auditor searches across all data sources. For an exact match, use quotation marks and provide a resource name in the format that is typical for your data source (e.g., `Enterprise-SQL`). |
-Follow the steps to add a filter to your search.
+To add a filter to your search:
**Step 1 –** Click a filter type icon. Enter a value you want to search for.
-Alternatively, you can type a value directly into the Search field.
+Alternatively, you can enter a value directly into the Search field.
- For exact match, use quotation marks.
- To further restrict your search, right-click the value and select a filter from the pop-up menu.
@@ -49,7 +49,7 @@ value are shown.
| To... | Do... |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Modify filter | Double-click the filter and type a new value.  If you need to modify the When filter, delete it and add a new value, or navigate to the Advanced mode (Simple mode does not support its modification). |
+| Modify filter | Double-click the filter and enter a new value.  If you need to modify the When filter, delete it and add a new value, or navigate to the Advanced mode (Simple mode doesn't support its modification). |
| Remove filter | Click the **Close** icon next to it. |
## Exporting and Importing Filters
@@ -58,5 +58,5 @@ To export or import filters as regular expressions, use the **Tools** menu comma
| To... | Use... |
| ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Export | **Copy search** — copy the search filters that are currently applied to your search. This can be helpful if you want to share your search with a colleague (e.g., by pasting it in an email) or to modify a saved search query with your current filters. |
+| Export | **Copy search** — copy the search filters that are applied to your search. This can be helpful if you want to share your search with a colleague (e.g., by pasting it in an email) or to modify a saved search query with your current filters. |
| Import | **Paste search** — paste the search filters you copied before. These can be filters copied from a previous search or those someone shared with you. |
diff --git a/docs/auditor/10.7/admin/search/overview.md b/docs/auditor/10.7/admin/search/overview.md
index 0fbf4a7c33..3afc3254af 100644
--- a/docs/auditor/10.7/admin/search/overview.md
+++ b/docs/auditor/10.7/admin/search/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 40
# View and Search Collected Data
Netwrix Auditor delivers complete visibility into your IT infrastructure. Its convenient interactive
-search interface enables you to investigate incidents and browse data collected across the entire IT
-infrastructure. When running a search, you are not limited to a certain data source, change type, or
+search interface lets you investigate incidents and browse data collected across the entire IT
+infrastructure. When running a search, you aren't limited to a certain data source, change type, or
object name. You can create flexible searches that provide you with precise results on _who_ changed
_what_, and _when_ and _where_ each change was made.
@@ -18,7 +18,7 @@ access to data—only within their delegated scope. See the
[Role-Based Access and Delegation](/docs/auditor/10.7/admin/monitoringplans/delegation.md) topic for additional
information.
-This functionality is currently available for the following data sources:
+This functionality is available for the following data sources:
- Active Directory
- Microsoft Entra ID (formerly Azure AD)
@@ -48,9 +48,9 @@ Archive. See [Investigations](/docs/auditor/10.7/admin/settings/investigations.m
## Browsing Your Audit Data
-On the main Netwrix Auditor page, click
+On the main Netwrix Auditor page, to the left, click the search tile:
+
-on the left.
You can add any elements (a dashboard, report, alert, risk, etc.) to the Auditor Home screen to
access them instantly. See the [Navigation](/docs/auditor/10.7/admin/navigation/overview.md) and
@@ -114,7 +114,7 @@ a column or change its position, or hide the Details pane on the right.
To modify view:
1. Navigate to Tools
-2. Click Select columns. The dialog that opens shows the search columns currently selected for
+2. Click Select columns. The dialog that opens shows the search columns selected for
display.
3. Check the columns you want to include and clear unwanted ones.
4. Set the order of displayed columns using arrows on the right.
@@ -151,15 +151,15 @@ Navigate to Tools in the top right corner of the Search window and select the re
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Save as report | Save your search results as custom reports. |
| Create alert | Create an alert with the same set of filters you have just specified for your search. |
-| Subscribe | Create subscription for periodic delivery of the search query results. Subscription to the search results is not the same as creation of a custom report using this search. |
+| Subscribe | Create subscription for periodic delivery of the search query results. Subscription to the search results isn't the same as creation of a custom report using this search. |
| Export data | Save your search results as a _.pdf_ or _.csv_ file. All audit data from your search query results will be exported (unlike the interactive view which is limited to the top 2,000 entries). When exporting large amount of data (e.g., changes made by a newly retired employee during the last 8 months), it is recommended to use _.csv_ format. |
## Troubleshooting Tips
-If you do not see the expected information in search results, try the following:
+If you don't see the expected information in search results, try the following:
- Verify the Audit Database retention and SQL Server settings.
-- Make sure that data collection is configured properly in the monitoring plan settings.
+- Ensure that data collection is configured properly in the monitoring plan settings.
- Check the required audit settings in your monitored infrastructure.
- Verify the data collecting account.
diff --git a/docs/auditor/10.7/admin/settings/auditdatabase.md b/docs/auditor/10.7/admin/settings/auditdatabase.md
index 297bc451df..30cb233bae 100644
--- a/docs/auditor/10.7/admin/settings/auditdatabase.md
+++ b/docs/auditor/10.7/admin/settings/auditdatabase.md
@@ -26,7 +26,7 @@ will use a dedicated database to store data. So, there are two types of database
if needed.) See the [Fine-Tune Your Plan and Edit Settings](/docs/auditor/10.7/admin/monitoringplans/finetune.md) topic
for additional information.
-Follow the steps to review and update global Audit Database settings:
+To review and update global Audit Database settings:
**Step 1 –** Navigate to **Settings** > **Audit Database**.
@@ -39,8 +39,8 @@ Follow the steps to review and update global Audit Database settings:
| Option | Description |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Default SQL Server settings | Specify SQL Server instance name and connection settings. |
-| Database retention | Configure retention if you want audit data to be deleted automatically from your Audit Database after a certain period of time. These settings cannot be modified for a certain plan. |
-| SQL Server Reporting Services settings | Define the Report Server URL and account used to upload data to Report Server. These settings cannot be modified for a certain plan. |
+| Database retention | Configure retention if you want audit data to be deleted automatically from your Audit Database after a certain period of time. These settings can't be modified for a certain plan. |
+| SQL Server Reporting Services settings | Define the Report Server URL and account used to upload data to Report Server. These settings can't be modified for a certain plan. |
## Configure Default SQL Server Settings
@@ -49,7 +49,7 @@ Server settings section.
| Option | Description |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| SQL Server instance | Specify the name of the SQL Server instance to store audit data. If you have more than one Auditor Server running in your network, make sure to configure them to use different SQL Server instances. The same SQL Server instance cannot be used to store audit data collected by several Auditor Servers. |
+| SQL Server instance | Specify the name of the SQL Server instance to store audit data. If you have more than one Auditor Server running in your network, ensure to configure them to use different SQL Server instances. The same SQL Server instance can't be used to store audit data collected by several Auditor Servers. |
| Authentication | Select the authentication type you want to use to connect to the SQL Server instance: - Windows authentication - SQL Server authentication |
| User name | Specify the account to be used to connect to the SQL Server instance. This account must be granted the **database owner (db_owner)** role and the dbcreator server role. |
| Password | Enter a password. |
@@ -78,7 +78,7 @@ Reporting Services settings section.
| Option | Description |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Report Server URL | Specify the Report Server URL. Make sure that the resource is reachable. |
-| Report Manager URL | Specify the Report Manager URL. Make sure that the resource is reachable. |
-| User name | Specify the account to connect to SSRS. Use the following format: _domain\username_ or _hostname\username_ Workgroup format (_.\username_) is not supported. Use _hostname\username_ instead. Make sure this account is granted the Content Manager role on the Report Server. See the [SQL Server Reporting Services](/docs/auditor/10.7/requirements/sqlserverreportingservice.md) topic for additional information. |
+| Report Server URL | Specify the Report Server URL. ensure that the resource is reachable. |
+| Report Manager URL | Specify the Report Manager URL. ensure that the resource is reachable. |
+| User name | Specify the account to connect to SSRS. Use the following format: _domain\username_ or _hostname\username_ Workgroup format (_.\username_) isn't supported. Use _hostname\username_ instead. ensure this account is granted the Content Manager role on the Report Server. See the [SQL Server Reporting Services](/docs/auditor/10.7/requirements/sqlserverreportingservice.md) topic for additional information. |
| Password | Enter a password. |
diff --git a/docs/auditor/10.7/admin/settings/custombrand.md b/docs/auditor/10.7/admin/settings/custombrand.md
index 104b8d6554..8bc494da97 100644
--- a/docs/auditor/10.7/admin/settings/custombrand.md
+++ b/docs/auditor/10.7/admin/settings/custombrand.md
@@ -7,7 +7,7 @@ sidebar_position: 110
# Customize Branding
Netwrix Auditor allows customizing look and feel of your reports, search subscriptions and exported
-search results—you can skip Netwrix logo, add your company logo and title. However, users are not
+search results—you can skip Netwrix logo, add your company logo and title. However, users aren't
empowered to customize layout or color scheme.
Review the following for additional information:
@@ -26,11 +26,13 @@ You can customize branding for the following AuditIntelligence outputs:
- Overview dashboard exported to pdf file;
- Overview dashboard delivered in the subscription email.
-Please note the following rebranding limitations and requirements to the logo file:
+:::note
+Rebranding limitations and requirements for logo files:
+:::
-1. Make sure you have full Netwrix Auditor installation: Netwrix Auditor Server and Client to enable
+1. Ensure you have full Netwrix Auditor installation: Netwrix Auditor Server and Client to enable
rebranding.
-2. Since Netwrix applies company's logo as is, keep in mind reasonable limitations of your logo
+2. Since Netwrix applies company's logo as is, be aware of reasonable limitations of your logo
dimensions. You can find examples of appropriate logo files in the rebranding archive (file
LLogo.webp). Re-size your logo and verify that subscriptions emails and pdf files look fine after
rebranding.
@@ -40,7 +42,7 @@ Please note the following rebranding limitations and requirements to the logo fi
- For subscription emails, just put the logo file to _%ALLUSERSPROFILE%\Netwrix
Auditor\Branding_ and run the script to update email look and feel.
- - For exported pdf files, make sure that the logo file is located in the default directory for
+ - For exported pdf files, ensure that the logo file is located in the default directory for
each user that is going to work with exported search results, Risk Assessment and Overview
dashboards. Otherwise, specify custom path to logo file. Default path to logo for exported
files is _%LOCALAPPDATA%\Netwrix Auditor\Audit Intelligence\Resources_.
@@ -55,7 +57,7 @@ installed.
**Step 3 –** Run SearchRebranding.ps1 considering the following:
-- Use default paths to logo files—Run the script and type your company name as the `report_title`.
+- Use default paths to logo files—Run the script and enter your company name as the `report_title`.
- Use custom paths to logo files—run the script as follows:
`SearchRebranding.ps1 -subscriptions_logo_path -export_logo_path `
@@ -75,7 +77,7 @@ By default, Netwrix Auditor reports look as follows:
Report branding is customized on Netwrix Auditor Server side that means that all clients connected
to this server will have the same look and feel for reports.
-Follow the steps to customize branding.
+To customize branding:
**Step 1 –** On the computer where Auditor Server resides, navigate to _C:\Program Data\Netwrix
Auditor\Rebranding_.
@@ -105,7 +107,7 @@ be updated.
-Follow the steps to restore original look.
+To restore original look:
**Step 1 –** On the computer where Auditor Server resides, navigate to the script location.
diff --git a/docs/auditor/10.7/admin/settings/general.md b/docs/auditor/10.7/admin/settings/general.md
index ccf7059caa..bdd602c6fd 100644
--- a/docs/auditor/10.7/admin/settings/general.md
+++ b/docs/auditor/10.7/admin/settings/general.md
@@ -7,14 +7,14 @@ sidebar_position: 10
# General
On the General tab you can configure global Netwrix Auditor settings, e.g., self-audit, tags,
-accounts and passwords.
+accounts, and passwords.
Review the following for additional information:
| Option | Description |
| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Self-audit | Select to enable data collection for product self-auditing. Self-audit allows tracking every change to monitoring plan, data source, and audit scope and details about it (before-after values) so that you know that scope of data to be audited is complete and changed only in line with workflows adopted by our organization. Review the following for additional information: - [Netwrix Auditor Operations and Health](/docs/auditor/10.7/admin/healthstatus/overview.md) |
+| Self-audit | Select to enable data collection for product self-auditing. Self-audit allows tracking every change to monitoring plan, data source, and audit scope and details about it (before-after values) so that you know that scope of data to be audited is complete and changed only in line with workflows adopted by your organization. Review the following for additional information: - [Netwrix Auditor Operations and Health](/docs/auditor/10.7/admin/healthstatus/overview.md) |
| Netwrix Auditor usage statistics | It is optional on your part to help Netwrix improve the quality, reliability, and performance of Netwrix products and services. If selected, Netwrix collects statistical information on how the Licensee uses the product in accordance with applicable law. Visit [Netwrix Corporation Software License Agreement](https://www.netwrix.com/eula.html) for additional information about the program. You can review a sample piece of data if you are interested in data acquired by Netwrix. |
-| Tags | Netwrix Auditor allows you to apply tags when creating an alert. With alerts, you can distinguish one alert from another, create groups of similar alerts, etc. The Tags page contains a complete list of alerts that were ever created in the product. See the [Alerts](/docs/auditor/10.7/admin/alertsettings/overview.md) topic for additional information. Currently, you cannot assign or create tags on this page. To apply tags to an alert, navigate to alert settings and locate the Apply tags section on the General tab. See the [Create Alerts](/docs/auditor/10.7/admin/alertsettings/create/create.md) topic for additional information. |
-| Account and passwords | Netwrix Auditor allows you to assign different accounts for monitoring plans. Click **Manage** to review the full list of accounts and associated auditing scope. You can also change accounts' password if necessary. |
+| Tags | Netwrix Auditor lets you apply tags when creating an alert. With alerts, you can distinguish one alert from another, create groups of similar alerts, etc. The Tags page contains a complete list of alerts that were ever created in the product. See the [Alerts](/docs/auditor/10.7/admin/alertsettings/overview.md) topic for additional information. you can't assign or create tags on this page. To apply tags to an alert, navigate to alert settings and locate the Apply tags section on the General tab. See the [Create Alerts](/docs/auditor/10.7/admin/alertsettings/create/create.md) topic for additional information. |
+| Account and passwords | Netwrix Auditor lets you assign different accounts for monitoring plans. Click **Manage** to review the full list of accounts and associated auditing scope. You can also change accounts' password if necessary. |
| Access Reviews | Netwrix Auditor supports integration with Netwrix Auditor Access Reviews, which enables business owners to conduct resource and group reviews and recommend changes. See the [Access Reviews](/docs/auditor/10.7/accessreviews/accessreviews.md) topic for additional information. |
diff --git a/docs/auditor/10.7/admin/settings/integrations.md b/docs/auditor/10.7/admin/settings/integrations.md
index 1bd5124c05..b7db53d97d 100644
--- a/docs/auditor/10.7/admin/settings/integrations.md
+++ b/docs/auditor/10.7/admin/settings/integrations.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# Integrations
-Netwrix Auditor Integration API—endless integration, auditing and reporting capabilities.
+Netwrix Auditor Integration API—endless integration, auditing, and reporting capabilities.
The Netwrix Auditor Integration API provides access to audit data collected by Netwrix Auditor
through REST API endpoints. According to the RESTful model, each operation is associated with a URL.
@@ -26,5 +26,5 @@ Netwrix recommends adding a special data source to your monitoring plan—Netwri
In Netwrix Auditor 9.0, Netwrix has updated API schemas. See the
[Compatibility Notice](/docs/auditor/10.7/api/compatibility.md) topic for additional information.
-To learn more about Integration API capabilities, refer to the
+For details on Integration API capabilities, see the
[Integration API](/docs/auditor/10.7/api/overview.md).
diff --git a/docs/auditor/10.7/admin/settings/investigations.md b/docs/auditor/10.7/admin/settings/investigations.md
index 40e6561a69..d47d2f4022 100644
--- a/docs/auditor/10.7/admin/settings/investigations.md
+++ b/docs/auditor/10.7/admin/settings/investigations.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Investigations
-By default, the Audit Database stores data up to 180 days. Once the retention period is over, the
+By default, the Audit Database stores data up to 180 days. After the retention period is over, the
data is deleted from the Audit Database and becomes unavailable for reporting and search.
Depending on your company requirements you may need to investigate past incidents and browse old
@@ -28,11 +28,11 @@ investigation data, you must be assigned the Global administrator or Global revi
| Option | Description |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| SQL Server Instance | Specify the name of the SQL Server instance to import your audit data to. If you want to run searches and generate reports, select the same SQL Server instance as the one specified on Settings → Audit Database page. See [Audit Database](/docs/auditor/10.7/admin/settings/auditdatabase.md) topic for more information. |
- | Database | Select import database name. By default, data is imported to a specially created the Netwrix_ImportDB database but you can select any other. Do not select databases that already contain data. Selecting such databases leads to data overwrites and loss. |
+ | Database | Select import database name. By default, data is imported to a specially created the Netwrix_ImportDB database but you can select any other. Don't select databases that already contain data. Selecting such databases leads to data overwrites and loss. |
| Authentication | Select the authentication type you want to use to connect to the SQL Server instance: - Windows authentication - SQL Server authentication |
| User name | Specify the account to be used to connect to the SQL Server instance. This account must be granted the **database owner (db_owner)** role and the dbcreator server role. |
| Password | Enter a password. |
- | Clear imported data | Select to delete all previously imported data. To prevent SQL Server from overfilling, it is recommended to clear imported data once it is longer needed. |
+ | Clear imported data | Select to delete all previously imported data. To prevent SQL Server from overfilling, it is recommended to clear imported data after it is no longer needed. |
3. Review your New investigation configuration. Click Configure to specify the import scope.
@@ -40,6 +40,6 @@ investigation data, you must be assigned the Global administrator or Global revi
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| From... To... | Specify the time range for which you want to import past audit data. |
| Data sources | Select data sources whose audit data you want to import to the Audit Database. |
- | Monitoring plans | Select monitoring plans whose audit data you want to import to the Audit Database. Netwrix Auditor lists monitoring plans that are currently available in the product configuration. Select All to import audit data for all monitoring plans, including those that were removed from the product (or removed and then recreated with the same name—Netwrix Auditor treats them as different monitoring plans). For example, you had a monitoring plan corp.local used for auditing Active Directory. You removed this monitoring plan, but its audit data was preserved in the Long-Term Archive. Then, you created a new monitoring plan for auditing Exchange and named it corp.local again. Its data is also stored in the Long-Term Archive. Netwrix Auditor treats both corp.local monitoring plans—the removed and the current—as different. If you select corp.local in the monitoring plans list, only Exchange data will be imported to Audit Database (as it corresponds to the current monitoring plan configuration). To import Active Directory data from the removed monitoring plan, select All monitoring plans. |
+ | Monitoring plans | Select monitoring plans whose audit data you want to import to the Audit Database. Netwrix Auditor lists monitoring plans that are available in the product configuration. Select All to import audit data for all monitoring plans, including those that were removed from the product (or removed and then recreated with the same name—Netwrix Auditor treats them as different monitoring plans). For example, you had a monitoring plan corp.local used for auditing Active Directory. You removed this monitoring plan, but its audit data was preserved in the Long-Term Archive. Then, you created a new monitoring plan for auditing Exchange and named it corp.local again. Its data is also stored in the Long-Term Archive. Netwrix Auditor treats both corp.local monitoring plans—the removed and the current—as different. If you select corp.local in the monitoring plans list, only Exchange data will be imported to Audit Database (as it corresponds to the current monitoring plan configuration). To import Active Directory data from the removed monitoring plan, select All monitoring plans. |
4. Click Run.
diff --git a/docs/auditor/10.7/admin/settings/licenses.md b/docs/auditor/10.7/admin/settings/licenses.md
index 4cb6cc8f8b..73c9d33e56 100644
--- a/docs/auditor/10.7/admin/settings/licenses.md
+++ b/docs/auditor/10.7/admin/settings/licenses.md
@@ -6,11 +6,11 @@ sidebar_position: 90
# Licenses
-The Licenses tab allows you to review the status of your current licenses, update them and add new
-licenses. To learn about Netwrix Auditor licenses, refer to the following Netwrix Knowledge Base
-article: [Netwrix Auditor Licensing FAQs](https://www.netwrix.com/kb/2113).
+The Licenses tab lets you review the status of your current licenses, update them, and add new
+licenses. For information about Netwrix Auditor licenses, see the
+[Netwrix Auditor Licensing FAQs](https://www.netwrix.com/kb/2113).
-Follow the steps to update or add a license.
+To update or add a license:
**Step 1 –** Click **Update**.
diff --git a/docs/auditor/10.7/admin/settings/longtermarchive.md b/docs/auditor/10.7/admin/settings/longtermarchive.md
index 37564076e7..2d3f7efe8b 100644
--- a/docs/auditor/10.7/admin/settings/longtermarchive.md
+++ b/docs/auditor/10.7/admin/settings/longtermarchive.md
@@ -17,7 +17,7 @@ Review the following for additional information:
| Option | Description |
| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Long-Term Archive settings | |
-| Write audit data to | Specify the path to a local or shared folder where your audit data will be stored. By default, it is set to _"C:\ProgramData\Netwrix Auditor\Data"_. By default, the LocalSystem account is used to write data to the local-based Long-Term Archive and computer account is used for the file share-based storage. Subscriptions created in the Auditor client are uploaded to file servers under the Long-Term Archive service account as well. It is not recommended to store your Long-Term Archive on a system disk. If you want to move the Long-Term Archive to another location, refer to the following Netwrix Knowledge base article: [How to move Long-Term Archive to a new location](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/how-to-move-long-term-archive-to-a-new-location). |
+| Write audit data to | Specify the path to a local or shared folder where your audit data will be stored. By default, it is set to _"C:\ProgramData\Netwrix Auditor\Data"_. By default, the LocalSystem account is used to write data to the local-based Long-Term Archive and computer account is used for the file share-based storage. Subscriptions created in the Auditor client are uploaded to file servers under the Long-Term Archive service account as well. It isn't recommended to store your Long-Term Archive on a system disk. If you want to move the Long-Term Archive to another location, see Netwrix Knowledge base article: [How to move Long-Term Archive to a new location](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/how-to-move-long-term-archive-to-a-new-location). |
| Keep audit data for (in months) | Specify how long data will be stored. By default, it is set to 120 months. |
| Use custom credentials (for the file share-based Long-Term Archive only) | Select the checkbox and provide user name and password for the Long-Term Archive service account. You can specify a custom account only for the Long-Term Archive stored on a file share. The custom Long-Term Archive service account can be granted the following rights and permissions: - Advanced permissions on the folder where the Long-term Archive is stored: - List folder / read data - Read attributes - Read extended attributes - Create files / write data - Create folders / append data - Write attributes - Write extended attributes - Delete subfolders and files - Read permissions - On the file shares where report subscriptions are saved: - Change share permission - Create files / write data folder permission Subscriptions created in the Auditor client are uploaded to file servers under the Long-Term Archive service account as well. See the [Subscriptions](/docs/auditor/10.7/admin/subscriptions/overview.md) topic for additional information. |
@@ -28,10 +28,10 @@ Setting Recording Settings
| | |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Configure custom location of session recordings | Default location for storing session recordings is set to _"\\``\Netwrix_UAVR$"_. However, storing extra files on the Auditor Server may produce additional load on it, so consider using this option to specify another location where session recordings will be stored. |
-| Enter UNC path to shared folder: | Specify UNC path to the shared folder where user session video recordings will be stored. You can use server name or IP address, for example: _\\172.28.6.33\NA_UserSessions_ Using a local folder for that purpose is not recommended, as storing extra files on the Auditor Server will produce additional load on it. Make sure the specified shared folder has enough capacity to store the video files. Retention period for the video files can be adjusted in the related monitoring plan settings (targeted at User Activity data source); default retention is 7 days. See the [User Activity](/docs/auditor/10.7/admin/monitoringplans/overview_1.md) topic for additional information. After you specify and save settings for session recordings, it is recommended that you leave them unchanged. Otherwise — if you change the storage location while using Netwrix Auditor for User Activity — please be aware of possible data loss, as Auditor will not automatically move session recordings to a new location. |
-| User name / Password | Provide user name and password for the account that will be used to store session recordings to the specified shared folder. Make sure the account has at least the Write permission for that folder. |
+| Enter UNC path to shared folder: | Specify UNC path to the shared folder where user session video recordings will be stored. You can use server name or IP address, for example: _\\172.28.6.33\NA_UserSessions_ Using a local folder for that purpose isn't recommended, as storing extra files on the Auditor Server will produce additional load on it. Ensure the specified shared folder has enough capacity to store the video files. Retention period for the video files can be adjusted in the related monitoring plan settings (targeted at User Activity data source); default retention is 7 days. See the [User Activity](/docs/auditor/10.7/admin/monitoringplans/overview_1.md) topic for additional information. After you specify and save settings for session recordings, ensure you leave them unchanged. Otherwise — if you change the storage location while using Netwrix Auditor for User Activity — be aware of possible data loss, as Auditor will not automatically move session recordings to a new location. |
+| User name / Password | Provide user name and password for the account that will be used to store session recordings to the specified shared folder. ensure the account has at least the Write permission for that folder. |
Auditor informs you if you are running out of space on a system disk where the Long-Term Archive is
-stored by default. You will see events in the Netwrix Auditor **System Health** log once the free
+stored by default. You will see events in the Netwrix Auditor **System Health** log after the free
disk space starts approaching minimum level. When the free disk space is less than 3 GB, the
Netwrix services responsible for audit data collection will be stopped.
diff --git a/docs/auditor/10.7/admin/settings/notifications.md b/docs/auditor/10.7/admin/settings/notifications.md
index 52a21bbc48..b585555bbb 100644
--- a/docs/auditor/10.7/admin/settings/notifications.md
+++ b/docs/auditor/10.7/admin/settings/notifications.md
@@ -57,7 +57,6 @@ could use the application to send email. To do this, the following actions requi
### Create a Group
-Follow the steps to create a group.
**Step 1 –** Log in to the Exchange admin center with your administrator account.
@@ -78,15 +77,13 @@ the group.
### Add Email to a Group
-Follow the steps to add emails to group.
-**Step 1 –** In the Exchange admin cente go to Groupsand click on the [Mail-enabled security] tab.
+**Step 1 –** In the Exchange admin cente go to Groupsand click the [Mail-enabled security] tab.
-**Step 2 –** Click on the group you have created and add emails you want to allow APIs to access.
+**Step 2 –** Click the group you have created and add emails you want to allow APIs to access.
### Apply Restriction Using PowerShell Commands
-Follow the steps to run following commands using PowerShell.
**Step 1 –** Open PowerShell
@@ -124,14 +121,14 @@ and click Modify to adjust them if necessary.
| Port number | Specify your SMTP server port number. |
| Sender address | Enter the address that will appear in the From field. **_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. |
| SMTP authentication | Select this checkbox if your mail server requires the SMTP authentication. |
-| Sender email (from) | Enter the address that will appear in the "_From_" field in email notifications. This option does not affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, make sure that your Exchange supports this option. |
+| Sender email (from) | Enter the address that will appear in the "_From_" field in email notifications. This option doesn't affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, ensure that your Exchange supports this option. |
| User name | Enter a user name for the SMTP authentication. |
| Password | Enter a password for SMTP authentication. |
| Use Secure Sockets Layer encrypted connection (SSL/TLS) | Select this checkbox if your SMTP server requires SSL to be enabled. |
| Use implicit SSL anthentification | Select this checkbox if the implicit SSL mode is used, which means that an SSL connection is established before any meaningful data is sent. |
-| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option is not available for auditing User Activity as well Netwrix Auditor tools. |
+| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option isn't available for auditing User Activity as well Netwrix Auditor tools. |
-You can configure Activity Summary frequency, format and delivery time for each monitoring plan
+You can configure Activity Summary frequency, format, and delivery time for each monitoring plan
individually. See the [Fine-Tune Your Plan and Edit Settings](/docs/auditor/10.7/admin/monitoringplans/finetune.md) topic
for more information.
@@ -140,17 +137,15 @@ emails.
## Summary Emails and Notifications about Critical Events
-Follow the steps to send summary emails and notifications about critical events.
-
**Step 1 –** Navigate to the Summary email recipient and click Modify.
**Step 2 –** Specify recipient address:
- To send to a single recipient, enter personal mailbox address.
-- To send to multiple recipients, make sure they are added to a distribution group, and enter the
- group address. Entering multiple individual addresses is not supported.
+- To send to multiple recipients, ensure they are added to a distribution group, and enter the
+ group address. Entering multiple individual addresses isn't supported.
-To learn more about product health, you can also navigate to the Health status tile in the main
+For more information about product health, navigate to the Health status tile in the main
window. It will take you to the Health Status dashboard that contains information on the product
activity and system health state. See the
[Health Status Dashboard](/docs/auditor/10.7/admin/healthstatus/dashboard/overview.md) topic for additional information.
diff --git a/docs/auditor/10.7/admin/settings/privilegesecure.md b/docs/auditor/10.7/admin/settings/privilegesecure.md
index 9852f50703..581bf3a7ec 100644
--- a/docs/auditor/10.7/admin/settings/privilegesecure.md
+++ b/docs/auditor/10.7/admin/settings/privilegesecure.md
@@ -56,7 +56,7 @@ The integration can be configured for the following Auditor data sources:
## Enable and Configure Netwrix Privilege Secure Integration
-Follow the steps to enable and configure Netwrix Privilege Secure integration.
+enable and configure Netwrix Privilege Secure integration:
**Step 1 –** In Netwrix Auditor, navigate to Settings in the upper right corner.
@@ -70,7 +70,7 @@ Follow the steps to enable and configure Netwrix Privilege Secure integration.
options are available:
- New/Generate certificate – Create a new certificate.
-- Select an existing certificate – Select an available certificate from the drop-down list.
+- Select an existing certificate – Select an available certificate from the dropdown list.
@@ -84,7 +84,7 @@ the steps below:
Console).
2. **Click File > Add/Remove Snap-in...** and locate Certificates icon.
3. In the pop-up window, select the **Computer account** and click **Next**.
-4. Make sure that the **Local Computer** option is selected in the next window, then click
+4. Ensure that the **Local Computer** option is selected in the next window, then click
**Finish**. The Certificates menu will appear.
5. Go to **Certificates (Local Computer) > Personal > Certificates > `{Certificate Name}`** and
click **Export**.
@@ -117,7 +117,7 @@ documentation for additional instructions.
**Step 12 –** After the validation, click **Finish**.
Integration between Netwrix Auditor and Netwrix Privilege Secure is established. Before using the
-Netwrix Privilege Secure for data collection in Netwrix Auditor, make sure that you created a
+Netwrix Privilege Secure for data collection in Netwrix Auditor, ensure that you created a
dedicated Access Policy and Connection Profile in Netwrix Privilege Secure. Refer to the
[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
documentation for additional information.
diff --git a/docs/auditor/10.7/admin/settings/sensitivedatadiscovery.md b/docs/auditor/10.7/admin/settings/sensitivedatadiscovery.md
index 76a99a2180..389335aa14 100644
--- a/docs/auditor/10.7/admin/settings/sensitivedatadiscovery.md
+++ b/docs/auditor/10.7/admin/settings/sensitivedatadiscovery.md
@@ -8,8 +8,7 @@ sidebar_position: 80
Sensitive Data Discovery is an integration module between Auditor and Netwrix Data Classification.
It allows Auditor users to generate reports and configure alerts and search for the sensitive data
-collected and classified with Netwrix Data Classification (NDC). Refer to the following
-documentation to learn more about NDC:
+collected and classified with Netwrix Data Classification (NDC). For more information about NDC, see the following resource:
- [ ](https://helpcenter.netwrix.com/bundle/DataClassification_5.6.2/page/NDC_Overview.html)[Netwrix Data Classification Documentation](https://helpcenter.netwrix.com/category/dataclassification)
@@ -35,10 +34,10 @@ Databases
The following integration options are available:
-- NDC SQL Database Provider – This integration allows users to generate State-in-Time reports
+- NDC SQL Database Provider – With this integration, you can generate State-in-Time reports
showing data categories for the sensitive data classified with Netwrix Data Classification.
Available for File storage systems, SharePoint, and SharePoint Online.
-- NDC Endpoint Provider – This integration allows users to receive alerts triggered by specific
+- NDC Endpoint Provider – This integration triggers alerts triggered by specific
events related to the sensitive data classified with Netwrix Data Classification. When enabled,
Netwrix users can also browse sensitive data with the search. Available for File storage systems
(including Windows file server, EMC, NetApp, Nutanix File server, Synology, and Qumulo),
@@ -58,7 +57,7 @@ The account must be granted the following rights and permissions:
Netwrix recommends using different accounts to connect to the SQL Server instances where NDC SQL
database and Categories database reside.
-**NOTE:** Netwrix Data Classification and Netwrix Auditor integration (NDC Provider) currently does
+**NOTE:** Netwrix Data Classification and Netwrix Auditor integration (NDC Provider) does
not support Single Sign-On. Single Sign-on needs to be disabled in Netwrix Data Classification in
order for the account used by the NDC Provider to authenticate.
@@ -139,7 +138,6 @@ steps to enable and configure Sensitive Data Discovery:
## What is Next
-Follow the steps to run a data collection and review sensitive data.
**Step 1 –** Navigate to your File storage system, SharePoint, SharePoint Online, or SQL Server
monitoring plan.
@@ -156,24 +154,17 @@ Netwrix suggests the following integration scenarios:
For NDC SQL Database Provider:
-Review your sensitive data in Data Discovery and Classification reports. Refer to the following
+Review your sensitive data in Data Discovery and Classification reports. See
Netwrix Auditor help center article for more information about these reports:
[Data Discovery and Classification Reports](/docs/auditor/10.7/admin/reports/types/datadiscoveryclassification.md).
ForNDC Endpoint Provider:
- Browse your data with Netwrix search.
-- **NOTE:** Shortly after the data collection, changes related to sensitive content are reported
- without data categories. For example, if a user adds some sensitive data to the SharePoint Online
- document that initially does not contain sensitive data; this will be reported as document
- modification with empty "_data categories_" field. Another example: a user creates a new document
- containing sensitive data on a file server; this will be reported as a file add with empty "data
- categories" field. In this case, you have to wait until Netwrix Auditor processes information
- collected by NDC. It takes a while depending on a number of processed objects in your
- infrastructure and reindexing settings configured in Netwrix Data Classification. See the Manage
- Sources and Control Data Processing topic in the
- [Netwrix Data Classification Documentation](https://helpcenter.netwrix.com/category/dataclassification)
- for additional information.
+
+:::note
+Shortly after the data collection, changes related to sensitive content are reported without data categories. For example, if a user adds some sensitive data to the SharePoint Online document that initially doesn't contain sensitive data, this will be reported as document modification with empty "_data categories_" field. Similarly, if a user creates a new document containing sensitive data on a file server, this will be reported as a file add with empty "data categories" field. In this case, you must wait until Netwrix Auditor processes information collected by NDC. This takes a while depending on the number of processed objects in your infrastructure and reindexing settings configured in Netwrix Data Classification. See the Manage Sources and Control Data Processing topic in the [Netwrix Data Classification Documentation](https://helpcenter.netwrix.com/category/dataclassification) for additional information.
+:::
- Click the **Select** column in the Tools menu and review data categories (taxonomies) of your
sensitive documents.
- Use filtering capabilities to narrow your search results. See the
diff --git a/docs/auditor/10.7/admin/subscriptions/create.md b/docs/auditor/10.7/admin/subscriptions/create.md
index b1108e4e97..2980814ecf 100644
--- a/docs/auditor/10.7/admin/subscriptions/create.md
+++ b/docs/auditor/10.7/admin/subscriptions/create.md
@@ -26,9 +26,9 @@ information.
| ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
| Subscription name | Enter the name for the subscription. |
- | Report name _OR_ Email subject | For report subscription—You cannot edit report name. For subscription to search and risk assessment overview—Specify email subject to identify subscription emails from Auditor. For example, "_Successful read attempts on important file shares_". |
+ | Report name _OR_ Email subject | For report subscription—You can't edit report name. For subscription to search and risk assessment overview—Specify email subject to identify subscription emails from Auditor. For example, "_Successful read attempts on important file shares_". |
| Send empty subscriptions when no activity occurred Available for report and search subscriptions only. | Slide the switch to Yes if you want to receive a report even if no changes occurred. |
- | Specify delivery options | - File format—Configure reports to be delivered as the pdf or csv files for search subscriptions; and pdf, docx, csv or xls files for report subscriptions. Available for report and search subscriptions only. - File delivery—Select delivery method: - Attach to email—Select this option to receive data as email attachments. The maximum size of the attachment file is 50 MB. Attachments larger than 50MB will be uploaded to _\\``\Netwrix_Auditor_Subscriptions$\LostAndFound_ folder on Netwrix Auditor server. They will be available for 7 days. Check the subscription email to get the files. - Upload to a file share—Select this option to save data on the selected file share. Click Browse to select a folder on the computer that hosts Auditor Server or specify a UNC path to a shared network resource. Make sure that the recipients have sufficient rights to access it and the Long-Term Archive service account has sufficient rights to upload reports. See the [File-Based Repository for Long-Term Archive](/docs/auditor/10.7/requirements/longtermarchive.md) topic for additional information. **NOTE:** Make sure that the AD Computer account for the Auditor host server also has read access on the file share where the Subscriptions are being uploaded. |
+ | Specify delivery options | - File format—Configure reports to be delivered as the pdf or csv files for search subscriptions; and pdf, docx, csv, or xls files for report subscriptions. Available for report and search subscriptions only. - File delivery—Select delivery method: - Attach to email—Select this option to receive data as email attachments. The maximum size of the attachment file is 50 MB. Attachments larger than 50MB will be uploaded to _\\``\Netwrix_Auditor_Subscriptions$\LostAndFound_ folder on Netwrix Auditor server. They will be available for 7 days. Check the subscription email to get the files. - Upload to a file share—Select this option to save data on the selected file share. Click Browse to select a folder on the computer that hosts Auditor Server or specify a UNC path to a shared network resource. Ensure that the recipients have sufficient rights to access it and the Long-Term Archive service account has sufficient rights to upload reports. See the [File-Based Repository for Long-Term Archive](/docs/auditor/10.7/requirements/longtermarchive.md) topic for additional information. **NOTE:** ensure that the AD Computer account for the Auditor host server also has read access on the file share where the Subscriptions are being uploaded. |
| Other tabs | |
| Recipients | Shows the number of recipients selected and allows specifying emails where reports are to be sent. Expand the Recipients list and click Add to add more recipients. |
| Schedule | Allows specifying report delivery schedule (daily, certain days of week, a certain day of a certain month). By default, risk assessment overview and search subscription delivery is scheduled to 7.00 am daily, report subscription delivery - to 8.00 am daily. |
diff --git a/docs/auditor/10.7/admin/subscriptions/manage.md b/docs/auditor/10.7/admin/subscriptions/manage.md
index b7e25f30d4..938364cd8a 100644
--- a/docs/auditor/10.7/admin/subscriptions/manage.md
+++ b/docs/auditor/10.7/admin/subscriptions/manage.md
@@ -14,7 +14,7 @@ The table below provides instructions on how to manage your subscriptions.
| To... | Do... |
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Browse subscriptions | Type the target subscription name in the search bar in the upper part of the Subscriptions window and click the Search icon to review results. |
+| Browse subscriptions | Enter the target subscription name in the search bar in the upper part of the Subscriptions window and click the Search icon to review results. |
| Enable or disable subscriptions | Pick a subscription and select On or Off in the Mode column. |
| Modify subscriptions | Select the subscription that you want to modify and click Edit at the bottom of the Subscriptions window. Update the subscription and save your changes. |
| Remove subscriptions | Click  icon next to the selected subscription. |
diff --git a/docs/auditor/10.7/admin/subscriptions/overview.md b/docs/auditor/10.7/admin/subscriptions/overview.md
index 842bcb5dda..a587d8bba7 100644
--- a/docs/auditor/10.7/admin/subscriptions/overview.md
+++ b/docs/auditor/10.7/admin/subscriptions/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# Subscriptions
-Subscriptions enable you to schedule email delivery of a variety of reports or set of specific
+Subscriptions let you schedule email delivery of a variety of reports or set of specific
search criteria. Subscriptions are helpful if you are a rare guest of Netwrix Auditor and you only
need to get statistics based on individual criteria. For example, an IT manager can easily provide
auditors with weekly reports to prove compliance with regulations.
diff --git a/docs/auditor/10.7/api/activityrecordreference.md b/docs/auditor/10.7/api/activityrecordreference.md
index c7e30d4c70..73b97be5b1 100644
--- a/docs/auditor/10.7/api/activityrecordreference.md
+++ b/docs/auditor/10.7/api/activityrecordreference.md
@@ -23,10 +23,10 @@ Records.
| ObjectType | Yes | nvarchar 255 | A type of affected object or its class (e.g., user, mailbox). |
| Monitoring Plan | No | nvarchar 255 | The Auditor object that is responsible for monitoring a given data source and item. Sub-elements: Name and ID. If you provide a monitoring plan name for input Activity Records, ensure the plan is created in Auditor, the Netwrix API data source is added to the plan, and enabled for monitoring. This ensures data is written to the database associated with this plan. |
| DataSource | No | nvarchar max | IT infrastructure monitored with Auditor (e.g., _Active Directory_). For input Activity Records, the data source is automatically set to Netwrix API. |
-| Item | No | nvarchar max | The exact object that is monitored (e.g., a domain name, SharePoint farm name) or integration name. Sub-element: Name. The item type is added inside the name value in brackets (e.g., _enterprise.local (Domain)_). For input Activity Records, the type is automatically set to Integration, you do not need to provide it. The output Activity Records may contain various item types depending on the monitoring plan configuration: - AD container
- NetApp
- Computer
- Office 365 tenant
- Domain
- Oracle Database instance
- EMC Isilon
- SharePoint farm
- Dell VNX/VNXe
- SQL Server instance
- Integration
- VMware ESX/ESXi/vCenter
- IP range
- Windows file share. If you provide an item name for input Activity Records, ensure this item is included in the monitoring plan within the Netwrix API data source. If you specify an item that does not exist, data will be written to the plan's database anyway but will not be available for search using the Item filter.
|
+| Item | No | nvarchar max | The exact object that is monitored (e.g., a domain name, SharePoint farm name) or integration name. Sub-element: Name. The item type is added inside the name value in brackets (e.g., _enterprise.local (Domain)_). For input Activity Records, the type is automatically set to Integration, you don't need to provide it. The output Activity Records may contain various item types depending on the monitoring plan configuration: - AD container
- NetApp
- Computer
- Office 365 tenant
- Domain
- Oracle Database instance
- EMC Isilon
- SharePoint farm
- Dell VNX/VNXe
- SQL Server instance
- Integration
- VMware ESX/ESXi/vCenter
- IP range
- Windows file share. If you provide an item name for input Activity Records, ensure this item is included in the monitoring plan within the Netwrix API data source. If you specify an item that doesn't exist, data will be written to the plan's database anyway but will not be available for search using the Item filter.
|
| Workstation | No | nvarchar max | An originating workstation from which the change was made (e.g., _WKSwin12.enterprise.local_). |
| IsArchiveOnly | No | — | IsArchiveOnly allows saving Activity Record to the Long-Term Archive only. In this case, these Activity Records will not be available for search in the Auditor client. |
-| DetailList | No | — | Information specific to the data source, e.g., assigned permissions, before and after values, start and end dates. References details. |
+| DetailList | No | — | Information specific to the data source, e.g., assigned permissions, before, and after values, start, and end dates. References details. |
| Detail sub-elements (provided that DetailList exists) | | | |
| PropertyName | Yes | nvarchar 255 | The name of a modified property. |
| Message | No | string | Object-specific details about the change. Message is included in output Activity Records only. |
diff --git a/docs/auditor/10.7/api/compatibility.md b/docs/auditor/10.7/api/compatibility.md
index e862908266..1ec7065509 100644
--- a/docs/auditor/10.7/api/compatibility.md
+++ b/docs/auditor/10.7/api/compatibility.md
@@ -6,7 +6,7 @@ sidebar_position: 130
# Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
| Property in 8.0 – 8.5 | New property in 9.0 and above |
@@ -15,4 +15,4 @@ leveraging Netwrix Auditor Integration API. Download the latest add-on version i
| XML: ``, JSON: `"ManagedObject"` | XML: ` Name Unique ID `, JSON: `"MonitoringPlan" : { "ID": "{Unique ID}", "Name": "Name" }` Now the MonitoringPlan contains two sub-entries: ID and Name. The ID property is optional and is assigned automatically by the product. |
| — | XML: `- Item name
`, JSON: `"Item": {"Name": "Item name"` |
-To learn more about input and output Activity Record structure, refer to [Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md).
+For input and output Activity Record structure, see [Activity Records](/docs/auditor/10.7/api/postdata/activityrecords.md).
diff --git a/docs/auditor/10.7/api/filterreference/filteroperators.md b/docs/auditor/10.7/api/filterreference/filteroperators.md
index 4dd053dbc1..9bafe97148 100644
--- a/docs/auditor/10.7/api/filterreference/filteroperators.md
+++ b/docs/auditor/10.7/api/filterreference/filteroperators.md
@@ -6,15 +6,15 @@ sidebar_position: 20
# Operators
-Review the table below to learn more about operators.
+The table below shows operators.
| Operator | Description | Example |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Contains | This operator shows all entries that contain a value specified in the filter. | If you set the Who filter to contains _John_, you will get the following results: _Domain1\John_, _Domain1\Johnson_, _Domain2\Johnny_, _John@domain.com_. |
-| Equals | This operator shows all entries with the exact value specified. Make sure to provide a full object name or path. To apply this operator when adding filters in the Simple mode, provide a value in quotation marks (e.g., _"Domain1\John"_). | Use this operator if you want to get precise results, e.g., _\\FS\Share\NewPolicy.docx_. |
+| Equals | This operator shows all entries with the exact value specified. Ensure to provide a full object name or path. To apply this operator when adding filters in the Simple mode, provide a value in quotation marks (e.g., _"Domain1\John"_). | Use this operator if you want to get precise results, e.g., _\\FS\Share\NewPolicy.docx_. |
| Not equal to | This operator shows all entries except those with the exact value specified. In the Search field in the Simple mode, this operator appears as not, e.g., Who not for the Who filter. | If you set the Who filter to not equal to _Domain1\John_, you will exclude the exact user specified and find all changes performed by other users, e.g., _Domain1\Johnson, Domain2\John_. |
| Starts with | This operator shows all entries that start with the specified value. | If you set the Who filter to starts with _Domain1\John_, you will find all changes performed by _Domain1\John_, _Domain1\Johnson_, and _Domain1\Johnny_. |
| Ends with | This operator shows all entries that end with the exact specified value. | If you set the Who filter to ends with _John_, you will find all changes performed by _Domain1\John_, _Domain2\Dr.John_, _Domain3\John_. |
-| Does not contain | This operator shows all entries except those that contain the specified value. In the Search field in the Simple mode, this operator appears as not, e.g., Who not for the Who filter. | If you set the Who filter to does not contain _John_, you will exclude the following users: _Domain1\John_, _Domain2\Johnson_, and _Johnny@domain.com_. |
+| Doesn't contain | This operator shows all entries except those that contain the specified value. In the Search field in the Simple mode, this operator appears as not, e.g., Who not for the Who filter. | If you set the Who filter to doesn't contain _John_, you will exclude the following users: _Domain1\John_, _Domain2\Johnson_, and _Johnny@domain.com_. |
| In group | This operator relates to the Who filter. It instructs Netwrix Auditor to show only data for the accounts included in the specified group. | If you set the In group condition for Who filter to _Domain\Administrators_, only the data for the accounts included in that group will be displayed. |
| Not in group | This operator relates to the Who filter. It instructs Netwrix Auditor to show only data for the accounts not included in the specified group. | If you set the Not in group condition for Who filter to _Domain\Administrators_, only the data for the accounts not included in that group will be displayed. |
diff --git a/docs/auditor/10.7/api/filterreference/filterreference.md b/docs/auditor/10.7/api/filterreference/filterreference.md
index 976bfe9fb7..ceaac63b4f 100644
--- a/docs/auditor/10.7/api/filterreference/filterreference.md
+++ b/docs/auditor/10.7/api/filterreference/filterreference.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# Reference for Creating Search Parameters File
-Review this section to learn more about operators and how to apply them to Activity Record filters
+See the following sections to understand operators and how to apply them to Activity Record filters
to create a unique search. You can:
- Add different filters to your search. Search results will be sorted by all selected filters since
diff --git a/docs/auditor/10.7/api/filterreference/filters.md b/docs/auditor/10.7/api/filterreference/filters.md
index f64e207fb0..53e1cbf067 100644
--- a/docs/auditor/10.7/api/filterreference/filters.md
+++ b/docs/auditor/10.7/api/filterreference/filters.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Filters
-Review the table below to learn more about filters. The filters correspond to Activity Record
+The table below shows filters. The filters correspond to Activity Record
fields.
| Filter | Description | Supported Operators |
diff --git a/docs/auditor/10.7/api/overview.md b/docs/auditor/10.7/api/overview.md
index 3b74c65963..359fe5167e 100644
--- a/docs/auditor/10.7/api/overview.md
+++ b/docs/auditor/10.7/api/overview.md
@@ -6,12 +6,12 @@ sidebar_position: 70
# Integration API
-Netwrix Auditor Netwrix Risk Insights leverages Netwrix Auditor Integration API. Although you can
+Netwrix Auditor Netwrix Risk Insights provides Netwrix Auditor Integration API. Although you can
always use the add-on as is, but Netwrix encourages customers to create their own integration
add-ons. The add-ons created based on Netwrix Auditor Integration API capabilities are easily
tailored to your specific environment and business requirements.
-Netwrix Auditor Integration API—endless integration, auditing and reporting capabilities.
+Netwrix Auditor Integration API—endless integration, auditing, and reporting capabilities.
The Netwrix Auditor Integration API provides access to audit data collected by Netwrix Auditor
through REST API endpoints. According to the RESTful model, each operation is associated with a URL.
@@ -25,7 +25,7 @@ Integration API provides the following capabilities:
Netwrix Auditor Integration API operates with XML- and JSON-formatted Activity Records—minimal
-chunks of audit data containing information on _who_ changed _what_, _when_ and _where_ this change
+chunks of audit data containing information on _who_ changed _what_, _when_, and _where_ this change
was made. XML format is set as default.
With Integration API you can write Activity Records to the SQL Server-based Audit Database and
@@ -37,7 +37,7 @@ is installed along with Netwrix Auditor Server and is enabled automatically. By
Auditor Integration API works over HTTPS protocol using an automatically generated certificate.
Default communication port is 9699.
-Netwrix does not limit you with applications that can be used with Integration API. You can write
+Netwrix doesn't limit you with applications that can be used with Integration API. You can write
RESTful requests using any tool or application you prefer—cURL, Telerik Fiddler, various Google
Chrome or Mozilla FireFox plug-ins, etc.
@@ -53,7 +53,7 @@ Complete the following fields:
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Specify a name for your integration | Specify the add-on name or provide any other name that distinguishes this custom source from any other. This name will be listed in the Item filter in the interactive search. |
-Make sure Integration API is enabled. To check it, navigate to Settings → Integrations tab. See
+Ensure Integration API is enabled. To check it, navigate to Settings → Integrations tab. See
[Integrations](/docs/auditor/10.7/admin/settings/integrations.md) for more information.
-Make sure to provide a monitoring plan name and item name in activity records before importing data.
+Ensure to provide a monitoring plan name and item name in activity records before importing data.
diff --git a/docs/auditor/10.7/api/postdata/activityrecords.md b/docs/auditor/10.7/api/postdata/activityrecords.md
index 30d9070a0e..6872604507 100644
--- a/docs/auditor/10.7/api/postdata/activityrecords.md
+++ b/docs/auditor/10.7/api/postdata/activityrecords.md
@@ -79,13 +79,13 @@ Records. [Write Activity Records](/docs/auditor/10.7/api/writeactivityrecords.md
## Schema
The Activity Records you want to feed to Netwrix Auditor must be compatible with input schema. The
-output schema resembles the input schema and can be used to validate Activity Records returned
+output schema resembles the input schema and Use validate Activity Records returned
by Netwrix Auditor before further data parsing.
| Format | Schema description |
| ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| XML | The file must be compatible with the XML schema. On the computer where Auditor Server resides, you can find XSD file under _Netwrix_Auditor_installation_folder\Audit Core\API Schemas_. The `ActivityRecordList` root element includes the `ActivityRecord `elements. Each `ActivityRecord` contains values in the `Who`, `When`, `Where`, etc. fields. The `MonitoringPlan` element contains sub-elements such as `Name `and `ID`, the `Item `element contains `Name`. Both `MonitoringPlan` and `Item `are optional for input Activity Records. The `DetailList `element is optional too, it may include one or more `Detail `entries. The `Detail `element may contain sub-elements with values (e.g., before and after values). For input Activity Records, the data source is automatically set to Netwrix API. minOccurs="0" indicates that element is optional and may be absent when writing data to the Audit Database. |
-| JSON | Activity Records are sent as an array collected within square brackets [ ]. Each `ActivityRecord` object is collected in braces {} and contains values in the `Who`, `When`, `Where`, etc. fields. The `DetailList `field is not mandatory, it may include one or more detail. The `Detail `field may contain sub-fields with values (e.g., before and after values). For input Activity Records, the data source is automatically set to Netwrix API. |
+| JSON | Activity Records are sent as an array collected within square brackets [ ]. Each `ActivityRecord` object is collected in braces {} and contains values in the `Who`, `When`, `Where`, etc. fields. The `DetailList `field isn't mandatory, it may include one or more detail. The `Detail `field may contain sub-fields with values (e.g., before and after values). For input Activity Records, the data source is automatically set to Netwrix API. |
## Example
diff --git a/docs/auditor/10.7/api/postdata/overview.md b/docs/auditor/10.7/api/postdata/overview.md
index 5a9b55d517..a960f0ea4f 100644
--- a/docs/auditor/10.7/api/postdata/overview.md
+++ b/docs/auditor/10.7/api/postdata/overview.md
@@ -7,12 +7,12 @@ sidebar_position: 90
# Post Data
While running requests to Netwrix Auditor Integration API endpoints, you will need to post data,
-e.g., a Continuation mark in order to continue retrieving Activity Records, Search parameters to
+e.g., a Continuation mark to continue retrieving Activity Records, Search parameters to
find Activity Records matching your search, or Activity Records you want to feed to the Audit
Database. Data is sent in the request body and must be formatted according to XML convention and
compatible with Netwrix-provided XSD schemas.
-In Netwrix Auditor 9.0, Netwrix has updated API schemas. Make sure to check and update your custom
+In Netwrix Auditor 9.0, Netwrix has updated API schemas. Ensure to check and update your custom
scripts and add-ons. [Compatibility Notice](/docs/auditor/10.7/api/compatibility.md)
The file must be formatted in accordance with XML standard. The following symbols must be replaced
@@ -30,7 +30,7 @@ and > (greater than) symbols.
Also, Netwrix allows transferring data in JSON format (organized as name and value pairs). JSON file
must be formatted in accordance with JSON specification. Special characters in JSON strings must be
preceded with the \ character: " (double quotes), / (slash), \ (backslash). E.g.,
-"\\local\\enterprise\\Users\\Jason Smith". Trailing comma is not supported.
+"\\local\\enterprise\\Users\\Jason Smith". Trailing comma isn't supported.
Review the following for additional information:
diff --git a/docs/auditor/10.7/api/prerequisites.md b/docs/auditor/10.7/api/prerequisites.md
index 5f60ff182e..be2e840726 100644
--- a/docs/auditor/10.7/api/prerequisites.md
+++ b/docs/auditor/10.7/api/prerequisites.md
@@ -14,11 +14,10 @@ manage other API settings.
## Configure Integration API Settings
-Follow the steps to change the port.
**Step 1 –** In the Netwrix Auditor main window, navigate to the Integration tile.
-**Step 2 –** Make sure the Leverage Integration API option is enabled.
+**Step 2 –** ensure the Use Integration API option is enabled.
**Step 3 –** Click Modify under the API settings section and specify a port number. Windows firewall
rule will be automatically created.
@@ -34,10 +33,10 @@ When you first configure the Audit Database settings in Netwrix Auditor, the pro
several databases for special purposes, including Netwrix_Auditor_API. This database is designed to
store data imported from the other sources using Netwrix Auditor Integration API.
-Make sure that the Audit Database settings are configured in Netwrix Auditor. To check or configure
+Ensure that the Audit Database settings are configured in Netwrix Auditor. To check or configure
these settings, navigate to the **Settings > Audit Database**.
-You cannot use Netwrix Auditor Integration API without configuring the Audit Database.
+You can't use Netwrix Auditor Integration API without configuring the Audit Database.
Refer to the [Audit Database](/docs/auditor/10.7/admin/settings/auditdatabase.md) topic for detailed instructions on
how to configure SQL Server settings.
diff --git a/docs/auditor/10.7/api/responsestatuscodes.md b/docs/auditor/10.7/api/responsestatuscodes.md
index 32135d9094..e17756fb69 100644
--- a/docs/auditor/10.7/api/responsestatuscodes.md
+++ b/docs/auditor/10.7/api/responsestatuscodes.md
@@ -9,12 +9,12 @@ sidebar_position: 100
| Code | Status | Write Activity Records | Retrieve, search Activity Records |
| ---------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 200 OK | Success | Success. The body is empty. Activity Records were written to the Audit Database and the Long-Term Archive. | Success. The body contains Activity Records. Activity Records were retrieved from the Audit Database. |
-| 400 Bad Request | Error | Error validating Activity Records. Make sure the Activity Records are compatible with the [Schema](postdata/activityrecords.md#schema). | Error validating request parameters or post data. Make sure the post data files (Continuation mark, Search parameters) are compatible with their schemas and the `?count=` parameter is valid. |
+| 400 Bad Request | Error | Error validating Activity Records. Ensure the Activity Records are compatible with the [Schema](postdata/activityrecords.md#schema). | Error validating request parameters or post data. ensure the post data files (Continuation mark, Search parameters) are compatible with their schemas and the `?count=` parameter is valid. |
| 401 Unauthorized | Error | The request is unauthorized and the body is empty. See for [API Endpoints](/docs/auditor/10.7/api/endpoints.md) more information. | |
-| 404 Not Found | Error | Error addressing the endpoint. The body is empty. The requested endpoint does not exist (e.g., /netwrix/api/v1/mynewendpoint/). | |
+| 404 Not Found | Error | Error addressing the endpoint. The body is empty. The requested endpoint doesn't exist (e.g., /netwrix/api/v1/mynewendpoint/). | |
| 405 Method Not Allowed | Error | Error addressing the endpoint. The body is empty. Wrong HTTP request was sent (any except POST). | Error addressing the endpoint. The body is empty. Wrong HTTP request was sent (any except GET or POST). |
| 413 Request Entity Too Large | Error | Error transferring files. The body is empty. The posted file exceeds supported size. | |
-| 500 Internal Server Error | Error | Error writing Activity Records to the Audit Database or the Long-Term Archive: - One or more Activity Records were not processed.
- Netwrix Auditor license has expired.
- Internal error occurred.
| Error retrieving Activity Records from the Audit Database: - Netwrix Auditorlicense has expired.
- The Netwrix Auditor Archive Service is unreachable. Try restarting the service on the computer that hosts Netwrix Auditor Server.
- Internal error occurred.
|
+| 500 Internal Server Error | Error | Error writing Activity Records to the Audit Database or the Long-Term Archive: - One or more Activity Records weren't processed.
- Netwrix Auditor license has expired.
- Internal error occurred.
| Error retrieving Activity Records from the Audit Database: - Netwrix Auditorlicense has expired.
- The Netwrix Auditor Archive Service is unreachable. Try restarting the service on the computer that hosts Netwrix Auditor Server.
- Internal error occurred.
|
| 503 Service Unavailable | Error | The Netwrix Auditor Archive Service is busy or unreachable. Try restarting the service on the computer that hosts Netwrix Auditor Server. | — |
diff --git a/docs/auditor/10.7/api/searchactivityrecords.md b/docs/auditor/10.7/api/searchactivityrecords.md
index 9bf12ab8e3..55e692d548 100644
--- a/docs/auditor/10.7/api/searchactivityrecords.md
+++ b/docs/auditor/10.7/api/searchactivityrecords.md
@@ -12,7 +12,7 @@ available in the Netwrix Auditor client. See the
and [View and Search Collected Data](/docs/auditor/10.7/admin/search/overview.md) topic for detailed instruction on
how to search and filter audit data.
-As the interactive search in the Netwrix Auditor client, this REST API endpoint allows you to
+As the interactive search in the Netwrix Auditor client, this REST API endpoint lets you
retrieve Activity Records matching a certain criteria. You can create your own set of filters in the
Search parameters file. See the [Search Parameters](/docs/auditor/10.7/api/postdata/searchparameters.md) topic for more
information. Activity Records are retrieved according to the account's delegated scope.
@@ -69,8 +69,8 @@ Follow the steps- to retrieve all Activity Records matching search criteria.
[Search Parameters](/docs/auditor/10.7/api/postdata/searchparameters.md) topic for more information.
As an example, this request retrieves Activity Records where administrator added new objects to the
-Active Directory domain. Groups and group policies are not taken into account. Changes could only
-occur between September 16, 2016 and March 16, 2017.
+Active Directory domain. Groups and group policies aren't taken into account. Changes could only
+occur between September 16, 2016, and March 16, 2017.
Ensure to pass information about transferred data, including `Content-Type:application/xml` or
`application/json `and encoding. The syntax greatly depends on the tool you use.
diff --git a/docs/auditor/10.7/api/writeactivityrecords.md b/docs/auditor/10.7/api/writeactivityrecords.md
index befd3b0507..7a5633dd7a 100644
--- a/docs/auditor/10.7/api/writeactivityrecords.md
+++ b/docs/auditor/10.7/api/writeactivityrecords.md
@@ -10,8 +10,8 @@ sidebar_position: 60
Write data to the Audit Database and to the Long-Term Archive. By default, all imported data is
written to a special Netwrix_Auditor_API database and recognized as the Netwrix API data source.
-This data is not associated with any monitoring plan in the product. You can associate Activity
-Records with a plan, in this case data will be written to a database linked to this plan. Make sure
+This data isn't associated with any monitoring plan in the product. You can associate Activity
+Records with a plan, in this case data will be written to a database linked to this plan. ensure
the plan you specify is already created in Netwrix Auditor, the Netwrix API data source is added to
the plan and enabled for monitoring.
diff --git a/docs/auditor/10.7/configuration/activedirectory/additional.md b/docs/auditor/10.7/configuration/activedirectory/additional.md
index b37a7127de..50405b82a0 100644
--- a/docs/auditor/10.7/configuration/activedirectory/additional.md
+++ b/docs/auditor/10.7/configuration/activedirectory/additional.md
@@ -8,7 +8,7 @@ sidebar_position: 40
If you have an on-premises Exchange server in your Active Directory domain, consider that some
changes can be made through this Exchange server. To be able to audit and report who made those
-changes, make sure that the account used for data collection meets one of the following
+changes, ensure that the account used for data collection meets one of the following
requirements:
- Membership in the Organization Management or Records Management group
@@ -44,7 +44,7 @@ reports, search results and activity summaries.
## Configure Manage Auditing and Security Log Policy
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
Domain Admins group. Follow the steps:
**Step 1 –** Open the **Group Policy Management** console on any domain controller in the target
@@ -76,7 +76,7 @@ domain controllers.
## Grant Permissions for Deleted Objects Container
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
Domain Admins group. Follow the steps:
**Step 1 –** Log on to any domain controller in the target domain with a user account that is a
@@ -91,7 +91,7 @@ where `deleted_object_dn` is the distinguished name of the deleted directory obj
For example: `dsacls "CN=Deleted Objects,DC=Corp,DC=local" /takeownership`
**Step 4 –** To grant permission to view objects in the Deleted Objects container to a user or a
-group, type the following command:
+group, Enter the following command:
`dsacls /G :`
@@ -103,7 +103,7 @@ For example, `dsacls "CN=Deleted Objects,DC=Corp,DC=local" /G Corp\jsmith:LCRP`
In this example, the user CORP\jsmith has been granted **List Contents** and **Read Property**
permissions for the **Deleted Objects** container in the **corp.local** domain. These permissions
-let this user view the contents of the **Deleted Objects** container, but do not let this user make
+let this user view the contents of the **Deleted Objects** container, but don't let this user make
any changes to objects in this container. These permissions are equivalent to the default
permissions that are granted to the **Domain Admins** group.
@@ -120,7 +120,6 @@ Management console.
### Configure the Log On As a Batch Job policy via Local Security Policy Snap-in
-Follow the steps to configure the Log On As a Batch Job policy via Local Security Policy snap-in.
**Step 1 –** On any domain controller in the target domain, open the Local Security Policy snap-in:
navigate to Start > Windows Administrative Tools and select Local Security Policy.
@@ -135,7 +134,7 @@ Specify the account that you want to define this policy for.
### Configure the Log On As a Batch Job Policy Using the Group Policy Management Console
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
Domain Admins group. Follow the steps:
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
@@ -166,7 +165,7 @@ domain controllers.
## Assign Permission to Read the Registry Key
-This permission is required only if the account selected for data collection is not a member of the
+This permission is required only if the account selected for data collection isn't a member of the
Domain Admins group.
This permission should be assigned on each domain controller in the audited domain, so if your
@@ -179,7 +178,6 @@ console.
Assign Permission Via the Registry Editor Snap-in
-Follow the steps to assign permission via the Registry Editor snap-in:
**Step 1 –** On your target server, open Registry Editor: navigate to **Start > Run** and type
_"regedit"_.
@@ -200,7 +198,6 @@ To assign permission using the Group Policy Management console
Assign Permission Using the Group Policy Management Console
-Follow the steps to assign permission using the Group Policy Management console:
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
navigate to Start > Windows Administrative Tools (Windows Server 2016/2019) or Administrative Tools
diff --git a/docs/auditor/10.7/configuration/activedirectory/advancedpolicy.md b/docs/auditor/10.7/configuration/activedirectory/advancedpolicy.md
index 8aaecef089..0ac4237b59 100644
--- a/docs/auditor/10.7/configuration/activedirectory/advancedpolicy.md
+++ b/docs/auditor/10.7/configuration/activedirectory/advancedpolicy.md
@@ -33,7 +33,7 @@ To do it, perform the following steps:
and navigate to Policies → Windows Settings → Security Settings → Local Policies → Security
Options.
4. Locate the Audit: Force audit policy subcategory settings to override audit policy category
- settings and make sure that policy setting is set to _"Enabled"_.
+ settings and ensure that policy setting is set to _"Enabled"_.
diff --git a/docs/auditor/10.7/configuration/activedirectory/manual.md b/docs/auditor/10.7/configuration/activedirectory/manual.md
index 9a17f2b9e3..f5b3f2b438 100644
--- a/docs/auditor/10.7/configuration/activedirectory/manual.md
+++ b/docs/auditor/10.7/configuration/activedirectory/manual.md
@@ -16,12 +16,11 @@ To configure your domain for monitoring manually, you will need:
- ADSI Edit — Required if you plan to perform configuration steps from a server other than domain
controller
-**NOTE:** If these tools are not installed, refer to the following Microsoft articles:
+**NOTE:** If these tools aren't installed, see Microsoft articles:
- [Group Policy Management Console](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn265969(v=ws.11))
- [ADSI Edit](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc773354(v=ws.10)?redirectedfrom=MSDN)
-Follow the steps to configure your domain for monitoring.
**Step 1 –** Configure effective domain controllers policy (by default, Default Domain Controllers
Policy). See the [Configure Basic Domain Audit Policies](/docs/auditor/10.7/configuration/activedirectory/basicpolicy.md) or
@@ -54,12 +53,11 @@ Also, remember to perform the following steps for AD auditing:
## Enable Secondary Logon Service
-Follow the steps to Enable Secondary Logon Service.
**Step 1 –** On the computer where Auditor Server resides, navigate to Start > Windows
Administrative Tools > **Services**.
**Step 2 –** In the **Services** dialog, locate the **Secondary Logon** service.
-**Step 3 –** Right-click the service and on the **General** tab make sure that **Startup type** for
+**Step 3 –** Right-click the service and on the **General** tab ensure that **Startup type** for
this service is other than _Disabled_. The startup type can be either _Automatic_ or _Manual_.
diff --git a/docs/auditor/10.7/configuration/activedirectory/objectlevel.md b/docs/auditor/10.7/configuration/activedirectory/objectlevel.md
index 93ba0ba105..e6530c1b77 100644
--- a/docs/auditor/10.7/configuration/activedirectory/objectlevel.md
+++ b/docs/auditor/10.7/configuration/activedirectory/objectlevel.md
@@ -14,7 +14,7 @@ Auditing of the Configuration partition is enabled by default. See the
[Active Directory](/docs/auditor/10.7/admin/monitoringplans/activedirectory/overview.md) topic for detailed
instructions on how to enable monitoring of changes to the Schema partition in the target AD domain.
-Perform the following procedures to configure object-level auditing for the Domain, Configuration
+Perform the following procedures to configure object-level auditing for the Domain, Configuration,
and Schema partitions:
- Configuring object-level auditing for the Domain partition
@@ -42,10 +42,10 @@ dialog, select the **Auditing** tab.
1. Click **Add**. In the **Auditing Entry** dialog, click the **Select a principal** link.
2. In the **Select user, Computer, Service account, or Group** dialog, type _"Everyone"_ in the
**Enter the object name to select** field.
-3. Set **Type** to _"Success"_ and **Applies to** to _"This object and all descendant objects"_.
+3. Set **Type** to _"Success"_ and **Applies to** _"This object and all descendant objects"_.
4. Under **Permissions**, select all checkboxes except the following: _Full Control_, _List
Contents_, _Read All Properties_ and _Read Permissions_.
-5. Scroll to the bottom of the list and make sure that the **Only apply these auditing settings to
+5. Scroll to the bottom of the list and ensure that the **Only apply these auditing settings to
objects and/or containers within this container** checkbox is cleared.
@@ -61,7 +61,7 @@ Administrative Tools **> ADSI Edit**.
**Step 2 –** Right-click the **ADSI Edit** node and select **Connect To**. In the **Connection
Settings** dialog, enable **Select a well-known Naming Context** and select **Configuration** from
-the drop-down list.
+the dropdown list.
@@ -77,10 +77,10 @@ dialog, open the **Auditing** tab.
1. Click **Add**. In the **Auditing Entry** dialog, click the **Select a principal** link.
2. In the **Select user, Computer, Service account, or Group** dialog, type _"Everyone"_ in the
**Enter the object name to select** field.
-3. Set **Type** to _"Success"_ and **Applies to** to _"This object and all descendant objects"_.
+3. Set **Type** to _"Success"_ and **Applies to** _"This object and all descendant objects"_.
4. Under **Permissions**, select all checkboxes except the following: _Full Control_, _List
Contents_, _Read All Properties_ and _Read Permissions_.
-5. Scroll to the bottom of the list and make sure that the **Only apply these auditing settings to
+5. Scroll to the bottom of the list and ensure that the **Only apply these auditing settings to
objects and/or containers within this container** checkbox is cleared.
diff --git a/docs/auditor/10.7/configuration/activedirectory/overview.md b/docs/auditor/10.7/configuration/activedirectory/overview.md
index a9be60d02b..845bc4f219 100644
--- a/docs/auditor/10.7/configuration/activedirectory/overview.md
+++ b/docs/auditor/10.7/configuration/activedirectory/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -40,15 +40,15 @@ You can configure your IT Infrastructure for monitoring in one of the following
**50** hours). See the [Adjust Security Event Log Size and Retention](/docs/auditor/10.7/configuration/activedirectory/securitylog.md)
topic.
- - To provide for event data collection, the Secondary Logon service must be up and running .
+ - To provide for event data collection, the Secondary Logon service must be operational .
Open **Administrative Tools** > **Services**, right-click the **Secondary Logon** service
- and on the **General** tab make sure that Startup type for this service is other than
+ and on the **General** tab ensure that Startup type for this service is other than
_Disabled_.
## Monitored Objects
Netwrix Auditor tracks changes made to all object classes and attributes in the Active Directory
-Domain, Configuration and Schema partitions. It also tracks changes to new object classes and
+Domain, Configuration, and Schema partitions. It also tracks changes to new object classes and
attributes added due to the Active Directory Schema extension. For detailed information, refer to
Microsoft articles:
@@ -57,15 +57,15 @@ Microsoft articles:
Review the following limitations:
-- Netwrix Auditor does not track changes to non-replicated attributes, such as badPwdCount,
+- Netwrix Auditor doesn't track changes to non-replicated attributes, such as badPwdCount,
Last-Logon, Last-Logoff, etc. The non-replicated attributes pertain to a particular domain
- controller and are not replicated to other domain controllers.
+ controller and aren't replicated to other domain controllers.
- Changes made through the Exchange Management Console in the Organization Configuration node
(Federation Trust, Organization Relationships and Hybrid Configuration tabs) are displayed in an
internal Active Directory format that can be difficult to interpret.
- Netwrix Auditor tracks changes to membership in all groups inside the monitored domain (Domain
local groups) and Universal and Global groups of domains in the same forest. Changes to Domain
- local groups of a different domain in the same forest are not reported.
+ local groups of a different domain in the same forest aren't reported.
State-in-time data collection is supported for Active Directory.
@@ -142,7 +142,7 @@ you should:
- Configure the Exchange Administrator Audit Logging (AAL) settings, as described the
[Exchange Administrator Audit Logging Settings](/docs/auditor/10.7/configuration/exchange/auditlog.md) topic.
-- Make sure that the account used for data collection has the following:
+- Ensure that the account used for data collection has the following:
- Membership in the Organization Management or Records Management group
diff --git a/docs/auditor/10.7/configuration/activedirectory/permissions.md b/docs/auditor/10.7/configuration/activedirectory/permissions.md
index 2f1a2f4f1e..6c8c4b8331 100644
--- a/docs/auditor/10.7/configuration/activedirectory/permissions.md
+++ b/docs/auditor/10.7/configuration/activedirectory/permissions.md
@@ -21,7 +21,7 @@ The account used for data collection must meet the following requirements:
- Local Admin on the Netwrix Auditor server.
- The combination of the following rights and permissions if you plan to disable network traffic
- compression for your monitoring plan or, for some reasons, do not want to add this account to the
+ compression for your monitoring plan or, for some reasons, don't want to add this account to the
Domain Admins group:
- The "Manage auditing and security log" policy must be defined for this account.
@@ -31,14 +31,14 @@ The account used for data collection must meet the following requirements:
container are required. See the Grant Permissions for the Deleted Objects Container topic for
additional information.
-If the account selected for data collection is not a member of the Domain Admins group, see the
+If the account selected for data collection isn't a member of the Domain Admins group, see the
[Assign Permission To Read the Registry Key](/docs/auditor/10.7/configuration/windowsserver/permissions.md) topic.
## Additional Configuration to Review Changes Made via Exchange Server
If you have an on-premises Exchange server in your Active Directory domain, consider that some
changes can be made via that Exchange server. To be able to audit and report who made those changes,
-you should make sure that the account used for data collection has any of the following:
+you should ensure that the account used for data collection has any of the following:
- Membership in the **Organization Management** or **Records Management** group.
@@ -78,7 +78,7 @@ If you plan to use network traffic compression for data processing, consider the
- If network traffic compression will be _enabled_, then the account must belong to the Domain
Admins group.
- If network traffic compression will be _disabled_, and the account you plan to use for data
- collection is not a member of the Domain Admins group, then the **Manage auditing and security
+ collection isn't a member of the Domain Admins group, then the **Manage auditing and security
log** policy must be defined for this account.
See the Configure the Manage Auditing and Security Log Policy topic for more information.
@@ -86,7 +86,7 @@ If you need to process Active Directory **Deleted Objects** container, consider
- Read permission on this container is required. See the Grant Permissions for the Deleted Objects
Container topic for additional information.
-- Grant this permission only if the account you plan to use for data collection is not a member of
+- Grant this permission only if the account you plan to use for data collection isn't a member of
the Domain Admins group.
If auto-backup is _enabled_ for the domain controller event logs:
@@ -98,12 +98,12 @@ If auto-backup is _enabled_ for the domain controller event logs:
- Membership in any of the following groups: Administrators, Print Operators, Server Operators
- Read/Write share permission and Full control security permission on the logs backup folder.
-**NOTE:** Grant these permissions only if the account you plan to use for data collection is not a
+**NOTE:** Grant these permissions only if the account you plan to use for data collection isn't a
member of the **Domain Admins** group.
If you have an on-premises Exchange server in your Active Directory domain, consider that some
changes can be made via that Exchange server. To be able to audit and report who made those changes,
-you should make sure that the account used for data collection has any of the following:
+you should ensure that the account used for data collection has any of the following:
- Membership in the **Organization Management** or **Records Management** group.
- The **Audit Logs** management role (see the
@@ -123,10 +123,9 @@ reports, search results and activity summaries.
## Configure the Manage Auditing and Security Log Policy
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
Domain Admins group.
-Follow the steps to configure the Manage Auditing and Security Log Policy.
**Step 1 –** Open the **Group Policy Management** console on any domain controller in the target
domain: navigate to Start > Windows Administrative Tools (Windows Server 2016 and higher) or
@@ -156,10 +155,9 @@ domain controllers.
## Grant Permissions for the Deleted Objects Container
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
Domain Admins group.
-Follow the steps to grant permissions for the Deleted Objects Container.
**Step 1 –** Log on to any domain controller in the target domain with a user account that is a
member of the **Domain Admins** group.
@@ -173,7 +171,7 @@ where `deleted_object_dn` is the distinguished name of the deleted directory obj
For example: `dsacls "CN=Deleted Objects,DC=Corp,DC=local" /takeownership`
**Step 4 –** To grant permission to view objects in the **Deleted Objects** container to a user or a
-group, type the following command:
+group, Enter the following command:
`dsacls /G :`
@@ -185,7 +183,7 @@ For example, `dsacls "CN=Deleted Objects,DC=Corp,DC=local" /G Corp\jsmith:LCRP`
In this example, the user CORP\jsmith has been granted **List Contents** and **Read Property**
permissions for the **Deleted Objects** container in the **corp.local** domain. These permissions
-let this user view the contents of the **Deleted Objects** container, but do not let this user make
+let this user view the contents of the **Deleted Objects** container, but don't let this user make
any changes to objects in this container. These permissions are equivalent to the default
permissions that are granted to the **Domain Admins** group.
@@ -198,7 +196,6 @@ policy will be reset. In this case, redefine the Deny log on as a service policy
Security Policy console on your computer or on the domain level through the Group Policy Management
console.
-Follow the steps to define the Log On As a Service policy.
**Step 1 –** On the computer where Auditor Server is installed, open the **Local Security Policy**
snap-in: navigate to Start > Windows Administrative Tools and select Local Security Policy.
@@ -224,7 +221,6 @@ Management console.
### Configure the Log On As a Batch Job policy via Local Security Policy Snap-in
-Follow the steps to configure the Log On As a Batch Job policy via Local Security Policy snap-in.
**Step 1 –** On any domain controller in the target domain, open the **Local Security Policy**
snap-in: navigate to Start > Windows Administrative Tools and select Local Security Policy.
@@ -239,10 +235,9 @@ Specify the account that you want to define this policy for.
### Configure the Log On As a Batch Job Policy Using the Group Policy Management Console
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
Domain Admins group.
-Follow the steps to configure the Log On As a Batch Job policy using the Group Policy Management
Console.
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
diff --git a/docs/auditor/10.7/configuration/activedirectory/registrykey.md b/docs/auditor/10.7/configuration/activedirectory/registrykey.md
index de306fd580..4610ae3244 100644
--- a/docs/auditor/10.7/configuration/activedirectory/registrykey.md
+++ b/docs/auditor/10.7/configuration/activedirectory/registrykey.md
@@ -14,12 +14,12 @@ Netwrix Auditor. On the computer whereNetwrix Auditor Server is installed, navig
| ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\AD Change Reporter | |
| CleanAutoBackupLogs | Defines the retention period for the security log backups: - 0—Backups are never deleted from Domain controllers - [X]— Backups are deleted after [X] hours |
-| IgnoreAuditCheckResultError | Defines whether audit check errors should be displayed in the Activity Summary footer: - 0—Display errors - 1—Do not display errors |
-| IgnoreRootDCErrors | Defines whether to display audit check errors for the root domain (when data is collected from a child domain) in the Activity Summary footer: - 0—Display errors - 1—Do not display errors |
-| MonitorModifiedAndRevertedBack | Defines whether the Activity Summary must display the attributes whose values were modified and then restored between data collections: - 0—These attributes are not displayed - 1—These attributes are displayed as "modified and reverted back" |
+| IgnoreAuditCheckResultError | Defines whether audit check errors should be displayed in the Activity Summary footer: - 0—Display errors - 1—Don't display errors |
+| IgnoreRootDCErrors | Defines whether to display audit check errors for the root domain (when data is collected from a child domain) in the Activity Summary footer: - 0—Display errors - 1—Don't display errors |
+| MonitorModifiedAndRevertedBack | Defines whether the Activity Summary must display the attributes whose values were modified and then restored between data collections: - 0—These attributes aren't displayed - 1—These attributes are displayed as "modified and reverted back" |
| ProcessBackupLogs | Defines whether to process security log backups: - 0—No - 1—Yes Even if this key is set to _"0"_, the security log backups will not be deleted regardless of the value of the CleanAutoBackupLogs key. |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\AD Change Reporter\ | |
| CollectLogsMaxThreads | Defines the number of Domain Controllers to simultaneously start log collection on. |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\Management Console\Database settings | |
-| SqlOperationTimeout | Defines the timeout for executing SQL queries such as data selection, insertion or deletion (in seconds). |
+| SqlOperationTimeout | Defines the timeout for executing SQL queries such as data selection, insertion, or deletion (in seconds). |
| timeout | Defines the Audit Database connection timeout (in seconds). |
diff --git a/docs/auditor/10.7/configuration/activedirectory/securitylog.md b/docs/auditor/10.7/configuration/activedirectory/securitylog.md
index 3ed4cd67d3..53e60253cb 100644
--- a/docs/auditor/10.7/configuration/activedirectory/securitylog.md
+++ b/docs/auditor/10.7/configuration/activedirectory/securitylog.md
@@ -15,7 +15,7 @@ method for this log to “_Overwrite events as needed_”.
To adjust your Security event log size and retention method, follow the procedure described below.
-To read about event log settings recommended by Microsoft, refer to the following article:
+To read about event log settings recommended by Microsoft, see article:
[Event Log](https://support.microsoft.com/en-us/help/957662/recommended-settings-for-event-log-sizes-in-windows).
To increase the maximum size of the Security event log and set its retention method
@@ -39,7 +39,7 @@ To increase the maximum size of the Security event log and set its retention met
`gpupdate /force`
-If "Overwrite" option is not enough to meet your data retention requirements, you can use
+If "Overwrite" option isn't enough to meet your data retention requirements, you can use
_auto-archiving_ option for Security event log to preserve historical event data in the archive
files. With that option enabled, you may want to adjust the retention settings for log archives
(backups). Related procedures are described in the
diff --git a/docs/auditor/10.7/configuration/activedirectory/tombstone.md b/docs/auditor/10.7/configuration/activedirectory/tombstone.md
index d49208ef68..b5c934b4ed 100644
--- a/docs/auditor/10.7/configuration/activedirectory/tombstone.md
+++ b/docs/auditor/10.7/configuration/activedirectory/tombstone.md
@@ -13,7 +13,7 @@ Archive, a local file-based storage of audit data) and AD tombstones.
To be able to restore deleted Active Directory objects longer, increase the **Active Directory
tombstone lifetime** property (set by default to 180 days). Netwrix recommends setting it to 2 years
-(**730 days**). You can specify any number of days, but a selected value should not exceed the
+(**730 days**). You can specify any number of days, but a selected value shouldn't exceed the
Long-Term Archive retention period.
Take into consideration that increasing tombstone lifetime may affect Active Directory performance
@@ -22,14 +22,13 @@ and operability.
To perform this procedure, you will need the
[ADSI Edit](http://technet.microsoft.com/en-us/library/cc773354(v=ws.10).aspx) utility.utility.
-Follow the steps to change the tombstone lifetime attribute.
**Step 1 –** On any domain controller in the target domain, navigate to Start > Windows
Administrative Tools **> ADSI Edit**.
**Step 2 –** Right-click the **ADSI Edit** node and select **Connect To**. In the **Connection
Settings** dialog, enable **Select a well-known Naming Context** and select **Configuration** from
-the drop-down list.
+the dropdown list.
diff --git a/docs/auditor/10.7/configuration/activedirectoryfederatedservices/overview.md b/docs/auditor/10.7/configuration/activedirectoryfederatedservices/overview.md
index de14bed55e..8f8440aa81 100644
--- a/docs/auditor/10.7/configuration/activedirectoryfederatedservices/overview.md
+++ b/docs/auditor/10.7/configuration/activedirectoryfederatedservices/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -27,7 +27,7 @@ configuration replicated between them. The first AD FS federation server you set
becomes the **primary** server. Other federation servers you add to the farm will become
**secondary** servers.
-Make sure you have Windows Remote Management properly configured on your Auditor console computer.
+Ensure you have Windows Remote Management properly configured on your Auditor console computer.
See the [Software Requirements](/docs/auditor/10.7/requirements/software.md) topic for additional information.
You can configure your IT Infrastructure for monitoring in one of the following ways:
@@ -81,7 +81,7 @@ need to configure audit settings manually, as described later in this section.
**Step 2 –** In the **Configure audit settings** section, select **Adjust audit settings
-automatically** check box.
+automatically** checkbox.
@@ -92,7 +92,6 @@ necessary log settings on these servers.
## Configure AD FS farm manually
-Follow the steps to enable AD FS audit settings and set up Windows audit policy.
**Step 1 –** AD FS audit settings must be configured on the primary AD FS server, i.e. on the first
server you have set up in the farm:
diff --git a/docs/auditor/10.7/configuration/activedirectoryfederatedservices/permissions.md b/docs/auditor/10.7/configuration/activedirectoryfederatedservices/permissions.md
index 5dc29490e8..a3681998b3 100644
--- a/docs/auditor/10.7/configuration/activedirectoryfederatedservices/permissions.md
+++ b/docs/auditor/10.7/configuration/activedirectoryfederatedservices/permissions.md
@@ -14,5 +14,5 @@ you will provide this account in the monitoring plan wizard.
- If the target AD FS federation server is a domain controller, then the account must belong to the
**Administrators** or **Domain Admins** group
-- Otherwise, if the server is not a domain controller, the account must belong to the **Local
+- Otherwise, if the server isn't a domain controller, the account must belong to the **Local
Administrators** group.
diff --git a/docs/auditor/10.7/configuration/exchange/auditlog.md b/docs/auditor/10.7/configuration/exchange/auditlog.md
index a2dba834fb..c5b90c9845 100644
--- a/docs/auditor/10.7/configuration/exchange/auditlog.md
+++ b/docs/auditor/10.7/configuration/exchange/auditlog.md
@@ -33,7 +33,7 @@ Programs → Exchange Management Shell**.
**Step 2 –** Execute the following command depending on your Exchange version:
-- Exchange 2019, 2016 and 2013
+- Exchange 2019, 2016, and 2013
`Set-AdminAuditLogConfig -AdminAuditLogEnabled $true -AdminAuditLogAgeLimit 30 -AdminAuditLogCmdlets * -LogLevel Verbose`
@@ -52,4 +52,4 @@ Exchange logging. For that:
`.\SetAALExcludedCmdlets.ps1`
-Make sure your policies allow script execution.
+Ensure your policies allow script execution.
diff --git a/docs/auditor/10.7/configuration/exchange/mailboxacccess.md b/docs/auditor/10.7/configuration/exchange/mailboxacccess.md
index c22171d2a6..8fe16314d8 100644
--- a/docs/auditor/10.7/configuration/exchange/mailboxacccess.md
+++ b/docs/auditor/10.7/configuration/exchange/mailboxacccess.md
@@ -16,12 +16,12 @@ information.
However, in some scenarios users may need to apply required audit settings manually. For that,
review the following procedures:
-- Configuring mailbox access tracking for Exchange 2019, 2016 and 2013 manually
+- Configuring mailbox access tracking for Exchange 2019, 2016, and 2013 manually
- Configuring mailbox access tracking for Exchange 2010 manually
-## Configuring mailbox access tracking for Exchange 2019, 2016 and 2013 manually
+## Configuring mailbox access tracking for Exchange 2019, 2016, and 2013 manually
-Perform the procedures below only if you do not want to enable the automatic audit configuration
+Perform the procedures below only if you don't want to enable the automatic audit configuration
option when setting up monitoring in Netwrix Auditor.
You can configure auditing for:
@@ -36,7 +36,7 @@ You can configure auditing for:
## Configuring mailbox access tracking for Exchange 2010 manually
-Perform the procedure below only if you do not want to enable network traffic compression option
+Perform the procedure below only if you don't want to enable network traffic compression option
when setting up Exchange monitoring in Netwrix Auditor.
**Step 1 –** On the computer where the monitored Exchange server is installed, navigate to **Start →
diff --git a/docs/auditor/10.7/configuration/exchange/overview.md b/docs/auditor/10.7/configuration/exchange/overview.md
index ace485240e..a637aeb211 100644
--- a/docs/auditor/10.7/configuration/exchange/overview.md
+++ b/docs/auditor/10.7/configuration/exchange/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -42,19 +42,19 @@ You can configure your IT Infrastructure for monitoring in one of the following
- The Maximum Security event log size must be set to 4GB. The retention method of the
Security event log must be set to _“Overwrite events as needed.”_
- Auto archiving must be enabled to prevent audit data loss if log overwrites occur.
- - The Object-level audit settings must be configured for the Domain, Configuration and
+ - The Object-level audit settings must be configured for the Domain, Configuration, and
Schema partitions.
- The AD tombstoneLifetime attribute must be set to _"730"_.
- - If you have an on-premises Exchange server 2019, 2016, 2013 or 2010 in your Active
+ - If you have an on-premises Exchange server 2019, 2016, 2013, or 2010 in your Active
Directory domain, consider that some changes can be made via that Exchange server. To be
able to audit and report who made those changes, you should configure the Exchange
Administrator Audit Logging (AAL) settings, as described in the
[Exchange Administrator Audit Logging Settings](/docs/auditor/10.7/configuration/exchange/auditlog.md) topic.
- The Administrator Audit Logging settings must be configured (only required for Exchange
- 2019, 2016, 2013 or 2010). See the
+ 2019, 2016, 2013, or 2010). See the
[Exchange Administrator Audit Logging Settings](/docs/auditor/10.7/configuration/exchange/auditlog.md) topic for additional
information.
- - In order to audit mailbox access, native audit logging must be enabled for user, shared,
+ - To audit mailbox access, native audit logging must be enabled for user, shared,
equipment, linked, and room mailboxes:
- Access types: administrator , delegate user
@@ -76,9 +76,9 @@ You can configure your IT Infrastructure for monitoring in one of the following
**50** hours). See the
[Adjust Security Event Log Size and Retention](/docs/auditor/10.7/configuration/activedirectory/securitylog.md) topic.
- - To provide for event data collection, the Secondary Logon service must be up and running .
+ - To provide for event data collection, the Secondary Logon service must be running.
Open **Administrative Tools** > **Services**, right-click the **Secondary Logon** service
- and on the **General** tab make sure that Startup type for this service is other than
+ and on the **General** tab ensure that Startup type for this service is other than
_Disabled_.
_Remember,_ for Exchange auditing, do the following:
diff --git a/docs/auditor/10.7/configuration/exchange/permissions.md b/docs/auditor/10.7/configuration/exchange/permissions.md
index 98b707b464..75246bc401 100644
--- a/docs/auditor/10.7/configuration/exchange/permissions.md
+++ b/docs/auditor/10.7/configuration/exchange/permissions.md
@@ -22,7 +22,7 @@ The account used for data collection must meet the following requirements:
OR
- The combination of the following rights and permissions if you plan to disable network traffic
- compression for your monitoring plan or, for some reasons, do not want to add this account to the
+ compression for your monitoring plan or, for some reasons, don't want to add this account to the
Domain Admins group:
- The Manage auditing and security log policy must be defined for this account. See the
@@ -52,8 +52,6 @@ The following is required if auto-backup is _enabled_ for the domain controller
## Add Account to the Organization Management Group
-Follow the steps to add account to the Organization Management group.
-
**Step 1 –** Navigate to **Start > Active Directory Users and Computers** on any domain controller
in the root domain of the forest where Microsoft Exchange 2019, 2016, or 2013 is installed.
@@ -66,18 +64,16 @@ tab and click **Add**.
-If for some reason you do not want this account to belong to the Organization Management group, you
+If for some reason you don't want this account to belong to the Organization Management group, you
can add it to the Records Management group in the same way. The Records Management group is less
powerful, and accounts belonging to it have fewer rights and permissions.
## Assign Management Roles
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
**Organization Management** or the **Records Management** group.
-Follow the steps to assign management roles.
-
-**Step 1 –** On the computer where Microsoft Exchange 2019, 2016, 2013 or is installed, open the
+**Step 1 –** On the computer where Microsoft Exchange 2019, 2016, 2013, or is installed, open the
**Exchange Management Shell** under an account that belongs to the **Organization Management**
group.
@@ -93,7 +89,7 @@ In this example, the user _CORP\jsmith_ has been assigned the **Audit Logs** rol
## Assign Permission to Read the Registry Key
-This permission is required only if the account selected for data collection is not a member of the
+This permission is required only if the account selected for data collection isn't a member of the
Domain Admins group.
This permission should be assigned on each domain controller in the audited domain, so if your
@@ -106,8 +102,6 @@ console.
### Assign Permission Via the Registry Editor Snap-in
-Follow the steps to assign permission via the Registry Editor snap-in.
-
**Step 1 –** On your target server, open Registry Editor: navigate to **Start > Run** and type
_"regedit"_.
@@ -125,8 +119,6 @@ _HKEY_LOCAL_MACHINE\SECURITY\Policy\PolAdtEv_ registry key.
### Assign Permission Using the Group Policy Management Console
-Follow the steps to assign permission using the Group Policy Management console.
-
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
navigate to Start > Windows Administrative Tools (Windows Server 2016/2019) or Administrative Tools
(Windows 2012 R2 and below) > Group Policy Management.
diff --git a/docs/auditor/10.7/configuration/exchange/permissionsregistrykeys.md b/docs/auditor/10.7/configuration/exchange/permissionsregistrykeys.md
index 7dd3c023b4..6771d408bb 100644
--- a/docs/auditor/10.7/configuration/exchange/permissionsregistrykeys.md
+++ b/docs/auditor/10.7/configuration/exchange/permissionsregistrykeys.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Assign Permission To Read the Registry Key
-This permission is required only if the account selected for data collection is not a member of the
+This permission is required only if the account selected for data collection isn't a member of the
Domain Admins group. This permission should be assigned on each domain controller in the audited
domain, so if your domain contains multiple domain controllers, it is recommended to assign
permissions through Group Policy, or automatically using
@@ -17,8 +17,6 @@ information.
## Assign Permission Via the Registry Editor Snap-in
-Follow the steps to assign permission via the Registry Editor snap-in.
-
**Step 1 –** On your target server, open Registry Editor: navigate to **Start > Run** and type
_"regedit"_.
@@ -36,8 +34,6 @@ _HKEY_LOCAL_MACHINE\SECURITY\Policy\PolAdtEv_ registry key.
## Assign Permission Using the Group Policy Management Console
-Follow the steps to assign permission using the Group Policy Management console.
-
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
navigate to Start > Windows Administrative Tools (Windows Server 2016/2019) or Administrative Tools
(Windows 2012 R2 and below) > Group Policy Management.
diff --git a/docs/auditor/10.7/configuration/exchange/registrykey.md b/docs/auditor/10.7/configuration/exchange/registrykey.md
index 76937a0941..42f8982bd6 100644
--- a/docs/auditor/10.7/configuration/exchange/registrykey.md
+++ b/docs/auditor/10.7/configuration/exchange/registrykey.md
@@ -13,13 +13,13 @@ Auditor. Navigate to Start → Run and type _"regedit"_.
| ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\AD Change Reporter | |
| CleanAutoBackupLogs | Defines the retention period for the security log backups: - 0—Backups are never deleted from Domain controllers - [X]— Backups are deleted after [X] hours |
-| IgnoreAuditCheckResultError | Defines whether audit check errors should be displayed in the Activity Summary footer: - 0—Display errors - 1—Do not display errors |
-| IgnoreRootDCErrors | Defines whether to display audit check errors for the root domain (when data is collected from a child domain) in the Activity Summary footer: - 0—Display errors - 1—Do not display errors |
-| MonitorModifiedAndRevertedBack | Defines whether the Activity Summary must display the attributes whose values were modified and then restored between data collections: - 0—These attributes are not displayed - 1—These attributes are displayed as "modified and reverted back" |
+| IgnoreAuditCheckResultError | Defines whether audit check errors should be displayed in the Activity Summary footer: - 0—Display errors - 1—Don't display errors |
+| IgnoreRootDCErrors | Defines whether to display audit check errors for the root domain (when data is collected from a child domain) in the Activity Summary footer: - 0—Display errors - 1—Don't display errors |
+| MonitorModifiedAndRevertedBack | Defines whether the Activity Summary must display the attributes whose values were modified and then restored between data collections: - 0—These attributes aren't displayed - 1—These attributes are displayed as "modified and reverted back" |
| ProcessBackupLogs | Defines whether to process security log backups: - 0—No - 1—Yes Even if this key is set to _"0"_, the security log backups will not be deleted regardless of the value of the CleanAutoBackupLogs key. |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\AD Change Reporter\ | |
| CollectLogsMaxThreads | Defines the number of Domain Controllers to simultaneously start log collection on. |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\Management Console\Database settings | |
| overwrite_datasource | Defines whether to overwrite the database connection settings (stored in the reports data source) if they differ from the SQL server settings specified when configuring the monitoring plan: - 0—No - 1—Yes |
-| SqlOperationTimeout | Defines the timeout for executing SQL queries such as data selection, insertion or deletion (in seconds). |
+| SqlOperationTimeout | Defines the timeout for executing SQL queries such as data selection, insertion, or deletion (in seconds). |
| timeout | Defines the Audit Database connection timeout (in seconds). |
diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/cifss.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/cifss.md
index 1bbaeea2f7..12b7dbf1b1 100644
--- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/cifss.md
+++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/cifss.md
@@ -57,19 +57,17 @@ information:
| Auditing Entry |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Successful reads** |
-| The Auditing Entry below shows Advanced Permissions for auditing successful reads only: - Apply onto—Select _"Files only"_.
- Check _"Successful"_ and _"Failed"_ next to List folder / read data.
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing successful reads only: - Apply onto—Select _"Files only"_.
- Check _"Successful"_ and _"Failed"_ next to List folder / read data.
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
| **Successful changes** |
-| The Auditing Entry below shows Advanced Permissions for auditing successful changes only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Successful"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing successful changes only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Successful"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
| **Failed read attempts** |
-| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to List folder / read data.
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to List folder / read data.
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
| **Failed change attempts** |
-| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
## Configure Object-level Access Auditing on Windows Server 2012 and Above
-Follow the steps to configure Object-level access auditing on Windows Server 2012 and above.
-
**Step 1 –** Navigate to the target file share, right-click it and select **Properties**.
**Step 2 –** In the `` Properties dialog box, select the Security tab and click
@@ -100,10 +98,10 @@ Review the following for additional information:
| Auditing Entry | |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- |
| Successful reads | |
-| The Auditing Entry below shows Advanced Permissions for auditing successful reads only:  - Type—Set to _"Success"_.
- Applies to—Set to _"Files only"_.
- Advanced permissions—Select List folder / read data.
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing successful reads only:  - Type—Set to _"Success"_.
- Applies to—Set to _"Files only"_.
- Advanced permissions—Select List folder / read data.
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Successful changes | |
-| The Auditing Entry below shows Advanced Permissions for auditing successful changes only:  - Type—Set to _"Success"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing successful changes only:  - Type—Set to _"Success"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Failed read attempts | |
-| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions—Select List folder / read data.
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions—Select List folder / read data.
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Failed change attempts | |
-| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md
index 9df7b2d40e..8a9a56b78e 100644
--- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md
+++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/objectaccess.md
@@ -6,14 +6,11 @@ sidebar_position: 30
# Configure Audit Object Access Policy
-Netwrixrecommends you to avoid linking a GPO to the top level of the domain due to the potential
+Netwrix recommends you avoid linking a GPO to the top level of the domain due to the potential
impact. Instead, create a new organization unit for your file servers within your domain and assign
-GPO there. For detailed instructions on how to create a new OU, refer to the following Microsoft
-article:
+GPO there. For detailed instructions on how to create a new OU, see
[Create a New Organizational Unit](https://technet.microsoft.com/en-us/library/cc771564.aspx).
-Follow the steps to configure Audit Object Access Policy:
-
**Step 1 –** Open the **Group Policy Management** console on any domain controller in the target
domain: navigate to Start > Windows Administrative Tools**→ Group Policy Management.**
diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md
index 0f93beaf94..262a109d6c 100644
--- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md
+++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/overview.md
@@ -13,7 +13,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
diff --git a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md
index ec3ee353a8..65fd2f6cec 100644
--- a/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md
+++ b/docs/auditor/10.7/configuration/fileservers/delldatastorage/securityeventlog.md
@@ -6,13 +6,11 @@ sidebar_position: 20
# Configure Security Event Log Maximum Size
-Follow the steps to configure Event Log maximum size:
-
**Step 1 –** On your file server, create a new file system where the security log will be stored.
**Step 2 –** Mount this file system on a mount point, e.g., **/events**.
-**Step 3 –** Make sure that it is accessible via the **\\``\C$\events** UNC path.
+**Step 3 –** ensure that it is accessible via the **\\``\C$\events** UNC path.
**Step 4 –** On the computer where Auditor Server is installed, open **Registry Editor**: navigate
to **Start → Run** and type _"regedit"_.
diff --git a/docs/auditor/10.7/configuration/fileservers/dellisilon/compliance.md b/docs/auditor/10.7/configuration/fileservers/dellisilon/compliance.md
index fc744dc94e..1df11a0e3f 100644
--- a/docs/auditor/10.7/configuration/fileservers/dellisilon/compliance.md
+++ b/docs/auditor/10.7/configuration/fileservers/dellisilon/compliance.md
@@ -16,9 +16,6 @@ You can configure your cluster for monitoring in one of the following ways:
## Configure Dell Isilon/PowerScale Cluster in Compliance Mode Via Shell Script
-Follow the steps to configure Dell Isilon/PowerScale cluster in Compliance mode via the shell
-script:
-
**Step 1 –** On the computer where Auditor Server resides, navigate to _C:\Program Files
(x86)\Netwrix Auditor\File Server Auditing_ and copy the configure*ifs.sh shell script to
*/ifs/data\_ catalog on your cluster.
@@ -64,8 +61,6 @@ Where `Enterprise\Administrator` is your account name.
## Configure Dell Isilon/PowerScale Cluster in Compliance Mode Manually
-Follow the steps to configure Dell Isilon/PowerScale cluster in Compliance mode manually:
-
**Step 1 –** Navigate to your cluster command prompt through the SSH connection.
**Step 2 –** Log in to your cluster as a **compadmin** user.
diff --git a/docs/auditor/10.7/configuration/fileservers/dellisilon/normal.md b/docs/auditor/10.7/configuration/fileservers/dellisilon/normal.md
index 0b32e8626e..b8b997d219 100644
--- a/docs/auditor/10.7/configuration/fileservers/dellisilon/normal.md
+++ b/docs/auditor/10.7/configuration/fileservers/dellisilon/normal.md
@@ -16,9 +16,6 @@ You can configure your cluster for monitoring in one of the following ways:
## Configure Dell Isilon/PowerScale Cluster in Normal or Enterprise Mode via Shell Script
-Follow the steps to configure Dell Isilon/PowerScale cluster in Normal or Enterprise mode using
-shell script:
-
**Step 1 –** On the computer where Auditor Server resides, navigate to _C:\Program Files
(x86)\Netwrix Auditor\File Server Auditing_ and copy the configure*ifs.sh shell script to
*/ifs/data\_ catalog on your cluster.
@@ -49,8 +46,6 @@ where
## Configure Dell Isilon/PowerScale Cluster in Normal or Enterprise Mode Manually
-Follow the steps to configure Dell Isilon/PowerScale cluster in Normal or Enterprise mode manually:
-
**Step 1 –** Navigate to your cluster command prompt through the SSH connection.
**Step 2 –** Log in to your cluster as a root user.
@@ -77,11 +72,11 @@ deprecated. When configuring audit manually, you see the following warning:
WARNING: lwnet has been deprecated.
-Please use `isi smb ...` equivalents instead.
+use `isi smb ...` equivalents instead.
See `isi smb --help` for more information.
-This command is required to create a shared folder pointed to _/ifs/.ifsvar/audit/_. Please ignore
+This command is required to create a shared folder pointed to _/ifs/.ifsvar/audit/_. ignore
the warning.
**Step 5 –** Add the BUILTIN\Administrators group in the share permissions for the netwrix*audit$
@@ -92,7 +87,7 @@ isi smb shares permission create --share=netwrix_audit$ --group="BUILTIN\Adminis
--permission-type=allow --permission=full --zone=system
```
-**NOTE:** Please verify the correctness of the path to the Isilon audit log files in
+**NOTE:** verify the correctness of the path to the Isilon audit log files in
`_Monitoring Plans -> -> -> Edit item -> General -> File share UNC path to audit logs_`
It must follow the format:
@@ -136,7 +131,7 @@ isi auth roles modify netwrix_audit --add-group="BUILTIN\Administrators" --zone=
When preparing to audit your Dell Isilon/PowerScale storage system, consider the following:
- If you plan to configure audit settings for Dell Isilon/PowerScale storage below the version 8.2
- manually (without using the**configure_ifs.sh** script), make sure that auditing of the
+ manually (without using the**configure_ifs.sh** script), ensure that auditing of the
`success create` events is **disabled**.
For Dell Isilon/PowerScale storage below the version 8.2, the storage system logging will become
@@ -146,7 +141,7 @@ When preparing to audit your Dell Isilon/PowerScale storage system, consider the
For Dell Isilon/PowerScale storage 8.2 and above, this option for manual audit configuration can
be safely enabled.
-- Auditing of the _System_ zone is not supported. As stated by Dell, this zone should be reserved
+- Auditing of the _System_ zone isn't supported. As stated by Dell, this zone should be reserved
for configuration access only. Current data should be stored in other access zones. See the
[Isilon OneFS 9.10.0.0 Web Administration Guide](https://www.dell.com/support/manuals/en-al/isilon-onefs/ifs-pub-91000-administration-guide-gui/access-zones-best-practices?guid=guid-49c42b04-e9cd-4520-bfe4-ce2d2c389d87&lang=en-us)
topic for additional information.
diff --git a/docs/auditor/10.7/configuration/fileservers/dellisilon/overview.md b/docs/auditor/10.7/configuration/fileservers/dellisilon/overview.md
index 49b3aca342..fc282c51d2 100644
--- a/docs/auditor/10.7/configuration/fileservers/dellisilon/overview.md
+++ b/docs/auditor/10.7/configuration/fileservers/dellisilon/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -71,7 +71,7 @@ The following table lists actions that can be performed on Dell Isilon/PowerScal
| Remove (failed attempt) | +\* | +\* | – |
| Copied | – | – | – |
-**NOTE:** For Dell Isilon/PowerScale storage, auditing of _System_ zone is not supported. As stated
+**NOTE:** For Dell Isilon/PowerScale storage, auditing of _System_ zone isn't supported. As stated
by Dell, this zone should be reserved for configuration access only. Current data should be stored
in other access zones. See the
[Dell Upsilon CLI Administration Guide](https://www.dellemc.com/en-us/collaterals/unauth/technical-guides-support-information/2019/09/docu95372.pdf)
diff --git a/docs/auditor/10.7/configuration/fileservers/netappcmode/cifs.md b/docs/auditor/10.7/configuration/fileservers/netappcmode/cifs.md
index 02a31f3969..f2b685e82d 100644
--- a/docs/auditor/10.7/configuration/fileservers/netappcmode/cifs.md
+++ b/docs/auditor/10.7/configuration/fileservers/netappcmode/cifs.md
@@ -57,18 +57,16 @@ Do one of the following depending on the OS:
| Auditing Entry |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Successful reads |
- | The Auditing Entry below shows Advanced Permissions for auditing successful reads only: - Apply onto—Select _"Files only"_. - Check _"Successful"_ and _"Failed"_ next to List folder / read data. - Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
+ | The Auditing Entry below shows Advanced Permissions for auditing successful reads only: - Apply onto—Select _"Files only"_. - Check _"Successful"_ and _"Failed"_ next to List folder / read data. - ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
| Successful changes |
- | The Auditing Entry below shows Advanced Permissions for auditing successful changes only: - Apply onto—Select _"This folder, subfolders and files"_. - Check _"Successful"_ next to the following permissions: - Create files / write data - Create folders / append data - Write extended attributes - Delete subfolders and files - Delete - Change permissions - Take ownership - Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
+ | The Auditing Entry below shows Advanced Permissions for auditing successful changes only: - Apply onto—Select _"This folder, subfolders and files"_. - Check _"Successful"_ next to the following permissions: - Create files / write data - Create folders / append data - Write extended attributes - Delete subfolders and files - Delete - Change permissions - Take ownership - ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
| Failed read attempts |
- | The Auditing Entry below shows Advanced Permissions for auditing failed read attempts only: - Apply onto—Select _"This folder, subfolders and files"_. - Check _"Failed"_ next to List folder / read data. - Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
+ | The Auditing Entry below shows Advanced Permissions for auditing failed read attempts only: - Apply onto—Select _"This folder, subfolders and files"_. - Check _"Failed"_ next to List folder / read data. - ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
| Failed change attempts |
- | The Auditing Entry below shows Advanced Permissions for auditing failed change attempts only: - Apply onto—Select _"This folder, subfolders and files"_. - Check _"Failed"_ next to the following permissions: - Create files / write data - Create folders / append data - Write extended attributes - Delete subfolders and files - Delete - Change permissions - Take ownership - Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
+ | The Auditing Entry below shows Advanced Permissions for auditing failed change attempts only: - Apply onto—Select _"This folder, subfolders and files"_. - Check _"Failed"_ next to the following permissions: - Create files / write data - Create folders / append data - Write extended attributes - Delete subfolders and files - Delete - Change permissions - Take ownership - ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
## Configure Object-level Access Auditing on Windows Server 2012 and Above
-Follow the steps to configure Object-level access auditing on Windows Server 2012 and above.
-
**Step 1 –** Navigate to the target file share, right-click it and select **Properties**.
**Step 2 –** In the `` Properties dialog box, select the Security tab and click
@@ -99,10 +97,10 @@ Review the following for additional information:
| Auditing Entry | |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- |
| Successful reads | |
-| The Auditing Entry below shows Advanced Permissions for auditing successful reads only:  - Type—Set to _"Success"_.
- Applies to—Set to _"Files only"_.
- Advanced permissions—Select List folder / read data.
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing successful reads only:  - Type—Set to _"Success"_.
- Applies to—Set to _"Files only"_.
- Advanced permissions—Select List folder / read data.
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Successful changes | |
-| The Auditing Entry below shows Advanced Permissions for auditing successful changes only:  - Type—Set to _"Success"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing successful changes only:  - Type—Set to _"Success"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Failed read attempts | |
-| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions—Select List folder / read data.
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions—Select List folder / read data.
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Failed change attempts | |
-| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
diff --git a/docs/auditor/10.7/configuration/fileservers/netappcmode/eventcategories.md b/docs/auditor/10.7/configuration/fileservers/netappcmode/eventcategories.md
index 43a626996f..4a07cc7b03 100644
--- a/docs/auditor/10.7/configuration/fileservers/netappcmode/eventcategories.md
+++ b/docs/auditor/10.7/configuration/fileservers/netappcmode/eventcategories.md
@@ -37,7 +37,7 @@ name.
In the example above, the `vserver audit create -destination /audit` command executed on the
`svm1` SVM creates and enables audit on the volume `/audit`.
- Netwrix Auditor accesses audit logs via file shares. Make sure the volume you specified is
+ Netwrix Auditor accesses audit logs via file shares. Ensure the volume you specified is
mounted on SVM and shared (e.g., `audit$` is a share name and its path is `/audit`).
4. Enable audit:
@@ -59,14 +59,14 @@ name.
| Option | Setting |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `Auditing State` | `true` |
- | `Categories of Events to Audit` | `file-ops` Only required if you use Clustered Data ONTAP 8.3, ONTAP 9.0, ONTAP 9.1 or later. You cannot select event categories if you use Clustered Data ONTAP 8.2. For ONTAP 9.0 and later, also check the following options: `file-ops, file-share, audit-policy-change`. For ONTAP 8.3, just check `file-ops`. |
+ | `Categories of Events to Audit` | `file-ops` Only required if you use Clustered Data ONTAP 8.3, ONTAP 9.0, ONTAP 9.1 or later. You can't select event categories if you use Clustered Data ONTAP 8.2. For ONTAP 9.0 and later, also check the following options: `file-ops, file-share, audit-policy-change`. For ONTAP 8.3, just check `file-ops`. |
| Log Format | "XML" or "EVTX" |
7. Modify the log file size limit—set to 300 MB. Execute:
svm1::> vserver audit modify -rotate-size 300MB
- 300MB is the recommended maximum log size proceeding from performance evaluations. Make sure
+ 300MB is the recommended maximum log size proceeding from performance evaluations. Ensure
there is enough disk space allocated for the security logs archives. Depending on the file
access activity, audit data may grow rapidly, and the location specified for the security log
(and security log auto archives) must be large enough to hold data until it is processed by
@@ -120,5 +120,7 @@ To configure logs retention period
-6. **NOTE:** If the **CleanAutoBackupLogs** registry value is set to _"0"_, you will have to remove
+6. :::note
+ If the **CleanAutoBackupLogs** registry value is set to _"0"_, you will have to remove
the old logs manually, or you may run out of space on your hard drive.
+ :::
diff --git a/docs/auditor/10.7/configuration/fileservers/netappcmode/overview.md b/docs/auditor/10.7/configuration/fileservers/netappcmode/overview.md
index 099754bfbe..f72e27661a 100644
--- a/docs/auditor/10.7/configuration/fileservers/netappcmode/overview.md
+++ b/docs/auditor/10.7/configuration/fileservers/netappcmode/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -23,7 +23,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
automatically configure audit in the target environment, your current audit settings will be
checked on each data collection and adjusted if necessary.
- - To use this option for NetApp Clustered Data ONTAP 8 or ONTAP 9, make sure that audit
+ - To use this option for NetApp Clustered Data ONTAP 8 or ONTAP 9, ensure that audit
configuration has been created (with `vserver audit create` command) for the target system
enabling audit configuration is optional.
@@ -138,9 +138,9 @@ the following administration and management guides.
Perform the following steps before proceeding with the audit configuration.
-**Step 1 –** Configure CIFS server and make sure it functions properly.
+**Step 1 –** Configure CIFS server and ensure it functions properly.
-**NOTE**: NFS file shares are not supported.
+**NOTE**: NFS file shares aren't supported.
**Step 2 –** Configure System Access Control List (SACL) on your file share. See
[Configure Audit Settings for CIFS File Shares](/docs/auditor/10.7/configuration/fileservers/netappcmode/cifs.md) topic for additional information.
@@ -152,4 +152,4 @@ the _"ntfs"_ or _"mixed"_.
volumes section in
[Clustered Data ONTAP® 8.3 File Access Management Guide for CIFS.](https://library.netapp.com/ecm/ecm_download_file/ECMP1610207)
-**NOTE:** The current version of Netwrix Auditor does not support auditing of Infinite Volumes.
+**NOTE:** The current version of Netwrix Auditor doesn't support auditing of Infinite Volumes.
diff --git a/docs/auditor/10.7/configuration/fileservers/netappcmode/permissions.md b/docs/auditor/10.7/configuration/fileservers/netappcmode/permissions.md
index 4100d32e96..5cdc7c41c0 100644
--- a/docs/auditor/10.7/configuration/fileservers/netappcmode/permissions.md
+++ b/docs/auditor/10.7/configuration/fileservers/netappcmode/permissions.md
@@ -37,9 +37,9 @@ The following permissions are required for the account on the target server:
- To connect to NetApp Clustered Data ONTAP 8 or ONTAP 9, an account must be assigned a custom role
(e.g., fsa_role) on SVM that has the following capabilities with access query levels:
- | | |
- | ---------------------------------------------------------------------------- | ---------------------------------- |
- | - version - volume - vserver audit - vserver audit rotate-log - vserver cifs | readonly readonly all all readonly |
+ | | |
+ | ---------------------------------------------------------------------------- | ----------------------------------------- |
+ | - version - volume - vserver audit - vserver audit rotate-log - vserver cifs | readonly, readonly, all, all, readonly |
The following permissions are required for the account on the Netwrix Auditor server:
@@ -55,8 +55,6 @@ _Remember,_ that you can also assign the built-in vsadmin role instead of the pe
**NOTE:** This article applies to NetApp 8.3.2 and later. You must be a **cluster administrator** to
run the commands below.
-Follow the steps to create a role for enabling AD user access:
-
**Step 1 –** Create a new role (e.g., netwrix_role for ONTAPI and netwrix_rest_role for RESTAPI) on
your SVM (e.g., svm1). For example:
@@ -92,7 +90,7 @@ security login rest-role create -role netwrix_rest_role -api /api/svm/svms -acce
security login rest-role create -role netwrix_rest_role -api /api/protocols/audit -access all -vserver svm1
```
-**Step 2 –** The capabilities must be assigned one by one. To review currently applied capabilities,
+**Step 2 –** The capabilities must be assigned one by one. To review applied capabilities,
you can use the following command:
ONTAPI role:
@@ -111,7 +109,7 @@ security login rest-role show -vserver svm1 -role netwrix_rest_role
NetApp. If you want to use an AD account for collecting data, enable it to access SVM through
ONTAPI. For example:
-**NOTE:** In ONTAP 9.10 and higher, it is not possible to assign ONTAPI role (e.g. netwrix_role) and
+**NOTE:** In ONTAP 9.10 and higher, it isn't possible to assign ONTAPI role (e.g. netwrix_role) and
RESTAPI role (e.g. netwrix_rest_role) to one AD user. To allow a user access to both the ONTAPI and
RESTAPI, you can use different AD groups by assigning roles to them and including the user in these
groups.
diff --git a/docs/auditor/10.7/configuration/fileservers/netappcmode/servicepolicy.md b/docs/auditor/10.7/configuration/fileservers/netappcmode/servicepolicy.md
index feeecbb928..b043f87823 100644
--- a/docs/auditor/10.7/configuration/fileservers/netappcmode/servicepolicy.md
+++ b/docs/auditor/10.7/configuration/fileservers/netappcmode/servicepolicy.md
@@ -10,7 +10,7 @@ sidebar_position: 30
For older NetApp ONTAP versions use [System Service Firewall Policies](#configure-system-service-firewall-policies) instead.
By default, the 'default-data-files' policy is applied to the SVM CIFS/SMB interface and HTTP/HTTPS
-options are not available. To make the ONTAPI available through HTTP/HTTPS ports on your SVM
+options aren't available. To make the ONTAPI available through HTTP/HTTPS ports on your SVM
interface for Netwrix Auditor Server, configure the 'interface service'-policy. Below is an example
of the configuration:
diff --git a/docs/auditor/10.7/configuration/fileservers/netappcmode/webaccess.md b/docs/auditor/10.7/configuration/fileservers/netappcmode/webaccess.md
index 4cac066ce5..240abb379b 100644
--- a/docs/auditor/10.7/configuration/fileservers/netappcmode/webaccess.md
+++ b/docs/auditor/10.7/configuration/fileservers/netappcmode/webaccess.md
@@ -11,8 +11,6 @@ flush from the internal filer format to an MS Event Viewer compatible format. Ne
supports both the SSL and non-SSL HTTP access, trying HTTPS first, and falling back to HTTP if it is
unavailable.
-Follow the steps to configure ONTAPI\RESTAPI Web Access.
-
**Step 1 –** Navigate to your cluster management command prompt through the SSH/Telnet connection.
**Step 2 –** Log in as a cluster administrator and review your current web access settings. Make
@@ -87,7 +85,7 @@ RESTAPI
cluster1::> vserver services web modify -vserver svm1 -name rest -enabled true -ssl-only true
```
-**Step 7 –** Make sure that the custom role (e.g., netwrix_role for ONTAPI or netwrix_rest_role for
+**Step 7 –** ensure that the custom role (e.g., netwrix_role for ONTAPI or netwrix_rest_role for
RESTAPI) assigned to your account specified for data collection can access ONTAPI or RESTAPI. See
[Permissions for NetApp Auditing](/docs/auditor/10.7/configuration/fileservers/netappcmode/permissions.md) topic for additional information.
diff --git a/docs/auditor/10.7/configuration/fileservers/nutanix/notificationpolicy.md b/docs/auditor/10.7/configuration/fileservers/nutanix/notificationpolicy.md
index fc47c75162..4d3049d6df 100644
--- a/docs/auditor/10.7/configuration/fileservers/nutanix/notificationpolicy.md
+++ b/docs/auditor/10.7/configuration/fileservers/nutanix/notificationpolicy.md
@@ -22,7 +22,7 @@ include any of them.
| Successful _delete_ operations | FILE_DELETE DIRECTORY_DELETE |
| Failed _read/modify/delete_ attempts\* | FILE_OPEN |
-\* - Failed attempt to move/rename file are not audited.
+\* - Failed attempt to move/rename file aren't audited.
## Configuration Procedure
@@ -96,7 +96,7 @@ here:
_"all_mount_targets" : true_ - instructs to notify on changes to all shares
-_"protocol_type_list" : ["SMB"]_ - instructs to track SMB shares (the only currently supported)
+_"protocol_type_list" : ["SMB"]_ - instructs to track SMB shares (the only supported)
_``_ – enter the name of notification policy you want to create
@@ -143,7 +143,7 @@ _`_ – enter the uuid of target you want to audit.
## Example
-The JSON-formatted structure below is an example of the request body that can be used to create a
+Use the JSON-formatted structure below to create a
notification policy named _MOUNT_POINT_POLICY_ to audit the mount a share on Nutanix File Server
with the _uuid=378896fd-e829-4869-84a2-6c29268acfff_. The following operations will be audited:
diff --git a/docs/auditor/10.7/configuration/fileservers/nutanix/overview.md b/docs/auditor/10.7/configuration/fileservers/nutanix/overview.md
index 7f016e0b7c..837fd222fa 100644
--- a/docs/auditor/10.7/configuration/fileservers/nutanix/overview.md
+++ b/docs/auditor/10.7/configuration/fileservers/nutanix/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -84,12 +84,12 @@ The following table lists the actions that can be performed with Nutanix Files:
The following considerations refer to Nutanix Files auditing and reporting:
-- All changes performed on Nutanix File Shares initiated from the machine(s) where Auditor Server
+- All changes performed on Nutanix File Shares initiated from the machines where Auditor Server
resides, will not displayed in Netwrix search and reports because Nutanix Files unable to generate
such Activity Records for Auditor.
- Auditing of NFS file shares in not supported due to known limitations.
-- Currently, not every detail about permission and attribute changes may be provided by Nutanix
- Files, so they cannot be reported by Auditor.
-- As for the state-in-time data collection, note that effective permissions (as a combination of
- NTFS and Shared permissions) are not calculated properly for the local Administrator group
- members.
+- not every detail about permission and attribute changes may be provided by Nutanix
+ Files, so they can't be reported by Auditor.
+- :::note
+ For state-in-time data collection, effective permissions (as a combination of NTFS and Shared permissions) aren't calculated properly for the local Administrator group members.
+ :::
diff --git a/docs/auditor/10.7/configuration/fileservers/nutanix/permissions.md b/docs/auditor/10.7/configuration/fileservers/nutanix/permissions.md
index beddd32f0e..b6a41c0430 100644
--- a/docs/auditor/10.7/configuration/fileservers/nutanix/permissions.md
+++ b/docs/auditor/10.7/configuration/fileservers/nutanix/permissions.md
@@ -39,11 +39,9 @@ See the section below for the instructions on user role assignment.
## Role Assignment Procedure
-Before starting the role assignment, make sure your Nutanix File Server is included in the AD
+Before starting the role assignment, ensure your Nutanix File Server is included in the AD
domain.
-Follow the steps to assign the required roles to the corresponding accounts using Nutanix Prism.
-
**Step 1 –** Open Nutanix Prism web portal.
**Step 2 –** Select **File Server** category. In the list of servers, select the server you want to
diff --git a/docs/auditor/10.7/configuration/fileservers/nutanix/ports.md b/docs/auditor/10.7/configuration/fileservers/nutanix/ports.md
index 873ea978c4..387a755011 100644
--- a/docs/auditor/10.7/configuration/fileservers/nutanix/ports.md
+++ b/docs/auditor/10.7/configuration/fileservers/nutanix/ports.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Nutanix Ports
-Follow the steps to open Nutanix port for inbound connections.
-
**Step 1 –** On a target computer navigate to **Start** > **Control Panel** and select **Windows
Firewall.**
diff --git a/docs/auditor/10.7/configuration/fileservers/overview.md b/docs/auditor/10.7/configuration/fileservers/overview.md
index 664e9be227..91c5f55b62 100644
--- a/docs/auditor/10.7/configuration/fileservers/overview.md
+++ b/docs/auditor/10.7/configuration/fileservers/overview.md
@@ -30,13 +30,13 @@ by Auditor on these supported storage systems.:
## State-in-Time Data
-State-in-time data collection is supported for files, folders and shares on Windows-based file
-servers, Dell and NetApp storage systems, and Nutanix File Servers. Remember to select the
+State-in-time data collection is supported for files, folders, and shares on Windows-based file
+servers, Dell, and NetApp storage systems, and Nutanix File Servers. Remember to select the
corresponding option in the data source settings within the monitoring plan.
## Sensitive Data
-Starting with the version 10, the product is able to report about sensitive data in your IT
+Starting with the version 10, the product can report about sensitive data in your IT
infrastructure. Pay attention to the "_Data categories_" column in search and reports (for the
"_File_" object types only). See the
[Sensitive Data Discovery ](/docs/auditor/10.7/admin/settings/sensitivedatadiscovery.md) topic for additional
@@ -46,17 +46,16 @@ information on how to enable monitoring of sensitive data in Auditor.
The table below lists the object types and attributes that can be monitored by Auditor.
-For more information on the attributes marked with (\*) , refer to the following Microsoft article:
+For more information on the attributes marked with (\*), see the Microsoft article
[File Attribute Constants](https://msdn.microsoft.com/en-us/library/windows/desktop/gg258117(v=vs.85).aspx).
| Object type | Attributes |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| File | - Attributes\* - Location - Name - Ownership - Permissions: - Group Permissions - User Permissions - Primary Group - Security descriptor control flags - Size - Data categories |
-| Folder | - Attributes\* The Reparse point attribute content is available for reviewing only when State-In-Time snapshot collection is enabled. Mind that reparse point content changes cannot be audited. - Location - Name - Ownership - Permissions: - Group Permissions - User Permissions - Primary Group - Security descriptor control flags |
+| Folder | - Attributes\* The Reparse point attribute content is available for reviewing only when State-In-Time snapshot collection is enabled. Mind that reparse point content changes can't be audited. - Location - Name - Ownership - Permissions: - Group Permissions - User Permissions - Primary Group - Security descriptor control flags |
| Share | - Access-based Enumeration - Caching - Continuous Availability - Description - Enable BranchCache - Encrypt Data Access - Local Path - User Limit |
-**CAUTION:** File and folder attributes marked with the (\*) are not monitored by default. Please
-contact Netwrix Technical Support team to monitor these file and folder attributes.
+**CAUTION:** File and folder attributes marked with the (\*) aren't monitored by default. Contact Netwrix Technical Support team to monitor these file and folder attributes.
In addition to general object attributes, Auditor generates the following attributes associated with
the object and reserved for internal use:
diff --git a/docs/auditor/10.7/configuration/fileservers/qumulo/configure.md b/docs/auditor/10.7/configuration/fileservers/qumulo/configure.md
index fdb7b6d294..c6f563dc02 100644
--- a/docs/auditor/10.7/configuration/fileservers/qumulo/configure.md
+++ b/docs/auditor/10.7/configuration/fileservers/qumulo/configure.md
@@ -24,5 +24,5 @@ To configure Core Audit for Qumulo file servers
When you see the green line “_Connected_”, the environment is ready.
-For detailed information about Qumulo Web UI. refer to the following Qumulo how-to article:
+For detailed information about Qumulo Web UI, see the Qumulo how-to article
[Qumulo Core Audit Logging](https://care.qumulo.com/hc/en-us/articles/360021454193-Qumulo-Core-Audit-Logging).
diff --git a/docs/auditor/10.7/configuration/fileservers/qumulo/overview.md b/docs/auditor/10.7/configuration/fileservers/qumulo/overview.md
index 999b3ebc13..1f51a61035 100644
--- a/docs/auditor/10.7/configuration/fileservers/qumulo/overview.md
+++ b/docs/auditor/10.7/configuration/fileservers/qumulo/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
diff --git a/docs/auditor/10.7/configuration/fileservers/synology/configure.md b/docs/auditor/10.7/configuration/fileservers/synology/configure.md
index 53de1c34e7..cdc16bb08b 100644
--- a/docs/auditor/10.7/configuration/fileservers/synology/configure.md
+++ b/docs/auditor/10.7/configuration/fileservers/synology/configure.md
@@ -6,11 +6,7 @@ sidebar_position: 10
# Configure Synology File Servers for Audit
-Follow the steps to configure your Synology NAS devices to transmit the local system logs for
-monitoring.
-
-**Step 1 –** Navigate to **Control Panel > File Services > SMB > Log Settings**. Please note that
-all audit types should be enabled.
+**Step 1 –** Navigate to **Control Panel > File Services > SMB > Log Settings**. All audit types should be enabled.
**Step 2 –** Log in to the Synology Web Administration Console.
@@ -26,9 +22,10 @@ all audit types should be enabled.
**Step 4 –** Click Apply.
-> **NOTE:** Currently, Netwrix Auditor cannot collect activities using a local Synology user. Data
-collection only supported via a domain user with the necessary access privileges to the Synology
-file server.
+:::note
+Netwrix Auditor can't collect activities using a local Synology user. Data collection is only supported via a domain user with the necessary access privileges to the Synology file server.
+:::
-> **NOTE:** Currently, Netwrix Auditor cannot collect activities on shared folders hidden using
-the Synology option **Hide this shared folder in "My Network Places"**.
+:::note
+Netwrix Auditor can't collect activities on shared folders hidden using the Synology option **Hide this shared folder in "My Network Places"**.
+:::
diff --git a/docs/auditor/10.7/configuration/fileservers/synology/overview.md b/docs/auditor/10.7/configuration/fileservers/synology/overview.md
index 8ebc3e95df..cc2b77df6e 100644
--- a/docs/auditor/10.7/configuration/fileservers/synology/overview.md
+++ b/docs/auditor/10.7/configuration/fileservers/synology/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
diff --git a/docs/auditor/10.7/configuration/fileservers/windows/advancedpolicy.md b/docs/auditor/10.7/configuration/fileservers/windows/advancedpolicy.md
index dd3d6b750a..f3839e2edd 100644
--- a/docs/auditor/10.7/configuration/fileservers/windows/advancedpolicy.md
+++ b/docs/auditor/10.7/configuration/fileservers/windows/advancedpolicy.md
@@ -16,8 +16,6 @@ Setting up both basic and advanced audit policies may lead to incorrect audit re
basic audit policies to be ignored and prevent conflicts, enable the _Audit: Force audit policy
subcategory settings_ policy.
-Follow the steps to enforce advanced policies.
-
**Step 1 –** On the audited server, open the Local Security Policy snap-in and navigate to Start >
Windows Administrative Tools > Local Security Policy.
diff --git a/docs/auditor/10.7/configuration/fileservers/windows/configuration.md b/docs/auditor/10.7/configuration/fileservers/windows/configuration.md
index a81b5966f6..5a1648230d 100644
--- a/docs/auditor/10.7/configuration/fileservers/windows/configuration.md
+++ b/docs/auditor/10.7/configuration/fileservers/windows/configuration.md
@@ -9,9 +9,6 @@ sidebar_position: 80
Configure this Back up Files and Directories policy via the Local Security Policy Snap-in or using
the Group Policy Management Console.
-Follow the steps to configure the Back up Files and Directories policy via the Local Security Policy
-Snap-in.
-
**Step 1 –** On any domain controller in the target domain, open the Local Security Policy snap-in:
navigate to Start > Windows Administrative Tools > Local Security Policy.
@@ -24,10 +21,7 @@ specify the user that you want to define this policy for.
The policy is now configured.
-Follow the steps to configure the Back up Files and Directories policy using the Group Policy
-Management Console.
-
-**NOTE:** Perform this procedure only if the account selected for data collection is not a member of
+**NOTE:** Perform this procedure only if the account selected for data collection isn't a member of
the Domain Admins group.
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
diff --git a/docs/auditor/10.7/configuration/fileservers/windows/eventlog.md b/docs/auditor/10.7/configuration/fileservers/windows/eventlog.md
index ee1f453d21..1f1bd5fdd1 100644
--- a/docs/auditor/10.7/configuration/fileservers/windows/eventlog.md
+++ b/docs/auditor/10.7/configuration/fileservers/windows/eventlog.md
@@ -12,8 +12,6 @@ multiple target computers, you need to perform this procedure on each of them.
If you move security log files from the default system folder to a non-default one, you must reboot
your target server for the reports and search functionality to work properly.
-Follow the steps to configure Event Log Size and Retention Settings.
-
**Step 1 –** On a target server, navigate to Start > Windows Administrative Tools > Event Viewer.
**Step 2 –** Navigate to Event Viewer tree > Windows Logs, right-click **Security** and select
@@ -21,13 +19,13 @@ Follow the steps to configure Event Log Size and Retention Settings.
-**Step 3 –** Make sure Enable logging is selected.
+**Step 3 –** ensure Enable logging is selected.
-**Step 4 –** In the Maximum log size field, specify the desired log size.
+**Step 4 –** In the Maximum log size field, specify the log size you want.
-**Step 5 –** Make sure the Do not overwrite events (Clear logs manually) check box is cleared. If
+**Step 5 –** ensure the Don't overwrite events (Clear logs manually) checkbox is cleared. If
selected, change the retention method to _Overwrite events as needed (oldest events first)_.
-Make sure the Maximum security log size group policy does not overwrite your log settings. To check
+Ensure the Maximum security log size group policy doesn't overwrite your log settings. To check
this, start the Group Policy Management console, proceed to the GPO that affects your server, and
navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Event Log.
diff --git a/docs/auditor/10.7/configuration/fileservers/windows/localpolicy.md b/docs/auditor/10.7/configuration/fileservers/windows/localpolicy.md
index d1b4bb662a..1ceb599aef 100644
--- a/docs/auditor/10.7/configuration/fileservers/windows/localpolicy.md
+++ b/docs/auditor/10.7/configuration/fileservers/windows/localpolicy.md
@@ -6,11 +6,9 @@ sidebar_position: 30
# Configure Local Audit Policies
-You can choose to configure local audit policies or advanced audit policies.See the
+You can choose to configure local audit policies or advanced audit policies. See the
[Configure Advanced Audit Policies](/docs/auditor/10.7/configuration/fileservers/windows/advancedpolicy.md) topic for more information.
-Follow the steps to configure local audit policies.
-
**Step 1 –** On the audited server, open the Local Security Policy snap-in: navigate to Start >
Windows Administrative Tools > Local Security Policy.
diff --git a/docs/auditor/10.7/configuration/fileservers/windows/objectlevel.md b/docs/auditor/10.7/configuration/fileservers/windows/objectlevel.md
index b637281279..8cb906b09c 100644
--- a/docs/auditor/10.7/configuration/fileservers/windows/objectlevel.md
+++ b/docs/auditor/10.7/configuration/fileservers/windows/objectlevel.md
@@ -28,8 +28,6 @@ Perform one of the following procedures depending on the OS version you are usin
## Configure Object-level Access Auditing on Windows Server 2012 and Above
-Follow the steps to configure Object-level access auditing on Windows Server 2012 and above.
-
**Step 1 –** Navigate to the target file share, right-click it and select **Properties**.
**Step 2 –** In the `` Properties dialog box, select the Security tab and click
@@ -60,13 +58,13 @@ Review the following for additional information:
| Auditing Entry | |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- |
| Successful reads | |
-| The Auditing Entry below shows Advanced Permissions for auditing successful reads only:  - Type—Set to _"Success"_.
- Applies to—Set to _"Files only"_.
- Advanced permissions—Select List folder / read data.
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing successful reads only:  - Type—Set to _"Success"_.
- Applies to—Set to _"Files only"_.
- Advanced permissions—Select List folder / read data.
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Successful changes | |
-| The Auditing Entry below shows Advanced Permissions for auditing successful changes only:  - Type—Set to _"Success"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing successful changes only:  - Type—Set to _"Success"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Failed read attempts | |
-| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions—Select List folder / read data.
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions—Select List folder / read data.
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Failed change attempts | |
-| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
## Configure Object-level access auditing on pre-Windows Server 2012 versions
@@ -102,10 +100,10 @@ information:
| Auditing Entry |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Successful reads** |
-| The Auditing Entry below shows Advanced Permissions for auditing successful reads only: - Apply onto—Select _"Files only"_.
- Check _"Successful"_ and _"Failed"_ next to List folder / read data.
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing successful reads only: - Apply onto—Select _"Files only"_.
- Check _"Successful"_ and _"Failed"_ next to List folder / read data.
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
| **Successful changes** |
-| The Auditing Entry below shows Advanced Permissions for auditing successful changes only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Successful"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing successful changes only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Successful"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
| **Failed read attempts** |
-| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to List folder / read data.
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to List folder / read data.
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
| **Failed change attempts** |
-| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
diff --git a/docs/auditor/10.7/configuration/fileservers/windows/overview.md b/docs/auditor/10.7/configuration/fileservers/windows/overview.md
index 6f04a39b89..e213f3bfe7 100644
--- a/docs/auditor/10.7/configuration/fileservers/windows/overview.md
+++ b/docs/auditor/10.7/configuration/fileservers/windows/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -45,7 +45,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
| Change Permissions\* | "Success" and "Fail" |
| Take Ownership\* | "Success" and "Fail" |
- \* Select "Fail" only if you want to track failure events, it is not required for
+ \* Select "Fail" only if you want to track failure events, it isn't required for
success events monitoring.
**NOTE:** If you want to get only state-in-time snapshots of your system configuration,
@@ -56,14 +56,13 @@ You can configure your IT Infrastructure for monitoring in one of the following
- The Audit: Force audit policy subcategory settings (Windows 7 or later) security
option must be enabled.
- - **NOTE:** If you want to get only state-in-time snapshots of your system
- configuration, limit your audit settings to the following policies:
+ - If you want to get only state-in-time snapshots of your system configuration, limit your audit settings to the following policies:
| Advanced Audit Policy | Setting |
| ----------------------------------------- | --------- |
| Object Access > Audit File Share | "Success" |
| Object Access > Audit Handle Manipulation | "Success" |
- | Policy Change > Audit Audit Policy Change | "Success" |
+ | Policy Change > Audit Policy Change | "Success" |
- The following legacy policies can be configured instead of advanced:
@@ -88,11 +87,11 @@ You can configure your IT Infrastructure for monitoring in one of the following
- File and Printer Sharing (Echo Request - ICMPv4-In)
- File and Printer Sharing (Echo Request - ICMPv6-In)
- **NOTE:** The rules marked with \* are required only if you do not want to use
+ **NOTE:** The rules marked with \* are required only if you don't want to use
network traffic compression for auditing.
- If you plan to audit Windows Server 2019 or Windows 10 Update 1803 without network
- compression service, make sure the following inbound connection rules are enabled:
+ compression service, ensure the following inbound connection rules are enabled:
- Remote Scheduled Tasks Management (RPC)
- Remote Scheduled Tasks Management (RPC-EMAP)
@@ -107,18 +106,16 @@ Consider the following:
- To collect data from 32-bit operating systems, network traffic compression must be disabled.
- To collect data from Windows Failover Cluster, network traffic compression must be enabled.
-- Scale-Out File Server (SOFS) cluster is not supported.
-- Auditing of files and folders placed directly into the DFS namespace root is not supported, as
- such configuration is not recommended by Microsoft. (See the Microsoft
+- Scale-Out File Server (SOFS) cluster isn't supported.
+- Auditing of files and folders placed directly into the DFS namespace root isn't supported, as
+ such configuration isn't recommended by Microsoft. (See the Microsoft
[Placing files directly in the namespace share](https://learn.microsoft.com/en-us/archive/blogs/askds/common-dfsn-configuration-mistakes-and-oversights#placing-files-directly-in-the-namespace-share)
- article for additional information.) Make sure the UNC path of a shared folder is placed within a
+ article for additional information.) ensure the UNC path of a shared folder is placed within a
share targeted by a DFS folder.
## Configuration Steps
-Follow the steps to configure Windows File Servers for auditing:
-
-**Step 1 –** Check requirements. Make sure the Windows File Servers you want to monitor meet the
+**Step 1 –** Check requirements. Ensure the Windows File Servers you want to monitor meet the
requirements.
**Step 2 –** Decide on audit data to collect.
@@ -132,7 +129,7 @@ requirements.
- Audit flags must be set on every file share you want to audit.
- If your file shares are stored within one folder (or disk drive), you can configure audit
settings for this folder only. As a result, you will receive reports on all required access
- types applied to all file shares within this folder. It is not recommended to configure audit
+ types applied to all file shares within this folder. It isn't recommended to configure audit
settings for system disks.
- By default, Auditor will monitor all shares stored in the specified location, except for
hidden shares (both default and user-defined). If you want to monitor user-defined hidden
@@ -146,7 +143,7 @@ requirements.
- To collect data from 32-bit operating systems, network traffic compression must be disabled.
- To collect data from Windows Failover Cluster, network traffic compression must be enabled.
-- Scale-Out File Server (SOFS) cluster is not supported.
+- Scale-Out File Server (SOFS) cluster isn't supported.
- Several constraints apply to DFS auditing. See the DFS-Related Constraints topic for additional
information.
@@ -155,14 +152,14 @@ requirements.
- In the reports and search results, in some cases, Auditor displays not the actual time when the
event occurred but data collection time.
- Auditor may report on several unexpected changes with _who_ (initiator's account) reported as
- _system_ due to the native Windows File Servers audit peculiarities. If you do not want to see
+ _system_ due to the native Windows File Servers audit peculiarities. If you don't want to see
these changes, exclude them from the audit. See the [File Servers](/docs/auditor/10.7/configuration/fileservers/overview.md) topic for
additional information. For example - mass file removals, when target Windows server generates too
many events at a time and the product is unable to parse their sequences correctly.
- Due to Windows limitations, the _copy/rename/move_ actions on remote file shares may be reported
as two sequential actions: copying – as adding a new file and reading the initial file;
renaming/moving – as removing the initial file and adding a new file with the same name.
-- To report on _copy_ actions on remote file shares, make sure that audit of successful read
+- To report on _copy_ actions on remote file shares, ensure that audit of successful read
operations is enabled. See the [Configure Object-Level Access Auditing](/docs/auditor/10.7/configuration/fileservers/windows/objectlevel.md) topic for
additional information.
@@ -228,16 +225,15 @@ provide the UNC path of the whole namespace or UNC path of the DFS link (folder)
- _"\\domain\dfsnamespace\"_ (domain-based namespace)
- _"\\server\dfsnamespace\"_ (in case of stand-alone namespace);
-Auditing of files and folders placed directly into the DFS namespace root is not supported, as such
-configuration is not recommended by Microsoft. See the
+Auditing of files and folders placed directly into the DFS namespace root isn't supported, as such
+configuration isn't recommended by Microsoft. See the
[Placing files directly in the namespace share](https://docs.microsoft.com/en-us/archive/blogs/askds/common-dfsn-configuration-mistakes-and-oversights#placing-files-directly-in-the-namespace-share)
-section of the Microsoft article for additional information. Make sure the UNC path of a shared
+section of the Microsoft article for additional information. Ensure the UNC path of a shared
folder is placed within a share targeted by a DFS folder.
-For recommendations on configuring DFS replication, refer to the following Netwrix knowledge base
-article:
+For recommendations on configuring DFS replication, see the Netwrix knowledge base article
[Why did loss of performance occur when configuring audit settings for Windows File Servers?](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/auditing-distributed-file-systems-with-replication-in-netwrix-auditor).
-Remember that replication of namespace roots is not supported.
+Remember that replication of namespace roots isn't supported.
## File Servers and Antivirus
diff --git a/docs/auditor/10.7/configuration/fileservers/windows/remoteregistryservice.md b/docs/auditor/10.7/configuration/fileservers/windows/remoteregistryservice.md
index cc51fe8ae2..35a75e1e0f 100644
--- a/docs/auditor/10.7/configuration/fileservers/windows/remoteregistryservice.md
+++ b/docs/auditor/10.7/configuration/fileservers/windows/remoteregistryservice.md
@@ -6,8 +6,6 @@ sidebar_position: 60
# Enable Remote Registry Service
-Follow the steps to enable the Remote Registry service.
-
**Step 1 –** Navigate to Start > Windows Administrative Tools > Services.
@@ -15,7 +13,7 @@ Follow the steps to enable the Remote Registry service.
**Step 2 –** In the Services window, locate the Remote Registry service, right-click it and select
**Properties**.
-**Step 3 –** In the Remote Registry Properties dialog box, make sure the Startup type parameter is
+**Step 3 –** In the Remote Registry Properties dialog box, ensure the Startup type parameter is
set to _Automatic_ and click **Start**.
diff --git a/docs/auditor/10.7/configuration/grouppolicy/overview.md b/docs/auditor/10.7/configuration/grouppolicy/overview.md
index 9c0bfa52f1..042dbddb16 100644
--- a/docs/auditor/10.7/configuration/grouppolicy/overview.md
+++ b/docs/auditor/10.7/configuration/grouppolicy/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -40,7 +40,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
**50** hours). See the
[Adjust Security Event Log Size and Retention](/docs/auditor/10.7/configuration/activedirectory/securitylog.md) topic.
- - To provide for event data collection, the Secondary Logon service must be up and running .
+ - To provide for event data collection, the Secondary Logon service must be running.
Open **Administrative Tools** > **Services**, right-click the **Secondary Logon** service
- and on the **General** tab make sure that Startup type for this service is other than
+ and on the **General** tab ensure that Startup type for this service is other than
_Disabled_.
diff --git a/docs/auditor/10.7/configuration/grouppolicy/permissions.md b/docs/auditor/10.7/configuration/grouppolicy/permissions.md
index 8c6c7d5189..53f51a12eb 100644
--- a/docs/auditor/10.7/configuration/grouppolicy/permissions.md
+++ b/docs/auditor/10.7/configuration/grouppolicy/permissions.md
@@ -36,7 +36,7 @@ The account used for data collection must meet the following requirements:
OR
- The combination of the following rights and permissions if you plan to disable network traffic
- compression for your monitoring plan or, for some reasons, do not want to add this account to the
+ compression for your monitoring plan or, for some reasons, don't want to add this account to the
**Domain Admins** group:
- **Manage auditing and security log** policy must be defined for this account.
@@ -60,7 +60,7 @@ The following is required if auto-backup is _enabled_ for the domain controller
## Assign Permission to Read the Registry Key
-This permission is required only if the account selected for data collection is not a member of the
+This permission is required only if the account selected for data collection isn't a member of the
Domain Admins group.
This permission should be assigned on each domain controller in the audited domain, so if your
@@ -71,9 +71,7 @@ Policy, or automatically using
To assign permissions manually, use the Registry Editor snap-in or the Group Policy Management
console.
-Assign Permission Via the Registry Editor Snap-in
-
-Follow the steps to assign permission via the Registry Editor snap-in:
+## Assign Permission Via the Registry Editor Snap-in
**Step 1 –** On your target server, open Registry Editor: navigate to **Start > Run** and type
_"regedit"_.
@@ -90,11 +88,7 @@ Set\Services\EventLog\Security_.
**Step 6 –** For auditing Logon Activity, you also need to assign the Read permission to the
_HKEY_LOCAL_MACHINE\SECURITY\Policy\PolAdtEv_ registry key.
-To assign permission using the Group Policy Management console
-
-Assign Permission Using the Group Policy Management Console
-
-Follow the steps to assign permission using the Group Policy Management console:
+## Assign Permission Using the Group Policy Management Console
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
navigate to Start > Windows Administrative Tools (Windows Server 2016/2019) or Administrative Tools
@@ -143,9 +137,7 @@ about integration and supported data sources. In this case, the credentials will
Netwrix Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand,
ensuring password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
-
-**Step 1 –** Select the desired item.
+**Step 1 –** Select the monitored item you want to configure.
**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
collection.
@@ -153,9 +145,9 @@ collection.
**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
-Credential-based is the default option. Refer to the
-[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+Credential-based is the default option. See the
+[Netwrix Privilege Secure documentation](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
+for details about Access Policies.
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
@@ -166,7 +158,7 @@ sources.
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.7/configuration/grouppolicy/registrykey.md b/docs/auditor/10.7/configuration/grouppolicy/registrykey.md
index 1815b48baa..0cc62df069 100644
--- a/docs/auditor/10.7/configuration/grouppolicy/registrykey.md
+++ b/docs/auditor/10.7/configuration/grouppolicy/registrykey.md
@@ -15,8 +15,8 @@ Netwrix Auditor. Navigate to Start → Run and type _"regedit"_.
| CleanAutoBackupLogs | Defines the retention period for the security log backups: - 0—Backups are never deleted from Domain controllers - [X]— Backups are deleted after [X] hours |
| GPOBackup | Defines whether to backup GPOs during data collection: - 0—No - 1—Yes |
| GPOBackupDays | Defines the backup frequency: - 0—Backup always - X—Once in X days GPOBackup must be set to _"1"_. |
-| IgnoreAuditCheckResultError | Defines whether audit check errors should be displayed in the Activity Summary footer: - 0—Display errors - 1—Do not display errors |
-| IgnoreRootDCErrors | Defines whether to display audit check errors for the root domain (when data is collected from a child domain) in the Activity Summary footer: - 0—Display errors - 1—Do not display errors |
+| IgnoreAuditCheckResultError | Defines whether audit check errors should be displayed in the Activity Summary footer: - 0—Display errors - 1—Don't display errors |
+| IgnoreRootDCErrors | Defines whether to display audit check errors for the root domain (when data is collected from a child domain) in the Activity Summary footer: - 0—Display errors - 1—Don't display errors |
| ProcessBackupLogs | Defines whether to process security log backups: - 0—No - 1—Yes Even if this key is set to _"0"_, the security log backups will not be deleted regardless of the value of the CleanAutoBackupLogs key. |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\AD Change Reporter\ | |
| CollectLogsMaxThreads | Defines the number of Domain Controllers to simultaneously start log collection on. |
@@ -24,5 +24,5 @@ Netwrix Auditor. Navigate to Start → Run and type _"regedit"_.
| SessionImportDays | Defines the frequency of a full snapshot upload: - X—Once in X days |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\Management Console\Database settings | |
| overwrite_datasource | Defines whether to overwrite the database connection settings (stored in the reports data source) if they differ from the SQL server settings specified when configuring the monitoring plan: - 0—No - 1—Yes |
-| SqlOperationTimeout | Defines the timeout for executing SQL queries such as data selection, insertion or deletion (in seconds). |
+| SqlOperationTimeout | Defines the timeout for executing SQL queries such as data selection, insertion, or deletion (in seconds). |
| timeout | Defines the Audit Database connection timeout (in seconds). |
diff --git a/docs/auditor/10.7/configuration/logonactivity/advancedpolicy.md b/docs/auditor/10.7/configuration/logonactivity/advancedpolicy.md
index bab0e22308..fbd63fc23d 100644
--- a/docs/auditor/10.7/configuration/logonactivity/advancedpolicy.md
+++ b/docs/auditor/10.7/configuration/logonactivity/advancedpolicy.md
@@ -32,7 +32,7 @@ To do it, perform the following steps:
and navigate to Policies → Windows Settings → Security Settings → Local Policies → Security
Options.
4. Locate the Audit: Force audit policy subcategory settings to override audit policy category
- settings and make sure that policy setting is set to _"Enabled"_.
+ settings and ensure that policy setting is set to _"Enabled"_.
diff --git a/docs/auditor/10.7/configuration/logonactivity/overview.md b/docs/auditor/10.7/configuration/logonactivity/overview.md
index 123d5af0fe..fdacaed6b1 100644
--- a/docs/auditor/10.7/configuration/logonactivity/overview.md
+++ b/docs/auditor/10.7/configuration/logonactivity/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -61,13 +61,13 @@ See the following topics for additional information:
Review a full list of actions captured when monitoring Logon Activity with Netwrix Auditor.
-**NOTE:** Please consider the following:
+**NOTE:** consider the following:
-- Logon activity by local accounts is not reported
-- Logoff activity from workstations is not reported
+- Logon activity by local accounts isn't reported
+- Logoff activity from workstations isn't reported
- Logoff activity from Domain Controllers is reported
-For the attributes marked with asterisk (\*) _what_ changed is not reported.
+For the attributes marked with asterisk (\*) _what_ changed isn't reported.
| Action | Object Type | Attributes |
| ----------------- | -------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
diff --git a/docs/auditor/10.7/configuration/logonactivity/permissions.md b/docs/auditor/10.7/configuration/logonactivity/permissions.md
index 9ff292b1ed..04c6b1c34e 100644
--- a/docs/auditor/10.7/configuration/logonactivity/permissions.md
+++ b/docs/auditor/10.7/configuration/logonactivity/permissions.md
@@ -20,7 +20,7 @@ required:
Afterward, include this account in the monitoring plan wizard.
-Please consider the following:
+consider the following:
- For the data collecting account, you should use a different account than the one Auditor is using
to access the database.
@@ -31,15 +31,13 @@ Please consider the following:
This section contains instructions on how to configure an account to collect Logon Activity with
minimum rights assignment. The instructions below apply only if you are going create a monitoring
-plan with disabled network traffic compression and do not want to adjust audit settings
+plan with disabled network traffic compression and don't want to adjust audit settings
automatically.
Before creating an account, grant the _Read_ permission on the SECURITY registry key
`(HKEY_LOCAL_MACHINE\SECURITY)` for an admin account under which you will make changes in Group
Policy.
-Follow the steps to configure non-administrative account to collect logon activity:
-
**Step 1 –** Create a domain user with the following privileges:
- Back up files and directories. See the
diff --git a/docs/auditor/10.7/configuration/logonactivity/securityeventlog.md b/docs/auditor/10.7/configuration/logonactivity/securityeventlog.md
index 9d54cbba74..c3cd20843e 100644
--- a/docs/auditor/10.7/configuration/logonactivity/securityeventlog.md
+++ b/docs/auditor/10.7/configuration/logonactivity/securityeventlog.md
@@ -6,7 +6,6 @@ sidebar_position: 40
# Configure Security Event Log Size and Retention Settings
-Follow the steps to configure Security Event Log settings:
**Step 1 –** Open the **Group Policy Management** console on any domain controller in the target
domain: navigate to Start > Windows Administrative Tools (Windows Server 2016 and higher) or
@@ -31,6 +30,6 @@ needed**.
**Step 6 –** Run the following command to update group policy: `gpupdate /force`
**NOTE:** After configuring security event settings via Group Policy, you may notice that the log
-size on a specific computer is not set correctly. In this case, follow the resolution steps from the
+size on a specific computer isn't set correctly. In this case, follow the resolution steps from the
Netwrix Knowledge base article to fix the issue:
-[Security log settings do not apply via GPO](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/security-log-settings-do-not-apply-via-gpo).
+[Security log settings don't apply via GPO](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/security-log-settings-do-not-apply-via-gpo).
diff --git a/docs/auditor/10.7/configuration/microsoft365/exchangeonline/modernauth/manifest.md b/docs/auditor/10.7/configuration/microsoft365/exchangeonline/modernauth/manifest.md
index cfafce4b59..36246e3d31 100644
--- a/docs/auditor/10.7/configuration/microsoft365/exchangeonline/modernauth/manifest.md
+++ b/docs/auditor/10.7/configuration/microsoft365/exchangeonline/modernauth/manifest.md
@@ -6,8 +6,6 @@ sidebar_position: 20
# Assigning Application Permissions Using Manifest
-Follow the steps to assign Exchange Online application permissions using manifest.
-
**Step 1 –** Under App registrations, select the newly created app.
**Step 2 –** Select **Manifest** on the left.
diff --git a/docs/auditor/10.7/configuration/microsoft365/exchangeonline/modernauth/manualconfig.md b/docs/auditor/10.7/configuration/microsoft365/exchangeonline/modernauth/manualconfig.md
index 574815571a..4d85ff7fa9 100644
--- a/docs/auditor/10.7/configuration/microsoft365/exchangeonline/modernauth/manualconfig.md
+++ b/docs/auditor/10.7/configuration/microsoft365/exchangeonline/modernauth/manualconfig.md
@@ -26,14 +26,11 @@ General Requirements
[Download .NET Framework 4.7.1](https://dotnet.microsoft.com/download/dotnet-framework/net471)
**NOTE:** If you have the FIPS option enabled you should proceed to Manual Exchange Online
-pre-configuration. See the Configure Exchange Online Modern Authentication Manuallysection for
+pre-configuration. See the Configure Exchange Online Modern Authentication Manually section for
additional information.
-Follow the steps to enable Exchange Online Auto Audit for mailboxes with Modern Authentication
-(automatic mode).
-
**Step 1 –** Install the ExchangeOnlineManagement Powershell module and dependencies (Nget package
-provider). Refer to the following Microsoft article for more information:
+provider). See the following Microsoft article for more information:
[About the Exchange Online PowerShell V2 module](https://docs.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps).
**Step 2 –** Generate the self-signed certificate.
@@ -51,8 +48,6 @@ This section will be helpful for any case below:
- You have the FIPS policy enabled
- You want to install the module manually
-Follow the steps to install the module.
-
**Step 1 –** Install the Windows Management Framework for your OS:
[Windows Management Framework 5.1](https://www.microsoft.com/en-us/download/details.aspx?id=54616)
@@ -101,10 +96,8 @@ certificate, complete the following steps.
If the error still persists, or you want to pre-configure the work with certificate, follow the
instructions below:
-Follow the steps to install a certificate.
-
**Step 1 –** Get your certificate or generate a self-signed certificate. The name must be
-_`Netwrix_Auditor_MFA_`*
+_`Netwrix_Auditor_MFA_`_
**Step 2 –** Save the certificate to the _CurrentUser/My certificate_ folder for the Local System
account.
@@ -112,8 +105,6 @@ account.
**Step 3 –** Upload the certificate to the application selected in your monitoring plan or configure
it automatically with Netwrix Auditor.
-Follow the steps to generate a self-signed certificate.
-
**Step 1 –** Open Windows PowerShell as an Administrator and run the following commands:
```
@@ -125,15 +116,13 @@ $mycert | Export-PfxCertificate -FilePath mycert.pfx -Password $(ConvertTo-Secur
$mycert | Export-Certificate -FilePath mycert.cer
```
-**Step 2 –** Replace the `DnsName `parameter value with your certificate name
+**Step 2 –** Replace the `DnsName` parameter value with your certificate name
(`Netwrix_Auditor_MFA_`).
-Follow the steps to install the certificate to the CurrentUser/My certificate folder.
-
**Step 1 –** Download [PsExec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec) to
-run Windows PowerShell session under the LocalSystem account;
+run Windows PowerShell session under the LocalSystem account.
-**Step 2 –** Run Windows PowerShell as an Administrator, navigate to to PsExec.exe installation
+**Step 2 –** Run Windows PowerShell as an Administrator, navigate to the PsExec.exe installation
directory (use the 'CD' command), if necessary, and run the following command:
```
diff --git a/docs/auditor/10.7/configuration/microsoft365/exchangeonline/modernauth/modernauth.md b/docs/auditor/10.7/configuration/microsoft365/exchangeonline/modernauth/modernauth.md
index 2e87c8230d..2e73367503 100644
--- a/docs/auditor/10.7/configuration/microsoft365/exchangeonline/modernauth/modernauth.md
+++ b/docs/auditor/10.7/configuration/microsoft365/exchangeonline/modernauth/modernauth.md
@@ -6,8 +6,7 @@ sidebar_position: 30
# Access Exchange Online Using Modern Authentication
-Support for modern authentication will allow you to audit the organizations where MFA is enabled for
-all users, including service accounts.
+Modern authentication lets you audit organizations where MFA is enabled for all users, including service accounts.
This option is recommended for organizations that use modern authentication as the identity
management approach, having multi-factor authentication (MFA) enabled for their user accounts. In
@@ -29,8 +28,6 @@ You will need to create a dedicated app for each cloud-based data source you pla
If you plan to audit all of them, you need to create 4 apps.
-Follow the steps to register a new Microsoft Entra ID application.
-
**Step 1 –** Sign into the **Microsoft 365 Admin Center** with your _Global Administrator_,
_Application Administrator_ or _Cloud Application Administrator_ account and go to the **Microsoft
Entra ID admin center**.
@@ -91,14 +88,12 @@ article: [ Microsoft Entra app manifest](https://learn.microsoft.com/en-us/azur
#### Grant Admin Consent to a Tenant
-Follow the steps to grant Admin consent to a tenant.
Go back to the **Microsoft Entra ID admin center** > **Applications** > **App registrations** >
**API permissions** and click **Grant admin consent for** *``*. When prompted to
confirm, click **Yes**.
-**NOTE:** For Office 365 permissions, go to **Request API Permissions** > **APIs my organization
-users** and type "Office 365" in the search bar.
+**NOTE:** For Office 365 permissions, go to **Request API Permissions** > **APIs my organization uses** and type "Office 365" in the search bar.
See the following Microsoft article for additional information on how to create an application and
service principal using Microsoft Entra ID Admin portal:
@@ -106,9 +101,6 @@ service principal using Microsoft Entra ID Admin portal:
### Grant Required Roles
-Follow the steps to grant the required Microsoft Entra ID (formerly Azure AD) roles to the new
-application.
-
**Step 1 –** In the Entra portal, click **View** under Manage Azure Active Directory.
**Step 2 –** Select **Roles and admins** under Applications .
@@ -126,8 +118,6 @@ service principal using Azure AD Admin portal:
### Configure Client Secret
-Follow the steps to create a new client secret to be used by the app.
-
**Step 1 –** Go to **Manage** > **Certificates & secrets** and click **New client secret**.
**Step 2 –** Enter the description. From the expiration options select **24 months**.
@@ -142,8 +132,6 @@ See the following Microsoft article for more information on how to add a client
## Add an Exchange Online Monitoring Plan
-Follow the steps to add Exchange Online monitoring plan in the Netwrix Auditor:
-
**Step 1 –** In the Monitoring Plans, click **Add Plan** button.
**Step 2 –** Create a monitoring plan with the Exchange Online data source.
@@ -164,8 +152,6 @@ Exchange Online monitoring plan has been added to Auditor and initial data colle
### Obtain the Tenant Name
-Follow the steps to obtain the tenant name.
-
**Step 1 –** Navigate to **Microsoft Entra ID** > **Overview**.
**Step 2 –** In the **Tenant information** locate the **Primary domain** field, copy its value and
diff --git a/docs/auditor/10.7/configuration/microsoft365/exchangeonline/overview.md b/docs/auditor/10.7/configuration/microsoft365/exchangeonline/overview.md
index b36cdacc4a..f510991a2e 100644
--- a/docs/auditor/10.7/configuration/microsoft365/exchangeonline/overview.md
+++ b/docs/auditor/10.7/configuration/microsoft365/exchangeonline/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -94,7 +94,7 @@ Refer to the table to see Properties used in the Snapshot collection.
| Type | Properties |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| User Mailbox Shared Mailbox Equipment Mailbox Room Mailbox Linked Mailbox Mail-enabled security Dynamic distribution list Distribution list Microsoft 365 | Identity Name DisplayName DistinguishedName PrimarySmtpAddress Guid ArchiveGuid ExternalDirectoryObjectId ExchangeObjectId AuditEnabled AuditAdmin AuditDelegate AuditLogAgeLimit Type OwnerUPN ExchangeSecurityDescriptorSddl SendOnBehalfPrincipals Sid IsDirSynced SerializationData ForwardingAddress ForwardingSMTPAddress DeliverToMailboxAndForward |
-| ExchangeSecurityGroup | RecipientTypeDetails ExchangeObjectId ExternalDirectoryObjectId ExternalDirectoryObjectId Name |
+| ExchangeSecurityGroup | RecipientTypeDetails ExchangeObjectId ExternalDirectoryObjectId Name |
| RoleGroup | ExchangeObjectId Name Sid UserFriendlyName UserPrincipalName |
| MailUser GuestMailUser User | Identity Name DisplayName DistinguishedName SamAccountName UserPrincipalName ObjectCategory Id ExchangeObjectId ExternalDirectoryObjectId OrganizationId OriginatingServer RecipientType RecipientTypeDetails IsDirSynced Sid |
| MailFolder | ObjectType ObjectId DisplayName MailboxGuid SecurityDescriptorSddl ParentFolderId ChildFolderCount UnreadItemCount TotalItemCount WellKnownName Childs |
diff --git a/docs/auditor/10.7/configuration/microsoft365/exchangeonline/permissions.md b/docs/auditor/10.7/configuration/microsoft365/exchangeonline/permissions.md
index db3d32bc90..25583dbad6 100644
--- a/docs/auditor/10.7/configuration/microsoft365/exchangeonline/permissions.md
+++ b/docs/auditor/10.7/configuration/microsoft365/exchangeonline/permissions.md
@@ -6,10 +6,10 @@ sidebar_position: 20
# Permissions for Exchange Online Auditing
-Auditor allows you to audit Office 365 organizations that have established modern authentication as
+With Auditor, you can audit Office 365 organizations that have established modern authentication as
their identity management approach, including support for
[multi-factor authentication (MFA)](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks).
-To learn more about modern authentication, refer to the following Microsoft article:
+For more information about modern authentication, see the following Microsoft article:
[What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication).
In this scenario, Netwrix Auditor will access the cloud-based infrastructure via Microsoft Graph and
@@ -19,15 +19,13 @@ app and provide its settings to Auditor when configuring a monitored item.
## Configure the Microsoft Entra ID App for Auditing Exchange Online
-Follow the steps to use a data collecting account with modern authentication.
-
**Step 1 –** Create a Microsoft Entra ID app that will be used for modern authentication. See the
[Create and Register a New App in Microsoft Entra ID](/docs/auditor/10.7/configuration/microsoft365/exchangeonline/modernauth/modernauth.md#create-and-register-a-new-app-in-microsoft-entra-id)
topic for additional information.
**NOTE:** After you start a new monitoring plan and select a data source in the first step, you will
-be asked to enter a default data collection account. However, this step is not needed for Exchange
-Online as it cannot be used. Thus, there is no need to grant any permissions to this account.
+be asked to enter a default data collection account. However, this step isn't needed for Exchange
+Online as it can't be used. Thus, there is no need to grant any permissions to this account.
Instead, you will need to configure a modern authentication app and give the necessary permissions
there.
@@ -51,12 +49,10 @@ To prepare for non-owner mailbox access auditing in the Exchange Online organiza
to take several configuration steps, creating a Microsoft Entra ID app with the required permissions
and instructing this app to automatically apply the necessary audit settings.
-Follow the steps to configure a non-owner mailbox access audit.
-
**Step 1 –** Install the **Exchange Online PowerShell V3** module. There are three versions in the
repository: 3.0.0, 3.1.0 and 3.2.0.
-**NOTE:** Make sure you are using the version specified in the
+**NOTE:** Ensure you are using the version specified in the
[App-only authentication for unattended scripts in Exchange Online PowerShell and Security & Compliance PowerShell ](https://docs.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps)Microsoft
article.
@@ -68,7 +64,7 @@ article.
**Step 3 –** At the top of the **Request API permissions** pane, click the **APIs my organization
uses** tab and search for _Office 365 Exchange Online_.
-**Step 4 –** Click on the _Office 365 Exchange Online_ entry in the list of apps found.
+**Step 4 –** Click the _Office 365 Exchange Online_ entry in the list of apps found.
**Step 5 –** Proceed with adding the permissions for this app: select **Application permissions**
and then select **Exchange.ManageAsApp**.
@@ -145,20 +141,20 @@ Finally, run the following command to end the session:
Disconnect-ExchangeOnline -Confirm:$false
```
-To automate the process described above, you can create a a script comprising the corresponding
+To automate the process described above, you can create a script comprising the corresponding
commands and schedule its launch.
## Non-owner Mailbox Access Audit: Manual Configuration
If you plan to manually apply the audit settings required to audit non-owner mailbox access in
Exchange Online organization, you will need to create a remote PowerShell session to Exchange
-Online. Follow the steps to do so.
+Online.
**Step 1 –** Install the Exchange Online PowerShell V2 module as described in the
[About the Exchange Online PowerShell module](https://docs.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps)
Microsoft article.
-Make sure to install the latest version.
+Ensure to install the latest version.
**Step 2 –** Launch PowerShell and connect to Exchange Online, as described in the
[About the Exchange Online PowerShell module](https://docs.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps)
diff --git a/docs/auditor/10.7/configuration/microsoft365/exchangeonline/ports.md b/docs/auditor/10.7/configuration/microsoft365/exchangeonline/ports.md
index 7328653298..3537ae3e5d 100644
--- a/docs/auditor/10.7/configuration/microsoft365/exchangeonline/ports.md
+++ b/docs/auditor/10.7/configuration/microsoft365/exchangeonline/ports.md
@@ -19,5 +19,5 @@ Tip for reading the table: For example, on the computer where Netwrix Auditor Se
| Port | Protocol | Source | Target | Purpose |
| --------------- | -------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
| Exchange Online | | | | |
-| 80 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
-| 443 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
+| 80 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, see the Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
+| 443 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, see the Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
diff --git a/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/overview.md b/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/overview.md
index 7b6688c267..f1255a0972 100644
--- a/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/overview.md
+++ b/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -106,7 +106,7 @@ ServicePrincipals properties:
| Data source | Data usage |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Audit logs Collected via MS Graph on endpoint _/auditLogs/directoryaudits_ | Activity Record: who, when and some event-based Activity Record |
+| Audit logs Collected via MS Graph on endpoint _/auditLogs/directoryaudits_ | Activity Record: who, when, and some event-based Activity Record |
| Sign-in logs Collected via MS Graph on endpoint _/auditLogs/signIns_ | Logon Activity Record |
| Users changes Collected via MS Graph on endpoint _/users/delta/…_ | Activity Record for users |
| Groups changes Collected via MS Graph on endpoint _/groups/delta/…_ | Activity Record for groups |
diff --git a/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/basicauth.md b/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/basicauth.md
index aaa3cebbdf..74bf5a4173 100644
--- a/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/basicauth.md
+++ b/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/basicauth.md
@@ -17,8 +17,8 @@ Further permission assignment will depend on the data you plan to collect:
- To collect activity data including **logon attempts**, the administrative role is required, as
well as the Premium Plan license.
- To collect activity data without logons, the privileged role can be revoked from the specified
- account after the initial data collection. Ongoing audit data collection will leverage Microsoft
- APIs access permissions granted to Microsoft Entra ID app and, therefore, requires no tenant-level
+ account after the initial data collection. Ongoing audit data collection uses Microsoft
+ APIs with access permissions granted to the Microsoft Entra ID app, therefore requiring no tenant-level
administrative permissions.
## Required Roles and Permissions
@@ -49,8 +49,6 @@ your Netwrix Auditor, consider that after the upgrade you will have to perform t
procedure again, selecting one of these approaches. Until then, data collection will not be
performed.
-Follow the steps to assign a privileged role to the account.
-
**Step 1 –** Sign in to Microsoft Entra ID portal using your Microsoft account.
**Step 2 –** Select Microsoft Entra ID on the left.
@@ -58,7 +56,7 @@ Follow the steps to assign a privileged role to the account.
**Step 3 –** Select the account that you want to use as data collecting account, or create a new
user.
-**Step 4 –** Make sure you have disabled multi-factor authentication for this account.
+**Step 4 –** ensure you have disabled multi-factor authentication for this account.
**Step 5 –** Expand Directory role and select the role you need (for example, Global admin or any
other privileged role).
@@ -82,7 +80,7 @@ A less privileged role has now been assigned to the account.
## Assigning 'Security Administrator' or 'Security Reader' Role
To audit _Successful_ and/or _Failed Logons_ in Microsoft Entra ID, the Security Administrator or
-Security Reader role is required. Follow the steps to assign the role you need:
+Security Reader role is required.
**Step 1 –** Sign in to [Microsoft Entra ID portal](https://portal.azure.com/) using your Microsoft
account.
@@ -95,6 +93,5 @@ account.
**Step 5 –** Click Add member and select the account that you want to assign the role to.
-Refer to the following Microsoft article:
-[Microsoft Entra built-in roles](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles)
-for additional information on the Administrator role permissions.
+For more information on Administrator role permissions, see the Microsoft article
+[Microsoft Entra built-in roles](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles).
diff --git a/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/manifest.md b/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/manifest.md
index 16f12c0fc2..70e1b319d0 100644
--- a/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/manifest.md
+++ b/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/manifest.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Assign Application Permissions Using Manifest
-Follow the steps to assign application permissions using manifest.
-
**Step 1 –** Under App registrations, select the newly created app.
**Step 2 –** Select **Manifest** on the left.
diff --git a/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md b/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md
index 21b1f1ac1d..3527fb3403 100644
--- a/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md
+++ b/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md
@@ -17,8 +17,6 @@ provide its settings to Auditor when configuring a monitored item.
## Configuring Microsoft Entra ID App for Auditing Microsoft Entra ID
-Follow the steps to use a data collecting account with modern authentication.
-
**Step 1 –** Create and Register a New App in Microsoft Entra ID app that will be used for modern
authentication. See the Create and Register a New App in Microsoft Entra ID section for additional
information.
@@ -43,8 +41,6 @@ You will need to create a dedicated app for each cloud-based data source you pla
If you plan to audit all of them, you need to create 4 apps.
-Follow the steps to register a new Microsoft Entra ID application.
-
**Step 1 –** Sign into the **Microsoft 365 Admin Center** with your _Global Administrator_,
_Application Administrator_ or _Cloud Application Administrator_ account and go to the **Microsoft
Entra ID admin center**.
@@ -117,8 +113,6 @@ service principal using Microsoft Entra ID Admin portal:
### Configure Client Secret
-Follow the steps to create a new client secret to be used by the app.
-
**Step 1 –** Go to **Manage** > **Certificates & secrets** and click **New client secret**.
**Step 2 –** Enter the description. From the expiration options select **24 months**.
@@ -133,8 +127,6 @@ See the following Microsoft article for more information on how to add a client
### Add Microsoft Entra ID monitoring plan
-Follow the steps to add Microsoft Entra ID monitoring plan in the Netwrix Auditor.
-
**Step 1 –** In the Monitoring Plans, click **Add Plan** button.
**Step 2 –** Create a monitoring plan with the Microsoft Entra ID data source.
@@ -155,7 +147,7 @@ Microsoft Entra ID monitoring plan has been added to Auditor and initial data co
### Obtain Tenant Name
-Follow the steps to obtain the tenant name.
+To obtain the tenant name:
**Step 1 –** Navigate to **Microsoft Entra ID** > **Overview**.
diff --git a/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/permissions.md b/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/permissions.md
index 75935c0eb1..46018c673b 100644
--- a/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/permissions.md
+++ b/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/permissions/permissions.md
@@ -6,11 +6,10 @@ sidebar_position: 20
# Permissions for Microsoft Entra ID Auditing
-Auditor allows you to audit Office 365 organizations that have established modern authentication as
+Auditor audits Office 365 organizations that have established modern authentication as
their identity management approach, including support for
[multi-factor authentication (MFA)](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks).
-To learn more about modern authentication, refer to the following Microsoft article:
-[What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication).
+See the Microsoft article [What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication) for more information on modern authentication.
In this scenario, Netwrix Auditor will access the cloud-based infrastructure via Microsoft Graph and
other modern APIs, being authenticated through a pre-configured Microsoft Entra ID (formerly Azure
@@ -20,7 +19,7 @@ app and provide its settings to Auditor when configuring a monitored item.
## For Microsoft Entra ID Auditing
To collect audit data in your cloud-based environment, Netwrix uses a dedicated Microsoft Entra ID
-application and leverages APIs access permissions granted to that app. To register such application
+application with API access permissions granted to that app. To register such application
and assign required permissions, a Microsoft Entra ID account with an administrative role will be
required:
@@ -72,8 +71,6 @@ service principal using Microsoft Entra ID Admin portal:
### Configure Client Secret
-Follow the steps to create a new client secret to be used by the app.
-
**Step 1 –** Go to **Manage** > **Certificates & secrets** and click **New client secret**.
**Step 2 –** Enter the description. From the expiration options select **24 months**.
@@ -88,8 +85,6 @@ See the following Microsoft article for more information on how to add a client
### Obtain Tenant Name
-Follow the steps to obtain the tenant name.
-
**Step 1 –** Go to **Microsoft Entra ID** > **Overview**.
**Step 2 –** In the Tenant Information section, locate the **Primary domain** field, copy its value
diff --git a/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/ports.md b/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/ports.md
index ef03513b55..16fc5687ca 100644
--- a/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/ports.md
+++ b/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/ports.md
@@ -19,5 +19,5 @@ Tip for reading the table: For example, on the computer where Netwrix Auditor Se
| Port | Protocol | Source | Target | Purpose |
| ---- | -------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- |
-| 80 | TCP/UDP | Netwrix Auditor Server | For a full list of Microsoft Entra ID URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | login.windows.net graph.windows.net manage.office.com |
-| 443 | TCP/UDP | Netwrix Auditor Server | For a full list of Microsoft Entra ID URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | login.windows.net graph.windows.net manage.office.com |
+| 80 | TCP/UDP | Netwrix Auditor Server | For a full list of Microsoft Entra ID URLs, see the Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | login.windows.net graph.windows.net manage.office.com |
+| 443 | TCP/UDP | Netwrix Auditor Server | See the Microsoft support article [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) for a full list of Microsoft Entra ID URLs | login.windows.net graph.windows.net manage.office.com |
diff --git a/docs/auditor/10.7/configuration/microsoft365/sharepointonline/overview.md b/docs/auditor/10.7/configuration/microsoft365/sharepointonline/overview.md
index 9bf23794c9..dd2ea7348b 100644
--- a/docs/auditor/10.7/configuration/microsoft365/sharepointonline/overview.md
+++ b/docs/auditor/10.7/configuration/microsoft365/sharepointonline/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -48,7 +48,7 @@ OneDrive for Business changes are reported as SharePoint Online.
## Sensitive data
-Starting with the version 10, Netwrix Auditor is able to report about sensitive data in your IT
+Starting with the version 10, Netwrix Auditor can report about sensitive data in your IT
infrastructure. Pay attention to the "_Data categories_" column in search and reports (for the
"_Document_" object types only). See the
[Sensitive Data Discovery ](/docs/auditor/10.7/admin/settings/sensitivedatadiscovery.md)topic for additional
diff --git a/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/basicauth.md b/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/basicauth.md
index addafa008f..54b9a9c15e 100644
--- a/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/basicauth.md
+++ b/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/basicauth.md
@@ -47,8 +47,6 @@ your Netwrix Auditor, consider that after the upgrade you will have to perform t
procedure again, selecting one of these approaches. Until then, data collection will not be
performed.
-Follow the steps to assign a privileged role to the account.
-
**Step 1 –** Sign in to Microsoft Entra ID portal using your Microsoft account.
**Step 2 –** Select Microsoft Entra ID on the left.
@@ -56,7 +54,7 @@ Follow the steps to assign a privileged role to the account.
**Step 3 –** Select the account that you want to use as data collecting account, or create a new
user.
-**Step 4 –** Make sure you have disabled multi-factor authentication for this account.
+**Step 4 –** ensure you have disabled multi-factor authentication for this account.
**Step 5 –** Expand Directory role and select the role you need (for example, Global admin or any
other privileged role).
diff --git a/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/modernauth/manifest.md b/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/modernauth/manifest.md
index 7c63e057d2..8203473478 100644
--- a/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/modernauth/manifest.md
+++ b/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/modernauth/manifest.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Assigning Application Permissions Using Manifest
-Follow the steps to assign application permissions using Manifest.
-
**Step 1 –** Under **App registrations**, select the newly created app.
**Step 2 –** Select **Manifest** on the left.
diff --git a/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/modernauth/modernauth.md b/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/modernauth/modernauth.md
index c3316501c3..517e2d3cf0 100644
--- a/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/modernauth/modernauth.md
+++ b/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/modernauth/modernauth.md
@@ -15,8 +15,7 @@ appropriate access permissions.
If you plan to implement such scenario, you should register an Microsoft Entra ID app manually and
provide its settings to Auditor when configuring a monitored item.
-Support for modern authentication will allow you to audit the organizations where MFA is enabled for
-all users, including service accounts.
+Modern authentication lets you audit organizations where MFA is enabled for all users, including service accounts.
Required configuration procedure includes several manual steps, as described in the corresponding
section:
@@ -48,8 +47,6 @@ You will need to create a dedicated app for each cloud-based data source you pla
If you plan to audit all of them, you need to create 4 apps.
-Follow the steps to register a new Microsoft Entra ID application.
-
**Step 1 –** Sign into the **Microsoft 365 Admin Center** with your _Global Administrator_,
_Application Administrator_ or _Cloud Application Administrator_ account and go to the **Microsoft
Entra ID admin center**.
@@ -122,8 +119,6 @@ service principal using Microsoft Entra ID Admin portal:
### Configuring client secret
-Follow the steps to create a new client secret to be used by the app.
-
**Step 1 –** Go to **Manage** > **Certificates & secrets** and click **New client secret**.
**Step 2 –** Enter the description. From the expiration options select **24 months**.
@@ -138,8 +133,6 @@ See the following Microsoft article for more information on how to add a client
### Obtaining tenant name
-Follow the steps to obtain the tenant name.
-
**Step 1 –** Navigate to **Microsoft Entra ID** > **Overview**.
**Step 2 –** In the **Tenant information** locate the **Primary domain** field, copy its value and
diff --git a/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/permissions.md b/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/permissions.md
index 1df49b0c1b..c62dc07d9e 100644
--- a/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/permissions.md
+++ b/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/permissions.md
@@ -6,11 +6,10 @@ sidebar_position: 20
# Permissions for SharePoint Online Auditing
-Auditor allows you to audit Office 365 organizations that have established modern authentication as
+Auditor audits Office 365 organizations that have established modern authentication as
their identity management approach, including support for
[multi-factor authentication (MFA)](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks).
-To learn more about modern authentication, refer to the following Microsoft article:
-[What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication).
+See the Microsoft article [What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication) for more information on modern authentication.
In this scenario, Netwrix Auditor will access the cloud-based infrastructure via Microsoft Graph and
other modern APIs, being authenticated through a pre-configured Microsoft Entra ID (formerly Azure
@@ -20,13 +19,13 @@ app and provide its settings to Auditor when configuring a monitored item.
## Authentication for SharePoint Online Auditing
To collect audit data from your SharePoint Online and OneDrive for Business, Netwrix Auditor uses a
-dedicated Microsoft Entra ID application and leverages APIs access permissions granted to that app.
+dedicated Microsoft Entra ID application with API access permissions granted to that app.
To register this application and assign required permissions, an Microsoft Entra ID account with an
administrative role will be required:
- If Modern Authentication is used:
- Microsoft Entra ID application should be created manually by user with administrative role and
- assigned required permissions. This app will allow you to collect both activity and
+ assigned required permissions. This app lets you collect both activity and
state-in-time data. See the
[Configuring Microsoft Entra ID App for Auditing SharePoint Online](/docs/auditor/10.7/configuration/microsoft365/sharepointonline/permissions/modernauth/modernauth.md#configuring-microsoft-entra-id-app-for-auditing-sharepoint-online)
section for additional information.
diff --git a/docs/auditor/10.7/configuration/microsoft365/sharepointonline/ports.md b/docs/auditor/10.7/configuration/microsoft365/sharepointonline/ports.md
index 9b04303ca0..bbc05b76ba 100644
--- a/docs/auditor/10.7/configuration/microsoft365/sharepointonline/ports.md
+++ b/docs/auditor/10.7/configuration/microsoft365/sharepointonline/ports.md
@@ -18,5 +18,5 @@ Tip for reading the table: For example, on the computer where Netwrix Auditor Se
| Port | Protocol | Source | Target | Purpose |
| ---- | -------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- |
-| 80 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | login.windows.net graph.windows.net manage.office.com |
-| 443 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | login.windows.net graph.windows.net manage.office.com |
+| 80 | TCP | Netwrix Auditor Server | See the Microsoft support article [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) for a full list of Office 365 URLs | login.windows.net graph.windows.net manage.office.com |
+| 443 | TCP | Netwrix Auditor Server | See the Microsoft support article [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) for a full list of Office 365 URLs | login.windows.net graph.windows.net manage.office.com |
diff --git a/docs/auditor/10.7/configuration/microsoft365/teams/overview.md b/docs/auditor/10.7/configuration/microsoft365/teams/overview.md
index 6edd2f4cd5..0f90e03ffc 100644
--- a/docs/auditor/10.7/configuration/microsoft365/teams/overview.md
+++ b/docs/auditor/10.7/configuration/microsoft365/teams/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -36,7 +36,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
Auditor can monitor for operations with MS Teams entities, collect state-in-time snapshots and track
changes to the object attributes. This section provides detailed information on these activities.
-Starting with the version 10.5, Auditor is able to report about sensitive data in your IT
+Starting with the version 10.5, Auditor can report about sensitive data in your IT
infrastructure. Pay attention to the "_Data categories_" column in search and reports (for the
"_Document_" object types only). Refer to
[Sensitive Data Discovery ](/docs/auditor/10.7/admin/settings/sensitivedatadiscovery.md) for detailed
diff --git a/docs/auditor/10.7/configuration/microsoft365/teams/permissions/basicauth.md b/docs/auditor/10.7/configuration/microsoft365/teams/permissions/basicauth.md
index 261e943771..4d97d15fdd 100644
--- a/docs/auditor/10.7/configuration/microsoft365/teams/permissions/basicauth.md
+++ b/docs/auditor/10.7/configuration/microsoft365/teams/permissions/basicauth.md
@@ -39,8 +39,6 @@ your Netwrix Auditor, consider that after the upgrade you will have to perform t
procedure again, selecting one of these approaches. Until then, data collection will not be
performed.
-Follow the steps to assign a privileged role to the account.
-
**Step 1 –** Sign in to Microsoft Entra ID portal using your Microsoft account.
**Step 2 –** Select Microsoft Entra ID on the left.
@@ -48,7 +46,7 @@ Follow the steps to assign a privileged role to the account.
**Step 3 –** Select the account that you want to use as data collecting account, or create a new
user.
-**Step 4 –** Make sure you have disabled multi-factor authentication for this account.
+**Step 4 –** ensure you have disabled multi-factor authentication for this account.
**Step 5 –** Expand Directory role and select the role you need (for example, Global admin or any
other privileged role).
diff --git a/docs/auditor/10.7/configuration/microsoft365/teams/permissions/modernauth/manifest.md b/docs/auditor/10.7/configuration/microsoft365/teams/permissions/modernauth/manifest.md
index e326caaf65..af535ce5ae 100644
--- a/docs/auditor/10.7/configuration/microsoft365/teams/permissions/modernauth/manifest.md
+++ b/docs/auditor/10.7/configuration/microsoft365/teams/permissions/modernauth/manifest.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Assign Application Permissions Using Manifest
-Follow the steps to assign application permissions using manifest.
-
**Step 1 –** Under **App registrations**, select the newly created app.
**Step 2 –** Select **Manifest** on the left.
diff --git a/docs/auditor/10.7/configuration/microsoft365/teams/permissions/modernauth/modernauth.md b/docs/auditor/10.7/configuration/microsoft365/teams/permissions/modernauth/modernauth.md
index 68065d0d2f..ba90d33783 100644
--- a/docs/auditor/10.7/configuration/microsoft365/teams/permissions/modernauth/modernauth.md
+++ b/docs/auditor/10.7/configuration/microsoft365/teams/permissions/modernauth/modernauth.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Using Modern Authentication with MS Teams
-Modern authentication allows you to audit MS Teams environments without using an account with basic
+Modern authentication lets you audit MS Teams environments without using an account with basic
authentication. The configuration procedure includes several manual steps, as described below.
### Access MS Teams Using Modern Authentication
@@ -22,8 +22,6 @@ provide its settings to Netwrix Auditor when configuring a monitored item.
## Configure the Microsoft Entra ID App for Auditing MS Teams
-Follow the steps to use a data collecting account with modern authentication:
-
**Step 1 –** Create an Microsoft Entra ID app that will be used for modern authentication. See the
Create and Register a New App in Microsoft Entra ID section for additional information.
@@ -47,8 +45,6 @@ You will need to create a dedicated app for each cloud-based data source you pla
If you plan to audit all of them, you need to create 4 apps.
-Follow the steps to register a new Microsoft Entra ID application.
-
**Step 1 –** Sign into the **Microsoft 365 Admin Center** with your _Global Administrator_,
_Application Administrator_ or _Cloud Application Administrator_ account and go to the **Microsoft
Entra ID admin center**.
@@ -120,8 +116,6 @@ service principal using Microsoft Entra ID Admin portal:
### Configure Client Secret
-Follow the steps to create a new client secret to be used by the app.
-
**Step 1 –** Go to **Manage** > **Certificates & secrets** and click **New client secret**.
**Step 2 –** Enter the description. From the expiration options select **24 months**.
@@ -136,7 +130,6 @@ See the following Microsoft article for more information on how to add a client
### Add MS Teams monitoring plan
-Follow the steps to add MS Teams monitoring plan in the Netwrix Auditor.
**Step 1 –** In the Monitoring Plans, click **Add Plan** button.
@@ -158,7 +151,6 @@ MS Teams monitoring plan has been added to Auditor and initial data collection
### Obtain Tenant Name
-Follow the steps to obtain the tenant name.
**Step 1 –** Navigate to **Microsoft Entra ID** > **Overview**.
diff --git a/docs/auditor/10.7/configuration/microsoft365/teams/permissions/permissions.md b/docs/auditor/10.7/configuration/microsoft365/teams/permissions/permissions.md
index efce2c80b5..cc6c3f6cfb 100644
--- a/docs/auditor/10.7/configuration/microsoft365/teams/permissions/permissions.md
+++ b/docs/auditor/10.7/configuration/microsoft365/teams/permissions/permissions.md
@@ -6,18 +6,17 @@ sidebar_position: 20
# Permissions for Teams Auditing
-Auditor allows you to audit Office 365 organizations that have established modern authentication as
+Auditor audits Office 365 organizations that have established modern authentication as
their identity management approach, including support for
[multi-factor authentication (MFA)](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks).
-To learn more about modern authentication, refer to the following Microsoft article:
-[What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication).
+See the Microsoft article [What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication) for more information on modern authentication.
In this scenario, Netwrix Auditor will access the cloud-based infrastructure via Microsoft Graph and
other modern APIs, being authenticated through a pre-configured Microsoft Entra ID (formerly Azure
AD) application with appropriate access permissions. So, you should register an Microsoft Entra ID
app and provide its settings to Auditor when configuring a monitored item.
-**NOTE:** In some scenarios multi-factor authentication cannot be enabled for Auditor service
+**NOTE:** In some scenarios multi-factor authentication can't be enabled for Auditor service
account. If so, you will need to configure an account with basic authentication to access Microsoft
Entra ID/Office 365 tenant.
@@ -27,7 +26,7 @@ Before you start creating a monitoring plan to audit your Active Directory, plan
that will be used for data collection – it should meet the requirements listed in this topic. Then
you will provide this account in the monitoring plan wizard (or in the monitored item settings).
-Refer to the following topics to access Microsoft teams:
+See the following topics to access Microsoft Teams:
- [Using Basic Authentication with MS Teams](/docs/auditor/10.7/configuration/microsoft365/teams/permissions/basicauth.md)
- [Using Modern Authentication with MS Teams](/docs/auditor/10.7/configuration/microsoft365/teams/permissions/modernauth/modernauth.md)
diff --git a/docs/auditor/10.7/configuration/microsoft365/teams/ports.md b/docs/auditor/10.7/configuration/microsoft365/teams/ports.md
index 0c23e694f7..7d7152143a 100644
--- a/docs/auditor/10.7/configuration/microsoft365/teams/ports.md
+++ b/docs/auditor/10.7/configuration/microsoft365/teams/ports.md
@@ -18,5 +18,5 @@ Tip for reading the table: For example, on the computer where Netwrix Auditor Se
| Port | Protocol | Source | Target | Purpose |
| ---- | -------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
-| 80 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
-| 443 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
+| 80 | TCP | Netwrix Auditor Server | See the Microsoft support article [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) for a full list of Office 365 URLs | outlook.office365.com graph.windows.net manage.office.com |
+| 443 | TCP | Netwrix Auditor Server | See the Microsoft support article [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) for a full list of Office 365 URLs | outlook.office365.com graph.windows.net manage.office.com |
diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md
index 541311a546..ad7697d84c 100644
--- a/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md
+++ b/docs/auditor/10.7/configuration/networkdevices/ciscoasa.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -33,7 +33,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
- The `logging host` parameter is set to the host address of the audited CiscoASA device.
And UDP port (for, example 514) is used for sending messages.
- **NOTE:** Do not select the EMBLEM format logging for the syslog server option.
+ **NOTE:** Don't select the EMBLEM format logging for the syslog server option.
- The `logging timestamp` option enabled.
- The `logging trap` option is selected from 1 to 6 inclusive.
@@ -53,12 +53,12 @@ To configure your Cisco ASA devices, do the following:
hostname(config)# logging enable
4. Set the IP address of the computer that hosts Netwrix Auditor Server as the `logging host`
- parameter. And make sure that the UDP port is used for sending syslog messages (e.g., 514 UDP
+ parameter. And ensure that the UDP port is used for sending syslog messages (e.g., 514 UDP
port). For example:
hostname(config)# logging host ``
- Do not select the EMBLEM format logging for the syslog server option.
+ Don't select the EMBLEM format logging for the syslog server option.
5. Enable the `logging timestamp` option. For example:
diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md
index b4f9448cd2..e014dbb206 100644
--- a/docs/auditor/10.7/configuration/networkdevices/ciscoios.md
+++ b/docs/auditor/10.7/configuration/networkdevices/ciscoios.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -48,7 +48,7 @@ To configure your Cisco IOS devices, do the following:
Router# logging trap 5
-5. Set the IP address of the Netwrix Auditor Server as the logging host parameter. And make sure
+5. Set the IP address of the Netwrix Auditor Server as the logging host parameter. And ensure
that the UDP port is used for sending syslog messages (e.g., 514 UDP port). For example:
Router# logging 192.168.1.5
diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscomerakidashboard.md b/docs/auditor/10.7/configuration/networkdevices/ciscomerakidashboard.md
index 52dd34928e..0f4d51821f 100644
--- a/docs/auditor/10.7/configuration/networkdevices/ciscomerakidashboard.md
+++ b/docs/auditor/10.7/configuration/networkdevices/ciscomerakidashboard.md
@@ -31,30 +31,28 @@ item.
For Basic Authorization
-Since accounts with multi-factor authentication are not supported, you need to create a special
+Since accounts with multi-factor authentication aren't supported, you need to create a special
cloud account with read-only permissions and disabled multi-factor authentication.
-Follow the steps to configure Cisco Meraki Dashboard item.
-
**Step 1 –** Sign in to the
[Cisco Meraki Dashboard](https://account.meraki.com/secure/login/dashboard_login).
**Step 2 –** Create a dashboard account as described in the following Cisco Meraki article:
[Getting Started](https://documentation.meraki.com/Getting_Started)
-**Step 3 –** Make sure that the read-only permissions assigned to the account. For more information
-about Meraki permissions, refer to the following Cisco Meraki article:
+**Step 3 –** ensure that the read-only permissions assigned to the account. For more information
+about Meraki permissions, see the Cisco Meraki article
[Managing Dashboard Administrators and Permissions](https://documentation.meraki.com/zGeneral_Administration/Managing_Dashboard_Access/Managing_Dashboard_Administrators_and_Permissions).
**Step 4 –** Log in to this account and navigate to **My Profile** at the top of the dashboard.
**Step 5 –** Find the section labeled SMS authentication.
-**Step 6 –** Make sure that the SMS authentication parameter is set to **OFF**. For more information
-about authentication, refer to the following Cisco Meraki article:
+**Step 6 –** ensure that the SMS authentication parameter is set to **OFF**. For more information
+about authentication, see the Cisco Meraki article
[Two-Factor Authentication](https://documentation.meraki.com/zGeneral_Administration/Other_Topics/Two-Factor_Authentication).
-**NOTE:** This account is for Netwrix Auditor purposes. Do not forget to switch back to your
+**NOTE:** This account is for Netwrix Auditor purposes. Don't forget to switch back to your
account.
To Collect Data via API Key
@@ -62,21 +60,19 @@ To Collect Data via API Key
To work with multi-factor authentication (MFA) accounts, you need to generate an API key during
authorization.
-Follow the steps to create an API key for the Meraki Dashboard API.
-
**Step 1 –** Log in to your Cisco Meraki Dashboard account.
-**Step 2 –** Click on your username in the top-right corner of the dashboard to open the drop-down
+**Step 2 –** Click your username in the top-right corner of the dashboard to open the dropdown
menu.
**Step 3 –** Select **My profile**.
**Step 4 –** In the **My profile** page, scroll down to the **API access** section.
-**Step 5 –** Click on the **Generate new API key** button. You may be prompted to enter your account
+**Step 5 –** Click the **Generate new API key** button. You may be prompted to enter your account
password for security verification.
-Once generated, the API key will be displayed on the screen. Make sure to copy and save the API key
+Once generated, the API key will be displayed on the screen. Ensure to copy and save the API key
in a secure location, as it won't be displayed again for security reasons.
-**NOTE:** Logons are not collected on the board due to technical limitations from the Meraki API.
+**NOTE:** Logons aren't collected on the board due to technical limitations from the Meraki API.
diff --git a/docs/auditor/10.7/configuration/networkdevices/ciscomerakidevices.md b/docs/auditor/10.7/configuration/networkdevices/ciscomerakidevices.md
index 4526f72eb4..38ded43be8 100644
--- a/docs/auditor/10.7/configuration/networkdevices/ciscomerakidevices.md
+++ b/docs/auditor/10.7/configuration/networkdevices/ciscomerakidevices.md
@@ -11,8 +11,6 @@ To configure Cisco Meraki devices, configure the Syslog server for each of your
Netwrix recommends assigning a unique identificator to each Cisco Meraki device; otherwise, the
product may count them as a single anonymous device.
-Follow the steps to configure the Syslog server.
-
**Step 1 –** Sign in to
[Cisco Meraki Dashboard](https://account.meraki.com/secure/login/dashboard_login).
diff --git a/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md
index e2ec396d9b..f29d12a3c2 100644
--- a/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md
+++ b/docs/auditor/10.7/configuration/networkdevices/fortinetfortigate.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
diff --git a/docs/auditor/10.7/configuration/networkdevices/hpearuba.md b/docs/auditor/10.7/configuration/networkdevices/hpearuba.md
index 43a8e0725b..d53ab828e8 100644
--- a/docs/auditor/10.7/configuration/networkdevices/hpearuba.md
+++ b/docs/auditor/10.7/configuration/networkdevices/hpearuba.md
@@ -61,7 +61,7 @@ To configure HPE Aruba devices through the Management Console
5. Click Submit. The new server is added to the Syslog Servers list.
6. Click Pending Changes on the right.
-7. In the Pending Changes for `` Managed Controller(s) dialog, select the device you want to
+7. In the Pending Changes for `` Managed Controllers dialog, select the device you want to
apply changes to.
8. Click Deploy Changes.
9. If the configuration is correct, you will see the following wizard:
diff --git a/docs/auditor/10.7/configuration/networkdevices/juniper.md b/docs/auditor/10.7/configuration/networkdevices/juniper.md
index 42e08c3ee4..14c2f019a2 100644
--- a/docs/auditor/10.7/configuration/networkdevices/juniper.md
+++ b/docs/auditor/10.7/configuration/networkdevices/juniper.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
diff --git a/docs/auditor/10.7/configuration/networkdevices/paloalto.md b/docs/auditor/10.7/configuration/networkdevices/paloalto.md
index 4f14fc45d3..af36b45541 100644
--- a/docs/auditor/10.7/configuration/networkdevices/paloalto.md
+++ b/docs/auditor/10.7/configuration/networkdevices/paloalto.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -32,8 +32,6 @@ You can configure your IT Infrastructure for monitoring in one of the following
To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings
for each log type.
-Follow the steps to configure a Syslog server profile.
-
**Step 1 –** Connect to your PaloAlto device: launch an Internet browser and enter the IP address of
the firewall in the URL field (https://``).
@@ -52,8 +50,6 @@ the firewall in the URL field (https://``).
| Format | Select IETF. |
| Facility | Netwrix recommends using default values. |
-Follow the steps to configure syslog forwarding.
-
**Step 1 –** In the Web Interface, navigate to **Device** > **Log Settings**.
**Step 2 –** For System, Config, and User ID logs, click Add and enter unique name of your syslog
diff --git a/docs/auditor/10.7/configuration/networkdevices/permissions.md b/docs/auditor/10.7/configuration/networkdevices/permissions.md
index 2f2caf7d1f..e8d69c8bb9 100644
--- a/docs/auditor/10.7/configuration/networkdevices/permissions.md
+++ b/docs/auditor/10.7/configuration/networkdevices/permissions.md
@@ -12,5 +12,5 @@ provide this account in the monitoring plan wizard.
| For... | Requirement |
| ----------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| - Cisco ASA - Cisco IOS - Cisco FTD - Fortinet - HPE Aruba - Juniper - Palo Alto - Pulse Secure - SonicWall - HPE | You can use any account (not necessarily the credentials used to connect to the device itself), as long as these credentials do not affect Netwrix Auditor or monitored IT infrastructure. Provide this account in the monitoring plan wizard. |
+| - Cisco ASA - Cisco IOS - Cisco FTD - Fortinet - HPE Aruba - Juniper - Palo Alto - Pulse Secure - SonicWall - HPE | You can use any account (not necessarily the credentials used to connect to the device itself), as long as these credentials don't affect Netwrix Auditor or monitored IT infrastructure. Provide this account in the monitoring plan wizard. |
| - Cisco Meraki | See the [Configure Cisco Meraki Dashboard Account](ciscomerakidashboard.md#configure-cisco-meraki-dashboard-account) section for additional information. |
diff --git a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md
index 49d7dc0148..83d61d78e1 100644
--- a/docs/auditor/10.7/configuration/networkdevices/sonicwall.md
+++ b/docs/auditor/10.7/configuration/networkdevices/sonicwall.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -112,16 +112,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw
| Object type | Actions | Event ID |
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed |
-| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | |
+| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | |
| - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | |
| Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success |
-| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | |
+| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | |
| - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | |
| Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated |
-| - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | |
-| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | |
+| - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP/HTTPS Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | |
+| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | |
| | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older |
-| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server |
+| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server |
| Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= |
| - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | |
| - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | |
diff --git a/docs/auditor/10.7/configuration/oracle/database.md b/docs/auditor/10.7/configuration/oracle/database.md
index 22c6bd2cda..05c67ffa74 100644
--- a/docs/auditor/10.7/configuration/oracle/database.md
+++ b/docs/auditor/10.7/configuration/oracle/database.md
@@ -31,10 +31,10 @@ The following auditing modes are available for Oracle Database 12c, 18c, 19c:
changes, user actions, component actions, etc.
- Mixed Mode—Default auditing in a newly installed database. It enables both traditional and the new
- **Unified Auditing** facilities. Netwrix recommends using **Unified Auditing** mode if you do not
+ **Unified Auditing** facilities. Netwrix recommends using **Unified Auditing** mode if you don't
have any trail audit facilities in your infrastructure.
- The product does not log any errors on these events to the Netwrix Auditor System Health log.
+ The product doesn't log any errors on these events to the Netwrix Auditor System Health log.
To configure Oracle Database 12c, 18c, 19c Unified Auditing
@@ -81,7 +81,7 @@ Oracle Database administration documents:
- `[CREATE AUDIT POLICY](https://docs.oracle.com/database/121/SQLRF/statements_5001.htm#create-audit-policy)`
- `[AUDIT POLICY](http://docs.oracle.com/database/121/SQLRF/statements_4008.htm#audit-policy)`
-Currently, Netwrix Auditor checks audit settings for Unified Auditing when accomptability is enabled
+Netwrix Auditor checks audit settings for Unified Auditing when accomptability is enabled
for `ACTIONS`. If any of your current settings conflict with the audit configuration required for
Netwrix Auditor, these conflicts will be listed in the Netwrix Auditor System Health event log.
@@ -106,11 +106,9 @@ Starting with version 10.5, Auditor provides limited support of Oracle Database
for additional information.
Verify that Oracle Data Provider for .NET and Oracle Instant Client are installed and properly
-configured on the computer where Auditor Server is installed. The product does not provide any
+configured on the computer where Auditor Server is installed. The product doesn't provide any
special notification for that.
-Follow the steps to configure **Standard Auditing** on your Oracle Database 11g:
-
**Step 1 –** Select the audit trail to store audit records. Oracle Database has the following
options:
@@ -122,8 +120,6 @@ options:
### Store Oracle Audit Records
-Follow the steps to select Audit Trail to store Oracle Audit Records:
-
**Step 1 –** On the computer where your database is deployed, run the sqlplus tool.
**Step 2 –** Connect to your Oracle Database using Oracle account with the `SYSDBA` privilege. For
@@ -148,7 +144,7 @@ the following:
`STARTUP`
-If you only changed auditing settings, database restart is not required.
+If you only changed auditing settings, database restart isn't required.
If you are using Oracle Real Application Clusters (RAC), see the
[Starting and Stopping Instances and Oracle RAC Databases](https://docs.oracle.com/cd/E11882_01/rac.112/e41960/admin.htm#starting-and-stopping-instances-and-oracle-rac-databases)
@@ -157,8 +153,6 @@ on restarting your instances.
### Enable Auditing of Oracle Database Changes
-Follow the steps to enable auditing of Oracle Database changes:
-
**Step 1 –** On the computer where your database is deployed, run the sqlplus tool.
**Step 2 –** Connect to your Oracle Database—use Oracle account with the `SYSDBA` privilege. For
diff --git a/docs/auditor/10.7/configuration/oracle/finegained.md b/docs/auditor/10.7/configuration/oracle/finegained.md
index 25712703df..fdc42a49c3 100644
--- a/docs/auditor/10.7/configuration/oracle/finegained.md
+++ b/docs/auditor/10.7/configuration/oracle/finegained.md
@@ -7,11 +7,11 @@ sidebar_position: 40
# Configure Fine Grained Auditing
When configuring Fine Grained Auditing, you need to create an audit policy with required parameters
-set. The section below explains how to create, disable and delete such audit policies.
+set. The section below explains how to create, disable, and delete such audit policies.
Fine Grained audit policies can be configured for Oracle Database Enterprise Edition only. Keep in
mind that if you have Fine Grained policies configured, you will receive a permanent error in the
-Netwrix Auditor System Health log because Netwrix Auditor cannot detect it. Use Unified and Standard
+Netwrix Auditor System Health log because Netwrix Auditor can't detect it. Use Unified and Standard
audit policies to keep track of data changes.
To configure Fine Grained Auditing:
diff --git a/docs/auditor/10.7/configuration/oracle/overview.md b/docs/auditor/10.7/configuration/oracle/overview.md
index c6d1c4a88f..311811a1ec 100644
--- a/docs/auditor/10.7/configuration/oracle/overview.md
+++ b/docs/auditor/10.7/configuration/oracle/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -42,7 +42,7 @@ different auditing types:
| --------------------------------------- | --------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Unified Auditing | Oracle Database 23c, 21c, 19c, 18c, 12c | Consolidates all auditing into a single repository and view. This provides a two-fold simplification: audit data can now be found in a single location and all audit data is in a single format. See [Configure Oracle Database for Auditing](/docs/auditor/10.7/configuration/oracle/database.md) topic for more information. |
| Fine Grained Auditing | Oracle Database 23c, 21c, 19c, 18c, 12c, 11g Available for **Enterprise Edition** only. | Supports auditing of actions associated with columns in application tables — along with conditions necessary for an audit record to be generated. Helps to focus on security-relevant columns and rows, ignoring areas that are less important. See [Configure Fine Grained Auditing](/docs/auditor/10.7/configuration/oracle/finegained.md) topic for more information. |
-| Standard Auditing (trail auditing mode) | Oracle Database 11g | See topic for more information. Use initialization parameters and the `AUDIT` and `NOAUDIT` SQL statements to audit: - SQL statements - privileges - schema objects - network and multitier activities See [Oracle documentation](https://docs.oracle.com/cd/E11882_01/server.112/e10575/tdpsg_auditing.htm#oracle-documentation) for more information. Starting with version 10.5, Netwrix Auditor provides limited support of Oracle Database 11g and trail auditing mode, in particular: Netwrix Auditor client UI does not display any warnings and / or errors related to Standard Auditing mode operation. |
+| Standard Auditing (trail auditing mode) | Oracle Database 11g | See topic for more information. Use initialization parameters and the `AUDIT` and `NOAUDIT` SQL statements to audit: - SQL statements - privileges - schema objects - network and multitier activities See [Oracle documentation](https://docs.oracle.com/cd/E11882_01/server.112/e10575/tdpsg_auditing.htm#oracle-documentation) for more information. Starting with version 10.5, Netwrix Auditor provides limited support of Oracle Database 11g and trail auditing mode, in particular: Netwrix Auditor client UI doesn't display any warnings and / or errors related to Standard Auditing mode operation. |
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -58,16 +58,16 @@ dates set by the vendor. So, when planning your Netwrix Auditor deployment, cons
- Several limitations apply to Oracle 11g support in Netwrix Auditor 9.96:
- - Oracle wallets are not supported
- - Lightweight drivers for Oracle Instant Client are not supported
- - Auditor client UI does not display any warnings and / or errors regarding to trail audit mode
+ - Oracle wallets aren't supported
+ - Lightweight drivers for Oracle Instant Client aren't supported
+ - Auditor client UI doesn't display any warnings and / or errors regarding to trail audit mode
operation
- If you are using Oracle Database 11g and have performed seamless upgrade to the latest version of
- Auditor, the audit data collection will operate properly. However, consider and keep in mind
- Oracle Database 11g support expiration dates.
+ Auditor, the audit data collection will operate properly. However, note
+ the Oracle Database 11g support expiration dates.
-If you are using Oracle Database 12c or later, make sure you have Unified auditing mode enabled.
+If you are using Oracle Database 12c or later, ensure you have Unified auditing mode enabled.
Otherwise, Netwrix Auditor may not operate properly. See the [Migrate to Unified Audit](/docs/auditor/10.7/configuration/oracle/unified.md)
topic for additional information.
@@ -78,7 +78,7 @@ See the [Software Requirements](/docs/auditor/10.7/requirements/software.md) top
If you are using Oracle Wallet to connect to your database, see the
[Create and Configure Oracle Wallet](/docs/auditor/10.7/configuration/oracle/wallet.md) topic for configuration details.
-Oracle Wallet is not supported for Oracle 11g. If you are unsure of your audit settings, refer to
+Oracle Wallet isn't supported for Oracle 11g. If you are unsure of your audit settings, refer to
the [Verify Your Oracle Database Audit Settings](/docs/auditor/10.7/configuration/oracle/verifysettings.md)
Follow the steps for proper configuration.
@@ -111,7 +111,7 @@ displayed).
| - Directory | - Added / Add (Failed attempt) - Removed / Remove (Failed attempt) | - Cause (for failed attempts) - Container name\*\* - Database User - Program name / Database session requester\*\* - Privilege for action - Session ID - Object schema |
| Executable objects | | |
| - Procedure - Function - Package - Package body - Java | - Added / Add (Failed attempt) - Modified / Modify (Failed attempt) - Removed / Remove (Failed attempt) | - Cause (for failed attempts) - Container name\*\* - Database User - Privilege for action - Program name / Database session requester\*\* - Session ID - Unified policy name\*\* |
-| For Oracle 11g database Modified / Modify (Failed attempt) events will not be monitored for the following objects: _Procedure, Function, Package, Package body_ since native audit of these events is not supported. See the [Database SQL Language Reference](https://docs.oracle.com/cd/B28359_01/server.111/b28286/statements_4007.htm#database-sql-language-reference) for additional information. | | |
+| For Oracle 11g database Modified / Modify (Failed attempt) events will not be monitored for the following objects: _Procedure, Function, Package, Package body_ since native audit of these events isn't supported. See the [Database SQL Language Reference](https://docs.oracle.com/cd/B28359_01/server.111/b28286/statements_4007.htm#database-sql-language-reference) for additional information. | | |
| Logons | | |
| - Logon | - Successful logon / Failed logon - Logoff | - Cause (for failed attempts) - Client IP (only for logon events) - Container name\*\* - Database User - Privilege for action - Program name / Database session requester\*\* - Session ID - Object schema - Unified policy name\*\* |
| Materialized views | | |
diff --git a/docs/auditor/10.7/configuration/oracle/permissions.md b/docs/auditor/10.7/configuration/oracle/permissions.md
index 5b982b94ce..0a7dd2f0e4 100644
--- a/docs/auditor/10.7/configuration/oracle/permissions.md
+++ b/docs/auditor/10.7/configuration/oracle/permissions.md
@@ -15,10 +15,9 @@ required:
Alternatively, you can assign the default administrator role to that account.
-You can grant the required privileges to the existing account, or create a new one. Follow the
-procedure described below.
+You can grant the required privileges to the existing account, or create a new one.
-Follow the steps to grant CREATE SESSION and SELECT privileges to the account.
+## Grant CREATE SESSION and SELECT privileges
**Step 1 –** On the computer where your database is deployed, run the sqlplus tool.
diff --git a/docs/auditor/10.7/configuration/oracle/unified.md b/docs/auditor/10.7/configuration/oracle/unified.md
index 1fe9ec7543..534ba97716 100644
--- a/docs/auditor/10.7/configuration/oracle/unified.md
+++ b/docs/auditor/10.7/configuration/oracle/unified.md
@@ -54,7 +54,7 @@ detailed upgrade scenario.
| Windows systems | Stop the Oracle service: net stop OracleService%ORACLE_SID% |
| Oracle RAC installations | Shut down each database instance as follows: srvctl stop database -db db_name |
-5. Stop the listener. Stopping the listener is not necessary for Oracle RAC and Grid Infrastructure
+5. Stop the listener. Stopping the listener isn't necessary for Oracle RAC and Grid Infrastructure
listeners.
lsnrctl stop listener_name
diff --git a/docs/auditor/10.7/configuration/oracle/verifysettings.md b/docs/auditor/10.7/configuration/oracle/verifysettings.md
index 89fa82a90d..7598546691 100644
--- a/docs/auditor/10.7/configuration/oracle/verifysettings.md
+++ b/docs/auditor/10.7/configuration/oracle/verifysettings.md
@@ -16,6 +16,4 @@ your Oracle Database version and edition.
| Oracle Database Enterprise Edition (Fine Grained Auditing) | `SELECT POLICY_NAME, ENABLED from DBA_AUDIT_POLICIES;` |
| Oracle Database 11g(Standard Auditing) Starting with version 10.5, Netwrix Auditor provides limited support of Oracle Database 11g and trail auditing mode accordingly. | `SELECT audit_option, success, failure FROM dba_stmt_audit_opts;` To review your initialization parameters, execute the following command: `SHOW PARAMETERS audit%r;` |
-If you want to clean your audit settings periodically, refer to the following Oracle Help Center
-article for more information:
-[Database PL/SQL Packages and Types Reference.](https://docs.oracle.com/database/121/ARPLS/d_audit_mgmt.htm#database-plsql-packages-and-types-reference)
+If you want to clean your audit settings periodically, see the Oracle Help Center article on [Database PL/SQL Packages and Types Reference](https://docs.oracle.com/database/121/ARPLS/d_audit_mgmt.htm#database-plsql-packages-and-types-reference) for more information.
diff --git a/docs/auditor/10.7/configuration/oracle/wallet.md b/docs/auditor/10.7/configuration/oracle/wallet.md
index fafb003b85..d4df90d7d0 100644
--- a/docs/auditor/10.7/configuration/oracle/wallet.md
+++ b/docs/auditor/10.7/configuration/oracle/wallet.md
@@ -18,21 +18,15 @@ directory
There are multiple methods to create Oracle Wallet files. For example:
-- Using Oracle Wallet Manager. Refer to the following Oracle help article for more information:
- [Creating a New Oracle Wallet](https://docs.oracle.com/database/121/DBIMI/walet.htm#creating-a-new-oracle-wallet).
-- Using a console. As an example, refer to the following Oracle help article for WebLogic JDBC:
- [Creating and Managing Oracle Wallet](https://docs.oracle.com/middleware/1213/wls/JDBCA/oraclewallet.htm#creating-and-managing-oracle-wallet).
-- Using other Oracle products. For example, Autonomous Data Warehouse. Refer to the following Oracle
- help article for more information:
- [Download Client Credentials (Wallets)](https://docs.oracle.com/en/cloud/paas/autonomous-data-warehouse-cloud/user/connect-download-wallet.html#download-client-credentials-wallets).
+- Using Oracle Wallet Manager. See [Creating a New Oracle Wallet](https://docs.oracle.com/database/121/DBIMI/walet.htm#creating-a-new-oracle-wallet).
+- Using a console. As an example, see the Oracle help article for WebLogic JDBC: [Creating and Managing Oracle Wallet](https://docs.oracle.com/middleware/1213/wls/JDBCA/oraclewallet.htm#creating-and-managing-oracle-wallet).
+- Using other Oracle products. For example, Autonomous Data Warehouse. See the Oracle help article on [Download Client Credentials (Wallets)](https://docs.oracle.com/en/cloud/paas/autonomous-data-warehouse-cloud/user/connect-download-wallet.html#download-client-credentials-wallets).
## Install Oracle Instant Client
-To perform clear install of Oracle Instant Client, follow the instructions below. If you have Oracle
-Client installed, see the Update Existing Oracle Client Installation topic for additional
-information.
+To perform a clean install of Oracle Instant Client, follow the instructions below. If you have Oracle Client installed, see the Update Existing Oracle Client Installation topic for additional information.
-Follow the steps to install Oracle Instant Client
+### Install Oracle Instant Client
**Step 1 –** Download the appropriate package from Oracle website:
[Instant Client Packages](https://www.oracle.com/database/technologies/instant-client/downloads.html).
@@ -83,8 +77,7 @@ myOracle =
)
-Keep in mind that the wallet alias in the configuration file must equal to Netwrix Auditor item
-name.
+The wallet alias in the configuration file must match the Netwrix Auditor item name.
## Configure Oracle Instant Client for HTTP Proxy Connections
diff --git a/docs/auditor/10.7/configuration/sharepoint/overview.md b/docs/auditor/10.7/configuration/sharepoint/overview.md
index 3d634c7b99..d17e16a948 100644
--- a/docs/auditor/10.7/configuration/sharepoint/overview.md
+++ b/docs/auditor/10.7/configuration/sharepoint/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -40,8 +40,6 @@ You can configure your IT Infrastructure for monitoring in one of the following
## Configure Audit Log Trimming
-Follow the steps to configure Audit Log Trimming on your SharePoint farm.
-
**Step 1 –** Log in as an administrator to the audited SharePoint site collection.
**Step 2 –** In the upper-left of your site collection, go to **Site Actions** > **Site Settings**
@@ -65,8 +63,6 @@ settings.
## Configure Events Auditing Settings
-Follow the steps to configure event auditing settings.
-
**Step 1 –** Log in as an administrator to the audited SharePoint site collection.
**Step 2 –** In the upper-left of your site collection, go to **Site Actions** > **Site Settings**
@@ -93,12 +89,7 @@ information.
## Enable SharePoint Administration Service
-This service is must be started to ensure the Netwrix Auditor for SharePoint Core Service successful
-installation. Perform the procedure below, prior to the Core Service installation. See the
-[Install for SharePoint Core Service](/docs/auditor/10.7/install/sharepointcoreservice.md) topic for additional
-information.
-
-Follow the steps to enable SharePoint Administration Service.
+This service must be started to ensure successful installation of the Netwrix Auditor for SharePoint Core Service. Perform the procedure below before you install the Core Service. See the [Install for SharePoint Core Service](/docs/auditor/10.7/install/sharepointcoreservice.md) topic for additional information.
**Step 1 –** On the computer where SharePoint Central Administration is installed and where you
intend to deploy Netwrix Auditor for SharePoint Core Service, open the Services Management Console.
@@ -172,7 +163,7 @@ Review the following for additional information:
| -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Permission level | Default permission levels are predefined sets of permissions that you can assign to individual users, groups of users, or security groups, based on their functional requirements and on security considerations. SharePoint Server permission levels are defined at the site collection level; by default, they are inherited from the parent object. For more information on SharePoint permissions and permission levels read the following Microsoft article: [User permissions and permission levels in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/sites/user-permissions-and-permission-levels). |
| Zone: Default (policy) Zone: Intranet (policy) Zone: Internet (policy) Zone: Custom (policy) Zone: Extranet (policy) | Zone If you want to expose the same content in a web application to different types of users by using additional URLs or authentication methods, you can extend an existing web application into a new zone. When you extend the web application into a new zone, you create a separate Internet Information Services (IIS) web site to serve the same content, but with a unique URL and authentication type. For more information on SharePoint zones read the following Microsoft article: [Extend claims-based web applications in SharePoint](https://learn.microsoft.com/en-us/sharepoint/administration/extend-a-claims-based-web-application)[ ](https://social.technet.microsoft.com/wiki/contents/articles/38031.sharepoint-2016-extend-a-web-application.aspx). Policies Web application policies represent a concept that allows SharePoint administrators to grant or deny permissions to users and groups for sites under a web application. These granted or denied permissions take preference over the permissions set for the sites in the web application. For more information on SharePoint web application policies read the following Microsoft article: [Manage permissions for a web application in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/administration/manage-permissions-for-a-web-application). |
-| Site collection administrator | The _SharePoint site collection administrator_ is a permission type that overrides Full Control permission. It cannot be locked out of any subsite, list, library, item, or page on the site. The permissions inheritance for any of these elements can be broken at any time, and permissions can be changed so that even users with Full Control will have lesser permissions or even no permissions at all. In all cases the SharePoint site collection administrator will always have full access to all elements and all data. For more information, read the following Microsoft article: [Change site collection administrators in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/sites/change-site-collection-administrators). |
+| Site collection administrator | The _SharePoint site collection administrator_ is a permission type that overrides Full Control permission. It can't be locked out of any subsite, list, library, item, or page on the site. The permissions inheritance for any of these elements can be broken at any time, and permissions can be changed so that even users with Full Control will have lesser permissions or even no permissions at all. In all cases the SharePoint site collection administrator will always have full access to all elements and all data. For more information, read the following Microsoft article: [Change site collection administrators in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/sites/change-site-collection-administrators). |
| Site Collection lock status | Lock statuses apply to a site collection and are used to control the actions allowed on site collection. For more information on lock statuses, read the following Microsoft article: [Manage the lock status for site collections in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/sites/manage-the-lock-status-for-site-collections). |
| Web application user permissions | Sites and site collections have a variety of permissions that can be set, such as adding or editing list items or documents. These permissions are normally given to a user by assigning a particular permission level, such as _Full Control_, _Contribute_, or _View Only_. Each individual permission can be enabled or disabled for entire web application. For more information on web application user permissions, read the following Microsoft article: [Manage permissions for a web application in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/administration/manage-permissions-for-a-web-application). |
| Farm account | Farm account is a service account used to run the Central Administration web site application pool. It has _dbo_ access to the configuration database. For more information on SharePoint service accounts, read the following Microsoft articles: - [Plan for administrative and service accounts in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/plan-for-administrative-and-service-accounts) - [Account permissions and security settings in SharePoint Servers 2016 and 2019 Public Preview](https://docs.microsoft.com/en-us/sharepoint/install/account-permissions-and-security-settings-in-sharepoint-server-2016) |
diff --git a/docs/auditor/10.7/configuration/sharepoint/permissions.md b/docs/auditor/10.7/configuration/sharepoint/permissions.md
index 110ffae26a..5446985007 100644
--- a/docs/auditor/10.7/configuration/sharepoint/permissions.md
+++ b/docs/auditor/10.7/configuration/sharepoint/permissions.md
@@ -21,9 +21,7 @@ These group Managed Service Accounts should meet the related requirements.
**On the target SharePoint farm:**
1. On the SharePoint server where the Netwrix Auditor Core Service will be deployed: the account
- must be a member of the local Administrators group.
- To learn more about Netwrix Auditor Core Services, refer to
- [Installation](/docs/auditor/10.7/install/overview.md) topic.
+ must be a member of the local Administrators group. See the [Installation](/docs/auditor/10.7/install/overview.md) topic for more information about Netwrix Auditor Core Services.
2. On the SQL Server hosting SharePoint database: the SharePoint_Shell_Access role.
See the Assigning 'SharePoint_Shell_Access' Role topic for additional information.
3. If you plan to collect state-in-time data from a SharePoint farm, the account should also meet
@@ -55,13 +53,7 @@ Netwrix Auditor, the installation will be performed under the account specified
## Define Log On As a Service Policy
-On the SharePoint monitoring plan creation, the Log on as a service policy is automatically defined
-for the Data Processing Account as a local security policy. However, if you have the Deny log on as
-a service policy defined locally or on the domain level, the local Log on as a service policy will
-be reset. In this case, redefine the Deny log on as a service policy through the Local Security
-Policy console on your computer or on the domain level through the Group Policy Management console.
-
-Follow the steps to define log on as a service policy:
+On the SharePoint monitoring plan creation, the Log on as a service policy is automatically defined for the Data Processing Account as a local security policy. However, if you have the Deny log on as a service policy defined locally or on the domain level, the local Log on as a service policy will be reset. In this case, redefine the Deny log on as a service policy through the Local Security Policy console on your computer or on the domain level through the Group Policy Management console.
**Step 1 –** On the computer where Auditor Server is installed, open the **Local Security Policy**
snap-in: navigate to Start > Windows Administrative Tools and select Local Security Policy.
diff --git a/docs/auditor/10.7/configuration/sqlserver/configuringtracelogging.md b/docs/auditor/10.7/configuration/sqlserver/configuringtracelogging.md
index 4213c2edca..ae63708c2a 100644
--- a/docs/auditor/10.7/configuration/sqlserver/configuringtracelogging.md
+++ b/docs/auditor/10.7/configuration/sqlserver/configuringtracelogging.md
@@ -6,11 +6,7 @@ sidebar_position: 30
# Configuring Trace Logging
-If trace logging is disabled in SQL Server, then changes will be reported in Netwrix Auditor as made
-by _system_. To detect actual change initiator, Netwrix Auditor needs native trace logs data. During
-every data collection, Netwrix Auditor will check if the internal SQL audit mechanism is enabled,
-and enable it if necessary. To read more, refer to
-[this Netwrix Knowledge Base article](https://kb.netwrix.com/728).
+If trace logging is disabled in SQL Server, then changes will be reported in Netwrix Auditor as made by _system_. To detect the actual change initiator, Netwrix Auditor needs native trace log data. During every data collection, Netwrix Auditor checks if the internal SQL audit mechanism is enabled and enables it if necessary. See [this Netwrix Knowledge Base article](https://kb.netwrix.com/728) for more information.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -22,7 +18,7 @@ follow the procedure below.
If you enable monitoring of SQL logons, SQL trace for these logons will be created anyway.
-Follow the steps to exclude SQL Server instance from turning trace logging on automatically.
+## Exclude SQL Server instances from automatic trace logging
**Step 1 –** On Netwrix Auditor server, go to the _%Netwrix Auditor installation folder%\SQL Server
Auditing_ folder.
@@ -42,9 +38,9 @@ By default, SQL Server trace logs will be stored in the predefined location (dep
Server version). For example, SQL Server 2019 error logs are located at _``:\Program
Files\Microsoft SQL Server\MSSQL13.``\MSSQL\Log_.
-You can change this default location, using the _pathstotracelogs.txt_ file.
+You can change this default location by editing the _pathstotracelogs.txt_ file.
-Follow the steps to change trace log location.
+## Change trace log location
**Step 1 –** On Netwrix Auditor server, go to _%Netwrix Auditor installation folder%\SQL Server
Auditing_ folder.
@@ -61,7 +57,7 @@ will be ignored.
`SQLSRV01\MSSQL2016|C:\Logs\NA trace logs\`
-If you want to change trace logs location for multiple instances of one SQL server, make sure that
+If you want to change trace logs location for multiple instances of one SQL server, ensure that
specified UNC paths are unique across these instances.
Correct:
diff --git a/docs/auditor/10.7/configuration/sqlserver/overview.md b/docs/auditor/10.7/configuration/sqlserver/overview.md
index 52128bbaf8..41cdb165dc 100644
--- a/docs/auditor/10.7/configuration/sqlserver/overview.md
+++ b/docs/auditor/10.7/configuration/sqlserver/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -23,7 +23,7 @@ be checked on each data collection and adjusted if necessary.
## Checking for Primary Key
If you plan to audit an SQL Server for data changes and browse the results using '_Before_' and
-'_After_' filter values, make sure that the audited SQL database tables have a primary key (or a
+'_After_' filter values, ensure that the audited SQL database tables have a primary key (or a
unique column). Otherwise, '_Before_' and '_After_' values will not be reported.
## SQL Server Objects
diff --git a/docs/auditor/10.7/configuration/sqlserver/permissions.md b/docs/auditor/10.7/configuration/sqlserver/permissions.md
index 30f198da99..42e552b1b3 100644
--- a/docs/auditor/10.7/configuration/sqlserver/permissions.md
+++ b/docs/auditor/10.7/configuration/sqlserver/permissions.md
@@ -17,7 +17,7 @@ You can use group Managed Service Accounts (gMSA) as data collecting accounts.
1. To access SQL Server, Windows authentication will be used, so data collection account should be a
Windows account specified in the _domain\user_ format (_domain\user$_ for Managed Service
Account).
- SQL Server logins and authentication method are not supported.
+ SQL Server logins and authentication method aren't supported.
2. The account must be assigned the **System Administrator** server role for this SQL Server. See
Assigning 'System Administrator' Role section for more information.
3. For auditing SQL Server availability on groups, the account must have the sysadmin server role
diff --git a/docs/auditor/10.7/configuration/useractivity/datacollection.md b/docs/auditor/10.7/configuration/useractivity/datacollection.md
index 6a84706e37..bacd23c621 100644
--- a/docs/auditor/10.7/configuration/useractivity/datacollection.md
+++ b/docs/auditor/10.7/configuration/useractivity/datacollection.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Configure Data Collection Settings
-To successfully track user activity, make sure that the following settings are configured on the
+To successfully track user activity, ensure that the following settings are configured on the
audited computers and on the computer where Netwrix Auditor Server is installed:
- The **Windows Management Instrumentation** and the **Remote Registry** services are running and
@@ -25,39 +25,33 @@ audited computers and on the computer where Netwrix Auditor Server is installed:
## Check the Windows Services Status
-Follow the steps to check the status and startup type of Windows services.
-
**Step 1 –** Navigate to Start > Windows Administrative Tools > Services.
-**Step 2 –** In the **Services** snap-in, locate the **Remote Registry** service and make sure that
+**Step 2 –** In the **Services** snap-in, locate the **Remote Registry** service and ensure that
its status is _"Started"_ (on pre-Windows Server 2012 versions) and _"Running"_ (on Windows Server
-2012 and above). If it is not, right-click the service and select Start from the pop-up menu.
+2012 and above). If it isn't, right-click the service and select Start from the pop-up menu.
-**Step 3 –** Check that the **Startup Type** is set to _"Automatic"_. If it is not, double-click the
+**Step 3 –** Check that the **Startup Type** is set to _"Automatic"_. If it isn't, double-click the
service. In the **Remote Registry Properties** dialog, in the **General** tab, select _"Automatic"_
-from the drop-down list.
+from the dropdown list.
**Step 4 –** Perform the steps above for the **Windows Management Instrumentation** service.
## Windows Features Communication
-Follow the steps to allow Windows features to communicate through Firewall.
-
**Step 1 –** Navigate to **Start → Control Panel** and select **Windows Firewall.**
**Step 2 –** In the **Help Protect your computer with Windows Firewall** page, click **Allow a
program or feature through Windows Firewall** on the left.
**Step 3 –** In the Allow an app or feature through Windows Firewall page that opens, locate the
-**File and Printer Sharing** feature and make sure that the corresponding checkbox is selected under
+**File and Printer Sharing** feature and ensure that the corresponding checkbox is selected under
Domain.
**Step 4 –** Repeat step 3 for the **Windows Management Instrumentation (WMI)** feature.
## Open Local TCP Port 9004
-Follow the steps to open Local TCP Port 9004 for inbound connections.
-
**Step 1 –** On the computer where Netwrix Auditor is installed, navigate to **Start → Control
Panel** and select **Windows Firewall.**
@@ -73,7 +67,7 @@ left.
- On the Program step, specify the path: %Netwrix Auditor installation folder%/Netwrix Auditor/User
Activity Video Recording/UAVRServer.exe.
- On the Action step, select the Allow the connection action.
-- On the Profile step, make sure that the rule applies to Domain.
+- On the Profile step, ensure that the rule applies to Domain.
- On the Name step, specify the rule's name, for example UA Server inbound rule.
**Step 5 –** Double-click the newly created rule and open the Protocols and Ports tab.
@@ -85,8 +79,6 @@ left.
## Open Local TCP Port 9003
-Follow the steps to open Local TCP Port 9003 for inbound connections.
-
**Step 1 –** On a target computer navigate to **Start → Control Panel** and select **Windows
Firewall.**
@@ -115,8 +107,6 @@ left.
## Open Remote TCP Port 9004
-Follow the steps to open Remote TCP Port 9004 for outbound connections.
-
**Step 1 –** On a target computer, navigate to **Start → Control Panel** and select **Windows
Firewall.**
diff --git a/docs/auditor/10.7/configuration/useractivity/overview.md b/docs/auditor/10.7/configuration/useractivity/overview.md
index 3c7c25dbbe..ad4b0b0e1a 100644
--- a/docs/auditor/10.7/configuration/useractivity/overview.md
+++ b/docs/auditor/10.7/configuration/useractivity/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -28,7 +28,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
reliable audit data. You can enable Auditor to continually enforce the relevant audit policies or
configure them manually:
- - On the audited system(s):
+ - On the audited systems:
- The **Windows Management Instrumentation** and the **Remote Registry** services must be
running and their **Startup Type** must be set to "Automatic".
@@ -89,13 +89,11 @@ By default, the agent is installed automatically on the audited computers upon t
Object** wizard completion. If, for some reason, installation has failed, you must install the agent
manually on each of the audited computers.
-Before installing Netwrix Auditor agent to audit user activity, make sure that:
+Before installing Netwrix Auditor agent to audit user activity, ensure that:
- The audit settings are configured properly.
- The Data Processing Account has access to the administrative shares.
-Follow the steps to install Netwrix Auditor agent to audit user activity.
-
**Step 1 –** Navigate to _%Netwrix Auditor Installation Folder%\User Activity Video Recording_ and
copy the UACoreSvcSetup.msi file to the audited computer.
diff --git a/docs/auditor/10.7/configuration/useractivity/videorecordings.md b/docs/auditor/10.7/configuration/useractivity/videorecordings.md
index 7d513caae3..dd9cbd95b1 100644
--- a/docs/auditor/10.7/configuration/useractivity/videorecordings.md
+++ b/docs/auditor/10.7/configuration/useractivity/videorecordings.md
@@ -17,7 +17,7 @@ be configured:
- The user must have read permissions (resultant set) to the **Netwrix_UAVR$** shared folder where
video files are stored. By default, all members of the **Netwrix Auditor Client Users** group can
access this shared folder. Both the group and the folder are created automatically by Netwrix
- Auditor. Make sure to grant sufficient permissions on folder or explicitly add user to the group
+ Auditor. Ensure to grant sufficient permissions on folder or explicitly add user to the group
(regardless his or her role delegated in the product). See the To Add an Account to Netwrix
Auditor Client Users Group topic for additional information.
- A dedicated codec must be installed. This codec is installed automatically on the computer where
@@ -45,13 +45,11 @@ Auditor console.
**NOTE:** Microsoft is in the process of deprecating Internet Explorer. However, if you are trying
to access the video recordings from browser via direct links (reports on SSRS portal, subscriptions,
activity summaries, search export results), IE engine should be present on the client machine. IE
-might be disabled with GPO, but it should not be removed completely. Recommended option is to use
+might be disabled with GPO, but it shouldn't be removed completely. Recommended option is to use
Edge with "IE mode" option enabled.
## To Configure Internet Explorer Security Settings
-Follow the steps to configure Internet Explorer security settings.
-
**Step 1 –** In Internet Explorer, navigate to **Tools** > **Internet Options**.
**Step 2 –** Switch to the Security tab and select **Local Intranet**. Click **Custom Level**.
@@ -68,8 +66,6 @@ checkbox.
## To Enable JavaScript
-Follow the steps to enable JavaScript.
-
**Step 1 –** In Internet Explorer, navigate to **Tools** > **Internet Options**.
**Step 2 –** Switch to the Security tab and select **Internet**. Click **Custom Level**.
@@ -79,8 +75,6 @@ verify that **Active scripting** is set to **Enable**.
## To Disable Internet Explorer Enhanced Security Configuration (IE ESC)
-Follow the steps to disable Internet Explorer enhanced security configuration.
-
**Step 1 –** Navigate to Start > Windows Administrative Tools > **Server Manager**.
**Step 2 –** In the Security Information section, click Configure IE ESC link on the right to
@@ -88,10 +82,7 @@ disable it.
## To Add an Account to Netwrix Auditor Client Users Group
-All members of the Netwrix Auditor Client Users group are granted the Global reviewer role in
-Netwrix Auditor and have access to all collected data.
-
-Follow the steps to add an account to the Netwrix Auditor Client Users group.
+All members of the Netwrix Auditor Client Users group are granted the Global reviewer role in Netwrix Auditor and have access to all collected data.
**Step 1 –** On the computer where Netwrix Auditor Server is installed, start the Local Users and
Computers snap-in.
diff --git a/docs/auditor/10.7/configuration/vmware/overview.md b/docs/auditor/10.7/configuration/vmware/overview.md
index f5c162f9b5..74cb297ad2 100644
--- a/docs/auditor/10.7/configuration/vmware/overview.md
+++ b/docs/auditor/10.7/configuration/vmware/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
diff --git a/docs/auditor/10.7/configuration/windowsserver/advancedpolicy.md b/docs/auditor/10.7/configuration/windowsserver/advancedpolicy.md
index 7bdc69641f..48af74f893 100644
--- a/docs/auditor/10.7/configuration/windowsserver/advancedpolicy.md
+++ b/docs/auditor/10.7/configuration/windowsserver/advancedpolicy.md
@@ -22,11 +22,7 @@ components:
## Configure Security Options
-Setting up both basic and advanced audit policies may lead to incorrect audit reporting. To force
-basic audit policies to be ignored and prevent conflicts, enable the _Audit: Force audit policy
-subcategory settings_ policy.
-
-Follow the steps to enforce advanced policies.
+Setting up both basic and advanced audit policies may lead to incorrect audit reporting. To force basic audit policies to be ignored and prevent conflicts, enable the _Audit: Force audit policy subcategory settings_ policy.
**Step 1 –** On the audited server, open the Local Security Policy snap-in and navigate to Start >
Windows Administrative Tools > Local Security Policy.
@@ -40,9 +36,9 @@ Force audit policy subcategory settings policy.
## Configure Advanced Audit Policy on Windows Server 2016
-In Windows Server 2016 audit policies are not integrated with the Group Policies and can only be
+In Windows Server 2016 audit policies aren't integrated with the Group Policies and can only be
deployed using logon scripts generated with the native Windows **auditpol.exe** command line tool.
-Therefore, these settings are not permanent and will be lost after server reboot.
+Therefore, these settings aren't permanent and will be lost after server reboot.
The procedure below explains how to configure Advanced audit policy for a single server. If you
audit multiple servers, you may want to create logon scripts and distribute them to all target
@@ -100,4 +96,4 @@ System Audit Policies.
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | ------------ |
| Account Management | - Audit Security Group Management
- Audit User Account Management
| "Success" |
| Object Access | - Audit Handle Manipulation
- Audit Other Object Access Events
- Audit Registry
- Audit File Share
| "Success" |
-| Policy Change | - Audit Audit Policy Change
| "Success" |
+| Policy Change | | "Success" |
diff --git a/docs/auditor/10.7/configuration/windowsserver/dhcp.md b/docs/auditor/10.7/configuration/windowsserver/dhcp.md
index 3fb268b52e..58dc1947cf 100644
--- a/docs/auditor/10.7/configuration/windowsserver/dhcp.md
+++ b/docs/auditor/10.7/configuration/windowsserver/dhcp.md
@@ -16,7 +16,7 @@ settings (size and retention method). For that, take the steps described below.
-4. Make sure the **Enable logging** option is selected.
+4. Ensure the **Enable logging** option is selected.
5. Set **Maximum log size** to **4 GB**.
6. Set the retention method to **Overwrite events as needed (oldest events first)**. Click **OK** to
save the settings and close the dialog.
diff --git a/docs/auditor/10.7/configuration/windowsserver/eventlog.md b/docs/auditor/10.7/configuration/windowsserver/eventlog.md
index b763d53811..f9c2734919 100644
--- a/docs/auditor/10.7/configuration/windowsserver/eventlog.md
+++ b/docs/auditor/10.7/configuration/windowsserver/eventlog.md
@@ -21,8 +21,7 @@ for these logs to "_Overwrite events as needed_". This refers to the following e
Windows Server 2012 R2 and above)
- Applications and Services logs > AD FS > Admin log (for AD FS servers )
-Refer to the following Microsoft
-[article to read about the recommended event log settings](https://support.microsoft.com/en-us/help/957662/recommended-settings-for-event-log-sizes-in-windows).
+See the Microsoft article on [recommended event log settings](https://support.microsoft.com/en-us/help/957662/recommended-settings-for-event-log-sizes-in-windows) for more information.
The procedure below provides a possible way to specify the event log settings manually. However, if
you have multiple target computers, consider configuring these settings via Group Policy as also
@@ -30,8 +29,6 @@ described in this section
## Configure the Event Log Size Manually
-Follow the steps to configure Event Log Size and Retention Settings.
-
**Step 1 –** On a target server, navigate to Start > Windows Administrative Tools > Event Viewer.
**Step 2 –** Navigate to Event Viewer tree > Windows Logs, right-click **Security** and select
@@ -39,14 +36,14 @@ Follow the steps to configure Event Log Size and Retention Settings.
-**Step 3 –** Make sure Enable logging is selected.
+**Step 3 –** ensure Enable logging is selected.
-**Step 4 –** In the Maximum log size field, specify the desired log size.
+**Step 4 –** In the Maximum log size field, specify the log size you want.
-**Step 5 –** Make sure the Do not overwrite events (Clear logs manually) check box is cleared. If
+**Step 5 –** ensure the Don't overwrite events (Clear logs manually) checkbox is cleared. If
selected, change the retention method to _Overwrite events as needed (oldest events first)_.
-Make sure the Maximum security log size group policy does not overwrite your log settings. To check
+Ensure the Maximum security log size group policy doesn't overwrite your log settings. To check
this, start the Group Policy Management console, proceed to the GPO that affects your server, and
navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Event Log.
@@ -61,7 +58,7 @@ Repeat these steps for the following event logs:
- **Applications and Services Logs > Microsoft > Windows > DNS-Server > Audit**
Configure setting for DNS log only if you want to monitor DNS changes. The log is available on
- Windows Server 2012 R2 and above and is not enabled by default. See Microsoft documentation for
+ Windows Server 2012 R2 and above and isn't enabled by default. See Microsoft documentation for
more information on how to enable this log.
- **Applications and Services Logs** **>** **AD FS** **>** **Admin**
@@ -70,10 +67,9 @@ Repeat these steps for the following event logs:
## Configure the Event Log Size Using Group Policy
-Personnel with administrative rights can use Group Policy Objects to apply configuration settings to
-multiple servers in bulk.
+Personnel with administrative rights can use Group Policy Objects to apply configuration settings to multiple servers in bulk.
-Follow the steps to configure settings for Application, System and Security event logs.
+### Configure settings for Application, System, and Security event logs
**Step 1 –** Open the Group Policy Management Editor on the domain controller and go to **Computer
Configuration > Policies > Administrative Templates > Windows Components > Event Log Service**.
@@ -85,7 +81,7 @@ KB_.
**Step 4 –** Specify retention settings for the log; usually it is Overwrite as needed.
-Follow the steps to configure settings for other logs.
+### Configure settings for other logs
**Step 1 –** Open the registry editor and go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\. For example:
diff --git a/docs/auditor/10.7/configuration/windowsserver/iis.md b/docs/auditor/10.7/configuration/windowsserver/iis.md
index f56ff9052d..fd0786f0bc 100644
--- a/docs/auditor/10.7/configuration/windowsserver/iis.md
+++ b/docs/auditor/10.7/configuration/windowsserver/iis.md
@@ -19,7 +19,7 @@ To configure the Operational log size and retention method
-4. Make sure **Enable logging** is enabled.
+4. Ensure **Enable logging** is enabled.
5. Set **Maximum log size** to 4 GB.
-6. Make sure **Do not overwrite events (Clear logs manually)** is cleared. If selected, change the
+6. Ensure **Don't overwrite events (Clear logs manually)** is cleared. If selected, change the
retention method to **Overwrite events as needed (oldest events first)**.
diff --git a/docs/auditor/10.7/configuration/windowsserver/localpolicy.md b/docs/auditor/10.7/configuration/windowsserver/localpolicy.md
index caaaaaaf48..217c246398 100644
--- a/docs/auditor/10.7/configuration/windowsserver/localpolicy.md
+++ b/docs/auditor/10.7/configuration/windowsserver/localpolicy.md
@@ -24,11 +24,7 @@ You can also configure advanced audit policies for same purpose. See the
## Manual Configuration
-While there are several methods to configure local audit policies, this topic covers just one of
-them: how to configure policies locally with the Local Security Policy snap-in. To apply settings to
-the whole domain, use the Group Policy but consider the possible impact on your environment.
-
-Follow the steps to configure local audit policies.
+While there are several methods to configure local audit policies, this topic covers just one of them: how to configure policies locally with the Local Security Policy snap-in. To apply settings to the whole domain, use Group Policy but consider the possible impact on your environment.
**Step 1 –** On the audited server, open the Local Security Policy snap-in: navigate to Start >
Windows Administrative Tools > Local Security Policy.
diff --git a/docs/auditor/10.7/configuration/windowsserver/overview.md b/docs/auditor/10.7/configuration/windowsserver/overview.md
index e4799261cc..3ca8237750 100644
--- a/docs/auditor/10.7/configuration/windowsserver/overview.md
+++ b/docs/auditor/10.7/configuration/windowsserver/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -41,7 +41,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
Change subcategories must be enabled for _"Success"_.
- For Windows Server 2008 R2 / Windows 7 and above—Audit Security Group Management, Audit
User Account Management, Audit Handle Manipulation, Audit Other Object Access Events,
- Audit Registry, Audit File Share, and Audit Audit Policy Changeadvanced audit policies
+ Audit Registry, Audit File Share, and Audit Policy Change advanced audit policies
must be set to _"Success"_.
- See the [Configure Local Audit Policies](/docs/auditor/10.7/configuration/windowsserver/localpolicy.md) topic and the
[Configure Advanced Audit Policies](/docs/auditor/10.7/configuration/windowsserver/advancedpolicy.md) topic for additional information.
@@ -49,7 +49,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
- The following legacy audit policies can be configured instead of advanced: Audit object
access, Audit policy change, and **Audit account management** must be set to _"Success"_.
- The Enable Persistent Time Stamp local group policy must be enabled. This policy should be
- configured manually since Auditor does not enable it automatically. See the
+ configured manually since Auditor doesn't enable it automatically. See the
[Configure Enable Persistent Time Stamp Policy](/docs/auditor/10.7/configuration/windowsserver/persistenttimestamp.md) topic for additional
information.
- The Application, Security, and System event log maximum size must be set to 4 GB. The
@@ -83,12 +83,12 @@ You can configure your IT Infrastructure for monitoring in one of the following
- Performance Logs and Alerts (TCP-In)
- If the audited servers are behind the Firewall, review the list of protocols and ports
- required for Netwrix Auditor and make sure that these ports are opened. See the
+ required for Netwrix Auditor and ensure that these ports are opened. See the
[Windows Server Ports](/docs/auditor/10.7/configuration/windowsserver/ports.md) topic for additional information.
- For auditing removable storage media, two Event Trace Session objects must be created. See the
[Configure Removable Storage Media for Monitoring](/docs/auditor/10.7/configuration/windowsserver/removablestorage.md) topic for additional
information.
- - If you want to use Network traffic compression, make sure that the Auditor console computer is
+ - If you want to use Network traffic compression, ensure that the Auditor console computer is
accessible by its FQDN name.
- For auditing IIS:
@@ -108,10 +108,7 @@ remember to do the following:
## Exclude Monitored Objects
-You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Windows
-Server monitoring scope.
-
-Follow the steps to exclude data from the Windows Server monitoring scope:
+You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Windows Server monitoring scope.
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Windows Server Auditing_ folder.
@@ -124,10 +121,10 @@ Follow the steps to exclude data from the Windows Server monitoring scope:
| File | Description | Syntax |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| omitcollectlist.txt | Contains a list of objects and their properties to be excluded from being monitored. If you want to restart monitoring these objects, remove them from the omitcollectlist.txt and run data collection at least twice. | `monitoring plan name,server name,class name,property name,property value` `class name` is a mandatory parameter, it cannot be replaced with a wildcard. `property name` and `property value` are optional, but cannot be replaced with wildcards either. For example: `#*,server,MicrosoftDNS_Server `````` #*,*,StdServerRegProv` |
+| omitcollectlist.txt | Contains a list of objects and their properties to be excluded from being monitored. If you want to restart monitoring these objects, remove them from the omitcollectlist.txt and run data collection at least twice. | `monitoring plan name,server name,class name,property name,property value` `class name` is a mandatory parameter, it can't be replaced with a wildcard. `property name` and `property value` are optional, but can't be replaced with wildcards either. For example: `#*,server,MicrosoftDNS_Server `````` #*,*,StdServerRegProv` |
| omiterrors.txt | Contains a list of errors/warnings to be omitted from logging to the Netwrix Auditor System Health event log. | `monitoring plan name,server name,error text` For example: `*,productionserver1.corp.local,*Access is denied*` |
| omitreportlist.txt | Contains a list of objects to be excluded from reports and Activity Summary emails. In this case audit data is still being collected. | `monitoring plan name,who,where,object type,what,property name` For example: `*,CORP\\jsmith,*,*,*,*` |
-| omitsitcollectlist.txt | Contains a list of objects to be excluded from State-in-time reports. | `monitoring planname,server name,class name,property name,property value` `class name` is a mandatory parameter, it cannot be replaced with a wildcard. `property name` and `property value` are optional, but cannot be replaced with wildcards either. For example: `*,server,MicrosoftDNS_Server` `*,*,StdServerRegProv` |
+| omitsitcollectlist.txt | Contains a list of objects to be excluded from State-in-time reports. | `monitoring planname,server name,class name,property name,property value` `class name` is a mandatory parameter, it can't be replaced with a wildcard. `property name` and `property value` are optional, but can't be replaced with wildcards either. For example: `*,server,MicrosoftDNS_Server` `*,*,StdServerRegProv` |
| omitstorelist.txt | Contains a list of objects to be excluded from being stored to the Audit Archive and showing up in reports. In this case audit data is still being collected. | `monitoring plan name,who,where,object type,what,property name` For example: `*,*,*,Scheduled task,Scheduled Tasks\\User_Feed_Synchronization*,*` |
## Monitored Objects
@@ -198,12 +195,12 @@ value is reported as _“Not Applicable”_.
| DHCP Reservation | - Type:
- IPv4
- IPv6
- Action:
- Added
- Removed
- Modified
|
| DHCP Policy | - Type:
- IPv4
- IPv4 server-wide
- Action:
- Added
- Removed
- Modified
- Renamed
|
| Removable media | |
-| Removable Storage Media\*\* | Netwrix Auditor does not report on floppy/optical disk and memory card storage medias. For removable storages, the When value reports actual time when a change was made and/or a target server was started. - Device class:
- CD and DVD
- Floppy Drives
- Removable Disk
- Tape Drives
- Windows Portable Devices When the Audit Object Access local audit policy and/or the Audit Central Access Policy Staging \ Audit Removable Storage advanced audit policies are enabled on the target server, the `gpupdate /force` command execution issues removable storage restart. These actions are disclosed in Netwrix Auditor reports, search, and activity summaries. Note that these actions are system, not user-effected.
|
+| Removable Storage Media\*\* | Netwrix Auditor doesn't report on floppy/optical disk and memory card storage medias. For removable storages, the When value reports actual time when a change was made and/or a target server was started. - Device class:
- CD and DVD
- Floppy Drives
- Removable Disk
- Tape Drives
- Windows Portable Devices When the Audit Object Access local audit policy and/or the Audit Central Access Policy Staging \ Audit Removable Storage advanced audit policies are enabled on the target server, the `gpupdate /force` command execution issues removable storage restart. These actions are disclosed in Netwrix Auditor reports, search, and activity summaries. These actions are system-generated, not user-initiated.
|
| Scheduled Tasks | |
| Scheduled Task | - Account Name
- Application
- Comment
- Creator
- Enabled
- Parameters
- Triggers
|
| Local Users and Groups | |
| Local Group | |
-| Local User | - Description
- Disabled/Enabled
- Full Name
- Name
- User cannot change password
- Password Never Expires
- User must change password at next logon
|
+| Local User | - Description
- Disabled/Enabled
- Full Name
- Name
- User can't change password
- Password Never Expires
- User must change password at next logon
|
| DNS Configuration | |
| The Who value will be reported for DNS configuration settings only if the DNS server runs on Windows Server 2012 R2. See the following Microsoft article for additional information: [Update adds query logging and change auditing to Windows DNS servers](https://support.microsoft.com/en-us/kb/2956577). | |
| DNS Server | - Address Answer Limit
- Allow Update
- Auto Cache Update
- Auto Config File Zones
- Bind Secondaries
- Boot Method
- Default Aging State
- Default No Refresh Interval
- Default Refresh Interval
- Disable Auto Reverse Zones
- Disjoint Nets
- Ds Available
- Ds Polling Interval
- Ds Tombstone Interval
- EDns Cache Timeout
- Enable Directory Partitions
- Enable Dns Sec
- Enable EDns Probes
- CD-ROM D Enable Netmask Ordering
- Event Log Level
- Fail On Load If Bad Zone Data
- Forward Delegations
- Forwarders
- Forwarding Timeout
- Is Slave
- Listen Addresses
- Log File Max Size
- Log File Path
- Log Level
- Loose Wildcarding
- Max Cache TTL
- Max Negative Cache TTL
- Name Check Flag
- No Recursion
- Recursion Retry
- Recursion Timeout
- Round Robin
- Rpc Protocol
- Scavenging Interval
- Secure Cache Against Pollution
- Send Port
- Server Addresses
|
@@ -239,7 +236,7 @@ value is reported as _“Not Applicable”_.
| DNS SIG | - Algorithm
- Container name
- Key tag
- Labels
- Original TTL
- Owner name
- Record class
- Signature expiration (GMT)
- Signature inception (GMT)
- Signature (base 64)
- Signer's name
- TTL
- Type covered
- Zone type
|
| DNS SRV | - Container name
- Host offering this service
- Owner name
- Port number
- Priority
- Record class
- TTL
- Weight
- Zone type
|
| DNS TEXT | - Container name
- Owner name
- Record class
- Text
- TTL
- Zone type
|
-| DNS WINS | - Cache time-out
- Container name
- Do not replicate this record
- Lookup time-out
- Owner name
- Record class
- Wins servers
- Zone type
|
+| DNS WINS | - Cache time-out
- Container name
- Don't replicate this record
- Lookup time-out
- Owner name
- Record class
- Wins servers
- Zone type
|
| DNS WKS | - Container name
- IP address
- Owner name
- Protocol
- Record class
- Services
- TTL
- Zone type
|
| DNS X25 | - Container name
- Owner name
- Record
- Record class
- TTL
- X.121 PSDN address
- Zone type
|
| File Shares | |
@@ -248,7 +245,7 @@ value is reported as _“Not Applicable”_.
### Windows Server Registry Keys
-If you want to monitor changes to system components on a Windows Server, make sure that Windows
+If you want to monitor changes to system components on a Windows Server, ensure that Windows
Registry audit settings are configured on that Windows server.
This refers to the following keys:
@@ -287,9 +284,7 @@ The below is the full list of keys (and subkeys) involved in Windows Server audi
| RemovableMedia | - SYSTEM\CurrentControlSet\Enum\* |
-Consider that audit data for the registry keys themselves will not appear in Netwrix Auditor
-reports, alerts or search results, as it is only used as one of the sources for the Activity Records
-formation.
+Consider that audit data for the registry keys themselves will not appear in Netwrix Auditor reports, alerts, or search results, as it is only used as one of the sources for Activity Record formation.
- You can configure these settings automatically using Netwrix Auditor, as described in the
[Settings for Data Collection](/docs/auditor/10.7/admin/monitoringplans/create.md#settings-for-data-collection)
@@ -310,8 +305,6 @@ will adjust the audit settings for the following subkeys:
#### Monitoring Custom Registry Keys
-Follow the steps to monitor custom registry keys.
-
**Step 1 –** On the computer where Auditor Server resides, navigate to _%Netwrix Auditor
installation folder%\Windows Server Auditing._
@@ -342,12 +335,7 @@ there is no necessary event in the Security log with this path.
While VM cloning is supported by Netwrix Auditor, an additional setup process should be taken into
consideration before the deployment process.
-Every monitored VM instance gets a unique ID assigned for monitoring and data collection purposes.
-To ensure proper operation, the VM template must be excluded from the monitoring scope beforehand.
-Omitting the VM template will allow Netwrix Auditor to assign unique IDs correctly and collect data
-as intended.
-
-Follow the steps to add the template server to exclusions.
+Every monitored VM instance gets a unique ID assigned for monitoring and data collection purposes. To ensure proper operation, the VM template must be excluded from the monitoring scope beforehand. Omitting the VM template allows Netwrix Auditor to assign unique IDs correctly and collect data as intended.
**Step 1 –** In main Netwrix Auditor menu, select **Monitoring plans**.
diff --git a/docs/auditor/10.7/configuration/windowsserver/permissions.md b/docs/auditor/10.7/configuration/windowsserver/permissions.md
index dc632e6ab2..2407797417 100644
--- a/docs/auditor/10.7/configuration/windowsserver/permissions.md
+++ b/docs/auditor/10.7/configuration/windowsserver/permissions.md
@@ -20,7 +20,7 @@ The account used for data collection must meet the following requirements on the
## Assign Permission To Read the Registry Key
-**NOTE:** This permission is required only if the account selected for data collection is not a
+**NOTE:** This permission is required only if the account selected for data collection isn't a
member of the Domain Admins group.
This permission should be assigned on each domain controller in the audited domain, so if your
@@ -32,8 +32,6 @@ console.
### Assign Permission via the Registry Editor Snap-in
-Follow the steps to assign permission via the Registry Editor snap-in:
-
**Step 1 –** On your target server, open Registry Editor: navigate to **Start > Run** and type
_"regedit"_.
@@ -51,8 +49,6 @@ _HKEY_LOCAL_MACHINE\SECURITY\Policy\PolAdtEv_ registry key.
### Assign Permission using the Group Policy Management Console
-Follow the steps to assign permission using the Group Policy Management console;
-
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
navigate to Start > Windows Administrative Tools (Windows Server 2016/2019) or Administrative Tools
(Windows 2012 R2 and below) > Group Policy Management.
diff --git a/docs/auditor/10.7/configuration/windowsserver/ports.md b/docs/auditor/10.7/configuration/windowsserver/ports.md
index 42b824d52c..c4c67fddea 100644
--- a/docs/auditor/10.7/configuration/windowsserver/ports.md
+++ b/docs/auditor/10.7/configuration/windowsserver/ports.md
@@ -63,7 +63,7 @@ left.
- Performance Logs and Alerts (Tcp-In)
If you plan to audit Windows Server 2019 or Windows 10 Update 1803 without network compression
-service, make sure the following inbound connection rules are enabled:
+service, ensure the following inbound connection rules are enabled:
- Remote Scheduled Tasks Management (RPC)
- Remote Scheduled Tasks Management (RPC-EMAP)
diff --git a/docs/auditor/10.7/configuration/windowsserver/remoteregistry.md b/docs/auditor/10.7/configuration/windowsserver/remoteregistry.md
index 18b0e50980..611104a4e7 100644
--- a/docs/auditor/10.7/configuration/windowsserver/remoteregistry.md
+++ b/docs/auditor/10.7/configuration/windowsserver/remoteregistry.md
@@ -6,8 +6,6 @@ sidebar_position: 20
# Enable Remote Registry and Windows Management Instrumentation Services
-Follow the steps to enable the Remote Registry service.
-
**Step 1 –** Navigate to Start > Windows Administrative Tools > Services.
@@ -15,7 +13,7 @@ Follow the steps to enable the Remote Registry service.
**Step 2 –** In the Services window, locate the Remote Registry service, right-click it and select
**Properties**.
-**Step 3 –** In the Remote Registry Properties dialog box, make sure the Startup type parameter is
+**Step 3 –** In the Remote Registry Properties dialog box, ensure the Startup type parameter is
set to _Automatic_ and click **Start**.
diff --git a/docs/auditor/10.7/configuration/windowsserver/removablestorage.md b/docs/auditor/10.7/configuration/windowsserver/removablestorage.md
index b5715dd8c6..6d476fc2b5 100644
--- a/docs/auditor/10.7/configuration/windowsserver/removablestorage.md
+++ b/docs/auditor/10.7/configuration/windowsserver/removablestorage.md
@@ -17,8 +17,8 @@ To configure removable storage media monitoring on the local server
Server Audit\ETS\”_ to store event logs. To review Event Trace Session objects' configurationhow
to modify the root directory.
- If you do not want to use the Netwrix Auditor for Windows Server Compression Service for data
- collection, make sure that this path is readable via any shared resource.
+ If you don't want to use the Netwrix Auditor for Windows Server Compression Service for data
+ collection, ensure that this path is readable via any shared resource.
After environment variable substitution, the path shall be as follows:
@@ -40,7 +40,7 @@ To configure removable storage media monitoring on the local server
where:
- `NetwrixAuditorForWindowsServer`—Fixed name the product uses to identify the Event Trace
- Session object. The name cannot be changed.
+ Session object. The name can't be changed.
- ``—Path to the Event Trace Session
template file that comes with Netwrix Auditor. The default path is _"C:\Program Files
(x86)\Netwrix Auditor\Windows Server Auditing\EventTraceSessionTemplate.xml"_.
@@ -51,8 +51,8 @@ To configure removable storage media monitoring remotely
Server Audit\ETS\”_ to write data to. To review Event Trace Session objects' configurationhow to
modify the root directory.
- If you do not want to use the Netwrix Auditor for Windows Server Compression Service for data
- collection, make sure that this path is readable via any shared resource.
+ If you don't want to use the Netwrix Auditor for Windows Server Compression Service for data
+ collection, ensure that this path is readable via any shared resource.
After environment variable substitution, the path shall be as follows:
@@ -74,16 +74,15 @@ To configure removable storage media monitoring remotely
where:
- `NetwrixAuditorForWindowsServer`—Fixed name the product uses to identify the Event Trace
- Session object. The name cannot be changed.
+ Session object. The name can't be changed.
- ``—Path to the Event Trace Session
template file that comes with Netwrix Auditor. The default path is _"C:\Program Files
(x86)\Netwrix Auditor\Windows Server Auditing\EventTraceSessionTemplate.xml"_.
- - ``—Name of the target server. Provide a server name by entering its
- FQDN, NETBIOS or IPv4 address.
+ - ``—Name of the target server. Provide a server name by entering its FQDN, NETBIOS, or IPv4 address.
To review Event Trace Session objects' configuration
-An Administrator can only modify the root directory and log file name. Other configurations are not
+An Administrator can only modify the root directory and log file name. Other configurations aren't
supported by Netwrix Auditor.
1. On the target server, navigate to Start → Administrative Tools → Performance Monitor.
diff --git a/docs/auditor/10.7/configuration/windowsserver/windowsregistry.md b/docs/auditor/10.7/configuration/windowsserver/windowsregistry.md
index 02bbace08b..cc31a42147 100644
--- a/docs/auditor/10.7/configuration/windowsserver/windowsregistry.md
+++ b/docs/auditor/10.7/configuration/windowsserver/windowsregistry.md
@@ -6,10 +6,7 @@ sidebar_position: 30
# Configure Windows Registry Audit Settings
-Windows Registry audit permissions must be configured on each Windows server you want to audit so
-that the “Who” and “When” values are reported correctly for each change. For test environment, PoC
-or evaluation you can use automatic audit configuration. If you want to configure Windows Registry
-manually, follow the instructions below.
+Windows Registry audit permissions must be configured on each Windows server you want to audit so that the “Who” and “When” values are reported correctly for each change. For test environment, PoC, or evaluation, you can use automatic audit configuration. If you want to configure Windows Registry manually, follow the instructions below.
The following audit permissions must be set to _"Successful"_ for the
`HKEY_LOCAL_MACHINE\SOFTWARE and HKEY_LOCAL_MACHINE\SYSTEM` keys:
@@ -69,7 +66,7 @@ and click **Add**.
**Step 5 –** Click **Select a principal link** and specify the **Everyone** group in the **Enter the
object name to select** field.
-**Step 6 –** Set **Type** to _"Success"_ and **Applies to** to _"This key and subkeys_.
+**Step 6 –** Set **Type** to _"Success"_ and **Applies to** _"This key and subkeys"_.
**Step 7 –** Click **Show advanced permissions** and select the following access types:
@@ -83,5 +80,5 @@ object name to select** field.
Repeat the same steps for the `HKEY_LOCAL_MACHINE\SYSTEM` key.
-Using Group Policy for configuring registry audit is not recommended, as registry DACL settings may
+Using Group Policy for configuring registry audit isn't recommended, as registry DACL settings may
be lost.
diff --git a/docs/auditor/10.7/index.md b/docs/auditor/10.7/index.md
index f5d9cdd002..d894599640 100644
--- a/docs/auditor/10.7/index.md
+++ b/docs/auditor/10.7/index.md
@@ -6,9 +6,7 @@ sidebar_position: 1
# Netwrix Auditor v10.7 Documentation
-Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables
-control over changes, configurations and access in hybrid IT environments to protect data regardless
-of its location. The platform provides security analytics to detect anomalies in user behavior and
+Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables control over changes, configurations, and access in hybrid IT environments to protect data regardless of its location. The platform provides security analytics to detect anomalies in user behavior and
investigate threat patterns before a data breach occurs.
Netwrix Auditor includes applications for:
@@ -42,5 +40,5 @@ Major benefits:
To learn how Netwrix Auditor can help you achieve your specific business objectives, refer to the
[Netwrix Auditor Best Practices Guide](https://helpcenter.netwrix.com/bundle/Auditor_BestPractices_10.0/resource/NetwrixAuditor_BestPractices_10.0.pdf).
-**CAUTION:** To keep your systems safe, Auditor should not be exposed to inbound access from the
+**CAUTION:** To keep your systems safe, Auditor shouldn't be exposed to inbound access from the
internet.
diff --git a/docs/auditor/10.7/install/firstlaunch.md b/docs/auditor/10.7/install/firstlaunch.md
index 29495f9382..a8c6d020d1 100644
--- a/docs/auditor/10.7/install/firstlaunch.md
+++ b/docs/auditor/10.7/install/firstlaunch.md
@@ -22,7 +22,7 @@ To start using Netwrix Auditor
can log in with your Windows credentials by simply clicking Connect. Select Use specified
credentials if you want to log in as another user.
- Make sure you have sufficient permissions to access the product. If you cannot log into Netwrix
+ ensure you have sufficient permissions to access the product. If you can't log into Netwrix
Auditor with your Windows credentials, contact your Netwrix Auditor administrator.
After logging into Netwrix Auditor, you will see the following window:
diff --git a/docs/auditor/10.7/install/overview.md b/docs/auditor/10.7/install/overview.md
index 2840790130..1a504399af 100644
--- a/docs/auditor/10.7/install/overview.md
+++ b/docs/auditor/10.7/install/overview.md
@@ -6,8 +6,7 @@ sidebar_position: 40
# Installation
-This chapter provides step-by-step instructions on how to install Netwrix Auditor and its
-Compression Services. Refer to the following sections for detailed information:
+This chapter provides step-by-step instructions on how to install Netwrix Auditor and its Compression Services. See the following sections for detailed information:
- Install Netwrix Auditor
- Installing Core Services
@@ -21,17 +20,14 @@ It also includes advanced scenarios such as:
For instructions on upgrade procedures, refer to [Upgrade to the Latest Version](/docs/auditor/10.7/install/upgrade.md).
-**CAUTION:** To keep your systems safe, Netwrix Auditor should not be exposed to inbound access from
-the internet.
-
-Follow these steps to install Netwrix Auditor
+**CAUTION:** To keep your systems safe, Netwrix Auditor shouldn't be exposed to inbound access from the internet.
**Step 1 –** Download Netwrix Auditor 10.7 from
[Netwrix website](https://www.netwrix.com/auditor.html).
-NOTE: Before installing Netwrix Auditor, make sure that the Windows Firewall service is started. If
-you use a third-party firewall, see [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md). Also,
-you must be a member of the local Administrators group to run the Netwrix Auditor installation.
+:::note
+Before installing Netwrix Auditor, ensure that the Windows Firewall service is started. If you use a third-party firewall, see [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md). Also, you must be a member of the local Administrators group to run the Netwrix Auditor installation.
+:::
**Step 2 –** Unpack the installation package. The following window will be displayed on successful
operation completion:
@@ -56,7 +52,7 @@ type:
Netwrix Customer Experience Program. It is optional on your part to help Netwrix improve the
quality, reliability, and performance of Netwrix products and services. If you accept, Netwrix
collects statistical information on how the Licensee uses the product in accordance with applicable
-law. Select Skip if you do not want to participate in the program.
+law. Select Skip if you don't want to participate in the program.
You can always opt-out of the Netwrix Customer Experience Program later. See the
[About Netwrix Auditor](/docs/auditor/10.7/admin/settings/about.md) topic for additional information.
@@ -77,11 +73,9 @@ virtualization server. For more information on additional deployment options, vi
## Installing Core Services
-To audit SharePoint farms and user activity, Netwrix Auditor provides Core Services that must be
-installed in the audited environment to collect audit data. Both Core Services can be installed
-either automatically when setting up auditing in Netwrix Auditor, or manually.
+To audit SharePoint farms and user activity, Netwrix Auditor provides Core Services that must be installed in the audited environment to collect audit data. Both Core Services can be installed either automatically when setting up auditing in Netwrix Auditor, or manually.
-Refer to the following sections below for manual installation instructions:
+See the following sections for manual installation instructions:
- [Install for SharePoint Core Service](/docs/auditor/10.7/install/sharepointcoreservice.md)
- [Install for User Activity Core Service](/docs/auditor/10.7/install/useractivitycoreservice.md)
diff --git a/docs/auditor/10.7/install/sharepointcoreservice.md b/docs/auditor/10.7/install/sharepointcoreservice.md
index c50e955651..b18f77f916 100644
--- a/docs/auditor/10.7/install/sharepointcoreservice.md
+++ b/docs/auditor/10.7/install/sharepointcoreservice.md
@@ -8,11 +8,9 @@ sidebar_position: 50
This section contains instructions on how to install Netwrix Auditor for SharePoint Core Service.
-During the Netwrix Auditor for SharePoint Core Service installation / uninstallation your SharePoint
-sites may be unavailable.
+During the Netwrix Auditor for SharePoint Core Service installation or uninstallation, your SharePoint sites may be unavailable.
-Prior to the Netwrix Auditor for SharePoint Core Service installation, review the following
-prerequisites and make sure that:
+Before you install the Netwrix Auditor for SharePoint Core Service, review the following prerequisites and ensure that:
- Netwrix Auditor for SharePoint Core Service is going to be installed on the computer that hosts
SharePoint Central Administration in the audited SharePoint farm.
@@ -23,11 +21,7 @@ prerequisites and make sure that:
- The user that is going to run the Core Service installation:
- Is a member of the local Administrators group on SharePoint server, where the Core Service
will be deployed.
- - Is granted the SharePoint_Shell_Access role on SharePoint SQL Server configuration database.
- See [Permissions for SharePoint Auditing](/docs/auditor/10.7/configuration/sharepoint/permissions.md) topic
- for more information.
-
-Follow the steps to install Netwrix Auditor for SharePoint Core Service manually.
+ - Is granted the SharePoint_Shell_Access role on SharePoint SQL Server configuration database. See [Permissions for SharePoint Auditing](/docs/auditor/10.7/configuration/sharepoint/permissions.md) for more information.
**Step 1 –** On the computer where Auditor Server resides,navigate to _%Netwrix Auditor installation
folder%\SharePoint Auditing\_\_\SharePointPackage_ and copy SpaPackage\_``.msi to the
diff --git a/docs/auditor/10.7/install/silentmode.md b/docs/auditor/10.7/install/silentmode.md
index 33a1e56703..814ab1201a 100644
--- a/docs/auditor/10.7/install/silentmode.md
+++ b/docs/auditor/10.7/install/silentmode.md
@@ -6,9 +6,7 @@ sidebar_position: 20
# Install in Silent Mode
-Silent installation provides a convenient method for deploying Netwrix Auditor without UI.
-
-Follow the steps to install Auditor in a silent mode.
+Silent installation provides a convenient method for deploying Netwrix Auditor without a user interface.
**Step 1 –** Download the product installation package.
diff --git a/docs/auditor/10.7/install/uninstall.md b/docs/auditor/10.7/install/uninstall.md
index 67c4ad2144..e3296ca499 100644
--- a/docs/auditor/10.7/install/uninstall.md
+++ b/docs/auditor/10.7/install/uninstall.md
@@ -8,11 +8,9 @@ sidebar_position: 90
This topic provides instructions to uninstall Netwrix Auditor.
-**NOTE:** If you enabled network traffic compression for data collection, make sure to disable it
-before uninstalling the product. Some network compression services must be removed manually. See the
-Uninstall Compression and Core Services topic for additional information.
-
-Follow the steps to uninstall Auditor.
+:::note
+If you enabled network traffic compression for data collection, disable it before uninstalling the product. Some network compression services must be removed manually. See the Uninstall Compression and Core Services topic for additional information.
+:::
**Step 1 –** On the computer where Auditor is installed, navigate to **Start > Control Panel >
Programs and Features**.
@@ -27,13 +25,10 @@ client consoles will become inoperable.
Perform the procedures below if you used Compression Services and Core Services for data collection
(i.e., the **Network traffic compression** option was enabled).
-Some Auditor Compression services are stopped but not removed when the product is uninstalled. You
-need to delete them manually prior to uninstalling Auditor.
+Some Auditor Compression services are stopped but not removed when the product is uninstalled. You need to delete them manually before you uninstall Auditor.
### Delete Netwrix Auditor for Active Directory Compression Service
-Follow the steps to uninstall the service.
-
**Step 1 –** Navigate to the Active Directory monitoring plan you are using. In the command prompt,
execute the following command:
@@ -52,8 +47,6 @@ sc delete adcrsvc
### Delete Netwrix Auditor for SharePoint Core Service
-Follow the steps to delete the Netwrix Auditor for the SharePoint Core Service.
-
**Step 1 –** In the audited SharePoint farm, navigate to the computer where Central Administration
is installed and where the Netwrix Auditor for SharePoint Core Service resides.
@@ -61,14 +54,13 @@ is installed and where the Netwrix Auditor for SharePoint Core Service resides.
**Step 3 –** Select the Netwrix Auditor **for SharePoint Core Service** and click Uninstall.
-**CAUTION:** Once you click Uninstall you cannot cancel the uninstallation. The Netwrix Auditor
-**for SharePoint Core Service** will be uninstalled even if you click Cancel.
+**CAUTION:** When you click Uninstall, you can't cancel the uninstallation. The Netwrix Auditor for SharePoint Core Service will be uninstalled even if you click Cancel.
### Delete Netwrix Auditor for Windows Server Compression Service
-**NOTE:** Perform this procedure only if you enabled the Compression Service for data collection.
-
-Follow the steps to delete the Netwrix Auditor for Windows Server Compression Service.
+:::note
+Perform this procedure only if you enabled the Compression Service for data collection.
+:::
**Step 1 –** On the target servers, navigate to **Start > Control Panel > Programs and Features**.
@@ -77,8 +69,6 @@ Follow the steps to delete the Netwrix Auditor for Windows Server Compression Se
### Delete Netwrix Auditor Mailbox Access Core Service
-Follow the steps to delete a Netwrix Auditor Mailbox Access Core Service.
-
**Step 1 –** In the command prompt, execute the following command:
```
@@ -92,9 +82,6 @@ If any argument contains spaces, use double quotes.
### Delete Netwrix Auditor User Activity Core Service
-Follow the steps to remove the Core Service via Auditor client on the computer where the Auditor
-Server resides:
-
**Step 1 –** In Auditor client, navigate to All **monitoring plans** and specify the plan.
**Step 2 –** In the right pane, select the **Items** tab.
@@ -103,11 +90,11 @@ Server resides:
Core Service** will be deleted from the selected computer. Perform this action with other computers.
**Step 4 –** In the left pane navigate to **All monitoring plans >\_\_**User Activity monitoring
-plan > Monitored Computers.\_\_ Make sure that the computers you have removed from auditing are no
+plan > Monitored Computers.\_\_ ensure that the computers you have removed from auditing are no
longer present in the list.
**Step 5 –** In case some computers are still present in the list, select them one by one and click
-**Retry Uninstallation**. If this does not help, remove the Core Services manually from the target
+**Retry Uninstallation**. If this doesn't help, remove the Core Services manually from the target
computers through **Programs and Features**.
Remove the Netwrix Auditor User Activity Core Service manually on each audited computer:
@@ -116,7 +103,7 @@ Remove the Netwrix Auditor User Activity Core Service manually on each audited c
**Step 2 –** Select the **Netwrix Auditor User Activity** **Core Service** and click **Uninstall**.
-**NOTE:** You may also use the attached PowerShell script in order to remove the User Activity Core Service from multiple systems: [Uninstall-NetwrixProduct.ps1](/files/auditor/Uninstall-NetwrixProduct.ps1)
+**NOTE:** You may also use the attached PowerShell script to remove the User Activity Core Service from multiple systems: [Uninstall-NetwrixProduct.ps1](/files/auditor/Uninstall-NetwrixProduct.ps1)
### Delete the Netwrix Auditor Application Deployment Service
@@ -126,7 +113,7 @@ service runs on the target servers.
**NOTE:** Perform this procedure only if you enabled the Network traffic compression option for
Windows File Servers data collection.
-Follow the steps to delete the Netwrix Auditor Application Deployment Service.
+To delete the Netwrix Auditor Application Deployment Service:
**Step 1 –** On the target server, navigate to **Start > Registry Editor > Programs and Features**.
@@ -137,13 +124,11 @@ key.
### Delete Netwrix Auditor for File Servers Compression Service
-The Netwrix Auditor for File Servers Compression Service runs on the Auditor Server host as
-designed.
+The Netwrix Auditor for File Servers Compression Service runs on the Auditor Server host as designed.
-**NOTE:** This is applicable for NetApp and Dell Data Storage sources. Delete the service
-irrespective of the Network traffic compression option for Dell Isilon source.
-
-Follow the steps to delete the Netwrix Auditor for File Servers Compression Service.
+:::note
+This is applicable for NetApp and Dell Data Storage sources. Delete the service irrespective of the Network traffic compression option for Dell Isilon source.
+:::
**Step 1 –** On the computer where AuditorServer resides, navigate to **Start > Control Panel >
Programs and Features**.
@@ -156,8 +141,6 @@ Deployment Service and runs on the File Server directly.
### Delete the Netwrix Auditor Event Log Compression Service
-Follow the steps to delete the Netwrix Auditor Event Log Compression Service.
-
**Step 1 –** Navigate to **Start > Control Panel > Programs and Features**.
**Step 2 –** Select **Netwrix Auditor Event Log Compression** > **Service** and click **Uninstall**.
diff --git a/docs/auditor/10.7/install/upgrade.md b/docs/auditor/10.7/install/upgrade.md
index 6fa1a60e9b..94ccc8bd75 100644
--- a/docs/auditor/10.7/install/upgrade.md
+++ b/docs/auditor/10.7/install/upgrade.md
@@ -50,7 +50,7 @@ operation. The issues listed below apply to upgrade from 9.96 and 10.
- After the upgrade you may receive temporary data collection errors – they occur when the program
tries to upload collected data to the Audit Database before the database upgrade is finished.
-- Microsoft Exchange Server 2010 is no longer supported. Please upgrade your Exchange Server to a
+- Microsoft Exchange Server 2010 is no longer supported. upgrade your Exchange Server to a
new version.
- For Netwrix Auditor for SharePoint Online, the following data will be available within 24 hours
after upgrade:
@@ -62,7 +62,7 @@ operation. The issues listed below apply to upgrade from 9.96 and 10.
- For auditing cloud-based applications (Microsoft Entra ID, Exhange Online, SharePoint Online, and
MS Teams) with Netwrix Auditor using basic authentication: before an upgrade from version 10.0 and
- earlier, make sure that the account under which the upgrade will be performed has sufficient
+ earlier, ensure that the account under which the upgrade will be performed has sufficient
rights and permissions to perform initial data collection and upgrade. Review the following for
more information about required rights and permissions:
@@ -82,7 +82,7 @@ operation. The issues listed below apply to upgrade from 9.96 and 10.
- [Permissions for Teams Auditing](/docs/auditor/10.7/configuration/microsoft365/teams/permissions/permissions.md)
- Netwrix Auditor for Oracle Database. If you use the following combination of the audit settings:
- Mixed Mode + Fine Grained Auditing, please check your configuration. You may need to re-configure
+ Mixed Mode + Fine Grained Auditing, check your configuration. You may need to re-configure
your audit since the Oracle Database data collection mechanism was changed. See the
[Supported Data Sources](/docs/auditor/10.7/requirements/supporteddatasources/supporteddatasources.md) and
[Verify Your Oracle Database Audit Settings](/docs/auditor/10.7/configuration/oracle/verifysettings.md) topics for
@@ -116,15 +116,9 @@ software products from the My Products page:
[Customer Portal Access](https://helpcenter.netwrix.com/bundle/NetwrixCustomerPortalAccess/page/Customer_Portal_Access.html)
topic for information on how to register for a Customer Portal account.
-Partners and MSPs who are logged into the Netwrix Partner Portal can download the latest version of
-their software products from the My Product page:
-[https://www.netwrix.com/par/site/products](https://www.netwrix.com/my_products.html). To receive an
-invitation to the Partner Portal, please contact
-[netwrix.msp@netwrix.com](http://netwrix.msp@netwrix.com/).
+Partners and MSPs who are logged into the Netwrix Partner Portal can download the latest version of their software products from the My Product page: [https://www.netwrix.com/par/site/products](https://www.netwrix.com/my_products.html). To receive an invitation to the Partner Portal, contact [netwrix.msp@netwrix.com](http://netwrix.msp@netwrix.com/).
-Follow the steps to perform the upgrade.
-
-**Step 1 –** Make sure you have completed the preparatory steps above.
+**Step 1 –** Ensure you have completed the preparatory steps above.
**Step 2 –** Run the setup on the computer where the Auditor Server resides. See the
[Installation](/docs/auditor/10.7/install/overview.md) topic for additional information.
diff --git a/docs/auditor/10.7/install/useractivitycoreservice.md b/docs/auditor/10.7/install/useractivitycoreservice.md
index 7bcfb0a400..a0652f58cf 100644
--- a/docs/auditor/10.7/install/useractivitycoreservice.md
+++ b/docs/auditor/10.7/install/useractivitycoreservice.md
@@ -6,11 +6,11 @@ sidebar_position: 60
# Install for User Activity Core Service
-By default, the Core Service is installed automatically on the audited computers when setting up
-auditing in Netwrix Auditor. If, for some reason, installation has failed, you must install the Core
+By default, Netwrix Auditor automatically installs the Core Service on the audited computers when setting up
+auditing. If, for some reason, installation has failed, you must install the Core
Service manually on each audited computer.
-Follow the steps to install Netwrix Auditor User Activity Core Service.
+To install Netwrix Auditor User Activity Core Service, complete the following steps:
**Step 1 –** On the computer where Auditor Server resides, navigate to _%ProgramFiles% (x86)\Netwrix
Auditor\User Activity Video Recording_ and copy the UACoreSvcSetup.msi file to the audited computer.
@@ -25,12 +25,11 @@ computer where Netwrix Auditor is installed) and the server TCP port.
## Install User Activity Core Service with the Command Prompt
-Follow the steps to perform a silent installation of the User Activity Core Service with the command
-prompt.
+To perform a silent installation of the User Activity Core Service with the command prompt, complete the following steps:
-**Step 1 –** On the computer where Auditor Server resides,, navigate to _%ProgramFiles%
+**Step 1 –** On the computer where Auditor Server resides, navigate to _%ProgramFiles%
(x86)\Netwrix Auditor\User Activity Video Recording_ and copy the **UACoreSvcSetup.msi** file to the
-audited computer or to a file share the target server(s) can access.
+audited computer or to a file share the target servers can access.
**Step 2 –** Run the following commands on target servers:
diff --git a/docs/auditor/10.7/install/viagrouppolicy.md b/docs/auditor/10.7/install/viagrouppolicy.md
index 57f2f3e7fc..598b4c9281 100644
--- a/docs/auditor/10.7/install/viagrouppolicy.md
+++ b/docs/auditor/10.7/install/viagrouppolicy.md
@@ -10,7 +10,7 @@ The Netwrix Auditor client can be deployed on multiple computers via Group Polic
helpful if you want to grant access to configuration and audit data to a significant number of
employees and, therefore, have to run Netwrix Auditor installation on multiple computers.
-If installing via Group Policy, make sure to deploy Netwrix Auditor client and Netwrix Auditor
+If installing via Group Policy, ensure to deploy Netwrix Auditor client and Netwrix Auditor
server on different machines. If both components are installed on the same machine, you may
experience issues with future upgrades.
@@ -32,7 +32,7 @@ To run the Netwrix Auditor installation, you must be a member of the local Admin
1. Create a shared folder that will be used for distributing the installation package.
- Make sure that the folder is accessible from computers where the Netwrix Auditor clients are
+ ensure that the folder is accessible from computers where the Netwrix Auditor clients are
going to be deployed. You must grant the Read permissions on this folder to these computer
accounts.
@@ -43,7 +43,7 @@ To run the Netwrix Auditor installation, you must be a member of the local Admin
It is recommended to create a dedicated organizational unit using Active Directory Users and
Computers and add computers where you want to deploy the Netwrix Auditor client.
-Follow the steps to create a Group Policy
+To create a Group Policy, complete the following steps:
**Step 1 –** Open the **Group Policy Management** console on any domain controller in the target
domain: navigate to Start > Windows Administrative Tools (Windows Server 2016 and higher) or
diff --git a/docs/auditor/10.7/install/virtualappliance/configure.md b/docs/auditor/10.7/install/virtualappliance/configure.md
index a8bacdb7e8..e96e4cb64b 100644
--- a/docs/auditor/10.7/install/virtualappliance/configure.md
+++ b/docs/auditor/10.7/install/virtualappliance/configure.md
@@ -26,7 +26,7 @@ the license agreement and then press `Y` to accept it.
| Rename virtual machine | Specify a new name for the virtual machine (e.g., _`NA-Server`_). The computer name must be properly formatted. It may contain letters (a-z, A-Z), numbers (0-9), and hyphens (-), but no spaces and periods (.). The name may not consist entirely of digits and may not be longer than 15 characters. |
| Add additional input languages | Select `Y` if you want to specify additional input languages. Select `N` to proceed with English. |
| Configure network | - Select `Y` to use DHCP server to configure network settings automatically. - Select `N` to configure required parameters manually. In this case, you will be prompted to set up IP settings manually. |
-| Join computer to the domain or workgroup | **To join a domain** Select `Y`. Specify the fully qualified domain name to join (e.g., `corp.local`). Then specify domain administrator name and password. For your convenience, the account specified will be added to the local Administrators group and set as account for collecting data from the target systems. Domain Users group will be removed from the local Users group after the machine with the appliance joins the domain. The script is starting to test your domain controller: by NETBIOS name first, then by DNS name and finally, using an IP address. If at least one of the tests is successful, the computer will be added to a domain. In case of failure, you will be prompted to do one of the following: - Re-try to joint to the selected domain. In this case, the script uses the DNS name of your domain controller. The name must be resolved. - Continue with Workgroup. See the procedure below on how to join the computer to a workgroup. - Cancel and **Return to Main Menu**. Select if you want to cancel the domain join and re-configure the machine. Press Enter and repeat menu section. You will return to step 5. **To join a workgroup** Select `N`. Specify the local administrator name and credentials. For your convenience, the account specified will be set as account for collecting data from the target systems. Netwrix Auditor is unable to work in a workgroup. Please confirm if you want to proceed. Otherwise, you will not be able to run reviews on data collected by Auditor. See the [Access Reviews](/docs/auditor/10.7/accessreviews/accessreviews.md) topic for additional information about integration with Access Reviews. |
+| Join computer to the domain or workgroup | **To join a domain** Select `Y`. Specify the fully qualified domain name to join (e.g., `corp.local`). Then specify domain administrator name and password. For your convenience, the account specified will be added to the local Administrators group and set as account for collecting data from the target systems. Domain Users group will be removed from the local Users group after the machine with the appliance joins the domain. The script is starting to test your domain controller: by NETBIOS name first, then by DNS name and finally, using an IP address. If at least one of the tests is successful, the computer will be added to a domain. In case of failure, you will be prompted to do one of the following: - Re-try to joint to the selected domain. In this case, the script uses the DNS name of your domain controller. The name must be resolved. - Continue with Workgroup. See the procedure below on how to join the computer to a workgroup. - Cancel and **Return to Main Menu**. Select if you want to cancel the domain join and re-configure the machine. Press Enter and repeat menu section. You will return to step 5. **To join a workgroup** Select `N`. Specify the local administrator name and credentials. For your convenience, the account specified will be set as account for collecting data from the target systems. Netwrix Auditor is unable to work in a workgroup. confirm if you want to proceed. Otherwise, you will not be able to run reviews on data collected by Auditor. See the [Access Reviews](/docs/auditor/10.7/accessreviews/accessreviews.md) topic for additional information about integration with Access Reviews. |
| Configure SQL Server | The shell script automatically configures SQL Server instance. The sysadmin server role on SQL Server instance is granted automatically to the BUILTIN\Administrators group. |
In the example below, review how the shell script configures the new VM:
@@ -43,7 +43,7 @@ workgroup).
For the first time, Auditor Client starts automatically. Later, you can always run it from the Start
menu or launch it by double-clicking the Auditor shortcut on the desktop.
-Do not close the Virtual Appliance Configuration window until the product configuration completes.
+Don't close the Virtual Appliance Configuration window until the product configuration completes.
## What Is Next
@@ -56,5 +56,5 @@ Now you can evaluate Auditor functionality. Review the table below for more info
| - Browse data with interactive search - Review diagrams - Generate reports - Configure report subscriptions - Create alerts | Auditor Client | - [Reports](/docs/auditor/10.7/admin/reports/overview.md) - [Subscriptions](/docs/auditor/10.7/admin/subscriptions/overview.md) - [Alerts](/docs/auditor/10.7/admin/alertsettings/overview.md) |
| See the data collected by Auditor | Auditor Client | - [Access Reviews](/docs/auditor/10.7/accessreviews/accessreviews.md) |
-**NOTE:** If any errors occur, please contact
+**NOTE:** If any errors occur, contact
[Netwrix technical support](https://www.netwrix.com/support.html).
diff --git a/docs/auditor/10.7/install/virtualappliance/importvmware.md b/docs/auditor/10.7/install/virtualappliance/importvmware.md
index 6ddfea60ae..4f308db155 100644
--- a/docs/auditor/10.7/install/virtualappliance/importvmware.md
+++ b/docs/auditor/10.7/install/virtualappliance/importvmware.md
@@ -43,4 +43,4 @@ in this VMware article:
**Step 6 –** On the Select a template step, select NetwrixAuditor from your ContentLibrary.
-**Step 7 –** Proceed with the wizard: select name and folder, resources and storage for the VM.
+**Step 7 –** Proceed with the wizard: select the name, folder, resources, and storage for the VM.
diff --git a/docs/auditor/10.7/install/virtualappliance/overview.md b/docs/auditor/10.7/install/virtualappliance/overview.md
index 1c0d20c2f0..14bd07a32d 100644
--- a/docs/auditor/10.7/install/virtualappliance/overview.md
+++ b/docs/auditor/10.7/install/virtualappliance/overview.md
@@ -6,8 +6,7 @@ sidebar_position: 70
# Virtual Deployment Overview
-In addition to on-premises deployment, Netwrix Auditor offers the deployment option that can speed
-time-to-value by getting you up and running in less than 15 minutes.
+In addition to on-premises deployment, Netwrix Auditor offers a deployment option that gets you operational in less than 15 minutes.
Virtual appliance — If you run a Microsoft Hyper-V or VMware vSphere, you can deploy Auditor as a
virtual appliance. Virtual appliance is a VM image file with installed Netwrix Auditor. The image is
@@ -62,7 +61,7 @@ The virtual appliance also contains Access Information Center for Auditor versio
[Microsoft Licensing Activation Centers worldwide telephone numbers](https://www.microsoft.com/en-us/licensing/existing-customer/activation-centers)
for additional information.
-- Microsoft SQL Server Express Edition is only recommended for evaluation, PoC or small deployments.
+- Microsoft SQL Server Express Edition is only recommended for evaluation, PoC, or small deployments.
For production deployment planning in bigger environments, refer to requirements and
recommendations listed in the
[Requirements for SQL Server to Store Audit Data](/docs/auditor/10.7/requirements/sqlserver.md) section.
diff --git a/docs/auditor/10.7/overview/gettingstarted.md b/docs/auditor/10.7/overview/gettingstarted.md
index 0caf59f1c4..c40cb6bd19 100644
--- a/docs/auditor/10.7/overview/gettingstarted.md
+++ b/docs/auditor/10.7/overview/gettingstarted.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Getting Started
-In this section, we will cover:
+This section covers:
- Pre-installation procedures
- Installation
@@ -21,7 +21,7 @@ In this section, we will cover:
| -------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
| Pre-installation procedures | |
| Review recommendations and considerations for Netwrix Auditor deployment planning. | - [Requirements](/docs/auditor/10.7/requirements/overview.md) |
-| Make sure the data source you are going to audit is supported. | - [Supported Data Sources](/docs/auditor/10.7/requirements/supporteddatasources/supporteddatasources.md) |
+| Ensure the data source you are going to audit is supported. | - [Supported Data Sources](/docs/auditor/10.7/requirements/supporteddatasources/supporteddatasources.md) |
| Open the required ports for connections. | - [Protocols and Ports Required](/docs/auditor/10.7/requirements/ports.md) |
| Review system requirements. | - [Requirements](/docs/auditor/10.7/requirements/overview.md) |
| Installation | |
@@ -30,7 +30,7 @@ In this section, we will cover:
| IT infrastructure configuration | |
| Configure target IT infrastructure depending on your data source. | - [Supported Data Sources](/docs/auditor/10.7/requirements/supporteddatasources/supporteddatasources.md) |
| Configure Auditor service accounts. | - [Software Requirements](/docs/auditor/10.7/requirements/software.md) |
-| If you are going to use Group Managed Service Account (gMSA) for data collection and storage, refer to the following article for more information. | - [Use Group Managed Service Account (gMSA)](/docs/auditor/10.7/requirements/gmsa.md) |
+| If you are going to use Group Managed Service Account (gMSA) for data collection and storage, see the linked article for more information. | - [Use Group Managed Service Account (gMSA)](/docs/auditor/10.7/requirements/gmsa.md) |
| Product configuration | |
| Configure role-based access and delegation. | - [Role-Based Access and Delegation](/docs/auditor/10.7/admin/monitoringplans/delegation.md) |
| Configure general product settings. | - [Netwrix Auditor Settings](/docs/auditor/10.7/admin/settings/overview.md) |
diff --git a/docs/auditor/10.7/overview/producteditions.md b/docs/auditor/10.7/overview/producteditions.md
index deb86319fa..6bef57fbb9 100644
--- a/docs/auditor/10.7/overview/producteditions.md
+++ b/docs/auditor/10.7/overview/producteditions.md
@@ -18,7 +18,7 @@ Enterprise Advanced version. Alternatively, you can switch to Free Community Edi
Free Community Edition helps you maintain visibility into your environment by delivering daily
reports that summarize changes that took place in the last 24 hours. However, you will no longer be
-able to use interactive search, predefined reports, alerts and dashboards, or store your security
+able to use interactive search, predefined reports, alerts, or dashboards, or store your security
intelligence. After switching to free mode, you may need to re-arrange your audit configuration due
to the limitations.
@@ -63,7 +63,7 @@ Refer to a table below to compare product editions.
| Activity Summary | 1 recipient | Multiple recipients |
| AuditArchive | – | Both Long-Term Archive and Audit Database |
| Search | – | + |
-| Reports (including organization–level reports, overview diagrams, change and activity reports, reports with video and review status) and special report packs | – | + |
+| Reports (including organization–level reports, overview diagrams, change, and activity reports, and reports with video and review status) and special report packs | – | + |
| State–in–time reports | – | + |
| Ability to save search as a custom report | – | + |
| Subscriptions | – | + |
diff --git a/docs/auditor/10.7/overview/whatsnew.md b/docs/auditor/10.7/overview/whatsnew.md
index 2469c90a4b..956dd19861 100644
--- a/docs/auditor/10.7/overview/whatsnew.md
+++ b/docs/auditor/10.7/overview/whatsnew.md
@@ -10,7 +10,7 @@ sidebar_position: 30
All Netwrix product announcements have moved to the new Netwrix Community. See announcements for
Netwrix Auditor in the [Auditor](https://community.netwrix.com/c/auditor/announcements/90) area of
-our new community.
+the new community.
The following information highlights the new and enhanced features introduced in this Netwrix
Auditor 10.7 version.
@@ -19,7 +19,7 @@ Auditor 10.7 version.
Integration with Netwrix Privilege Secure
-Netwrix Auditor is able to store its collection credentials in Netwrix Privilege Secure, making the
+Netwrix Auditor can store its collection credentials in Netwrix Privilege Secure, making the
usage of Auditor more secure.
Data sensitivity tags in searches and alerts for NetApp, Qumulo, and Synology
@@ -27,7 +27,7 @@ Data sensitivity tags in searches and alerts for NetApp, Qumulo, and Synology
Data sensitivity tags in searches and alerts enable customers using NetApp, Qumulo, and Synology
systems to reduce the time to detect incidents involving sensitive data and accelerate the response
to these kinds of threats. They can set up alerts that will be triggered whenever sensitive
-documents are accessed, modified or deleted, or filter out all activity that isn’t related to
+documents are accessed, modified, or deleted, or filter out all activity that isn’t related to
sensitive data.
New sensitive data-related risks for SharePoint Online
diff --git a/docs/auditor/10.7/requirements/console.md b/docs/auditor/10.7/requirements/console.md
index 211d51a710..e4ae531169 100644
--- a/docs/auditor/10.7/requirements/console.md
+++ b/docs/auditor/10.7/requirements/console.md
@@ -12,7 +12,7 @@ the resources required for Netwrix Auditor deployment.
The actual hardware requirements will depend on the number of activities collected per day in
addition to the number of files and folders monitored.
-**CAUTION:** To keep your systems safe, Auditor should not be exposed to inbound access from the
+**CAUTION:** To keep your systems safe, Auditor shouldn't be exposed to inbound access from the
internet.
## Full Installation
@@ -39,7 +39,7 @@ Netwrix Auditor and SQL Server instance will be deployed on different servers.
Requirements below apply to Netwrix Auditor server.
-| Hardware component | Evaluation, PoC or starter environment | Regular environment (up to 1m ARs\*/day) | Large environment (1-10m ARs\*/day) | XLarge environment (10m ARs\*/day or more) |
+| Hardware component | Evaluation, PoC, or starter environment | Regular environment (up to 1m ARs\*/day) | Large environment (1-10m ARs\*/day) | XLarge environment (10m ARs\*/day or more) |
| ------------------ | -------------------------------------- | ---------------------------------------- | ----------------------------------------- | ---------------------------------------------------------------- |
| CPUs | 2 cores | 4 CPUs | 8 CPUs | 16 CPUs |
| RAM | 8 GB | min 8 GB | min 16 GB | 64 GB |
@@ -59,7 +59,7 @@ details, see:
- [Working Folder](/docs/auditor/10.7/requirements/workingfolder.md)
Netwrix Auditor informs you if you are running out of space on a system disk where the Long-Term
-Archive is stored by default. You will see related events in the Health log once the free disk space
+Archive is stored by default. You will see related events in the Health log when the free disk space
starts approaching the minimum level. When the free disk space is less than 3 GB, the Netwrix
services responsible for audit data collection will be stopped.
@@ -98,8 +98,8 @@ by clicking
## Client Installation
-The client installation includes only Netwrix Auditor client console that enables you to connect to
-the Netwrix Auditor Server installed remotely.
+The client installation includes only the Netwrix Auditor client console, which connects you to
+a remotely installed Netwrix Auditor Server.
Virtual deployment is recommended.
diff --git a/docs/auditor/10.7/requirements/deploymentscenarios.md b/docs/auditor/10.7/requirements/deploymentscenarios.md
index 7bc567f001..6c0e16443b 100644
--- a/docs/auditor/10.7/requirements/deploymentscenarios.md
+++ b/docs/auditor/10.7/requirements/deploymentscenarios.md
@@ -24,9 +24,9 @@ dedicated servers:
Also, ensure these servers have enough RAM to prevent from performance loss - minimum 12 GB
required, 16+ GB recommended.
-To learn more, see the How It Works and Deployment Planning topics in the Netwrix Data
-Classification Knowlege center:
-[Netwrix Data Classification Documentation](https://helpcenter.netwrix.com/category/dataclassification)..
+For more information, see the How It Works and Deployment Planning topics in the Netwrix Data
+Classification Knowledge Center:
+[Netwrix Data Classification Documentation](https://helpcenter.netwrix.com/category/dataclassification)
When planning for hardware resources, consider that insufficient CPU and RAM may lead to performance
bottlenecks. Thus, try to provide not minimal but recommended configuration. Same recommendations
@@ -61,10 +61,10 @@ Hyper-V virtualization server. For more information on this deployment option, r
- If you are implementing a PoC project, it is strongly recommended that after its completion you
create a new Netwrix Auditor server VM dedicated for use in production. Migrating the VM that
- hosted Netwrix Auditor server during the PoC into production environment is not recommended, as it
+ hosted Netwrix Auditor server during the PoC into production environment isn't recommended, as it
may lead to performance problems.
- Consider using a dedicated SQL Server for the PoC project. Production database servers are often
- configured with the features that are not necessary for Netwrix Auditor (like cluster support,
+ configured with the features that aren't necessary for Netwrix Auditor (like cluster support,
frequent backup, and so on). If you have no opportunity to use a dedicated SQL Server, then create
an dedicated instance for Netwrix Auditor databases on your existing server.
@@ -129,7 +129,7 @@ approximately 1+ million of activity records generated per day):
| Software Component | Requirement |
|---------------------------------------|---------------------------------------------------------------------------------------------|
-| Microsoft SQL Server 2012 or later | Standard or Enterprise edition (Express cannot be used due to its database size limitation) |
+| Microsoft SQL Server 2012 or later | Standard or Enterprise edition (Express can't be used due to its database size limitation) |
| Dedicated SQL Server instance or cluster is recommended | |
| SQL Server Reporting Services for reporting | |
@@ -168,7 +168,7 @@ more than 20 000 users (10+ million of activity records generated per day):
| Software Component | Requirement |
|-----------------------------------------|------------------------------------------------------------------------------------------------------|
-| Microsoft SQL Server 2012 or later | Standard or Enterprise edition (Express cannot be used due to its database size limitation) |
+| Microsoft SQL Server 2012 or later | Standard or Enterprise edition (Express can't be used due to its database size limitation) |
| Dedicated SQL Server instance or cluster| Recommended |
| SQL Server Reporting Services | For reporting |
diff --git a/docs/auditor/10.7/requirements/gmsa.md b/docs/auditor/10.7/requirements/gmsa.md
index bc75c087d9..5937ebafde 100644
--- a/docs/auditor/10.7/requirements/gmsa.md
+++ b/docs/auditor/10.7/requirements/gmsa.md
@@ -10,20 +10,20 @@ Auditor supports using Group Managed Service Accounts (gMSA) for data collection
can help you to simplify product administration, providing the following benefits:
- There is no password to manage for this account: Windows handles the password management for it.
- User interaction for password update on a regular basis is not required.
+ User interaction for password update on a regular basis isn't required.
- Using the gMSA also eliminates a need in service accounts with static passwords that are set upon
creation and then never cycled.
- The gMSA also helps to ensure that service account is only used to run a service (gMSA accounts
- cannot be used to log on interactively to domain computers).
+ can't be used to log on interactively to domain computers).
- The gMSA is allowed to audit trusted domains using configured and validated gMSA from the target
domain.
-Currently, gMSA is supported:
+gMSA is supported:
- As a data collecting account for the following data sources:
- Active Directory (including Group Policy and Logon Activity)
- - File Server (currently for Windows File Servers)
+ - File Server (for Windows File Servers)
- SQL Server
- SharePoint
- User Activity (including User Activity Video Recording)
@@ -53,7 +53,7 @@ domain or subdomain.
See the following Microsoft article for more information:
[Get started with Group Managed Service Accounts](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts/getting-started-with-group-managed-service-accounts)
-By default, the gMSA account is not a member of any domain groups. After creating gMSA account, you
+By default, the gMSA account isn't a member of any domain groups. After creating gMSA account, you
need to add this account to one of the domain groups as required for the data source you are going
to audit.
@@ -63,22 +63,22 @@ To generate password for gMSA accounts, domain controllers require a Key Distrib
root key. This key is created once, so if there are any gMSA accounts in your domain, this means the
root key already exists.
-Follow the steps to check whether the root key exists in your domain.
+To check whether the root key exists in your domain, complete the following steps:
**Step 1 –** Open the **Active Directory Sites and Services** Console and select **View** > **Show
Services Node**.
**Step 2 –** Browse to **Services** > **Group Key Distribution Services** > **Master Root Keys**.
-**Step 3 –** Alternatively, you can run the `Get-KdsRootKey` cmdlet. If the key does not exist, it
+**Step 3 –** Alternatively, you can run the `Get-KdsRootKey` cmdlet. If the key doesn't exist, it
will not return any output.
## Create a KDS Root Key
-If the KDS root key does not exist, then you can create a KDS root key as described below, or
+If the KDS root key doesn't exist, you can create a KDS root key as described below, or
contact your Active Directory administrator.
-Follow the steps to create a KDS key (on a domain controller running Windows Server 2012 or later).
+To create a KDS key on a domain controller running Windows Server 2012 or later, complete the following steps:
**Step 1 –** On the domain controller, run **Windows PowerShell**.
@@ -104,8 +104,8 @@ _mm/dd/yyyy_ format, for example: `Add-KdsRootKey -EffectiveTime 02/27/21`
**CAUTION:** This approach, however, should be used with care. Waiting up to 10 hours is a safety
measure to prevent password generation from occurring before all DCs in the environment are capable
-of answering gMSA requests. For more information, refer to the following microsoft article:
-[Create the Key Distribution Services KDS Root Key](https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/create-the-key-distribution-services-kds-root-key).
+of answering gMSA requests. See the Microsoft article
+[Create the Key Distribution Services KDS Root Key](https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/create-the-key-distribution-services-kds-root-key) for more information.
To make the KDS Root Key work immediately you can use the following powershell command:
@@ -121,7 +121,7 @@ wait 10 hours for replication.
To create a new gMSA, you will need to specify:
- New account name and FQDN
-- Computer account(s) that will be allowed to make use of that gMSA. Here it will be your Auditor
+- Computer accounts that will be allowed to make use of that gMSA. Here it will be your Auditor
Server
- The account must be a member of the **Administrators** group on the Auditor Server.
@@ -130,7 +130,7 @@ For example, you can create a gMSA using the `New-ADServiceAccount` PowerShell c
should specify your Auditor Server account in the `-PrincipalsAllowedToRetrieveManagedPassword`
attribute.
-Make sure you specify a valid computer object in this attribute.
+Ensure you specify a valid computer object in this attribute.
If you have multiple Auditor servers, you can specify the computer accounts using a comma separated
list, or specify a security group and add the required computer accounts to that security group.
@@ -143,7 +143,7 @@ To create a new gMSA in the root domain using PowerShell:
here:
- - _name_ — new gMSA name, here **nagmsa**. Make sure the name refers to a valid computer
+ - _name_ — new gMSA name, here **nagmsa**. Ensure the name refers to a valid computer
objects.
- _DNSHostName_ — FQDN of the new gMSA account, here **nagmsa.mydomain.local**
- _PrincipalsAllowedToRetrieveManagedPassword_ — your Netwrix Auditor Server NETBIOS name ended
@@ -188,10 +188,10 @@ account, depending on what purpose a gMSA account will be used for.
- [Requirements for SQL Server to Store Audit Data](/docs/auditor/10.7/requirements/sqlserver.md)
- _Remember,_ that a gMSA account cannot access SSRS due to Microsoft restrictions.
+ _Remember,_ that a gMSA account can't access SSRS due to Microsoft restrictions.
-- If you are going to use a gMSA as a data collection accoun for User Activity or User Activity
- Video Recording, refer to the following topics:
+- If you are going to use a gMSA as a data collection account for User Activity or User Activity
+ Video Recording, see the following topics:
- [User Activity](/docs/auditor/10.7/configuration/useractivity/overview.md)
- [Configure Video Recordings Playback Settings](/docs/auditor/10.7/configuration/useractivity/videorecordings.md)
@@ -212,7 +212,7 @@ To process the corresponding monitored items using gMSA, you can specify this ac
monitored plan properties. See the
[Create a New Monitoring Plan](/docs/auditor/10.7/admin/monitoringplans/create.md) topic for additional information.
-Follow the steps to set a custom account in the monitored item properties.
+To set a custom account in the monitored item properties, complete the following steps:
**Step 1 –** Open the monitored item properties for editing.
diff --git a/docs/auditor/10.7/requirements/longtermarchive.md b/docs/auditor/10.7/requirements/longtermarchive.md
index 1b15564f0d..b635723371 100644
--- a/docs/auditor/10.7/requirements/longtermarchive.md
+++ b/docs/auditor/10.7/requirements/longtermarchive.md
@@ -22,7 +22,7 @@ recommendations in the next section.
Then you should prepare the new folder for repository, target Netwrix Auditor at that folder, and,
if necessary, move repository data from the old to the new location.
-Follow the steps to modify Long-Term Archive location and other settings.
+To modify Long-Term Archive location and other settings, complete the following steps:
**Step 1 –** In Auditor client, click Settings > Long-Term Archive; alternatively, if you are
viewing the Long-Term Archive widget of the Health Status dashboard, click Open settings.
@@ -114,7 +114,7 @@ The custom account must be granted the following rights and permissions:
The procedure below applies to Windows Server 2012 R2 and above and may vary slightly depending on
your OS.
-Follow the steps to assign permissions on the Long-Term Archive folder:
+To assign permissions on the Long-Term Archive folder, complete the following steps:
**Step 1 –** Navigate to a folder where the Long-Term Archive will be stored, right-click it and
select Properties.
@@ -127,8 +127,8 @@ select Properties.
**Step 4 –** In the Permission Entry for `` dialog, apply the following settings:
- Specify an account as principal.
-- Set Type to _"Allow"_.
-- Set Applies to to _"This folder, subfolders and files"_.
+- Set **Type** to **Allow**.
+- For **Applies to**, select **This folder, subfolders, and files**.
- Switch to the Advanced permissions section.
- Check the following permissions:
- List folder / read data
@@ -146,8 +146,7 @@ select Properties.
The procedure below applies to Windows Server 2012 R2 and above and may vary slightly depending on
your OS.
-Follow the steps to assign the **Change** and **Create Files/Write Data** permissions to upload
-subscriptions to file shares:
+To assign the **Change** and **Create Files/Write Data** permissions to upload subscriptions to file shares, complete the following steps:
**Step 1 –** Navigate to a folder where report subscriptions will be stored, right-click it and
select Properties.
@@ -171,9 +170,9 @@ check the Allow flag next to Change.
**Step 8 –** Apply the following settings to your Permission Entry.
- Specify a Netwrix Auditor user as principal.
-- Set Type to _"Allow"_.
-- Set Applies to to _"This folder, subfolders and files"_.
-- Check Create files / write data in the Advanced permissions section.
+- Set **Type** to **Allow**.
+- For **Applies to**, select **This folder, subfolders, and files**.
+- Check **Create files / write data** in the Advanced permissions section.
The users who are going to access report subscriptions must be granted read access to these shares.
Netwrix recommends you to create a dedicated folder and grant access to the entire Netwrix Auditor
diff --git a/docs/auditor/10.7/requirements/overview.md b/docs/auditor/10.7/requirements/overview.md
index 4d14e73211..e072c0e212 100644
--- a/docs/auditor/10.7/requirements/overview.md
+++ b/docs/auditor/10.7/requirements/overview.md
@@ -16,17 +16,17 @@ following topics for additional information:
## Architecture Overview
-Netwrix Auditor provides comprehensive auditing of applications, platforms and storage systems. The
+Netwrix Auditor provides comprehensive auditing of applications, platforms, and storage systems. The
product architecture and components interactions are shown in the figure below.
-- Netwrix Auditor Server — the central component that handles the collection, transfer and
+- Netwrix Auditor Server — the central component that handles the collection, transfer, and
processing of audit data from the various data sources (audited systems). Data from the sources
- not yet supported out of the box is collected using RESTful Integration API.
-- Netwrix Auditor Client — a component that provides a friendly interface to authorized personnel
- who can use this console UI to manage the product settings, examine alerts, reports and search
- results. Other users can obtain audit data by email or with 3rd party tools — for example, reports
+ not yet supported natively is collected using RESTful Integration API.
+- Netwrix Auditor Client — a component that provides a user interface to authorized personnel
+ who can use this console to manage product settings, examine alerts, reports, and search
+ results. Other users can obtain audit data by email or third-party tools — for example, reports
can be provided to the management team via the intranet portal.
- Data sources — entities that represent the types of audited systems supported by Netwrix Auditor
(for example, Active Directory, Exchange Online, NetApp storage system, and so on), or the areas
@@ -34,9 +34,8 @@ product architecture and components interactions are shown in the figure below.
- Long-Term Archive — a file-based repository storage keeps the audit data collected from all your
data sources or imported using Integration API in a compressed format for a long period of time.
Default retention period is 120 months.
-- Audit databases — these are Microsoft SQL Server databases used as operational storage. This type
- of data storage allows you to browse recent data, run search queries, generate reports and
- alerts.
+- Audit databases — these are Microsoft SQL Server databases used as operational storage. Use this type
+ of data storage to browse recent data, run search queries, and generate reports and alerts.
Typically, data collected from the certain data source (for example, Exchange Server) is stored to
the dedicated Audit database and the long-term archive. So, you can configure as many databases as
the data sources you want to process. Default retention period for data stored in the Audit
diff --git a/docs/auditor/10.7/requirements/ports.md b/docs/auditor/10.7/requirements/ports.md
index e553096ae4..dc560ce8b2 100644
--- a/docs/auditor/10.7/requirements/ports.md
+++ b/docs/auditor/10.7/requirements/ports.md
@@ -14,10 +14,10 @@ re-installation or upgrade.
| If you use... | Do the following... |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Windows Firewall | If you are running Windows Firewall on the computer where Auditor Server is going to be installed, the 135, 9004, 9699, 9011, and one dynamic port will be opened automatically for inbound connections during Auditor installation. For outbound rules, create or enable predefined Windows Firewall rules. Before installing Auditor, make sure that the Windows Firewall service is started. |
+| Windows Firewall | If you are running Windows Firewall on the computer where Auditor Server is going to be installed, ports 135, 9004, 9699, 9011, and one dynamic port will be opened automatically for inbound connections during Auditor installation. Create or enable predefined Windows Firewall rules for outbound connections. Before installing Auditor, ensure that the Windows Firewall service is started. |
| Third-party Firewall | If you use a third-party firewall, you must create rules manually. |
-Follow the steps to create Firewall rules manually.
+To create Firewall rules manually, complete the following steps:
The example below applies to Windows Firewall and explains how to create a rule for inbound
connection.
@@ -38,7 +38,7 @@ left.
- On the Protocol and Ports step, select TCP or UDP. In the Specific local ports field specify the
port number.
- On the Action step, select the Allow the connection action.
-- On the Profile step, make sure that the rule applies to all profiles (Domain, Private, Public).
+- On the Profile step, ensure that the rule applies to all profiles (Domain, Private, Public).
- On the Name step, specify the rule's name, for example Netwrix Auditor TCP port_number Access.
In most cases, this configuration is enough to ensure successful data collection and processing. If
@@ -72,7 +72,7 @@ be installed and on your target servers.
During installation, Netwrix Auditor automatically creates inbound Windows Firewall rules for the
essential ports required for the product to function properly. If you use a third-party firewall,
-make sure to allow inbound connections to local ports on the target and outbound connections to
+Ensure to allow inbound connections to local ports on the target and outbound connections to
remote ports on the source.
Tip for reading the table: For example, on the computer where Netwrix Auditor client is installed
@@ -87,9 +87,9 @@ Server resides (target), allow inbound connections to local 135 TCP port.
| 9699 | TCP | Script / query host | Netwrix Auditor Server | Netwrix Auditor Integration API |
| Dynamic: 1024 -65535 | TCP | Computers where Netwrix Auditor Server and Netwrix Auditor client are installed | Netwrix Auditor Server | Netwrix Auditor internal components interaction. Allow C:\Program Files (x86)\Netwrix Auditor\Audit Core\NwCoreSvc.exe to use the port. |
| For Managed Service Providers: 443 | TCP | Netwrix Auditor Server | Netwrix Partner Portal | Reporting on active MSP licenses |
-| - 80 for http - 443 for https | TCP | SSRS | Netwrix Auditor Server | Reports If your environment is configured differently, we recommend that you check with your DBA or the SSRS settings through the Configuration Manage. |
+| - 80 for http - 443 for https | TCP | SSRS | Netwrix Auditor Server | Reports If your environment is configured differently, consult your DBA or check the SSRS settings through the Configuration Manager. |
-In most environments, the rules are created automatically and you do not need to open more ports to
+In most environments, the rules are created automatically and you don't need to open more ports to
ensure successful data collection.
In rare cases, for example if your security policies require you to provide a justification for
diff --git a/docs/auditor/10.7/requirements/software.md b/docs/auditor/10.7/requirements/software.md
index b06d960537..241da30fd0 100644
--- a/docs/auditor/10.7/requirements/software.md
+++ b/docs/auditor/10.7/requirements/software.md
@@ -25,7 +25,7 @@ Server, in the monitored environment, or in both locations.
| - AD FS | _On the computer where_ Auditor _Server_ _is installed:_ - Windows Remote Management must be configured to allow remote PowerShell usage. For that, set up the **TrustedHosts** list: - to include all AD FS servers, use the following cmdlet: `Set-Item wsman:\localhost\Client\TrustedHosts -value '*' -Force;` - to include specific AD FS servers (monitored items), do the following: 1. Use Get cmdlet to obtain the existing **TrustedHosts** list. 2. If necessary, add the IP addresses of required AD FS servers to existing list (use comma as a separator). 3. Provide the updated list to the cmdlet as a parameter. For example: `Set-Item wsman:\localhost\Client\TrustedHosts -value '172.28.57.240,172.28.57.127' -Force;` See the following Microsoft article [Installation and configuration for Windows Remote Management](https://docs.microsoft.com/en-us/windows/win32/winrm/installation-and-configuration-for-windows-remote-management) for additional information about TrustedHosts. |
| - Windows Server (with enabled network traffic compression) - User Activity | _In the monitored environment:_ - .NET Framework 4.8 and above. See the following Microsoft article for additional information about .Net Framework installer redistributable: [Microsoft .NET Framework 4.8 offline installer for Windows.](https://support.microsoft.com/en-us/topic/microsoft-net-framework-4-8-offline-installer-for-windows-9d23f658-3b97-68ab-d013-aa3c3e7495e0) |
| - Microsoft Entra ID Ports - SharePoint Online | Usually, there is no need in any additional components for data collection. |
-| - Oracle Database | Oracle Database 12c and above: _On the computer where_ Auditor _Server_ _is installed:_ - Oracle Instant Client. - Download the appropriate package from Oracle website: [Instant Client Packages](https://www.oracle.com/database/technologies/instant-client.html). Netwrix recommends installing the latest available version (Netwrix Auditor is compatible with version 12 and above). - Install, following the instructions, for example,[ Instant Client Installation for Microsoft Windows 64-bit](https://www.oracle.com/database/technologies/instant-client/winx64-64-downloads.html#instant-client-installation-for-microsoft-windows-64-bit). Check your Visual Studio Redistributable version. Applicable packages for each Oracle Database version with downloading links are listed in the installation instructions: [Instant Client Installation for Microsoft Windows 64-bit](https://www.oracle.com/database/technologies/instant-client/winx64-64-downloads.html#instant-client-installation-for-microsoft-windows-64-bit). Oracle Database 11g: Auditor provides limited support of Oracle Database 11g. See the [Considerations for Oracle Database 11g](/docs/auditor/10.7/configuration/oracle/overview.md#considerations-for-oracle-database-11g) topic for additional information. _On the computer where_ Auditor _Server_ _is installed:_ - [Microsoft Visual C++ 2010 Redistributable Package](https://www.microsoft.com/en-us/download/details.aspx?id=14632)—can be installed automatically during the monitoring plan creation. - Oracle Data Provider for .NET and Oracle Instant Client Netwrix recommends the following setup steps: 1. Download the [64-bit Oracle Data Access Components 12c Release 4 (12.1.0.2.4) for Windows x64 (ODAC121024_x64.zip)](http://www.oracle.com/technetwork/database/windows/downloads/index-090165.html) package. 2. Run the setup and select the Data Provider for .NET checkbox. Oracle Instant Client will be installed, too. 3. On the ODP.NET (Oracle Data Provider) step make sure the Configure ODP.NET and/or Oracle Providers for ASP.Net at machine-wide level checkbox is selected . |
+| - Oracle Database | Oracle Database 12c and above: _On the computer where_ Auditor _Server_ _is installed:_ - Oracle Instant Client. - Download the appropriate package from Oracle website: [Instant Client Packages](https://www.oracle.com/database/technologies/instant-client.html). Netwrix recommends installing the latest available version (Netwrix Auditor is compatible with version 12 and above). - Install, following the instructions, for example,[ Instant Client Installation for Microsoft Windows 64-bit](https://www.oracle.com/database/technologies/instant-client/winx64-64-downloads.html#instant-client-installation-for-microsoft-windows-64-bit). Check your Visual Studio Redistributable version. Applicable packages for each Oracle Database version with downloading links are listed in the installation instructions: [Instant Client Installation for Microsoft Windows 64-bit](https://www.oracle.com/database/technologies/instant-client/winx64-64-downloads.html#instant-client-installation-for-microsoft-windows-64-bit). Oracle Database 11g: Auditor provides limited support of Oracle Database 11g. See the [Considerations for Oracle Database 11g](/docs/auditor/10.7/configuration/oracle/overview.md#considerations-for-oracle-database-11g) topic for additional information. _On the computer where_ Auditor _Server_ _is installed:_ - [Microsoft Visual C++ 2010 Redistributable Package](https://www.microsoft.com/en-us/download/details.aspx?id=14632)—can be installed automatically during the monitoring plan creation. - Oracle Data Provider for .NET and Oracle Instant Client Netwrix recommends the following setup steps: 1. Download the [64-bit Oracle Data Access Components 12c Release 4 (12.1.0.2.4) for Windows x64 (ODAC121024_x64.zip)](http://www.oracle.com/technetwork/database/windows/downloads/index-090165.html) package. 2. Run the setup and select the Data Provider for .NET checkbox. Oracle Instant Client will be installed, too. 3. On the ODP.NET (Oracle Data Provider) step ensure the Configure ODP.NET and/or Oracle Providers for ASP.Net at machine-wide level checkbox is selected . |
| - Group Policy | _On the computer where_ Auditor _Server_ _is installed:_ - Group Policy Management Console. Download Remote Server Administration Tools that include GPMC for: - [Windows 8.1](http://www.microsoft.com/en-us/download/details.aspx?id=39296) - [Windows 10](https://www.microsoft.com/en-us/download/details.aspx?id=45520) - For Windows Server 2012 R2/2016, Group Policy Management is turned on as a Windows feature. |
## Using SSRS-based Reports
@@ -34,25 +34,26 @@ SQL Server Reporting Services are needed for this kind of reports. See the
[Requirements for SQL Server to Store Audit Data](/docs/auditor/10.7/requirements/sqlserver.md) topic for additional information. If
you plan to export or print such reports, check the requirements below.
-**NOTE:** Please note that if you are going to use SQL Express plan, do not install SSRS and Auditor
-on the domain controller.
+:::note
+If you are using SQL Express, don't install SSRS and Auditor on the domain controller.
+:::
Export SSRS-based reports
To export SSRS-based reports, it is recommended Internet Explorer is installed on the machine where
-Auditor client runs. If IE is not available, you can use the **Print** function or click the button
+Auditor client runs. If IE isn't available, you can use the **Print** function or click the button
**Open in browser** and export the report directly from Netwrix Auditor.
See the following Microsoft article for the full list of the supported browsers:
[Browser Support for Reporting Services and Power View](https://learn.microsoft.com/en-us/sql/reporting-services/browser-support-for-reporting-services-and-power-view?view=sql-server-ver16).
-Follow the steps to configure Internet Options to allow file downloads for the Local intranet zone.
+To configure Internet Options to allow file downloads for the Local intranet zone, complete the following steps:
**Step 1 –** Select **Internet Options** and click **Security**.
**Step 2 –** Select **Local intranet** zone and click **Custom level**.
-**Step 3 –** In the Settings list, locate **Downloads** > **File download** and make sure the
+**Step 3 –** In the Settings list, locate **Downloads** > **File download** and ensure the
**Enabled** option is selected.
Printing
@@ -90,10 +91,10 @@ information.
You can deploy Auditor on servers or workstations running supported Windows OS version. See system
requirements for details.
-Installation on the domain controller is not supported.
+Installation on the domain controller isn't supported.
If you plan to have the audited system and Auditor Server residing in the workgroups, consider that
-in such scenario the product cannot be installed on the machine running Windows 7.
+in such scenario the product can't be installed on the machine running Windows 7.
Domain trusts, however, may affect data collection from different data sources. To prevent this,
consider the recommendations and restrictions listed below.
@@ -112,10 +113,10 @@ Activity record stands for one operable chunk of information in Auditor workflow
### Simple Deployment
-This scenario can be used for PoC, evaluation, or testing purposes. It can be also suitable for
-small infrastructures, producing only several thousands of activity records per day. In this
-scenario, you only deploy Auditor Server and default client, selecting Full installation option
-during the product setup.
+Use this scenario for proof-of-concept (PoC), evaluation, or testing purposes. It's also suitable for
+small infrastructures that produce only several thousand activity records per day. In this
+scenario, you deploy Auditor Server and the default client by selecting the Full installation option
+during setup.
@@ -126,7 +127,7 @@ in the Auditor documentation.
In this scenario, multiple Auditor clients are installed on different machines.
-Follow the steps to perform distributed deployment.
+To perform distributed deployment, complete the following steps:
**Step 1 –** Install Auditor server and default client, selecting Full installation during the
product setup.
diff --git a/docs/auditor/10.7/requirements/sqlserver.md b/docs/auditor/10.7/requirements/sqlserver.md
index 41232c2268..5eca518059 100644
--- a/docs/auditor/10.7/requirements/sqlserver.md
+++ b/docs/auditor/10.7/requirements/sqlserver.md
@@ -13,17 +13,17 @@ generation, Reporting Services (or Advanced Services) are also required.
Supported SQL Server versions and editions are listed below.
Due to limited database size, Express Edition (with Reporting Services) is recommended only for
-evaluation, PoC or small environments. For production environment, consider using Standard or
+evaluation, PoC, or small environments. For production environments, use Standard or
Enterprise Edition.
| Version | Edition |
| ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SQl Server 2022 | - Standard or Enterprise Edition - [Express Edition](https://www.microsoft.com/en-us/download/details.aspx?id=104781) with [Reporting Services](https://www.microsoft.com/en-us/download/details.aspx?id=104502) (for evaluation, PoC and small environments) |
-| SQL Server 2019 (on-premises Windows version) cumulative update 10 and above | - Standard or Enterprise Edition - [Express Edition](https://go.microsoft.com/fwlink/?linkid=866658) with [Reporting Services](https://www.microsoft.com/en-us/download/details.aspx?id=100122) (for evaluation, PoC and small environments) |
-| SQL Server 2017 | - Standard or Enterprise Edition - [Express Edition](https://go.microsoft.com/fwlink/?linkid=866658) with [Reporting Services](https://www.microsoft.com/en-us/download/details.aspx?id=100122) (for evaluation, PoC and small environments) |
-| SQL Server 2016 | - Standard or Enterprise Edition - [Express Edition with Advanced Services (SP2)](https://www.microsoft.com/en-us/download/details.aspx?id=56840) (for evaluation, PoC and small environments) |
-| SQL Server 2014 | - Standard or Enterprise Edition - [Express Edition with Advanced Services](https://www.microsoft.com/en-us/download/details.aspx?id=42299) (for evaluation, PoC and small environments) |
-| SQL Server 2012 | - Standard or Enterprise Edition - [Express Edition with Advanced Services](http://www.microsoft.com/en-us/download/details.aspx?id=29062) (for evaluation, PoC and small environments) |
+| SQl Server 2022 | - Standard or Enterprise Edition - [Express Edition](https://www.microsoft.com/en-us/download/details.aspx?id=104781) with [Reporting Services](https://www.microsoft.com/en-us/download/details.aspx?id=104502) (for evaluation, PoC, and small environments) |
+| SQL Server 2019 (on-premises Windows version) cumulative update 10 and above | - Standard or Enterprise Edition - [Express Edition](https://go.microsoft.com/fwlink/?linkid=866658) with [Reporting Services](https://www.microsoft.com/en-us/download/details.aspx?id=100122) (for evaluation, PoC, and small environments) |
+| SQL Server 2017 | - Standard or Enterprise Edition - [Express Edition](https://go.microsoft.com/fwlink/?linkid=866658) with [Reporting Services](https://www.microsoft.com/en-us/download/details.aspx?id=100122) (for evaluation, PoC, and small environments) |
+| SQL Server 2016 | - Standard or Enterprise Edition - [Express Edition with Advanced Services (SP2)](https://www.microsoft.com/en-us/download/details.aspx?id=56840) (for evaluation, PoC, and small environments) |
+| SQL Server 2014 | - Standard or Enterprise Edition - [Express Edition with Advanced Services](https://www.microsoft.com/en-us/download/details.aspx?id=42299) (for evaluation, PoC, and small environments) |
+| SQL Server 2012 | - Standard or Enterprise Edition - [Express Edition with Advanced Services](http://www.microsoft.com/en-us/download/details.aspx?id=29062) (for evaluation, PoC, and small environments) |
**NOTE:** SQL express is only supported for small environments. It might cause performance issues on
the medium and large environments.
@@ -97,15 +97,15 @@ These databases are intended for storing various data, as listed below.
| **`Netwrix_OverviewReportsDB`** | Stores data required for overview reports. |
| **`Netwrix_Self_Audit`** | Stores data collected by Netwrix Auditor self-audit (optional, created if the corresponding feature is enabled). |
-These databases usually do not appear in the UI; they are only listed in the **Database statistics**
+These databases usually don't appear in the UI; they are only listed in the **Database statistics**
widget of the **Health Status** dashboard. If you need their settings to be modified via SQL Server
-Management Studio, please contact your database administrator. For example, you may need to change
+Management Studio, contact your database administrator. For example, you may need to change
logging and recovery model (by default, it is set to **simple** for all these databases, as well as
for the Audit databases).
## Install Microsoft SQL Server and Reporting Services
-Netwrix Auditor uses Microsoft SQL Server database as short-term data storage and utilizes SQL
+Netwrix Auditor uses Microsoft SQL Server database as short-term data storage and uses SQL
Server Reporting Services engine for report generation. You can either use your existing SQL Server
for these purposes, or deploy a new server instance. System requirements for SQL Server are listed
in the corresponding section of this guide.
@@ -113,11 +113,10 @@ in the corresponding section of this guide.
Consider the following:
- Supported versions are 2012 and later.
-- **NOTE:** Please, note that for the Reporting Services, only English operating systems are
- supported.
-- Supported editions are Enterprise, Standard and Express with Advanced Services (it includes
+- For Reporting Services, only English operating systems are supported.
+- Supported editions are Enterprise, Standard, and Express with Advanced Services (it includes
Reporting Services).
-- If downloading SQL Server Express Edition with Advanced Services from Microsoft site, make sure
+- If downloading SQL Server Express Edition with Advanced Services from Microsoft site, ensure
you download the file whose name contains SQLEXPRADV. Otherwise, Reporting Services will not be
deployed, and you will not be able to analyze and report on collected data.
@@ -139,7 +138,7 @@ When planning for SQL Server that will host Auditor databases, consider the foll
Netwrix Auditor Server will be installed, or on the remote machine accessible by Netwrix Auditor.
Remember to check connection settings and access rights.
- In large and extra-large infrastructures SQL Server should be installed on a separate server or
- cluster. Installation of Netwrix Auditor and SQL Server on the same server is not recommended in
+ cluster. Installation of Netwrix Auditor and SQL Server on the same server isn't recommended in
such environments.
- If you plan to have Netwrix Auditor and SQL Server running on different machines, establish fast
and reliable connection between them (100 Mbps or higher).
@@ -150,9 +149,9 @@ When planning for SQL Server that will host Auditor databases, consider the foll
wizard or manually downloading it from Microsoft web site (see Install Microsoft SQL Server and
Reporting Services).
-**CAUTION:** It is not recommended to install Netwrix Auditor databases to a production SQL Server
+**CAUTION:** It isn't recommended to install Netwrix Auditor databases to a production SQL Server
instance. Such instances may have a lot of maintenance plans or scripts running that may affect data
-uploaded by the product. The product databases are designed for reporting and searching and do not
+uploaded by the product. The product databases are designed for reporting and searching and don't
require maintenance or backup. For the long-term data storage, Netwrix Auditor uses Long-Term
Archive. See [File-Based Repository for Long-Term Archive](/docs/auditor/10.7/requirements/longtermarchive.md) for additional
information.
@@ -163,8 +162,8 @@ of local Administrators group) will be assigned the _sysadmin_ server role for i
You will also need to provide a path for storing the SQL Server databases - it is recommended to
specify the data drive for that purpose (by default, system drive is used).
-- If you plan to have more than one Netwrix Auditor Servers in your network, make sure to configure
- them to use different SQL Server instances. The same SQL Server instance cannot be used to store
+- If you plan to have more than one Netwrix Auditor Servers in your network, ensure to configure
+ them to use different SQL Server instances. The same SQL Server instance can't be used to store
audit data collected by several Netwrix Auditor Servers.
- Consider that sufficient access rights will be required for the account that will write data to
the audit databases hosted on the default SQL Server. This account should be assigned the
@@ -185,8 +184,7 @@ For database sizing, it is recommended to estimate:
- Retention policy for the audit databases
- Maximum database size supported by different SQL Server versions
-To estimate the number of the activity records produced by your data sources, collected and saved by
-Auditor during the week, you can use the Activity records by date widget of the Health Status
+To estimate the number of activity records your data sources produce and Auditor collects and saves during the week, you can use the Activity records by date widget of the Health Status
dashboard. See the
[Activity Records Statistics](/docs/auditor/10.7/admin/healthstatus/dashboard/activityrecordstatistics.md) topic for
additional information.
@@ -205,7 +203,7 @@ performance:
- Each instance uses only up to 1 GB of RAM
- Each instance uses only up to 4 cores of the first CPU
-- Database size cannot exceed 10 GB
+- Database size can't exceed 10 GB
## Database Settings
@@ -225,7 +223,7 @@ If not yet existing on the specified SQL server instance, the database will be c
this operation to succeed, ensure that Netwrix Auditor service account has sufficient rights on that
SQL Server.
-Settings of other Auditor databases cannot be modified.
+Settings of other Auditor databases can't be modified.
### Example
@@ -239,16 +237,16 @@ so, you can create 2 monitoring plans:
### Database Retention
-Consider that retention is a global setting, that is, it applies to all Audit databases you
+Consider that retention is a global setting that applies to all Audit databases you
configure for your monitoring plans.
-Follow the steps to change database retention after the product deployment.
+To change database retention after product deployment, complete the following steps:
**Step 1 –** In the Auditor main screen, select Settings > Audit Database.
-**Step 2 –** In the dialog displayed, make sure the Clear stale data when a database retention
+**Step 2 –** In the dialog displayed, ensure the Clear stale data when a database retention
period is exceeded: is set to ON, then click Modify to specify the required retention period (in
days).
@@ -259,13 +257,13 @@ This setting also applies to the `Netwrix_Auditor_API` database.
This is the account that Auditor uses to write the collected audit data to the audit databases.
Starting with version 9.96, you can use Group Managed Service Account (gMSA) for that purpose.
-_Remember,_ gMSA cannot be used to access SSRS. Use a standard account for that. See the
+_Remember,_ gMSA can't be used to access SSRS. Use a standard account for that. See the
[SQL Server Reporting Services](/docs/auditor/10.7/requirements/sqlserverreportingservice.md) topic for additional information.
This account must be granted the **Database owner (`db_owner`)** role and the **dbcreator** server
role on the SQL Server instance hosting your audit databases.
-Follow the steps to assign the **dbcreator** and **`db_owner`** roles.
+To assign the **dbcreator** and **`db_owner`** roles, complete the following steps:
**Step 3 –** On the computer where SQL Server instance with the Audit Database resides, navigate to
**Start** > **All Programs** > **Microsoft SQL Server** > **SQL Server Management Studio**.
diff --git a/docs/auditor/10.7/requirements/sqlserverreportingservice.md b/docs/auditor/10.7/requirements/sqlserverreportingservice.md
index a0cd1f9838..fd21e474d6 100644
--- a/docs/auditor/10.7/requirements/sqlserverreportingservice.md
+++ b/docs/auditor/10.7/requirements/sqlserverreportingservice.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# SQL Server Reporting Services
-Netwrix Auditor utilizes SQL Server Reporting Services (SSRS) engine for report generation.
+Netwrix Auditor uses SQL Server Reporting Services (SSRS) engine for report generation.
If you want to generate reports and run search queries against data collected by Netwrix Auditor,
you should configure SQL Server Reporting Services (2012 R2 and above required).
@@ -14,14 +14,14 @@ you should configure SQL Server Reporting Services (2012 R2 and above required).
Consider the following:
- SQL Server and SQL Server Reporting Services can be deployed on the separate machines only in
- commercial edition. SQL Server Express Edition with Advanced Services does not support such
+ commercial edition. SQL Server Express Edition with Advanced Services doesn't support such
deployment scenario.
**NOTE:** It is recommended to use HTTPS instead of HTTP. HTTPS connection should also be configured
for Reporting Service.
-If you plan, however, not to use Netwrix Auditor built-in intelligence (search, alerts or reports)
-but only to receive e-mail notifications on audit data collection results, you may not need to
+If you plan not to use Netwrix Auditor's built-in intelligence (search, alerts, or reports)
+and only receive e-mail notifications on audit data collection results, you may not need to
configure SSRS or audit database settings.
## Configure SSRS Account
@@ -29,9 +29,9 @@ configure SSRS or audit database settings.
An account used to upload data to the SQL Server Reporting Services (SSRS) Server must be granted
the Content Manager role on the SSRS **Home** folder.
-**NOTE:** gMSA cannot be used to access SSRS. Use a standard account for that purpose.
+**NOTE:** gMSA can't be used to access SSRS. Use a standard account for that purpose.
-Follow the steps to assign the Content Manager role.
+To assign the Content Manager role, complete the following steps:
**Step 1 –** Navigate to your **Report Manager** URL.
@@ -50,7 +50,7 @@ Reviewer role must be granted the Browser role on the Report Server. Netwrix Aud
role automatically when adding a user. If for some reason the product was unable to grant the role,
do it manually.
-Follow the steps to assign the Browser role to a user.
+To assign the Browser role to a user, complete the following steps:
**Step 1 –** Open the **Report Manager** URL in your web browser.
@@ -71,16 +71,16 @@ Reporting Services is properly configured, perform the following procedure:
You must be logged in as a member of the local Administrators group on the computer where SQL Server
2016 Express is installed.
-Follow the steps to verify Reporting Services installation.
+To verify Reporting Services installation, complete the following steps:
**Step 6 –** Navigate to **Start >\_\_**All Apps > SQL Server\_**\_Reporting Services Configuration
Manager**.
-**Step 7 –** In the Reporting Services Configuration Connection dialog, make sure that your local
+**Step 7 –** In the Reporting Services Configuration Connection dialog, ensure that your local
report server instance (for example, _SQLExpress_) is selected, and click **Connect**.
**Step 8 –** In the **Reporting Services Configuration Manager** left pane, select **Web Service
-URL**. Make sure that:
+URL**. Ensure that:
- **Virtual Directory** is set to _ReportServer_``_ (e.g.,
\_ReportServer_SQLEXPRESS_ for _SQLEXPRESS_ instance)
@@ -91,4 +91,4 @@ sure that the SQL Server Name and Database Name fields contain correct values. I
**Change Database** and complete the Report Server Database Configuration wizard.
**Step 10 –** In the Reporting Services Configuration Manager left pane, select **Report Manager
-URL**. Make sure **Virtual Directory** is set correctly, and that the URL is valid.
+URL**. Ensure **Virtual Directory** is set correctly, and that the URL is valid.
diff --git a/docs/auditor/10.7/requirements/supporteddatasources/monitoredobjecttypes.md b/docs/auditor/10.7/requirements/supporteddatasources/monitoredobjecttypes.md
index cef1ac3231..90184130ad 100644
--- a/docs/auditor/10.7/requirements/supporteddatasources/monitoredobjecttypes.md
+++ b/docs/auditor/10.7/requirements/supporteddatasources/monitoredobjecttypes.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Monitored Object Types, Actions, and Attributes
-Netwrix Auditor monitored object types, actions, attributes and components for each data source are
+Netwrix Auditor monitored object types, actions, attributes, and components for each data source are
located in the following topics:
- [Active Directory](/docs/auditor/10.7/configuration/activedirectory/overview.md)
@@ -42,7 +42,7 @@ located in the following topics:
Review the list of actions audited and reported by Netwrix Auditor. Actions vary depending on the
data source and the object type.
-| Action | Active Directory | Active Directory Federation Services | Exchange Exchange Online | File Servers | Group Policy | Logon Activity | Microsoft Entra ID (formerly Azure AD) | Oracle database | SharePoint SharePoint Online | SQL Server | User Activity | VMware Servers | Windows Server |
+| Action | Active Directory | Active Directory Federation Services | Exchange/Exchange Online | File Servers | Group Policy | Logon Activity | Microsoft Entra ID (formerly Azure AD) | Oracle database | SharePoint/SharePoint Online | SQL Server | User Activity | VMware Servers | Windows Server |
| ----------------------------------------- | ---------------- | ------------------------------------ | ------------------------ | ------------ | ------------ | -------------- | -------------------------------------- | --------------- | ---------------------------- | ---------- | ------------- | -------------- | -------------- |
| Added | + | - | +\* | + | + | – | + | + | + | + | – | + | + |
| Removed | + | - | +\* | + | + | – | + | + | + | + | – | + | + |
diff --git a/docs/auditor/10.7/requirements/supporteddatasources/supporteddatasources.md b/docs/auditor/10.7/requirements/supporteddatasources/supporteddatasources.md
index e05ddb9c92..d79b598e33 100644
--- a/docs/auditor/10.7/requirements/supporteddatasources/supporteddatasources.md
+++ b/docs/auditor/10.7/requirements/supporteddatasources/supporteddatasources.md
@@ -74,7 +74,7 @@ Auditor supports monitoring the following device versions:
**NOTE:** Only CIFS configuration is supported.
-Auditing of _System_ zone is not supported. As stated by Dell, this zone should be reserved for
+Auditing of _System_ zone isn't supported. As stated by Dell, this zone should be reserved for
configuration access only. Current data should be stored in other access zones. See the
[Isilon OneFS 8.2.1 CLI Administration Guide](https://www.dellemc.com/en-us/collaterals/unauth/technical-guides-support-information/2019/09/docu95372.pdf)
for additional information.
@@ -180,7 +180,7 @@ Auditor supports monitoring the following versions:
- Exchange Online version provided within Microsoft Office 365
- Microsoft GCC (government community cloud) and GCC High
- **NOTE:** DoD tenant types are not supported.
+ **NOTE:** DoD tenant types aren't supported.
See the [Exchange Online](/docs/auditor/10.7/configuration/microsoft365/exchangeonline/overview.md) topic for
additional information.
@@ -192,7 +192,7 @@ Auditor supports monitoring the following versions:
- Microsoft Entra ID version provided within Microsoft Office 365
- Microsoft GCC (government community cloud) and GCC High
- **NOTE:** DoD tenant types are not supported.
+ **NOTE:** DoD tenant types aren't supported.
See the
[Microsoft Entra ID (formerly Azure AD)](/docs/auditor/10.7/configuration/microsoft365/microsoftentraid/overview.md)
@@ -205,7 +205,7 @@ Auditor supports monitoring the following versions:
- Microsoft Entra ID version provided within Microsoft Office 365
- Microsoft GCC (government community cloud) and GCC High
- **NOTE:** DoD tenant types are not supported.
+ **NOTE:** DoD tenant types aren't supported.
See the [MS Teams](/docs/auditor/10.7/configuration/microsoft365/teams/overview.md) topic for additional
information.
@@ -217,7 +217,7 @@ Auditor supports monitoring the following versions:
- SharePoint Online version provided within Microsoft Office 365
- Microsoft GCC (government community cloud) and GCC High
- **NOTE:** DoD tenant types are not supported.
+ **NOTE:** DoD tenant types aren't supported.
See the [SharePoint Online](/docs/auditor/10.7/configuration/microsoft365/sharepointonline/overview.md) topic for
additional information.
@@ -356,7 +356,7 @@ Auditor supports monitoring the following versions:
- Microsoft SQL Server 2014
- Microsoft SQL Server 2012
-**NOTE:** Linux-based versions are not supported.
+**NOTE:** Linux-based versions aren't supported.
See the [SQL Server](/docs/auditor/10.7/configuration/sqlserver/overview.md) topic for additional information.
@@ -433,7 +433,7 @@ Auditor supports monitoring the following operating system versions:
- Windows Server 2012
**NOTE:** DNS support is limited on Windows Server 2008 to Windows Server 2008 SP2 (32 and 64-bit).
-DHCP is not supported on Windows Server 2008.
+DHCP isn't supported on Windows Server 2008.
Internet Information Services (IIS)
diff --git a/docs/auditor/10.7/requirements/workingfolder.md b/docs/auditor/10.7/requirements/workingfolder.md
index 25247ced0c..d11bda867c 100644
--- a/docs/auditor/10.7/requirements/workingfolder.md
+++ b/docs/auditor/10.7/requirements/workingfolder.md
@@ -9,7 +9,7 @@ sidebar_position: 70
The working folder is a file-based storage that also keeps operational information (configuration
files of the product components, log files, and other data). To ensure audit trail continuity,
Netwrix Auditor also caches some audit data locally in its working folder for a short period (up to
-30 days) prior to storing it to the Long-Term Archive or audit database.
+30 days) before storing it to the Long-Term Archive or audit database.
By default, the working folder is located at _%ProgramData%\Netwrix Auditor_.
diff --git a/docs/auditor/10.7/tools/auditconfigurationassistant.md b/docs/auditor/10.7/tools/auditconfigurationassistant.md
index 7e26d90730..014e8b5a66 100644
--- a/docs/auditor/10.7/tools/auditconfigurationassistant.md
+++ b/docs/auditor/10.7/tools/auditconfigurationassistant.md
@@ -25,7 +25,7 @@ Auditor\*\*\*\*>**\*\*Netwrix Auditor Audit Configuration Assistant**. Alternati
this utility from the monitoring plan wizard for Active Directory data source. See the Launch Audit
Configuration Assistant section for additional information.
-Currently, the utility supports Active Directory and Logon Activity data sources.
+the utility supports Active Directory and Logon Activity data sources.
## Prerequisites
@@ -61,7 +61,7 @@ Select **Netwrix Auditor**→**Netwrix Auditor Audit Configuration Assistant**.
- If the utility is installed on the same machine as Netwrix Auditor server, you will be taken to
the **Welcome** step.
- If the utility is installed on the remote machine together with Netwrix Auditor client, the
- initial window will allow you to enter the settings to connect to Netwrix Auditor Server. Specify
+ initial window lets you enter the settings to connect to Netwrix Auditor Server. Specify
the following:
| Setting | Description |
@@ -83,7 +83,7 @@ Alternatively, you can launch this utility by clicking the corresponding link:
## Start Assessment
-Follow the steps to start assessment.
+To start the assessment, complete the following steps:
**Step 1 –** Specify the monitoring scope —select what you plan to monitor with Netwrix Auditor. You
can select both **Active Directory** and **Logon Activity**, or any of them.
@@ -112,7 +112,7 @@ At this step, you will be presented the results of the environment readiness ass
-Follow the steps to view results.
+To view results, complete the following steps:
**Step 1 –** Examine the report.
@@ -133,7 +133,7 @@ audit settings. Operation progress will be reported in the bottom of the window.
**Step 1 –** Wait for the process to complete.
**Step 2 –** Review the results. Successfully applied settings will be reported with a green tick;
-those that did not manage to apply will be with the yellow warning sign and explanatory text.
+those that didn't manage to apply will be with the yellow warning sign and explanatory text.
**Step 3 –** You can click **Start over** to get to the Start Assessment, fix the issues and perform
the procedure again, or click **Finish**.
diff --git a/docs/auditor/10.7/tools/eventlogmanager/eventlog.md b/docs/auditor/10.7/tools/eventlogmanager/eventlog.md
index b7dfeb9bef..1a5daf9ba8 100644
--- a/docs/auditor/10.7/tools/eventlogmanager/eventlog.md
+++ b/docs/auditor/10.7/tools/eventlogmanager/eventlog.md
@@ -9,7 +9,7 @@ sidebar_position: 20
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Event Log
monitoring scope.
-Follow the steps to exclude data from the Event Log monitoring scope:
+To exclude data from the Event Log monitoring scope, complete the following steps:
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Event Log Management_ folder.
diff --git a/docs/auditor/10.7/tools/eventlogmanager/eventlogmanager.md b/docs/auditor/10.7/tools/eventlogmanager/eventlogmanager.md
index 443a538d9f..4effd22d52 100644
--- a/docs/auditor/10.7/tools/eventlogmanager/eventlogmanager.md
+++ b/docs/auditor/10.7/tools/eventlogmanager/eventlogmanager.md
@@ -14,7 +14,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -46,7 +46,7 @@ Review the following for additional information:
## Create Monitoring Plans for Event Logs
-Follow the steps to configure monitoring plan for event logs.
+To configure a monitoring plan for event logs, complete the following steps:
**Step 1 –** Navigate to **Start** **>** Netwrix Auditor **>** Netwrix Auditor**Event Log
Manager\_\_**.\_\_
@@ -65,8 +65,8 @@ new plan.
| Option | Description |
| ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
- | Computer name | Allows specifying a single computer by entering its FQDN, NETBIOS or IP address. You can click Browse to select a computer from the list of computers in your network. |
- | Active Directory container | Allows specifying a whole AD container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be monitored within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify domains, OUs, and containers you do not want to audit. The list of containers does not include child domains of trusted domains. Use other options **(Computer name, IP address range**, or **Import computer names from a file**) to specify the target computers. |
+ | Computer name | Allows specifying a single computer by entering its FQDN, NETBIOS, or IP address. You can click Browse to select a computer from the list of computers in your network. |
+ | Active Directory container | Allows specifying a whole AD container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be monitored within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify domains, OUs, and containers you don't want to audit. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer name, IP address range**, or **Import computer names from a file**) to specify the target computers. |
| IP address range / Computers within an IP range | Allows specifying an IP range for the audited computers. To exclude computers from within the specified range, click **Exclude**. Enter the IP range you want to exclude, and click **Add**. |
**Step 4 –** You can specify multiple computer names by importing a list from a .txt file (one
@@ -93,12 +93,12 @@ whether to import the list once, or to update it on every data collection.
| Password | Enter a password for SMTP authentication. |
| Use Secure Sockets Layer encrypted connection (SSL) | Select this checkbox if your SMTP server requires SSL to be enabled. |
| Use implicit SSL | Select this checkbox if the implicit SSL mode is used, which means that an SSL connection is established before any meaningful data is sent. |
-| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option is not available for auditing User Activity as well Netwrix Auditor tools. |
+| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option isn't available for auditing User Activity as well Netwrix Auditor tools. |
**Step 7 –** Navigate to the Audit Database tab to configure Audit Database and review SQL Server
settings. Netwrix Auditor Event Log Manager synchronizes Audit Database and reports settings with
the default Audit Database configuration from Netwrix Auditor Server. If this option is disabled,
-contact your Netwrix Auditor Global administrator and make sure that these settings are properly
+contact your Netwrix Auditor Global administrator and ensure that these settings are properly
configured in Netwrix Auditor Server. Refer to [Audit Database](/docs/auditor/10.7/admin/settings/auditdatabase.md)
for detailed instructions on how to configure the Audit Database settings.
@@ -106,11 +106,11 @@ for detailed instructions on how to configure the Audit Database settings.
| Option | Description |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Write data to Audit Database and enable reports | Select if you want to generate reports. Even if you do not select this checkbox now, you will still be able to configure these settings later, but already collected audit data will not be imported in the Audit Database. |
+| Write data to Audit Database and enable reports | Select if you want to generate reports. Even if you don't select this checkbox now, you will still be able to configure these settings later, but already collected audit data will not be imported in the Audit Database. |
| Write event descriptions to Audit Database | Select if you want to see the exact error or warning text. |
| Store events for... days | Specify the Audit Database retention period. This setting affects all monitoring plans. The minimum value specified across the plans will be applied. When configuring, mind that your data will be deleted automatically when its retention period is over. |
-**NOTE:** You cannot edit SQL Server settings for Netwrix Auditor Event Log Manager.
+**NOTE:** You can't edit SQL Server settings for Netwrix Auditor Event Log Manager.
**Step 9 –** Navigate to the Advanced tab and configure the following:
@@ -136,16 +136,16 @@ existing filters, and create new filters. To do it, click Configure next to Audi
The product allows creating inclusive and exclusive audit archiving filters.
-Follow the steps to configure audit archiving filters.
+To configure audit archiving filters, complete the following steps:
**Step 1 –** To create or modify an audit archiving filter, see Create Monitoring Plans for Event
Logs.
**Step 2 –** To collect events required to generate a specific report, you must select a filter
-which name coincides with this report’s name. Click Enable and select Filters for Reports. All
+whose name coincides with this report’s name. Click Enable and select Filters for Reports. All
filters required to store events for all available reports will be selected automatically.
-Follow the steps to create or edit an audit archiving filter.
+To create or edit an audit archiving filter, complete the following steps:
**Step 1 –** On the Audit archiving filters page, click Add or select a filter and click Edit.
@@ -156,11 +156,11 @@ Follow the steps to create or edit an audit archiving filter.
| The Event tab | |
| Name | Specify the filter name. |
| Description | Enter the description for this filter (optional). |
-| Event Log | Select an event log from the drop-down list. You will be alerted on events from this event log. You can also input a different event log. To find out a log’s name, navigate to Start > Windows Administrative Tools→ Event Viewer → Applications and Services Logs → Microsoft → Windows and expand the required `` node, right-click the file under it and select Properties. Find the event log’s name in the Full Name field. Netwrix Auditor Event Log Manager does not collect the Analytic and Debug logs, so you cannot configure alerts for these logs. You can use a wildcard (`*`). For inclusive filters: all Windows logs except for the ones mentioned above will be saved. For exclusive: all Windows logs events will be excluded. |
+| Event Log | Select an event log from the dropdown list. You will be alerted on events from this event log. You can also input a different event log. To find out a log’s name, navigate to Start > Windows Administrative Tools→ Event Viewer → Applications and Services Logs → Microsoft → Windows and expand the required `` node, right-click the file under it and select Properties. Find the event log’s name in the Full Name field. Netwrix Auditor Event Log Manager doesn't collect the Analytic and Debug logs, so you can't configure alerts for these logs. You can use a wildcard (`*`). For inclusive filters: all Windows logs except for the ones mentioned above will be saved. For exclusive: all Windows logs events will be excluded. |
| Write to/Don't write to | Select the location to write/not to write events to, depending on the filter type (inclusive or exclusive). It is recommended to write events both to the Long-Term Archive and to the Audit Database, because if your database is corrupted, you will be able to import the necessary data from the Long-Term Archive using the DB Importer tool. See Import Audit Data with the Database Importer for more information. |
| The Event Fields tab | |
| Event ID | Enter the identifier of a specific event that you want to be save. You can add several IDs separated by comma. |
-| Event Level | Select the event types that you want to be save. If the Event Level check box is cleared, all event types will be saved. If you want to select the inclusive Success Audit/Failure Audit filters, note that on these platforms these events belong to the “Information” level, so they will not be collected if you select the Information checkbox in the Exclusive Filters. |
+| Event Level | Select the event types that you want to be save. If the Event Level checkbox is cleared, all event types will be saved. For inclusive Success Audit/Failure Audit filters on these platforms, these events belong to the “Information” level. They will not be collected if you select the Information checkbox in the Exclusive Filters. |
| Computer | Specify a computer (as it is displayed in the Computer field in the event properties). Only events from this computer will be saved. If you want to specify several computers, you can define a case-sensitive mask for this parameter. Below is an example of a mask: - `*` - any machine - computer – a machine named ‘computer’ - `*`computer`*` - machines with names like ‘xXxcomputerxXx’ or ‘newcomputer’ - computer? – machines with names like ‘computer1’ or ‘computerV’ - co?puter - machines with names like ‘computer’ or ‘coXputer’ - ????? – any machine with a 5-character name - ???`*` - any machine with a 3-character name or longer |
| User | Enter a user’s name. Only events created by this user will be saved. If you need to specify several users, you can define a mask for this parameter in the same way as described above. |
| Source | Specify this parameter if you want to save events from a specific source. Input the event source as it is displayed in the Source field in the event properties. If you need to specify several sources, you can define a mask for this parameter in the same way as described above. |
@@ -175,21 +175,21 @@ health events, you need to create a dedicated monitoring plan for this log with
Event Log Manager standalone tool.
You can also review and filter Netwrix Auditor health events right in the product. See
-[Netwrix Auditor Health Log](/docs/auditor/10.7/admin/healthstatus/dashboard/healthlog.md) for addditional
-information
+[Netwrix Auditor Health Log](/docs/auditor/10.7/admin/healthstatus/dashboard/healthlog.md) for additional
+information.
-Follow the steps to configure the Netwrix Auditor System Health log monitoring.
+To configure the Netwrix Auditor System Health log monitoring, complete the following steps:
**Step 1 –** Start Netwrix Auditor Event Log Manager and create the new monitoring plan.
-**Step 2 –** Make sure that the Enable event log collection checkbox is selected. Specify the name
+**Step 2 –** ensure that the Enable event log collection checkbox is selected. Specify the name
for the new monitoring plan, for example, _"\_Netwrix Auditor \_Health Status"_.
**Step 3 –** Navigate to the Monitored computers list and add a server where the Netwrix Auditor
Server resides.
**Step 4 –** Navigate to the Audit Database tab and select Write event descriptions to Audit
-Database if you want to see the exact error or warning text. Make sure that Audit Database settings
+Database if you want to see the exact error or warning text. Ensure that Audit Database settings
are configured properly, follow the [Audit Database](/docs/auditor/10.7/admin/settings/auditdatabase.md)
**Step 5 –** Click Configure next to Audit archiving filters and select the Netwrix Auditor System
@@ -201,7 +201,7 @@ used to collect data on Netwrix Auditor health status events.
## Review Past Event Log Entries
Netwrix Auditor Event Log Manager collects event log entries and stores them to the Audit Archive.
-Follow the steps to review past events.
+To review past events, complete the following steps:
**Step 1 –** On the main Netwrix Auditor Event Log Manager page, click View next to View collected
events.
@@ -217,7 +217,7 @@ events.
## Import Audit Data with the Database Importer
-Follow the steps to Import Audit Data with the Database Importer.
+To import audit data with the Database Importer, complete the following steps:
**Step 1 –** On the main Netwrix Auditor Event Log Manager page, click Import Data.
diff --git a/docs/auditor/10.7/tools/eventlogmanager/windowseventlogs.md b/docs/auditor/10.7/tools/eventlogmanager/windowseventlogs.md
index 4a9a06d9d3..8dc2182931 100644
--- a/docs/auditor/10.7/tools/eventlogmanager/windowseventlogs.md
+++ b/docs/auditor/10.7/tools/eventlogmanager/windowseventlogs.md
@@ -8,7 +8,7 @@ sidebar_position: 10
The Remote Registry service must be enabled on the target computers.
-Follow the steps to enable the Remote Registry service.
+To enable the Remote Registry service, complete the following steps:
**Step 1 –** Navigate to Start > Windows Administrative Tools > Services.
@@ -17,7 +17,7 @@ Follow the steps to enable the Remote Registry service.
**Step 2 –** In the Services window, locate the Remote Registry service, right-click it and select
**Properties**.
-**Step 3 –** In the Remote Registry Properties dialog box, make sure the Startup type parameter is
+**Step 3 –** In the Remote Registry Properties dialog box, ensure the Startup type parameter is
set to _Automatic_ and click **Start**.
diff --git a/docs/auditor/10.7/tools/inactiveusertracker.md b/docs/auditor/10.7/tools/inactiveusertracker.md
index a118716279..50166a61ce 100644
--- a/docs/auditor/10.7/tools/inactiveusertracker.md
+++ b/docs/auditor/10.7/tools/inactiveusertracker.md
@@ -12,7 +12,7 @@ performs the following tasks:
- Checks the managed domain or specific organizational units by inquiring all domain controllers,
and sends reports to managers and system administrators listing all accounts that have been
inactive for the specified number of days.
-- Automatically deactivates inactive accounts by settings a random password, disabling, deleting or
+- Automatically deactivates inactive accounts by setting a random password, disabling, deleting, or
moving them to a specified organizational unit.
**NOTE:** The password that is generated will contain uppercase and lowercase letters, numbers
@@ -29,7 +29,7 @@ performs the following tasks:
## Create Monitoring Plan to Audit Inactive Users
-Follow the steps to create a monitoring plan to audit inactive users.
+To create a monitoring plan to audit inactive users, complete the following steps:
**Step 1 –** Navigate to Start > Netwrix Auditor > Netwrix Auditor Inactive Users Tracker.
@@ -90,7 +90,7 @@ The following variables can be used in the Inactive User Tracker message templat
| Option | Description |
| --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Use Netwrix Auditor notification settings | Select this option if you want to use modern authentication. Please note that modern authentication must already be configured in the monitoring plan you are going to use. If you select this option, the fields below are not needed. |
+| Use Netwrix Auditor notification settings | Select this option if you want to use modern authentication. Modern authentication must already be configured in the monitoring plan you are going to use. If you select this option, the fields below aren't needed. |
| SMTP server | Enter your SMTP server address. It can be your company's Exchange server or any public mail server (e.g., Gmail, Yahoo). |
| Port number | Specify your SMTP server port number. |
| Sender address | Enter the address that will appear in the From field. **_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. |
@@ -99,14 +99,14 @@ The following variables can be used in the Inactive User Tracker message templat
| Password | Enter a password for SMTP authentication. |
| Use Secure Sockets Layer encrypted connection (SSL) | Select this checkbox if your SMTP server requires SSL to be enabled. |
| Use implicit SSL | Select this checkbox if the implicit SSL mode is used, which means that an SSL connection is established before any meaningful data is sent. |
-| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option is not available for auditing User Activity as well Netwrix Auditor tools. |
-| Display the following From address in email notifications | Enter the address that will appear in the "_From_" field in email notifications. This option does not affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, make sure that your Exchange supports this option. |
+| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option isn't available for auditing User Activity as well Netwrix Auditor tools. |
+| Display the following From address in email notifications | Enter the address that will appear in the "_From_" field in email notifications. This option doesn't affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, ensure that your Exchange supports this option. |
Review your configuration and click Save.
## Review Report on Inactive Users
-Follow the steps to review report on inactive users.
+To review the report on inactive users, complete the following steps:
**Step 1 –** Click Generate next to Generate report on inactive users to view report immediately.
@@ -129,7 +129,7 @@ your Active Directory domain with Netwrix Auditor. Navigate to Start > Run and t
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Inactive User
monitoring scope.
-Follow the steps to exclude data from the Inactive Users monitoring scope:
+To exclude data from the Inactive Users monitoring scope, complete the following steps:
**Step 1 –** Navigate to the `%PROGRAMDATA%\Netwrix Auditor\Inactive Users Tracker` folder.
@@ -144,5 +144,5 @@ Follow the steps to exclude data from the Inactive Users monitoring scope:
| File | Description | Syntax |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| filter.txt | Contains a list of accounts to be excluded from processing. | `Username` |
-| omitdclist.txt | Contains a list of domain controllers to be excluded from processing. Auditor skips all automated deactivation actions for inactive accounts (disable, move, delete) even if one domain controller is unavailable during scheduled task execution. Add the unavailable domain controllers to this file to ensure Auditor functions properly. | `Full DNS name` or `NetBIOS name` IP addresses are not supported. |
+| omitdclist.txt | Contains a list of domain controllers to be excluded from processing. Auditor skips all automated deactivation actions for inactive accounts (disable, move, delete) even if one domain controller is unavailable during scheduled task execution. Add the unavailable domain controllers to this file to ensure Auditor functions properly. | `Full DNS name` or `NetBIOS name` IP addresses aren't supported. |
| omitoulist.txt | Contains a list of organizational units to be excluded from processing. | `Path` `*OU=OUNAME*` For example: If the OU is "sampledomain.sample/sampling", the syntax should be: `*OU=sampling*` |
diff --git a/docs/auditor/10.7/tools/objectrestoread.md b/docs/auditor/10.7/tools/objectrestoread.md
index 2f7e6baf87..09fc482eba 100644
--- a/docs/auditor/10.7/tools/objectrestoread.md
+++ b/docs/auditor/10.7/tools/objectrestoread.md
@@ -35,15 +35,15 @@ their passwords preserved, you must modify the Schema container settings so that
are retained when accounts are being deleted.
To perform this procedure, you will need the
-[ADSI Edit](http://technet.microsoft.com/en-us/library/cc773354(v=ws.10).aspx) utility.utility.
+[ADSI Edit](http://technet.microsoft.com/en-us/library/cc773354(v=ws.10).aspx) utility.
-Follow the steps to modify schema container settings.
+To modify schema container settings, complete the following steps:
**Step 1 –** Navigate to Start > Windows Administrative Tools > ADSI Edit.
**Step 2 –** Right-click the **ADSI Edit** node and select **Connect To**. In the **Connection
Settings** dialog, enable **Select a well-known Naming Context** and select **Schema** from the
-drop-down list.
+dropdown list.
**Step 3 –** Expand the Schema your_Root_Domain_name node. Right-click the CN=Unicode-Pwd attribute
and select Properties.
@@ -58,7 +58,7 @@ Now you will be able to restore deleted accounts with their passwords preserved.
## Roll Back Unwanted Changes
-Follow the steps to roll back unwanted changes.
+To roll back unwanted changes, complete the following steps:
**Step 1 –** Navigate to Start > Netwrix Auditor > Netwrix Auditor Object Restore for Active
Directory.
diff --git a/docs/auditor/10.7/tools/passwordexpirationnotifier/monitoringscope.md b/docs/auditor/10.7/tools/passwordexpirationnotifier/monitoringscope.md
index 0217766595..52e16c6e08 100644
--- a/docs/auditor/10.7/tools/passwordexpirationnotifier/monitoringscope.md
+++ b/docs/auditor/10.7/tools/passwordexpirationnotifier/monitoringscope.md
@@ -9,7 +9,7 @@ sidebar_position: 20
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from monitoring and
alerting on password expiration.
-Follow the steps to exclude data from the Active Directory monitoring scope.
+To exclude data from the Active Directory monitoring scope, complete the following steps:
**Step 1 –** Navigate to the \_%Netwrix Auditor installation folder%\Password Expiration
Alerting_folder.
diff --git a/docs/auditor/10.7/tools/passwordexpirationnotifier/overview.md b/docs/auditor/10.7/tools/passwordexpirationnotifier/overview.md
index 278be84ad0..798ee934b1 100644
--- a/docs/auditor/10.7/tools/passwordexpirationnotifier/overview.md
+++ b/docs/auditor/10.7/tools/passwordexpirationnotifier/overview.md
@@ -6,11 +6,7 @@ sidebar_position: 50
# Password Expiration Notifier
-Netwrix Auditor Password Expiration Notifier standalone tool checks which domain accounts or
-passwords are about to expire in the specified number of days and sends notifications to users. It
-also generates summary reports that can be delivered to system administrators and/or users'
-managers. Besides, Netwrix Auditor Password Expiration Notifier allows checking the effects of a
-password policy change before applying it to the managed domain.
+The Password Expiration Notifier checks when domain accounts or passwords will expire and sends notifications to users. It generates summary reports for system administrators and users' managers. You can also use it to preview the effects of a password policy change before applying it to the domain.
- Windows Server 2025
- Windows Server 2022
@@ -21,21 +17,18 @@ password policy change before applying it to the managed domain.
Review the following for additional information:
-- Configure Password Expiration Alerting
-- Registry Key Configuration
+- [Configure Password Expiration Alerting](#configure-password-expiration-alerting)
+- [Registry Key Configuration](#registry-key-configuration)
- [Password Expiration Notifier Ports](/docs/auditor/10.7/tools/passwordexpirationnotifier/ports.md)
- [Password Expiration Monitoring Scope](/docs/auditor/10.7/tools/passwordexpirationnotifier/monitoringscope.md)
## Configure Password Expiration Alerting
-Follow the steps to configure password expiration alerting.
+1. Navigate to **Start** > **Netwrix Auditor** > **Password Expiration Notifier**.
-**Step 1 –** Navigate to **Start** > **Netwrix Auditor** > **Password Expiration Notifier**.
+2. On the main page, select a monitoring plan. Click **Add** to create a new monitoring plan.
-**Step 2 –** On the main page, you will be prompted to select a monitoring plan. Click Add to add a
-new monitoring plan.
-
-**Step 3 –** Configure basic parameters as follows:
+3. Configure basic parameters as follows:
| Option | Description |
| ------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
@@ -43,7 +36,7 @@ new monitoring plan.
| Audited domain | Specify domain name in the FQDN format. |
| Send report to administrators | Enable this option and specify one or several email addresses for administrators to receive daily reports with a list of inactive users whose accounts/passwords are going to expire in the specified number of days. Use semicolon to separate several addresses. |
-**Step 4 –** Navigate to the **General** tab and complete the following fields:
+4. Navigate to the **General** tab and complete the following fields:
| Option | Description |
| -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
@@ -52,24 +45,24 @@ new monitoring plan.
| Filter users by group | To audit users for expiring accounts/passwords that belong to certain groups within your Active Directory domain, select this option and click Select Groups. In the dialog that opens, specify the groups that you want to audit. Only users belonging to these groups will be notified and included in the administrators and managers reports. |
| Filter by account name | Specify one or several user account names (e.g., \*John\*). Use semicolon to separate several names. Only user accounts that contain selected name will be notified and included in the administrators and managers reports. |
-**Step 5 –** Navigate to the **Actions** tab and complete the following fields:
+5. Navigate to the **Actions** tab and complete the following fields:
| Option | Description |
| --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Send report to the users’ managers | Enable this option to deliver reports to the user’s managers. To review and edit the user's managers 1. Start **Active Directory Users and Computers**. 2. Navigate to each group where the user belongs to, right-click it and select Properties. 3. In the `` Properties dialog, select the Managed By tab and review a manager. Update it if necessary. To edit a report template, click **Customize**. You can use HTML tags when editing a template. |
| List users whose accounts or passwords expire in `<>` days or less | Specify the expiration period for accounts and/or passwords to be included in the administrators and managers reports. |
-| Only report on users with expiring accounts | Select this option to deliver reports on users with expiring accounts only and ignore users whose passwords will be valid for a rather long time. |
+| Only report on users with expiring accounts | Select this option to deliver reports only for users with expiring accounts. |
| Notify users | Select this option to notify users that their passwords and/or accounts are about to expire. |
-| Every day if password expires in `<>` days or less | Select this option for users to be notified daily that their passwords are going to expire, and specify the number of days before the expiration date. To edit a report template, click **Customize**. You can use HTML tags when editing a template. In order to send a test email, click **Test** and select an account. Make sure this account has a password that expires within the period you specifed next to this option. |
-| First/Second/Last time when password expires in `<>` days | Select this option for users to be notified three times, and specify the number of days before the expiration date for each of three notifications. To edit a report template, click **Customize**. You can use HTML tags when editing a template. In order to send a test email, click Test and select an account. Make sure this account has a password that expires within the period you specifed next to this option. |
-| Notify users by email every day if their accounts expire in `<>` days | Select this option for users to be notified daily that their account is going to expire, and specify the number of days before the expiration date. In order to send a test email, click **Test** and select an account. Make sure this account has a password that expires within the period you specifed next to this option. |
+| Every day if password expires in `<>` days or less | Select this option for users to be notified daily that their passwords are going to expire, and specify the number of days before the expiration date. To edit a report template, click **Customize**. You can use HTML tags when editing a template. To send a test email, click **Test** and select an account. Ensure this account has a password that expires within the period you specified next to this option. |
+| First/Second/Last time when password expires in `<>` days | Select this option for users to be notified three times, and specify the number of days before the expiration date for each of three notifications. To edit a report template, click **Customize**. You can use HTML tags when editing a template. To send a test email, click **Test** and select an account. Ensure this account has a password that expires within the period you specified next to this option. |
+| Notify users by email every day if their accounts expire in `<>` days | Select this option for users to be notified daily that their account is going to expire, and specify the number of days before the expiration date. To send a test email, click **Test** and select an account. Ensure this account has a password that expires within the period you specified next to this option. |
| Notify users by text messages | Select this option for users to receive text messages if their passwords are about to expire. To edit SMS Notifications template, click Customize. - Every day if password expires in `<>` days or less — Select this option for users to be notified daily that their passwords are going to expire, and specify the number of days before the expiration date. - First/Second/Last time when password expires in `<>` days — Select this option for users to be notified three times, and specify the number of days before the expiration date for each of three notifications. - Provider name — Specify provider name. - Property name — Specify the name of the Active Directory User Property where the recipient's phone number is stored. Pager is the default property. If the Pager property of an AD User contains a full email address, Provider Name will be ignored. |
-**Step 6 –** Navigate to the **Notifications** tab and complete the following fields:
+6. Navigate to the **Notifications** tab and complete the following fields:
| Option | Description |
| --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Use Netwrix Auditor notification settings | Select this option if you want to use modern authentication. Please note that modern authentication must already be configured in the monitoring plan you are going to use. If you select this option, the fields below are not needed. |
+| Use Netwrix Auditor notification settings | Select this option to use modern authentication. Modern authentication must already be configured in the monitoring plan you're using. If you select this option, the fields below aren't needed. |
| SMTP server | Enter your SMTP server address. It can be your company's Exchange server or any public mail server (e.g., Gmail, Yahoo). |
| Port number | Specify your SMTP server port number. |
| Sender address | Enter the address that will appear in the From field. **_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. |
@@ -78,10 +71,10 @@ new monitoring plan.
| Password | Enter a password for SMTP authentication. |
| Use Secure Sockets Layer encrypted connection (SSL) | Select this checkbox if your SMTP server requires SSL to be enabled. |
| Use implicit SSL | Select this checkbox if the implicit SSL mode is used, which means that an SSL connection is established before any meaningful data is sent. |
-| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option is not available for auditing User Activity as well Netwrix Auditor tools. |
-| Display the following From address in email notifications | Enter the address that will appear in the "_From_" field in email notifications. This option does not affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, make sure that your Exchange supports this option. |
+| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. This option isn't available for auditing User Activity or other Netwrix Auditor tools. |
+| Display the following From address in email notifications | Enter the address that will appear in the "_From_" field in email notifications. This option doesn't affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, ensure that your Exchange supports this option. |
-**Step 7 –** Navigate to the **Advanced** tab and complete the following fields:
+7. Navigate to the **Advanced** tab and complete the following fields:
| Option | Description |
| ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -90,26 +83,26 @@ new monitoring plan.
| Attach reports as a CSV files | Select this option to receive reports attached to emails as CSV files. |
| Ignore users who must change password at next logon | Select this option to exclude users who must change password at next logon from reports. |
| Ignore users with the "_Password never expires_" option enabled | Select this option to exclude users with the "_Password never expires_" option enabled from reports. |
-| Ignore users who do not have email accounts | Select this option to exclude users who do not have email accounts from reports. |
+| Ignore users who don't have email accounts | Select this option to exclude users who don't have email accounts from reports. |
| Ignore users whose passwords have already expired | Select this option to exclude users whose passwords have already expired from reports. |
-| Include data on expiring accounts | Select this option to include data on expiring domain accounts further to expiring passwords information. |
+| Include data on expiring accounts | Select this option to include data on expiring domain accounts in addition to expiring passwords information. |
| Only report on users with fine-grained password policies applied | Select this option to include in reports only users who have fine-grained policies applied. |
-**Step 8 –** If you want to save your current configuration, click Save.
+8. Click **Save** to save your configuration.
-To review Password Expiration Report
+## Review Password Expiration Report
-Click Generate next to Generate report on users with expired account or passwords to view report on
-users passwords immediately. In the Maximum Password Age Setting dialog that opens, select domain
-policy settings or specify the maximum password age in days.
+1. Click **Generate** next to **Generate report on users with expired account or passwords** to view the report immediately.
+2. In the **Maximum Password Age Setting** dialog that opens, select domain policy settings or specify the maximum password age in days.
## Registry Key Configuration
-Review the basic registry keys that you may need to configure for monitoring expiring passwords
-within your Active Directory domain with Netwrix Auditor. Navigate to **Start > Run** and type
-_"regedit"_.
+Review the following registry keys to configure monitoring for expiring passwords in your Active Directory domain. To access the registry:
+
+1. Navigate to **Start** > **Run**.
+2. Type `regedit`.
| Registry key (REG_DWORD type) | Description / Value |
| ------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
diff --git a/docs/auditor/10.8/accessreviews/accessreviews.md b/docs/auditor/10.8/accessreviews/accessreviews.md
index 14f8030d03..5f8f8f9dcf 100644
--- a/docs/auditor/10.8/accessreviews/accessreviews.md
+++ b/docs/auditor/10.8/accessreviews/accessreviews.md
@@ -96,70 +96,70 @@ Review the following considerations:
and the estimation tool usage, see
[Managing Access Reviews Integration Limits for File Servers](/docs/kb/auditor/configuration-and-setup/file-server-auditing/managing-access-reviews-integration-limits-for-file-servers).
- ## Initial Configuration
+## Initial Configuration
- Next, configure the Access Reviews for your environment:
+Next, configure the Access Reviews for your environment:
- - Console Users — Grant users access to the application starting with an Administrator account.
- There are two levels of access: Administrator and Security Team. See the
- [Console Access Page](/docs/auditor/10.8/accessreviews/admin/configuration/consoleaccess.md) topic for
- information.
+- Console Users — Grant users access to the application starting with an Administrator account.
+ There are two levels of access: Administrator and Security Team. See the
+ [Console Access Page](/docs/auditor/10.8/accessreviews/admin/configuration/consoleaccess.md) topic for
+ information.
- - Optionally, disable the Builtin Administrator account. See the
- [Modify the Builtin Administrator Account](/docs/auditor/10.8/accessreviews/admin/configuration/consoleaccess.md#modify-the-builtin-administrator-account)
- topic for additional information.
+ - Optionally, disable the Builtin Administrator account. See the
+ [Modify the Builtin Administrator Account](/docs/auditor/10.8/accessreviews/admin/configuration/consoleaccess.md#modify-the-builtin-administrator-account)
+ topic for additional information.
- - Notification — Configure the Notification settings required for the application to
- send email. See the
- [Notifications Page](/docs/auditor/10.8/accessreviews/admin/configuration/notifications.md) topic for
- information.
+- Notification — Configure the Notification settings required for the application to
+ send email. See the
+ [Notifications Page](/docs/auditor/10.8/accessreviews/admin/configuration/notifications.md) topic for
+ information.
- ## Enable Console Users
+## Enable Console Users
- Notify Access Reviews Console users granted one of the available roles.
+Notify Access Reviews Console users granted one of the available roles.
- **_RECOMMENDED:_** The notification should include:
+**_RECOMMENDED:_** The notification should include:
- - Why your organization is using Netwrix Auditor Access Reviews.
- - What they will be doing in the Access Reviews Console.
- - How to log into the Access Reviews Console, specifically what URL and credentials to use.
+- Why your organization is using Netwrix Auditor Access Reviews.
+- What they will be doing in the Access Reviews Console.
+- How to log into the Access Reviews Console, specifically what URL and credentials to use.
- You should also provide links to the appropriate topics based on the user's role:
+You should also provide links to the appropriate topics based on the user's role:
- - Security Team — Need topics that align to the work the will be doing in the Access Reviews
- Console:
+- Security Team — Need topics that align to the work the will be doing in the Access Reviews
+ Console:
- - Ownership Administrator — Send the URL link for the
- [Resource Owners Overview](/docs/auditor/10.8/accessreviews/resourceowners/overview.md) topic.
- - Review Administrator — Send the URL link for the
- [Reviews Overview](/docs/auditor/10.8/accessreviews/entitlementreviews/overview.md) topic.
+ - Ownership Administrator — Send the URL link for the
+ [Resource Owners Overview](/docs/auditor/10.8/accessreviews/resourceowners/overview.md) topic.
+ - Review Administrator — Send the URL link for the
+ [Reviews Overview](/docs/auditor/10.8/accessreviews/entitlementreviews/overview.md) topic.
- - Administrator — Send the URL link for the
- [Administrator Overview](/docs/auditor/10.8/accessreviews/admin/overview.md) topic.
+- Administrator — Send the URL link for the
+ [Administrator Overview](/docs/auditor/10.8/accessreviews/admin/overview.md) topic.
- ## Resource Ownership Configuration
+## Resource Ownership Configuration
- You must assign ownership of resources to use the Access Reviews workflow:
+You must assign ownership of resources to use the Access Reviews workflow:
- - Resource Ownership — Assign ownership for resources to be managed through the application. See
- the [Resource Owners Interface](/docs/auditor/10.8/accessreviews/resourceowners/interface/interface.md) topic for
- additional information.
- - Enable Owners — Send a notification to your owners about resource ownership with the
- application. See the
- [Notification to Owners](/docs/auditor/10.8/accessreviews/resourceowners/overview.md#notification-to-owners)
- topic for additional information.
+- Resource Ownership — Assign ownership for resources to be managed through the application. See
+ the [Resource Owners Interface](/docs/auditor/10.8/accessreviews/resourceowners/interface/interface.md) topic for
+ additional information.
+- Enable Owners — Send a notification to your owners about resource ownership with the
+ application. See the
+ [Notification to Owners](/docs/auditor/10.8/accessreviews/resourceowners/overview.md#notification-to-owners)
+ topic for additional information.
- ## Access Reviews Workflow
+## Access Reviews Workflow
- The Access Reviews application runs attestations on resources and groups with the assigned
- owners. The workflow consists of:
+The Access Reviews application runs attestations on resources and groups with the assigned
+owners. The workflow consists of:
- - Reviews — Configure reviews for resource Access or group Membership .
- - Owner Performs Review — Owners process the review, potentially recommending changes
- - Review Administrator Approval — Review and process owner recommended changes
+- Reviews — Configure reviews for resource Access or group Membership .
+- Owner Performs Review — Owners process the review, potentially recommending changes
+- Review Administrator Approval — Review and process owner recommended changes
- **_RECOMMENDED:_** Set expectations for response time from owners.
+**_RECOMMENDED:_** Set expectations for response time from owners.
- You can run reviews multiple times, maintaining a historical record for each instance. See the
- [Reviews Overview](/docs/auditor/10.8/accessreviews/entitlementreviews/overview.md) topic for additional
- information.
+You can run reviews multiple times, maintaining a historical record for each instance. See the
+[Reviews Overview](/docs/auditor/10.8/accessreviews/entitlementreviews/overview.md) topic for additional
+information.
diff --git a/docs/auditor/10.8/accessreviews/admin/additionalconfig/emailtemplates.md b/docs/auditor/10.8/accessreviews/admin/additionalconfig/emailtemplates.md
index 78d013597c..dba895854a 100644
--- a/docs/auditor/10.8/accessreviews/admin/additionalconfig/emailtemplates.md
+++ b/docs/auditor/10.8/accessreviews/admin/additionalconfig/emailtemplates.md
@@ -27,7 +27,7 @@ Substitution Tokens are only valid for certain Notification message templates. B
the Substitution Tokens, the value or string they represent, and the message templates in which they
may be used.
-| Substitution Token | Description | Applicable Template(s) |
+| Substitution Token | Description | Applicable Templates |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
| @LoginUrl@ | URL that allows a user to access the default (login) page | OwnershipChangeNotification ReminderDigest |
| @ResourceDescription@ | Description of resource - To use the resource's description in emails instead of the path, replace @ResourcePath@ with @ResourceDescription@ | OwnershipConfirm ReminderDigest |
@@ -43,8 +43,6 @@ Email templates are shipped in a ZIP file and stored in the Access Reviews insta
...\Netwrix\Access Reviews
-Follow the steps to customize the email templates.
-
**NOTE:** To successfully modify these Notifications email templates, a familiarity with basic HTML
is necessary.
@@ -60,12 +58,12 @@ installation directory to be preserved during future application upgrades.
-**Step 3 –** Locate the desired HTML message template.
+**Step 3 –** Locate the HTML message template you want to customize.
**Step 4 –** Open the file with a text editor, e.g. Notepad, and customize the email body.
**NOTE:** Using a tool other than a text editor to edit HTML files, such as a WYSIWYG web page
-editor which may drastically alter the underlying HTML code, is not supported.
+editor which may drastically alter the underlying HTML code, isn't supported.
**Step 5 –** Email subject lines can be edited by changing the text between the opening ``
tag and the closing `` tag.
@@ -73,7 +71,7 @@ tag and the closing `` tag.
**Step 6 –** After making changes, save the file and view it within a web browser to see what the
changes will look like. The Substitution Tokens will display without supplied values.
-**Step 7 –** After making the desired changes, save and close the text editor. Then re-launch the
+**Step 7 –** After making your changes, save and close the text editor. Then re-launch the
application.
The modifications to the HTML email templates are in use by the notification emails.
diff --git a/docs/auditor/10.8/accessreviews/admin/additionalconfig/timeoutparameter.md b/docs/auditor/10.8/accessreviews/admin/additionalconfig/timeoutparameter.md
index 25b9fef5ae..55573f8aa7 100644
--- a/docs/auditor/10.8/accessreviews/admin/additionalconfig/timeoutparameter.md
+++ b/docs/auditor/10.8/accessreviews/admin/additionalconfig/timeoutparameter.md
@@ -14,14 +14,12 @@ the Access Reviews installation directory:
...\Netwrix\Access Reviews
-Follow the steps to modify the timeout parameter.
-
**Step 1 –** Open the `AccessInformationCenter.Service.exe.Config` file with a text editor, e.g.
Notepad.
-**Step 2 –** Change the value for the `AuthSessionTimeout` parameter to the desired number of
+**Step 2 –** Change the value for the `AuthSessionTimeout` parameter to your preferred number of
minutes. For example:
diff --git a/docs/auditor/10.8/accessreviews/admin/configuration/activedirectory.md b/docs/auditor/10.8/accessreviews/admin/configuration/activedirectory.md
index 9f697ae791..9377365ec4 100644
--- a/docs/auditor/10.8/accessreviews/admin/configuration/activedirectory.md
+++ b/docs/auditor/10.8/accessreviews/admin/configuration/activedirectory.md
@@ -41,8 +41,7 @@ _Remember,_ click **Save** when any changes are made to this page.
## Update the Active Directory Service Account Password
-Follow the steps to update the Active Directory service account password. These steps only apply for
-the **Use the following Active Directory account** option.
+These steps only apply for the **Use the following Active Directory account** option.
**Step 1 –** On the Active Directory page, enter the new password in the correct field.
diff --git a/docs/auditor/10.8/accessreviews/admin/configuration/consoleaccess.md b/docs/auditor/10.8/accessreviews/admin/configuration/consoleaccess.md
index 8c6c87958b..8718b1c39c 100644
--- a/docs/auditor/10.8/accessreviews/admin/configuration/consoleaccess.md
+++ b/docs/auditor/10.8/accessreviews/admin/configuration/consoleaccess.md
@@ -20,21 +20,19 @@ There are two levels of access, or roles, which can be granted to domain users o
has created.
- Access can be limited by resource types (File System, SharePoint, or Active Directory)
-**CAUTION:** Before disabling the Builtin Administrator account, it is necessary to first assign at
+**CAUTION:** Before disabling the Builtin Administrator account, first assign at
least one domain user account to the Administrator role. Login with another Administrator account to
disable the Builtin Administrator. Failure to do this could result in being locked-out of the
Configuration interface. As an alternative to disabling this account, the password can be changed.
See the Modify the Builtin Administrator Account topic for additional information.
Once users have been granted console access, they can login with their domain credentials. Console
-access is not a requirement for owners to complete Access Reviews. See the
+access isn't a requirement for owners to complete Access Reviews. See the
[URL & Login](/docs/auditor/10.8/accessreviews/admin/login.md) topic for information on how users will log in and where they are
directed after login based on their assigned role or lack of role.
## Add Console Users
-Follow the steps to grant domain users or groups console access.
-
**Step 1 –** In the Configuration interface on the Console Access page, click Add. The Console
@@ -44,8 +42,8 @@ Access wizard opens.
**Step 2 –** On the Select Trustee page, enter the following information and click Next:
-- Domain — If the Access Reviews Console has been configured for multiple domains, use the drop-down
- menu to select the desired domain
+- Domain — If the Access Reviews Console has been configured for multiple domains, use the dropdown
+ menu to select the domain you want
- Search — Begin typing the sAMAccountName or display name and the field will auto-populate options
from Active Directory sAMAccountName
@@ -53,7 +51,7 @@ Access wizard opens.
**Step 3 –** On the Select Access page, enter the following information and click **Finish**:
-- Select a role for this trustee – Select a role from the drop down list:
+- Select a role for this trustee – Select a role from the dropdown list:
- Unlimited Access — The Administrator role grants unlimited access
- Limited Access — All other roles can be granted limited access
@@ -61,23 +59,21 @@ Access wizard opens.
- Allow access to the following resource — When enabled, users can be limited to only having
visibility into data for the selected types of resources. Check the boxes for the type of resource
data to be made available to this user.
-- Access is enabled – A user's account must be enabled in order to log into the console. Unchecking
- this option allows you to configure access to be granted at a future time.
+- Access is enabled – A user's account must be enabled to log into the console. Uncheck
+ this option to configure access to be granted at a future time.
**Step 4 –** The new user displays in the list on the Console Access page. Repeat these steps for
each trustee to be granted console access.
-Once the first user with the role of Administrator has been added, the Builtin Administrator account
+After the first user with the role of Administrator has been added, the Builtin Administrator account
can be disabled by that user. See the Modify the Builtin Administrator Account topic for additional
information.
## Modify Console Users
-Follow the steps to modify a user’s console access.
-
-**NOTE:** These steps are for modifying domain users with console access roles and do not apply to
+**NOTE:** These steps are for modifying domain users with console access roles and don't apply to
the Builtin Administrator account. See the Modify the Builtin Administrator Account topic for
additional information.
@@ -86,9 +82,9 @@ modified and click Modify. The Console Access wizard opens to the Select Access
-**Step 2 –** Modify the desired settings and click **Finish**:
+**Step 2 –** Modify the settings as needed and click **Finish**:
-- Select a role for this trustee – Select a role from the drop down list:
+- Select a role for this trustee – Select a role from the dropdown list:
- Unlimited Access — The Administrator role grants unlimited access
- Limited Access — All other roles can be granted limited access
@@ -100,17 +96,17 @@ modified and click Modify. The Console Access wizard opens to the Select Access
visibility into data for specific servers. Begin typing server names and the field will
auto-populate with known servers from scanned data. A resource type appears in parentheses after
the host name for quick reference.
-- Access is enabled – A user's account must be enabled in order to log into the console. Unchecking
- this option allows you to configure access to be granted at a future time.
+- Access is enabled – A user's account must be enabled to log into the console. Uncheck
+ this option to configure access to be granted at a future time.
Any modifications to the user’s role are visible in the list on the Console Access page.
## Delete Console Users
-**CAUTION:** Confirmation is not requested when deleting users. An alternative to deleting a console
+**CAUTION:** Confirmation isn't requested when deleting users. An alternative to deleting a console
user is to disable their access. See the Modify Console Users topic for additional information.
-Follow the steps to remove a user’s configured console access.
+To remove a user’s configured console access:
@@ -122,8 +118,7 @@ The user is removed from the list on the Console Access page.
## Modify the Builtin Administrator Account
-The Builtin Administrator account can be disabled or its password can be changed. Follow the steps
-to modify this account.
+The Builtin Administrator account can be disabled or its password can be changed. To modify this account:
@@ -132,8 +127,8 @@ Administrator account and click **Modify**. The Builtin Administrator window ope
**Step 2 –** Modify the account as desired and click **OK**:
-- Access is enabled — Indicates whether the account can be used to login
-- Change Password — Allows you to change the password for this Builtin Administrator account. Check
+- Access is enabled — Indicates whether the account can log in
+- Change Password — Use this option to change the password for this Builtin Administrator account. Check
the box and enter the new password in both entry fields. The password must be eight or more
characters long.
diff --git a/docs/auditor/10.8/accessreviews/admin/configuration/database.md b/docs/auditor/10.8/accessreviews/admin/configuration/database.md
index 09d7654a58..771697097a 100644
--- a/docs/auditor/10.8/accessreviews/admin/configuration/database.md
+++ b/docs/auditor/10.8/accessreviews/admin/configuration/database.md
@@ -7,8 +7,7 @@ sidebar_position: 40
# Database Page
The Access Reviews application must have access to the SQL Server hosting the database. It is
-configured during installation. If it is necessary to modify these setting after installation, that
-is done on the Database Page of the Configuration interface.
+configured during installation. If you need to modify these settings after installation, you can do so on the Database Page of the Configuration interface.
@@ -45,8 +44,8 @@ _Remember,_ click **Save** when any changes are made to this page.
## Update the Database Service Account Password
-Follow the steps to update the Database service account password. These steps only apply for the SQL
-Authentication option.
+To update the Database service account password, follow these steps. These steps only apply for the SQL
+Authentication option:
**Step 1 –** On the Database page, enter the new password in the correct field.
diff --git a/docs/auditor/10.8/accessreviews/admin/configuration/diagnostics.md b/docs/auditor/10.8/accessreviews/admin/configuration/diagnostics.md
index bd7ec27de8..7101d5ea36 100644
--- a/docs/auditor/10.8/accessreviews/admin/configuration/diagnostics.md
+++ b/docs/auditor/10.8/accessreviews/admin/configuration/diagnostics.md
@@ -16,8 +16,7 @@ download the archive of all application logs.
## Debug Logs
-When requested by [Netwrix Support](https://www.netwrix.com/support.html) , follow the steps to
-provide debug logs.
+When requested by [Netwrix Support](https://www.netwrix.com/support.html), complete the following steps to provide debug logs:
**Step 1 –** On the Diagnostics page, check the Enable debug logging box.
@@ -28,5 +27,5 @@ provide debug logs.
**Step 4 –** On the Diagnostics page, click **Download Logs**.
The downloaded logs have the debug logging information and can be sent to
-[Netwrix Support](https://www.netwrix.com/support.html). When your issue is resolved, do not forget
+[Netwrix Support](https://www.netwrix.com/support.html). When your issue is resolved, don't forget
to turn off Debug logs.
diff --git a/docs/auditor/10.8/accessreviews/admin/configuration/notifications.md b/docs/auditor/10.8/accessreviews/admin/configuration/notifications.md
index ce315f9fcb..3e1b3e96ce 100644
--- a/docs/auditor/10.8/accessreviews/admin/configuration/notifications.md
+++ b/docs/auditor/10.8/accessreviews/admin/configuration/notifications.md
@@ -18,8 +18,7 @@ for configuring weekly reminders for owners with outstanding reviews.
## Configure SMTP Server Settings
-SMTP server information is supplied and modified on the Notifications page. Follow the steps to
-configure or modify the SMTP settings.
+SMTP server information is supplied and modified on the Notifications page. To configure or modify the SMTP settings:
@@ -78,7 +77,7 @@ Notification options.
## Notification Options
-Once the SMTP server is configured, there are additional options. Only the Reply-To field must be
+After the SMTP server is configured, there are additional options. Only the Reply-To field must be
populated:
@@ -111,8 +110,8 @@ Reminders section.
**Step 3 –** Set the date and time for when the reminder will be sent:
-- Day of the week – Select the day of the week from the drop-down menu
-- Time of day – Click on the field to open a clock window. Set the time of day reminders will be
+- Day of the week – Select the day of the week from the dropdown menu
+- Time of day – Click the field to open a clock window. Set the time of day reminders will be
sent, e.g. 12:00 AM
**Step 4 –** Click **Save**. Then click **OK** to confirm.
diff --git a/docs/auditor/10.8/accessreviews/admin/firstlaunch.md b/docs/auditor/10.8/accessreviews/admin/firstlaunch.md
index da3ac80506..f3c3ab5204 100644
--- a/docs/auditor/10.8/accessreviews/admin/firstlaunch.md
+++ b/docs/auditor/10.8/accessreviews/admin/firstlaunch.md
@@ -31,7 +31,7 @@ access for domain users and configure notification settings. Select the Configur
[Console Access Page](/docs/auditor/10.8/accessreviews/admin/configuration/consoleaccess.md) and
[Notifications Page](/docs/auditor/10.8/accessreviews/admin/configuration/notifications.md) topics for additional information.
-The interfaces available to console users are controlled by the role assigned. Owners do not need to
+The interfaces available to console users are controlled by the role assigned. Owners don't need to
be assigned console access. See the [URL & Login](/docs/auditor/10.8/accessreviews/admin/login.md) topic for information on how users will
log in and where they are directed after login.
diff --git a/docs/auditor/10.8/accessreviews/admin/login.md b/docs/auditor/10.8/accessreviews/admin/login.md
index 3bd28a4e58..477eadaffb 100644
--- a/docs/auditor/10.8/accessreviews/admin/login.md
+++ b/docs/auditor/10.8/accessreviews/admin/login.md
@@ -27,7 +27,7 @@ the application in their default browser. Alternatively, the localhost URL can b
Remote Access
-Since Access Reviews is a browser-based application, it is possible to access the web interface
+Since Access Reviews is a browser-based application, you can access the web interface
remotely. It is up to the Administrator to provide users with the correct URL for access.
Depending on your network environment, you may need to use the NetBIOS name, FQDN, or IP Address of
diff --git a/docs/auditor/10.8/accessreviews/admin/navigate/datagrid.md b/docs/auditor/10.8/accessreviews/admin/navigate/datagrid.md
index aa531608c8..44ada81996 100644
--- a/docs/auditor/10.8/accessreviews/admin/navigate/datagrid.md
+++ b/docs/auditor/10.8/accessreviews/admin/navigate/datagrid.md
@@ -10,7 +10,7 @@ The data grids within various tables have several features to improve your exper
## Search & Filter
-There is a Search box above a table's header row that can be used to filter the table data.
+There is a Search box above a table's header row that can filter the table data.
@@ -18,7 +18,7 @@ Begin typing in the Search box. The filter acts as a wildcard, filtering the tab
## Column Filters
-There is a filter icon to the right of each column name that can be used to apply a column specific
+There is a filter icon to the right of each column name that can apply a column specific
filter. You can apply filters to multiple columns simultaneously.
@@ -40,7 +40,7 @@ Table column widths can be resized to change the width.
-Simply select the edges of the column headers and drag to the desired width.
+Simply select the edges of the column headers and drag to the width you want.
## Sort
@@ -48,13 +48,13 @@ Data within a table can be sorted alphanumerically for a column.
-Click on any column header. An arrow will appear next to the column name indicating the sort to be
+Click any column header. An arrow will appear next to the column name indicating the sort to be
ascending or descending order.
## Columns Selector
Columns can be hidden or unhidden. Available columns for a table are listed in the column selector
-menu that appears when you right-click on a column header.
+menu that appears when you right-click a column header.
@@ -63,8 +63,8 @@ Unchecked columns are hidden.
## Exports
-There are two export buttons above a table's header row that can be used to export the data
-currently displayed within the table.
+There are two export buttons above a table's header row that can export the data
+displayed within the table.
diff --git a/docs/auditor/10.8/accessreviews/admin/navigate/editnotes.md b/docs/auditor/10.8/accessreviews/admin/navigate/editnotes.md
index e58e9797e9..81d0a1524b 100644
--- a/docs/auditor/10.8/accessreviews/admin/navigate/editnotes.md
+++ b/docs/auditor/10.8/accessreviews/admin/navigate/editnotes.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Edit Notes Window
-The Edit Note window can be opened from a variety of interfaces. Follow the steps to add or edit a
+The Edit Note window can be opened from a variety of interfaces. To add or edit a
note.
**Step 1 –** Select the item in the interface and click Edit Notes. The Edit Notes window opens.
diff --git a/docs/auditor/10.8/accessreviews/admin/troubleshooting/loglevel.md b/docs/auditor/10.8/accessreviews/admin/troubleshooting/loglevel.md
index bf5b6f4118..58ac009396 100644
--- a/docs/auditor/10.8/accessreviews/admin/troubleshooting/loglevel.md
+++ b/docs/auditor/10.8/accessreviews/admin/troubleshooting/loglevel.md
@@ -11,7 +11,7 @@ Reviews installation directory:
...\Netwrix\Access Reviews
-Follow the steps to modify the log level.
+To modify the log level.
**Step 1 –** Open the `AccessInformationCenter.Service.exe.Config` file in a text editor, e.g.
Notepad.
@@ -20,7 +20,7 @@ Notepad.
**Step 2 –** The level value is set in the `LogLevel` parameter, where "2" is the default level. As
the logging level increases from 0 to 3, the types of information and level of detail included
-within the log file also increase. Change to the desired log level:
+within the log file also increase. Change to the log level:
diff --git a/docs/auditor/10.8/accessreviews/admin/troubleshooting/overview.md b/docs/auditor/10.8/accessreviews/admin/troubleshooting/overview.md
index 798e8f2873..67c6c155f7 100644
--- a/docs/auditor/10.8/accessreviews/admin/troubleshooting/overview.md
+++ b/docs/auditor/10.8/accessreviews/admin/troubleshooting/overview.md
@@ -15,7 +15,7 @@ Configuration of Permissions on the Installation Directory:
The Windows service account running the Netwrix Auditor Access Reviews service may be used as the
Database service account, the Active Directory service account, and/or the SMTP authentication
account. Check the Database, Active Directory, and Notification pages in the Configuration interface
-to confirm where the account is in use before modifying it to ensure these functionality are not
+to confirm where the account is in use before modifying it to ensure these functionality aren't
impaired. If this account is changed, a new account must have the **Full Control** permission to
files and folders in the Access Reviews installation directory. See the
[Application Service Account](/docs/auditor/10.8/accessreviews/admin/troubleshooting/serviceaccount.md) topic for additional information.
diff --git a/docs/auditor/10.8/accessreviews/admin/troubleshooting/serviceaccount.md b/docs/auditor/10.8/accessreviews/admin/troubleshooting/serviceaccount.md
index 7ae8cb036b..79e3714fc8 100644
--- a/docs/auditor/10.8/accessreviews/admin/troubleshooting/serviceaccount.md
+++ b/docs/auditor/10.8/accessreviews/admin/troubleshooting/serviceaccount.md
@@ -9,7 +9,7 @@ sidebar_position: 20
The Windows service account running the Netwrix Auditor Access Reviews service may be used as the
Database service account, the Active Directory service account, and/or the SMTP authentication
account. Check the Database, Active Directory, and Notification pages in the Configuration interface
-to confirm where the account is in use before modifying it to ensure these functionality are not
+to confirm where the account is in use before modifying it to ensure these functionality aren't
impaired. If the same account is being used for multiple purposes, it will require the proper
permissions for each purpose.
@@ -24,7 +24,7 @@ Control over the installation directory:
## Modify the Service Account via Service Control Manager
-Follow the steps to enable and/or modify the Windows service account running the Netwrix Auditor
+To enable and/or modify the Windows service account running the Netwrix Auditor
Access Reviews service.
**Step 1 –** Navigate to Service Control Manager (`services.msc`). The Services Control Manager
@@ -32,7 +32,7 @@ opens.
-**Step 2 –** Right-click on the Netwrix Auditor Access Reviews service and select **Properties**.
+**Step 2 –** Right-click the Netwrix Auditor Access Reviews service and select **Properties**.
The service Properties window opens.
diff --git a/docs/auditor/10.8/accessreviews/entitlementreviews/approvalprocess/approvalprocess.md b/docs/auditor/10.8/accessreviews/entitlementreviews/approvalprocess/approvalprocess.md
index 2c48c5a147..e37eba972d 100644
--- a/docs/auditor/10.8/accessreviews/entitlementreviews/approvalprocess/approvalprocess.md
+++ b/docs/auditor/10.8/accessreviews/entitlementreviews/approvalprocess/approvalprocess.md
@@ -20,7 +20,7 @@ decline, or defer all owner-recommended changes for a review.
## Process Owner Responses
-Follow the steps to perform a granular review of a resource owner's recommended changes.
+To perform a granular review of a resource owner's recommended changes.
**Step 1 –** On the Manage Reviews page, select a review and click **View Details**. The Review
Details page opens.
@@ -33,7 +33,7 @@ opens.
**Step 3 –** By default, the table displays only the recommended changes. Select an item and click
-the desired action button: Accept, Decline, or Defer. The Approval column icon updates. See the
+the action button you want: Accept, Decline, or Defer. The Approval column icon updates. See the
[View Responses Window](/docs/auditor/10.8/accessreviews/entitlementreviews/interface/viewresponses.md) topic for additional information.
**Step 4 –** Repeat Step 3 until all changes have been processed. Then click **Close**. The View
@@ -45,23 +45,23 @@ Responses window closes.
implemented outside of the application by your IT department. Use the **Export Excel** or **Export
CSV** buttons to generate and download an export of accepted changes.
-**Step 7 –** When remediation is complete, return to the Mange Reviews page (click on the
+**Step 7 –** When remediation is complete, return to the Mange Reviews page (click the
breadcrumb). Select the review in the list and click **Mark Completed**.
The review remains marked as Completed until the next instance is started.
## Batch Processing
-Follow the steps to perform a batch processing of a resource owner's recommended changes.
+To perform a batch processing of a resource owner's recommended changes.
**Step 1 –** On the Manage Reviews page, select a review and click **View Details**. The Review
Details page opens. .
-**Step 2 –** Select a resource in the list and open the **Process Changes** drop-down menu.
+**Step 2 –** Select a resource in the list and open the **Process Changes** dropdown menu.
-**Step 3 –** Select the desired action for all recommended changes: Accept, Decline, or Defer.
+**Step 3 –** Select the action you want for all recommended changes: Accept, Decline, or Defer.
_Remember,_ all recommended changes for the selected resource will be processed with the same
resolution.
@@ -72,7 +72,7 @@ resolution.
implemented outside of the application by your IT department. Use the **Export Excel** or **Export
CSV** buttons to generate and download an export of accepted changes.
-**Step 6 –** When remediation is complete, return to the Mange Reviews page (click on the
+**Step 6 –** When remediation is complete, return to the Mange Reviews page (click the
breadcrumb). Select the review in the list and click **Mark Completed**.
The review remains marked as Completed until the next instance is started.
diff --git a/docs/auditor/10.8/accessreviews/entitlementreviews/approvalprocess/removechanges.md b/docs/auditor/10.8/accessreviews/entitlementreviews/approvalprocess/removechanges.md
index c5066eb0cf..526459d75e 100644
--- a/docs/auditor/10.8/accessreviews/entitlementreviews/approvalprocess/removechanges.md
+++ b/docs/auditor/10.8/accessreviews/entitlementreviews/approvalprocess/removechanges.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Remove Changes Window
-Select the desired resource on a Review Details page and click **Remove Changes**. The Remove
+Select the resource you want on a Review Details page and click **Remove Changes**. The Remove
changes window opens to confirm the action.
diff --git a/docs/auditor/10.8/accessreviews/entitlementreviews/create/create.md b/docs/auditor/10.8/accessreviews/entitlementreviews/create/create.md
index b133b09376..bcd59fdc1a 100644
--- a/docs/auditor/10.8/accessreviews/entitlementreviews/create/create.md
+++ b/docs/auditor/10.8/accessreviews/entitlementreviews/create/create.md
@@ -32,7 +32,7 @@ See the Create a Review topic for additional information.
## Create a Review
-Follow the steps to create a review.
+To create a review.
**Step 1 –** On the Manage Reviews page, click Create. The Create Review wizard opens.
@@ -62,18 +62,18 @@ created.
- Description — Description or explanation of the resource as supplied by either the Ownership
Administrator or the assigned owner
- Reviewer — Primary owner assigned to the resource
- - Confirmed — Indicates whether or not the assigned owner has confirmed ownership of that
+ - Confirmed — Indicates whether the assigned owner has confirmed ownership of that
resource. Tool-tips display when hovering over the icons indicating whether the resource
ownership has been confirmed, declined, pending response, or that a confirmation has not been
requested.
- Scan Data — A checkmark indicates the resource has been scanned. Only resources with scan data
can be included in a review.
-- Select the desired resource(s) and click **Add**. The **View Selections** button indicates how
+- Select the resources you want and click **Add**. The **View Selections** button indicates how
many resources have been selected. Click the button to open the Selected Resources window, where
you can view and modify the selections. See the
[Selected Resources Window](/docs/auditor/10.8/accessreviews/entitlementreviews/interface/selectedresources.md) topic for additional information.
-- Once the desired resources have been selected, click **Next**.
+- After selecting the resources you want, click **Next**.
@@ -82,7 +82,7 @@ create the review. Action status displays on the page. When the update has compl
Close. The Create Review wizard closes.
The new review displays in the table on the Manage Reviews page. An email was sent to the primary
-owner assigned to the resource(s) in this review. By default, the application is configured to send
+owner assigned to the resources in this review. By default, the application is configured to send
notifications only to the primary owner. However, this can be customized on the Configuration >
Notifications page to send notifications to all assigned owners. See the
[Notifications Page](/docs/auditor/10.8/accessreviews/admin/configuration/notifications.md) topic for additional information.
diff --git a/docs/auditor/10.8/accessreviews/entitlementreviews/create/reviewinstances.md b/docs/auditor/10.8/accessreviews/entitlementreviews/create/reviewinstances.md
index 3bb2c1df8f..46af65735b 100644
--- a/docs/auditor/10.8/accessreviews/entitlementreviews/create/reviewinstances.md
+++ b/docs/auditor/10.8/accessreviews/entitlementreviews/create/reviewinstances.md
@@ -9,7 +9,7 @@ sidebar_position: 10
After a review has been completed, it can be run again, which creates multiple instances of the
review. Each instance is identified by date timestamps indicating its start and end times.
-**_RECOMMENDED:_** Prior to running another review instance, ensure the most up to date information
+**_RECOMMENDED:_** Before running another review instance, ensure the most up to date information
is available to owners for review.
diff --git a/docs/auditor/10.8/accessreviews/entitlementreviews/interface/deletereview.md b/docs/auditor/10.8/accessreviews/entitlementreviews/interface/deletereview.md
index c73d7c628f..3733ad2fd2 100644
--- a/docs/auditor/10.8/accessreviews/entitlementreviews/interface/deletereview.md
+++ b/docs/auditor/10.8/accessreviews/entitlementreviews/interface/deletereview.md
@@ -17,7 +17,7 @@ The Delete Review window opens from either the
## Delete Entire Review
-Select the desired review on the Manage Reviews page and click **Delete**. The Delete Review window
+Select the review you want on the Manage Reviews page and click **Delete**. The Delete Review window
opens to confirm the action.
@@ -29,7 +29,7 @@ Click **Yes** to complete the deletion. Click **No** to cancel it. The Delete Re
## Delete Review Instance
-Select the desired review instance from the drop-down menu on the Review Details page and click
+Select the review you want instance from the dropdown menu on the Review Details page and click
**Delete**. The Delete Review window opens to confirm the action.
diff --git a/docs/auditor/10.8/accessreviews/entitlementreviews/interface/renamereview.md b/docs/auditor/10.8/accessreviews/entitlementreviews/interface/renamereview.md
index 83476a5752..3479c4c5a0 100644
--- a/docs/auditor/10.8/accessreviews/entitlementreviews/interface/renamereview.md
+++ b/docs/auditor/10.8/accessreviews/entitlementreviews/interface/renamereview.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# Rename Review Window
The Rename Review window opens from the [Manage Reviews Page](/docs/auditor/10.8/accessreviews/entitlementreviews/interface/interface.md#manage-reviews-page)
-of the Entitlement Reviews interface. Follow the steps to rename a review.
+of the Entitlement Reviews interface. To rename a review.
**Step 1 –** Select the review and click **Rename**. The Rename Review window opens.
diff --git a/docs/auditor/10.8/accessreviews/entitlementreviews/interface/sendreminders.md b/docs/auditor/10.8/accessreviews/entitlementreviews/interface/sendreminders.md
index bd84115b61..3f7306bec9 100644
--- a/docs/auditor/10.8/accessreviews/entitlementreviews/interface/sendreminders.md
+++ b/docs/auditor/10.8/accessreviews/entitlementreviews/interface/sendreminders.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Send Reminders Window
The Send Reminders window opens from the [Manage Reviews Page](/docs/auditor/10.8/accessreviews/entitlementreviews/interface/interface.md#manage-reviews-page)
-of the Entitlement Reviews interface. Select the desired active review(s) and click **Send
+of the Entitlement Reviews interface. Select the active reviews and click **Send
Reminders** to send immediate reminder notifications. The Send Reminders window opens to display an
action status.
diff --git a/docs/auditor/10.8/accessreviews/entitlementreviews/interface/stopreview.md b/docs/auditor/10.8/accessreviews/entitlementreviews/interface/stopreview.md
index 84c60151a3..9bf94db533 100644
--- a/docs/auditor/10.8/accessreviews/entitlementreviews/interface/stopreview.md
+++ b/docs/auditor/10.8/accessreviews/entitlementreviews/interface/stopreview.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# Stop Review Window
The Stop Review window opens from the [Manage Reviews Page](/docs/auditor/10.8/accessreviews/entitlementreviews/interface/interface.md#manage-reviews-page) of
-the Entitlement Reviews interface. Select the desired active review(s) and click **Stop**. The Stop
+the Entitlement Reviews interface. Select the active reviews and click **Stop**. The Stop
Review window opens to confirm the action.
diff --git a/docs/auditor/10.8/accessreviews/entitlementreviews/interface/viewresponses.md b/docs/auditor/10.8/accessreviews/entitlementreviews/interface/viewresponses.md
index 846814179a..dc75939d40 100644
--- a/docs/auditor/10.8/accessreviews/entitlementreviews/interface/viewresponses.md
+++ b/docs/auditor/10.8/accessreviews/entitlementreviews/interface/viewresponses.md
@@ -17,7 +17,7 @@ The information displayed in the table includes:
- Item Reviewed — Item upon which changes were suggested by the owner
- Current — Current state of the item at the time of the review
- Desired — Change suggested by the owner
-- Notes — Icon indicates a Note has been added. Click on the icon to read the attached note(s).
+- Notes — Icon indicates a Note has been added. Click the icon to read the attached notes.
- Approval — Status of the Review Administrator's approval
- Clock — Indicates waiting on the Review Administrator to make an official decision
diff --git a/docs/auditor/10.8/accessreviews/entitlementreviews/overview.md b/docs/auditor/10.8/accessreviews/entitlementreviews/overview.md
index a4901aa787..424f265ed6 100644
--- a/docs/auditor/10.8/accessreviews/entitlementreviews/overview.md
+++ b/docs/auditor/10.8/accessreviews/entitlementreviews/overview.md
@@ -11,7 +11,7 @@ The Entitlement Reviews interface is where users with either the Security Team o
business users or data custodians (to be referred to as Owners) to attest to the access and
privileges users have to their resources.
-For the purpose of the Access Reviewsapplication, a “resource” refers to the file system shared
+To the Access Reviewsapplication, a “resource” refers to the file system shared
folders, SharePoint Online site collections, and Active Directory (AD) groups. All data available
within the Access Reviews application is collected by Netwrix Auditor according to the synchronized
monitoring plans.
@@ -65,7 +65,7 @@ Prerequisite:
Workflow:
**_RECOMMENDED:_** When deploying the Access Reviews application in an organization to process
-reviews, owners should be notified prior to launching the first set of reviews. See the
+reviews, owners should be notified before launching the first set of reviews. See the
[Notification to Owners](/docs/auditor/10.8/accessreviews/resourceowners/overview.md#notification-to-owners) topic for additional
information.
diff --git a/docs/auditor/10.8/accessreviews/installation/accessreviewsconfiguration.md b/docs/auditor/10.8/accessreviews/installation/accessreviewsconfiguration.md
index cd0b2c64c0..a9da19bb81 100644
--- a/docs/auditor/10.8/accessreviews/installation/accessreviewsconfiguration.md
+++ b/docs/auditor/10.8/accessreviews/installation/accessreviewsconfiguration.md
@@ -18,7 +18,7 @@ You can configure Netwrix Auditor Access Reviews in two ways:
If you plan to use Access Reviews for multiple data sources, configure the settings to work with the
data sources that you select.
-Follow the steps to configure Access Reviews in the Netwrix Auditor.
+To configure Access Reviews in the Netwrix Auditor:
**Step 1 –** Go to **Settings > General > Access Reviews**.
@@ -28,7 +28,7 @@ Follow the steps to configure Access Reviews in the Netwrix Auditor.
-**Step 3 –** Select the desired data sources to review.
+**Step 3 –** Select the data sources you want to review.
**Step 4 –** Click **Save**.
@@ -39,11 +39,11 @@ Netwrix Auditor Access Reviews is configured and ready to use in the Netwrix Aud
If you plan to use Access Reviews for a specific monitoring plan, configure Access Reviews in that
monitoring plan.
-Follow the steps to configure Access Reviews in the Netwrix Auditor.
+To configure Access Reviews in the Netwrix Auditor:
**Step 1 –** Go to **Configuration > Monitoring plans**.
-**Step 2 –** Double click the desired monitoring plan.
+**Step 2 –** Double click the monitoring plan you want to configure.
**Step 3 –** Click **Edit data source** button on the left.
diff --git a/docs/auditor/10.8/accessreviews/installation/install.md b/docs/auditor/10.8/accessreviews/installation/install.md
index 0a11c51901..649d307f69 100644
--- a/docs/auditor/10.8/accessreviews/installation/install.md
+++ b/docs/auditor/10.8/accessreviews/installation/install.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install
-Once the prerequisites have been met, follow the steps to install the Access Reviews application.
+After meeting the prerequisites, install the Access Reviews application.
**Step 1 –** Run the `AccessReviews.exe` executable, and the Netwrix Auditor Access Reviews Setup
wizard opens.
@@ -46,7 +46,7 @@ specific requirements for changing the path.
- Database — Enter the name of the database. By default, this is set to NetwrixAR.
-- Authentication – Select the Database service account type from the drop-down menu. Then enter the
+- Authentication – Select the Database service account type from the dropdown menu. Then enter the
account information in the **User Name** and **Password** fields.
- For Windows Authentication – **User Name** format must be `[DOMAIN]\[username]` , for example
`NWXTECH\ad.bruce`
@@ -54,7 +54,7 @@ specific requirements for changing the path.
**NOTE:** See the [Database Page](/docs/auditor/10.8/accessreviews/admin/configuration/database.md) topic for additional
information.
-
+
**Step 6 –** If there are no errors, you will be asked to confirm creation of the new database.
Click **Yes**.
@@ -73,7 +73,7 @@ field. When the port is set as desired, click **Next**.
-**Step 9 –** Once the installation has successfully completed, click **Finish** to exit the wizard.
+**Step 9 –** After installation has successfully completed, click **Finish** to exit the wizard.
The installation wizard placed a Netwrix Auditor Access Reviews icon on the desktop. Now proceed to
the [First Launch](/docs/auditor/10.8/accessreviews/admin/firstlaunch.md) topic for next steps.
diff --git a/docs/auditor/10.8/accessreviews/installation/overview.md b/docs/auditor/10.8/accessreviews/installation/overview.md
index b46d3ad4a9..cbe18ed2dd 100644
--- a/docs/auditor/10.8/accessreviews/installation/overview.md
+++ b/docs/auditor/10.8/accessreviews/installation/overview.md
@@ -11,8 +11,8 @@ in a Microsoft® SQL® Server database. Netwrix Auditor must be installed and co
installing and using the Access Reviews application. The Access Reviews Configuration tool must be
used after installation to complete the integration of these products.
-**NOTE:** Access Reviews is a separately licensed product and is not included with Netwrix Auditor.
-Make sure that you have the Access Reviews license enabled in Auditor.
+**NOTE:** Access Reviews is a separately licensed product and isn't included with Netwrix Auditor.
+ensure that you have the Access Reviews license enabled in Auditor.
## Prerequisites
@@ -21,7 +21,7 @@ The Access Reviews application must be installed on the same server as Netwrix A
### Permissions
Permissions are needed to the Netwrix Auditor database and to Active Directory. This can be one
-account with sufficient rights to each or two separate accounts. For the purpose of this document,
+account with sufficient rights to each or two separate accounts. To this document,
these will be referred to as the Database service account and the Active Directory service account.
- Database service account – This is the same account used by Netwrix Auditor for a database service
@@ -37,7 +37,7 @@ these will be referred to as the Database service account and the Active Directo
## Software Compatibility & Versions
-For proper functionality, it is necessary for the version of the Access Reviews to be compatible
+For proper functionality, the version of Access Reviews must be compatible
with the existing Netwrix Auditor installation. If necessary,
[Netwrix Support](https://www.netwrix.com/support.html) can confirm whether the two product versions
are compatible.
diff --git a/docs/auditor/10.8/accessreviews/installation/secure.md b/docs/auditor/10.8/accessreviews/installation/secure.md
index 95129cc5b3..a246ebe83e 100644
--- a/docs/auditor/10.8/accessreviews/installation/secure.md
+++ b/docs/auditor/10.8/accessreviews/installation/secure.md
@@ -6,15 +6,13 @@ sidebar_position: 30
# Secure Console Access
-Enable Secure Sockets Layer (SSL) for secure, remote connections to the application web server. In
-order to enable SSL, you need to create a certificate and then bind it to the secure port.
+Enable Secure Sockets Layer (SSL) for secure, remote connections to the application web server. To enable SSL, you need to create a certificate and then bind it to the secure port.
**NOTE:** Organizations typically have one or more system administrators responsible for Public Key
-Infrastructure (PKI) and certificates. To continue with this configuration, it will first be
-necessary to confer with the PKI administrator to determine which certificate method will conform to
-the organization’s security policies.
+Infrastructure (PKI) and certificates. To continue with this configuration, first confer with the PKI
+administrator to determine which certificate method will conform to the organization’s security policies.
-Follow the steps to enable SSL.
+## Enable SSL
**Step 1 –** Create an SSL Binding.
@@ -33,7 +31,7 @@ variables:
- The `$port` value must be accurate for your environment. The HTTP default port is 81. The HTTPS
default is 481. However, it can be customized during installation.
- The `$guid` value is required for specifying a valid GUID value to identify the owning application
- for a binding purpose. It obtained from any valid GUID.
+ for a binding purpose. Obtain it from any valid GUID.
If you need to find the `$certHash` value of a certificate that was already created, run the
PowerShell `dir` command below on the certificate's drive. This will output the Thumbprint (Hash)
@@ -43,7 +41,7 @@ value and the certificate name:
dir cert:\localmachine\my
```
-Replace the environmental variables in the example script below. Then Run the PowerShell command to
+Replace the environmental variables in the example script below. Then run the PowerShell command to
create an SSL binding:
```powershell
@@ -58,8 +56,7 @@ The next step is to modify the `AccessInformationCenter.Service.exe.Config` file
## Modify the AccessInformationCenter.Service.exe.Config File
-Follow the steps to modify the Modify the `AccessInformationCenter.Service.exe.Config` file for
-HTTPS.
+To modify the `AccessInformationCenter.Service.exe.Config` file for HTTPS:
**Step 1 –** Open the `AccessInformationCenter.Service.exe.Config` file in a text editor, e.g.
Notepad. It is located in the installation directory:
diff --git a/docs/auditor/10.8/accessreviews/installation/upgrade.md b/docs/auditor/10.8/accessreviews/installation/upgrade.md
index 172211016c..f7300ea639 100644
--- a/docs/auditor/10.8/accessreviews/installation/upgrade.md
+++ b/docs/auditor/10.8/accessreviews/installation/upgrade.md
@@ -10,13 +10,13 @@ sidebar_position: 40
the Netwrix Auditor Access Reviews application, see the Special Considerations topic for upgrade
steps.
-To upgrade the Access Reviews application to a newer version, simply run the new `AccessReviews.msi`
-executable. It is not necessary to uninstall the existing version. See the [Install](/docs/auditor/10.8/accessreviews/installation/install.md)
+To upgrade the Access Reviews application to a newer version, run the new `AccessReviews.msi`
+executable. It isn't necessary to uninstall the existing version. See the [Install](/docs/auditor/10.8/accessreviews/installation/install.md)
topic for additional information.
_Remember,_ the Access Reviews version must align to the compatible Netwrix Auditor version.
-When the installer is run over an existing version, the following is happening in the backend:
+When you run the installer over an existing version, the installer does the following:
- During the installation process, a Backup folder is created in the Access Reviews installation
directory
@@ -25,8 +25,7 @@ When the installer is run over an existing version, the following is happening i
- The Backup folder contains the files where various settings reside listed in the table below
-- The backup folder files are copied over the default files laid down by the installer, preserving
- customized settings
+- The installer copies the backup folder files over the default files, preserving customized settings
- After the installation is complete, the Backup folder is removed
| File | Location | Guidance |
@@ -39,8 +38,7 @@ When the installer is run over an existing version, the following is happening i
The originally released Netwrix Access Information Center has been rebranded to Netwrix Auditor
Access Reviews. This rebranding project included changing the installation directory, the name of
-the service, and the default name of the database created by the installer. Follow the steps to
-replace Netwrix Access Information Center with Netwrix Auditor Access Reviews.
+the service, and the default name of the database created by the installer. To replace Netwrix Access Information Center with Netwrix Auditor Access Reviews:
**Step 1 –** Install the Netwrix Auditor Access Reviews application on the same server where the
Netwrix Access Information Center was installed. See the [Install](/docs/auditor/10.8/accessreviews/installation/install.md) topic for additional
@@ -55,10 +53,10 @@ information. On the SQL Server Connection page:
**Step 2 –** Launch the application and reset the Builtin Administrator password. See the
[First Launch](/docs/auditor/10.8/accessreviews/admin/firstlaunch.md) topic for additional information.
-**Step 3 –** It will be necessary to add your Console Users again. See the
+**Step 3 –** Add your Console Users again. See the
[Console Access Page](/docs/auditor/10.8/accessreviews/admin/configuration/consoleaccess.md) topic for additional information.
-**Step 4 –** It will be necessary to configure the Notification settings. See the
+**Step 4 –** Configure the Notification settings. See the
[Notifications Page](/docs/auditor/10.8/accessreviews/admin/configuration/notifications.md) topic for additional information.
**Step 5 –** If you have customized your email templates, it will be necessary to copy the Templates
diff --git a/docs/auditor/10.8/accessreviews/owneroverview/confirmationrequest.md b/docs/auditor/10.8/accessreviews/owneroverview/confirmationrequest.md
index f391b23b53..eedd1ba939 100644
--- a/docs/auditor/10.8/accessreviews/owneroverview/confirmationrequest.md
+++ b/docs/auditor/10.8/accessreviews/owneroverview/confirmationrequest.md
@@ -33,7 +33,7 @@ message after authentication:
-"Before we update ownership can you suggest another owner?" Enter possible owners in the textbox.
+"Before updating ownership, can you suggest another owner?" Enter possible owners in the textbox.
Click **Submit** to complete the process.
diff --git a/docs/auditor/10.8/accessreviews/owneroverview/pendingreviews/access.md b/docs/auditor/10.8/accessreviews/owneroverview/pendingreviews/access.md
index 8e9b8f9bbe..28be2715d6 100644
--- a/docs/auditor/10.8/accessreviews/owneroverview/pendingreviews/access.md
+++ b/docs/auditor/10.8/accessreviews/owneroverview/pendingreviews/access.md
@@ -6,8 +6,7 @@ sidebar_position: 10
# Perform an Access Review
-An Access review can be conducted for various types of data repository resources. Follow the steps
-to perform an Access review.
+An Access review can be conducted for various types of data repository resources. To perform an Access review:
**Step 1 –** On the Pending Reviews page, select the resource with a pending Access review and click
**Begin Review**. The Resource Review page opens to the 1 Make changes tab.
@@ -22,8 +21,8 @@ The table displays access information for the resource being reviewed:
- Access Level (Full Control, Modify, and Read) columns — Blue checkmark icon indicates current
access level
-**Step 2 –** Recommend access changes for a trustee by clicking the icon for the desired access
-level (Full Control, Modify, or Read columns). A yellow checkmark icon indicates the new level of
+**Step 2 –** Recommend access changes for a trustee by clicking the icon for the access level you
+want (Full Control, Modify, or Read columns). A yellow checkmark icon indicates the new level of
access you are recommending.
**Step 3 –** Recommend removing access by selecting one or more trustees and clicking the **Remove
diff --git a/docs/auditor/10.8/accessreviews/owneroverview/pendingreviews/membership.md b/docs/auditor/10.8/accessreviews/owneroverview/pendingreviews/membership.md
index 8c9ff1b678..ac4ab8b2ce 100644
--- a/docs/auditor/10.8/accessreviews/owneroverview/pendingreviews/membership.md
+++ b/docs/auditor/10.8/accessreviews/owneroverview/pendingreviews/membership.md
@@ -6,8 +6,7 @@ sidebar_position: 20
# Perform a Membership Review
-A Membership review is an evaluation of group membership. Follow the steps to perform a Membership
-review.
+A Membership review is an evaluation of group membership. To perform a Membership review:
**Step 1 –** On the Pending Reviews page, select the resource with a pending Membership review and
click **Begin Review**. The Resource Review page opens to the 1 Make changes tab.
diff --git a/docs/auditor/10.8/accessreviews/owneroverview/pendingreviews/pendingreviews.md b/docs/auditor/10.8/accessreviews/owneroverview/pendingreviews/pendingreviews.md
index f327e70819..988c80de92 100644
--- a/docs/auditor/10.8/accessreviews/owneroverview/pendingreviews/pendingreviews.md
+++ b/docs/auditor/10.8/accessreviews/owneroverview/pendingreviews/pendingreviews.md
@@ -73,8 +73,8 @@ features:
- Save Changes — Saves all recommended changes, enabling you to leave the review in progress and
return at a later time to complete it. It opens the Saving review window, which displays a status
for the action.
-- Remove Access — On the 1 Make changes tab, removes access from the selected trustees. Ctrl-click
- can be used for multi-select. Current access blue icon with a checkmark will turn to an empty
+- Remove Access — On the 1 Make changes tab, removes access from the selected trustees. Use Ctrl-click
+ for multi-select. Current access blue icon with a checkmark will turn to an empty
yellow icon.
- Only show changes since last review — Scopes the table to only display those items that have been
modified since the last review instance
diff --git a/docs/auditor/10.8/accessreviews/resourceowners/confirmation/confirm.md b/docs/auditor/10.8/accessreviews/resourceowners/confirmation/confirm.md
index 0ace1242a0..6bf1beaaf8 100644
--- a/docs/auditor/10.8/accessreviews/resourceowners/confirmation/confirm.md
+++ b/docs/auditor/10.8/accessreviews/resourceowners/confirmation/confirm.md
@@ -13,27 +13,27 @@ Owners interface. It can be opened for one or multiple resources.
It contains one page:
-- 1. Select Owners — Lists the current owner(s) for each selected resource and confirmation status
+- 1. Select Owners — Lists the current owners for each selected resource and confirmation status
## Request Ownership Confirmation
-Follow the steps to request ownership confirmation.
+To request ownership confirmation:
-**Step 1 –** In the Resource Owners interface, select the desired resource or resources and click
+**Step 1 –** In the Resource Owners interface, select the resource or resources you want to request confirmation for and click
Request Confirmation. The Confirm Ownership wizard opens.
-**Step 2 –** On the Select Owners page, you can optionally remove owners you do not want or need
+**Step 2 –** On the Select Owners page, you can optionally remove owners you don't want or need
ownership confirmation from. Select those owners and click **Remove**. Those owners will not receive
-the confirmation email. Once the list is set as desired, click **Finish**. The Access Reviews
+the confirmation email. When the list is set as you want, click **Finish**. The Access Reviews
application begins to send the confirmation email. The table provides the following information:
- Resource Name — The icon indicates the type of resource. The resource name includes its location,
such as the UNC path for a file system resource, the URL for SharePoint resource, or Group name
(e.g., [Domain]\[Group]).
- Owner Name — Name of the assigned owner
-- Confirmed — Indicates whether or not the assigned owner has confirmed ownership of that resource.
+- Confirmed — Indicates whether the assigned owner has confirmed ownership of that resource.
Tool-tips display when hovering over the icons indicating whether the resource ownership has been
confirmed, declined, pending response, or that a confirmation has not been requested.
diff --git a/docs/auditor/10.8/accessreviews/resourceowners/confirmation/confirmation.md b/docs/auditor/10.8/accessreviews/resourceowners/confirmation/confirmation.md
index a495247680..0246552081 100644
--- a/docs/auditor/10.8/accessreviews/resourceowners/confirmation/confirmation.md
+++ b/docs/auditor/10.8/accessreviews/resourceowners/confirmation/confirmation.md
@@ -8,7 +8,7 @@ sidebar_position: 20
The reason for assigning owners to resources is to enable those resources to be included in reviews,
or attestations, conducted through the application. In order for this to work, the assigned owner
-needs to claim that ownership responsibility. Resources that do not have confirmed owners may fall
+needs to claim that ownership responsibility. Resources that don't have confirmed owners may fall
through the cracks.
**NOTE:** This does require the Notification settings to be configured for the Access Reviews
@@ -27,7 +27,7 @@ this column to indicate the owner confirmation status:
|  | Confirmed | Indicates the assigned owner confirmed ownership of the resource. Hover over the icon to view the date timestamp of the confirmation. |
|  | Declined | Indicates the assigned owner declined ownership of the resource. These individuals would have been asked to suggest an alternative owner. Check the Notes for the resource to view this information. Hover over the icon to view the date timestamp of the decline. _Remember,_ a resource with declined ownership needs to be updated to assign a new owner. See the [Update Resource Wizard](/docs/auditor/10.8/accessreviews/resourceowners/interface/update.md) topic for additional information. |
-If multiple owners have been assigned, there is a choice for which assigned owner(s) should receive
+If multiple owners have been assigned, there is a choice for which assigned owners should receive
the confirmation. If multiple owners were sent the request, the column remains as a waiting symbol
until the assigned Primary owner replies.
diff --git a/docs/auditor/10.8/accessreviews/resourceowners/interface/add.md b/docs/auditor/10.8/accessreviews/resourceowners/interface/add.md
index bac0fb6248..c7e27d99a2 100644
--- a/docs/auditor/10.8/accessreviews/resourceowners/interface/add.md
+++ b/docs/auditor/10.8/accessreviews/resourceowners/interface/add.md
@@ -21,7 +21,7 @@ See the Add a Resource topic for additional information.
## Add a Resource
-Follow the steps to add resources one at a time and assign owners.
+To add resources one at a time and assign owners:
**Step 1 –** In the Resource Owners interface, click **Add**. The Add new resource wizard opens.
@@ -36,8 +36,7 @@ Follow the steps to add resources one at a time and assign owners.
- For example, http://farm.corp.com
- For groups, enter the group name in NTAccount format [DOMAIN\GROUP]
- For example, acme\app.group
-- Browse option – Navigate through the resource tree to select the desired File System or SharePoint
- resource.
+- Browse option – Navigate through the resource tree to select the File System or SharePoint resource you want.
@@ -58,7 +57,7 @@ the owners:
- Owner Mail — Trustee's email address as read from Active Directory
- Owner Title — Trustee's title as read from Active Directory
- Owner Department — Trustee's department as read from Active Directory
-- Confirmed — Indicates whether or not the assigned owner has confirmed ownership of that resource.
+- Confirmed — Indicates whether the assigned owner has confirmed ownership of that resource.
Tool-tips display when hovering over the icons indicating whether the resource ownership has been
confirmed, declined, pending response, or that a confirmation has not been requested.
diff --git a/docs/auditor/10.8/accessreviews/resourceowners/interface/addowner.md b/docs/auditor/10.8/accessreviews/resourceowners/interface/addowner.md
index aa8656dc06..94b3926ab4 100644
--- a/docs/auditor/10.8/accessreviews/resourceowners/interface/addowner.md
+++ b/docs/auditor/10.8/accessreviews/resourceowners/interface/addowner.md
@@ -13,6 +13,6 @@ browsing Active Directory.
Enter a name in the search field to find and select users from Active Directory, which populates in
-a drop-down menu as you type. If multiple domains are known to the application, ensure the correct
-domain is selected from the drop-down menu. Click **OK** and the Add Owner window closes. The
+a dropdown menu as you type. If multiple domains are known to the application, ensure the correct
+domain is selected from the dropdown menu. Click **OK** and the Add Owner window closes. The
selected user appears in the Owner list.
diff --git a/docs/auditor/10.8/accessreviews/resourceowners/interface/confirmremoval.md b/docs/auditor/10.8/accessreviews/resourceowners/interface/confirmremoval.md
index ef4f2f1cd6..c78eda55f2 100644
--- a/docs/auditor/10.8/accessreviews/resourceowners/interface/confirmremoval.md
+++ b/docs/auditor/10.8/accessreviews/resourceowners/interface/confirmremoval.md
@@ -6,17 +6,17 @@ sidebar_position: 40
# Confirm Removal Window
-The process of removing a resource from the Resource Owners interface disassociates the owner(s)
-from the resource, it does not remove the resource from the database or from the available reports.
+The process of removing a resource from the Resource Owners interface disassociates the owners
+from the resource, it doesn't remove the resource from the database or from the available reports.
Any history of actions performed by the owner for that resource will be maintained, but pending
actions will be canceled. Pending actions may include s outstanding reviews.
-Follow the steps to remove a resource from being managed through the application.
+To remove a resource from being managed through the application:
**Step 1 –** In the Resource Owners interface, select the resource and click Remove. The Confirm
Removal window opens.
-
+
**Step 2 –** Click Yes to complete the removal process or **No** to cancel it.
diff --git a/docs/auditor/10.8/accessreviews/resourceowners/interface/interface.md b/docs/auditor/10.8/accessreviews/resourceowners/interface/interface.md
index ca0cebd3a0..eab22ad783 100644
--- a/docs/auditor/10.8/accessreviews/resourceowners/interface/interface.md
+++ b/docs/auditor/10.8/accessreviews/resourceowners/interface/interface.md
@@ -21,11 +21,11 @@ The information displayed in the table includes:
information.
- Owner Name – Name of the assigned owner. If there are several owners of a resource, the list is
comma-separated.
-- Status – Indicates whether or not the assigned owner has confirmed ownership of that resource.
+- Status – Indicates whether the assigned owner has confirmed ownership of that resource.
Tool-tips display when hovering over the icons indicating whether the resource ownership has been
confirmed, declined, pending response, or that a confirmation has not been requested. See the
[Ownership Confirmation](/docs/auditor/10.8/accessreviews/resourceowners/confirmation/confirmation.md) topic for additional information.
-- Notes – Icon indicates a Note has been added. Click on the icon to read the attached note(s).
+- Notes – Icon indicates a Note has been added. Click the icon to read the attached notes.
Notes can be added by Ownership Administrators or populated with alternative owners by individuals
who declined ownership. See the [Edit Notes Window](/docs/auditor/10.8/accessreviews/admin/navigate/editnotes.md) and the Notes &
Descriptions topics for additional information.
@@ -34,7 +34,7 @@ The information displayed in the table includes:
review instance. See the
[Review Details Page](/docs/auditor/10.8/accessreviews/entitlementreviews/interface/interface.md#review-details-page) topic for additional
information.
-- Active Review – Indicates whether or not there is a pending review. The hyperlink will open the
+- Active Review – Indicates whether there is a pending review. The hyperlink will open the
Entitlement Reviews interface to that Review Details page displaying the active review instance.
See the [Review Details Page](/docs/auditor/10.8/accessreviews/entitlementreviews/interface/interface.md#review-details-page) topic for
additional information.
@@ -42,16 +42,16 @@ The information displayed in the table includes:
The table data grid functions the same way as other table grids. See the
[Data Grid Features](/docs/auditor/10.8/accessreviews/admin/navigate/datagrid.md) topic for additional information.
-The buttons at the bottom enable you to conduct the following actions:
+The buttons at the bottom let you conduct the following actions:
| Button | Function |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Add | Launches the Add new resource wizard to add a new resource to the list. This allows you to add one resource at a time and assign an owner. See the [Add New Resource Wizard](/docs/auditor/10.8/accessreviews/resourceowners/interface/add.md) topic for additional information. |
-| Update | Launches the Update resource wizard for the selected resource. This allows you to make changes to the assigned owners or add/edit the resource description. See the [Update Resource Wizard](/docs/auditor/10.8/accessreviews/resourceowners/interface/update.md) topic for additional information. |
-| Remove | Opens the Confirm removal window to removes the selected resource from being managed through the application. _Remember,_ only resources with an assigned owner will be visible in the table. Removing a resource from this table does not delete the resource from the application database. See the [Confirm Removal Window](/docs/auditor/10.8/accessreviews/resourceowners/interface/confirmremoval.md) topic for additional information. |
-| Request Confirmation | Opens the Confirm Ownership wizard. Sends an email to the assigned owner(s) for the selected resource requesting ownership confirmation. See the[Confirm Ownership Wizard](/docs/auditor/10.8/accessreviews/resourceowners/confirmation/confirm.md) topic for additional information. |
+| Add | Launches the Add new resource wizard to add a new resource to the list. You can add one resource at a time and assign an owner. See the [Add New Resource Wizard](/docs/auditor/10.8/accessreviews/resourceowners/interface/add.md) topic for additional information. |
+| Update | Launches the Update resource wizard for the selected resource. You can make changes to the assigned owners or add/edit the resource description. See the [Update Resource Wizard](/docs/auditor/10.8/accessreviews/resourceowners/interface/update.md) topic for additional information. |
+| Remove | Opens the Confirm removal window to removes the selected resource from being managed through the application. _Remember,_ only resources with an assigned owner will be visible in the table. Removing a resource from this table doesn't delete the resource from the application database. See the [Confirm Removal Window](/docs/auditor/10.8/accessreviews/resourceowners/interface/confirmremoval.md) topic for additional information. |
+| Request Confirmation | Opens the Confirm Ownership wizard. Sends an email to the assigned owners for the selected resource requesting ownership confirmation. See the[Confirm Ownership Wizard](/docs/auditor/10.8/accessreviews/resourceowners/confirmation/confirm.md) topic for additional information. |
| Edit Notes | Opens the Edit Notes window for the selected resource and allows free-text editing of the notes. See the [Edit Notes Window](/docs/auditor/10.8/accessreviews/admin/navigate/editnotes.md) topic for additional information. |
## Notes & Descriptions
diff --git a/docs/auditor/10.8/accessreviews/resourceowners/interface/update.md b/docs/auditor/10.8/accessreviews/resourceowners/interface/update.md
index 09010f416f..13b5333255 100644
--- a/docs/auditor/10.8/accessreviews/resourceowners/interface/update.md
+++ b/docs/auditor/10.8/accessreviews/resourceowners/interface/update.md
@@ -12,7 +12,7 @@ The Update resource wizard is opened with the **Update** button in the Resource
It contains three pages:
-- 1. Select Owners — Lists the current owner(s). Modify by adding new owners, removing owners, or
+- 1. Select Owners — Lists the current owners. Modify by adding new owners, removing owners, or
changing owner priority order (primary, secondary, etc.)
- 2. Description — Enter or modify a note describing the resource
- 3. Summary — Provides a preview of the settings selected within the wizard
@@ -21,14 +21,14 @@ See the Update a Resource topic for additional information.
## Update a Resource
-Follow the steps to update ownership configuration for a resource.
+To update ownership configuration for a resource:
-**Step 1 –** In the Resource Owners interface, select the desired resource and click **Update**. The
+**Step 1 –** In the Resource Owners interface, select the resource you want to update and click **Update**. The
Update resource wizard opens.
-**Step 2 –** The Select Owners page lists the currently assigned owner(s). Modify as desired and
+**Step 2 –** The Select Owners page lists the assigned owners. Modify as desired and
click **Next** to continue.
- Add new owners — Click **Add** to browse for a new owner. See the
@@ -44,14 +44,14 @@ information on the owners:
- Owner Mail — Trustee's email address as read from Active Directory
- Owner Title — Trustee's title as read from Active Directory
- Owner Department — Trustee's department as read from Active Directory
-- Confirmed — Indicates whether or not the assigned owner has confirmed ownership of that resource.
+- Confirmed — Indicates whether the assigned owner has confirmed ownership of that resource.
Tool-tips display when hovering over the icons indicating whether the resource ownership has been
confirmed, declined, pending response, or that a confirmation has not been requested.
**Step 3 –** The Description page displays any description that has been provided by either the
-Ownership Administrator or the assigned owner(s) for the resource. Modify as desired by typing in
+Ownership Administrator or the assigned owners for the resource. Modify as desired by typing in
the textbox. Then click **Next** to continue.
diff --git a/docs/auditor/10.8/accessreviews/resourceowners/overview.md b/docs/auditor/10.8/accessreviews/resourceowners/overview.md
index 61a49337de..5338c3b342 100644
--- a/docs/auditor/10.8/accessreviews/resourceowners/overview.md
+++ b/docs/auditor/10.8/accessreviews/resourceowners/overview.md
@@ -8,7 +8,7 @@ sidebar_position: 30
The Resource Owners interface is where Access Reviews Console users with either the Security Team or
Administrator role (to be referred to as Ownership Administrators) can assign ownership of resources
-to be managed through the application. Assigned owners do not require a console user role. Resources
+to be managed through the application. Assigned owners don't require a console user role. Resources
to be included in the Access Reviews workflow must first be assigned owners within the Resource
Owners interface.
@@ -70,7 +70,7 @@ Prerequisite:
Workflow:
-**NOTE:** This workflow is not numbered because the Notification piece can occur at any time in the
+**NOTE:** This workflow isn't numbered because the Notification piece can occur at any time in the
workflow.
- Add resources to be managed by associating a business data owner with a resource. See the
diff --git a/docs/auditor/10.8/accountlockoutexaminer/configure.md b/docs/auditor/10.8/accountlockoutexaminer/configure.md
index 02751fa1d2..4e8cb9c8af 100644
--- a/docs/auditor/10.8/accountlockoutexaminer/configure.md
+++ b/docs/auditor/10.8/accountlockoutexaminer/configure.md
@@ -11,7 +11,7 @@ environment, as described in this section.
## System requirements
-Make sure that the machine where you plan install the solution meets the system requirements listed
+Ensure that the machine where you plan install the solution meets the system requirements listed
below.
**Hardware:**
@@ -73,7 +73,7 @@ lockout reason detection:
### Inbound firewall rules
-Make sure the following **Inbound** firewall rules are enabled on the Domain Controllers and domain
+Ensure the following **Inbound** firewall rules are enabled on the Domain Controllers and domain
computers:
- File and Printer Sharing (Echo Request - ICMPv4-In)
diff --git a/docs/auditor/10.8/accountlockoutexaminer/overview.md b/docs/auditor/10.8/accountlockoutexaminer/overview.md
index ed09f54f50..5fcf1aaf11 100644
--- a/docs/auditor/10.8/accountlockoutexaminer/overview.md
+++ b/docs/auditor/10.8/accountlockoutexaminer/overview.md
@@ -25,18 +25,16 @@ You can investigate lockouts originating from the following sources:
## Upgrade recommendations
-Since the functionality of older and newer versions does not match one-to-one (see Feature
+Since the functionality of older and newer versions doesn't match one-to-one (see Feature
comparison of Netwrix Account Lockout Examiner 4.1 and 5.x), there is no upgrade path for **Netwrix
Account Lockout Examiner 4.1**.
-Though its users can continue working with that older version, we recommend to use the latest
-Netwrix Account Lockout Examiner to benefit from the variety of its new features and enhanced
-usability.
+Though its users can continue working with that older version, the latest Netwrix Account Lockout Examiner is recommended to benefit from the variety of its new features and enhanced usability.
## Feature comparison of Netwrix Account Lockout Examiner 4.1 and 5.x
-Netwrix Account Lockout Examiner 5.1 and later is not an evolutionary update, but rather a total
-revamp of version 4.1. Hence, the functionality of the older and newer versions does not match
+Netwrix Account Lockout Examiner 5.1 and later isn't an evolutionary update, but rather a total
+revamp of version 4.1. Hence, the functionality of the older and newer versions doesn't match
one-to-one. Feature comparison is provided in the table below.
| Feature | Version 4.1 | Version 5.x |
@@ -64,7 +62,7 @@ one-to-one. Feature comparison is provided in the table below.
Users of Account Lockout Examiner 4.1 can continue using that older version, as there is no upgrade
path, just a new installation of the latest version.
-We welcome any feedback and ideas you might have. You can check in on
+Feedback and ideas are welcome. You can check in on
[Netwrix page at Spiceworks](https://community.spiceworks.com/pages/NetWrix?tab=353) or submit
direct feedback via
-[this link](https://community.spiceworks.com/products/47099-netwrix-account-lockout-examiner).
+[Netwrix Account Lockout Examiner feedback page](https://community.spiceworks.com/products/47099-netwrix-account-lockout-examiner).
diff --git a/docs/auditor/10.8/accountlockoutexaminer/usage.md b/docs/auditor/10.8/accountlockoutexaminer/usage.md
index f4d51a77ac..346b3d7fa4 100644
--- a/docs/auditor/10.8/accountlockoutexaminer/usage.md
+++ b/docs/auditor/10.8/accountlockoutexaminer/usage.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Examining Lockouts
-To start using **Netwrix Account Lockout Examiner**, download it from Netwrix web site. Once the
+To start using **Netwrix Account Lockout Examiner**, download it from Netwrix web site. After the
download completes, run the executable from your browser menu or from your **Downloads** folder.
To find out why an Active Directory account was locked out, perform the following steps:
@@ -26,7 +26,7 @@ To find out why an Active Directory account was locked out, perform the followin
-Once the examination completes, you will be presented with a list of reasons why the account you
+After the examination completes, you will be presented with a list of reasons why the account you
supplied is being locked out.
## Modifying product settings
@@ -36,7 +36,7 @@ After you click **Settings** in the main window, you can apply the following opt
| Option | Description | Default |
| ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| **Examining** | | |
-| Skip unresolved IP addresses | For safety reasons, Netwrix Account Lockout Examiner by default does not connect to the unknown and potentially dangerous IP addresses. See [this Knowledge Base article](https://kb.netwrix.com/5810) for more information. | Enabled |
+| Skip unresolved IP addresses | For safety reasons, Netwrix Account Lockout Examiner by default doesn't connect to the unknown and potentially dangerous IP addresses. See [this Knowledge Base article](https://kb.netwrix.com/5810) for more information. | Enabled |
| Examine all domain controllers | Select this option if you want to examine all domain controllers to detect potential lockout reason. | Disabled |
| **Usage statistics** | | |
| Take part in Netwrix Customer Experience Improvement program | Select this option to participate in the program. See [this Knowledge Base article](https://kb.netwrix.com/5820) for more information on the program. | |
@@ -50,12 +50,12 @@ Lockout Examiner\Logs_ folder.
| Symptom | Cause | Solution |
| --------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| In the environments with root/child domains, you may receive the "_Could not query ComputerName. Access is denied_." error. | The account used to run Netwrix Account Lockout Examiner is not a member of the local **Administrators** group on the workstations in both root and child domains. Administrative rights are required to access the Security Event logs on these workstations. | Make sure this account is included in the local **Administrators** group. |
-| **Issues encountered during examination** section is shown in the examination results. | Most probably this means that **Netwrix Account Lockout Examiner** cannot reach some of the data sources it needs. | - Check that you have configured the audit settings in the target domain as described in [Required audit settings](configure.md#required-audit-settings) section. - Check that network connectivity between the Account Lockout Examiner machine and the domain controllers in your domain works properly. |
+| In the environments with root/child domains, you may receive the "_Could not query ComputerName. Access is denied_." error. | The account used to run Netwrix Account Lockout Examiner isn't a member of the local **Administrators** group on the workstations in both root and child domains. Administrative rights are required to access the Security Event logs on these workstations. | ensure this account is included in the local **Administrators** group. |
+| **Issues encountered during examination** section is shown in the examination results. | Most probably this means that **Netwrix Account Lockout Examiner** can't reach some of the data sources it needs. | - Check that you have configured the audit settings in the target domain as described in [Required audit settings](configure.md#required-audit-settings) section. - Check that network connectivity between the Account Lockout Examiner machine and the domain controllers in your domain works properly. |
-We welcome any feedback and ideas you might have. Please take a minute to check in on
+Feedback and ideas are welcome. Take a minute to check in on
[Netwrix page at Spiceworks](https://community.spiceworks.com/pages/NetWrix?tab=353) or submit
direct feedback via
-[this link](https://community.spiceworks.com/products/47099-netwrix-account-lockout-examiner).
+[Netwrix Account Lockout Examiner feedback page](https://community.spiceworks.com/products/47099-netwrix-account-lockout-examiner).
diff --git a/docs/auditor/10.8/addon/alienvaultusm/automate.md b/docs/auditor/10.8/addon/alienvaultusm/automate.md
index 565034bb6e..c4940d8d9c 100644
--- a/docs/auditor/10.8/addon/alienvaultusm/automate.md
+++ b/docs/auditor/10.8/addon/alienvaultusm/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.8/addon/alienvaultusm/integrationeventlog.md b/docs/auditor/10.8/addon/alienvaultusm/integrationeventlog.md
index 1b9df219ad..f2e9bbf491 100644
--- a/docs/auditor/10.8/addon/alienvaultusm/integrationeventlog.md
+++ b/docs/auditor/10.8/addon/alienvaultusm/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.8/addon/alienvaultusm/overview.md b/docs/auditor/10.8/addon/alienvaultusm/overview.md
index 08f8876dc8..5e27303130 100644
--- a/docs/auditor/10.8/addon/alienvaultusm/overview.md
+++ b/docs/auditor/10.8/addon/alienvaultusm/overview.md
@@ -46,5 +46,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.8/addon/alienvaultusm/parameters.md b/docs/auditor/10.8/addon/alienvaultusm/parameters.md
index c8a8661531..2b091cd29a 100644
--- a/docs/auditor/10.8/addon/alienvaultusm/parameters.md
+++ b/docs/auditor/10.8/addon/alienvaultusm/parameters.md
@@ -31,10 +31,10 @@ dynamically calculated EventIDs will be modified and applied incorrectly.
| Parameter | Default value | Description |
| -------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId\* | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to _TRUE_. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
\* When configuring the **IncludeDataSourceToMakeEventId** parameter, consider that the _Object
Type - Action_ pair may be identical for several data sources (e.g., Object='User' and
diff --git a/docs/auditor/10.8/addon/alienvaultusm/powershell.md b/docs/auditor/10.8/addon/alienvaultusm/powershell.md
index f066d2b7b0..a162f95b94 100644
--- a/docs/auditor/10.8/addon/alienvaultusm/powershell.md
+++ b/docs/auditor/10.8/addon/alienvaultusm/powershell.md
@@ -11,11 +11,11 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
+To run the add-on with PowerShell:
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -55,7 +55,7 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
first run. At the end of the first run, the timestamp will be created, and the next run will start
diff --git a/docs/auditor/10.8/addon/amazonwebservices/automate.md b/docs/auditor/10.8/addon/amazonwebservices/automate.md
index 3f94bb6b1e..b8ba174fdf 100644
--- a/docs/auditor/10.8/addon/amazonwebservices/automate.md
+++ b/docs/auditor/10.8/addon/amazonwebservices/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.8/addon/amazonwebservices/collecteddata.md b/docs/auditor/10.8/addon/amazonwebservices/collecteddata.md
index b692a9f7ab..f9c2e1ebfc 100644
--- a/docs/auditor/10.8/addon/amazonwebservices/collecteddata.md
+++ b/docs/auditor/10.8/addon/amazonwebservices/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data.
+To work with collected data:
**Step 1 –** Start the Auditor client and navigate to **Search**.
diff --git a/docs/auditor/10.8/addon/amazonwebservices/overview.md b/docs/auditor/10.8/addon/amazonwebservices/overview.md
index bb8853d45e..90fdba42e0 100644
--- a/docs/auditor/10.8/addon/amazonwebservices/overview.md
+++ b/docs/auditor/10.8/addon/amazonwebservices/overview.md
@@ -7,10 +7,10 @@ sidebar_position: 20
# Amazon Web Services
Amazon Web Services (AWS) provides a wide range of cloud-based services, including solutions and
-management tools for virtualization, data storage and hosting, private networking, relational and
-NoSQL databases, and many more. AWS CloudTrail is an internal tracking service that records AWS API
-calls. Companies leverage this information for analyzing user activity patterns and detecting
-potential threats. Unfortunately, collected audit data cannot be used for future reference: AWS
+management tools for virtualization, data storage and hosting, private networking, relational, and
+NoSQL databases, and many other features. AWS CloudTrail is an internal tracking service that records AWS API
+calls. Companies use this information to analyze user activity patterns and detect
+potential threats. Unfortunately, collected audit data can't be used for future reference: AWS
CloudTrail stores events for 7 days allowing administrators and security analysts to review data for
only short time periods.
@@ -30,7 +30,7 @@ On a high level, the add-on works as follows:
- The add-on processes these events into Netwrix Auditor-compatible format (Activity Records). Each
Activity Record contains the user account, action, time, and other details.
- Currently, Netwrix Auditor processes details for the following AWS events (other events can be
+ Netwrix Auditor processes details for the following AWS events (other events can be
imported without details):
| | | | |
@@ -46,7 +46,7 @@ See the [Integration API](/docs/auditor/10.8/api/overview.md) topic for addition
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging the Integration API. Download the latest add-on version in the Add-on Store.
See the [Integration API](/docs/auditor/10.8/api/overview.md) topic for additional information about schema
diff --git a/docs/auditor/10.8/addon/amazonwebservices/parameters.md b/docs/auditor/10.8/addon/amazonwebservices/parameters.md
index 408bcbc967..41593bd0f4 100644
--- a/docs/auditor/10.8/addon/amazonwebservices/parameters.md
+++ b/docs/auditor/10.8/addon/amazonwebservices/parameters.md
@@ -21,10 +21,10 @@ modify the parameters as required.
| ---------------------- | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| AWSSDKInstallPath | 'C:\Program Files (x86)\AWS SDK for .NET' | Assumes that AWS SDK for .NET is installed by its default path. To specify another location, provide a path in single quotes (e.g., '_C:\Program Files (x86)\My SDKs\AWS SDK for .NET_'). |
| ImportAllEvents | — | By default, only events with processed details will be imported. To import all events, set the switch during the add-on execution. **NOTE:** Importing all events makes audit data less human-readable. |
-| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add- on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer,WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). |
+| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer,WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). |
| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format. **NOTE:** The account must be assigned the **Contributor** role in Auditor. |
| NetwrixAuditorPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
-| NetwrixAuditorPlan | — | Unless specified, data is written to the **Netwrix\_ Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. **NOTE:** If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the **Netwrix API** data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the **Audit Database**. |
+| NetwrixAuditorPlan | — | Unless specified, data is written to the **Netwrix\_ Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. **NOTE:** If you select a plan name in the add-on, ensure a dedicated plan is created in Auditor, the **Netwrix API** data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the **Audit Database**. |
## Update In-Script Parameters
diff --git a/docs/auditor/10.8/addon/amazonwebservices/powershell.md b/docs/auditor/10.8/addon/amazonwebservices/powershell.md
index 515847bf2b..f9b8e9e3fd 100644
--- a/docs/auditor/10.8/addon/amazonwebservices/powershell.md
+++ b/docs/auditor/10.8/addon/amazonwebservices/powershell.md
@@ -6,11 +6,11 @@ sidebar_position: 30
# Run the Add-On with PowerShell
-Follow the steps to run add-on with PowerShell:
+To run the add-on with PowerShell:
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
diff --git a/docs/auditor/10.8/addon/arcsight/automate.md b/docs/auditor/10.8/addon/arcsight/automate.md
index a853cd56d1..92b02a7539 100644
--- a/docs/auditor/10.8/addon/arcsight/automate.md
+++ b/docs/auditor/10.8/addon/arcsight/automate.md
@@ -16,7 +16,7 @@ running the add-on.
**Step 2 –** Select **Create Task**.
**Step 3 –** On the **General** tab, specify a task name, e.g., Netwrix Auditor Add-on for ArcSight.
-Make sure the account that runs the task has all necessary rights and permissions.
+Ensure the account that runs the task has all necessary rights and permissions.
**Step 4 –** On the **Triggers** tab, **click** New and define the schedule. This option controls
how often audit data is exported from Auditor and transferred to ArcSight Logger. Netwrix recommends
diff --git a/docs/auditor/10.8/addon/arcsight/collecteddata.md b/docs/auditor/10.8/addon/arcsight/collecteddata.md
index 739b67d6b1..41d21e4433 100644
--- a/docs/auditor/10.8/addon/arcsight/collecteddata.md
+++ b/docs/auditor/10.8/addon/arcsight/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to see collected data.
+To see collected data:
**Step 1 –** Log on to your ArcSight Logger web interface.
diff --git a/docs/auditor/10.8/addon/arcsight/overview.md b/docs/auditor/10.8/addon/arcsight/overview.md
index 0501bb039a..192033bf89 100644
--- a/docs/auditor/10.8/addon/arcsight/overview.md
+++ b/docs/auditor/10.8/addon/arcsight/overview.md
@@ -44,7 +44,7 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging the Integration API. Download the latest add-on version in the Add-on Store. See the
[Integration API](/docs/auditor/10.8/api/overview.md)topic for additional information.
diff --git a/docs/auditor/10.8/addon/arcsight/parameters.md b/docs/auditor/10.8/addon/arcsight/parameters.md
index ed3a87e289..164a12cd57 100644
--- a/docs/auditor/10.8/addon/arcsight/parameters.md
+++ b/docs/auditor/10.8/addon/arcsight/parameters.md
@@ -20,7 +20,7 @@ modify the parameters as required.
| Parameter or switch | Default value | Description |
| ---------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| TCP | – | By default, UDP protocol is used. Specify the switch during the add-on execution if you want to use TCP protocol for transferring data. Via UDP, events will be sent one by one, via TCP— in a batch. |
-| ArcSightHost | – | Provide a name of the computer where ArcSight resides (e.g., 172.28.6.18, ArcSightSRV, ArcSightSRV.enterprise.local). **NOTE:** This is a mandatory parameter. Unless specified, the add- on assumes that the default port 514 is used for UDP and 515 for TCP. To specify a non-default port, provide a server name followed by the port number (e.g., _ArcSightSRV.enterprise.local:9998_). |
-| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add- on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). |
+| ArcSightHost | – | Provide a name of the computer where ArcSight resides (e.g., 172.28.6.18, ArcSightSRV, ArcSightSRV.enterprise.local). **NOTE:** This is a mandatory parameter. Unless specified, the add-on assumes that the default port 514 is used for UDP and 515 for TCP. To specify a non-default port, provide a server name followed by the port number (e.g., _ArcSightSRV.enterprise.local:9998_). |
+| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). |
| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format. **NOTE:** The account must be assigned the **Global reviewer** role in Netwrix Auditor or be a member of the **Netwrix Auditor Client Users** group on the computer hosting Auditor Server. |
| NetwrixAuditorPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
diff --git a/docs/auditor/10.8/addon/arcsight/powershell.md b/docs/auditor/10.8/addon/arcsight/powershell.md
index 7718acf4af..90d18d19fc 100644
--- a/docs/auditor/10.8/addon/arcsight/powershell.md
+++ b/docs/auditor/10.8/addon/arcsight/powershell.md
@@ -6,11 +6,9 @@ sidebar_position: 30
# Run the Add-On with PowerShell
-Follow the steps to run add-on with PowerShell:
-
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -25,7 +23,10 @@ quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Ad
Depending on the number of Activity Records stored in the Audit Database execution may take a while.
Ensure the script execution completed successfully. As a result, data will be exported to ArcSight.
-Note that events exceeding 4000 symbols are trimmed.
+
+:::note
+Events exceeding 4000 symbols are trimmed.
+:::
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records.
diff --git a/docs/auditor/10.8/addon/azuresqlmi/collecteddata.md b/docs/auditor/10.8/addon/azuresqlmi/collecteddata.md
index ba57848114..6d5ce941b8 100644
--- a/docs/auditor/10.8/addon/azuresqlmi/collecteddata.md
+++ b/docs/auditor/10.8/addon/azuresqlmi/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected with the add-on, you can do the following in Auditor:
- **Search for required data**. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.8/addon/azuresqlmi/deployment.md b/docs/auditor/10.8/addon/azuresqlmi/deployment.md
index 70f020ab78..cad4f3cdf3 100644
--- a/docs/auditor/10.8/addon/azuresqlmi/deployment.md
+++ b/docs/auditor/10.8/addon/azuresqlmi/deployment.md
@@ -32,7 +32,7 @@ To integrate with Microsoft Entra ID, you need to create a separate application
- **Description**: "Netwrix Integration Secret"
- **Expires**: Choose appropriate expiration period (recommended: 12-24 months)
4. Click **Add**
-5. **Important**: Copy the secret value - you cannot retrieve it later
+5. **Important**: Copy the secret value - you can't retrieve it later
### 1.3 Configure API Permissions (Optional)
@@ -382,7 +382,7 @@ Run the Netwrix Auditor Add-on Setup Wizard and follow these configuration steps
This Azure SQL Managed Instance add-on is a **free integration solution** for Netwrix Auditor.
-**We value your feedback!** Your experience and suggestions help us improve the add-on. Please share your feedback on:
+Your feedback is valuable! Your experience and suggestions help improve the add-on. Share your feedback on:
- Functionality and features
- Documentation and setup process
- Additional requirements or use cases
diff --git a/docs/auditor/10.8/addon/azuresqlmi/overview.md b/docs/auditor/10.8/addon/azuresqlmi/overview.md
index 8bc6d2694f..185e5c758b 100644
--- a/docs/auditor/10.8/addon/azuresqlmi/overview.md
+++ b/docs/auditor/10.8/addon/azuresqlmi/overview.md
@@ -88,11 +88,11 @@ The add-on captures comprehensive audit data including:
This Azure SQL Managed Instance add-on is a **free integration solution** for Netwrix Auditor.
-**We value your feedback!** Your experience and suggestions help us improve the add-on. Please share your feedback on:
+Your feedback is valuable! Your experience and suggestions help improve the add-on. Share your feedback on:
- Functionality and features
- Documentation and setup process
- Additional requirements or use cases
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.8/addon/connectwise/configure.md b/docs/auditor/10.8/addon/connectwise/configure.md
index aecff8bc58..e4d13f9f7b 100644
--- a/docs/auditor/10.8/addon/connectwise/configure.md
+++ b/docs/auditor/10.8/addon/connectwise/configure.md
@@ -10,8 +10,6 @@ This section describes how to configure settings of the main add-on component, N
**ConnectWise Manage Integration Service** that is required for connection to ConnectWise Manage and
service ticket creation.
-Follow the steps to configure ConnectWise.
-
**Step 1 –** To connect to ConnectWise Manage REST API, the API keys will be required. To obtain
them, you will need an API Member account. See
[this article](https://docs.connectwise.com/ConnectWise_Documentation/090/040/010/040) for details.
diff --git a/docs/auditor/10.8/addon/connectwise/connectionticketingsettings.md b/docs/auditor/10.8/addon/connectwise/connectionticketingsettings.md
index 3bf1f900ca..4070d867ec 100644
--- a/docs/auditor/10.8/addon/connectwise/connectionticketingsettings.md
+++ b/docs/auditor/10.8/addon/connectwise/connectionticketingsettings.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# Connection and Ticketing Settings
-It is recommended that you use configuration wizard to specify connection and ticketing settings.
-However, you can adjust them manually, using the information provided in this section.
+Use the configuration wizard to specify connection and ticketing settings.
+However, you can adjust them manually using the information provided in this section.
## Settings for ConnectWise Ticket Creation
@@ -23,7 +23,7 @@ values are provided. Add more ticket parameters or update values if necessary.
| `` | `` | Description |
| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Summary | [Netwrix Auditor] %AlertName% | Instructs the system to fill in the Summary ticket field with the Auditor alert name (e.g., _[Netwrix Auditor] Password Reset)_. |
-| InitialDescription | Alert Details: Who: %Who% Action: %Action% Object type: %ObjectType% What: %What% When: %When% Where: %Where% Workstation: %Workstation% Details: %Details% Data source: %DataSource% Monitoring plan: %MonitoringPlanName% Item: %Item% Sent by Netwrix Auditor from %Computer% | Instructs the system to fill in the InitialDescription ticket field with the Auditor activity record data. To read more about activity records, see the [Reference for Creating Activity Records](/docs/auditor/10.8/api/activityrecordreference.md) topic for additional information. You may need to fill in the internal description intended for use by MSP only (this description will not be visible to managed clients), perform the following steps: **Step 1 –** Run the configuration wizard (or modify _ConnectWiseSettings.xml_) to specify the settings you need. **Step 2 –** Then open _ConnectWiseSettings.xml_ for edit. **Step 3 –** Locate the **InitialDescription** parameter and change the Name attribute to _initialInternalAnalysis_. |
+| InitialDescription | Alert Details: Who: %Who% Action: %Action% Object type: %ObjectType% What: %What% When: %When% Where: %Where% Workstation: %Workstation% Details: %Details% Data source: %DataSource% Monitoring plan: %MonitoringPlanName% Item: %Item% Sent by Netwrix Auditor from %Computer% | Instructs the system to fill in the InitialDescription ticket field with the Auditor activity record data. See the [Reference for Creating Activity Records](/docs/auditor/10.8/api/activityrecordreference.md) topic for details. To fill in the internal description for MSP use only (not visible to managed clients), perform these steps: **Step 1 –** Run the configuration wizard (or modify _ConnectWiseSettings.xml_) to specify the settings you need. **Step 2 –** Open _ConnectWiseSettings.xml_ for editing. **Step 3 –** Locate the **InitialDescription** parameter and change the Name attribute to _initialInternalAnalysis_. |
| Impact/Urgency | Medium | Instructs the system to set ticket Impact/Urgency to _Medium_. |
## Parameters for Handling Related Tickets
@@ -43,7 +43,7 @@ automatically.
| Name | Description |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ClosedTicketStates TicketState | Lists closed ticket statuses. By default, resolved, closed, and canceled tickets can be reopened. To specify a new status, provide its ID in the `` tag (e.g., 8 for canceled). |
-| NewState | Defines a ticket status once it is reopened. By default, is set to _new_. To specify another status, provide its ID in the `` tag (e.g., _1_ for _new_). |
+| NewState | Defines the ticket status when reopened. By default, set to _new_. To specify another status, provide its ID in the `` tag (e.g., _1_ for _new_). |
When finished, save your changes to configuration file.
@@ -51,8 +51,7 @@ Remember to restart the add-on service every time you update any of configuratio
## Review Other Parameters
-You can update other parameters with your own values if necessary; however, it is recommended that
-you contact Netwrix before modifying this section.
+You can update other parameters with your own values if necessary; however, contact Netwrix before modifying this section.
| Name | Description |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
diff --git a/docs/auditor/10.8/addon/connectwise/deployment.md b/docs/auditor/10.8/addon/connectwise/deployment.md
index 9503cea1c8..be0e2064b5 100644
--- a/docs/auditor/10.8/addon/connectwise/deployment.md
+++ b/docs/auditor/10.8/addon/connectwise/deployment.md
@@ -6,13 +6,11 @@ sidebar_position: 10
# Deploy the Add-On
-Follow the steps to deploy the Add-On for ConnectWise.
-
**Step 1 –** Prepare Auditor for using the add-on:
1. In the Auditor settings, enable Integration API and specify connection port. See the
[Integrations](/docs/auditor/10.8/admin/settings/integrations.md) topic for additional information.
-2. Make sure your monitoring plans set up in Auditor are using Audit Databases to store collected
+2. Ensure your monitoring plans set up in Auditor are using Audit Databases to store collected
data. See the [Audit Database](/docs/auditor/10.8/admin/settings/auditdatabase.md) topic for additional
information.
diff --git a/docs/auditor/10.8/addon/connectwise/operationalsettings.md b/docs/auditor/10.8/addon/connectwise/operationalsettings.md
index 0158fc7200..032ca17ada 100644
--- a/docs/auditor/10.8/addon/connectwise/operationalsettings.md
+++ b/docs/auditor/10.8/addon/connectwise/operationalsettings.md
@@ -8,7 +8,7 @@ sidebar_position: 50
This section describes how to configure settings of the main add-on component, Netwrix Auditor
**ConnectWise Manage Integration Service**, required for its operation, including connection to
-Auditor Server, activity records processing, queuing and forwarding, ticket creation, and so on.
+Auditor Server, activity records processing, queuing, and forwarding, ticket creation, and so on.
For that, follow the steps:
@@ -23,10 +23,10 @@ policies. Use the following format: `value`.
| ----------------------------------- | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| NetwrixAuditorHost | https://localhost:9699 | The add-on runs on the computer where Auditor Server resides and uses the default Integration API port (TCP port **9699**). To specify a non-default port, provide a new port number (e.g., _https://localhost:8788_). The add-on must always run locally, on the computer where Auditor Server resides. |
| NetwrixAuditorUserName | — | Unless specified, the Netwrix Auditor **ConnectWise Manage Integration Service** runs under the LocalSystem account. If you want this service to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format in this parameter value. The user account for running the service and connecting to Auditor Server must be granted the Global administrator role in Auditor or be a member of the Netwrix Auditor **Administrators** group. It must also have sufficient permissions to create files on the local computer. |
-| NetwrixAuditorPassword | — | Provide a password for the account. Unless an account is specified, the service runs under the LocalSystem account and does not require a password. |
+| NetwrixAuditorPassword | — | Provide a password for the account. Unless an account is specified, the service runs under the LocalSystem account and doesn't require a password. |
| TicketFloodLimit | 10 | Specify the maximum number of standalone tickets the service can create during TicketFloodInterval. If a ticket flood limit is reached, the service writes all new alerts into a single ticket. |
| TicketFloodInterval | 3600 | Specify the time period, in seconds. During this time period, the service can create as many tickets as specified in TicketFloodLimit. The default value is 3600 seconds, i.e., 1 hour. |
-| ConsolidationInterval | 900 | Specify the time period, in seconds. During this time period, the service does not process similar alerts as they happen but consolidates them before updating open tickets. The default value is 900 seconds (15 minutes). This option works in combination with UpdateTicketOnRepetitiveAlerts and is helpful if you want to reduce the number of ticket updates on ConnectWise Manage side. That is, this option defines the maximum delay for processing alerts and updating existing tickets. Tickets for new alert types are created immediately. For example, a new alert is triggered—the service opens a new ticket. The alert keeps firing 20 times more within 10 minutes. Instead of updating the ticket every time, the service consolidates alerts for 15 minutes, and then updates a ticket just once with all collected data. |
+| ConsolidationInterval | 900 | Specify the time period, in seconds. During this time period, the service doesn't process similar alerts as they happen but consolidates them before updating open tickets. The default value is 900 seconds (15 minutes). This option works in combination with UpdateTicketOnRepetitiveAlerts and is helpful if you want to reduce the number of ticket updates on ConnectWise Manage side. That is, this option defines the maximum delay for processing alerts and updating existing tickets. Tickets for new alert types are created immediately. For example, a new alert is triggered—the service opens a new ticket. The alert keeps firing 20 times more within 10 minutes. Instead of updating the ticket every time, the service consolidates alerts for 15 minutes, and then updates a ticket just once with all collected data. |
| CheckAlertQueueInterval | 5 | Internal parameter. Check and process the alert queue every N seconds; in seconds. |
| UpdateTicketOnRepetitiveAlerts | true | Instead of creating a new ticket, update an existing active ticket if a similar alert occurs within UpdateInterval. To open a new ticket for every alert, set the parameter to _"false"_. |
| ReopenTicketOnRepetitiveAlerts | true | Instead of creating a new ticket, reopen an existing ticket that is in a closed state (be default, closed, canceled, and resolved) if a similar alert occurs within UpdateInterval. This option works only when UpdateTicketOnRepetitiveAlerts is set to _"true"_. If you want to reopen closed tickets, you must be granted the right to perform Write operations on inactive tickets. |
@@ -36,13 +36,13 @@ policies. Use the following format: `value`.
| ProcessActivityRecord QueueInterval | 5 | Internal parameter. Process activity record queue every N seconds; in seconds. |
| DisplayOnlyFirstActivityRecord | true | Add only the first activity record in the work notes, activity records that update this ticket will be added as attachments to this ticket. If false, all activity records will be displayed in the ticket work notes. |
| ActivityRecordRequestsRetention | | |
-| RequestLimit | 5000 | Internal parameter. The maximum number of activity record requests the service can store in its internal memory. Once the limit is reached, the service clears activity record requests starting with older ones. |
+| RequestLimit | 5000 | Internal parameter. The maximum number of activity record requests the service can store in its internal memory. When the limit is reached, the service clears activity record requests starting with older ones. |
| RequestLimitInterval | 604800 | Internal parameter. The service can store the activity record requests not older than N seconds; in seconds. Older activity record requests are cleared. |
| ActivityRecordWebRequests | | |
| RequestLimit | 200 | Internal parameter. The maximum number of activity records the service can retrieve in a single request. |
| RequestTimeout | 180 | Internal parameter. By default, 3 minutes. Defines the connection timeout. |
| TicketRequestsRetention | | |
-| RequestLimit | 300000 | Internal parameter. The maximum number of ticket requests the service can store in its internal memory. Once the limit is reached, the service clears ticket requests starting with older ones. |
+| RequestLimit | 300000 | Internal parameter. The maximum number of ticket requests the service can store in its internal memory. When the limit is reached, the service clears ticket requests starting with older ones. |
| RequestLimitInterval | 604800 | Internal parameter. The service can store the ticket requests not older than N seconds; in seconds. Older tickets requests are cleared. |
**Step 3 –** Restart the service every time you update ITSMSettings.xml configuration file.
diff --git a/docs/auditor/10.8/addon/connectwise/overview.md b/docs/auditor/10.8/addon/connectwise/overview.md
index d331472235..844c0cb35b 100644
--- a/docs/auditor/10.8/addon/connectwise/overview.md
+++ b/docs/auditor/10.8/addon/connectwise/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# ConnectWise Manage
-Managed Service Providers (MSP) need to effectively utilize and standardize IT service management
+Managed Service Providers (MSP) need to effectively use and standardize IT service management
tools. Those who use for that purpose the ConnectWise Manage solution usually have similar processes
in place:
@@ -43,7 +43,7 @@ On a high level, the workflow is as follows:
2. Whenever the alert is triggered, the add-on uses the Integration API to retrieve activity record
for the original event from the audit store. An activity record contains the user account,
action, time, and other details. The add-on creates a service ticket in ConnectWise Manage,
- populates it with data from the activity record, and assigns Impact, Priority and SLA status to
+ populates it with data from the activity record, and assigns Impact, Priority, and SLA status to
the ticket.
3. The designated service team performs data analysis and root cause detection to resolve the
ticket; MSP is notified of the results and possible response actions to take on the client side.
diff --git a/docs/auditor/10.8/addon/copilot/collecteddata.md b/docs/auditor/10.8/addon/copilot/collecteddata.md
index 32c1b9d4a0..bd9de18b11 100644
--- a/docs/auditor/10.8/addon/copilot/collecteddata.md
+++ b/docs/auditor/10.8/addon/copilot/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected with the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.8/addon/copilot/deployment.md b/docs/auditor/10.8/addon/copilot/deployment.md
index d5105f71bf..b42f8c8992 100644
--- a/docs/auditor/10.8/addon/copilot/deployment.md
+++ b/docs/auditor/10.8/addon/copilot/deployment.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Deployment Procedure
-Follow the steps to install Microsoft Copilot add-on.
-
**Step 1 –** Accept EULA.
**Step 2 –** Select the installation folder and click **Next**.
@@ -16,8 +14,6 @@ Follow the steps to install Microsoft Copilot add-on.
## Configure Copilot for Monitoring
-Follow the steps to configure Copilot for monitoring.
-
**Step 1 –** Register an Azure App and grant it the following permissions:
- Microsoft.Graph — Domain.Read.All
@@ -25,12 +21,10 @@ Follow the steps to configure Copilot for monitoring.
## Configure the add-on
-Follow the steps to configure the add-on.
-
**Step 1 –** Specify Active Directory credentials.
- Username – Provide the name of the account under which the service runs. Unless specified, the
- service runs under the account currently logged on.
+ service runs under the account logged on.
- Password – Provide the password for the selected account.
diff --git a/docs/auditor/10.8/addon/copilot/overview.md b/docs/auditor/10.8/addon/copilot/overview.md
index 707cc40b43..083f68ef05 100644
--- a/docs/auditor/10.8/addon/copilot/overview.md
+++ b/docs/auditor/10.8/addon/copilot/overview.md
@@ -7,15 +7,15 @@ sidebar_position: 70
# Copilot
Microsoft Copilot is an AI-powered assistant designed to help users in Microsoft 365 apps like Word,
-Excel, and Teams. It leverages large language models to assist with tasks such as generating
+Excel, and Teams. It uses large language models to assist with tasks such as generating
content, analyzing data, and automating workflows.
To retrieve activity logs on Copilot interactions, the Add-on requires an Azure App registration.
This allows the application to interact with Microsoft services by obtaining necessary logs and data
related to Copilot activity.
-The Netwrix Auditor Add-On for Microsoft Copilot works in collaboration with Netwrix Auditor. To get
-the add-on up and running, refer the following topics:
+The Netwrix Auditor Add-On for Microsoft Copilot works in collaboration with Netwrix Auditor. To deploy
+and configure the add-on, refer the following topics:
- [Deployment Procedure](/docs/auditor/10.8/addon/copilot/deployment.md)
- [Work with Collected Data](/docs/auditor/10.8/addon/copilot/collecteddata.md)
diff --git a/docs/auditor/10.8/addon/ctera/collecteddata.md b/docs/auditor/10.8/addon/ctera/collecteddata.md
index c233d88d49..87857086e0 100644
--- a/docs/auditor/10.8/addon/ctera/collecteddata.md
+++ b/docs/auditor/10.8/addon/ctera/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected with the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
@@ -31,7 +31,7 @@ See the following topics for additional information:
- [View and Search Collected Data](/docs/auditor/10.8/admin/search/overview.md)
- [Subscriptions](/docs/auditor/10.8/admin/subscriptions/overview.md)
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected with the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.8/addon/ctera/install.md b/docs/auditor/10.8/addon/ctera/install.md
index 955178db1f..8fedf31c94 100644
--- a/docs/auditor/10.8/addon/ctera/install.md
+++ b/docs/auditor/10.8/addon/ctera/install.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Install Add-On
-Follow the steps to install the Add-On:
-
**Step 1 –** Navigate to your add-on package.
**Step 2 –** Unzip the Add-On to a desired folder.
diff --git a/docs/auditor/10.8/addon/ctera/overview.md b/docs/auditor/10.8/addon/ctera/overview.md
index 5c04e552b0..d8b38f64fa 100644
--- a/docs/auditor/10.8/addon/ctera/overview.md
+++ b/docs/auditor/10.8/addon/ctera/overview.md
@@ -36,7 +36,7 @@ follows:
### Configure Logging for CTERA Edge Filer
-Prior to start using the Add-On, configure syslog logging settings on your CTERA Edge Filers. See
+Before using the Add-On, configure syslog logging settings on your CTERA Edge Filers. See
the
[Configuring Syslog Settings](https://kb.ctera.com/docs/configuring-logging#configuring-syslog-settings)
article on the CTERA product documentation portal for detailed instructions.
@@ -59,5 +59,5 @@ installed on the same server.
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.8/addon/ctera/parameters.md b/docs/auditor/10.8/addon/ctera/parameters.md
index 2f89a546e9..1c5aabe310 100644
--- a/docs/auditor/10.8/addon/ctera/parameters.md
+++ b/docs/auditor/10.8/addon/ctera/parameters.md
@@ -16,14 +16,14 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (_/ netwrix/ api_ ) |
-| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (_/ netwrix/ api_ ) |
+| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
-| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account currently logged on. |
+| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account logged on. |
| Password | Provide the password for the selected account. |
| Auditor Monitoring Plan settings | |
-| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Auditor Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Auditor Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
diff --git a/docs/auditor/10.8/addon/cyberark/collecteddata.md b/docs/auditor/10.8/addon/cyberark/collecteddata.md
index 0da803a426..c316eabe13 100644
--- a/docs/auditor/10.8/addon/cyberark/collecteddata.md
+++ b/docs/auditor/10.8/addon/cyberark/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected with the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.8/addon/cyberark/deployment.md b/docs/auditor/10.8/addon/cyberark/deployment.md
index f9e5442517..b3826abd39 100644
--- a/docs/auditor/10.8/addon/cyberark/deployment.md
+++ b/docs/auditor/10.8/addon/cyberark/deployment.md
@@ -6,8 +6,6 @@ sidebar_position: 20
# Deploy the Add-On
-Follow the steps to deploy the Add-On:
-
**Step 1 –** Prepare Auditor for data processing.
**Step 2 –** Configure Syslog message forwarding in CyberArk.
@@ -22,12 +20,12 @@ Follow the steps to deploy the Add-On:
In Auditor client, go to the Integrations section and verify Integration API settings:
-1. Make sure the **Leverage Integration API** is switched to **ON**.
+1. Ensure that the **Leverage Integration API** is switched to **ON**.
2. Check the TCP communication port number – default is **9699**.
See the [Prerequisites](/docs/auditor/10.8/api/prerequisites.md) topic for additional information.
-By default, activity records are written to _Netwrix_Auditor_API_ database which is not associated
+By default, activity records are written to _Netwrix_Auditor_API_ database which isn't associated
with a specific monitoring plan.
Optionally, you can create a dedicated monitoring plan in Auditor. In this case, data will be
@@ -45,8 +43,6 @@ On the CyberArk side, you need to specify the server that will receive Syslog me
CyberArk, process them and forward to Auditor Server. This will be the add-on installation server
(the machine where _SyslogService.exe_ runs).
-Follow the steps to configure Syslog message forwarding in CyberArk.
-
**Step 1 –** Log in to your CyberArk system.
**Step 2 –** On the CyberArk server, locate the _%Program Files (x86)%\PrivateArk\Server\Conf_
@@ -60,8 +56,8 @@ folder and open the **dbparam.ini** file for editing.
%\PrivateArk\Server\Syslog_ folder.
Place the _Netwrix.xsl_ file there, too, so that default relative path should be _\Server\Syslog_.
- **SyslogServerPort** – communication port of the syslog server (i.e. add-on installation server).
- Default is **514**. Note that if you are using Netwrix Auditor for Network Devices, this port may
- be already in use, and you should provide another one.
+ Default is **514**. If you are using Netwrix Auditor for Network Devices, this port may already
+ be in use; provide another one.
- **SyslogServerIP** - IP address of the add-on installation server.
- SyslogServerProtocol – communication protocol for data transfer between CyberArk system and the
add-on. Specify **UDP** protocol.
@@ -83,8 +79,6 @@ _Remember,_ deploy the add-on on the same machine with the Auditor Server.
## Install Add-On
-Follow the steps to install the Add-On:
-
**Step 1 –** Navigate to your add-on package.
**Step 2 –** Unzip the Add-On to a desired folder.
@@ -112,14 +106,14 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (_/ netwrix/ api_ ) |
-| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (_/ netwrix/ api_ ) |
+| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
-| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account currently logged on. |
+| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account logged on. |
| Password | Provide the password for the selected account. |
| Auditor Monitoring Plan settings | |
-| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Auditor Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Auditor Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
diff --git a/docs/auditor/10.8/addon/cyberark/overview.md b/docs/auditor/10.8/addon/cyberark/overview.md
index a7da944113..38e85eef85 100644
--- a/docs/auditor/10.8/addon/cyberark/overview.md
+++ b/docs/auditor/10.8/addon/cyberark/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 80
# CyberArk Privileged Access Security
Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables
-control over changes, configurations and access in hybrid IT environments to protect data regardless
+control over changes, configurations, and access in hybrid IT environments to protect data regardless
of its location. The platform provides security analytics to detect anomalies in user behavior and
investigate threat patterns before a data breach occurs.
@@ -16,7 +16,7 @@ and SSH Keys. It enables organizations to manage and monitor all activities asso
privileged identities, for example, Windows server administrator, root on a UNIX server, etc. A
featured set of the Privileged Access Security tools includes, in particular:
-- **Privileged Session Manager** - a tool that enables users to securely connect to remote targets
+- **Privileged Session Manager** - a tool for securely connecting to remote targets
with a standard remote desktop client application, providing isolated sessions.
- **Enterprise Password Vault** – a tool for storage and centralized management of the privileged
accounts; it supports automated changes and logging of the activities associated with all types of
@@ -53,7 +53,7 @@ works as follows:
of events to be monitored, etc.
See the [Monitored Events](/docs/auditor/10.8/addon/cyberark/monitoredevents.md) topic for additional information on the events
- supported for monitoring out of the box.
+ supported for monitoring by default.
3. On the add-on installation server, the administrator runs the installation file and configures
the Add-On parameters in the configuration wizard.
diff --git a/docs/auditor/10.8/addon/cyberark/parameters.md b/docs/auditor/10.8/addon/cyberark/parameters.md
index 6a5e5bbea7..3272c16d2c 100644
--- a/docs/auditor/10.8/addon/cyberark/parameters.md
+++ b/docs/auditor/10.8/addon/cyberark/parameters.md
@@ -20,16 +20,16 @@ Parameters in **Settings.xml** can be grouped as follows:
- **General parameters** that affect add- on execution. They are listed in the table below.
- Settings for a certain event source (within the _Source_ section) that can override general
settings.
-- **Internal parameters** that should not be modified in most cases. They are listed in the topic.
+- **Internal parameters** that shouldn't be modified in most cases. They are listed in the topic.
| Parameter | Default value | Description |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General parameters | | |
| ListenUdpPort | 514 | Specify UDP port for listening to the incoming syslog events. |
-| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (/netwrix/api . . . . ) |
-| NetwrixAuditor CertificateThumbprint | NOCHECK | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check the certificate via Windows Certificate Store. - `AB:BB:CC.`—Check the certificate thumbprint identifier. - `NOCHECK`—Do not check the certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
-| NetwrixAuditorPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
-| NetwrixAuditorPlanItem | — | Unless specified, data is not associated with a specific monitoring plan and thus cannot be filtered by item name. Specify an item name here. Make sure to create a dedicated item in Auditor in advance. |
+| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (/netwrix/api . . . . ) |
+| NetwrixAuditor CertificateThumbprint | NOCHECK | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check the certificate via Windows Certificate Store. - `AB:BB:CC.`—Check the certificate thumbprint identifier. - `NOCHECK`—Don't check the certificate. ensure to select this parameter if you plan to specify servers by their IP. |
+| NetwrixAuditorPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, ensure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
+| NetwrixAuditorPlanItem | — | Unless specified, data isn't associated with a specific monitoring plan and thus can't be filtered by item name. Specify an item name here. ensure to create a dedicated item in Auditor in advance. |
| EventStorePath | — | Select where to store temporary files of syslog messages before the add-on sends them to Auditor Server. Netwrix recommends to store these files in the same directory with the add-on (SyslogService.exe). |
| LogLevel | warning | Specify logging level: - none - info - warning (used by default) - error - debug |
| WriteCriticalIssues ToEventLog | 0 | Instructs the add-on to write important events (like service start or critical issue) not only to its own log but also to Netwrix event log. - 1=yes - 0=no (default) |
@@ -37,8 +37,8 @@ Parameters in **Settings.xml** can be grouped as follows:
| NetwrixAuditorPlan | — | When specified, overrides the general settings. |
| NetwrixAuditorPlanItem | — | When specified, overrides the general settings. |
| AppNameRegExp | — | Custom regular expression pattern that will be used to retrieve the application name from your syslog messages. The add-on will match the application name and the files with syslog parsing rules to be applied. The pattern you provide here must match the application name in your custom rule file. Unless specified, RFC 3164/5424 format is used. |
-| AppNameGroupID | — | Define application name value by Group ID only if messages are not formatted in accordance with RFC 3164/5424. Otherwise, leave the default value. |
-| RuleFileList PathFile | cyberark-v2.xml | Specify paths to XML file(s) with regular expression parsing rules. You can create a custom file or use rules provided out of the box. Currently, the **cyberark-v2.xml** rule file is shipped with this add-on. You can specify several rule files. The service will check if the AppName parameter in the first rule file matches the AppNameRegExp and AppNameGroupID regular expression in this file. If not, the service will proceed to the next rule file. |
+| AppNameGroupID | — | Define application name value by Group ID only if messages aren't formatted in accordance with RFC 3164/5424. Otherwise, leave the default value. |
+| RuleFileList PathFile | cyberark-v2.xml | Specify paths to XML files with regular expression parsing rules. You can create a custom file or use rules provided by default. The **cyberark-v2.xml** rule file is shipped with this add-on. You can specify several rule files. The service will check if the AppName parameter in the first rule file matches the AppNameRegExp and AppNameGroupID regular expression in this file. If not, the service will proceed to the next rule file. |
| AcceptList Address | — | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. The _Address_ parameter may be followed by optional attributes that override parameters specified above: - _naplan_—A name of associated monitoring plan - _naplanitem_—A name of associated item For example: `172.28.3.15 ` |
Remember to save **Settings.xml** after editing is complete.
diff --git a/docs/auditor/10.8/addon/cyberark/troubleshooting.md b/docs/auditor/10.8/addon/cyberark/troubleshooting.md
index 6eaa4878b7..a1c7bcbb17 100644
--- a/docs/auditor/10.8/addon/cyberark/troubleshooting.md
+++ b/docs/auditor/10.8/addon/cyberark/troubleshooting.md
@@ -11,14 +11,11 @@ same folder as **SyslogService.exe.**
To change the add-on logging level, use the **LogLevel** parameter in the **Settings.xml** file.
-- It is recommended that before the first run you set this parameter to `debug`. This will
- facilitate operations tracking and possible problem solving.
-- After that it is strongly recommended to re-set this parameter to `error` to prevent the
- uncontrolled log growth.
+- Before the first run, set this parameter to `debug` to facilitate operations tracking and possible problem solving.
+- After that, reset this parameter to `error` to prevent uncontrolled log growth.
-If you cannot see collected data in Auditor, check the following:
+If you can't see collected data in Auditor, check the following:
-1. In Auditor settings, go to the **Integrations** section and make sure the **Leverage Integration
- API** is switched to **ON**. Check the communication port number – default is **9699**.
-2. If you configured a dedicated monitoring plan, make sure data source monitoring is enabled.
+1. In Auditor settings, go to the **Integrations** section and ensure the **Leverage Integration API** is switched to **ON**. Check the communication port number – default is **9699**.
+2. If you configured a dedicated monitoring plan, ensure data source monitoring is enabled.
3. Verify the parameters you provided in **Settings.xml** and **dbparam.ini**.
diff --git a/docs/auditor/10.8/addon/hyperv/collecteddata.md b/docs/auditor/10.8/addon/hyperv/collecteddata.md
index d73336668b..e6849ba673 100644
--- a/docs/auditor/10.8/addon/hyperv/collecteddata.md
+++ b/docs/auditor/10.8/addon/hyperv/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected with the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.8/addon/hyperv/deployment.md b/docs/auditor/10.8/addon/hyperv/deployment.md
index a2402e0952..5a61b57ccd 100644
--- a/docs/auditor/10.8/addon/hyperv/deployment.md
+++ b/docs/auditor/10.8/addon/hyperv/deployment.md
@@ -27,7 +27,7 @@ Users_ local group on the SCVMM server.
-In this scenario, make sure to specify SCVMM server address in the **DataCollectionServer**
+In this scenario, ensure to specify SCVMM server address in the **DataCollectionServer**
parameter (not the machine where SCVMM console runs) in the **settings.xml** configuration file. See
the [Add-On Parameters](/docs/auditor/10.8/addon/hyperv/parameters.md)topic for additional information.
@@ -78,7 +78,7 @@ Configuration parameters __NetwrixAuditorUserName__ and __NetrixAuditorPassword_
``
-Credentials for **Data Collection Server** (that is, SCVMM) are not required.
+Credentials for **Data Collection Server** (that is, SCVMM) aren't required.
## Example 4
diff --git a/docs/auditor/10.8/addon/hyperv/install.md b/docs/auditor/10.8/addon/hyperv/install.md
index 3b57d1cf7d..93594071ba 100644
--- a/docs/auditor/10.8/addon/hyperv/install.md
+++ b/docs/auditor/10.8/addon/hyperv/install.md
@@ -20,12 +20,12 @@ Follow the step to deploy the Add-On:
In Auditor client, go to the Integrations section and verify Integration API settings:
-1. Make sure the **Leverage Integration API** is switched to **ON**.
+1. Ensure the **Leverage Integration API** is switched to **ON**.
2. Check the TCP communication port number – default is **9699**.
See the [Prerequisites](/docs/auditor/10.8/api/prerequisites.md) topic for additional information.
-By default, activity records are written to _Netwrix_Auditor_API_ database which is not associated
+By default, activity records are written to _Netwrix_Auditor_API_ database which isn't associated
with a specific monitoring plan.
Optionally, you can create a dedicated monitoring plan in Auditor. In this case, data will be
@@ -51,8 +51,8 @@ See the [Add-On Parameters](/docs/auditor/10.8/addon/hyperv/parameters.md)topic
| Parameter | Default value | Description |
| ---------------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| DataCollectionServer | (empty) | Specify SCVMM server to collect data from. You can use IP address, FQDN or NETBIOS name. For _localhost_, leave this parameter empty. |
-| DataCollectionUserName | (empty) | Specify user account that will be used for data collection from SCVMM server. To use the account currently logged in, leave this parameter empty. Make sure the account has administrative rights on that server (see the [Accounts and Rights](overview.md#accounts-and-rights) topic for additional information). |
+| DataCollectionServer | (empty) | Specify SCVMM server to collect data from. You can use IP address, FQDN, or NETBIOS name. For _localhost_, leave this parameter empty. |
+| DataCollectionUserName | (empty) | Specify user account that will be used for data collection from SCVMM server. To use the account logged in, leave this parameter empty. ensure the account has administrative rights on that server (see the [Accounts and Rights](overview.md#accounts-and-rights) topic for additional information). |
| DataCollectionPassword | | Specify user account password. |
| ShortTermFolder | ShortTerm | Specify path to the short-term archive (Netwrix Auditor working folder). You can use full or relative path. |
diff --git a/docs/auditor/10.8/addon/hyperv/overview.md b/docs/auditor/10.8/addon/hyperv/overview.md
index 0277e1e919..da043f8ab3 100644
--- a/docs/auditor/10.8/addon/hyperv/overview.md
+++ b/docs/auditor/10.8/addon/hyperv/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 90
# Hyper-V SCVMM
Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables
-control over changes, configurations and access in hybrid IT environments to protect data regardless
+control over changes, configurations, and access in hybrid IT environments to protect data regardless
of its location. The platform provides security analytics to detect anomalies in user behavior and
investigate threat patterns before a data breach occurs.
@@ -68,7 +68,7 @@ See the [Integration API](/docs/auditor/10.8/api/overview.md) topic for addition
of the Activity Record and the capabilities of the Integration API.
8. The add-on uses the Integration API to send the Activity Records to Auditor Server, where this
- data becomes available for search, reporting and alerting.
+ data becomes available for search, reporting, and alerting.
9. Users open Auditor Client to work with collected data:
- Search for file changes using certain criteria
- Export data to PDF or CSV files
@@ -78,7 +78,7 @@ of the Activity Record and the capabilities of the Integration API.
### Add-on Delivery Package
-The add-on delivery package is a ZIP archive comprising several files, including DLLs, configuration
+The add-on delivery package is a ZIP archive comprising several files, including DLLs, configuration,
and executable files. The latter ones are listed in the table below.
| File name | Description |
diff --git a/docs/auditor/10.8/addon/hyperv/parameters.md b/docs/auditor/10.8/addon/hyperv/parameters.md
index bc678cb5fe..d0290e0177 100644
--- a/docs/auditor/10.8/addon/hyperv/parameters.md
+++ b/docs/auditor/10.8/addon/hyperv/parameters.md
@@ -16,16 +16,16 @@ your execution scenario and security policies.
| Parameter | Default value | Description |
| ------------------------------------ | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| NetwrixIntegration | | |
-| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (/netwrix/api . . . . ) |
-| NetwrixAuditor CertificateThumbprint | NOCHECK | Auditor Certificate Thumbprint Property. Possible values: - `AB:BB:CC.`—Check Auditor server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (/netwrix/api . . . . ) |
+| NetwrixAuditor CertificateThumbprint | NOCHECK | Auditor Certificate Thumbprint Property. Possible values: - `AB:BB:CC.`—Check Auditor server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| NetwrixAuditorDateTimeFormat | yyyy-MM-ddTHH:mm:ssZ | Auditor time format. By default, set to zero offset. |
-| NetwrixAuditorPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
-| NetwrixAuditorPlanItem | — | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item in Auditor in advance. |
+| NetwrixAuditorPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, ensure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
+| NetwrixAuditorPlanItem | — | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item in Auditor in advance. |
| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format. The account must be assigned the Contributor role in Netwrix Auditor. |
| NetwrixAuditorUserPassword | Current user credentials | Unless specified, the add-on runs with the current user credentials. Provide a different password if necessary. |
| DataCollection | | |
-| DataCollectionServer | (empty) | Specify SCVMM server to collect data from. You can use IP address, FQDN or NETBIOS name. For localhost, leave this parameter empty. |
-| DataCollectionUserName | (empty) | Specify user account that will be used for data collection from SCVMM server. To use the account currently logged in, leave this parameter empty. Make sure the account has administrative rights on that server (see the [Accounts and Rights](overview.md#accounts-and-rights) topic for additional information). |
+| DataCollectionServer | (empty) | Specify SCVMM server to collect data from. You can use IP address, FQDN, or NETBIOS name. For localhost, leave this parameter empty. |
+| DataCollectionUserName | (empty) | Specify user account that will be used for data collection from SCVMM server. To use the account logged in, leave this parameter empty. ensure the account has administrative rights on that server (see the [Accounts and Rights](overview.md#accounts-and-rights) topic for additional information). |
| DataCollectionPassword | | Specify user account password. |
| ShortTermFolder | ShortTerm | Specify path to the short-term archive (Netwrix Auditor working folder). You can use full or relative path. |
diff --git a/docs/auditor/10.8/addon/hyperv/troubleshooting.md b/docs/auditor/10.8/addon/hyperv/troubleshooting.md
index 767378249f..d42637e53e 100644
--- a/docs/auditor/10.8/addon/hyperv/troubleshooting.md
+++ b/docs/auditor/10.8/addon/hyperv/troubleshooting.md
@@ -6,13 +6,11 @@ sidebar_position: 60
# Maintenance and Troubleshooting
-If you cannot see collected data in Auditor, check the following:
+If you can't see collected data in Auditor, check the following:
- Add-on account has sufficient rights to access SCVMM and Auditor.
-- In Netwrix Auditor settings, go to the **Integrations** section and make sure the **Leverage
- Integration API** is switched to **ON**. Check the communication port number – default is
- **9699**.
-- If you configured a dedicated monitoring plan, make sure data source monitoring is enabled.
+- In Netwrix Auditor settings, go to the **Integrations** section and ensure the **Leverage Integration API** is switched to **ON**. Check the communication port number – default is **9699**.
+- If you configured a dedicated monitoring plan, ensure data source monitoring is enabled.
- Verify the parameters you provided in **settings.xml**.
## Monitor Several SCVMM
@@ -50,11 +48,11 @@ Alternatively, you can use **Windows Task Scheduler**.
- If the solution was deployed using the third scenario (that is, SCVMM server and add-on are
running on different machines), then the following error may be written in the solution log:
-The WinRM client cannot process the request.
+The WinRM client can't process the request.
See the [Deployment Scenarios](/docs/auditor/10.8/addon/hyperv/deployment.md)topic for additional information.
-If the authentication scheme is different from Kerberos, or if the client computer is not joined to
+If the authentication scheme is different from Kerberos, or if the client computer isn't joined to
a domain, then HTTPS transport must be used or the destination machine must be added to the
**TrustedHosts** list. To configure this list, use **winrm.cmd**.
diff --git a/docs/auditor/10.8/addon/ibmqradar/automate.md b/docs/auditor/10.8/addon/ibmqradar/automate.md
index 6a202cf53f..f9c1ee1d25 100644
--- a/docs/auditor/10.8/addon/ibmqradar/automate.md
+++ b/docs/auditor/10.8/addon/ibmqradar/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.8/addon/ibmqradar/collecteddata.md b/docs/auditor/10.8/addon/ibmqradar/collecteddata.md
index 6f1f0a7795..6aecbd739f 100644
--- a/docs/auditor/10.8/addon/ibmqradar/collecteddata.md
+++ b/docs/auditor/10.8/addon/ibmqradar/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
-
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.8/addon/ibmqradar/integrationeventlog.md b/docs/auditor/10.8/addon/ibmqradar/integrationeventlog.md
index 2271b809e4..ac8e8a6b6b 100644
--- a/docs/auditor/10.8/addon/ibmqradar/integrationeventlog.md
+++ b/docs/auditor/10.8/addon/ibmqradar/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.8/addon/ibmqradar/overview.md b/docs/auditor/10.8/addon/ibmqradar/overview.md
index 13debeb18a..f1511a70c5 100644
--- a/docs/auditor/10.8/addon/ibmqradar/overview.md
+++ b/docs/auditor/10.8/addon/ibmqradar/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 100
# IBM QRadar
-Netwrix Auditor Add-on for SIEM helps you to get most from your SIEM investment. This topic focuses
+Netwrix Auditor Add-on for SIEM helps you get the most from your SIEM investment. This topic focuses
on the IBM QRadar SIEM solution.
The add-on works in collaboration with Netwrix Auditor, supplying additional data that augments the
@@ -46,5 +46,4 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts that work with Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.8/addon/ibmqradar/parameters.md b/docs/auditor/10.8/addon/ibmqradar/parameters.md
index ec0cf1b902..4881fe3528 100644
--- a/docs/auditor/10.8/addon/ibmqradar/parameters.md
+++ b/docs/auditor/10.8/addon/ibmqradar/parameters.md
@@ -31,10 +31,10 @@ dynamically calculated EventIDs will be modified and applied incorrectly.
| Parameter | Default value | Description |
| -------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId\* | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to _TRUE_. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
\* When configuring the **IncludeDataSourceToMakeEventId** parameter, consider that the _Object
Type - Action_ pair may be identical for several data sources (e.g., Object='User' and
diff --git a/docs/auditor/10.8/addon/ibmqradar/powershell.md b/docs/auditor/10.8/addon/ibmqradar/powershell.md
index 37527d9157..b2fc2031b7 100644
--- a/docs/auditor/10.8/addon/ibmqradar/powershell.md
+++ b/docs/auditor/10.8/addon/ibmqradar/powershell.md
@@ -11,11 +11,9 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
-
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -56,7 +54,7 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
first run. At the end of the first run, the timestamp will be created, and the next run will start
diff --git a/docs/auditor/10.8/addon/intelsecurity/automate.md b/docs/auditor/10.8/addon/intelsecurity/automate.md
index 58d06c10aa..b9c0490837 100644
--- a/docs/auditor/10.8/addon/intelsecurity/automate.md
+++ b/docs/auditor/10.8/addon/intelsecurity/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.8/addon/intelsecurity/collecteddata.md b/docs/auditor/10.8/addon/intelsecurity/collecteddata.md
index 6f1f0a7795..6aecbd739f 100644
--- a/docs/auditor/10.8/addon/intelsecurity/collecteddata.md
+++ b/docs/auditor/10.8/addon/intelsecurity/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
-
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.8/addon/intelsecurity/integrationeventlog.md b/docs/auditor/10.8/addon/intelsecurity/integrationeventlog.md
index eb4e547fa7..c506384c2d 100644
--- a/docs/auditor/10.8/addon/intelsecurity/integrationeventlog.md
+++ b/docs/auditor/10.8/addon/intelsecurity/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.8/addon/intelsecurity/overview.md b/docs/auditor/10.8/addon/intelsecurity/overview.md
index 43cfa02874..a50d392d75 100644
--- a/docs/auditor/10.8/addon/intelsecurity/overview.md
+++ b/docs/auditor/10.8/addon/intelsecurity/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# Intel Security
-Netwrix Auditor Add-on for SIEM helps you to get most from your SIEM investment. This topic focuses
+Netwrix Auditor Add-on for SIEM helps you get the most from your SIEM investment. This topic focuses
on the Intel Security SIEM solution.
The add-on works in collaboration with Netwrix Auditor, supplying additional data that augments the
@@ -46,5 +46,4 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts that work with Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.8/addon/intelsecurity/parameters.md b/docs/auditor/10.8/addon/intelsecurity/parameters.md
index 3822b8cc1e..2d216b5fda 100644
--- a/docs/auditor/10.8/addon/intelsecurity/parameters.md
+++ b/docs/auditor/10.8/addon/intelsecurity/parameters.md
@@ -31,10 +31,10 @@ dynamically calculated EventIDs will be modified and applied incorrectly.
| Parameter | Default value | Description |
| -------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId\* | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to _TRUE_. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
\* When configuring the **IncludeDataSourceToMakeEventId** parameter, consider that the _Object
Type - Action_ pair may be identical for several data sources (e.g., Object='User' and
diff --git a/docs/auditor/10.8/addon/intelsecurity/powershell.md b/docs/auditor/10.8/addon/intelsecurity/powershell.md
index b47e6f0247..a0fc7006b0 100644
--- a/docs/auditor/10.8/addon/intelsecurity/powershell.md
+++ b/docs/auditor/10.8/addon/intelsecurity/powershell.md
@@ -15,7 +15,7 @@ modify the parameters as required.
**Step 1 –** On computer where you want to execute the add-on, start **Windows PowerShell**.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -56,7 +56,7 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
first run. At the end of the first run, the timestamp will be created, and the next run will start
diff --git a/docs/auditor/10.8/addon/linux/collecteddata.md b/docs/auditor/10.8/addon/linux/collecteddata.md
index 2435ba82e2..a7cc3f7519 100644
--- a/docs/auditor/10.8/addon/linux/collecteddata.md
+++ b/docs/auditor/10.8/addon/linux/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 30
# Work with Collected Data
-Follow the steps to search for collected data:
-
**Step 1 –** Start the Auditor client and navigate to **Search**.
**Step 2 –** Click **Search**.
diff --git a/docs/auditor/10.8/addon/linux/install.md b/docs/auditor/10.8/addon/linux/install.md
index 955178db1f..8fedf31c94 100644
--- a/docs/auditor/10.8/addon/linux/install.md
+++ b/docs/auditor/10.8/addon/linux/install.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Install Add-On
-Follow the steps to install the Add-On:
-
**Step 1 –** Navigate to your add-on package.
**Step 2 –** Unzip the Add-On to a desired folder.
diff --git a/docs/auditor/10.8/addon/linux/overview.md b/docs/auditor/10.8/addon/linux/overview.md
index 223e3c0b04..8f509427c9 100644
--- a/docs/auditor/10.8/addon/linux/overview.md
+++ b/docs/auditor/10.8/addon/linux/overview.md
@@ -14,7 +14,7 @@ On a high level, the add-on works as follows:
**Step 1** – The add-on listens to the specified UDP ports and captures designated Syslog messages.
-**Step 2** – Out of the box, messages from Red Hat Enterprise Linux 6, 7, 8, 9, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16 are supported. For other distributions, deployment of the rsyslog package may be required. You can edit the add-on configuration to extend the captured message list.
+**Step 2** – By default, messages from Red Hat Enterprise Linux 6, 7, 8, 9, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16 are supported. For other distributions, deployment of the rsyslog package may be required. You can edit the add-on configuration to extend the captured message list.
**Step 3** – The add-on processes these events into Netwrix Auditor-compatible format (Activity Records). Each Activity Record contains the user account, action, time, and other details.
diff --git a/docs/auditor/10.8/addon/linux/parameters.md b/docs/auditor/10.8/addon/linux/parameters.md
index 021638caa4..110b2093cb 100644
--- a/docs/auditor/10.8/addon/linux/parameters.md
+++ b/docs/auditor/10.8/addon/linux/parameters.md
@@ -16,14 +16,14 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Netwrix Auditor Endpoint | Netwrix Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Netwrix Auditor Server and uses default port _9699_. To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (_/netwrix/api_ ) |
-| Certificate Thumbprint | Possible values:
- `Empty`— Check Auditor certificate via Windows Certificate Store.
- `AB:BB:CC`— Check Auditor Server certificate thumbprint identifier.
- `NOCHECK`— Do not check Auditor certificate.
Make sure to select this parameter if you plan to specify servers by their IP. |
+| Netwrix Auditor Endpoint | Netwrix Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Netwrix Auditor Server and uses default port _9699_. To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (_/netwrix/api_ ) |
+| Certificate Thumbprint | Possible values:
- `Empty`— Check Auditor certificate via Windows Certificate Store.
- `AB:BB:CC`— Check Auditor Server certificate thumbprint identifier.
- `NOCHECK`— Don't check Auditor certificate.
ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
| Username | Specify the account under which the service will authenticate to the **Netwrix_Auditor_API**. |
| Password | Provide the password for the selected account. |
| Monitoring Plan settings | |
-| Monitoring Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Monitoring Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Monitoring Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Monitoring Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
diff --git a/docs/auditor/10.8/addon/logrhythm/automate.md b/docs/auditor/10.8/addon/logrhythm/automate.md
index 983ffca41a..01a022eaef 100644
--- a/docs/auditor/10.8/addon/logrhythm/automate.md
+++ b/docs/auditor/10.8/addon/logrhythm/automate.md
@@ -11,7 +11,7 @@ task manually. To do this, right-click a task and click **Run**.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.8/addon/logrhythm/collecteddata.md b/docs/auditor/10.8/addon/logrhythm/collecteddata.md
index 4eb4fba982..6aecbd739f 100644
--- a/docs/auditor/10.8/addon/logrhythm/collecteddata.md
+++ b/docs/auditor/10.8/addon/logrhythm/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data.
-
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.8/addon/logrhythm/integrationeventlog.md b/docs/auditor/10.8/addon/logrhythm/integrationeventlog.md
index 8aaeab96fe..09aa47bbae 100644
--- a/docs/auditor/10.8/addon/logrhythm/integrationeventlog.md
+++ b/docs/auditor/10.8/addon/logrhythm/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.8/addon/logrhythm/overview.md b/docs/auditor/10.8/addon/logrhythm/overview.md
index de47365a9e..740e738d57 100644
--- a/docs/auditor/10.8/addon/logrhythm/overview.md
+++ b/docs/auditor/10.8/addon/logrhythm/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 130
# LogRhythm
-Netwrix Auditor Add-on for SIEM helps you to get most from your SIEM investment. This topic focuses
+Netwrix Auditor Add-on for SIEM helps you get the most from your SIEM investment. This topic focuses
on the LogRhythm SIEM solution.
The add-on works in collaboration with Netwrix Auditor, supplying additional data that augments the
@@ -46,5 +46,4 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts that work with Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.8/addon/logrhythm/parameters.md b/docs/auditor/10.8/addon/logrhythm/parameters.md
index 751c5b06cf..62e8f61e53 100644
--- a/docs/auditor/10.8/addon/logrhythm/parameters.md
+++ b/docs/auditor/10.8/addon/logrhythm/parameters.md
@@ -31,10 +31,10 @@ dynamically calculated EventIDs will be modified and applied incorrectly.
| Parameter | Default value | Description |
| -------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId\* | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to _TRUE_. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
\* When configuring the **IncludeDataSourceToMakeEventId** parameter, consider that the _Object
Type - Action_ pair may be identical for several data sources (e.g., Object='User' and
diff --git a/docs/auditor/10.8/addon/logrhythm/powershell.md b/docs/auditor/10.8/addon/logrhythm/powershell.md
index 3f5b5be75f..11da1e50da 100644
--- a/docs/auditor/10.8/addon/logrhythm/powershell.md
+++ b/docs/auditor/10.8/addon/logrhythm/powershell.md
@@ -11,11 +11,9 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run the script with PowerShell.
-
**Step 1 –** On computer where you want to execute the add-on, start **Windows PowerShell**.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -56,7 +54,7 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
first run. At the end of the first run, the timestamp will be created, and the next run will start
diff --git a/docs/auditor/10.8/addon/nasuni/collecteddata.md b/docs/auditor/10.8/addon/nasuni/collecteddata.md
index 0da803a426..c316eabe13 100644
--- a/docs/auditor/10.8/addon/nasuni/collecteddata.md
+++ b/docs/auditor/10.8/addon/nasuni/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected with the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.8/addon/nasuni/install.md b/docs/auditor/10.8/addon/nasuni/install.md
index 955178db1f..8fedf31c94 100644
--- a/docs/auditor/10.8/addon/nasuni/install.md
+++ b/docs/auditor/10.8/addon/nasuni/install.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Install Add-On
-Follow the steps to install the Add-On:
-
**Step 1 –** Navigate to your add-on package.
**Step 2 –** Unzip the Add-On to a desired folder.
diff --git a/docs/auditor/10.8/addon/nasuni/overview.md b/docs/auditor/10.8/addon/nasuni/overview.md
index dbcf643a16..31affd6def 100644
--- a/docs/auditor/10.8/addon/nasuni/overview.md
+++ b/docs/auditor/10.8/addon/nasuni/overview.md
@@ -36,8 +36,6 @@ follows:
### Configure Logging for
-Follow the steps to configure the syslog integration.
-
**Step 1 –** Log in to the Nasuni Management Console and go to the **Console Settings** > **Syslog
Exports**.
@@ -53,8 +51,8 @@ configuration.
**Step 4 –** Enable auditing:
1. On the Volumes tab, open **Auditing**.
-2. Choose the volume you wish to be audited and click **Edit Volumes**.
-3. Select the **Auditing Enabled** option and choose which Event Types you wish to be reported.
+2. Choose the volume you want to be audited and click **Edit Volumes**.
+3. Select the **Auditing Enabled** option and choose which Event Types you want to be reported.
4. Hit the **Save Auditing Settings** button.
### Accounts and Rights
@@ -77,5 +75,4 @@ admin privileges.
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts that work with Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.8/addon/nasuni/parameters.md b/docs/auditor/10.8/addon/nasuni/parameters.md
index dcce4538fe..ab31e7c4ad 100644
--- a/docs/auditor/10.8/addon/nasuni/parameters.md
+++ b/docs/auditor/10.8/addon/nasuni/parameters.md
@@ -16,14 +16,14 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (_/ netwrix/ api_ ) |
-| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (_/ netwrix/ api_ ) |
+| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
-| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account currently logged on. |
+| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account logged on. |
| Password | Provide the password for the selected account. |
| Auditor Monitoring Plan settings | |
-| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Auditor Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Auditor Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
diff --git a/docs/auditor/10.8/addon/nutanixahv/collecteddata.md b/docs/auditor/10.8/addon/nutanixahv/collecteddata.md
index e3bb323de3..f6eb063f1a 100644
--- a/docs/auditor/10.8/addon/nutanixahv/collecteddata.md
+++ b/docs/auditor/10.8/addon/nutanixahv/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected with the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.8/addon/nutanixahv/install.md b/docs/auditor/10.8/addon/nutanixahv/install.md
index cc8de53fea..cbcfacf778 100644
--- a/docs/auditor/10.8/addon/nutanixahv/install.md
+++ b/docs/auditor/10.8/addon/nutanixahv/install.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Deploy the Add-On
-Follow the steps to deploy the Add-On:
-
**Step 1 –** Prepare Auditor for data processing.
**Step 2 –** Configure message forwarding for Nutanix Prism.
@@ -24,12 +22,12 @@ Follow the steps to deploy the Add-On:
In Auditor client, go to the Integrations section and verify Integration API settings:
-1. Make sure the **Leverage Integration API** is switched to **ON**.
+1. Ensure the **Leverage Integration API** is switched to **ON**.
2. Check the TCP communication port number – default is **9699**.
See the [Prerequisites](/docs/auditor/10.8/api/prerequisites.md) topic for additional information.
-By default, activity records are written to _Netwrix_Auditor_API_ database which is not associated
+By default, activity records are written to _Netwrix_Auditor_API_ database which isn't associated
with a specific monitoring plan.
Optionally, you can create a dedicated monitoring plan in Auditor. In this case, data will be
@@ -139,18 +137,18 @@ Open the add-on folder and edit the **settings.xml** file to configure the add-o
| Parameter | Default value | Description |
| ------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| NetwrixAuditorIntegration | | |
-| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (/netwrix/api . . . . ) |
-| CertificateThumbprint | NOCHECK | Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Netwrix Auditor certificate via Windows Certificate Store. - `AB:BB:CC.`—Check Netwrix Auditor Server certificate thumbprint identifier. - `NOCHECK`—Do not check Netwrix Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (/netwrix/api . . . . ) |
+| CertificateThumbprint | NOCHECK | Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Netwrix Auditor certificate via Windows Certificate Store. - `AB:BB:CC.`—Check Netwrix Auditor Server certificate thumbprint identifier. - `NOCHECK`—Don't check Netwrix Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| DateTimeFormat | yyyy-MM-ddTHH:mm:ssZ | Auditor time format. By default, set to zero offset. |
-| MonitoringPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
-| MonitoringPlanItem | — | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item in Auditor in advance. |
+| MonitoringPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, ensure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
+| MonitoringPlanItem | — | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item in Auditor in advance. |
| UserName | Current user credentials | Credentials to access Auditor server. Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor server, specify the account name in the _DOMAIN\username_ format. |
| Password | Current user credentials | Unless specified, the service runs with the current user credentials. Provide a different password if necessary. |
| ARsNumberAtTime | | Maximum number of Audit Records that can be sent to Auditor at a time. |
| ARsSendingPeriodicity | | Periodic time interval for sending Activity Records (in seconds). |
| PauseWhenSendingFailed | | Pause after a failed attempt to send Activity Records (in seconds). |
| **DataCollection** | | |
-| ListenUDPPort | 514 | UDP port for receiving incoming Syslog messages. Make sure that this port is not used by any other add-ons or applications (for example, Netwrix Auditor for Network Devices); otherwise specify another port here. |
+| ListenUDPPort | 514 | UDP port for receiving incoming Syslog messages. Ensure that this port isn't used by any other add-ons or applications (for example, Netwrix Auditor for Network Devices); otherwise specify another port here. |
| StateUpdatingPeriodicity | | Periodic time interval for updating state of clusters (in seconds). |
| EventsReadingPeriodicity | | Periodic time interval for reading events (in seconds). Target endpoint: _/api/nutanix/v2.0/events_ |
| PageLength | | The number of objects loaded with one request. |
diff --git a/docs/auditor/10.8/addon/nutanixahv/overview.md b/docs/auditor/10.8/addon/nutanixahv/overview.md
index ba9ed2bf68..39e206d41b 100644
--- a/docs/auditor/10.8/addon/nutanixahv/overview.md
+++ b/docs/auditor/10.8/addon/nutanixahv/overview.md
@@ -7,12 +7,12 @@ sidebar_position: 150
# Nutanix AHV
Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables
-control over changes, configurations and access in hybrid IT environments to protect data regardless
+control over changes, configurations, and access in hybrid IT environments to protect data regardless
of its location. The platform provides security analytics to detect anomalies in user behavior and
investigate threat patterns before a data breach occurs.
Nutanix AHV is a virtualization platform within the Nutanix Enterprise Cloud architecture. It
-provides facilities for VM deployment, operation and centralized management. Nutanix AHV is a fully
+provides facilities for VM deployment, operation, and centralized management. Nutanix AHV is a fully
integrated component of the Nutanix Enterprise Cloud.
Virtualization teams, Managed Service Providers and other IT professionals need to detect who does
@@ -122,7 +122,7 @@ be then encrypted and stored in the solution configuration.
- By default, the add-on is targeted at a single Nutanix Prism Central/Element server.
- Netwrix add-on must be deployed in the same subnet as Nutanix Prism Central/Element server.
-- Please be aware that monitoring of actions performed on the add-on installation server is not
+- be aware that monitoring of actions performed on the add-on installation server isn't
supported.
### Upgrade Path
diff --git a/docs/auditor/10.8/addon/nutanixahv/troubleshooting.md b/docs/auditor/10.8/addon/nutanixahv/troubleshooting.md
index 2f539f51c8..1d4f34c8fc 100644
--- a/docs/auditor/10.8/addon/nutanixahv/troubleshooting.md
+++ b/docs/auditor/10.8/addon/nutanixahv/troubleshooting.md
@@ -6,18 +6,17 @@ sidebar_position: 50
# Maintenance and Troubleshooting
-If you cannot see collected data in Auditor, check the following:
+If you can't see collected data in Auditor, check the following:
- Service account has sufficient rights to access Auditor.
-- In Auditor settings, go to the **Integrations** section and make sure the **Leverage Integration
- API** is switched to **ON**. Check the communication port number – default is **9699**.
-- If you configured a dedicated monitoring plan, make sure data source monitoring is enabled.
+- In Auditor settings, go to the **Integrations** section and ensure the **Leverage Integration API** is switched to **ON**. Check the communication port number – default is **9699**.
+- If you configured a dedicated monitoring plan, ensure data source monitoring is enabled.
- Verify the parameters you provided in **settings.xml**.
-Also, remember that events from the remote Syslog server (add-on installation server) are not
+Also, remember that events from the remote Syslog server (add-on installation server) aren't
collected.
-Currently, the add-on supports only one Prism installation (Central or Element). To monitor more
+the add-on supports only one Prism installation (Central or Element). To monitor more
than one Prism Central/Element, you can copy the add-on to another folder, configure
**settings.xml** as described in this document and modify **install.ps1** to rename the service:
diff --git a/docs/auditor/10.8/addon/okta/collecteddata.md b/docs/auditor/10.8/addon/okta/collecteddata.md
index b1a1a285ae..a2603f9e10 100644
--- a/docs/auditor/10.8/addon/okta/collecteddata.md
+++ b/docs/auditor/10.8/addon/okta/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data collected with the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.8/addon/okta/deployment.md b/docs/auditor/10.8/addon/okta/deployment.md
index e4dabc38c7..383fb322d7 100644
--- a/docs/auditor/10.8/addon/okta/deployment.md
+++ b/docs/auditor/10.8/addon/okta/deployment.md
@@ -6,8 +6,6 @@ sidebar_position: 10
# Deploy the Add-On
-Follow the steps to deploy the Add-On.
-
**Step 1 –** Download the distribution package.
**Step 2 –** Unpack it to a folder on the computer where you plan to deploy the add-on.
diff --git a/docs/auditor/10.8/addon/okta/overview.md b/docs/auditor/10.8/addon/okta/overview.md
index a2ff9d2676..3dd7226330 100644
--- a/docs/auditor/10.8/addon/okta/overview.md
+++ b/docs/auditor/10.8/addon/okta/overview.md
@@ -11,7 +11,7 @@ Okta-based devices. Aggregating data into a single audit trail simplifies analys
monitoring more cost effective, and helps you keep tabs on your IT infrastructure.
Implemented as a service, this add-on facilitates the data transition from Okta-based systems to
-Netwrix Auditor. All you have to do is provide connect ion details and specify parsing rules.
+Netwrix Auditor. All you have to do is provide connection details and specify parsing rules.
On a high level, the add-on works as follows:
@@ -22,7 +22,7 @@ On a high level, the add-on works as follows:
which writes them to the Long-Term Archive and the Audit Database.
See the [Integration API](/docs/auditor/10.8/api/overview.md) topic for additional information on the structure
-of the Activity Record and the capabilities of the NIntegration API.
+of the Activity Record and the capabilities of the Integration API.
## Prerequisites
@@ -52,5 +52,4 @@ In case the add-on and Auditor are installed on the same server, no special sett
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts that work with Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.8/addon/overview.md b/docs/auditor/10.8/addon/overview.md
index 51a828843d..3b0db00c20 100644
--- a/docs/auditor/10.8/addon/overview.md
+++ b/docs/auditor/10.8/addon/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 80
# Add-Ons
The Netwrix Auditor Add-on Store contains free add-ons developed by Netwrix and your peers in
-the community. The add-ons help you leverage integration between your on-premises or cloud
-applications and Netwrix Auditor.
+the community. The add-ons help you integrate your on-premises and cloud
+applications with Netwrix Auditor.
The list of available add-ons keeps growing because with the new RESTful API, the integration
capabilities of Netwrix Auditor are unlimited. Netwrix encourages users to develop add-ons, upload
@@ -17,7 +17,7 @@ them to Netwrix website, and share with community.
Benefits:
- Centralize auditing and reporting of your IT environment — Netwrix unifies auditing of all IT
- systems across your on-premises, cloud or hybrid environment, and enables centralized reporting
+ systems across your on-premises, cloud, or hybrid environment, and enables centralized reporting
for security and compliance.
- Get the most from your SIEM investment — To maximize SIEM value, Netwrix increases the
signal-to-noise ratio and feeds your HP ArcSight, Splunk, IBM QRadar or any other SIEM solution
@@ -52,10 +52,8 @@ Before your start working with the add-on, go through its quick-start guide at
Each guide contains detailed instructions for deploying and running the add-on, as well as
prerequisites and configuration settings. Generic steps are described below.
-Follow the steps to use the add-on.
-
**Step 1 –** Check prerequisites. Since the add-ons work only in combination with Netwrix Auditor,
-make sure that Netwrix Auditor and its Audit Database are configured, and roles are assigned
+ensure that Netwrix Auditor and its Audit Database are configured, and roles are assigned
properly.
**Step 2 –** Specify parameters required for add-on operation. Before running or scheduling the
diff --git a/docs/auditor/10.8/addon/privilegeduserlinux/collecteddata.md b/docs/auditor/10.8/addon/privilegeduserlinux/collecteddata.md
index 6e78bcc77c..265d2f3380 100644
--- a/docs/auditor/10.8/addon/privilegeduserlinux/collecteddata.md
+++ b/docs/auditor/10.8/addon/privilegeduserlinux/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-Follow the steps to work with collected data:
+To work with collected data, follow these steps:
**Step 1 –** Start the Auditor client and navigate to **Search**.
diff --git a/docs/auditor/10.8/addon/privilegeduserlinux/overview.md b/docs/auditor/10.8/addon/privilegeduserlinux/overview.md
index 79a7524227..8074895998 100644
--- a/docs/auditor/10.8/addon/privilegeduserlinux/overview.md
+++ b/docs/auditor/10.8/addon/privilegeduserlinux/overview.md
@@ -12,7 +12,7 @@ On a high level, the add-on works as follows:
**Step 1** – The add-on listens to the specified UDP ports and captures designated Syslog messages.
-**Step 2** – Out of the box, messages from Red Hat Enterprise Linux 6, 7, 8, 9, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16 are supported. For other distributions, deployment of the rsyslog package may be required. You can edit the add-on configuration to extend the captured message list.
+**Step 2** – By default, messages from Red Hat Enterprise Linux 6, 7, 8, 9, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16 are supported. For other distributions, deployment of the rsyslog package may be required. You can edit the add-on configuration to extend the captured message list.
**Step 3** – The add-on processes these events into Netwrix Auditor-compatible format (Activity Records). Each Activity Record contains the user account, action, time, and other details.
diff --git a/docs/auditor/10.8/addon/privilegeduserlinux/parameters.md b/docs/auditor/10.8/addon/privilegeduserlinux/parameters.md
index 82d3e53903..9966f59797 100644
--- a/docs/auditor/10.8/addon/privilegeduserlinux/parameters.md
+++ b/docs/auditor/10.8/addon/privilegeduserlinux/parameters.md
@@ -16,14 +16,14 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Netwrix Auditor Endpoint | Netwrix Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Netwrix Auditor Server and uses default port _9699_. To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (_/netwrix/api_ ) |
-| Certificate Thumbprint | Possible values:
- `Empty`— Check Auditor certificate via Windows Certificate Store.
- `AB:BB:CC`— Check Auditor Server certificate thumbprint identifier.
- `NOCHECK`— Do not check Auditor certificate.
Make sure to select this parameter if you plan to specify servers by their IP. |
+| Netwrix Auditor Endpoint | Netwrix Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Netwrix Auditor Server and uses default port _9699_. To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (_/netwrix/api_ ) |
+| Certificate Thumbprint | Possible values:
- `Empty`— Check Auditor certificate via Windows Certificate Store.
- `AB:BB:CC`— Check Auditor Server certificate thumbprint identifier.
- `NOCHECK`— Don't check Auditor certificate.
ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
| Username | Specify the account under which the service will authenticate to the **Netwrix_Auditor_API**. |
| Password | Provide the password for the selected account. |
| Monitoring Plan settings | |
-| Monitoring Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Monitoring Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Monitoring Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Monitoring Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
diff --git a/docs/auditor/10.8/addon/radius/automate.md b/docs/auditor/10.8/addon/radius/automate.md
index 463df57654..496a86b2f2 100644
--- a/docs/auditor/10.8/addon/radius/automate.md
+++ b/docs/auditor/10.8/addon/radius/automate.md
@@ -14,7 +14,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task
Scheduler**.Select **Create Task**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.8/addon/radius/collecteddata.md b/docs/auditor/10.8/addon/radius/collecteddata.md
index be0186d42d..7828586b09 100644
--- a/docs/auditor/10.8/addon/radius/collecteddata.md
+++ b/docs/auditor/10.8/addon/radius/collecteddata.md
@@ -6,10 +6,10 @@ sidebar_position: 50
# Work with Collected Data
-Auditor provides a convenient interface for reviewing RADIUS server logons. Once the script
-execution completed, you can start analyzing user activity data with Netwrix search.
+Auditor provides a convenient interface for reviewing RADIUS server logons. After the script
+execution completes, you can start analyzing user activity data with Netwrix search.
-Follow the steps to see results.
+To see results, follow these steps:
**Step 1 –** Start the Auditor client and navigate to Search.
diff --git a/docs/auditor/10.8/addon/radius/customreport.md b/docs/auditor/10.8/addon/radius/customreport.md
index ab922ade8b..920e7da49f 100644
--- a/docs/auditor/10.8/addon/radius/customreport.md
+++ b/docs/auditor/10.8/addon/radius/customreport.md
@@ -11,7 +11,7 @@ additional script, **Netwrix_Auditor_Saved_Search_for_RADIUS_Server_Logons.ps1**
the add-on and creates the RADIUS server logons since yesterday custom search-based report in the
Auditor client.
-Follow the steps to create a custom report with the script.
+## Create a custom report
**Step 1 –** Copy the **Netwrix_Auditor_Saved_Search_for_RADIUS_Server_Logons.ps1** script to the
Auditor Server.
diff --git a/docs/auditor/10.8/addon/radius/overview.md b/docs/auditor/10.8/addon/radius/overview.md
index e291da084c..2eb533243d 100644
--- a/docs/auditor/10.8/addon/radius/overview.md
+++ b/docs/auditor/10.8/addon/radius/overview.md
@@ -25,7 +25,7 @@ sign-in procedures and improve overall security. In a Windows Server environment
is provided by the Network Policy Server (NPS).
In addition to providing user authentication and authorization, a RADIUS server can grant or deny
-access to a connecting device based on network policies. Companies leverage these policies to
+access to a connecting device based on network policies. Companies use these policies to
empower users to connect to the corporate infrastructure using their personal devices, while
disallowing potentially vulnerable and unsafe devices to minimize risk.
@@ -78,5 +78,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.8/addon/radius/parameters.md b/docs/auditor/10.8/addon/radius/parameters.md
index 697138743e..42f62d1fa3 100644
--- a/docs/auditor/10.8/addon/radius/parameters.md
+++ b/docs/auditor/10.8/addon/radius/parameters.md
@@ -19,7 +19,7 @@ information.
| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., WKS.enterprise.local:9999). |
| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the DOMAIN\username format. The account must be assigned the Global reviewer role in Auditor or be a member of the Netwrix Auditor Client Users group on the computer hosting Auditor Server. |
| NetwrixAuditorPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
-| NetwrixAuditorPlan | – | Unless specified, data is written to **Netwrix\_ Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. **NOTE:** If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
+| NetwrixAuditorPlan | – | Unless specified, data is written to **Netwrix\_ Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. **NOTE:** If you select a plan name in the add-on, ensure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
| RADIUSHost | localhost | Assumes that the script runs on the RADIUS server. If you want to run a script on another machine, provide a name of the computer where RADIUS server resides (e.g., 172.28.6.16, EnterpriseNPS, NPS.enterprise.local). |
| RADIUSUserName | Current user credentials | Unless specified, the script runs with the current user credentials. If you want the script to use another account to access the RADIUS server, specify the account name in the DOMAIN\username format. **NOTE:** The account must be a member of the **Domain Users** group and have the **Manage auditing and security log** right. |
| RADIUSPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
diff --git a/docs/auditor/10.8/addon/radius/powershell.md b/docs/auditor/10.8/addon/radius/powershell.md
index 8f0745c084..6dbeabc5b0 100644
--- a/docs/auditor/10.8/addon/radius/powershell.md
+++ b/docs/auditor/10.8/addon/radius/powershell.md
@@ -11,11 +11,11 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run the script with PowerShell.
+## Run the script with PowerShell
**Step 1 –** On computer where you want to execute the add-on, start **Windows PowerShell**.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
diff --git a/docs/auditor/10.8/addon/radius/troubleshooting.md b/docs/auditor/10.8/addon/radius/troubleshooting.md
index aaa64f3e10..e3e852b4ae 100644
--- a/docs/auditor/10.8/addon/radius/troubleshooting.md
+++ b/docs/auditor/10.8/addon/radius/troubleshooting.md
@@ -8,5 +8,5 @@ sidebar_position: 70
| Error in PowerShell | Resolution |
| -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| New-Object : Exception calling ".ctor" with "1" argument(s): "Attempted to perform an unauthorized operation." | The account specified for collecting events on the RADIUS server does not have sufficient rights and permissions or the password is incorrect. - Check the password for this account. - Select the account that belongs to the **Domain Users** group and has the **Manage auditing and security log** right in domain where the RADIUS server resides. |
-| New-Object : Exception calling ".ctor" with "1" argument(s): "The RPC server is unavailable" | The firewall on the RADIUS server blocks the script execution. On the server, navigate to the **Help Protect your computer with Windows Firewall** page, select **Advanced Settings** and enable the **Remote Event Log Management (RPC)** inbound rule. |
+| New-Object : Exception calling ".ctor" with "1" arguments: "Attempted to perform an unauthorized operation." | The account specified for collecting events on the RADIUS server doesn't have sufficient rights and permissions or the password is incorrect. - Check the password for this account. - Select the account that belongs to the **Domain Users** group and has the **Manage auditing and security log** right in domain where the RADIUS server resides. |
+| New-Object : Exception calling ".ctor" with "1" arguments: "The RPC server is unavailable" | The firewall on the RADIUS server blocks the script execution. On the server, navigate to the **Help Protect your computer with Windows Firewall** page, select **Advanced Settings** and enable the **Remote Event Log Management (RPC)** inbound rule. |
diff --git a/docs/auditor/10.8/addon/servicenow/alerts.md b/docs/auditor/10.8/addon/servicenow/alerts.md
index 91e9da1c09..ac067e7fcc 100644
--- a/docs/auditor/10.8/addon/servicenow/alerts.md
+++ b/docs/auditor/10.8/addon/servicenow/alerts.md
@@ -23,7 +23,7 @@ Action section of the alert properties specify the full path to Netwrix.ITSM.Ale
file (the add-on component responsible for alert handling), for example,
_C:\Addon\ITSM_SI\Netwrix.ITSM.AlertResponseAction.exe_.
-**NOTE:** Make sure to turn on alerting in Auditor. You should manually set the state to "**On**"
+**NOTE:** Ensure to turn on alerting in Auditor. You should manually set the state to "**On**"
for all alerts you want to integrate with the add-on.
Perform the following steps to integrate alerts with the add-on:
@@ -40,4 +40,4 @@ C:\Add-on\Netwrix.ITSM.AlertsUploaderTool.exe
| To... | Execute... |
|------------------------------------------| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Upload alert set shipped with the add-on | Netwrix.ITSM.AlertsUploaderTool.exe /UploadTemplates Once uploaded, the alerts appear in the **All Alerts** list in Auditor, their names start with "_ITSM add-on_". Make sure to set their state to **"On**" (turn them on) manually.
+| Upload alert set shipped with the add-on | Netwrix.ITSM.AlertsUploaderTool.exe /UploadTemplates Once uploaded, the alerts appear in the **All Alerts** list in Auditor, their names start with "_ITSM add-on_". Ensure to set their state to **"On**" (turn them on) manually.
diff --git a/docs/auditor/10.8/addon/servicenow/deployment.md b/docs/auditor/10.8/addon/servicenow/deployment.md
index d9a95c0a71..b1bf198b6d 100644
--- a/docs/auditor/10.8/addon/servicenow/deployment.md
+++ b/docs/auditor/10.8/addon/servicenow/deployment.md
@@ -6,8 +6,6 @@ sidebar_position: 40
# Deploy the Service
-Follow the steps to deploy the service.
-
**Step 1 –** Locate the add-on folder on the computer where the Auditor Server resides.
**Step 2 –** Run the **install.cmd** file. The file deploys and enables the Auditor **ITSM
diff --git a/docs/auditor/10.8/addon/servicenow/install.md b/docs/auditor/10.8/addon/servicenow/install.md
index 7568f3aba2..bfdeb0a728 100644
--- a/docs/auditor/10.8/addon/servicenow/install.md
+++ b/docs/auditor/10.8/addon/servicenow/install.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Add-On
-After downloading the add-on package from Netwrix add-on store, copy it to the a computer where the
+After downloading the add-on package from Netwrix add-on store, copy it to a computer where the
Auditor Server resides. Unpack the ZIP archive to a folder of your choice.
The main component of the add- on is implemented as a service named Netwrix Auditor **ITSM
diff --git a/docs/auditor/10.8/addon/servicenow/overview.md b/docs/auditor/10.8/addon/servicenow/overview.md
index 568065961b..7dccbfc445 100644
--- a/docs/auditor/10.8/addon/servicenow/overview.md
+++ b/docs/auditor/10.8/addon/servicenow/overview.md
@@ -18,8 +18,8 @@ what actions should lead to ticket creation.
On a high level, the add-on works as follows:
-1. The add-ons comes with a special set of alerts developed by Netwrix industry experts. With a help
- of a straight- forward command- line tool, you upload these alerts to Netwrix Auditor and enable
+1. The add-on comes with a special set of alerts developed by Netwrix industry experts. With the help
+ of a straightforward command-line tool, you upload these alerts to Netwrix Auditor and enable
integration with add-on.
2. Whenever the alert is triggered, the add-on retrieves an Activity Records for this action using
the Netwrix Auditor Integration API. Each Activity Record contains the user account, action,
@@ -37,6 +37,6 @@ follows:
| On... | Ensure that... |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| The Auditor Server side | - Auditor version is **9.8** or later. - The Audit Database settings are configured in the Auditor. See the [Audit Database](/docs/auditor/10.8/admin/settings/auditdatabase.md)topic for additional information. - The TCP 9699 port (default Auditor Integration API port) is open for inbound connections. - The user retrieving data from the Audit Database is granted the Global reviewer role in the Auditor or is a member of the Netwrix Auditor Client Users group. Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user will have the most extended permissions in the product. |
-| On the ServiceNow side | - ServiceNow version should be any of the following: - Helsinki - Istanbul - Kingston - London **NOTE:** Currently, Jakarta version has only experimental support. - A new user is created and has sufficient permissions to create tickets and update them. The **itil** role is recommended. If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
+| On the ServiceNow side | - ServiceNow version should be any of the following: - Helsinki - Istanbul - Kingston - London **NOTE:** Jakarta version has only experimental support. - A new user is created and has sufficient permissions to create tickets and update them. The **itil** role is recommended. If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
See the [Integration API](/docs/auditor/10.8/api/overview.md) topic for additional information.
diff --git a/docs/auditor/10.8/addon/servicenow/parameters.md b/docs/auditor/10.8/addon/servicenow/parameters.md
index d574a8a695..d9f7c62b74 100644
--- a/docs/auditor/10.8/addon/servicenow/parameters.md
+++ b/docs/auditor/10.8/addon/servicenow/parameters.md
@@ -24,10 +24,10 @@ parameters depending on your execution scenario and security policies.
| **Connection to Netwrix Auditor** | | |
| NetwrixAuditorHost | localhost:9699 | - The add-on runs on the computer where the Auditor Server resides and uses the default Integration API port **9699**. To specify a non-default port, provide a new port number (e.g., _https://localhost:8788_). - The add- on must always run locally, on the computer where the Auditor Server resides. |
| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs under the **LocalSystem** account. If you want the add-on to use another account to connect to the Auditor Server, specify the account name in the _DOMAIN\username_ format. Alternatively, after deploying the **Netwrix Auditor ITSM Integration Service** service, specify an account in its properties. The account must be assigned the Global reviewer role in the Auditor or be a member of the Netwrix Auditor**Administrators** group. The user must have sufficient permissions to create files on the computer. |
-| NetwrixAuditorPassword | – | Provide a password for the account. Unless an account is specified, the service runs under the **LocalSystem** account and does not require a password. |
+| NetwrixAuditorPassword | – | Provide a password for the account. Unless an account is specified, the service runs under the **LocalSystem** account and doesn't require a password. |
| TicketFloodLimit | 10 | Specify the maximum number of standalone tickets the service can create during **TicketFloodInterval**. If a ticket flood limit is reached, the service writes all new alerts into a single ticket. |
| TicketFloodInterval | 3600 | Specify the time period, in seconds. During this time period, the service can create as many tickets as specified in **TicketFloodLimit**. The default value is 3600 seconds, i.e., 1 hour. |
-| ConsolidationInterval | 900 | Specify the time period, in seconds. During this time period, the service does not process similar alerts as they happen but consolidates them before updating open tickets in your ITSM. The default values is 900 seconds, i.e., 15 minutes. This option works in combination with **UpdateTicketOnRepetitiveAlerts** and is helpful if you want to reduce the number of ticket updates on ITSM side. I.e., this option defines the maximum delay for processing alerts and updating existing tickets. Tickets for new alert types are created immediately. For example, a new alert is triggered—the service opens a new incident ticket. The alert keeps firing 20 times more within 10 minutes. Instead of updating the ticket every time, the service consolidates alerts for 15 minutes, and then updates a ticket just ones with all collected data. |
+| ConsolidationInterval | 900 | Specify the time period, in seconds. During this time period, the service doesn't process similar alerts as they happen but consolidates them before updating open tickets in your ITSM. The default value is 900 seconds, that is, 15 minutes. This option works in combination with **UpdateTicketOnRepetitiveAlerts** and is helpful if you want to reduce the number of ticket updates on ITSM side. That is, this option defines the maximum delay for processing alerts and updating existing tickets. Tickets for new alert types are created immediately. For example, a new alert is triggered—the service opens a new incident ticket. The alert keeps firing 20 times more within 10 minutes. Instead of updating the ticket every time, the service consolidates alerts for 15 minutes, and then updates a ticket just once with all collected data. |
| CheckAlertQueueInterval | 5 | Internal parameter. Check and process the alert queue every N seconds; in seconds. |
| UpdateTicketOnRepetitiveAlerts | true | Instead of creating a new ticket, reopen an existing ticket that is in a closed state (be default, closed, canceled, and resolved) if a similar alert occurs within **UpdateInterval**. This option works only when **UpdateTicketOnRepetitiveAlerts** is set to "_true_". **NOTE:** If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
| UpdateInterval | 86400 | Specify the time period, in seconds. If a similar alert occurs in less than N seconds, it is treated as a part of an existing incident. The default value is 86400 seconds, i.e., 24 hours. If an alerts is triggered after the **UpdateInterval** is over, a new ticket is created. |
@@ -36,21 +36,19 @@ parameters depending on your execution scenario and security policies.
| ProcessActivityRecordQueueInterval | 5 | Internal parameter. Process Activity Record queue every N seconds; in seconds. |
| DisplayOnlyFirstActivityRecord | true | Add only the first Activity Record in the work notes, Activity Records that update this ticket will be added as attachments to this ticket. If false, all Activity Records will be displayed in the ticket work notes. |
| **ActivityRecordRequestsRetention** | | |
-| RequestLimit | 5000 | Internal parameter. The maximum number of Activity Record requests the service can store in its internal memory. Once the limit is reached, the service clears Activity Record requests starting with older ones. |
+| RequestLimit | 5000 | Internal parameter. The maximum number of Activity Record requests the service can store in its internal memory. When the limit is reached, the service clears Activity Record requests starting with older ones. |
| RequestLimitInterval | 604800 | Internal parameter. The service can store the Activity Record requests not older than N seconds; in seconds. Older Activity Record requests are cleared. |
| **ActivityRecordWebRequests** | | |
| RequestLimit | 200 | Internal parameter. The maximum number of Activity Records the service can retrieve in a single request. |
| RequestTimeout | 180 | Internal parameter. By default, 3 minutes. Defines the connection timeout. |
| **TicketRequestsRetention** | | |
-| RequestLimit | 300000 | Internal parameter. The maximum number of ticket requests the service can store in its internal memory. Once the limit is reached, the service clears ticket requests starting with older ones. |
+| RequestLimit | 300000 | Internal parameter. The maximum number of ticket requests the service can store in its internal memory. When the limit is reached, the service clears ticket requests starting with older ones. |
| RequestLimitInterval | 604800 | Internal parameter. The service can store the ticket requests not older than N seconds; in seconds. Older tickets requests are cleared. |
**NOTE:** Stop and then restart the service every time you update any of configuration files.
## ServiceNow Parameters
-Follow the steps to define ServiceNow parameters:
-
**Step 1 –** Navigate to your add-on folder and select **ServiceNowSettings.xml**.
**Step 2 –** Define parameters such as ServiceNow connection parameters inside the ``
@@ -61,7 +59,7 @@ section.
| `` parameter | Default value | Description |
| ------------------------ | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| URL | — | Provide a link to your ServiceNow system (e.g., _https://enterprise.service-now.com_). |
-| UserName | — | Specify a user account. Make sure the user has sufficient permissions to create tickets and update them. The **itil** role is recommended. **NOTE:** If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
+| UserName | — | Specify a user account. Ensure the user has sufficient permissions to create tickets and update them. The **itil** role is recommended. **NOTE:** If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
| Password | — | Provide a password. |
**Step 4 –** Review the `` section. The parameters inside this section correspond
@@ -72,7 +70,7 @@ Each `` includes the` ` and` ` pair
ServiceNow ticket field and a value that will be assigned to it. For most parameters, default values
are provided. Add more ticket parameters or update values if necessary.
-**NOTE:** The template remains the same for all alerts and cannot be adjusted per individual alerts.
+**NOTE:** The template remains the same for all alerts and can't be adjusted per individual alerts.
| Name | Value | Description |
| ------------------ | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -81,7 +79,7 @@ are provided. Add more ticket parameters or update values if necessary.
| impact | 1 | Sets **Impact** to "_1 – High_". |
| urgency | 1 | Sets **Urgency** to "_1 – High_". |
| severity | 1 | Sets **Severity** to "_1 – High_". |
-| assignment\_ group | d625dccec0a8016700a22a0 f7900d06 | Sets **Assignment** group to "_Service Desk_". **NOTE:** You cannot use a group name as a value. Provide its guid instead. |
+| assignment\_ group | d625dccec0a8016700a22a0 f7900d06 | Sets **Assignment** group to "_Service Desk_". **NOTE:** You can't use a group name as a value. Provide its guid instead. |
| description | %AlertDescription% %PreviousTicketReference% | Provides an alert description and references to related tickets in **Description**. |
| work_notes | Alert Details: ... | Adds the full alert text to Work notes, including data source, who, what, where, etc. To find out what is included in the alert details, see the **ServiceNowSettings.xml** file. **NOTE:** You can write alert details in the **Additional comments** field instead of Work notes. To do this, rename `work_notes `into `comments`. If you want to write alert details into both fields, create a copy of `` entry containing work_notes and `work_notes` into `comments` tag (e.g., 8 for canceled). |
-| NewState | Defines a ticket status once it is reopened. By default, new. To specify another status, provide its ID in the `` tag (e.g., 1 for new). |
+| NewState | Defines a ticket status when it is reopened. By default, new. To specify another status, provide its ID in the `` tag (e.g., 1 for new). |
**NOTE:** Stop and then restart the service every time you update any of configuration files.
diff --git a/docs/auditor/10.8/addon/siem/activityrecords.md b/docs/auditor/10.8/addon/siem/activityrecords.md
index 29a862a188..9c47257657 100644
--- a/docs/auditor/10.8/addon/siem/activityrecords.md
+++ b/docs/auditor/10.8/addon/siem/activityrecords.md
@@ -23,11 +23,11 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters—the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
+## Run add-on with PowerShell
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -69,7 +69,7 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
first run. At the end of the first run, the timestamp will be created, and the next run will start
@@ -90,7 +90,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task
Scheduler**.Task Scheduler.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.8/addon/siem/collecteddata.md b/docs/auditor/10.8/addon/siem/collecteddata.md
index 2a5c298623..2bf782648d 100644
--- a/docs/auditor/10.8/addon/siem/collecteddata.md
+++ b/docs/auditor/10.8/addon/siem/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 40
# Work with Collected Data
-Follow the steps to work with collected data:
-
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.8/addon/siem/configure.md b/docs/auditor/10.8/addon/siem/configure.md
index 9f7065066d..a25ee91d06 100644
--- a/docs/auditor/10.8/addon/siem/configure.md
+++ b/docs/auditor/10.8/addon/siem/configure.md
@@ -33,10 +33,10 @@ dynamically calculated EventIDs will be modified and applied incorrectly.
| Parameter | Default value | Description |
| ------------------------------ | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to TRUE. _Object Type - Action_ pair may be identical for several data sources (e.g., Object='User' and Action='Added'); thus, excluding DataSource from calculation may lead to the same EventID (duplicates). See the [Export Activity Records ](/docs/auditor/10.8/addon/siem/activityrecords.md) topic for additional information.. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the **DataSource** field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the **DataSource** field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the **DataSource** field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular **DataSource** does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the **DataSource** field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the **DataSource** field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the **DataSource** field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular **DataSource** doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
## Alerts to Event Log Add-on Settings
diff --git a/docs/auditor/10.8/addon/siem/deployment.md b/docs/auditor/10.8/addon/siem/deployment.md
index 73a9db3f95..b6157dec2b 100644
--- a/docs/auditor/10.8/addon/siem/deployment.md
+++ b/docs/auditor/10.8/addon/siem/deployment.md
@@ -32,7 +32,7 @@ The script will be executed on Auditor Server.
By default, Auditor uses the _LocalSystem_ account to run PowerShell scripts. If you want to use
another account, in the alert settings go to **Response Action**, select the **Use custom
-credentials** checkbox and specify user name and password. Make sure this account has **Log on as
+credentials** checkbox and specify user name and password. Ensure this account has **Log on as
batch job** privilege. See the
[Configure a Response Action for Alert](/docs/auditor/10.8/admin/alertsettings/responseaction.md) topic for
additional information.
diff --git a/docs/auditor/10.8/addon/siem/integrationeventlog.md b/docs/auditor/10.8/addon/siem/integrationeventlog.md
index bb0ba17b32..55b3dd8868 100644
--- a/docs/auditor/10.8/addon/siem/integrationeventlog.md
+++ b/docs/auditor/10.8/addon/siem/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.8/addon/siem/overview.md b/docs/auditor/10.8/addon/siem/overview.md
index 1844fb87e3..b8f4e98449 100644
--- a/docs/auditor/10.8/addon/siem/overview.md
+++ b/docs/auditor/10.8/addon/siem/overview.md
@@ -50,11 +50,11 @@ follows:
| On... | Ensure that... |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The Auditor Server side | - Auditor version is **9.96** or 10. - The alert response action settings in Auditor Server are configured as follows: - **Take action when alert occurs** is switched **ON** - **Run** field contains the path to Windows PowerShell: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` - **With parameters** field contains the required parameters, including the path to **Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1** file. Example: `-File C:\Netwrix_Auditor_Add-on_for_SIEM\Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1 -NetwrixPathToCsvData` For details on script parameters, see the section below. - **Write data to CSV file** option is selected - **Command line preview** looks like this: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File C:\Netwrix_Auditor_Add-on_for_SIEM\Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1 -NetwrixPathToCsvData {CsvFile}` - By default, the executable file will be launched under the _LocalSystem_ account. If you want to use another account, make sure it has **Log on as batch job** privilege on Netwrix Auditor server. You may want to perform the test run after configuring the script as the alert response action. If so, consider that current user account (logged on to Auditor client) must have local **Administrator** privileges on AuditorServer where the executable file is located. |
+| The Auditor Server side | - Auditor version is **9.96** or 10. - The alert response action settings in Auditor Server are configured as follows: - **Take action when alert occurs** is switched **ON** - **Run** field contains the path to Windows PowerShell: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` - **With parameters** field contains the required parameters, including the path to **Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1** file. Example: `-File C:\Netwrix_Auditor_Add-on_for_SIEM\Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1 -NetwrixPathToCsvData` For details on script parameters, see the section below. - **Write data to CSV file** option is selected - **Command line preview** looks like this: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File C:\Netwrix_Auditor_Add-on_for_SIEM\Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1 -NetwrixPathToCsvData {CsvFile}` - By default, the executable file will be launched under the _LocalSystem_ account. If you want to use another account, ensure it has **Log on as batch job** privilege on Netwrix Auditor server. You may want to perform the test run after configuring the script as the alert response action. If so, consider that current user account (logged on to Auditor client) must have local **Administrator** privileges on AuditorServer where the executable file is located. |
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
## Activity Records to Event Log Add-on
@@ -75,9 +75,9 @@ Auditor Integration API, refer to [Integration API](/docs/auditor/10.8/api/overv
This add-on works as response action to the alert, as follows:
-1. The administrator enables and configured response action for selected alert, as described in the
+1. The administrator enables and configures a response action for the selected alert, as described in the
following topic:
- [Configure a Response Action for Alert](/docs/auditor/10.8/admin/alertsettings/responseaction.md). Make sure
+ [Configure a Response Action for Alert](/docs/auditor/10.8/admin/alertsettings/responseaction.md). Ensure
to provide correct path to the script file and to select the Write data to CSV file option.
2. When the alert is triggered, the script starts - it retrieves audit data (activity record fields)
from the CSV file and processes it into log events. Each event contains the user account, action,
diff --git a/docs/auditor/10.8/addon/siemcefexport/automate.md b/docs/auditor/10.8/addon/siemcefexport/automate.md
index a498e2ad5e..082a61b140 100644
--- a/docs/auditor/10.8/addon/siemcefexport/automate.md
+++ b/docs/auditor/10.8/addon/siemcefexport/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.8/addon/siemcefexport/collecteddata.md b/docs/auditor/10.8/addon/siemcefexport/collecteddata.md
index eb9595672d..d446366ec3 100644
--- a/docs/auditor/10.8/addon/siemcefexport/collecteddata.md
+++ b/docs/auditor/10.8/addon/siemcefexport/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
-
**Step 1 –** Navigate to the destination folder and open a CEF log file.
**Step 2 –** Review audit data exported from the Audit Database. For example, review this
diff --git a/docs/auditor/10.8/addon/siemcefexport/deployment.md b/docs/auditor/10.8/addon/siemcefexport/deployment.md
index 1295850403..edfb15cc56 100644
--- a/docs/auditor/10.8/addon/siemcefexport/deployment.md
+++ b/docs/auditor/10.8/addon/siemcefexport/deployment.md
@@ -6,7 +6,7 @@ sidebar_position: 20
## Choose Appropriate Execution Scenario
-Netwrix Auditor Netwrix Risk Insights runs on any computer in your environment. For example, you can
+Netwrix Auditor runs on any computer in your environment. For example, you can
run the add-on on the computer where Netwrix Auditor is installed or on a remote server. Depending
on the execution scenario you choose, you have to define a different set of parameters. See the
[Define Parameters](/docs/auditor/10.8/addon/siemcefexport/parameters.md) topic for additional information.
diff --git a/docs/auditor/10.8/addon/siemcefexport/overview.md b/docs/auditor/10.8/addon/siemcefexport/overview.md
index 4ea2e91e24..bcdfdb00e4 100644
--- a/docs/auditor/10.8/addon/siemcefexport/overview.md
+++ b/docs/auditor/10.8/addon/siemcefexport/overview.md
@@ -46,5 +46,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.8/addon/siemcefexport/powershell.md b/docs/auditor/10.8/addon/siemcefexport/powershell.md
index 26a4c47f31..9a9e1fc395 100644
--- a/docs/auditor/10.8/addon/siemcefexport/powershell.md
+++ b/docs/auditor/10.8/addon/siemcefexport/powershell.md
@@ -11,11 +11,11 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
+## Run add-on with PowerShell
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -34,7 +34,9 @@ quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Ad
Depending on the number of Activity Records stored in Auditor Audit Database execution may take a
while. Ensure the script execution completed successfully. The CEF log file will be created in the
-destination folder. Note that details (or 'msg' in CEF terms) exceeding 16000 symbols are trimmed.
+destination folder. :::note
+Details (or 'msg' in CEF terms) exceeding 16000 symbols are trimmed.
+:::
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records.
diff --git a/docs/auditor/10.8/addon/siemeventlogexport/automate.md b/docs/auditor/10.8/addon/siemeventlogexport/automate.md
index f436e20c0b..f7c3cb6a7e 100644
--- a/docs/auditor/10.8/addon/siemeventlogexport/automate.md
+++ b/docs/auditor/10.8/addon/siemeventlogexport/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.8/addon/siemeventlogexport/collecteddata.md b/docs/auditor/10.8/addon/siemeventlogexport/collecteddata.md
index f54d6b1dc3..98900d2a6e 100644
--- a/docs/auditor/10.8/addon/siemeventlogexport/collecteddata.md
+++ b/docs/auditor/10.8/addon/siemeventlogexport/collecteddata.md
@@ -6,8 +6,6 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
-
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.8/addon/siemeventlogexport/deployment.md b/docs/auditor/10.8/addon/siemeventlogexport/deployment.md
index e8e40e92af..68b7a42967 100644
--- a/docs/auditor/10.8/addon/siemeventlogexport/deployment.md
+++ b/docs/auditor/10.8/addon/siemeventlogexport/deployment.md
@@ -18,7 +18,7 @@ Netwrix suggests the following execution scenarios:
| The add-on runs on the Auditor Server with the current user credentials. Activity Records are exported to a local event log. | C:\Add-ons\Netwrix*Auditor_Event_Log* Export_Add-on.ps1 |
| The add-on runs on the Auditor Server with explicitly defined credentials. Activity Records are exported to a local event log. | C:\Add-ons\Netwrix*Auditor_Event_Log* Export_Add-on.ps1 -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool |
| The add-on exports Activity Records from a remote Auditor Server using current user credentials and writes data to a local event log. | C:\Add-ons\Netwrix*Auditor_Event_Log* Export_Add-on.ps1 -NetwrixAuditorHost 172.28.6.15 |
-| The add-on exports Activity Records from a remoteAuditor Server using explicitly defined credentials and writes data to a local event log. | C:\Add-ons\Netwrix*Auditor_Event_Log* Export_Add-on.ps1 -NetwrixAuditorHost 172.28.6.15 -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool |
+| The add-on exports Activity Records from a remote Auditor Server using explicitly defined credentials and writes data to a local event log. | C:\Add-ons\Netwrix*Auditor_Event_Log* Export_Add-on.ps1 -NetwrixAuditorHost 172.28.6.15 -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool |
For security reasons, Netwrix recommends running the script with current user credentials (skipping
user credentials). Create a special user account with permissions to both Auditor data and event log
diff --git a/docs/auditor/10.8/addon/siemeventlogexport/overview.md b/docs/auditor/10.8/addon/siemeventlogexport/overview.md
index b25efc5624..e2128749e9 100644
--- a/docs/auditor/10.8/addon/siemeventlogexport/overview.md
+++ b/docs/auditor/10.8/addon/siemeventlogexport/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 230
# SIEM Generic Integration for Event Log Export
-Netwrix Auditor helps you protect and get most from your SIEM investment. The Event Log Export
-Add-on works in collaboration with Netwrix Auditor , supplying additional data that augments the
+Netwrix Auditor helps you protect and get the most from your SIEM investment. The Event Log Export
+Add-on works in collaboration with Netwrix Auditor, supplying additional data that augments the
data collected by SIEM.
The add-on enriches your SIEM data with actionable context in human-readable format, including the
@@ -42,6 +42,6 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging the Integration API. Download the latest add- on version in the Add- on Store. See the
[Integration API](/docs/auditor/10.8/api/overview.md) topic for additional information about schema updates.
diff --git a/docs/auditor/10.8/addon/siemeventlogexport/parameters.md b/docs/auditor/10.8/addon/siemeventlogexport/parameters.md
index a78ba14978..231d3c01f1 100644
--- a/docs/auditor/10.8/addon/siemeventlogexport/parameters.md
+++ b/docs/auditor/10.8/addon/siemeventlogexport/parameters.md
@@ -18,6 +18,6 @@ parameters— the script uses a default value unless a parameter is explicitly d
| Parameter | Default value | Description |
| ---------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add- on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., WKS.enterprise.local:9999). |
+| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. To run the add-on from a different machine, provide the computer name where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., WKS.enterprise.local:9999). |
| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the DOMAIN\username format. **NOTE:** The account must be assigned the **Global reviewer** role in Auditor or be a member of the **Netwrix Auditor Client Users** group on the computer hosting Auditor Server. |
| NetwrixAuditorPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
diff --git a/docs/auditor/10.8/addon/siemeventlogexport/powershell.md b/docs/auditor/10.8/addon/siemeventlogexport/powershell.md
index 4bb7b4194a..e8d5465ef1 100644
--- a/docs/auditor/10.8/addon/siemeventlogexport/powershell.md
+++ b/docs/auditor/10.8/addon/siemeventlogexport/powershell.md
@@ -11,12 +11,9 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
+**Step 1 –** On the computer where you want to execute the add-on, start Windows PowerShell.
-**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
-window.
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console window.
**Step 3 –** Add script parameters. The console will look similar to the following:
diff --git a/docs/auditor/10.8/addon/solarwinds/automate.md b/docs/auditor/10.8/addon/solarwinds/automate.md
index 082a39da0e..218f245b25 100644
--- a/docs/auditor/10.8/addon/solarwinds/automate.md
+++ b/docs/auditor/10.8/addon/solarwinds/automate.md
@@ -9,11 +9,11 @@ sidebar_position: 40
To ensure you feed the most recent data to your SIEM solution, Netwrix recommends scheduling a daily
task for running the add-on.
-**Perform the following steps to create a scheduled task:**
+## Create a scheduled task
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.8/addon/solarwinds/collecteddata.md b/docs/auditor/10.8/addon/solarwinds/collecteddata.md
index 6f1f0a7795..7bfd4f0702 100644
--- a/docs/auditor/10.8/addon/solarwinds/collecteddata.md
+++ b/docs/auditor/10.8/addon/solarwinds/collecteddata.md
@@ -6,10 +6,7 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
-
-**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
-Programs** > **Event Viewer**.
+**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All Programs** > **Event Viewer**.
**Step 2 –** In the Event Viewer dialog, navigate to **Event Viewer (local)** > **Applications and
Services Logs** >Netwrix Auditor Integration log.
diff --git a/docs/auditor/10.8/addon/solarwinds/integrationeventlog.md b/docs/auditor/10.8/addon/solarwinds/integrationeventlog.md
index 3c5f1352c1..9f77bb9eff 100644
--- a/docs/auditor/10.8/addon/solarwinds/integrationeventlog.md
+++ b/docs/auditor/10.8/addon/solarwinds/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.8/addon/solarwinds/overview.md b/docs/auditor/10.8/addon/solarwinds/overview.md
index 7633f5a2c6..bcf5ee80d4 100644
--- a/docs/auditor/10.8/addon/solarwinds/overview.md
+++ b/docs/auditor/10.8/addon/solarwinds/overview.md
@@ -46,5 +46,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.8/addon/solarwinds/powershell.md b/docs/auditor/10.8/addon/solarwinds/powershell.md
index 9df9eb9dc5..5e188df345 100644
--- a/docs/auditor/10.8/addon/solarwinds/powershell.md
+++ b/docs/auditor/10.8/addon/solarwinds/powershell.md
@@ -15,7 +15,7 @@ modify the parameters as required.
**Step 1 –** On computer where you want to execute the add-on, start **Windows PowerShell**.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -56,7 +56,7 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
first run. At the end of the first run, the timestamp will be created, and the next run will start
diff --git a/docs/auditor/10.8/addon/splunk/collecteddata.md b/docs/auditor/10.8/addon/splunk/collecteddata.md
index 9c66e08749..0a97143cd8 100644
--- a/docs/auditor/10.8/addon/splunk/collecteddata.md
+++ b/docs/auditor/10.8/addon/splunk/collecteddata.md
@@ -10,8 +10,6 @@ Review the examples below for the possible scenarios on how to work with collect
## Search by Index
-Follow the steps to search by index:
-
**Step 1 –** Navigate to the **Search** page of the add-on or **Search & Reporting** Splunk app
**Step 2 –** Enter the search command:
@@ -26,14 +24,14 @@ for example:
index=netwrix_index
```
-**Step 3 –** Press the **Last 24 hours** button and choose **All time** time range.
+**Step 3 –** Press the **Last 24 hours** button and choose **All time**.
-**Step 4 –** Press the search button; you should see list of the events currently indexed in Splunk.
+**Step 4 –** Press the search button; you should see list of the events indexed in Splunk.
-**Step 5 –** Click on the arrow button next to any of the returned event to expand the list of
+**Step 5 –** Click the arrow button next to any of the returned event to expand the list of
parsed fields and confirm that fields are populated properly.
-> If you do not see any fields, make sure that you are running the search in Smart or Verbose mode.
+> If you don't see any fields, ensure that you are running the search in Smart or Verbose mode.
## Use Index Search and Netwrix Auditor Fields
@@ -48,14 +46,12 @@ index=netwrix_index Action=Added ObjectType=user
| table Who Action ObjectType What Where
```
-**Step 3 –** Press the **Last 24 hours** button and choose **All time** time range.
+**Step 3 –** Press the **Last 24 hours** button and choose **All time**.
**Step 4 –** Press the search button.
## Search by CIM Data Model
-Follow the steps to search by data model:
-
**Step 1 –** Navigate to the **Search** page of the add-on or **Search & Reporting** Splunk app
**Step 2 –** Enter the search command:
@@ -72,12 +68,12 @@ for example:
| search sourcetype=netwrix
```
-**Step 3 –** Press the **Last 24 hours** button and choose **All time** time range.
+**Step 3 –** Press the **Last 24 hours** button and choose **All time**.
-**Step 4 –** Press the search button; you should see list of the events currently indexed in Splunk
+**Step 4 –** Press the search button; you should see list of the events indexed in Splunk
and mapped to the selected data model.
-**Step 5 –** Click on the arrow button next to any of the returned event to expand the list of
+**Step 5 –** Click the arrow button next to any of the returned event to expand the list of
parsed fields and confirm that fields are populated properly.
## Use CIM Data Model Search and Data Model Fields
@@ -94,6 +90,6 @@ The following example shows how to get all events for account deletion.
| table All_Changes.vendor_product All_Changes.action All_Changes.src All_Changes.dest All_Changes.user All_Changes.object All_Changes.object_attrs
```
-**Step 3 –** Press the **Last 24 hours** button and choose **All time** time range.
+**Step 3 –** Press the **Last 24 hours** button and choose **All time**.
**Step 4 –** Press the search button.
diff --git a/docs/auditor/10.8/addon/splunk/datamodelmap.md b/docs/auditor/10.8/addon/splunk/datamodelmap.md
index c5119f02c6..ecfa3cb643 100644
--- a/docs/auditor/10.8/addon/splunk/datamodelmap.md
+++ b/docs/auditor/10.8/addon/splunk/datamodelmap.md
@@ -9,7 +9,7 @@ sidebar_position: 30
The Splunk Common Information Model (CIM) is installed with an add-on and adds a set of data models
that allow data normalization to simplify search.
-The CIM contains a number of standard data models that can be used for search. Each of them has
+The CIM contains a number of standard data models that you can use to search. Each of them has
predefined set of standard fields common for different data sources.
Netwrix Auditor add-on for Splunk will map some of the Activity Records that match certain scenario
diff --git a/docs/auditor/10.8/addon/splunk/deployment.md b/docs/auditor/10.8/addon/splunk/deployment.md
index 7256d627da..0c799b0fb6 100644
--- a/docs/auditor/10.8/addon/splunk/deployment.md
+++ b/docs/auditor/10.8/addon/splunk/deployment.md
@@ -14,9 +14,9 @@ Follow the steps below.
**Step 2 –** Unpack it to a folder on the computer from which you can access Splunk Web.
-**Step 3 –** Login to Splunk Web using Splunk Administrator account.
+**Step 3 –** log in to Splunk Web using Splunk Administrator account.
-**Step 4 –** Expand the drop-down list at the top panel and choose **Manage Apps**.
+**Step 4 –** Expand the dropdown list at the top panel and choose **Manage Apps**.
**Step 5 –** On the **Apps** screen, click **Install app from file**.
@@ -29,9 +29,7 @@ The installed add-on should appear in the Apps list. Splunk might not display ad
## Configure the add-on
-Follow the steps to configure the add-on.
-
-**Step 1 –** Open **Netwrix Auditor Add-on for Splunk** from the drop-down list at the top panel and navigate to the **Configuration** page.
+**Step 1 –** Open **Netwrix Auditor Add-on for Splunk** from the dropdown list at the top panel and navigate to the **Configuration** page.
**Step 2 –** Configure the account:
@@ -42,7 +40,7 @@ Follow the steps to configure the add-on.
- For the Account name provide a unique name for the account that will be visible to the add-on
users
- In the Username field insert the user name of the account that will be used to access Netwrix
- Auditor Integration API. If a domain account is used, make sure to use the _DOMAIN\User_
+ Auditor Integration API. If a domain account is used, ensure to use the _DOMAIN\User_
format.
- In the Password field insert the account password
@@ -65,11 +63,9 @@ Follow the steps to configure the add-on.
Splunk uses indexes to store data and manage access to it. While you can send Netwrix Auditor data
to one of the existing indexes it is strongly recommended to create a separate index.
-Follow the steps to configure data input.
-
**Step 1 –** Create a new index to store data from Netwrix Auditor:
-1. In Splunk expand the **Settings** drop-down menu and click on the **Indexes** option under the **DATA**
+1. In Splunk expand the **Settings** dropdown menu and click the **Indexes** option under the **DATA**
section.
2. Press the **New Index** button to create an index.
3. Provide the new index parameters:
@@ -95,7 +91,7 @@ Follow the steps to configure data input.
**CAUTION:** This field should never be empty.
- - Checkpoint type specifies location for continuation mark data. Do not change this setting unless advised by your Splunk Administrator.
+ - Checkpoint type specifies location for continuation mark data. Don't change this setting unless advised by your Splunk Administrator.
4. Click the **Add** button.
diff --git a/docs/auditor/10.8/addon/splunk/overview.md b/docs/auditor/10.8/addon/splunk/overview.md
index 3ba5faad88..b5f53c6873 100644
--- a/docs/auditor/10.8/addon/splunk/overview.md
+++ b/docs/auditor/10.8/addon/splunk/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 250
# Splunk
**Netwrix Auditor** is a visibility platform for user behavior analysis and risk mitigation that enables
-control over changes, configurations and access in hybrid IT environments to protect data regardless
+control over changes, configurations, and access in hybrid IT environments to protect data regardless
of its location. The platform provides security analytics to detect anomalies in user behavior and
investigate threat patterns before a data breach occurs.
@@ -55,8 +55,8 @@ index.
-To learn more about Netwrix Auditor activity records, see the
-[Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md) topic for additional information.
+See the [Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md) topic for additional
+information.
For this data to be provided to Splunk, it adds a new Splunk source type, performing additional data
parsing and field extraction. The audit data is also mapped into the Common Information Model (CIM)
@@ -95,7 +95,7 @@ Before running the add-on, ensure that all the necessary components and policies
### Auditor Server side
1. Auditor version is 9.96 or higher.
-2. Netwrix Auditor Integration API and Audit Database are configured. Make sure that Netwrix Auditor Integration API is configured to use HTTPS protocol.
+2. Netwrix Auditor Integration API and Audit Database are configured. Ensure that Netwrix Auditor Integration API is configured to use HTTPS protocol.
See the [Prerequisites](/docs/auditor/10.8/api/prerequisites.md) and [Audit Database](/docs/auditor/10.8/admin/settings/auditdatabase.md) topics for additional information.
3. The user retrieving data from the Audit Database is granted the Global reviewer role in Auditor or is a member of the Netwrix Auditor Client Users group. It is recommended to create a dedicated account for that purpose.
Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user will have the most extended permissions in the product.
@@ -110,7 +110,7 @@ See the [Role-Based Access and Delegation](/docs/auditor/10.8/admin/monitoringpl
### HTTPS certificate requirements
-Starting with version **1.7.0**, the Netwrix Auditor add-on for Splunk requires the HTTPS certificate used by the Netwrix Auditor Integration API to be trusted by the Splunk add-on. If the certificate is not trusted, the add-on will not be able to retrieve data from the Integration API.
+Starting with version **1.7.0**, the Netwrix Auditor add-on for Splunk requires the HTTPS certificate used by the Netwrix Auditor Integration API to be trusted by the Splunk add-on. If the certificate isn't trusted, the add-on will not be able to retrieve data from the Integration API.
You can satisfy this requirement using one of the following options:
@@ -133,7 +133,7 @@ After updating the trust store, proceed with add-on configuration.
## Considerations and limitations
-- If the information is not available in the activity record received from Auditor, it will also not
+- If the information isn't available in the activity record received from Auditor, it will also not
be available in Splunk.
- CIM might not have data models for some of the activity records received from Auditor; such
information can only be accessed in Splunk using search by index.
diff --git a/docs/auditor/10.8/addon/splunk/troubleshooting.md b/docs/auditor/10.8/addon/splunk/troubleshooting.md
index df77c395d2..bddc14c6de 100644
--- a/docs/auditor/10.8/addon/splunk/troubleshooting.md
+++ b/docs/auditor/10.8/addon/splunk/troubleshooting.md
@@ -6,8 +6,9 @@ sidebar_position: 40
# Maintenance and Troubleshooting
-Splunk records service logs to the `_internal` index. Follow the steps to troubleshoot data input
-from Netwrix Auditor API:
+Splunk records service logs to the `_internal` index.
+
+## Troubleshoot data input from Netwrix Auditor API
**Step 1 –** Navigate to the **Search** page of the add-on or **Search & Reporting** Splunk app.
@@ -23,7 +24,7 @@ For example:
index=_internal netwrix_data_input
```
-**Step 3 –** Press the **Last 24 hours** button and choose **All time** time range.
+**Step 3 –** Press the **Last 24 hours** button and choose **All time**.
**Step 4 –** Press the search button; you should see list of the events with Splunk service
information.
diff --git a/docs/auditor/10.8/admin/alertsettings/create/create.md b/docs/auditor/10.8/admin/alertsettings/create/create.md
index 09997e892b..b6836397d0 100644
--- a/docs/auditor/10.8/admin/alertsettings/create/create.md
+++ b/docs/auditor/10.8/admin/alertsettings/create/create.md
@@ -18,8 +18,6 @@ topic for additional information.
## Create a Custom Alert
-Follow the steps to create a custom alert.
-
**Step 1 –** On the main Auditor page, click the Alert settings link under the Configuration section
on the left:
@@ -31,9 +29,9 @@ See the [Navigation](/docs/auditor/10.8/admin/navigation/overview.md) topic for
| Option | Description |
| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| General | - Specify a name and enter the description for the new alert.
**NOTE:** Make sure that the Send alert when the action occurs option is enabled. Otherwise, the new alert will be disabled. - Email subject — Specify the subject of the email. It is possible to insert variables into the subject line. You can choose between "_Who_", "_What_" and"_Where_" variables. Consider the following:
- Only one variable of each type can be added
- You need to cut off the full path from the object names in "_What_" alert and leave only the actual name. For example, "_\com\Corp\Users\Departments\IT\Username_" should be just "_Username_". If you want to get back to the default Email subject line, click the **Restore Default** button.
- Apply tags — Create a set of tags to more efficiently identify and sort your alerts. Select Edit under Apply tags to associate tags with your alert. Later, you can quickly find an alert of interest using Filter by tags in the upper part of the All Alerts window. To see a full list of alerts ever created in the product, navigate to Settings > Tags.
|
-| Recipients | Select alert recipients. Click Add Recipient and select alert delivery type: - Email — Specify the email address where notifications will be delivered. You can add as many recipients as necessary.
**_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. - SMS-enabled email — Netwrix uses the sms gateway technology to deliver notifications to a phone number assigned to a dedicated email address. Specify email address to receive SMS notifications. Make sure that your carrier supports sms to email gateway technology.
|
-| Filters | Apply a set of filters to narrow events that trigger a new alert. Alerts use the same interface and logic as search. - Filter — Select general type of filter (e.g., "Who", "Data Source", "Monitoring plan", etc.)
- Operator — Configure match types for selected filter (e.g., "Equals", "Does not contain", etc.)
- Value — Specify filter value. See the [View and Search Collected Data](/docs/auditor/10.8/admin/search/overview.md) topic for additional information on how to create and modify filters. The Filters section contains required fields highlighted with red. Once you completed all filters, click Preview on the right pane to see search-based list of events that will trigger your alert. 
|
-| Thresholds | If necessary, enable threshold to trigger the new alert. In this case, a single alert will be sent instead of many alerts. This can be helpful when Auditor detects many activity records matching the filters you specified. Slide the switch under the Send alert when the threshold is exceeded option and configure the following: - Limit alerting to activity records with the same... — Select a filter in the drop-down list (e.g., who). Note that, Auditor will search for activity records with the same value in the filter you selected. Only alerts grouped by the Who parameter can be included in the Behavior Anomalies list. Mind that in this case, the product does not summarize risk scores and shows the value you associated with this alert. This may significantly reduce risk score accuracy.
- Send alert for `<...>` activity records within `<...>` seconds — Select a number of changes that occurred in a given period (in seconds). For example, you want to receive an alert on suspicious activity. You select "_Action_" in the Limit alerting to activity records with the same list and specify a number of actions to be considered an unexpected behavior: _1000_ changes in _60_ seconds. When the selected threshold exceeded, an alert will be delivered to the specified recipients: one for every 1000 removals in 60 seconds, one for every 1000 failed removals in 60 seconds. So you can easily discover what is going on in your IT infrastructure.
|
-| Risk Score | - Slide the switch to On under Include this alert in Behavior Anomalies assessment. See the [Behavior Anomalies](/docs/auditor/10.8/admin/behavioranomalies/overview.md) topic for additional information.
- Associate a risk score with the alert — Assign a risk score based on the type of anomaly and the severity of the deviation from the normal behavior. An action's risk score is a numerical value from 1 (Low) to 100 (High) that designates the level of risk with 100 being the riskiest and 1 the least risky. These are general guidelines you can adopt when setting a risk score:
- High score — Assign to an action that requires your immediate response (e.g., adding account to a privileged group). Configure a non-threshold alert with email recipients.
- Above medium score — Assign to a repetitive action occurring during a short period of time. While a standalone action is not suspicious, multiple actions merit your attention (e.g., mass deletions from a SharePoint site). Configure a threshold-based alert with email recipients.
- Low score — Assign to an infrequent action. While a single action is safe, multiple occurrences aggregated over a long period of time may indicate a potential in-house bad actor (e.g., creation of potentially harmful files on a file share). Configure a non-threshold alert, email recipients are optional but make sure to regularly review the Behavior Anomalies dashboard.
- Low score — Assign to a repetitive action that does not occur too often (e.g., rapid logons). Multiple occurrences of action sets may indicate a potential in-house bad actor or account compromise. Configure a threshold-based alert, email recipients are optional but make sure to regularly review the Behavior Anomalies dashboard.
|
+| General | - Specify a name and enter the description for the new alert.
**NOTE:** ensure that the Send alert when the action occurs option is enabled. Otherwise, the new alert will be disabled. - Email subject — Specify the subject of the email. You can insert variables into the subject line. Choose between "_Who_", "_What_" and"_Where_" variables. Consider the following:
- Only one variable of each type can be added
- You need to cut off the full path from the object names in "_What_" alert and leave only the actual name. For example, "_\com\Corp\Users\Departments\IT\Username_" should be just "_Username_". If you want to get back to the default Email subject line, click the **Restore Default** button.
- Apply tags — Create a set of tags to more efficiently identify and sort your alerts. Select Edit under Apply tags to associate tags with your alert. Later, you can quickly find an alert of interest using Filter by tags in the upper part of the All Alerts window. To see a full list of alerts ever created in the product, navigate to Settings > Tags.
|
+| Recipients | Select alert recipients. Click Add Recipient and select alert delivery type: - Email — Specify the email address where notifications will be delivered. You can add as many recipients as necessary.
**_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. - SMS-enabled email — Netwrix uses the sms gateway technology to deliver notifications to a phone number assigned to a dedicated email address. Specify email address to receive SMS notifications. ensure that your carrier supports sms to email gateway technology.
|
+| Filters | Apply a set of filters to narrow events that trigger a new alert. Alerts use the same interface and logic as search. - Filter — Select general type of filter (e.g., "Who", "Data Source", "Monitoring plan", etc.)
- Operator — Configure match types for selected filter (e.g., "Equals", "Doesn't contain", etc.)
- Value — Specify filter value. See the [View and Search Collected Data](/docs/auditor/10.8/admin/search/overview.md) topic for additional information on how to create and modify filters. The Filters section contains required fields highlighted with red. After you complete all filters, click Preview on the right pane to see search-based list of events that will trigger your alert. 
|
+| Thresholds | If necessary, enable threshold to trigger the new alert. In this case, a single alert will be sent instead of many alerts. This can be helpful when Auditor detects many activity records matching the filters you specified. Slide the switch under the Send alert when the threshold is exceeded option and configure the following: - Limit alerting to activity records with the same... — Select a filter in the dropdown list (e.g., who). Auditor will search for activity records with the same value in the filter you selected. Only alerts grouped by the Who parameter can be included in the Behavior Anomalies list. Mind that in this case, the product doesn't summarize risk scores and shows the value you associated with this alert. This may significantly reduce risk score accuracy.
- Send alert for `<...>` activity records within `<...>` seconds — Select a number of changes that occurred in a given period (in seconds). For example, you want to receive an alert on suspicious activity. You select "_Action_" in the Limit alerting to activity records with the same list and specify a number of actions to be considered an unexpected behavior: _1000_ changes in _60_ seconds. When the selected threshold exceeded, an alert will be delivered to the specified recipients: one for every 1000 removals in 60 seconds, one for every 1000 failed removals in 60 seconds. So you can easily discover what is going on in your IT infrastructure.
|
+| Risk Score | - Slide the switch to On under Include this alert in Behavior Anomalies assessment. See the [Behavior Anomalies](/docs/auditor/10.8/admin/behavioranomalies/overview.md) topic for additional information.
- Associate a risk score with the alert — Assign a risk score based on the type of anomaly and the severity of the deviation from the normal behavior. An action's risk score is a numerical value from 1 (Low) to 100 (High) that designates the level of risk with 100 being the riskiest and 1 the least risky. These are general guidelines you can adopt when setting a risk score:
- High score — Assign to an action that requires your immediate response (e.g., adding account to a privileged group). Configure a non-threshold alert with email recipients.
- Above medium score — Assign to a repetitive action occurring during a short period of time. While a standalone action isn't suspicious, multiple actions merit your attention (e.g., mass deletions from a SharePoint site). Configure a threshold-based alert with email recipients.
- Low score — Assign to an infrequent action. While a single action is safe, multiple occurrences aggregated over a long period of time may indicate a potential in-house bad actor (e.g., creation of potentially harmful files on a file share). Configure a non-threshold alert, email recipients are optional but ensure to regularly review the Behavior Anomalies dashboard.
- Low score — Assign to a repetitive action that doesn't occur too often (e.g., rapid logons). Multiple occurrences of action sets may indicate a potential in-house bad actor or account compromise. Configure a threshold-based alert, email recipients are optional but ensure to regularly review the Behavior Anomalies dashboard.
|
| Response Action | You can instruct Auditor to perform a response action when the alert occurs — for example, start an executable file (command, batch file, or other) that will remediate the issue, or open a ticket with the help desk, and so on. For that, you will need an executable file stored locally on the Auditor server. Slide the switch to turn the feature **ON**, and see the [Configure a Response Action for Alert](/docs/auditor/10.8/admin/alertsettings/responseaction.md) topic for additional information. |
diff --git a/docs/auditor/10.8/admin/alertsettings/create/createeventlog.md b/docs/auditor/10.8/admin/alertsettings/create/createeventlog.md
index 6edaf2eed4..9c907e9492 100644
--- a/docs/auditor/10.8/admin/alertsettings/create/createeventlog.md
+++ b/docs/auditor/10.8/admin/alertsettings/create/createeventlog.md
@@ -10,7 +10,7 @@ Alerts are configurable notifications triggered by certain events and sent to th
recipients. You can enable or disable, and modify existing alerts, and create new alerts. To do it,
click Configure next to Alerts.
-Follow the steps to create new alert.
+## Create a new alert
**Step 1 –** In the Alerts window, click Add to start new alert.
@@ -35,7 +35,7 @@ The %ManagedObjectName% variable will be replaced with your monitoring plan name
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | Specify the filter name. |
| Description | Enter the description for this filter (optional). |
- | Event Log | Select an event log from the drop-down list. You will be alerted on events from this event log. You can also input a different event log. To find out a log’s name, navigate to Start > Windows Administrative Tools > **Event Viewer** > **Applications and Services Logs** > Microsoft > Windows and expand the required Log_Name node, right-click the file under it and select Properties. Find the event log’s name in the Full Name field. Auditor does not collect the Analytic and Debug logs, so you cannot configure alerts for these logs. You can use a wildcard (\*). In this case you will be alerted on events from all Windows logs except for the ones mentioned above. |
+ | Event Log | Select an event log from the dropdown list. You will be alerted on events from this event log. You can also input a different event log. To find out a log’s name, navigate to Start > Windows Administrative Tools > **Event Viewer** > **Applications and Services Logs** > Microsoft > Windows and expand the required Log_Name node, right-click the file under it and select Properties. Find the event log’s name in the Full Name field. Auditor doesn't collect the Analytic and Debug logs, so you can't configure alerts for these logs. You can use a wildcard (\*). In this case you will be alerted on events from all Windows logs except for the ones mentioned above. |
- In the Event Fields tab:
diff --git a/docs/auditor/10.8/admin/alertsettings/create/createhealthstatus.md b/docs/auditor/10.8/admin/alertsettings/create/createhealthstatus.md
index 6141aa461e..5199026fe5 100644
--- a/docs/auditor/10.8/admin/alertsettings/create/createhealthstatus.md
+++ b/docs/auditor/10.8/admin/alertsettings/create/createhealthstatus.md
@@ -16,13 +16,13 @@ data on Auditor health status events. See the topic for additional information.
**Step 1 –** Start Netwrix Auditor Event Log Manager and create the new monitoring plan.
-**Step 2 –** Make sure that the Enable event log collection checkbox is selected. Specify the name
+**Step 2 –** ensure that the Enable event log collection checkbox is selected. Specify the name
for the new plan, for example, _"\_Netwrix Auditor \_Health Status"_.
**Step 3 –** Navigate to the Monitored computers list and add a server where the Auditor server
resides.
-**Step 4 –** On the General tab, click Configure next to Alerts. Make sure the predefined alerts are
+**Step 4 –** On the General tab, click Configure next to Alerts. Ensure the predefined alerts are
disabled. Click Add to create anew alert.
**Step 5 –** In the Alert Properties wizard, specify the alert name and enter alert description
diff --git a/docs/auditor/10.8/admin/alertsettings/create/createmailboxaccess.md b/docs/auditor/10.8/admin/alertsettings/create/createmailboxaccess.md
index 6c2e28b00d..8987b574a8 100644
--- a/docs/auditor/10.8/admin/alertsettings/create/createmailboxaccess.md
+++ b/docs/auditor/10.8/admin/alertsettings/create/createmailboxaccess.md
@@ -17,17 +17,15 @@ The procedure below describes the basic steps, required for creation of a monito
be used to collect data on non-owner mailbox access events. See
[Event Log Manager](/docs/auditor/10.8/tools/eventlogmanager/eventlogmanager.md) topic for additional information.
-Follow the steps to create alert for non-owner mailbox access events.
-
**Step 1 –** Create a monitoring plan in Netwrix Auditor Event Log Manager.
-**Step 2 –** Make sure that the Enable event log collection checkbox is selected. Specify the name
+**Step 2 –** ensure that the Enable event log collection checkbox is selected. Specify the name
for the new plan, for example, "_Non-owner mailbox access auditing_".
**Step 3 –** Navigate to the Monitored computers list and add a server where your Exchange
organization resides.
-**Step 4 –** On the General tab, click Configure next to Alerts. Make sure the predefined alerts are
+**Step 4 –** On the General tab, click Configure next to Alerts. Ensure the predefined alerts are
disabled. Click Add to create an alert for non-owner mailbox access event.
**Step 5 –** In the Alert Properties wizard, specify the alert name and enter alert description
@@ -80,7 +78,7 @@ the email address where notifications will be delivered.
email address and inform you if any problems are detected.
**Step 11 –** Click Edit next to Audit Archiving Filters step, in the Inclusive Filters section
-clear the filters you do not need, click Add and specify the following information:
+clear the filters you don't need, click Add and specify the following information:
- The filter name and description (e.g., Non-owner mailbox access event)
- In Event Log, enter _"Netwrix Non-Owner Mailbox Access Agent"_.
diff --git a/docs/auditor/10.8/admin/alertsettings/dashboard.md b/docs/auditor/10.8/admin/alertsettings/dashboard.md
index 7400461740..885284a14d 100644
--- a/docs/auditor/10.8/admin/alertsettings/dashboard.md
+++ b/docs/auditor/10.8/admin/alertsettings/dashboard.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Alerts Overview Dashboard
-Aggregated statistics on the alerts is provided in the Alerts overview widget. It displays currently
+Aggregated statistics on the alerts is provided in the Alerts overview widget. It displays
triggered alerts with detailed information.
To view the dashboard, on the main Auditor page, click the Alerts tile.
@@ -25,7 +25,7 @@ The dashboard includes the following widgets:
-Clicking any tile except for Risk score by top 5 users drills down to the Alert history dashboard
+Clicking any tile except for Risk score by top 5 users opens the Alert history dashboard
that provides users with the detailed information about the latest alerts triggered in their IT
infrastructure enriched with the actionable chart and timeline.
diff --git a/docs/auditor/10.8/admin/alertsettings/manage.md b/docs/auditor/10.8/admin/alertsettings/manage.md
index ff96c55e33..7d3a564304 100644
--- a/docs/auditor/10.8/admin/alertsettings/manage.md
+++ b/docs/auditor/10.8/admin/alertsettings/manage.md
@@ -7,10 +7,9 @@ sidebar_position: 30
# Manage Alerts
For your convenience, Netwrix provides you with a set of predefined alerts that are commonly used
-for IT infrastructure monitoring. The out-of-the-box alerts include those that help you detect
-suspicious activity and inform you on critical changes to your environment. The alerts contain
-pre-configured filters and in most cases you only need to enable an alert and select who will
-receive notifications.
+for IT infrastructure monitoring. These pre-configured alerts help you detect suspicious activity and
+inform you on critical changes to your environment. The alerts contain pre-configured filters and in
+most cases you only need to enable an alert and select who will receive notifications.
You can add any elements (a dashboard, report, alert, risk, etc.) to the Auditor Home screen to
access them instantly. See the [Navigation](/docs/auditor/10.8/admin/navigation/overview.md) and
diff --git a/docs/auditor/10.8/admin/alertsettings/overview.md b/docs/auditor/10.8/admin/alertsettings/overview.md
index 06068ae90e..6233089f75 100644
--- a/docs/auditor/10.8/admin/alertsettings/overview.md
+++ b/docs/auditor/10.8/admin/alertsettings/overview.md
@@ -9,7 +9,7 @@ sidebar_position: 70
If you want to be notified about suspicious activity, you can configure alerts that will be
triggered by specific events. Alerts are sent after the specified action has been detected. Alerts
are helpful if you want to be notified about actions critical to your organization security and have
-to mitigate risks once the suspicious action occurs.
+to mitigate risks after the suspicious action occurs.
Review the following to take advantage of the Alerts functionality:
@@ -28,13 +28,13 @@ The example alert is triggered when a new user is created in the monitored domai
## Tags
-Netwrix Auditor allows you to apply tags when creating an alert. Applying tags to alerts allows you
-to distinguish one alert from another or create groups of similar alerts.
+You can apply tags when creating an alert in Netwrix Auditor. Applying tags helps you distinguish one
+alert from another or create groups of similar alerts.
-The Tags page contains a complete list of alerts that were created in the product. Currently, you
-cannot assign or create tags on this page.
+The Tags page contains a complete list of alerts that were created in the product. you
+can't assign or create tags on this page.
To apply tags to an alert, navigate to alert settings and locate the Apply tags section on the
General tab. See the [Create Alerts](/docs/auditor/10.8/admin/alertsettings/create/create.md) topic to receive information about tags applying.
diff --git a/docs/auditor/10.8/admin/alertsettings/responseaction.md b/docs/auditor/10.8/admin/alertsettings/responseaction.md
index 5001e972c4..35097a78dc 100644
--- a/docs/auditor/10.8/admin/alertsettings/responseaction.md
+++ b/docs/auditor/10.8/admin/alertsettings/responseaction.md
@@ -22,14 +22,13 @@ Response Action settings contain the following configuration options:
- Write data to CSV file – If this checkbox is selected, Netwrix Auditor will save activity records
in a CSV file. You can use it to pass information into your response action to receive a more
targeted response.
-- Limit row count in a file to – Select the desired number of rows you want for the file
+- Limit row count in a file to – Select the number of rows you want for the file
- Use custom credentials – Enter the username and password if you want the script to be run as an
account different from LocalSystem
- Command line preview – Showing a preview of the command line script. Click **Test run** button to
test its performance.
-Follow the steps to configure the required settings in the Response Action tab of the alert
-properties.
+## Configure response action settings
**Step 1 –** Turn the switch to On if you want a response action to be taken when the alert occurs.
@@ -72,7 +71,7 @@ If you leave this field empty, then the path to the file specified in the Run fi
a working directory. As shown in the example with the _.ps_ file, this may be the system directory.
So, to avoid system directory cluttering, it is recommended not to leave the Working directory field
empty but to explicitly specify the directory where your executable file is located, or a dedicated
-directory for that purpose. In the latter case, make sure the directory exists on Auditor server.
+directory for that purpose. In the latter case, ensure the directory exists on Auditor server.
**Step 7 –** Write data to CSV file — select this option if you want Auditor to locate the activity
records associated with the alert, and write the record fields and their values in a structured way
@@ -85,7 +84,7 @@ cleared.
**Step 8 –** Limit row count in a file to `` — limit the number of rows (activity records) to be
written to a single ._csv_ file. Enter a value from _1_ to _1000_.
-Learn more about how these options work in the Configure a Response Action for Alert section.
+For details on how these options work, see the section below.
By default, the executable file will be launched under the _LocalSystem_ account. If you want to use
another account, select the Use custom credentials checkbox and specify user name and password. Make
@@ -113,14 +112,14 @@ After the test run, you will get a notification message with the exit code. Typi
follows:
- **0** — the response action completed successfully
-- Any other value — the response action was not a success
+- Any other value — the response action wasn't a success
**_RECOMMENDED:_** Apply similar logic if you plan to use custom exit codes in your response action
script.
Same exit codes will be returned by response action regular runs.
-If the action is not a success (exit code is not 0), the program will try to perform response action
+If the action isn't a success (exit code isn't 0), the program will try to perform response action
again (up to 200 times) with increasing time interval.
## Write Data to a CSV File
@@ -144,7 +143,6 @@ records per launch (not more than the specified limit, i.e. 10 records in this e
A CSV file is named using the timestamp and GUID and stored in the subfolder of Netwrix Auditor
working folder (by default, _%ProgramData%\Netwrix
-Auditor\AuditCore\AuditArchive\AlertsToolLauncher\Csv_). Note that a CSV file will exist only while
-the executable file is running – after the execution is completed, the CSV file will be deleted. So
-if you plan, for example, to obtain some data from that file for further processing, you may need to
-copy it to a permanent location in a timely manner, e.g., using a script.
+Auditor\AuditCore\AuditArchive\AlertsToolLauncher\Csv_). A CSV file exists only while the executable file is running – after the execution completes, it's
+deleted. If you need to obtain data from that file for further processing, copy it to a permanent
+location in a timely manner, for example, using a script.
diff --git a/docs/auditor/10.8/admin/behavioranomalies/dashboard.md b/docs/auditor/10.8/admin/behavioranomalies/dashboard.md
index 36c892eb5e..400a1510c7 100644
--- a/docs/auditor/10.8/admin/behavioranomalies/dashboard.md
+++ b/docs/auditor/10.8/admin/behavioranomalies/dashboard.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Review Behavior Anomalies Dashboard
-To review the Behavior Anomalies dashboard, process and filter anomalies in user profiles, you must
+To review the Behavior Anomalies dashboard, process, and filter anomalies in user profiles, you must
be assigned the Global administrator or Global reviewer role in the product. See the
[Role-Based Access and Delegation](/docs/auditor/10.8/admin/monitoringplans/delegation.md) topic for additional
information.
@@ -30,9 +30,9 @@ The dashboards includes the following sections:
chart, click the pie chart icon in the upper left corner of the page.
- The user list with all users who provoked alerts and their total risk scores.
-Once you reviewed the general anomaly trend and identified users that merit your special attention,
-review their profiles and process anomalies. Click View Profile next to a user name to dive into
-user activity and investigate each action in details.
+After you review the general anomaly trend and identify users that merit special attention, review
+their profiles and process anomalies. Click View Profile next to a user name to explore user activity
+and investigate each action in detail.
[Review User Profiles and Process Anomalies](/docs/auditor/10.8/admin/behavioranomalies/userprofile.md)
[Review User Profiles and Process Anomalies](/docs/auditor/10.8/admin/behavioranomalies/userprofile.md)
diff --git a/docs/auditor/10.8/admin/behavioranomalies/overview.md b/docs/auditor/10.8/admin/behavioranomalies/overview.md
index e004464b5a..6430c1433d 100644
--- a/docs/auditor/10.8/admin/behavioranomalies/overview.md
+++ b/docs/auditor/10.8/admin/behavioranomalies/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# Behavior Anomalies
-Netwrix Auditor enables you to detect behavior anomalies in your IT environment, such as activity
+Netwrix Auditor helps you detect behavior anomalies in your IT environment, such as activity
surges or mass deletions of archived data. As you investigate suspicious activity and review
incidents, you can identify intruders or in-house bad actors who keep violating your company's
security policies.
@@ -25,23 +25,23 @@ On a high level, your behavior anomalies assessment workflow can be described as
between 1 and 100 points, reflects how critical the action is for your organization.
[Risk Score](/docs/auditor/10.8/admin/alertsettings/create/create.md)how to set a risk score for an alert.
- Although Netwrix industry experts suggest risk scores for alerts that are provided
- out-of-the-box, you can easily tailor these scores to your organization needs and priorities.
+ Although Netwrix industry experts suggest risk scores for alerts that are pre-configured, you
+ can easily tailor these scores to your organization needs and priorities.
You can always adjust risk scores over time as you become more aware of behavior patterns and
anomalous actions in your environment.
-2. Each action that provokes an alert is treated as anomaly. Once the anomaly is detected, it
+2. Each action that provokes an alert is treated as anomaly. After the anomaly is detected, it
appears on a dashboard's timeline and its risk score is added to the user's total score.
3. Every now and then, you review the Behavior Anomalies dashboard—the risk score timeline with
- anomaly surges, and the most active users. The general rule of thumb is: the more risk score
- points the user has the more he or she merits your attention.
+ anomaly surges, and the most active users. Generally, the higher the user's risk score, the more
+ attention they merit.
[Review Behavior Anomalies Dashboard](/docs/auditor/10.8/admin/behavioranomalies/dashboard.md)
-4. To learn more about user activity, you can drill-down to a user profile to review all alerts
- provoked by this user. As you review anomalies and mitigate risks, the user's total score
- reduces. [Review User Profiles and Process Anomalies](/docs/auditor/10.8/admin/behavioranomalies/userprofile.md)
+4. To review user activity in detail, navigate to a user profile to see all alerts provoked by that
+ user. As you review anomalies and mitigate risks, the user's total score decreases. [Review User
+ Profiles and Process Anomalies](/docs/auditor/10.8/admin/behavioranomalies/userprofile.md)
The purpose of the dashboard is to keep risks low and help you spot and address issues as they
-occur. The risk score assigned to a user does not qualify him or her as a bad actor but rather
+occur. The risk score assigned to a user doesn't qualify him or her as a bad actor but rather
brings your attention to behavior patterns. Depending on the role in your organization, users might
have different safe levels while you should make your priority to review the anomalies on time, stay
focused, and proactively mitigate risks.
diff --git a/docs/auditor/10.8/admin/behavioranomalies/tips.md b/docs/auditor/10.8/admin/behavioranomalies/tips.md
index 19581e80cb..60c1541ae8 100644
--- a/docs/auditor/10.8/admin/behavioranomalies/tips.md
+++ b/docs/auditor/10.8/admin/behavioranomalies/tips.md
@@ -16,7 +16,7 @@ helpful when configuring scoring settings and reviewing behavior anomalies.
rights elevation or suspicious access attempts?
Try to review user tasks—you may find out that the anomaly the user keeps provoking is a genuine
- part of his or her daily routine. For example, the office staff should not reset passwords for
+ part of his or her daily routine. For example, the office staff shouldn't reset passwords for
other accounts while this is a basic task for a system administrator. In this case, review your
alert settings and exclude the user from the alert filters.
@@ -30,6 +30,6 @@ helpful when configuring scoring settings and reviewing behavior anomalies.
- Is anyone who is charge of "Failed..." anomaly a bad actor?
Anyone can forget a password or accidentally try to access some data in a wrong folder. Such
- users are not subject to immediate prosecution unless they do not provoke repetitive alerts. The
+ users aren't subject to immediate prosecution unless they don't provoke repetitive alerts. The
best practice is to review user profile after some time and check if there are any threat
patterns in user behavior.
diff --git a/docs/auditor/10.8/admin/behavioranomalies/userprofile.md b/docs/auditor/10.8/admin/behavioranomalies/userprofile.md
index 751ccd05b2..bfaa1db375 100644
--- a/docs/auditor/10.8/admin/behavioranomalies/userprofile.md
+++ b/docs/auditor/10.8/admin/behavioranomalies/userprofile.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Review User Profiles and Process Anomalies
-The user profile enables you to investigate user behavior and take a closer look at anomalies.
+The user profile helps you investigate user behavior and examine anomalies in detail.
To view a user profile
@@ -19,7 +19,7 @@ The user profile page contains the following sections:
- User data with the name and the total risk score. Click Show user activity below the total risk
score, to launch the Interactive Search in a new window. Use it to see all user actions, including
- those that were not treated as anomalies.
+ those that weren't treated as anomalies.
- The Risk score timeline that demonstrates anomalous activity surges. Modify the timeframe to
narrow down the results.
- The Risk score by top five alerts chart that outlines the most frequent anomalies provoked by
@@ -27,12 +27,12 @@ The user profile page contains the following sections:
- The anomalies list displays details for each anomaly: the alert that was triggered, the date and
time, the risk score and anomaly status.
- Double-click an entry to see more details: who did what, when and where the action was made,
- etc. Navigate to Linked actions and click Show user activity or Show this activity record to
- invoke Interactive Search and see all user actions or a specific action correspondingly.
+ Double-click an entry for details about who did what, when, and where the action occurred.
+ Navigate to Linked actions and click Show user activity or Show this activity record to open
+ Interactive Search and view all user actions or a specific action.
Netwrix Auditor shows only the top 2,000 anomalies. Modify the timeframe or hide reviewed anomalies,
-and then click Refresh to see more anomalies.
+then click Refresh to check for additional anomalies.
## Process Anomalies and Reduce Risk Score
@@ -50,8 +50,8 @@ To change an anomaly status
-Once the anomaly is reviewed, it disappears from the timeline and chart, and its associated risk
-score is taken from user's total score. The reviewed anomalies supplement the status with the
+After the anomaly is marked as reviewed, it disappears from the timeline and chart, and its
+associated risk score is removed from the user's total score. The reviewed anomalies supplement the status with the
reviewer name and date (e.g., _Reviewed by CORP\Administrator (10/02/2017 10:12:03 AM)_).
You can always revert changes and assign the Active status back.
@@ -60,23 +60,23 @@ To process all anomalies
- In the Actions section, select Mark all as reviewed.
-In this case, all anomalies that are currently in view will be set to _"reviewed"_. Perform this
+In this case, all anomalies that are in view will be set to _"reviewed"_. Perform this
operation only with a proper justification. Since Netwrix Auditor shows only the top 2,000
-anomalies, make sure to click Refresh to check if there are more anomalies to be reviewed.
+anomalies, ensure to click Refresh to check if there are more anomalies to be reviewed.
-The anomalies that are excluded from view by filters are not affected by the Mark all as reviewed
+The anomalies that are excluded from view by filters aren't affected by the Mark all as reviewed
action.
## Customize Anomalies List
By default, all anomalies are in view. The Filters section helps you show or hide anomalies.
-Click Customize view and clear the checkboxes next to alert names, if you do not want to see
+Click Customize view and clear the checkboxes next to alert names, if you don't want to see
anomalies associated with them.
-When you hide an alert from view, its associated anomalies will no longer be displayed on a
-timeline, chart, or in the list but the user total score will remain unchanged. Note that hidden
-anomalies cannot be reviewed in bulk with the Mark all as reviewed action.
+When you hide an alert from view, its associated anomalies will no longer display on the timeline,
+chart, or list, but the user's total score remains unchanged. Hidden anomalies can't be reviewed in
+bulk with the Mark all as reviewed action.
-Hide reviewed anomalies enables you to modify the anomalies list so that you can focus on active
-anomalies only. To see reviewed anomalies, click Show reviewed anomalies.
+Use Hide reviewed anomalies to modify the anomalies list and focus on active anomalies only. Click
+Show reviewed anomalies to view reviewed anomalies.
diff --git a/docs/auditor/10.8/admin/compliancemappings.md b/docs/auditor/10.8/admin/compliancemappings.md
index fb8793397d..eb92b7cd75 100644
--- a/docs/auditor/10.8/admin/compliancemappings.md
+++ b/docs/auditor/10.8/admin/compliancemappings.md
@@ -8,9 +8,9 @@ sidebar_position: 100
This tile contains links to the practical guides on how to comply with different standards using
Netwrix Auditor. The guides were prepared by Netwrix industry experts and contain full information
-about most popular compliance standards. Clicking the 'Learn more...' link under a desired standard
-opens the page on the Netwrix website. Here you can review a brief description of each compliance
-standard supported by the product and download E book containing detailed requirements for the
-standards.
+about most popular compliance standards. Click a compliance standard's link to open the Netwrix
+Compliance Mapping guide for that standard on the Netwrix website. There you can review a brief
+description of each compliance standard supported by the product and download the E-book containing
+detailed requirements.
diff --git a/docs/auditor/10.8/admin/healthstatus/dashboard/activityrecordstatistics.md b/docs/auditor/10.8/admin/healthstatus/dashboard/activityrecordstatistics.md
index f5ac25202f..cab8092002 100644
--- a/docs/auditor/10.8/admin/healthstatus/dashboard/activityrecordstatistics.md
+++ b/docs/auditor/10.8/admin/healthstatus/dashboard/activityrecordstatistics.md
@@ -7,7 +7,7 @@ sidebar_position: 10
# Activity Records Statistics
Aggregated statistics on the activity records is provided in the Activity records by date widget.
-The chart shows the number of activity records produced by your data sources, collected and saved by
+The chart shows the number of activity records produced by your data sources, collected, and saved by
Netwrix Auditor during the last 7 days. This data can help you to assess the activity records
generation intensity in your IT infrastructure, and product load.
@@ -16,11 +16,11 @@ After you click View details, the Activity Records Statistics window will be dis
By default, statistics on activity records processing is grouped by Monitoring plan and presented
-for the Last 7 days. To modify the timeframe, use the drop-down list in the upper right corner.
+for the Last 7 days. To modify the timeframe, use the dropdown list in the upper right corner.
Other fields provide the following information: data source that produces activity records, with
date and time of the last collected record, and the overall number of records collected and uploaded
to the corresponding Audit database during the specified timeframe.
-If the data sources processed by a monitoring plan did not produce any activity records during the
+If the data sources processed by a monitoring plan didn't produce any activity records during the
specified timeframe, this monitoring plan will not appear in the list.
diff --git a/docs/auditor/10.8/admin/healthstatus/dashboard/databasestatistics.md b/docs/auditor/10.8/admin/healthstatus/dashboard/databasestatistics.md
index 9879ce58ad..a135b2ff81 100644
--- a/docs/auditor/10.8/admin/healthstatus/dashboard/databasestatistics.md
+++ b/docs/auditor/10.8/admin/healthstatus/dashboard/databasestatistics.md
@@ -12,7 +12,7 @@ adjust retention accordingly. The widget displays the name of default SQL Server
all Netwrix Auditor databases, the overall database capacity at the moment and its change over the
last day (24 hours).
-Transaction logs size is not included in the calculations.
+Transaction logs size isn't included in the calculations.
After you click View details, the following information will be displayed for the specified SQL
Server instance:
@@ -34,7 +34,7 @@ instance of the SQL Server:
The following capacity metrics are displayed for each database:
- **State**—database state summary
-- **Size**—current database size (logs are not included)
+- **Size**—current database size (logs aren't included)
- **Activity records**—number of the activity records stored in the database at the moment
After you expand the database node, the detailed database properties will be shown:
diff --git a/docs/auditor/10.8/admin/healthstatus/dashboard/healthlog.md b/docs/auditor/10.8/admin/healthstatus/dashboard/healthlog.md
index 45c903bad7..72ef0cd58f 100644
--- a/docs/auditor/10.8/admin/healthstatus/dashboard/healthlog.md
+++ b/docs/auditor/10.8/admin/healthstatus/dashboard/healthlog.md
@@ -42,7 +42,7 @@ There are three types of events that can be logged:
| Event Type | Description |
| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Information | An event that describes the successful operation beginning or completion. For example, the product successfully completed data collection for a monitoring plan. |
-| Warning | An event that is not necessarily significant, but may indicate a possible future problem. For example, the product failed to process a domain controller. |
+| Warning | An event that isn't necessarily significant, but may indicate a possible future problem. For example, the product failed to process a domain controller. |
| Error | An event that indicates a significant problem such as loss of data or loss of functionality. For example, the product failed to retrieve settings for your data source. |
Review the following:
@@ -58,8 +58,6 @@ If you want to monitor Auditor health status in more depth, you can do the follo
## Inspect Events in Health Log
-Follow the steps o inspect events in Netwrix Auditor health log
-
**Step 1 –** On the main Auditor page, select the Health status tile, then in the Health log
dashboard widget click Open health log.
@@ -72,8 +70,6 @@ collection or events of an important monitoring plan.
### Filter Events
-Follow the steps to filter events.
-
**Step 1 –** Select Filters in the upper part of the Netwrix Auditor Health Log window.
**Step 2 –** Complete the following fields:
@@ -84,8 +80,8 @@ Follow the steps to filter events.
| Event level | Select level of the events that you want to be displayed. |
| Event source | Select services and applications whose events you want to view. |
| Monitoring plan | Select to display events from one or several monitoring plans. |
-| Item name | Select to display events from the certain item(s) you need. |
-| Event ID | Enter event ID number or range of event IDs separated by commas. For example, 1, 3, 5-99. You can also exclude unwanted event IDs from being displayed. Type the minus sign before selected event ID. For example, -76. |
+| Item name | Select to display events from the certain items you need. |
+| Event ID | Enter event ID number or range of event IDs separated by commas. For example, 1, 3, 5-99. You can also exclude unwanted event IDs from being displayed. Enter the minus sign before selected event ID. For example, -76. |
diff --git a/docs/auditor/10.8/admin/healthstatus/dashboard/monitoringoverview.md b/docs/auditor/10.8/admin/healthstatus/dashboard/monitoringoverview.md
index 4018e04207..97c4d24b9a 100644
--- a/docs/auditor/10.8/admin/healthstatus/dashboard/monitoringoverview.md
+++ b/docs/auditor/10.8/admin/healthstatus/dashboard/monitoringoverview.md
@@ -12,7 +12,7 @@ displays current statuses of all monitoring plans:
- Ready (green indicator)—The monitoring plans (one or several) successfully processed the data
sources with all their items and are ready for the next run.
- Pay attention (yellow indicator)—The monitoring plans (one or several) require your attention, as
- some items were not processed completely but only partially. This status applies to the monitoring
+ some items weren't processed completely but only partially. This status applies to the monitoring
plans targeted at Logon Activity and Windows File Server. See the table below for details.
- Take action (red indicator)—Any data source or item in the monitoring plan (one or several) was
processed with errors.
@@ -27,16 +27,16 @@ and items their current status is depicted as follows:
| Entity | Status | Description |
| --------------- | ------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Data source | Disabled | A data source can be disabled manually via its settings (by switching Monitor this data source and collect activity data to OFF), or automatically, if the license is not valid any more (for example, the count of licensed objects was exceeded, or the trial period has expired). |
+| Data source | Disabled | A data source can be disabled manually via its settings (by switching Monitor this data source and collect activity data to OFF), or automatically, if the license isn't valid any more (for example, the count of licensed objects was exceeded, or the trial period has expired). |
| Empty | No items have been added to this data source yet. | |
| Enabled | Monitor this data source and collect activity data is set to ON in the data source settings. | |
-| Not available | The monitoring plan is corrupted and cannot process its data sources, so it is recommended to remove it and create anew. | |
-| Not responding | Data collector for this data source is not responding. The underlying items will not be displayed for such data source. | |
+| Not available | The monitoring plan is corrupted and can't process its data sources, so it is recommended to remove it and create anew. | |
+| Not responding | Data collector for this data source isn't responding. The underlying items will not be displayed for such data source. | |
| Working | The data source is being processed at the moment. | |
| (not displayed) | The data source status is unknown. | |
| Item | Pay attention | The item was processed with some issues (non-critical). This status applies to the monitoring plans targeted at Logon Activity and Windows File Server. It means that data collection from at least one entity completed with errors. For example, a MyFileServer item included in the File Server monitoring plan contains all CIFS shares hosted on the MyFileServer computer. If any of these shares was processed with errors while others were processed successfully, the processing of the whole MyFileServer item will be considered partially completed, and the monitoring plan will have a yellow indicator, requiring your attention. Click the Details link to examine the product log. |
| Ready | The item was processed successfully and is ready for the next run of data collection. | |
-| Take action | Critical error(s) occurred while processing this item. Click the Details link to examine the product log. | |
+| Take action | Critical errors occurred while processing this item. Click the Details link to examine the product log. | |
| Working | The item is being processed at the moment. | |
You can use the Search field, or apply a filter to display the information you need. For example, in
diff --git a/docs/auditor/10.8/admin/healthstatus/dashboard/overview.md b/docs/auditor/10.8/admin/healthstatus/dashboard/overview.md
index dc61aebaf7..a411854964 100644
--- a/docs/auditor/10.8/admin/healthstatus/dashboard/overview.md
+++ b/docs/auditor/10.8/admin/healthstatus/dashboard/overview.md
@@ -9,8 +9,8 @@ sidebar_position: 10
New Health Status dashboard facilitates Auditor maintenance and troubleshooting tasks, providing IT
specialists with at-a-glance view on the most critical factors: data collection performance, product
health and storage capacity. The dashboard comprises a set of widgets that display the status of
-these aspects using aggregated statistics and charts. Nearly each widget allows you to drill down to
-the detailed information on the aspect you are interested in.
+these aspects using aggregated statistics and charts. Nearly each widget provides access to detailed
+information on the aspect you're interested in.
To view the dashboard, on the main Auditor page, click the Health status tile located in the
Configuration section.
@@ -18,7 +18,7 @@ Configuration section.
The dashboard includes the following widgets:
- The Activity records by date chart—Shows the number of activity records produced by your data
- sources, collected and saved by Netwrix Auditor during the last 7 days. See the
+ sources, collected, and saved by Netwrix Auditor during the last 7 days. See the
[Activity Records Statistics](/docs/auditor/10.8/admin/healthstatus/dashboard/activityrecordstatistics.md) topic for additional information.
- The Monitoring overview widget—Shows aggregated statistics on the statuses of all monitoring plans
configured in Netwrix Auditor at the moment. See the [Monitoring Overview](/docs/auditor/10.8/admin/healthstatus/dashboard/monitoringoverview.md)
diff --git a/docs/auditor/10.8/admin/healthstatus/networktrafficcompression.md b/docs/auditor/10.8/admin/healthstatus/networktrafficcompression.md
index 68acf607bf..65ba3f5ed8 100644
--- a/docs/auditor/10.8/admin/healthstatus/networktrafficcompression.md
+++ b/docs/auditor/10.8/admin/healthstatus/networktrafficcompression.md
@@ -19,7 +19,7 @@ So, network traffic compression helps to increase scalability and optimize netwo
Its key capabilities are as follows:
-- Allows Auditor to collect detailed metrics for the servers, log files, hardware and individual
+- Allows Auditor to collect detailed metrics for the servers, log files, hardware, and individual
processes
- Collects audit data with no recognizable load on the server
- Communicates with Netwrix Auditor Server at predefined intervals, relaying data back to a central
diff --git a/docs/auditor/10.8/admin/healthstatus/overview.md b/docs/auditor/10.8/admin/healthstatus/overview.md
index bb92e28da6..31209dd186 100644
--- a/docs/auditor/10.8/admin/healthstatus/overview.md
+++ b/docs/auditor/10.8/admin/healthstatus/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# Netwrix Auditor Operations and Health
-This topic describes how you can monitor Auditor operations, health and resource usage. See the
+This topic describes how you can monitor Auditor operations, health, and resource usage. See the
following topics for additional information:
- [Health Status Dashboard](/docs/auditor/10.8/admin/healthstatus/dashboard/overview.md)
diff --git a/docs/auditor/10.8/admin/healthstatus/selfaudit.md b/docs/auditor/10.8/admin/healthstatus/selfaudit.md
index 5d19d6afea..b70e20fa33 100644
--- a/docs/auditor/10.8/admin/healthstatus/selfaudit.md
+++ b/docs/auditor/10.8/admin/healthstatus/selfaudit.md
@@ -6,10 +6,10 @@ sidebar_position: 20
# Self-Audit
-Built-in Netwrix Auditor self-audit allows you to track changes to the product configuration,
-including monitoring plans, data sources, audit scope and details about it (before-after values).
-This helps you to ensure that monitoring scope is complete and changed only in line with the
-workflows adopted by our organization.
+The built-in Netwrix Auditor self-audit feature tracks changes to the product configuration,
+including monitoring plans, data sources, audit scope, and details about it (before-after values).
+This helps ensure that monitoring scope is complete and changes align with your organization's
+workflows.
The corresponding option is available on the General tab of Netwrix AuditorSettings. By default, the
**Collect data for self-audit checkbox** is selected (enabled).
@@ -20,8 +20,6 @@ The corresponding option is available on the General tab of Netwrix AuditorSetti
All Auditor self-audit Activity Records can be found quickly using AuditIntelligence Search.
-Follow the steps to search for self-audit results.
-
**Step 1 –** In Auditor, navigate to Search.
**Step 2 –** Set the Data source filter to **Self-audit**.
@@ -38,11 +36,9 @@ the [View and Search Collected Data](/docs/auditor/10.8/admin/search/overview.md
### Review Auditor Self-Audit Report
-Also, there is a new Netwrix Auditor Self-Audit report available under Organization Level Reports in
-the predefined set of reports. This report shows detailed information on changes to Auditor
-monitoring plans, data sources and audited items.
-
-Follow the steps to review the Self-audit report.
+A Netwrix Auditor Self-Audit report is available under Organization Level Reports in the predefined
+set of reports. This report shows detailed information on changes to Auditor monitoring plans, data
+sources, and audited items.
**Step 1 –** In Auditor, navigate to Reports > Organization Level Reports.
diff --git a/docs/auditor/10.8/admin/healthstatus/summaryemail.md b/docs/auditor/10.8/admin/healthstatus/summaryemail.md
index c99eb126f3..4163d34571 100644
--- a/docs/auditor/10.8/admin/healthstatus/summaryemail.md
+++ b/docs/auditor/10.8/admin/healthstatus/summaryemail.md
@@ -21,4 +21,4 @@ The email looks like shown below:
The Monitoring Overview section of the email provides detail information only for the monitoring
-plans with issues. Successfully completed monitoring plans are not included.
+plans with issues. Successfully completed monitoring plans aren't included.
diff --git a/docs/auditor/10.8/admin/healthstatus/troubleshooting.md b/docs/auditor/10.8/admin/healthstatus/troubleshooting.md
index 6ed3f860bd..21584b08c8 100644
--- a/docs/auditor/10.8/admin/healthstatus/troubleshooting.md
+++ b/docs/auditor/10.8/admin/healthstatus/troubleshooting.md
@@ -9,7 +9,7 @@ sidebar_position: 50
This section provides instructions on how to troubleshoot issues that you may encounter while using
Netwrix Auditor.
-If your issue is not listed in the table below, try searching
+If your issue isn't listed in the table below, try searching
[Netwrix Knowledge Base](https://helpcenter.netwrix.com/).
If you need assistance from the Technical Support team, you can open a ticket using the Customer
@@ -17,13 +17,13 @@ portal as described in the Creating a ticket with Customer portal section.
| Issue | Reason and solution |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| I cannot connect/logon to Auditor. | 1. You may have insufficient permissions. Contact your Auditor Global administrator to make sure that your account is delegated control of the product. 2. You are trying to connect to a remote Auditor specified by its IP address while the NTLM authentication is disabled. Try specifying a server by its name (e.g., EnterpriseWKS). |
-| I do not receive any results while searching audit data or generating reports, or I am sure that some data is missing. | 1. No changes were detected. 2. You do not have sufficient permissions to review intelligence data. Contact your Global administrator. 3. Review your filter settings and make sure that your filters are properly configured. Try modifying your search. 4. You are looking for changes that occurred more than 180 days ago. These changes are no longer available for reporting and running searches. Ask your Auditor Global administrator to import audit data for a required date range from the Long-Term Archive. 5. Data collection for this monitoring plan might not have been launched two times yet or there was no data collection after this change; therefore, audit data has not been written to the Audit Database yet. 6. Some settings in Auditor are configured incorrectly. Contact your Auditor administrator to make sure that: - The monitoring plan you want to audit is properly configured, and the monitoring is enabled for each data source individually. - Audit Database settings are properly configured for each data source individually and Disable security intelligence and make data available only in activity summaries is cleared. Netwrix recommends to store all audit data on the same default SQL Server instance. |
-| "No plans found" text in the Monitoring plan field. | Contact your Auditor Global administrator or Configurator to make sure that the monitoring plans exist and are properly configured. |
-| I see a blank window instead of a report. | Contact your Auditor Global administrator to make sure that you are granted sufficient permissions on the Report Server. To view reports in a web browser - Open a web browser and type the Report Manager URL (found under Settings>**Audit Database**). In the page that opens, navigate to the report you want to generate and click the report name. You can modify the report filters and click View Report to apply them. |
-| I configured report subscription to be uploaded to a file server, but cannot find it / cannot access it. | Subscriptions can be uploaded either to a file share (e.g., _\\filestorage\reports_) or to a folder on the computer where Auditor Server is installed. To access these reports, you must be granted the Read permission. |
-| When trying to collect event data from Active Directory domain, an error message like this appears in Netwrix Health Log: _Monitoring Plan: `` The following error has occurred while processing '``': Error collecting the security log of the domain ``. Failed to process the domain controller `` due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it_. | This may happen due to Secondary Logon Service disabled state. To collect event data from the domain, this service must be up and running. Open its properties and start the service. |
-| The 'Workstation' field in search, reports, and Activity Summary is reported as 'unknown' | For the full list of possible reasons, please refer to the following Netwrix Knowledge Base article: [Why is the "Workstation" field reported as "unknown"?](/docs/kb/auditor/reports-alerts-and-notifications/report-generation/workstation-field-reported-as-unknown) |
+| Unable to connect or log on to Auditor. | 1. You may have insufficient permissions. Contact your Auditor Global administrator to ensure that your account is delegated control of the product. 2. You are trying to connect to a remote Auditor specified by its IP address while the NTLM authentication is disabled. Try specifying a server by its name (e.g., EnterpriseWKS). |
+| No results appear when searching audit data or generating reports, or some data appears to be missing. | 1. No changes were detected. 2. You don't have sufficient permissions to review intelligence data. Contact your Global administrator. 3. Review your filter settings and ensure that your filters are properly configured. Try modifying your search. 4. You are looking for changes that occurred more than 180 days ago. These changes are no longer available for reporting and running searches. Ask your Auditor Global administrator to import audit data for a required date range from the Long-Term Archive. 5. Data collection for this monitoring plan might not have been launched two times yet or there was no data collection after this change; therefore, audit data has not been written to the Audit Database yet. 6. Some settings in Auditor are configured incorrectly. Contact your Auditor administrator to ensure that: - The monitoring plan you want to audit is properly configured, and the monitoring is enabled for each data source individually. - Audit Database settings are properly configured for each data source individually and Disable security intelligence and make data available only in activity summaries is cleared. Netwrix recommends to store all audit data on the same default SQL Server instance. |
+| "No plans found" text in the Monitoring plan field. | Contact your Auditor Global administrator or Configurator to ensure that the monitoring plans exist and are properly configured. |
+| A blank window appears instead of a report. | Contact your Auditor Global administrator to ensure that you are granted sufficient permissions on the Report Server. To view reports in a web browser, open a web browser and enter the Report Manager URL (found under Settings > **Audit Database**). In the page that opens, navigate to the report you want to generate and click the report name. You can modify the report filters and click View Report to apply them. |
+| Report subscription configured to upload to a file server, but can't be found or accessed. | Subscriptions can be uploaded either to a file share (e.g., _\\filestorage\reports_) or to a folder on the computer where Auditor Server is installed. To access these reports, you must be granted the Read permission. |
+| When trying to collect event data from Active Directory domain, an error message like this appears in Netwrix Health Log: _Monitoring Plan: `` The following error has occurred while processing '``': Error collecting the security log of the domain ``. Failed to process the domain controller `` due to the following error: The service can't be started, either because it is disabled or because it has no enabled devices associated with it_. | This may happen due to Secondary Logon Service disabled state. To collect event data from the domain, this service must be running. Open its properties and start the service. |
+| The 'Workstation' field in search, reports, and Activity Summary is reported as 'unknown' | For the full list of possible reasons, see the Netwrix Knowledge Base article: [Why is the "Workstation" field reported as "unknown"?](/docs/kb/auditor/reports-alerts-and-notifications/report-generation/workstation-field-reported-as-unknown) |
## Creating a ticket with Customer portal
diff --git a/docs/auditor/10.8/admin/monitoringplans/activedirectory/overview.md b/docs/auditor/10.8/admin/monitoringplans/activedirectory/overview.md
index 159f2eb147..afbf56d247 100644
--- a/docs/auditor/10.8/admin/monitoringplans/activedirectory/overview.md
+++ b/docs/auditor/10.8/admin/monitoringplans/activedirectory/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Active Directory
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
@@ -24,15 +24,24 @@ Complete the following fields:
| -------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
-| Monitor Active Directory partitions | Select which of your Active Directory environment partitions you want to audit. By default, Auditor only tracks changes to the Domain partition and the Configuration partition of the audited domain. If you also want to audit changes to the Schema partition, or to disable auditing of changes to the Configuration partition, select one of the following: - Domain—Stores users, computers, groups and other objects. Updates to this partition are replicated only to domain controllers within the domain. - Configuration—Stores configuration objects for the entire forest. Updates to this partition are replicated to all domain controllers in the forest. Configuration objects store the information on sites, services, directory partitions, etc. - Schema—Stores class and attribute definitions for all existing and possible Active Directory objects. Updates to this partition are replicated to all domain controllers in the forest. You cannot disable auditing the Domain partition for changes. |
+| Monitor Active Directory partitions | Select which of your Active Directory environment partitions you want to audit. By default, Auditor only tracks changes to the Domain partition and the Configuration partition of the audited domain. If you also want to audit changes to the Schema partition, or to disable auditing of changes to the Configuration partition, select one of the following: - Domain—Stores users, computers, groups, and other objects. Updates to this partition are replicated only to domain controllers within the domain. - Configuration—Stores configuration objects for the entire forest. Updates to this partition are replicated to all domain controllers in the forest. Configuration objects store the information on sites, services, directory partitions, etc. - Schema—Stores class and attribute definitions for all existing and possible Active Directory objects. Updates to this partition are replicated to all domain controllers in the forest. You can't disable auditing the Domain partition for changes. |
| Detect additional details | Specify additional information to include in reports and activity summaries. Select Group membership if you want to include Group membership of the account under which the change was made. |
| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
-| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. See the [Active Directory](/docs/auditor/10.8/configuration/activedirectory/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
+| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [Active Directory](/docs/auditor/10.8/configuration/activedirectory/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your Active Directory domain configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.8/admin/reports/types/stateintime/overview.md) topic for additional information. The product updates the latest snapshot on the regular basis to keep users up-to-date on actual system state. Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. For that, in the Manage historical snapshots section, click **Manage** and select the snapshots that you want to import. To import snapshots, you must be assigned the Global administrator or the Global reviewer role . Move the selected snapshots to the Snapshots available for reporting list using the arrow button. When finished, click **OK**. |
| Users | |
-| Specify monitoring restrictions | Specify user accounts to exclude from data collection (and, therefore, search results, reports and Activity Summaries). To add a user to the exclusion list, click Add, then provide the user name in the _domain\user_ format. Consider the following: - Use NetBIOS format for domain name: _mydomain_ - Some audit data (events) may contain _System_ as the user (initiator) account name. To exclude such data, specify "_System_" when adding a user name here. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify user accounts to exclude from data collection (and, therefore, search results, reports, and Activity Summaries). To add a user to the exclusion list, click Add, then provide the user name in the _domain\user_ format. Consider the following: - Use NetBIOS format for domain name: _mydomain_ - Some audit data (events) may contain _System_ as the user (initiator) account name. To exclude such data, specify "_System_" when adding a user name here. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
| Objects | |
-| Specify monitoring restrictions | Specify restrictions for the objects to monitor in your Active Directory. Use them to create the lists of specific objects to include and / or exclude from the monitoring scope (and, therefore, search results, reports and Activity Summaries). The following options are available: - Monitor all objects - **Include these objects** - **Exclude these objects** To create a list of inclusions / exclusions, click Add and enter object path using one of the following formats: - Canonical name, for example: _mydomain.local/Computers/filesrv01_ OR - Object path as shown in the "_What_" column of reports and search results, for example: _\local\mydomain\Computers\filesrv01_ You can use a wildcard (\*) to replace any number of characters in the path. See the examples below for more information. |
+| Specify monitoring restrictions | Specify restrictions for the objects to monitor in your Active Directory. Use them to create the lists of specific objects to include and / or exclude from the monitoring scope (and, therefore, search results, reports, and Activity Summaries). The following options are available: - Monitor all objects
+- **Include these objects**
+- **Exclude these objects**
+
+To create a list of inclusions/exclusions, click **Add** and enter the object path using one of the following formats:
+
+- Canonical name, for example: _mydomain.local/Computers/filesrv01_
+- Object path as shown in the "_What_" column of reports and search results, for example: _\local\mydomain\Computers\filesrv01_
+
+You can use a wildcard (\*) to replace any number of characters in the path. See the examples below for more information. |
@@ -52,7 +61,7 @@ _OU_, except for the objects whose path begins with _enterprise.local/OU/BO_. Th
however, will not be monitored, meaning that, for example, its renaming will not be reported.
In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more
-granular audit data. Note that the new monitoring scope restrictions apply together with previous
+granular audit data. The new monitoring scope restrictions apply together with previous
exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic
for additional information.
@@ -62,7 +71,7 @@ This topic applies to auditing Active Directory only.
Active Directory environment consists of the following directory partitions:
-- Domain partition — Stores users, computers, groups and other objects. Updates to this partition
+- Domain partition — Stores users, computers, groups, and other objects. Updates to this partition
are replicated only to domain controllers within the domain.
- Configuration partition — Stores configuration objects for the entire forest. Updates to this
partition are replicated to all domain controllers in the forest. Configuration objects store the
@@ -75,7 +84,7 @@ By default, Netwrix Auditor only tracks changes to the Domain partition and the
partition of the audited domain. If you also want to audit changes to the Schema partition, or to
disable auditing of changes to the Configuration partition do the following:
-You cannot disable auditing the Domain partition for changes.
+You can't disable auditing the Domain partition for changes.
To enable auditing of the Configuration and Schema partitions
@@ -93,11 +102,13 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify AD container | Specify a whole AD domain, OU or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you do not want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers does not include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
+| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. Starting with version 10.7, you can implement the integration between Netwrix Auditor and Netwrix Privilege Secure. See the [Netwrix Privilege Secure](/docs/auditor/10.8/admin/settings/privilegesecure.md) topic for additional information. Refer to the [Permissions for Active Directory Auditing](/docs/auditor/10.8/configuration/activedirectory/permissions.md) topic for more information on using Netwrix Privilege Secure as an account for data collection. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Containers and Computers | |
| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU or container. - Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) are not supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU, or container.
+
+- **Add Computer** – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) aren't supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
## Domain
@@ -121,9 +132,9 @@ integration and supported data sources. In this case, the credentials will not b
Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring
password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
+To use Netwrix Privilege Secure as an account for data collection.
-**Step 1 –** Select the desired item.
+**Step 1 –** Select the item you want.
**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
collection.
@@ -133,7 +144,7 @@ collection.
**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
Credential-based is the default option. Refer to the
[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+documentation to Access Policies documentation.
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
@@ -144,7 +155,7 @@ sources.
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.8/admin/monitoringplans/activedirectory/scope.md b/docs/auditor/10.8/admin/monitoringplans/activedirectory/scope.md
index 60b8354f71..85464e72ec 100644
--- a/docs/auditor/10.8/admin/monitoringplans/activedirectory/scope.md
+++ b/docs/auditor/10.8/admin/monitoringplans/activedirectory/scope.md
@@ -13,7 +13,7 @@ Directory monitoring scope. You can apply restrictions to monitoring scope via t
**_RECOMMENDED:_** Configure monitoring scope restrictions on the Active Directory monitoring plan
page. See the [Active Directory](/docs/auditor/10.8/admin/monitoringplans/activedirectory/overview.md) topic for additional information.
-Follow the steps to exclude data from the Active Directory monitoring scope:
+To exclude data from the Active Directory monitoring scope:
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Active Directory Auditing_
folder.
@@ -26,9 +26,9 @@ folder.
| File | Description | Syntax |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| addprops.txt | Contains a list of properties that should be included for newly created AD objects. When a new object is added, Auditor does not show any data in the Details column in the Activity Summary emails. If you want to see the information on certain attributes of a newly created object, specify these attributes in this file. | `Object type:property:` For example, to show a group description on this group’s creation, add the following line: `group:description:` |
-| allowedpathlist.txt | Contains a list of AD paths to be included in Activity Summaries, reports, and search results. | `Path` The path must be provided in the same format as it is displayed in the What column. For example, if you only want to monitor specific OU(s) in the AD domain, but not the entire domain. You can put a wildcard (\*) in the omitpathlist.txt file to exclude all paths, and then specify the OU(s) you want to monitor in the allowedpathlist.txt file. Adding the wildcard (\*) to omitpathlist.txt will not allow Netwrix Auditor to run AD state-in-time data collection. |
-| omitallowedpathlist.txt | Contains a list of AD paths to be excluded from Activity Summaries, reports, and search results. This file can be used if you want to exclude certain paths inside those specified in the allowedpathlist.txt file. | `Path` The path must be provided in the same format as it is displayed in the What column. For example, you can put a wildcard (\*) in the omitpathlist.txt file to exclude all paths, then specify the OU(s) you want to monitor in the allowedpathlist.txt file, and then specify the paths you want to exclude from within them in the omitallowedpathlist.txt file. Adding the wildcard (\*) to omitpathlist.txt will not allow Netwrix Auditor to run AD state-in-time data collection. |
+| addprops.txt | Contains a list of properties that should be included for newly created AD objects. When a new object is added, Auditor doesn't show any data in the Details column in the Activity Summary emails. If you want to see the information on certain attributes of a newly created object, specify these attributes in this file. | `Object type:property:` For example, to show a group description on this group’s creation, add the following line: `group:description:` |
+| allowedpathlist.txt | Contains a list of AD paths to be included in Activity Summaries, reports, and search results. | `Path` The path must be provided in the same format as it is displayed in the What column. For example, if you only want to monitor specific OUs in the AD domain, but not the entire domain. You can put a wildcard (\*) in the omitpathlist.txt file to exclude all paths, and then specify the OUs you want to monitor in the allowedpathlist.txt file. Adding the wildcard (\*) to omitpathlist.txt will not allow Netwrix Auditor to run AD state-in-time data collection. |
+| omitallowedpathlist.txt | Contains a list of AD paths to be excluded from Activity Summaries, reports, and search results. This file can be used if you want to exclude certain paths inside those specified in the allowedpathlist.txt file. | `Path` The path must be provided in the same format as it is displayed in the What column. For example, you can put a wildcard (\*) in the omitpathlist.txt file to exclude all paths, then specify the OUs you want to monitor in the allowedpathlist.txt file, and then specify the paths you want to exclude from within them in the omitallowedpathlist.txt file. Adding the wildcard (\*) to omitpathlist.txt will not allow Netwrix Auditor to run AD state-in-time data collection. |
| omitexchangeserverlist.txt | Specify the Microsoft Exchange 2010 servers to be excluded from data collection. | `FQDN_server_name` **NOTE:** You can use the wildcard (\*) when specifying servers for exclusion. |
| omitobjlist.txt | Contains a list of object types to be excluded from Activity Summaries, reports, and search results. | `Object type` For example, to omit changes to the printQueue object, add the following line: `printQueue`. |
| omitpathlist.txt | Contains a list of AD paths to be excluded from Activity Summaries, reports, and search results. | `Path` The path must be provided in the same format as it is displayed in the What column. For example, to exclude changes to the Service Desk OU, add the following line: `*\Service Desk\*`. |
@@ -36,9 +36,9 @@ folder.
| omitreporterrors.txt | Contains a list of errors to be excluded from Netwrix Health Log. Thus, these errors will not appear in the Activity Summary emails. | `Error message text` For example, if you have advanced audit settings applied to your domain controllers policy, the following error will be returned in the Activity Summary emails: `Auditing of Directory Service Access is not enabled for this DC. Adjust the audit policy settings using the Active Directory Audit Configuration Wizard or see the product documentation for more information.` Add the text of this error message to this file to stop getting it in the Activity Summary emails. |
| omitsnapshotpathlist.txt | Contains a list of AD paths to be excluded from AD snapshots. | `Path` The path must be provided in the same format as it is displayed in the What column. For example, to exclude data on the Disabled Accounts OU from the Snapshot report, add the following line:` *\Disabled Accounts*`. |
| omitstorelist.txt | Contains a list of object types and properties to be excluded from AD snapshots. | `object_type.property_name` If there is no separator (.) between an object type and a property, the whole entry is treated as an object type. For example to exclude data on the AD adminDescription property, add the following line: `*.adminDescription`. |
-| omituserlist.txt | Contains a list of users you want to exclude from search results, reports and Activity Summaries. | `domain\username` For example, `*\administrator`. |
-| processaddedprops.txt | Contains a list of properties that should be included for newly created AD objects. When a new object is created, Auditor does not show any data in the Details column in reports. If you want to see the information on certain attributes of a newly created object, specify these attributes in this file. | `object type:property:` For example, if you want a user’s Description property to be displayed in the reports when a user is added, add the following line: `User:Description:` |
-| processdeletedprops.txt | Contains a list of properties that should be included for deleted AD objects. When an object is deleted, Auditor does not show any data in the Details column in reports. If you want to see the information on certain attributes of a deleted object, specify these attributes in this file. | `object type:property:` For example, if you want a user’s Description property to be displayed in the reports when a user is deleted, add the following line: `User:Description:` |
+| omituserlist.txt | Contains a list of users you want to exclude from search results, reports, and Activity Summaries. | `domain\username` For example, `*\administrator`. |
+| processaddedprops.txt | Contains a list of properties that should be included for newly created AD objects. When a new object is created, Auditor doesn't show any data in the Details column in reports. If you want to see the information on certain attributes of a newly created object, specify these attributes in this file. | `object type:property:` For example, if you want a user’s Description property to be displayed in the reports when a user is added, add the following line: `User:Description:` |
+| processdeletedprops.txt | Contains a list of properties that should be included for deleted AD objects. When an object is deleted, Auditor doesn't show any data in the Details column in reports. If you want to see the information on certain attributes of a deleted object, specify these attributes in this file. | `object type:property:` For example, if you want a user’s Description property to be displayed in the reports when a user is deleted, add the following line: `User:Description:` |
| propnames.txt | Contains a list of human-readable names for object types and properties to be displayed in Activity Summaries, reports, and search results. | `classname.attrname= intelligiblename` For example, if you want the adminDescription property to be displayed in the reports as Admin Screen Description, add the following line: `*.adminDesciption=Admin Screen Description` |
## Example
@@ -47,7 +47,7 @@ To exclude the "_corp/Administrator_" user from being audited, use the following
**omitusers.txt** file:
```
-# Specify users whose activity you want to exclude from Active Directory search results, reports and Activity Summaries.
+# Specify users whose activity you want to exclude from Active Directory search results, reports, and Activity Summaries.
# Syntax: Domain\Username
# Note: Wildcard * is supported and can replace any number of characters.
# Example:
diff --git a/docs/auditor/10.8/admin/monitoringplans/activitysummaryemail.md b/docs/auditor/10.8/admin/monitoringplans/activitysummaryemail.md
index b5f3ba4bcb..acaf3d4b79 100644
--- a/docs/auditor/10.8/admin/monitoringplans/activitysummaryemail.md
+++ b/docs/auditor/10.8/admin/monitoringplans/activitysummaryemail.md
@@ -12,7 +12,7 @@ data sources an Activity Summary is generated daily at 3:00 AM and delivered to
recipients. You can also launch data collection and Activity Summary generation manually.
Notifications on user activity and event log collection (Event Log Collection Status) are a bit
-different and do not show changes.
+different and don't show changes.
The following Activity Summary example applies to Active Directory. Other Activity Summaries
generated and delivered by Netwrix Auditor will vary slightly depending on the data source.
diff --git a/docs/auditor/10.8/admin/monitoringplans/adfs.md b/docs/auditor/10.8/admin/monitoringplans/adfs.md
index d74274ef58..6d9239cf76 100644
--- a/docs/auditor/10.8/admin/monitoringplans/adfs.md
+++ b/docs/auditor/10.8/admin/monitoringplans/adfs.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Active Directory Federation Services
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data collection
@@ -25,7 +25,7 @@ Complete the following fields:
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
| Schedule AD FS logons collection | Specify period for AD FS logons collection. |
| Specify data collection method | You can enable network traffic compression. If enabled, a Compression Service will be automatically launched on the audited computer, collecting and pre-filtering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
-| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. For a full list of audit settings required to collect comprehensive audit data and instructions on how to configure them, refer to [AD FS](/docs/auditor/10.8/configuration/activedirectoryfederatedservices/overview.md). |
+| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. For a full list of audit settings required to collect comprehensive audit data and instructions on how to configure them, refer to [AD FS](/docs/auditor/10.8/configuration/activedirectoryfederatedservices/overview.md). |
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the **Data source** list. As a next step, click **Add item** to specify an
@@ -35,12 +35,12 @@ topic for additional information.
## Federation Server
If you are going to audit an entire AD FS farm, consider adding all AD FS server one by one as items
-to your monitoring plan. Otherwise, your audit scope may contain warnings, errors or incomplete
+to your monitoring plan. Otherwise, your audit scope may contain warnings, errors, or incomplete
data.
Complete the following fields:
| Option | Description |
| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Specify AD FS federation server | Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
+| Specify AD FS federation server | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. |
diff --git a/docs/auditor/10.8/admin/monitoringplans/create.md b/docs/auditor/10.8/admin/monitoringplans/create.md
index 61486b792b..444862cae3 100644
--- a/docs/auditor/10.8/admin/monitoringplans/create.md
+++ b/docs/auditor/10.8/admin/monitoringplans/create.md
@@ -13,7 +13,7 @@ Users with the _Configurator_ role can create plans only within a delegated fold
To start creating a plan, do any of the following:
- On the main Auditor page, in the Quick Start section, click the tile with a data source of your
- choice, e.g., Active Directory. If you need a data source that is not listed on the main page,
+ choice, e.g., Active Directory. If you need a data source that isn't listed on the main page,
click All data sources.
- On the main Auditor page, in the Configuration section, click the Monitoring Plans tile. On the
Monitoring Plans page, select Add Plan.
@@ -44,15 +44,15 @@ general settings for data collection.
| Option | Description |
| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Specify the account for collecting data | If applicable, you can create a data collecting account in the following ways: - Not specified – Select this option if you want to choose the Netwrix Privilege Secure as the data collecting account for the Monitoring Plan. See the [Netwrix Privilege Secure](/docs/auditor/10.8/admin/settings/privilegesecure.md) topic for additional information. - User/password – Provide a username and password for the account that Auditor will use to collect data. By default, the user name is prepopulated with your account name. - gMSA – Use the group Managed Service Account (gMSA) as data collecting account. For more details about gMSA usage, see the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.8/requirements/gmsa.md) topic. **NOTE:** If you want to audit network devices or Microsoft Entra ID (formerly Azure AD)/Office 365 infrastructure, you need to use _not specified_ account. Make sure the account has sufficient permissions to collect data. For a full list of the rights and permissions, and instructions on how to configure them, refer to the[Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md). Netwrix recommends creating a special service account with extended permissions. When you configure a monitoring plan for the first time, the account you specify for data collection will be set as default. |
-| Enable network traffic compression | If selected, this option instructs Auditor to deploy a special utility that will run on the audited computers and do the following: - Collect and pre-filter audit data - Compress data and forward it to Auditor Server. This approach helps to optimize load balance and reduce network traffic. So, using this option can be recommended especially for distributed networks with remote locations that have limited bandwidth. See the [Network Traffic Compression](/docs/auditor/10.8/admin/healthstatus/networktrafficcompression.md) topic for additional information. |
-| Adjust audit settings automatically | Auditor can configure audit settings in your environment automatically. Select Adjust audit settings automatically. In this case, Auditor will continually check and enforce the relevant audit policies. For some data sources (currently, Active Directory and Logon Activity) you will be offered to launch a special utility that will detect current audit settings, check them against requirements and then adjust them automatically. See the [Audit Configuration Assistant](/docs/auditor/10.8/tools/auditconfigurationassistant.md) topic for additional information. You may also want to apply audit settings via GPO (for example, for Windows Servers). Auditor has certain limitations when configuring audit settings for NetApp and Dell Data Storage. See the [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) topic for additional information. If any conflicts are detected with your current settings, automatic audit configuration will not be performed. Select this option if you want to audit file shares on NetApp Data ONTAP 7 and 8 in 7-mode. For NetApp Clustered Data ONTAP 8 and ONTAP 9, only audit settings for file shares can be configured automatically, other settings must be applied manually. If you plan to monitor EMC Isilon, clear the checkbox. Currently, Auditor cannot configure audit on Dell Isilon appliances automatically. If you want to audit Dell VNX/VNXe, select Adjust audit settings automatically, but only audit settings for file shares will configured, the rest of settings must be configured manually. For a full list of audit settings and instructions on how to configure them manually, see the [Supported Data Sources](/docs/auditor/10.8/requirements/supporteddatasources/supporteddatasources.md) for additional information. |
+| Specify the account for collecting data | If applicable, you can create a data collecting account in the following ways: - Not specified – Select this option if you want to choose the Netwrix Privilege Secure as the data collecting account for the Monitoring Plan. See the [Netwrix Privilege Secure](/docs/auditor/10.8/admin/settings/privilegesecure.md) topic for additional information. - User/password – Provide a username and password for the account that Auditor will use to collect data. By default, the user name is prepopulated with your account name. - gMSA – Use the group Managed Service Account (gMSA) as data collecting account. For more details about gMSA usage, see the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.8/requirements/gmsa.md) topic. **NOTE:** If you want to audit network devices or Microsoft Entra ID (formerly Azure AD)/Office 365 infrastructure, you need to use _not specified_ account. Ensure the account has sufficient permissions to collect data. For a full list of the rights and permissions, and instructions on how to configure them, refer to the[Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md). Netwrix recommends creating a special service account with extended permissions. When you configure a monitoring plan for the first time, the account you specify for data collection will be set as default. |
+| Enable network traffic compression | If selected, this option instructs Auditor to deploy a special utility that will run on the audited computers and do the following: - Collect and pre-filter audit data - Compress data and forward it to Auditor Server. This approach helps to optimize load balance and reduce network traffic. Using this option is recommended especially for distributed networks with remote locations that have limited bandwidth. See the [Network Traffic Compression](/docs/auditor/10.8/admin/healthstatus/networktrafficcompression.md) topic for additional information. |
+| Adjust audit settings automatically | Auditor can configure audit settings in your environment automatically. Select Adjust audit settings automatically. In this case, Auditor will continually check and enforce the relevant audit policies. For some data sources (Active Directory and Logon Activity) you will be offered to launch a special utility that will detect current audit settings, check them against requirements and then adjust them automatically. See the [Audit Configuration Assistant](/docs/auditor/10.8/tools/auditconfigurationassistant.md) topic for additional information. You may also want to apply audit settings via GPO (for example, for Windows Servers). Auditor has certain limitations when configuring audit settings for NetApp and Dell Data Storage. See the [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) topic for additional information. If any conflicts are detected with your current settings, automatic audit configuration will not be performed. Select this option if you want to audit file shares on NetApp Data ONTAP 7 and 8 in 7-mode. For NetApp Clustered Data ONTAP 8 and ONTAP 9, only audit settings for file shares can be configured automatically, other settings must be applied manually. If you plan to monitor EMC Isilon, clear the checkbox. Auditor can't configure audit on Dell Isilon appliances automatically. If you want to audit Dell VNX/VNXe, select Adjust audit settings automatically, but only audit settings for file shares will configured, the rest of settings must be configured manually. For a full list of audit settings and instructions on how to configure them manually, see the [Supported Data Sources](/docs/auditor/10.8/requirements/supporteddatasources/supporteddatasources.md) for additional information. |
| Launch Audit Configuration Assistant | Click to launch a specially intended utility that will assess your environment readiness for monitoring and adjust audit settings, if necessary. The tool will be launched in a new window. See the [Audit Configuration Assistant](/docs/auditor/10.8/tools/auditconfigurationassistant.md) topic for additional information. |
| Collect data for state-in-time reports | State-in-time reports are based on the daily configuration snapshots of your audited systems; they help you to analyze particular aspects of the environment. State-in-time configuration snapshots are also used for IT risks assessment metrics and reports. This data collection option is available if you are creating a monitoring plan for any of the following data sources: - Active Directory - File Servers - Windows Server - Group Policy - SharePoint - SharePoint Online - Exchange Online - SQL Server - VMware See the [State–In–Time Reports](/docs/auditor/10.8/admin/reports/types/stateintime/overview.md) and [IT Risk Assessment Overview ](/docs/auditor/10.8/admin/riskassessment/overview.md) topics for additional information. |
## Default SQL Server Instance
-To provide searching, alerting and reporting capabilities, Auditor needs an SQL Server where audit
+To provide searching, alerting, and reporting capabilities, Auditor needs an SQL Server where audit
data will be stored in the databases. To store data from the data sources included in the monitoring
plan, the wizard creates an Audit Database for each plan. At this step, you should specify the
default SQL Server instance that will host Auditor databases. See the
@@ -69,15 +69,15 @@ plans.
Select one of the following options:
- Disable security intelligence and make data available only in activity summaries — select this
- option if you do not want audit data to be written to the Audit Database. In this case, data will
- be available only in Activity Summary emails. Alerts, reports and search capabilities will not be
+ option if you don't want audit data to be written to the Audit Database. In this case, data will
+ be available only in Activity Summary emails. Alerts, reports, and search capabilities will not be
supported.
If you later clear this option to start saving data to the database, consider that already
collected audit data will not be imported in that database.
- Install a new instance of Microsoft SQL Server Express automatically — this option is available at
- the first run of the wizard. It allows you to deploy SQL Server 2016 SP2 Express with Advanced
+ the first run of the wizard. It deploys SQL Server 2016 SP2 Express with Advanced
Services on the local machine. This SQL Server will be used as default host for Auditor databases.
It is strongly recommended that you plan for your databases first, as described in
@@ -94,7 +94,7 @@ Select one of the following options:
| Option | Description |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
- | SQL Server instance | Specify the name of the SQL Server instance to store audit data. If you have more than one Auditor Server running in your network, make sure to configure them to use different SQL Server instances. The same SQL Server instance cannot be used to store audit data collected by several Auditor Servers. |
+ | SQL Server instance | Specify the name of the SQL Server instance to store audit data. If you have more than one Auditor Server running in your network, ensure to configure them to use different SQL Server instances. The same SQL Server instance can't be used to store audit data collected by several Auditor Servers. |
| Authentication | Select the authentication type you want to use to connect to the SQL Server instance: - Windows authentication - SQL Server authentication |
| User name | Specify the account to be used to connect to the SQL Server instance. This account must be granted the **database owner (db_owner)** role and the dbcreator server role. |
| Password | Enter a password. |
@@ -121,10 +121,10 @@ Configure the following:
| Setting | Description |
| ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Disable security intelligence ... | Only select this option if you do not want your data to be stored in the database. In this case, you will only be able to receive activity summaries. Reporting and alerting capabilities will not be provided. To store data to the database, leave this check box cleared. |
+| Disable security intelligence ... | Only select this option if you don't want your data to be stored in the database. In this case, you will only be able to receive activity summaries. Reporting and alerting capabilities will not be provided. To store data to the database, leave this checkbox cleared. |
| Database | Default database name is _Netwrix_Auditor_``_. It is recommended that you enter a meaningful name for the database here. It may include the data source type (e.g. \_Exchange_Audit_Data_ or _OracleSrv02_Audit_Data_), or so. If you decided to use the existing SQL Server instance instead of dedicated, you may want to use _Netwrix_Auditor_ prefix to distinguish Netwrix Auditor databases from others. |
| Use default SQL Server settings | Select this option if you want Auditor to connect to the SQL Server instance using the default settings you specified at the Default SQL Server Instance step. |
-| Specify custom connection parameters | Select this option to use custom credentials when connecting to SQL Server. Specify authentication method and the account that Auditor will use. Make sure this account has sufficient rights to connect to SQL Server and work with the databases. |
+| Specify custom connection parameters | Select this option to use custom credentials when connecting to SQL Server. Specify authentication method and the account that Auditor will use. Ensure this account has sufficient rights to connect to SQL Server and work with the databases. |
Auditor will connect to the default SQL Server instance and create a database with the specified
name on it.
@@ -136,12 +136,12 @@ server used for reporting) are available on the Audit Database page of Auditor s
## SMTP Server Settings
When you create the first monitoring plan, you are prompted to specify the email settings that will
-be used for activity and health summaries, reports and alerts delivery. For the monitoring plans
+be used for activity and health summaries, reports, and alerts delivery. For the monitoring plans
that follow, Netwrix Auditor will automatically detect SMTP settings; however, for your first plan
you should provide them manually. See the [Notifications](/docs/auditor/10.8/admin/settings/notifications.md) topic for
additional information.
-You can skip this step if you do not want to receive email notifications, or configure SMTP settings
+You can skip this step if you don't want to receive email notifications, or configure SMTP settings
later, as described in the related section.
## Email Notification Recipients
@@ -168,13 +168,13 @@ plan wizard, select the Add item now checkbox. See the
[Add Items for Monitoring](datasources.md#add-items-for-monitoring) topic for additional
information.
-A monitoring plan cannot collect data until at least one item is specified.
+A monitoring plan can't collect data until at least one item is specified.
Some data sources require additional system components and updates to be installed on your computer.
In this case, Auditor will inform you and prompt you to check data source prerequisites instead of
adding an item.
-Once you complete the wizard, you can:
+After you complete the wizard, you can:
- Add items to your plan
- Add more data sources
diff --git a/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md b/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md
index d781e2bba5..cade881482 100644
--- a/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md
+++ b/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Data Collecting Account
This is a service account that Auditor uses to collect audit data from the monitored items, such as
-domains, OUs and servers. Netwrix recommends the creation of a dedicated service account for that
+domains, OUs, and servers. Netwrix recommends the creation of a dedicated service account for that
purpose. Depending on the data source your monitoring plan will process, the account must meet the
corresponding requirements in the table below.
@@ -63,7 +63,7 @@ data source.
Once a Data Collecting Account has been configured, you can always update the password for this
account in Netwrix Auditor.
-Follow the steps to update credentials for the accounts used by Auditor:
+To update credentials for the accounts used by Auditor:
**Step 1 –** On the Auditor home page, navigate to **Settings**.
diff --git a/docs/auditor/10.8/admin/monitoringplans/datasources.md b/docs/auditor/10.8/admin/monitoringplans/datasources.md
index 9fd1272ee5..a169519e20 100644
--- a/docs/auditor/10.8/admin/monitoringplans/datasources.md
+++ b/docs/auditor/10.8/admin/monitoringplans/datasources.md
@@ -10,17 +10,17 @@ You can fine-tune data collection for each data source. Settings that you config
source will be applied to all items belonging to that data source. Using data source settings, you
can, for example:
-- Enable state-in-time data collection (currently supported for several data sources)
+- Enable state-in-time data collection (supported for several data sources)
- Depending on the data source, customize the monitoring scope (e.g., enable read access auditing,
monitoring of failed attempts)
-To add, modify and remove data sources, enable or disable monitoring, you must be assigned the
+To add, modify, and remove data sources, enable, or disable monitoring, you must be assigned the
Global administrator role in the product or the Configurator role on the plan. See the
[Role-Based Access and Delegation](/docs/auditor/10.8/admin/monitoringplans/delegation.md) topic for additional information.
## Modify Data Source Settings
-Follow the steps to modify data source settings.
+To modify data source settings:
**Step 1 –** Select the monitoring plan you need and click **Edit**.
@@ -58,7 +58,7 @@ needed.
## Add a Data Source to an Existing Plan
-Follow the steps to add a data source to existing plan.
+To add a data source to an existing plan:
**Step 1 –** Select the monitoring plan you need and click Edit.
@@ -72,7 +72,7 @@ Follow the steps to add a data source to existing plan.
## Add Items for Monitoring
-Once you completed monitoring plan wizard and specified data sources, add items for monitoring. You
+After you complete the monitoring plan wizard and specify data sources, add items for monitoring. You
can add as many items for a data source as you want. In this case, all items will share settings you
specified for this data source.
@@ -93,11 +93,11 @@ associated with your data source.
| Windows Server User Activity | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) [AD Container](activedirectory/overview.md#ad-container) [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) |
| Netwrix API | [Integration API](/docs/auditor/10.8/api/overview.md) |
-To add, modify and remove items, you must be assigned the Global administrator role in the product
+To add, modify, and remove items, you must be assigned the Global administrator role in the product
or the **Configurator** role on the plan. See the
[Role-Based Access and Delegation](/docs/auditor/10.8/admin/monitoringplans/delegation.md)topic for additional information.
-Follow the steps to add a new item to a data source:
+To add a new item to a data source:
**Step 6 –** Navigate to your plan settings.
@@ -118,32 +118,36 @@ monitoring scope can be configured on the Data Source and/or Item levels. the se
examples on how to use omit functionality in Auditor.
In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more
-granular audit data. Note that the new monitoring scope restrictions apply together with previous
-exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for
-additional information.
+granular audit data.
+
+:::note
+The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files.
+:::
+
+See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md) topic for additional information.
| Use case | Related documentation |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Active Directory** | |
-| I want to omit all activity by a specific service account or service accounts with specific naming pattern. | [Active Directory](/docs/auditor/10.8/admin/monitoringplans/activedirectory/overview.md) |
+| You want to omit all activity by a specific service account or service accounts with a specific naming pattern. | [Active Directory](/docs/auditor/10.8/admin/monitoringplans/activedirectory/overview.md) |
| If Netwrix user is responsible just for a limited scope within corporate AD, s/he needs to omit everything else. | [Active Directory](/docs/auditor/10.8/admin/monitoringplans/activedirectory/overview.md) - Always both activity and state in time data are omitted. - In group/Not in group filters don't not process groups from omitted OUs. |
| **Logon Activity** | |
-| I want to omit domain logons by a specific service account or service accounts with specific naming pattern. | [Logon Activity](/docs/auditor/10.8/admin/monitoringplans/logonactivity/overview.md) |
+| You want to omit domain logons by a specific service account or service accounts with a specific naming pattern. | [Logon Activity](/docs/auditor/10.8/admin/monitoringplans/logonactivity/overview.md) |
| **File Servers** (including Windows file server, Dell, NetApp, Nutanix File server) | |
-| I have a server named _StationWin16_ where I can't install .Net 4.5 in OU where I keep all member servers. I want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) |
-| A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Then, s/he does not want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) |
-| A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Then, s/he does not want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) |
-| A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Netwrix Auditor to collect State-in-Time data for this folder. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) |
-| I want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) |
+| You have a server named _StationWin16_ where you can't install .Net 4.5 in the OU where you keep all member servers. You want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) |
+| A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Then, s/he doesn't want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) |
+| A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Then, s/he doesn't want the product to monitor this folder at all. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) |
+| A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Netwrix Auditor to collect State-in-Time data for this folder. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) [Dell Isilon](fileservers/overview.md#dell-isilon) [Dell VNX VNXe](fileservers/overview.md#dell-vnx-vnxe) [NetApp](fileservers/overview.md#netapp) [Windows File Share](fileservers/scope.md#windows-file-share) [Nutanix SMB Shares](fileservers/overview.md#nutanix-smb-shares) |
+| You want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) |
| **SQL Server** | |
-| I want to know if _corp\administrator_ user is messing with SQL data. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) |
-| As a Auditor administrator I want to exclude the _domain\nwxserviceaccount_ service account activity from SQL server audit so that I get reports without changes made by automatic systems. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) |
-| As a Auditor administrator I want to exclude all changes performed by _MyCustomTool_. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) |
+| You want to know if the _corp\administrator_ user is messing with SQL data. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) |
+| As an Auditor administrator, you want to exclude the _domain\nwxserviceaccount_ service account activity from SQL server audit so that you get reports without changes made by automatic systems. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) |
+| As an Auditor administrator, you want to exclude all changes performed by _MyCustomTool_. | [SQL Server Instance](sqlserver/items.md#sql-server-instance) |
| **SharePoint** | |
-| I want to exclude the _domain\nwxserviceaccount_ account from data collection as it produces standard activity that doesn't require monitoring. | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) |
-| As a Auditor Administrator I want to exclude shared _PublicList_ from read audit. | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) |
+| You want to exclude the _domain\nwxserviceaccount_ account from data collection as it produces standard activity that doesn't require monitoring. | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) |
+| As an Auditor Administrator, you want to exclude shared _PublicList_ from read audit. | [SharePoint Farm](sharepoint/overview.md#sharepoint-farm) |
| Windows Server | |
-| I have a server named StationWin16 where I can't install .Net 4.5 in OU where I keep all member servers. I want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) |
-| I want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) |
+| You have a server named StationWin16 where you can't install .Net 4.5 in the OU where you keep all member servers. You want to suppress errors from this server by excluding it from the Netwrix auditing scope. | [AD Container](activedirectory/overview.md#ad-container) |
+| You want to exclude specific computers within an IP range from the Netwrix auditing scope. | [File Servers](/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md) |
| VMware | |
-| I have a virtual machine named "testvm" I use for testing purposes, so I want to exclude it from being monitored. | [VMware ESX/ESXi/vCenter](vmware/overview.md#vmware-esxesxivcenter) |
+| You have a virtual machine named "testvm" that you use for testing purposes, so you want to exclude it from being monitored. | [VMware ESX/ESXi/vCenter](vmware/overview.md#vmware-esxesxivcenter) |
diff --git a/docs/auditor/10.8/admin/monitoringplans/delegation.md b/docs/auditor/10.8/admin/monitoringplans/delegation.md
index cbbe757123..b88bfcae14 100644
--- a/docs/auditor/10.8/admin/monitoringplans/delegation.md
+++ b/docs/auditor/10.8/admin/monitoringplans/delegation.md
@@ -7,7 +7,7 @@ sidebar_position: 230
# Role-Based Access and Delegation
Security and awareness of _who_ has access to _what_ is crucial for every organization. Besides
-notifying you on _who_ changed _what_, _when_ and _where_, and _who_ has access to _what_ in your IT
+notifying you on _who_ changed _what_, _when_, and _where_, and _who_ has access to _what_ in your IT
infrastructure, Netwrix pays attention to safety of its own configuration and collected data.
To keep the monitoring process secure, Netwrix suggests configuring role-based access. Delegating
@@ -21,7 +21,7 @@ Roles are described briefly in the table below and explained in detail in the ne
| Role | Access level | Recommended use |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Global administrator | Full control. Access to global settings, monitoring plan configuration, collected data, access delegation, etc. | The role should be assigned to a very limited number of employees—typically, only the owner of the Auditor Server host in your environment. By default, the user who installed Auditor is assigned the Global administrator role. All members of the local Administrators group are Global administrators too. |
-| Configurator | Access to monitoring plan configuration within the delegated scope: a monitoring plan or a folder with monitoring plans | The role is appropriate for system administrators, infrastructure engineers, and members of operations team who manage network and services in your organization but should not have access to sensitive data. |
+| Configurator | Access to monitoring plan configuration within the delegated scope: a monitoring plan or a folder with monitoring plans | The role is appropriate for system administrators, infrastructure engineers, and members of operations team who manage network and services in your organization but shouldn't have access to sensitive data. |
| Global reviewer | Access to all data collected by Auditor and intelligence and visibility features. | The role is appropriate for key employees who need to review audit data collected across various data sources—typically, IT managers, chief information security officer, and so on. |
| Reviewer | Access to data collected by Auditor and intelligence and visibility features within the delegated scope. | The role is appropriate for members of security team and helpdesk personnel who are responsible for mitigating risks in a certain sector of your environment (e.g., domain, file share). This role is granted to specialists who use the Integration API to retrieve data from the Audit Database. |
| Contributor | Write access to Auditor Server and Audit Database. | This service role is granted to specialists who use the Integration API to write data to the Audit Database. This role is also granted to service accounts or any accounts used for interaction with Auditor Server (e.g., add-on scripts). |
@@ -31,17 +31,17 @@ Roles are described briefly in the table below and explained in detail in the ne
| Feature | Global administrator | Global reviewer | Reviewer | Configurator | Contributor |
| --------------------------------------------------------------------------------------------- | -------------------- | ----------------------------------------------- | -------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | ------------------- |
| Launch Auditor client | + | + | + | + | + |
-| Delegate control, grant and revoke permissions | + | – | – | – | – |
+| Delegate control, grant, and revoke permissions | + | – | – | – | – |
| View global settings | + | Some | Some | Some | Some |
| Modify global settings (including default Audit Database, licenses, retention settings, etc.) | + | – | – | – | – |
| Monitoring plan configuration | | | | | |
| List folders | + | + | + | + | + |
-| Add, remove, rename folders | + | – | – | Some Only under assigned folders provided that directly assigned roles do not conflict. | – |
+| Add, remove, rename folders | + | – | – | Some Only under assigned folders provided that directly assigned roles don't conflict. | – |
| List monitoring plans, review status | + | + | + | + | + |
-| Add, remove, rename monitoring plans | + | – | – | Some Only under assigned folders provided that directly assigned roles do not conflict. | – |
+| Add, remove, rename monitoring plans | + | – | – | Some Only under assigned folders provided that directly assigned roles don't conflict. | – |
| Modify monitoring plan settings | + | Some Add and remove Activity Summary recipients | Some Add and remove Activity Summary recipients within the delegated scope | Some Restricted to the delegated scope (folder or monitoring plan) | – |
| List data sources and items in monitoring plan | + | + | + | + | + |
-| Add, modify, remove data sources, enable or disable auditing | + | – | – | Some Restricted to the delegated scope (folder or monitoring plan) | – |
+| Add, modify, remove data sources, enable, or disable auditing | + | – | – | Some Restricted to the delegated scope (folder or monitoring plan) | – |
| Add, modify, remove items in monitoring plan | + | – | – | Some Restricted to the delegated scope (folder or monitoring plan) | – |
| Manage state-in-time data, upload snapshots to the Audit Database | + | + | – | – | – |
| Intelligence | | | | | |
@@ -71,8 +71,8 @@ Roles are described briefly in the table below and explained in detail in the ne
Netwrix Auditor allows assigning roles on the product as a whole, or within a specific _scope_. A
scope can be limited to a single monitoring plan or to the contents of a folder. This helps to
ensure that only authorized personnel has access to the relevant data. For example, database
-administrators (DBAs) should not access Active Directory management data, and domain administrators
-do not need permissions to view database schema changes or update data collection settings, and so
+administrators (DBAs) shouldn't access Active Directory management data, and domain administrators
+don't need permissions to view database schema changes or update data collection settings, and so
on.
### Understanding Scopes
@@ -85,7 +85,7 @@ Scopes for different Auditor roles are as follows:
| Folder level | Configurator Reviewer |
| Plan level | Configurator Reviewer |
-Follow the steps to delegate control to some scope, review, or revoke assigned roles.
+To delegate control to some scope, review, or revoke assigned roles.
**Step 1 –** On the main Auditor page, navigate to the **Monitoring Plans** section.
@@ -137,7 +137,7 @@ users to these groups on the computer where Auditor Server resides.
Users will be granted roles with extended permissions. You may need to limit their scope to a
specific monitoring plan.
-Follow the steps to add an account to a group.
+To add an account to a group.
**Step 1 –** On the computer where Auditor Server is installed, start the Local Users and Computers
snap-in.
@@ -165,7 +165,7 @@ However, in some cases, organizations need to provide certain employees with acc
of audit data. For example, an auditor might need to review particular access reports once or twice
a year. You can provide these users (recipients) with means to review the data they need without
actually running Auditor. This ensures that dedicated specialists have access to the data while
-preventing data breaches and ensuring that sensitive data is not being distributed across the whole
+preventing data breaches and ensuring that sensitive data isn't being distributed across the whole
company.
Netwrix recommends granting limited access permissions to employees who need to:
@@ -178,6 +178,6 @@ To grant limited access to audit data, you can:
| Do.. | Recommended use |
| ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Schedule email report subscriptions | This is helpful when you want to share information with a group of employees, external consultants, auditors, and so on. Reports are sent according to a specified schedule and recipients can review them, but they do not have any other means to access audit data. Basically, this option is enough for employees who are interested in a high-level summary—for example, an auditor who performs monthly access rights attestation on critical folders or a senior manager. |
+| Schedule email report subscriptions | This is helpful when you want to share information with a group of employees, external consultants, auditors, and so on. Reports are sent according to a specified schedule and recipients can review them, but they don't have any other means to access audit data. Basically, this option is enough for employees who are interested in a high-level summary—for example, an auditor who performs monthly access rights attestation on critical folders or a senior manager. |
| Publish reports to file shares | This scenario works great for a helpdesk with several departments. Assume, each department has its own field of responsibility and must not disclose information to other departments. You can configure Auditor to publish reports to folders that can be accessed by employees from a specific department only. You might set up the following folders and permissions: - The user support team has access to a folder with reports on account lockouts and password resets. - File server helpdesk personnel have access to a different folder with daily reports listing all file removals. - The helpdesk supervisor has access to both folders. |
-| Configure alerts | This is helpful for rare occasions when you have to notify some senior specialists about critical system state that has to be addressed immediately, e.g., CISO must mitigate risks in the event of massive deletions in the sensitive data storage. |
+| Configure alerts | This is helpful for rare occasions when you have to notify some senior specialists about critical system state that has to be addressed immediately, e.g., CISO must mitigate risks if there are massive deletions in the sensitive data storage. |
diff --git a/docs/auditor/10.8/admin/monitoringplans/exchange/scope.md b/docs/auditor/10.8/admin/monitoringplans/exchange/scope.md
index a21e12721c..66b3bec446 100644
--- a/docs/auditor/10.8/admin/monitoringplans/exchange/scope.md
+++ b/docs/auditor/10.8/admin/monitoringplans/exchange/scope.md
@@ -12,7 +12,7 @@ scope. In addition, you can exclude data from non-owner access auditing.
- Exchange Monitoring Scope
- To exclude users or mailboxes from the Mailbox Access monitoring scope
-Follow the steps to exclude data from the Exchange monitoring scope:
+To exclude data from the Exchange monitoring scope:
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Active Directory Auditing_
folder.
@@ -30,17 +30,17 @@ folder.
| omitobjlist_ecr.txt | Contains a list of human-readable names of object classes to be excluded from change reports. | `Classname` For example: `exchangeAdminService` `msExchMessageDeliveryConfig` `Exchange_DSAccessDC` |
| omitpathlist_ecr.txt | Contains a list of AD paths to be excluded from change reports. | `Path` For example: `*\Microsoft Exchange System Objects\SystemMailbox*` |
| omitproplist_ecr.txt | Contains a list of object types and properties to be excluded from change reports. | `object_type.property_name` If there is no separator (.) between an object type and a property, the whole entry is treated as an object type. For example: `msExchSystemMailbox.*` `*.msExchEdgeSyncCredential` `*.msExchMailboxMoveTargetMDBLink` `*.adminDescription` |
-| omitreporterrors_ecr.txt | Contains a list of errors to be excluded from Activity Summaries. | `Error message text` For example, to omit the error “The HTTP service used by Public Folders is not available, possible causes are that Public stores are not mounted and the Information Store service is not running. ID no: c1030af3”, add `*c1030af3*` to the file. |
+| omitreporterrors_ecr.txt | Contains a list of errors to be excluded from Activity Summaries. | `Error message text` For example, to omit the error “The HTTP service used by Public Folders isn't available, possible causes are that Public stores aren't mounted and the Information Store service isn't running. ID no: c1030af3”, add `*c1030af3*` to the file. |
| omitstorelist_ecr.txt | Contains a list of classes and attributes names to be excluded from Exchange snapshots. | `object_type.property_name` If there is no separator (.) between an object type and a property, the whole entry is treated as an object type. For example: `Exchange_Server.AdministrativeGroup` `Exchange_Server.AdministrativeNote` `Exchange_Server.CreationTime` |
| propnames_ecr2007.txt | Contains a list of human-readable names for object classes and attributes of Exchange 2007 to be displayed in change reports. | `classname.attrname= intelligiblename` For example: `msExchMDBAvailabilityGroup= Database Availability Group` |
To exclude users or mailboxes from the Mailbox Access monitoring scope
-Auditor allows specifying users and mailboxes that you do not want to monitor for non-owner mailbox
+Auditor allows specifying users and mailboxes that you don't want to monitor for non-owner mailbox
access events. To do this, edit the mailboxestoexclude.txt, userstoexclude.txt, and
agentomitusers.txt files.
-Follow the steps to exclude data from Exchange Online monitoring scope
+To exclude data from Exchange Online monitoring scope
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Non-owner Mailbox Access
Reporter for Exchange_ folder.
@@ -57,7 +57,7 @@ specify mailboxes.
| File | Description | Syntax |
| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| mailboxestoexclude.txt | This file contains a list of mailboxes and folders that must be excluded from data collection. | Each entry must be a separate line. Wildcards (\*) can be used to replace any number of characters. - To exclude a certain user's mailbox, enter `username@domainname` , e.g.`john.smith@acme.com` - To exclude a certain folder, enter `username@domainname/foldername` , e.g. `john.smith@acme.com/Drafts ` - Use \*to exclude multiple mailboxes or folders, e.g. `*/foldername` will exclude the specified folder when processing all mailboxes. Examples: `*admin*@corp.com` `*/Drafts` - exclude _Drafts_ folder (for all mailboxes) `*/Testfolder/*` - exclude subfolders of _Testfolder_ (for all mailboxes) |
+| mailboxestoexclude.txt | This file contains a list of mailboxes and folders that must be excluded from data collection. | Each entry must be a separate line. Wildcards (\*) Use replace any number of characters. - To exclude a certain user's mailbox, enter `username@domainname` , e.g.`john.smith@acme.com` - To exclude a certain folder, enter `username@domainname/foldername` , e.g. `john.smith@acme.com/Drafts ` - Use \*to exclude multiple mailboxes or folders, e.g. `*/foldername` will exclude the specified folder when processing all mailboxes. Examples: `*admin*@corp.com` `*/Drafts` - exclude _Drafts_ folder (for all mailboxes) `*/Testfolder/*` - exclude subfolders of _Testfolder_ (for all mailboxes) |
| mailboxestoinclude.txt | This file contains a list of mailboxes that must be included when collecting data. For the mailboxes added to this list, the reports will contain only non-owner access events. | Specify email address to be included in the list as `username@domainname.` Example: `analyst@enterprise.com` |
| userstoexclude.txt | This file contains a list of users who must be excluded from reports if they perform non-owner access attempt for mailboxes (audit data on these users will still be stored in the state-in-time snapshots). If a user is removed from this list, the information on this user’s actions can be viewed with the Report Viewer. | `DOMAIN\username` |
| agentomitusers.txt | This file contains a list of users who must be excluded from reports and snapshots. If a user is removed from this list, audit data on this user will only be available after the next data collection. Writing new users to this file affects reports and snapshots only if Network traffic compression is enabled. | `DOMAIN\username` |
diff --git a/docs/auditor/10.8/admin/monitoringplans/exchangeonline/overview.md b/docs/auditor/10.8/admin/monitoringplans/exchangeonline/overview.md
index fcc8005c98..6e136fe81a 100644
--- a/docs/auditor/10.8/admin/monitoringplans/exchangeonline/overview.md
+++ b/docs/auditor/10.8/admin/monitoringplans/exchangeonline/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# Exchange Online
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
@@ -25,7 +25,7 @@ This instruction shows how to collect audit data from the Microsoft 365 tenant.
If you plan to use modern authentication, see the
[Configuring Microsoft Entra ID App for Auditing Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md#configuring-microsoft-entra-id-app-for-auditing-microsoft-entra-id)
topic for additional information on how to prepare Microsoft Entra ID app with required permissions.
-Make sure you have the following at hand:
+Ensure you have the following at hand:
- Tenant name
- For modern authentication: Application (client) ID
@@ -35,16 +35,16 @@ Make sure you have the following at hand:
Types of data that can be collected by Netwrix Auditor from the Microsoft 365 tenant depend on the
authentication option you choose.
-Follow the steps to configure Office 365 tenant as a monitored item.
+To configure Office 365 tenant as a monitored item.
**Step 1 –** On the **General** page of the item properties, specify **Tenant name**:
- If you are going to use **Basic authentication**, you can proceed to the next step – **Tenant
name** will be filled in automatically after it.
-- **NOTE:** Basic authentication is no longer possible for Exchange Online. For the already existing
- tenants it is still possible to use basic authentication for SharePoint Online and Microsoft Entra
- ID monitoring.
+:::note
+Basic authentication is no longer possible for Exchange Online. For the already existing tenants it is still possible to use basic authentication for SharePoint Online and Microsoft Entra ID monitoring.
+:::
- If you are going to use **Modern authentication**, paste the obtained name. See the
[Using Modern Authentication with Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md)
@@ -52,7 +52,7 @@ Follow the steps to configure Office 365 tenant as a monitored item.
-If you are using a government tenant, please click the **Tenant Environment** tab and select the
+If you are using a government tenant, click the **Tenant Environment** tab and select the
desired tenant environment.
**Step 2 –** Select authentication method that will be used when accessing Office 365 services:
@@ -63,7 +63,7 @@ desired tenant environment.
- Enter **User name** and **password**; use any of the following formats: _user@domain.com_ or
_user@domain.onmicrosoft.com_.
- The **Tenant name** field then will be filled in automatically.
- - Make sure this user account has sufficient access rights. See
+ - Ensure this user account has sufficient access rights. See
[Using Basic Authentication with Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/basicauth.md)
topic for additional information.
diff --git a/docs/auditor/10.8/admin/monitoringplans/exchangeonline/scope.md b/docs/auditor/10.8/admin/monitoringplans/exchangeonline/scope.md
index 0bc6cb9e14..a7fcfade5e 100644
--- a/docs/auditor/10.8/admin/monitoringplans/exchangeonline/scope.md
+++ b/docs/auditor/10.8/admin/monitoringplans/exchangeonline/scope.md
@@ -9,7 +9,7 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Exchange
Online monitoring scope.
-Follow the steps to exclude data from Exchange Online monitoring scope:
+To exclude data from Exchange Online monitoring scope:
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Exchange Online Auditing_
folder.
@@ -25,4 +25,4 @@ folder.
| omitlist.txt | The file contains a list of changes performed by cmdlets. To exclude a change from reports, search results and Activity Summaries, specify name of a cmdlet and the attribute that is changed by the selected cmdlet. | `cmdlet` For example: `Enable-OrganizationCustomization` `New-AdminAuditLogSearch` `New-MailboxAuditLogSearch` `cmdlet.param` For example: `*.Identity` `*.DomainController` `*.Organization` `*.IgnoreDefaultScope` `*.Force` `*.Confirm` `*.Password` `*-ManagementRoleEntry.Parameters` `Remove-PublicFolder.Recurse` |
| omitpathlist.txt | Contains a list of paths to be excluded from reports, search results and Activity Summaries. | `path` For example: `SystemMailbox{*}` `DiscoverySearchMailbox{*}` `FederatedEmail.*` You can use a wildcard (\*) to replace any number of characters in the path. |
| omituserlist.txt | Contains a list of user names to be excluded from reports, search results and Activity Summaries. | `domain\user` For example: `Enterprise\analyst` `email address` For example: `analyst@Enterprise.onmicrosoft.com` |
-| propnames.txt | Contains a list of human-readable names for object classes and their and their properties to be displayed in search results, reports and Activity Summaries. | `cmdletobject=friendlyname` `cmdlet.param=friendlyname` For example: `RoleGroupMember = Role Group` `UMHuntGroup = Unified Messaging Hunt Group` |
+| propnames.txt | Contains a list of human-readable names for object classes and their and their properties to be displayed in search results, reports, and Activity Summaries. | `cmdletobject=friendlyname` `cmdlet.param=friendlyname` For example: `RoleGroupMember = Role Group` `UMHuntGroup = Unified Messaging Hunt Group` |
diff --git a/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md b/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md
index cb9741be3f..e877643ccb 100644
--- a/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md
+++ b/docs/auditor/10.8/admin/monitoringplans/fileservers/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 90
# File Servers
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
@@ -42,7 +42,7 @@ To collect data from 32-bit operating systems, network traffic compression must
To collect data from Windows Failover Cluster, network traffic compression must be enabled.
- Configure audit settings – You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed.
-Do not select the checkbox if you want to configure audit settings manually. Some settings cannot be configured automatically. The product has the following limitations depending on your file server type
+Don't select the checkbox if you want to configure audit settings manually. Some settings can't be configured automatically. The product has the following limitations depending on your file server type
| File Server | SACL Check | SACL Adjust | Policy Check | Policy Adjust | Log Check | Log Adjust |
|-----------------------------------------|------------|-------------|--------------|---------------|-----------|------------|
@@ -55,7 +55,7 @@ Do not select the checkbox if you want to configure audit settings manually. Som
- Collect data for state-in-time reports – Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation.
When auditing file servers, changes to effective access permissions can be tracked in addition to audit permissions. By default, Combination of file and share permissions is tracked. File permissions define who has access to local files and folders. Share permissions provide or deny access to the same resources over the network. The combination of both determines the final access permissions for a shared folder—the more restrictive permissions are applied. Upon selecting Combination of file and share permissions only the resultant set will be written to the Audit Database. Select File permissions option too if you want to see difference between permissions applied locally and the effective file and share permissions set. To disable auditing of effective access, unselect all checkboxes under Include details on effective permissions.
-In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select day(s) of week you want your snapshot to be collected.
+In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select days of week you want your snapshot to be collected.
In the Manage historical snapshots section, you can click Manage and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past.
You must be assigned the Global administrator or the Global reviewer role to import snapshots.
Move the selected snapshots to the Snapshots available for reporting list using the arrow button.
@@ -63,11 +63,15 @@ The product updates the latest snapshot on the regular basis to keep users up to
- Users
-- Specify monitoring restrictions – Select the users to be excluded from search results, reports and Activity Summaries. To add users to the list, click Add and provide user name in the domain\user format: *mydomain\user1*.
+- Specify monitoring restrictions – Select the users to be excluded from search results, reports, and Activity Summaries. To add users to the list, click Add and provide user name in the domain\user format: *mydomain\user1*.
- Use NetBIOS domain name format.
- To exclude events containing “System” instead of initiator's account name in the “Who” column, enter "System" value to the list.
-In addition to the restrictions for a monitoring plan, you can use the *.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the *.txt files.
+In addition to the restrictions for a monitoring plan, you can use the *.txt files to collect more granular audit data.
+
+:::note
+The new monitoring scope restrictions apply together with previous exclusion settings configured in the *.txt files.
+:::
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the Data source list. As a next step, click Add item to specify an object for
@@ -89,7 +93,7 @@ shares (_D$, E$_), etc. will not be monitored. See the
[Add Items for Monitoring](/docs/auditor/10.8/admin/monitoringplans/datasources.md#add-items-for-monitoring) topic for additional
information.
-_Remember,_ before adding your monitored items, examine the considerations, limitations and
+_Remember,_ before adding your monitored items, examine the considerations, limitations, and
recommendations provided in the following sections:
- [DFS-Related Constraints](/docs/auditor/10.8/configuration/fileservers/windows/overview.md#dfs-related-constraints)
@@ -106,11 +110,11 @@ Complete the following fields:
| Option | Description |
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify Dell VNX/VNXe, Celerra or Unity storage array | Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
+| Specify Dell VNX/VNXe, Celerra, or Unity storage array | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Scope | |
| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. See the Fine-tune Monitoring Scope for additional information on how to narrow your monitoring scope. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. See the Fine-tune Monitoring Scope for additional information on how to narrow your monitoring scope. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
### Fine-tune Monitoring Scope
@@ -123,7 +127,7 @@ You can also create lists of specific file shares to include and/or exclude from
#### Include a File Share
-Follow the steps to include a file share.
+To include a file share.
**Step 1 –** Under Specify monitoring restrictions, select Specific file shares.
@@ -131,11 +135,11 @@ Follow the steps to include a file share.
**Step 3 –** Provide UNC path to a shared resource. For example: _NewStation\Shared._
-**Step 4 –** Do not specify a default file share mapped to a local drive (e.g., \\Server\e$).
+**Step 4 –** Don't specify a default file share mapped to a local drive (e.g., \\Server\e$).
#### Exclude Specific Data
-Follow the steps to exclude specific data.
+To exclude specific data.
Click Add Exclusion. Then, in the Specify Filters dialog, do the following:
@@ -144,18 +148,18 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
**Step 6 –** You can use a wildcard (\*) only if you need to exclude user activity on this file
-share. For other data types (_state-in-time_ or _all data_) wildcards are not supported. This refers
+share. For other data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers
to the specified shared folder, its subfolders and files.
**Step 7 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
-**Follow the steps to exclude specific user activity.**
+**To exclude specific user activity.**
**Step 1 –** Specify what user accounts should be excluded:
@@ -167,7 +171,7 @@ to the specified shared folder, its subfolders and files.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_.
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_.
@@ -187,7 +191,7 @@ Complete the following fields:
| File Share UNC path to audit logs | Path to the file share located on a Dell Isilon with event log files (e.g., _\\srv\netwrix_audit$\logs_). |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Scope | |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. See the Fine-tune Monitoring ScopeFine-tune Monitoring Scopetopic for additional information about how to narrow your monitoring scope. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. See the Fine-tune Monitoring ScopeFine-tune Monitoring Scopetopic for additional information about how to narrow your monitoring scope. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
### Configure the Scope
@@ -201,7 +205,7 @@ following for additional information:
### Add Inclusion
-Follow the steps to add inclusion.
+To add inclusion.
**Step 1 –** Under Specify monitoring restrictions, select Specific file shares.
@@ -209,11 +213,11 @@ Follow the steps to add inclusion.
**Step 3 –** Provide UNC path to a shared resource. For example: _NewStation\Shared._
-Do not specify a default file share mapped to a local drive (e.g., \\Server\e$).
+Don't specify a default file share mapped to a local drive (e.g., \\Server\e$).
### Add Exclusion
-Follow the steps to add exclusion.
+To add exclusion.
Click Add Exclusion. Then, in the Specify Filters dialog, do the following:
@@ -222,18 +226,18 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
**Step 5 –** You can use a wildcard (\*) only if you need to exclude user activity on this file
-share. For other data types (_state-in-time_ or _all data_) wildcards are not supported. This refers
+share. For other data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers
to the specified shared folder, its subfolders and files.
**Step 6 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
-**Follow the steps to exclude specific user activity.**
+**To exclude specific user activity.**
**Step 1 –** Specify what user accounts should be excluded:
@@ -245,7 +249,7 @@ to the specified shared folder, its subfolders and files.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_.
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_.
@@ -259,16 +263,16 @@ Complete the following fields:
| Option | Description |
| ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify NetApp file server | Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
+| Specify NetApp file server | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
| File share UNC path to audit logs | Select one of the following: - Detect automatically—If selected, a shared resource will be detected automatically. - Use this path—UNC path to the file share located on a NetApp Filer with event log files (e.g., _\\CORP\ETC$\log_). |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| ONTAPI/ONTAP REST API | |
| Specify protocol for accessing ONTAPI/ONTAP REST API | Select one of the following: - Detect automatically—If selected, a connection protocol will be detected automatically. - HTTP - HTTPS Refer to [Netwrix Auditor Installation and Configuration Guide](https://www.netwrix.com/download/documents/Netwrix_Auditor_Installation_Configuration_Guide.pdf) for detailed instructions on how to enable HTTP or HTTPS admin access. NOTE: ONTAP REST API works only over HTTPS protocol |
-| Specify management interface | Select management interface to connect to ONTAPI/ONTAP REST API. If you want to use custom management interface for ONTAPI/ONTAP REST API, select Custom and provide a server name by entering its FQDN, NETBIOS or IP address. |
+| Specify management interface | Select management interface to connect to ONTAPI/ONTAP REST API. If you want to use custom management interface for ONTAPI/ONTAP REST API, select Custom and provide a server name by entering its FQDN, NETBIOS, or IP address. |
| Specify account for connecting to ONTAPI/ONTAP REST API | Select an account to connect to NetApp and collect data through ONTAPI/ONTAP REST API. If you want to use a specific account (other than the one you specified on the General tab), select **Custom** and enter credentials. The credentials are case sensitive. Take into consideration that even if a custom account is specified, the account selected on the General tab must be a member of the Builtin\Administrators group and have sufficient permissions to access audit logs shared folder and audited shares. [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) |
| Scope | |
-| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. **CAUTION:** Monitoring of non-default hidden shares is not supported for NetApp servers in 7-mode. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. Configure Scope how to narrow your monitoring scope. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
+| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. **CAUTION:** Monitoring of non-default hidden shares isn't supported for NetApp servers in 7-mode. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. Configure Scope how to narrow your monitoring scope. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
### Configure Scope
@@ -279,7 +283,7 @@ following for additional information:
### Add Inclusion
-Follow the steps to add inclusion.
+To add inclusion.
**Step 1 –** Under Specify monitoring restrictions, select Specific file shares.
@@ -287,11 +291,13 @@ Follow the steps to add inclusion.
**Step 3 –** Provide UNC path to a shared resource. For example: _NewStation\Shared._
-NOTE: Do not specify a default file share mapped to a local drive (e.g., \\Server\e$).
+:::note
+Don't specify a default file share mapped to a local drive (e.g., \\Server\e$).
+:::
### Add Exclusion
-Follow the steps to add exclusion.
+To add exclusion.
Click Add Exclusion. Then, in the Specify Filters dialog, do the following:
@@ -300,18 +306,18 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
**Step 5 –** You can use a wildcard (\*) only if you need to exclude user activity on this file
-share. For other data types (_state-in-time_ or _all data_) wildcards are not supported. This refers
+share. For other data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers
to the specified shared folder, its subfolders and files.
**Step 6 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
-**Follow the steps to exclude specific user activity.**
+**To exclude specific user activity.**
**Step 1 –** Specify what user accounts should be excluded:
@@ -323,7 +329,7 @@ to the specified shared folder, its subfolders and files.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_.
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_.
@@ -332,7 +338,7 @@ settings.
## Nutanix Files
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
@@ -359,11 +365,11 @@ Actions reported by Auditor vary depending on the file server type and the audit
- Specify data collection method – You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance.
-- Configure audit settings – You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. See the [Supported Data Sources](/docs/auditor/10.8/requirements/supporteddatasources/supporteddatasources.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. Netwrix Auditor can configure the following settings:
+- Configure audit settings – You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [Supported Data Sources](/docs/auditor/10.8/requirements/supporteddatasources/supporteddatasources.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. Netwrix Auditor can configure the following settings:
- Policy Check
- Policy Adjust
-- Collect data for state-in-time reports – Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.8/admin/reports/types/stateintime/overview.md) topic for additional information. When auditing file servers, changes to effective access permissions can be tracked in addition to audit permissions. By default, Combination of file and share permissions is tracked. File permissions define who has access to local files and folders. Share permissions provide or deny access to the same resources over the network. The combination of both determines the final access permissions for a shared folder—the more restrictive permissions are applied. Upon selecting Combination of file and share permissions only the resultant set will be written to the Audit Database. Select File permissions option too if you want to see difference between permissions applied locally and the effective file and share permissions set. To disable auditing of effective access, unselect all checkboxes under Include details on effective permissions. In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select day(s) of week you want your snapshot to be collected. In the Manage historical snapshots section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must be assigned the Global administrator or the Global reviewer role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot on the regular basis to keep users up to date on actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database.
+- Collect data for state-in-time reports – Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.8/admin/reports/types/stateintime/overview.md) topic for additional information. When auditing file servers, changes to effective access permissions can be tracked in addition to audit permissions. By default, Combination of file and share permissions is tracked. File permissions define who has access to local files and folders. Share permissions provide or deny access to the same resources over the network. The combination of both determines the final access permissions for a shared folder—the more restrictive permissions are applied. Upon selecting Combination of file and share permissions only the resultant set will be written to the Audit Database. Select File permissions option too if you want to see difference between permissions applied locally and the effective file and share permissions set. To disable auditing of effective access, unselect all checkboxes under Include details on effective permissions. In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select days of week you want your snapshot to be collected. In the Manage historical snapshots section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must be assigned the Global administrator or the Global reviewer role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot on the regular basis to keep users up to date on actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database.
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the **Data source** list. As a next step, click **Add item** to specify an
@@ -376,14 +382,14 @@ Complete the following fields:
| Option | Description |
| -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **General** | |
-| Specify Nutanix File Server | Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. If you need to audit a 3-node cluster, it is recommended to use FQDN or NETBIOS name. |
+| Specify Nutanix File Server | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. If you need to audit a 3-node cluster, it is recommended to use FQDN or NETBIOS name. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for more information. |
-| Specify listening port for incoming connections | Provide the name of the TCP port to listen to notifications on the operations with Nutanix file shares. Default is **9898**. For details on how to open the port, refer to the [Nutanix Ports](/docs/auditor/10.8/configuration/fileservers/nutanix/ports.md) topic. |
+| Specify listening port for incoming connections | Provide the name of the TCP port to listen to notifications on the operations with Nutanix file shares. Default is **9898**. For details on how to open the port, see [Nutanix Ports](/docs/auditor/10.8/configuration/fileservers/nutanix/ports.md) topic. |
| **Nutanix File Server REST API** | |
| Specify account for connecting to Nutanix File Server REST API | Specify the account that will be used to connect to Nutanix REST API. This account should have sufficient privileges on the Nutanix File Server. For details, refer to [Create User Account to Access Nutanix REST API](/docs/auditor/10.8/configuration/fileservers/nutanix/useraccount.md). |
| **Scope** | |
| Monitor hidden shares | By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. Refer to Configure Scope for detailed instructions on how to configure your monitoring scope. Currently, auditing is available for SMB shares only. Auditing of NFS shares is not supported due to known limitations. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. Refer to Configure Scope for detailed instructions on how to configure your monitoring scope. auditing is available for SMB shares only. Auditing of NFS shares isn't supported due to known limitations. |
### Configure Scope
@@ -394,7 +400,7 @@ following for additional information:
### Add Inclusion
-Follow the steps to add inclusion.
+To add inclusion.
**Step 1 –** Under Specify monitoring restrictions, select Specific file shares.
@@ -402,11 +408,11 @@ Follow the steps to add inclusion.
**Step 3 –** Provide UNC path to a shared resource. For example: _NewStation\Shared._
-Do not specify a default file share mapped to a local drive (e.g., \\Server\e$).
+Don't specify a default file share mapped to a local drive (e.g., \\Server\e$).
### Add Exclusion
-Follow the steps to add exclusion.
+To add exclusion.
Click Add Exclusion. Then, in the Specify Filters dialog, do the following:
@@ -415,18 +421,18 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
**Step 5 –** You can use a wildcard (\*) only if you need to exclude user activity on this file
-share. For other data types (_state-in-time_ or _all data_) wildcards are not supported. This refers
+share. For other data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers
to the specified shared folder, its subfolders and files.
**Step 6 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
-**Follow the steps to exclude specific user activity.**
+**To exclude specific user activity.**
**Step 1 –** Specify what user accounts should be excluded:
@@ -438,7 +444,7 @@ to the specified shared folder, its subfolders and files.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_.
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_.
@@ -452,13 +458,13 @@ Complete the following fields:
| Option | Description |
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| General | |
-| Specify a file server | Provide UNC path to a file server. See the section below for special considerations. Do not specify a default file share mapped to a local drive (e.g., \\Server\e$). |
+| Specify a file server | Provide UNC path to a file server. See the section below for special considerations. Don't specify a default file share mapped to a local drive (e.g., \\Server\e$). |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Event Collection | |
| Specify a host or network resource | Provide UNC path to a file server or an IP range of servers you want to get activity events from. You can select to collect event data from the same server or provide a custom server or IP range. |
| Specify port and protocol for incoming connections | Use **Port** and **Protocol** to provide the port required for incoming connections (default is **UDP port 514**). |
| Scope | |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. |
## Synology
@@ -467,10 +473,10 @@ Complete the following fields:
| Option | Description |
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| General | |
-| Specify a file server | Provide UNC path to a file server. See the section below for special considerations. Do not specify a default file share mapped to a local drive (e.g., \\Server\e$). |
+| Specify a file server | Provide UNC path to a file server. See the section below for special considerations. Don't specify a default file share mapped to a local drive (e.g., \\Server\e$). |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Event Collection | |
| Specify a host or network resource | Provide UNC path to a file server or an IP range of servers you want to get activity events from. You can select to collect event data from the same server or provide a custom server or IP range. |
| Specify port and protocol for incoming connections | Use **Port** and **Protocol** to provide the port required for incoming connections (default is **UDP port 514**). |
| Scope | |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. |
diff --git a/docs/auditor/10.8/admin/monitoringplans/fileservers/scope.md b/docs/auditor/10.8/admin/monitoringplans/fileservers/scope.md
index a2e3350fb4..522db3c4a7 100644
--- a/docs/auditor/10.8/admin/monitoringplans/fileservers/scope.md
+++ b/docs/auditor/10.8/admin/monitoringplans/fileservers/scope.md
@@ -19,7 +19,7 @@ lists), as explained below.
Monitoring scope restrictions set up in the UI will apply together with the exclusion settings
configured in the \*.txt files.
-**Follow the steps to exclude data from file server monitoring scope:**
+**To exclude data from file server monitoring scope:**
**Step 1 –** Navigate to the "_%Netwrix Auditor installation folder%\File Server Auditing_" folder.
@@ -31,10 +31,10 @@ configured in the \*.txt files.
| File | Description | Syntax |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| omitcollectlist.txt | Contains a list of objects to be excluded from being monitored. | `Monitoring plan name,server name, resource path` Wildcards are not supported for the Server Name field. To disable filtering for this field, specify an empty string. For example: `*,,\\\\*\\System Volume Information*` |
+| omitcollectlist.txt | Contains a list of objects to be excluded from being monitored. | `Monitoring plan name,server name, resource path` Wildcards aren't supported for the Server Name field. To disable filtering for this field, specify an empty string. For example: `*,,\\\\*\\System Volume Information*` |
| omiterrors.txt | Contains a list of errors and warnings to be omitted from logging to the Netwrix Auditor System Health event log. | `Monitoring plan name,server name,error text` For example: `*,productionserver1.corp.local, *Access is denied*` |
-| omitreportlist.txt | Contains a list of objects to be excluded from _Search_, _Reports_ and "_Activity Summary_". In this case audit data is still being collected. | `Monitoring plan name,action,who,object type,resource path,property name` Wildcards are not supported for the action and property name fields. To disable filtering for these fields, specify an empty string. For example: `*,,CORP\\jsmith,*,*,` |
-| omitstorelist.txt | Contains a list of objects to be excluded from being stored to the "_Audit Archive_" and showing up in _Search_ and all types of _Reports_. In this case audit data is still being collected. | `Monitoring plan name,action,who ,object type,resource path,property name` Wildcards are not supported for the Change Type and Property Name fields. To disable filtering for these fields, specify an empty string. For example: `*,,*,*,\\\\productionserver1.corp.local\\builds\\*, Attributes` |
+| omitreportlist.txt | Contains a list of objects to be excluded from _Search_, _Reports_, and "_Activity Summary_". In this case audit data is still being collected. | `Monitoring plan name,action,who,object type,resource path,property name` Wildcards aren't supported for the action and property name fields. To disable filtering for these fields, specify an empty string. For example: `*,,CORP\\jsmith,*,*,` |
+| omitstorelist.txt | Contains a list of objects to be excluded from being stored to the "_Audit Archive_" and showing up in _Search_ and all types of _Reports_. In this case audit data is still being collected. | `Monitoring plan name,action,who ,object type,resource path,property name` Wildcards aren't supported for the Change Type and Property Name fields. To disable filtering for these fields, specify an empty string. For example: `*,,*,*,\\\\productionserver1.corp.local\\builds\\*, Attributes` |
| omitstoreprocesslist.txt | Contains a list of processes to be excluded from being stored to the "_Audit Archive_" and showing up in _Search_ and all types of _Reports_. | `Monitoring plan name,resource path, executable path` Only local applications can be excluded. For example: `*,*,*notepad.exe` |
## Windows File Share
@@ -44,7 +44,7 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| General | |
-| Specify Windows file share | Provide UNC path to a shared resource. See the section below for special considerations. Do not specify a default file share mapped to a local drive (e.g., \\Server\e$). |
+| Specify Windows file share | Provide UNC path to a shared resource. See the section below for special considerations. Don't specify a default file share mapped to a local drive (e.g., \\Server\e$). |
| Specify the account for collecting data | |
| Scope | |
| Specify monitoring restrictions | Refer to Configure Scope for detailed instructions on how to narrow your monitoring scope. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. |
@@ -60,18 +60,18 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
**Step 4 –** You can use a wildcard (\*) only if you need to exclude user activity on this file
-share. For other data types (_state-in-time_ or _all data_) wildcards are not supported. This refers
+share. For other data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers
to the specified shared folder, its subfolders and files.
**Step 5 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| **State-in-Time** | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| **State-in-Time** | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
-**Follow the steps to exclude specific user activity.**
+**To exclude specific user activity.**
**Step 1 –** Specify what user accounts should be excluded:
@@ -83,7 +83,7 @@ to the specified shared folder, its subfolders and files.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_.
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_.
diff --git a/docs/auditor/10.8/admin/monitoringplans/fileservers/windowsfileserver.md b/docs/auditor/10.8/admin/monitoringplans/fileservers/windowsfileserver.md
index daef83a007..a902275928 100644
--- a/docs/auditor/10.8/admin/monitoringplans/fileservers/windowsfileserver.md
+++ b/docs/auditor/10.8/admin/monitoringplans/fileservers/windowsfileserver.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Windows File Server
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
@@ -22,10 +22,10 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify Windows file share | Provide UNC path to a shared resource. See the section below for special considerations. Do not specify a default file share mapped to a local drive (e.g., \\Server\e$). |
+| Specify Windows file share | Provide UNC path to a shared resource. See the section below for special considerations. Don't specify a default file share mapped to a local drive (e.g., \\Server\e$). |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. Starting with version 10.7, you can implement the integration between Netwrix Auditor and Netwrix Privilege Secure. See the [Netwrix Privilege Secure](/docs/auditor/10.8/admin/settings/privilegesecure.md) topic for additional information. |
| Scope | |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. See the Configure Scope topic for additional information on how to narrow your monitoring scope. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. See the Configure Scope topic for additional information on how to narrow your monitoring scope. By default, Netwrix Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). If you want to monitor user-defined hidden shares, select the related option in the monitored item settings. Remember that administrative hidden shares like default system root or Windows directory (ADMIN$), default drive shares (D$, E$), etc. will not be monitored. See the topics on the monitored items for details. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
### Configure Scope
@@ -38,18 +38,18 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
**Step 2 –** You can use a wildcard (\*) only if you need to exclude user activity on this file
-share. For other data types (_state-in-time_ or _all data_) wildcards are not supported. This refers
+share. For other data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers
to the specified shared folder, its subfolders and files.
**Step 3 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. **NOTE:** In this case,Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| State-in-Time | Select to configure Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. **NOTE:** In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
-**Follow the steps to exclude specific user activity.**
+**To exclude specific user activity.**
**Step 1 –** Specify what user accounts should be excluded:
@@ -61,7 +61,7 @@ to the specified shared folder, its subfolders and files.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_.
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_.
@@ -101,11 +101,11 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify AD container | Specify a whole AD domain, OU or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you do not want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers does not include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
+| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. Starting with version 10.7, you can implement the integration between Netwrix Auditor and Netwrix Privilege Secure. See the [Netwrix Privilege Secure](/docs/auditor/10.8/admin/settings/privilegesecure.md) topic for additional information. Refer to the [Permissions for Active Directory Auditing](/docs/auditor/10.8/configuration/activedirectory/permissions.md) topic for more information on using Netwrix Privilege Secure as an account for data collection. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Containers and Computers | |
| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU or container. - Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) are not supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU, or container. - Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) aren't supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
## IP Range
@@ -122,7 +122,7 @@ Complete the following fields:
## Computer
For evaluation purposes, Netwrix recommends selecting Computer as an item for a monitoring plan.
-Once the product is configured to collect data from the specified items, audit settings (including
+After the product is configured to collect data from the specified items, audit settings (including
Core and Compression services installation) will be applied to all computers within AD Container or
IP Range.
@@ -131,11 +131,11 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| General | |
-| Specify a computer | Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
+| Specify a computer | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select account type you want to use and enter credentials. The following choices are available: - User/password. The account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. - Group Managed Service Account (gMSA). You should specify only the account name in the domain\account$ format. See the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.8/requirements/gmsa.md) topic for additional information. - Netwrix Privilege Secure. Starting with version 10.7, you can implement the integration between Netwrix Auditor and Netwrix Privilege Secure. See the [Netwrix Privilege Secure](/docs/auditor/10.8/admin/settings/privilegesecure.md) topic for additional information. |
| Scope | |
| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. |
### Configure Scope
@@ -152,18 +152,18 @@ the path format as it appears in the "_What_" column of reports and Activity Sum
example, _\\corpsrv\shared_.
You can use a wildcard (\*) only if you need to exclude user activity on this file share. For other
-data types (_state-in-time_ or _all data_) wildcards are not supported. This refers to the specified
+data types (_state-in-time_ or _all data_) wildcards aren't supported. This refers to the specified
shared folder, its subfolders and files.
**Step 2 –** Select what type of data you want to exclude:
| Option | Description | Example |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. In this case,Netwrix Auditor does not adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he does not have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
-| State-in-Time | Select to configure Netwrix Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he does not want Netwrix Auditor to collect state-in-time data for this folder. |
-| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he does not want to collect _Read_ operations. |
+| **All Data** | Select if you want to completely exclude the specified file share from being audited. The product will not collect any user activity or state-in-time data. In this case,Netwrix Auditor doesn't adjust audit settings automatically for the selected folders. | A Security Officer wants to monitor a file share but s/he doesn't have access to a certain folder on this share. Thus, s/he configures the product not to monitor this folder at all. |
+| State-in-Time | Select to configure Netwrix Auditor to exclude data for the state-in-time reports from the monitoring scope. | A Security Officer wants to monitor a file share, but it contains a folder with a huge amount of objects, so s/he doesn't want Netwrix Auditor to collect state-in-time data for this folder. |
+| **User Activity** | Select to exclude actions performed by specific users on the selected file share. See the procedure below for details. In this case, the product still collects stat-in-time data for this share. | A Security Officer wants to monitor a file share that contains a public folder for which s/he doesn't want to collect _Read_ operations. |
-Follow the steps to exclude specific user activity.
+To exclude specific user activity.
**Step 1 –** Specify what user accounts should be excluded:
@@ -175,7 +175,7 @@ Follow the steps to exclude specific user activity.
**Step 2 –** Specify what actions should be excluded:
- All actions — Exclude all actions of the selected users
-- These actions — Use the drop-down list to select the actions to exclude, e.g. _Added_ and _Moved_
+- These actions — Use the dropdown list to select the actions to exclude, e.g. _Added_ and _Moved_
@@ -190,9 +190,9 @@ integration and supported data sources. In this case, the credentials will not b
Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring
password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
+To use Netwrix Privilege Secure as an account for data collection.
-**Step 1 –** Select the desired item.
+**Step 1 –** Select the item you want.
**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
collection.
@@ -202,7 +202,7 @@ collection.
**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
Credential-based is the default option. Refer to the
[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+documentation to Access Policies documentation.
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
@@ -213,7 +213,7 @@ sources.
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.8/admin/monitoringplans/finetune.md b/docs/auditor/10.8/admin/monitoringplans/finetune.md
index 3ee49bf2a1..2439a575bc 100644
--- a/docs/auditor/10.8/admin/monitoringplans/finetune.md
+++ b/docs/auditor/10.8/admin/monitoringplans/finetune.md
@@ -6,7 +6,7 @@ sidebar_position: 210
# Fine-Tune Your Plan and Edit Settings
-At any time, you can review your plan settings and fine-tune Audit Database, notification and data
+At any time, you can review your plan settings and fine-tune Audit Database, notification, and data
collection settings.
To modify most plan settings, you must be assigned the Global administrator role in the product or
@@ -14,7 +14,7 @@ the Configurator role on the plan. The Global reviewer or this plan's Reviewer c
Summary recipients. See the [Role-Based Access and Delegation](/docs/auditor/10.8/admin/monitoringplans/delegation.md) topic for additional
information.
-Follow the steps to edit your plan settings:
+To edit your plan settings:
**Step 1 –** Select a plan in the All Monitoring Plans list and click Edit.
@@ -27,11 +27,11 @@ Follow the steps to edit your plan settings:
| General | |
| Name Description | Update a plan name or its description. |
| Data Collection | |
-| Specify the account for collecting data - Not specified - User/Password - gMSA | Specify a new user name and a password for the account that Auditor will use to collect data. Make sure the account has sufficient permissions to collect data. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information about the rights and permissions, and instructions on how to configure them. |
+| Specify the account for collecting data - Not specified - User/Password - gMSA | Specify a new user name and a password for the account that Auditor will use to collect data. Ensure the account has sufficient permissions to collect data. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information about the rights and permissions, and instructions on how to configure them. |
| Audit Database | |
| Disable security intelligence and make data available only in activity summaries | Keep this checkbox cleared if you want Auditor to write data to the Audit Database. |
| Use default SQL Server settings | Select this checkbox to write data to a SQL Server instance with connection parameters as shown in **Settings** > **Audit Database**. See the [Audit Database](/docs/auditor/10.8/admin/settings/auditdatabase.md) topic for additional information. |
-| Specify custom connection parameters | Specify this option to use non-default settings (e.g., use a different authentication method or user). Make sure to store data on the same SQL Server instance. Otherwise some data may become unavailable for search and reporting. |
+| Specify custom connection parameters | Specify this option to use non-default settings (e.g., use a different authentication method or user). Ensure to store data on the same SQL Server instance. Otherwise some data may become unavailable for search and reporting. |
| Notifications | |
| Specify Activity Summary delivery schedule | Configure how often you want to receive an Activity Summary. By default, it is delivered once a day, at 3 AM. You can specify custom delivery time and frequency (e.g., every 6 hours starting 12 AM — at 12 AM, 6 AM, 12 PM, 6 PM). |
| Customize notifications | By default, Activity Summary lists changes and activity in email body. For most data sources, if an Activity Summaries contains more than 1,000 activity records, these records are sent as a CSV attachment, bigger attachments are compressed in ZIP files. - Attach Activity Summary as a CSV file — You can configure Auditor to always send emails with attachments instead of listing activity and changes in email body. - Compress attachment before sending — You can configure Auditor to always compress attachments in a ZIP file, irrespective of its size and number of activity records. |
diff --git a/docs/auditor/10.8/admin/monitoringplans/grouppolicy/overview.md b/docs/auditor/10.8/admin/monitoringplans/grouppolicy/overview.md
index ffd93a0125..d11b8f03e9 100644
--- a/docs/auditor/10.8/admin/monitoringplans/grouppolicy/overview.md
+++ b/docs/auditor/10.8/admin/monitoringplans/grouppolicy/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 100
# Group Policy
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
@@ -26,7 +26,7 @@ Complete the following fields:
| Prerequisites | Netwrix Auditor will automatically look up additional system components and prompt you to install those that are missing. In case all required components have been already installed, this section will be omitted. See the [Other Components](/docs/auditor/10.8/requirements/software.md#other-components) topic for additional information. |
| Detect additional details | Specify additional information to include in reports and activity summaries. Select Group membership if you want to include Group membership of the account under which the change was made. |
| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
-| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. See the [Group Policy](/docs/auditor/10.8/configuration/grouppolicy/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
+| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [Group Policy](/docs/auditor/10.8/configuration/grouppolicy/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the **Data source** list. As a next step, click **Add item** to specify an
@@ -52,9 +52,9 @@ integration and supported data sources. In this case, the credentials will not b
Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring
password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
+To use Netwrix Privilege Secure as an account for data collection.
-**Step 1 –** Select the desired item.
+**Step 1 –** Select the item you want.
**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
collection.
@@ -64,7 +64,7 @@ collection.
**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
Credential-based is the default option. Refer to the
[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+documentation to Access Policies documentation.
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
@@ -75,7 +75,7 @@ sources.
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.8/admin/monitoringplans/grouppolicy/scope.md b/docs/auditor/10.8/admin/monitoringplans/grouppolicy/scope.md
index 599368ba01..233e8a1729 100644
--- a/docs/auditor/10.8/admin/monitoringplans/grouppolicy/scope.md
+++ b/docs/auditor/10.8/admin/monitoringplans/grouppolicy/scope.md
@@ -10,7 +10,7 @@ You can fine-tune Netwrix Auditor by specifying data that you want to exclude fr
monitoring scope. To do it, edit the omitobjlist_gp.txt, omitproplist_gp.txt and omituserlist_gp.txt
files.
-Follow the steps to exclude data from the Group Policy monitoring scope:
+To exclude data from the Group Policy monitoring scope:
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Active Directory Auditing_
folder.
diff --git a/docs/auditor/10.8/admin/monitoringplans/logonactivity/overview.md b/docs/auditor/10.8/admin/monitoringplans/logonactivity/overview.md
index ef55f3d07a..f4f982f6df 100644
--- a/docs/auditor/10.8/admin/monitoringplans/logonactivity/overview.md
+++ b/docs/auditor/10.8/admin/monitoringplans/logonactivity/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# Logon Activity
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
@@ -26,9 +26,9 @@ Complete the following fields:
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
| Fine-tune logon activity monitoring | Specify interval for Netwrix Auditor to collect data on logon activity and add successful non-interactive logons to your auditing scope, if necessary. |
| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
-| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. See the [Logon Activity](/docs/auditor/10.8/configuration/logonactivity/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
+| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [Logon Activity](/docs/auditor/10.8/configuration/logonactivity/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
| Users | |
-| Specify monitoring restrictions | Select the users to be excluded from search results, reports and Activity Summaries. To add users to the list, click Add. Then, provide the user name in the domain\user format. For example: _mydomain\user1_. Consider the following: - Use NetBIOS domain name format. - You can provide the "_System_" value to exclude events containing the “_System_” instead of an account name in the “_Who_” column. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Select the users to be excluded from search results, reports, and Activity Summaries. To add users to the list, click Add. Then, provide the user name in the domain\user format. For example: _mydomain\user1_. Consider the following: - Use NetBIOS domain name format. - You can provide the "_System_" value to exclude events containing the “_System_” instead of an account name in the “_Who_” column. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the **Data source** list. As a next step, click **Add item** to specify an
@@ -54,9 +54,9 @@ integration and supported data sources. In this case, the credentials will not b
Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring
password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
+To use Netwrix Privilege Secure as an account for data collection.
-**Step 1 –** Select the desired item.
+**Step 1 –** Select the item you want.
**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
collection.
@@ -66,7 +66,7 @@ collection.
**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
Credential-based is the default option. Refer to the
[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+documentation to Access Policies documentation.
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
@@ -77,7 +77,7 @@ sources.
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.8/admin/monitoringplans/logonactivity/scope.md b/docs/auditor/10.8/admin/monitoringplans/logonactivity/scope.md
index 24f06abb21..6d00df4959 100644
--- a/docs/auditor/10.8/admin/monitoringplans/logonactivity/scope.md
+++ b/docs/auditor/10.8/admin/monitoringplans/logonactivity/scope.md
@@ -9,7 +9,7 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Logon
Activity monitoring scope.
-Follow the steps to exclude data from the Logon Activity monitoring scope:
+To exclude data from the Logon Activity monitoring scope:
**Step 1 –** Navigate to the _%working folder%\\NLA\Settings_ folder and locate your monitoring plan
GUID.
diff --git a/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/overview.md b/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/overview.md
index 2f7f7a72f9..33f5bf8315 100644
--- a/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/overview.md
+++ b/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# Microsoft Entra ID
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
@@ -54,7 +54,7 @@ This instruction shows how to collect audit data from the Microsoft 365 tenant.
If you plan to use modern authentication, see the
[Configuring Microsoft Entra ID App for Auditing Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md#configuring-microsoft-entra-id-app-for-auditing-microsoft-entra-id)
topic for additional information on how to prepare Microsoft Entra ID app with required permissions.
-Make sure you have the following at hand:
+Ensure you have the following at hand:
- Tenant name
- For modern authentication: Application (client) ID
@@ -64,16 +64,16 @@ Make sure you have the following at hand:
Types of data that can be collected by Netwrix Auditor from the Microsoft 365 tenant depend on the
authentication option you choose.
-Follow the steps to configure Office 365 tenant as a monitored item.
+To configure Office 365 tenant as a monitored item.
**Step 1 –** On the **General** page of the item properties, specify **Tenant name**:
- If you are going to use **Basic authentication**, you can proceed to the next step – **Tenant
name** will be filled in automatically after it.
-- **NOTE:** Basic authentication is no longer possible for Exchange Online. For the already existing
- tenants it is still possible to use basic authentication for SharePoint Online and Microsoft Entra
- ID monitoring.
+:::note
+Basic authentication is no longer possible for Exchange Online. For the already existing tenants it is still possible to use basic authentication for SharePoint Online and Microsoft Entra ID monitoring.
+:::
- If you are going to use **Modern authentication**, paste the obtained name. See the
[Using Modern Authentication with Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md)
@@ -81,7 +81,7 @@ Follow the steps to configure Office 365 tenant as a monitored item.
-If you are using a government tenant, please click the **Tenant Environment** tab and select the
+If you are using a government tenant, click the **Tenant Environment** tab and select the
desired tenant environment.
**Step 2 –** Select authentication method that will be used when accessing Office 365 services:
@@ -92,7 +92,7 @@ desired tenant environment.
- Enter **User name** and **password**; use any of the following formats: _user@domain.com_ or
_user@domain.onmicrosoft.com_.
- The **Tenant name** field then will be filled in automatically.
- - Make sure this user account has sufficient access rights. See
+ - Ensure this user account has sufficient access rights. See
[Using Basic Authentication with Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/basicauth.md)
topic for additional information.
@@ -132,9 +132,9 @@ integration and supported data sources. In this case, the credentials will not b
Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring
password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
+To use Netwrix Privilege Secure as an account for data collection.
-**Step 1 –** Select the desired item.
+**Step 1 –** Select the item you want.
**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
collection.
@@ -144,7 +144,7 @@ collection.
**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
Credential-based is the default option. Refer to the
[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+documentation to Access Policies documentation.
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
@@ -155,7 +155,7 @@ sources.
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/scope.md b/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/scope.md
index d3c17bb8b8..3ca68512b5 100644
--- a/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/scope.md
+++ b/docs/auditor/10.8/admin/monitoringplans/microsoftentraid/scope.md
@@ -9,7 +9,7 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Microsoft
Entra ID (formerly Azure AD) monitoring scope or modify the way it will be displayed.
-Follow the steps to exclude data from the Microsoft Entra ID monitoring scope:
+To exclude data from the Microsoft Entra ID monitoring scope:
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Azure AD Auditing_ folder.
@@ -21,11 +21,11 @@ Follow the steps to exclude data from the Microsoft Entra ID monitoring scope:
| File | Description | Syntax |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
-| adomiteventuserlist.txt | Contains a list of users whose user names you want to exclude from Microsoft Entra ID search results, reports and Activity Summaries. The rest of change details (action, object type, etc.) will be reported, but the Who value will be "system". | user@tenant.com |
-| exomiteventuserlist.txt | Contains a list of Exchange whose user names you want to exclude from Microsoft Entra ID search results, reports and Activity Summaries. The rest of change details (action, object type, etc.) will be reported, but the Who value will be "system". This list omits changes made by users through Exchange admin center. | user@tenant.com |
+| adomiteventuserlist.txt | Contains a list of users whose user names you want to exclude from Microsoft Entra ID search results, reports, and Activity Summaries. The rest of change details (action, object type, etc.) will be reported, but the Who value will be "system". | user@tenant.com |
+| exomiteventuserlist.txt | Contains a list of Exchange whose user names you want to exclude from Microsoft Entra ID search results, reports, and Activity Summaries. The rest of change details (action, object type, etc.) will be reported, but the Who value will be "system". This list omits changes made by users through Exchange admin center. | user@tenant.com |
| maapioperationtypes.txt | Contains an overall list of object types that will be displayed in search results, reports, and Activity Summaries for each particular operation. By default, the list contains mapping for the most frequent operations (e.g., add user, update policy, remove member). The rest will be reported with Microsoft Entra ID object type. | operation = object type For example: add owner to group = Group |
-| omitproplist.txt | Contains a list of object classes and attributes to be excluded from Microsoft Entra ID search results, reports and Activity Summaries. | classname.attrname If there is no full stop, the entire line is considered a class name. |
-| omitUPNlist.txt | Specify the user principal name for objects you want to exclude from Microsoft Entra ID search results, licenses, reports and SITs. | user@tenant.com **NOTE:** Wildcard \* is supported and can replace any number of characters. |
+| omitproplist.txt | Contains a list of object classes and attributes to be excluded from Microsoft Entra ID search results, reports, and Activity Summaries. | classname.attrname If there is no full stop, the entire line is considered a class name. |
+| omitUPNlist.txt | Specify the user principal name for objects you want to exclude from Microsoft Entra ID search results, licenses, reports, and SITs. | user@tenant.com **NOTE:** Wildcard \* is supported and can replace any number of characters. |
| omituserlist.txt | Contains a list of users you want to exclude from Microsoft Entra ID search results, Microsoft Entra ID Changes reports and Activity Summaries. | user@tenant.com |
| propnames.txt | Contains a list of human-readable names for object types and attributes to be displayed in search results, reports, and Activity Summaries. | object=friendlyname object.property=friendlyname For example: \*.PasswordChanged = Password Changed |
| proptypes.txt | Defines how values will be displayed in the Details columns in Microsoft Entra ID search results, reports, and Activity Summaries. | For example: \*.Role.DisplayName = MultiValued |
diff --git a/docs/auditor/10.8/admin/monitoringplans/msteams.md b/docs/auditor/10.8/admin/monitoringplans/msteams.md
index 9b5c5ca775..f52f414197 100644
--- a/docs/auditor/10.8/admin/monitoringplans/msteams.md
+++ b/docs/auditor/10.8/admin/monitoringplans/msteams.md
@@ -6,7 +6,7 @@ sidebar_position: 120
# MS Teams
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data collection
@@ -25,7 +25,7 @@ This instruction shows how to collect audit data from the Microsoft 365 tenant.
If you plan to use modern authentication, see the
[Configuring Microsoft Entra ID App for Auditing Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md#configuring-microsoft-entra-id-app-for-auditing-microsoft-entra-id)
topic for additional information on how to prepare Microsoft Entra ID app with required permissions.
-Make sure you have the following at hand:
+Ensure you have the following at hand:
- Tenant name
- For modern authentication: Application (client) ID
@@ -35,16 +35,16 @@ Make sure you have the following at hand:
Types of data that can be collected by Netwrix Auditor from the Microsoft 365 tenant depend on the
authentication option you choose.
-Follow the steps to configure Office 365 tenant as a monitored item.
+To configure Office 365 tenant as a monitored item.
**Step 1 –** On the **General** page of the item properties, specify **Tenant name**:
- If you are going to use **Basic authentication**, you can proceed to the next step – **Tenant
name** will be filled in automatically after it.
-- **NOTE:** Basic authentication is no longer possible for Exchange Online. For the already existing
- tenants it is still possible to use basic authentication for SharePoint Online and Microsoft Entra
- ID monitoring.
+:::note
+Basic authentication is no longer possible for Exchange Online. For the already existing tenants it is still possible to use basic authentication for SharePoint Online and Microsoft Entra ID monitoring.
+:::
- If you are going to use **Modern authentication**, paste the obtained name. See the
[Using Modern Authentication with Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md)
@@ -52,7 +52,7 @@ Follow the steps to configure Office 365 tenant as a monitored item.
-If you are using a government tenant, please click the **Tenant Environment** tab and select the
+If you are using a government tenant, click the **Tenant Environment** tab and select the
desired tenant environment.
**Step 2 –** Select authentication method that will be used when accessing Office 365 services:
@@ -63,7 +63,7 @@ desired tenant environment.
- Enter **User name** and **password**; use any of the following formats: _user@domain.com_ or
_user@domain.onmicrosoft.com_.
- The **Tenant name** field then will be filled in automatically.
- - Make sure this user account has sufficient access rights. See
+ - Ensure this user account has sufficient access rights. See
[Using Basic Authentication with Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/basicauth.md)
topic for additional information.
diff --git a/docs/auditor/10.8/admin/monitoringplans/networkdevices.md b/docs/auditor/10.8/admin/monitoringplans/networkdevices.md
index 97e93bbcb1..ef4cea4b11 100644
--- a/docs/auditor/10.8/admin/monitoringplans/networkdevices.md
+++ b/docs/auditor/10.8/admin/monitoringplans/networkdevices.md
@@ -6,7 +6,7 @@ sidebar_position: 130
# Network Devices
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data collection
@@ -44,7 +44,7 @@ Complete the following fields:
| Option | Description |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify syslog host or network source | Select one of the following: - Host or network source name — Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. - IP Range — Specify an IP range for the audited computers. To exclude computers from within the specified range, click **Exclude**. Enter the IP subrange you want to exclude, and click **Add**. |
+| Specify syslog host or network source | Select one of the following: - Host or network source name — Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. - IP Range — Specify an IP range for the audited computers. To exclude computers from within the specified range, click **Exclude**. Enter the IP subrange you want to exclude, and click **Add**. |
| Specify port and protocol for incoming connections | Use **Port** and **Protocol** to provide the port required for incoming connections (default is **UDP port 514**). |
| Devices | |
| Configure monitoring rules for required network devices: - Cisco (ASA, IOS, FTD, Meraki) - Fortinet (FortiGate FortiOS) - Juniper (Junos OS) - Palo Alto (PAN-OS) - Sonic Wall (NS, SMA, WAF) - HPE (ArubaOS) - Pulse Secure | |
diff --git a/docs/auditor/10.8/admin/monitoringplans/oracle/overview.md b/docs/auditor/10.8/admin/monitoringplans/oracle/overview.md
index efb74f5977..95215011be 100644
--- a/docs/auditor/10.8/admin/monitoringplans/oracle/overview.md
+++ b/docs/auditor/10.8/admin/monitoringplans/oracle/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 140
# Oracle Database
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
@@ -43,7 +43,7 @@ Complete the following fields:
| Option | Description |
| ------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Connection type | Select how the product connects to Oracle Database: - Oracle Database instance – select if you want to connect to a database by instance name. - Oracle Wallet – select if you want to use Oracle Wallet – password-protected container used to store authentication and signing credentials, including private keys, certificates, and trusted certificates needed by SSL. |
-| Instance name | Provide connection details in the following format: _host:port/service_name._ Make sure audit settings are configured for your Oracle Database instance. |
+| Instance name | Provide connection details in the following format: _host:port/service_name._ ensure audit settings are configured for your Oracle Database instance. |
| Wallet alias | Provide the alias you set while creating wallet. For example, "_MyOracle_". Alias name in Netwrix Auditor should exactly match the alias in the `tnsnames.ora` file. [Configure Oracle Instant Client for HTTP Proxy Connections](/docs/auditor/10.8/configuration/oracle/wallet.md#configure-oracle-instant-client-for-http-proxy-connections) |
| Specify the account for collecting data For Oracle Database instance connection type only. | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. |
@@ -62,7 +62,7 @@ On a high level, data collection process for Oracle databases works as follows:
- Creates a monitoring plan in Netwrix Auditor, specifying the service account (prepared at
step 1) as a data collecting account in the Monitoring Plan wizard. Then s/he adds items to
the monitoring plan – these are Oracle Databases to collect data from.
- - Configures alerts related to Oracle data source. Current version does not include predefined
+ - Configures alerts related to Oracle data source. Current version doesn't include predefined
alerts for that data source, so follow the [Create Alerts](/docs/auditor/10.8/admin/alertsettings/create/create.md)
section to create and configure the necessary alerts.
diff --git a/docs/auditor/10.8/admin/monitoringplans/oracle/scope.md b/docs/auditor/10.8/admin/monitoringplans/oracle/scope.md
index ebf87a982b..8cfc7e2222 100644
--- a/docs/auditor/10.8/admin/monitoringplans/oracle/scope.md
+++ b/docs/auditor/10.8/admin/monitoringplans/oracle/scope.md
@@ -9,7 +9,7 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying users that you want to exclude from the Oracle
Database monitoring scope.
-Follow the steps to exclude data from the Oracle Database monitoring scope:
+To exclude data from the Oracle Database monitoring scope:
**Step 1 –** In Auditor, navigate to your Oracle Database monitoring plan and click Edit.
diff --git a/docs/auditor/10.8/admin/monitoringplans/overview.md b/docs/auditor/10.8/admin/monitoringplans/overview.md
index 3776428ef8..d80353815d 100644
--- a/docs/auditor/10.8/admin/monitoringplans/overview.md
+++ b/docs/auditor/10.8/admin/monitoringplans/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Monitoring Plans
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data collection
@@ -25,7 +25,7 @@ A monitoring plan defines data collection, notification, and storage settings.
To start collecting data, and add items to its scope.
-Follow the steps to collect data from your environment.
+To collect data from your environment.
**Step 1 –** Create a monitoring plan with the wizard. Select the data source when you start the
monitoring plan wizard, and its initial settings are configured at the wizard steps. See the
@@ -45,10 +45,10 @@ tile, then expand the All Monitoring Plans tree.
| To.. | Do.. |
| --------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| See how data collection goes on | Click on a plan name. You will see all data sources included in the plan and data collection status for each data source. |
+| See how data collection goes on | Click a plan name. You will see all data sources included in the plan and data collection status for each data source. |
| Start data collection manually | 1. Select a plan and click Edit. 2. In the monitoring plan window, click Update in the right pane. Data collection will be started (status for the data sources will be displayed as _Working_). Do the same if you need to generate Activity Summary with the latest changes. |
| View collected data | 1. Select a plan and click Edit. 2. In the right pane, go to the Intelligence section (in the bottom) and click Search. The search page will appear, displaying the collected data filtered out accordingly (i.e. provided by this monitoring plan). |
-| Modify plan settings, add or delete data sources, add or delete items | Select a plan and click Edit. On the page that opens, review your plan settings. Then follow the instructions described in these sections: - [Add Items for Monitoring](/docs/auditor/10.8/admin/monitoringplans/datasources.md) - [Fine-Tune Your Plan and Edit Settings](/docs/auditor/10.8/admin/monitoringplans/finetune.md) |
+| Modify plan settings, add, or delete data sources, add, or delete items | Select a plan and click Edit. On the page that opens, review your plan settings. Then follow the instructions described in these sections: - [Add Items for Monitoring](/docs/auditor/10.8/admin/monitoringplans/datasources.md) - [Fine-Tune Your Plan and Edit Settings](/docs/auditor/10.8/admin/monitoringplans/finetune.md) |
| Assign roles | Click Delegate to review current delegations and assign roles. You can delegate control over a monitoring plan to another administrator, or grant read access—Reviewer role—to the data collected by this plan. To simplify delegation, you can further organize the monitoring plans into folders. See the [Role-Based Access and Delegation](/docs/auditor/10.8/admin/monitoringplans/delegation.md) topic for additional information. |
## Using historical data
@@ -65,7 +65,7 @@ the historical snapshots to the database.
To import snapshots, you must be assigned the _Global administrator_ or the _Global reviewer_ role.
-Follow the steps to import historical snapshots.
+To import historical snapshots.
**Step 1 –** Select the monitoring plan you need.
diff --git a/docs/auditor/10.8/admin/monitoringplans/overview_1.md b/docs/auditor/10.8/admin/monitoringplans/overview_1.md
index 5df3a83df4..e2e37562ab 100644
--- a/docs/auditor/10.8/admin/monitoringplans/overview_1.md
+++ b/docs/auditor/10.8/admin/monitoringplans/overview_1.md
@@ -6,7 +6,7 @@ sidebar_position: 180
# User Activity
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
@@ -88,7 +88,7 @@ To exclude the Notepad application window with "_Document1_" open, add the follo
## Computer
For evaluation purposes, Netwrix recommends selecting Computer as an item for a monitoring plan.
-Once the product is configured to collect data from the specified items, audit settings (including
+After the product is configured to collect data from the specified items, audit settings (including
Core and Compression services installation) will be applied to all computers within AD Container or
IP Range.
@@ -97,7 +97,7 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify a computer | Provide a server name by entering its FQDN, NETBIOS or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
+| Specify a computer | Provide a server name by entering its FQDN, NETBIOS, or IPv4 address. You can click Browse to select a computer from the list of computers in your network. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select account type you want to use and enter credentials. The following choices are available: - User/password. The account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. - Group Managed Service Account (gMSA). You should specify only the account name in the domain\account$ format. See the [Use Group Managed Service Account (gMSA)](/docs/auditor/10.8/requirements/gmsa.md) topic for additional information. |
## IP Range
@@ -117,5 +117,5 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify AD container | Specify a whole AD domain, OU or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you do not want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers does not include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
+| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. |
diff --git a/docs/auditor/10.8/admin/monitoringplans/sharepoint/overview.md b/docs/auditor/10.8/admin/monitoringplans/sharepoint/overview.md
index da4fb7b540..e27180bb12 100644
--- a/docs/auditor/10.8/admin/monitoringplans/sharepoint/overview.md
+++ b/docs/auditor/10.8/admin/monitoringplans/sharepoint/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 150
# SharePoint
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
@@ -24,7 +24,7 @@ Complete the following fields:
| -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
| Detect additional details | Specify additional information to include in reports and activity summaries. Select Group membership if you want to include Group membership of the account under which the change was made. |
-| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. See the [SharePoint](/docs/auditor/10.8/configuration/sharepoint/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
+| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [SharePoint](/docs/auditor/10.8/configuration/sharepoint/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
| Collect data for state-in-time reports | Configure Netwrix Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.8/admin/reports/types/stateintime/overview.md) topic for additional information. In the **Manage historical snapshots** section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must be assigned the **Global administrator** or the **Global reviewer** role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot on the regular basis to keep users up to date on actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor . If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. |
Review your data source settings and click **Add** to go back to your plan. The newly created data
@@ -37,7 +37,7 @@ information.
| Problem | Description | KB article |
| ------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The "Timeout Expired" error appears during the agent's deployment. | The agent failed to be deployed due to one of the following reasons: - One or several servers are unreachable - The SPAdminV4 service is not started on any of the servers. - The servers within the farm are located in different time zones. - Your SharePoint farm exceeds the recommended capacity limits. Increase DeployTimeout value in _%ProgramData%\Netwrix\NetwrixAuditor for SharePoint\ Configuration\ ``\ Commonsettings.config_ and restart the agent service. | Refer to the [Timeout Expired Error on SharePoint Core Service Deployment](/docs/kb/auditor/configuration-and-setup/sharepoint-and-teams-auditing/timeout-expired-error-on-sharepoint-core-service-deployment) Knowledge Base article for the solution. |
+| The "Timeout Expired" error appears during the agent's deployment. | The agent failed to be deployed due to one of the following reasons: - One or several servers are unreachable - The SPAdminV4 service isn't started on any of the servers. - The servers within the farm are located in different time zones. - Your SharePoint farm exceeds the recommended capacity limits. Increase DeployTimeout value in _%ProgramData%\Netwrix\NetwrixAuditor for SharePoint\ Configuration\ ``\ Commonsettings.config_ and restart the agent service. | Refer to the [Timeout Expired Error on SharePoint Core Service Deployment](/docs/kb/auditor/configuration-and-setup/sharepoint-and-teams-auditing/timeout-expired-error-on-sharepoint-core-service-deployment) Knowledge Base article for the solution. |
## SharePoint Farm
@@ -49,11 +49,11 @@ Complete the following fields:
| Specify SharePoint farm for monitoring | Enter the SharePoint Central Administration website URL. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Core Service | |
-| Deploy Netwrix Auditor for SharePoint Core Service | Select deployment method for the Core Service. Select one of the following: - Automatically—The installation will run under the account used to collect data on the SharePoint farm wizard completion. Prior to the Netwrix Auditor for SharePoint Core Service installation, review the following prerequisites and make sure that: - Netwrix Auditor for SharePoint Core Service is going to be installed on the computer that hosts SharePoint Central Administration in the audited SharePoint farm. - [.Net Framework 3.5 SP1](http://www.microsoft.com/en-us/download/details.aspx?id=22) is installed on the computer that hosts SharePoint Central Administration in the audited SharePoint farm. - The SharePoint Administration (SPAdminV4) service is started on the target computer. See [SharePoint](/docs/auditor/10.8/configuration/sharepoint/overview.md) for more information. - The user that is going to run the Core Service installation: - Is a member of the local Administrators group on SharePoint server, where the Core Service will be deployed. - Is granted the SharePoint_Shell_Access role on SharePoint SQL Server configuration database. See [Permissions for SharePoint Auditing](/docs/auditor/10.8/configuration/sharepoint/permissions.md) topic for more information. - Manually—See the [Netwrix Auditor Installation and Configuration Guide](https://www.netwrix.com/download/documents/Netwrix_Auditor_Installation_Configuration_Guide.pdf) for more information. During the Netwrix Auditor for SharePoint Core Service installation / uninstallation your SharePoint sites may be unavailable. |
+| Deploy Netwrix Auditor for SharePoint Core Service | Select deployment method for the Core Service. Select one of the following: - Automatically—The installation will run under the account used to collect data on the SharePoint farm wizard completion. Before the Netwrix Auditor for SharePoint Core Service installation, review the following prerequisites and ensure that: - Netwrix Auditor for SharePoint Core Service is going to be installed on the computer that hosts SharePoint Central Administration in the audited SharePoint farm. - [.Net Framework 3.5 SP1](http://www.microsoft.com/en-us/download/details.aspx?id=22) is installed on the computer that hosts SharePoint Central Administration in the audited SharePoint farm. - The SharePoint Administration (SPAdminV4) service is started on the target computer. See [SharePoint](/docs/auditor/10.8/configuration/sharepoint/overview.md) for more information. - The user that is going to run the Core Service installation: - Is a member of the local Administrators group on SharePoint server, where the Core Service will be deployed. - Is granted the SharePoint_Shell_Access role on SharePoint SQL Server configuration database. See [Permissions for SharePoint Auditing](/docs/auditor/10.8/configuration/sharepoint/permissions.md) topic for more information. - Manually—See the [Netwrix Auditor Installation and Configuration Guide](https://www.netwrix.com/download/documents/Netwrix_Auditor_Installation_Configuration_Guide.pdf) for more information. During the Netwrix Auditor for SharePoint Core Service installation / uninstallation your SharePoint sites may be unavailable. |
| Changes | |
| Audit SharePoint farm configuration changes | Configuration changes are always audited. |
-| Audit SharePoint permissions and content changes | Select change types to be audited with Netwrix Auditor. Netwrix Auditor allows auditing the entire SharePoint farm. Alternatively, you can limit the auditing scope to separate web applications and site collections. To do it, select Specific SharePoint objects and do one of the following: - Click Add, provide the URL to web application or site collection and select object type (Web application or Site collection). - Click Import, select object type (Web application or Site collection), encoding type, and browse for a file that contains a list of web applications and sites. Netwrix Auditor ignores changes to system data (e.g., hidden and system lists or items are not audited). Netwrix Auditor also ignores the content changes to sites and objects on the site collections located on Central Administration web application, but the security changes that occurred there are tracked and reported anyway. |
+| Audit SharePoint permissions and content changes | Select change types to be audited with Netwrix Auditor. Netwrix Auditor allows auditing the entire SharePoint farm. Alternatively, you can limit the auditing scope to separate web applications and site collections. To do it, select Specific SharePoint objects and do one of the following: - Click Add, provide the URL to web application or site collection and select object type (Web application or Site collection). - Click Import, select object type (Web application or Site collection), encoding type, and browse for a file that contains a list of web applications and sites. Netwrix Auditor ignores changes to system data (e.g., hidden and system lists or items aren't audited). Netwrix Auditor also ignores the content changes to sites and objects on the site collections located on Central Administration web application, but the security changes that occurred there are tracked and reported anyway. |
| Activity | |
-| Specify monitoring restrictions | Specify restriction filters to narrow your SharePoint monitoring scope (search results, reports and Activity Summaries). For example, you can exclude site collections document libraries and lists from being audited as they contain public non sensitive data. All filters are applied using AND logic. Click Add and complete the following fields: - User – provide the name of the user as shown in the "_Who_" column of reports and Activity Summaries. Example: _mydomain\user1_. - Object URL – provide URL of the objects as shown in the "_What_" column of reports and Activity Summaries. Example: _http://sitecollection/list/document.docx_. - Action Type – select what types of actions performed by selected users under the object you want to monitor. Available values: _All_, _Changes_, _Reads_. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your SharePoint monitoring scope (search results, reports, and Activity Summaries). For example, you can exclude site collections document libraries and lists from being audited as they contain public non sensitive data. All filters are applied using AND logic. Click Add and complete the following fields: - User – provide the name of the user as shown in the "_Who_" column of reports and Activity Summaries. Example: _mydomain\user1_. - Object URL – provide URL of the objects as shown in the "_What_" column of reports and Activity Summaries. Example: _http://sitecollection/list/document.docx_. - Action Type – select what types of actions performed by selected users under the object you want to monitor. Available values: _All_, _Changes_, _Reads_. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
| Read Access | |
| Audit SharePoint read access | Configure Netwrix Auditor to track read access to lists and list items within your SharePoint farm except for Central Administration web sites. Select Sites only if you want to enable read access auditing on SharePoint sites only. Enable Sites and subsites to track read access on each subsite. Then, do one of the following: - Click Add and provide URL to a SharePoint site. - Click Import, select encoding type, and browse for a file that contains a list of sites. Read access auditing significantly increases the number of events generated on your SharePoint and the amount of data written to the AuditArchive. |
diff --git a/docs/auditor/10.8/admin/monitoringplans/sharepoint/scope.md b/docs/auditor/10.8/admin/monitoringplans/sharepoint/scope.md
index 870bfe7dad..bac4b9b703 100644
--- a/docs/auditor/10.8/admin/monitoringplans/sharepoint/scope.md
+++ b/docs/auditor/10.8/admin/monitoringplans/sharepoint/scope.md
@@ -9,7 +9,7 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the SharePoint
monitoring scope.
-Follow the steps to exclude data from the SharePoint monitoring scope:
+To exclude data from the SharePoint monitoring scope:
**Step 1 –** Navigate to the _%working folder%\Netwrix Auditor for SharePoint\Configuration\GUID_
folder, where omit lists are located.
@@ -29,7 +29,7 @@ monitoring plan separately.
| omitscreadaccesslist.txt | Contains a list of site collections for which the product will not monitor read access attempts. | `http(s)://URL` Enter the root web site URLs. If you have alternate access mapping configured in your SharePoint farm, and one web application has different URLs for different zones, you can use any of these URLs to specify a child site collection. For example: `http://sharepointsrv:3333/` |
| omitscstorelist.txt | Contains a list of site collections to be excluded from audit data collection. | `http(s)://URL` Enter the root web site URLs. If you have alternate access mapping configured in your SharePoint farm, and one web application has different URLs for different zones, you can use any of these URLs to specify a child site collection. For example: `https://siteColl*` |
| omitsitscstorelist.txt | Lists site collections to exclude from being monitored and reported in state-in-time report. | `http(s)://URL` Enter root web site URLs. If you have alternate access mapping configured in your SharePoint farm, and one web application has different URLs for different zones, you can use any of these URLs to specify a child site collection. You can use a wildcard (\*) to replace any number of characters. Examples: `http://siteCollection1:3333/ `````` https://siteColl*` |
-| omitsitstorelist.txt | Contains SharePoint lists and list items that you want to exclude from being audited. | URI Reference URI Reference does not include site collection URL. For example, to exclude the list item with URL _http://sitecollection/list/document.docx_, specify only "_list/document.docx_" instead of full URL. Wildcard (\*) is supported to replace any number of characters. Examples: `*list/document.docx `````` */_catalogs/* `````` */_vti_inf.html `````` */Style Library* `````` */SitePages*` |
+| omitsitstorelist.txt | Contains SharePoint lists and list items that you want to exclude from being audited. | URI Reference URI Reference doesn't include site collection URL. For example, to exclude the list item with URL _http://sitecollection/list/document.docx_, specify only "_list/document.docx_" instead of full URL. Wildcard (\*) is supported to replace any number of characters. Examples: `*list/document.docx `````` */_catalogs/* `````` */_vti_inf.html `````` */Style Library* `````` */SitePages*` |
| omituserviewstorelist.txt | Contains a list of user or service accounts to be excluded from read access monitoring. | `Login name` For example: SHAREPOINT\System |
| omitviewstorelist.txt | Contains lists and list items to be excluded from being monitored for read access. | `URI Reference ` Only specify URI reference to a list or list item without `https:\\` part. For example: `*list/document.docx` |
| omitwastorelist.txt | Contains a list of web applications to be excluded from audit data collection. | `http(s)://URL` Enter the root web site URLs. If you have alternate access mapping configured in your SharePoint farm, and one web application has different URLs for different zones, you can use any of these URLs. For example: `http://webApplication1:3333/` |
diff --git a/docs/auditor/10.8/admin/monitoringplans/sharepointonline/overview.md b/docs/auditor/10.8/admin/monitoringplans/sharepointonline/overview.md
index a426243792..60b09097f7 100644
--- a/docs/auditor/10.8/admin/monitoringplans/sharepointonline/overview.md
+++ b/docs/auditor/10.8/admin/monitoringplans/sharepointonline/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 160
# SharePoint Online
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in
the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
@@ -25,7 +25,7 @@ This instruction shows how to collect audit data from the Microsoft 365 tenant.
If you plan to use modern authentication, see the
[Configuring Microsoft Entra ID App for Auditing Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md#configuring-microsoft-entra-id-app-for-auditing-microsoft-entra-id)
topic for additional information on how to prepare Microsoft Entra ID app with required permissions.
-Make sure you have the following at hand:
+Ensure you have the following at hand:
- Tenant name
- For modern authentication: Application (client) ID
@@ -35,16 +35,16 @@ Make sure you have the following at hand:
Types of data that can be collected by Netwrix Auditor from the Microsoft 365 tenant depend on the
authentication option you choose.
-Follow the steps to configure Office 365 tenant as a monitored item.
+To configure Office 365 tenant as a monitored item.
**Step 1 –** On the **General** page of the item properties, specify **Tenant name**:
- If you are going to use **Basic authentication**, you can proceed to the next step – **Tenant
name** will be filled in automatically after it.
-- **NOTE:** Basic authentication is no longer possible for Exchange Online. For the already existing
- tenants it is still possible to use basic authentication for SharePoint Online and Microsoft Entra
- ID monitoring.
+:::note
+Basic authentication is no longer possible for Exchange Online. For the already existing tenants it is still possible to use basic authentication for SharePoint Online and Microsoft Entra ID monitoring.
+:::
- If you are going to use **Modern authentication**, paste the obtained name. See the
[Using Modern Authentication with Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md)
@@ -52,7 +52,7 @@ Follow the steps to configure Office 365 tenant as a monitored item.
-If you are using a government tenant, please click the **Tenant Environment** tab and select the
+If you are using a government tenant, click the **Tenant Environment** tab and select the
desired tenant environment.
**Step 2 –** Select authentication method that will be used when accessing Office 365 services:
@@ -63,7 +63,7 @@ desired tenant environment.
- Enter **User name** and **password**; use any of the following formats: _user@domain.com_ or
_user@domain.onmicrosoft.com_.
- The **Tenant name** field then will be filled in automatically.
- - Make sure this user account has sufficient access rights. See
+ - Ensure this user account has sufficient access rights. See
[Using Basic Authentication with Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/basicauth.md)
topic for additional information.
diff --git a/docs/auditor/10.8/admin/monitoringplans/sharepointonline/scope.md b/docs/auditor/10.8/admin/monitoringplans/sharepointonline/scope.md
index a8287366c0..e6b4fe27b1 100644
--- a/docs/auditor/10.8/admin/monitoringplans/sharepointonline/scope.md
+++ b/docs/auditor/10.8/admin/monitoringplans/sharepointonline/scope.md
@@ -9,7 +9,7 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the SharePoint
Online monitoring scope.
-Follow the steps to exclude data from the SharePoint monitoring scope:
+To exclude data from the SharePoint monitoring scope:
**Step 1 –** Navigate to the _%ProgramData%\Netwrix Auditor\Netwrix Auditor for SharePoint
Online\Configuration_ folder and locate your monitoring plan.
@@ -30,4 +30,4 @@ monitoring plan separately.
| omitreadstorelist.txt | Contains the SharePoint Online lists, documents, etc., to be excluded from being monitored for read access. | `https://URL` For example: `https://Corp.sharepoint.com/*` `*list/document.docx` |
| omituserreadstorelist.txt | Contains a list of user accounts to be excluded from read access monitoring. | Provide user name in the UPN format. For example: `account@example.*.com` |
| OmitSitScStoreList.txt | Contains a list of SharePoint Online site collections to be excluded from state-in-time data collection. | Enter root web site URLs. For example: `https://URL` |
-| OmitSitStoreList.txt | Contains SharePoint Online lists and list items to be excluded from state-in-time data collection. | Enter list or list item URI (Unique resource identifier, or endpoint) reference. Note that URI Reference does not include site collection URL. For example, to exclude a list item with the `https://sitecollection.sharepoint.com/list/document.docx`, URL, you should specify the corresponding endpoint (URI), i.e. `list/document.docx`. |
+| OmitSitStoreList.txt | Contains SharePoint Online lists and list items to be excluded from state-in-time data collection. | Enter list or list item URI (Unique resource identifier, or endpoint) reference. URI Reference doesn't include site collection URL. For example, to exclude a list item with the `https://sitecollection.sharepoint.com/list/document.docx`, URL, you should specify the corresponding endpoint (URI), i.e. `list/document.docx`. |
diff --git a/docs/auditor/10.8/admin/monitoringplans/sqlserver/items.md b/docs/auditor/10.8/admin/monitoringplans/sqlserver/items.md
index b37889c9c7..cde01f216a 100644
--- a/docs/auditor/10.8/admin/monitoringplans/sqlserver/items.md
+++ b/docs/auditor/10.8/admin/monitoringplans/sqlserver/items.md
@@ -14,7 +14,7 @@ Perform the following steps to add an item to the SQL Server monitoring plan.
**Step 3 –** Click **Add Item**.
-**Step 4 –** Select one of the items from the drop-down list:
+**Step 4 –** Select one of the items from the dropdown list:
- SQL Server Instance
- SQL Server Availability Group
@@ -51,7 +51,7 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Availability group listener | Provide a name of an availability group listener in FQDN or NetBIOS format. The listener is a virtual network name (VNN) that you can connect to in order to access a database in a primary or secondary replica of an Always On availability group. A listener allows you to connect to a replica without having to know the physical instance name of the SQL Server. Ensure that the requirements to the DNS name and Windows permissions requirements are met. See [Configure a listener for an Always On availability group](https://docs.microsoft.com/en-us/sql/database-engine/availability-groups/windows/create-or-configure-an-availability-group-listener-sql-server?view=sql-server-ver15) for additional information. |
+| Availability group listener | Provide a name of an availability group listener in FQDN or NetBIOS format. The listener is a virtual network name (VNN) that you can connect to and access a database in a primary or secondary replica of an Always On availability group. A listener lets you connect to a replica without knowing the physical instance name of the SQL Server. Ensure that the requirements to the DNS name and Windows permissions requirements are met. See [Configure a listener for an Always On availability group](https://docs.microsoft.com/en-us/sql/database-engine/availability-groups/windows/create-or-configure-an-availability-group-listener-sql-server?view=sql-server-ver15) for additional information. |
| Availability group name | Enter a name of your SQL Server availability group. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the [Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. |
diff --git a/docs/auditor/10.8/admin/monitoringplans/sqlserver/overview.md b/docs/auditor/10.8/admin/monitoringplans/sqlserver/overview.md
index ac1a48f381..9de70b72d8 100644
--- a/docs/auditor/10.8/admin/monitoringplans/sqlserver/overview.md
+++ b/docs/auditor/10.8/admin/monitoringplans/sqlserver/overview.md
@@ -6,8 +6,7 @@ sidebar_position: 170
# SQL Server
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
-the following topics:
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
collection and activity monitoring configure necessary protocols and ports for inbound and
@@ -41,7 +40,7 @@ On the **General** tab, you can configure the following settings for SQL Server
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
| Monitor SQL Server configuration changes | Always enabled, as SQL Server configuration changes are always monitored. |
| Monitor SQL Server logon activity | Specify what types of logon events you want to monitor: successful or failed, performed through Windows and SQL authentication. - Failed logons - Successful logons |
-| Collect data for state-in-time reports | Configure Netwrix Auditor to store the snapshots of your SQL Server instance configuration — you will require them for state-in-time reports generation. See [State–In–Time Reports](/docs/auditor/10.8/admin/reports/types/stateintime/overview.md) for more information. **CAUTION:** The State-in-Time functionality is not available for SQL Server Availability Groups. The product updates the latest snapshot on the regular basis to keep users up-to-date on actual system state. Only the latest snapshot is available for reporting in Netwrix Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. To import snapshots, you must be assigned the Global administrator or the Global reviewer role in Netwrix Auditor. 1. In the Manage historical snapshots section, click **Manage** and select the snapshots that you want to import. 2. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. 3. When finished, click **OK**. See also [Using historical data](/docs/auditor/10.8/admin/monitoringplans/overview.md#using-historical-data). |
+| Collect data for state-in-time reports | Configure Netwrix Auditor to store the snapshots of your SQL Server instance configuration — you will require them for state-in-time reports generation. See [State–In–Time Reports](/docs/auditor/10.8/admin/reports/types/stateintime/overview.md) for more information. **CAUTION:** The State-in-Time functionality isn't available for SQL Server Availability Groups. The product updates the latest snapshot on the regular basis to keep users up-to-date on actual system state. Only the latest snapshot is available for reporting in Netwrix Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. To import snapshots, you must be assigned the Global administrator or the Global reviewer role in Netwrix Auditor. 1. In the Manage historical snapshots section, click **Manage** and select the snapshots that you want to import. 2. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. 3. When finished, click **OK**. See also [Using historical data](/docs/auditor/10.8/admin/monitoringplans/overview.md#using-historical-data). |
## Users
@@ -51,25 +50,25 @@ On the **Users** tab, you can configure the following settings for SQL Server da
| Options | Description |
| ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Specify users to track their activity | Select the option you need to fine-tune your SQL Server monitoring scope. - **Monitor all users** - **Include only users matching these criteria** - **Exclude users matching these criteria** For example, you may need to track only actions performed by administrative accounts, or exclude the activity initiated by ordinary applications. If so, data should be filtered accordingly before it appears in search results, reports and Activity Summaries. You can create either inclusion or exclusion lists. All filters are applied using AND logic. To create a filter for user activity monitoring, select the related option and click the button on the right. Specify the following: - User — enter the initiator's account as it appears in the "_Who_" column of reports and Activity Summaries, for example: _mydomain\user1_. For events containing “_System_” in the “_Who_” column you can enter "_System_" . - Workstation where activity was initiated — enter the workstation name as it is shown in the "_Workstation_" column of reports and Activity Summaries, for example: _StationWin2016_. - Application that initiated the activity — enter the application name as shown next to "_Application name_" in details of reports and Activity Summaries. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify users to track their activity | Select the option you need to fine-tune your SQL Server monitoring scope. - **Monitor all users** - **Include only users matching these criteria** - **Exclude users matching these criteria** For example, you may need to track only actions performed by administrative accounts, or exclude the activity initiated by ordinary applications. If so, data should be filtered accordingly before it appears in search results, reports, and Activity Summaries. You can create either inclusion or exclusion lists. All filters are applied using AND logic. To create a filter for user activity monitoring, select the related option and click the button on the right. Specify the following: - User — enter the initiator's account as it appears in the "_Who_" column of reports and Activity Summaries, for example: _mydomain\user1_. For events containing “_System_” in the “_Who_” column you can enter "_System_" . - Workstation where activity was initiated — enter the workstation name as it is shown in the "_Workstation_" column of reports and Activity Summaries, for example: _StationWin2016_. - Application that initiated the activity — enter the application name as shown next to "_Application name_" in details of reports and Activity Summaries. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
## Data
On the **Data** tab, you can configure the following settings for SQL Server data source.
_Remember,_ when auditing SQL Server availability on groups, the only supported data collection mode
-is the 'Do not use triggers' mode.
+is the 'Don't use triggers' mode.
| Option | Description |
| ------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| --- | --- |
| --- | --- |
-| Monitor changes to data in the database tables | Enable monitoring of changes to data stored in the database tables hosted on the SQL Server. If you plan to enable this option, make sure the account that runs the _SQL Server service_ on the monitored instance has at least _read_ permissions in the Active Directory domain (e.g., it does not run under a local user account). Otherwise, enabling this option may lead to issues when altering databases on the monitored SQL Server instances. |
+| Monitor changes to data in the database tables | Enable monitoring of changes to data stored in the database tables hosted on the SQL Server. If you plan to enable this option, ensure the account that runs the _SQL Server service_ on the monitored instance has at least _read_ permissions in the Active Directory domain (e.g., it doesn't run under a local user account). Otherwise, enabling this option may lead to issues when altering databases on the monitored SQL Server instances. |
| **Data collection mode** | |
-| Do not use triggers | Default mode for a new installation of Netwrix Auditor. Data will be collected using the SQL Server traces. This mode allows you to get a sufficient level of detail in the reports and search results without producing additional load on your SQL Server instance. Thus, it is recommended for highly-transactional servers. When using this mode, consider that the "_What_" field of the Activity Record with "_Object type_" = "_Data_" may show incorrect data. The issues occur because the product applies data categories to an entire SQL Server table and not to rows. |
-| Use triggers for detailed monitoring | However, if you require a very detailed reporting on the data changes, you can select this mode. It will be also selected by default if you are upgrading your Netwrix Auditor deployment. Data will be collected using a set of triggers. For more information on this technology, see [https://kb.netwrix.com/728](https://kb.netwrix.com/728) . It is recommended to use this setting carefully, as collecting large amount of details from a highly-transactional server may affect its performance. Using this mode may lead to issues when altering databases on the monitored SQL Server instances. The issues occur only if the SQL Server service account does not have _Read_ permissions in the Active Directory domain (e.g., a local user account). When using this mode, consider that the "_What_" field of the Activity Record with "_Object type_" = "_Data_" may show incorrect data. The issues occur because the product applies data categories to an entire SQL Server table and not to rows. Switching from the configured triggerless mode may lead to a data loss. The workaround is to force data collection right after enabling the triggers. |
+| Don't use triggers | Default mode for a new installation of Netwrix Auditor. Data will be collected using the SQL Server traces. This mode lets you get a sufficient level of detail in the reports and search results without producing additional load on your SQL Server instance. Thus, it is recommended for highly-transactional servers. When using this mode, consider that the "_What_" field of the Activity Record with "_Object type_" = "_Data_" may show incorrect data. The issues occur because the product applies data categories to an entire SQL Server table and not to rows. |
+| Use triggers for detailed monitoring | However, if you require a very detailed reporting on the data changes, you can select this mode. It will be also selected by default if you are upgrading your Netwrix Auditor deployment. Data will be collected using a set of triggers. For more information on this technology, see [https://kb.netwrix.com/728](https://kb.netwrix.com/728) . It is recommended to use this setting carefully, as collecting large amount of details from a highly-transactional server may affect its performance. Using this mode may lead to issues when altering databases on the monitored SQL Server instances. The issues occur only if the SQL Server service account doesn't have _Read_ permissions in the Active Directory domain (e.g., a local user account). When using this mode, consider that the "_What_" field of the Activity Record with "_Object type_" = "_Data_" may show incorrect data. The issues occur because the product applies data categories to an entire SQL Server table and not to rows. Switching from the configured triggerless mode may lead to a data loss. The workaround is to force data collection right after enabling the triggers. |
| Changes (per transaction) to collect and report: | Specify how many changes per a database transaction you want to be collected. For example, you can limit this number to 10 changes per transaction, or collect all changes. It is recommended to adjust this setting carefully, as collecting large number of changes from a highly-transactional server may affect its performance. |
-| Monitoring rules | To specify what data changes must be monitored, create at least one **inclusion rule**. Exclusion rules are optional. Click **Add Rule** and configure the following:  - Type — Select rule type: include or exclude. - Server — Specify a name of the monitored SQL Server instance where the required database resides. Use the _server_name\instance_name_ format, for example, _SQLsrv11\SQLExpress2016_. **NOTE:** If you are going to configure monitoring rules for SQL Server Availability Groups, provide the name of your Availability Group item in this field. - Database — Specify the database whose data changes you want to monitor. - Table — Specify database table to monitor. - Column—Specify table column name. The following column types are currently not supported: `text, ntext, image, binary, varbinary, timestamp, sql_variant`. These filters will be applied using AND logic. Wildcard (\*) is supported and can be used to replace any number of characters. |
+| Monitoring rules | To specify what data changes must be monitored, create at least one **inclusion rule**. Exclusion rules are optional. Click **Add Rule** and configure the following:  - Type — Select rule type: include or exclude. - Server — Specify a name of the monitored SQL Server instance where the required database resides. Use the _server_name\instance_name_ format, for example, _SQLsrv11\SQLExpress2016_. **NOTE:** If you are going to configure monitoring rules for SQL Server Availability Groups, provide the name of your Availability Group item in this field. - Database — Specify the database whose data changes you want to monitor. - Table — Specify database table to monitor. - Column—Specify table column name. The following column types aren't supported: `text, ntext, image, binary, varbinary, timestamp, sql_variant`. These filters will be applied using AND logic. Wildcard (\*) is supported and can replace any number of characters. |
## Audit SELECT
@@ -83,4 +82,4 @@ audited.
| --- | --- |
| --- | --- |
| Audit successful SELECT statements | Enable monitoring of successful SELECT statements for the database tables. Successful SELECT statement execution will be reported as Read operation on the database table. Auditing SELECT statements will increase the amount of data collected from the SQL Server instance and stored to long-term archive and audit database. Plan for your resources accordingly. |
-| Monitoring rules | To specify what data changes will be monitored, you must create at least one **inclusion rule**. Exclusion rules are optional. Click **Add Inclusion** and specify the following:  - Server — specify target SQL Server instance in the server\instance format. **NOTE:** If you are going to configure monitoring rules for SQL Server Availability Groups, provide the name of your Availability Group item in this field. - Database — specify target database - Schema — specify database schema - Table — specify database table you will monitor Wildcard (\*) is supported and can be used to replace any number of characters. Filters will be applied using AND logic, that is, only SELECT statements matching all specified criteria will be monitored. So, in the example above, the program will track and report only the successful SELECT statements executed against the _Applicants_ table of the _HR2019_ database with _Custom_ schema, hosted on the _SQLsrv02\TestInstance_. When finished, click **Add**. If needed, configure the exclusion rules in a similar way. |
+| Monitoring rules | To specify what data changes will be monitored, you must create at least one **inclusion rule**. Exclusion rules are optional. Click **Add Inclusion** and specify the following:  - Server — specify target SQL Server instance in the server\instance format. **NOTE:** If you are going to configure monitoring rules for SQL Server Availability Groups, provide the name of your Availability Group item in this field. - Database — specify target database - Schema — specify database schema - Table — specify database table you will monitor Wildcard (\*) is supported and can replace any number of characters. Filters will be applied using AND logic, that is, only SELECT statements matching all specified criteria will be monitored. So, in the example above, the program will track and report only the successful SELECT statements executed against the _Applicants_ table of the _HR2019_ database with _Custom_ schema, hosted on the _SQLsrv02\TestInstance_. When finished, click **Add**. If needed, configure the exclusion rules in a similar way. |
diff --git a/docs/auditor/10.8/admin/monitoringplans/sqlserver/scope.md b/docs/auditor/10.8/admin/monitoringplans/sqlserver/scope.md
index 5452b99009..2f7ce21b70 100644
--- a/docs/auditor/10.8/admin/monitoringplans/sqlserver/scope.md
+++ b/docs/auditor/10.8/admin/monitoringplans/sqlserver/scope.md
@@ -6,10 +6,7 @@ sidebar_position: 20
# SQL Server Monitoring Scope
-You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the SQL Server
-monitoring scope.
-
-Follow the steps to exclude data from the SQL Server monitoring scope.
+To exclude data from the SQL Server monitoring scope, fine-tune Netwrix Auditor by specifying the data you want to exclude:
**Step 1 –** Navigate to the _%Netwrix Auditor install folder%\SQL Server Auditing_ folder.
@@ -21,12 +18,12 @@ Follow the steps to exclude data from the SQL Server monitoring scope.
| File | Description | Syntax |
| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| omitarlist.txt | Lists activity records to exclude from showing up in reports, search, and activity summaries. This omit list does not affect triggerless data collection mode, SELECT statements auditing and SQL logons monitoring. Use the _omitlogonlist.txt_ to exclude SQL logons from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | Specify the following fields of the activity records to exclude: `Monitoring plan name, `````` SQL Server instance,object type, `````` account,workstation,application name` Wildcard (\*) is supported and can replace any number of characters. For the account, workstation, application name fields, you can specify a mixed expression that contains both a value and a wildcard (e.g., Admin\*). For example: `SQLPlan,Ent-SQL,Table,guest,WksSQL,MyInternalApp` |
+| omitarlist.txt | Lists activity records to exclude from showing up in reports, search, and activity summaries. This omit list doesn't affect triggerless data collection mode, SELECT statements auditing and SQL logons monitoring. Use the _omitlogonlist.txt_ to exclude SQL logons from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | Specify the following fields of the activity records to exclude: `Monitoring plan name, `````` SQL Server instance,object type, `````` account,workstation,application name` Wildcard (\*) is supported and can replace any number of characters. For the account, workstation, application name fields, you can specify a mixed expression that contains both a value and a wildcard (e.g., Admin\*). For example: `SQLPlan,Ent-SQL,Table,guest,WksSQL,MyInternalApp` |
| omiterrorlist.txt | Contains a list of errors and warnings to be excluded from logging to the Netwrix Auditor System Health event log. | Monitoring plan name,item name,error text Wildcard (\*) is supported and can replace any number of characters. For example: \*,sqlserver1.corp.local, \*Access is denied\* |
| omitlogonlist.txt | Contains a list of logons to exclude from monitoring. | `monitoring plan name,SQL Server instance,logon type,account,workstation,application name` For the `account`, `workstation`, `application name` fields, you can specify a mixed expression that contains both a value and a wildcard (e.g., `Admin*`). The following logon types are supported: - `NtLogon `— Successful logon attempt made through Windows authentication. - `SqlLogon `— Successful logon attempt made through SQL Server authentication. - `NtFailedLogon `— Failed logon attempt made through Windows authentication. - `SqlFailedLogon `— Failed logon attempt made through SQL Server authentication. For example: `DB_M0,Ent-SQL,SQLFailedLogon,guest,WksSQL,MyInternalApp` |
-| omitobjlist.txt | Contains a list of object to exclude from showing up in reports, search results and activity summaries. Audit data, however, will still be collected and saved to Long-Term Archive. This omit list does not affect SELECT statements auditing, data changes auditing and logon activity auditing. Use the _omitlogonlist.txt_ to exclude logon activity from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | `object_type_name` Available object types can be found in the "Object type" column in reports. For example: `Database` `Column` |
-| omitpathlist.txt | Specify the resource paths to objects that you want to exclude from showing up in search, reports and activity summaries. Audit data, however, will still be collected and saved to Long-Term Archive. This omit list does not affect triggerless data collection mode, SELECT statements auditing and logon activity auditing. Use the _omitlogonlist.txt_ to exclude logon activity from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | `server_instance:resource_path` where: - `server_instance` — SQL Server instance, use \* for all servers - `resource_path` — resource path as shown in the "**What**" column of SQL Server report, or in search results Wildcard \* is supported and can replace any part of the path. For example, to exclude information about databases whose names start with "tmp" on the SQL Server instance "PROD.SQL2012": `PROD.SQL2012:Databases\tmp*`. |
-| omitproplist.txt | Contains a list of attributes to be excluded from being monitored and stored to the Audit Archive. | `object_type_name.property_name.attribute_name` where: - `object_type_name`—Can be found in the found in the Object Type column in change reports. - `property_name`—Can be found in the Details column (property name is bold). - `attribute_name`—Can be found in the Details column (attribute name is not bold). If an object does not have an attribute name, use the \* character. For example to exclude information about the Size attribute of the Database File property in all databases: `Database.Database File.Size`. |
-| omitstorelist.txt | Contains a list of SQL Server objects that you want to exclude from data collection and reporting. This list is only relevant to operations with SQL Server objects; it does not affect triggerless data collection mode, SELECT statements auditing and logon activity auditing. To configure exclusions for logon activity auditing (Windows or SQL logons), use the _omitlogonlist.txt_. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | `server_instance:resource_path` where: - `server_instance` — SQL Server instance. For all instances, use wildcard (\*). - ` resource_path` — path as shown in the "**What**" column of SQL Server report, or in search results. Wildcard (\*) can be used to replace any number of characters. For example, to exclude information about server roles on the SQL Server instances whose names start with _njsqlsrv23_, enter: `njsqlsrv23*:Security\Server Roles\*` |
-| omittracelist.txt | If you do not want the product to enable SQL tracing on some of your SQL Server instances, specify their names in this omitlist. In this case the "Who", "Workstation" and "When" values will not be reported correctly (except for content changes). This omit list does not affect triggerless data collection mode, SELECT statements auditing and logon activity auditing. Use the _omitlogonlist.txt_ to exclude logon activity from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | Enter the name of SQL Server instance, use \* for all servers: `server\instance name` Wildcard (\*) is supported and can replace any number of characters, e.g., MYSERVER_SQL\* Examples: \* \*\SQLExpress MYSERVER\\\* |
+| omitobjlist.txt | Contains a list of object to exclude from showing up in reports, search results and activity summaries. Audit data, however, will still be collected and saved to Long-Term Archive. This omit list doesn't affect SELECT statements auditing, data changes auditing and logon activity auditing. Use the _omitlogonlist.txt_ to exclude logon activity from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | `object_type_name` Available object types can be found in the "Object type" column in reports. For example: `Database` `Column` |
+| omitpathlist.txt | Specify the resource paths to objects that you want to exclude from showing up in search, reports and activity summaries. Audit data, however, will still be collected and saved to Long-Term Archive. This omit list doesn't affect triggerless data collection mode, SELECT statements auditing and logon activity auditing. Use the _omitlogonlist.txt_ to exclude logon activity from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | `server_instance:resource_path` where: - `server_instance` — SQL Server instance, use \* for all servers - `resource_path` — resource path as shown in the "**What**" column of SQL Server report, or in search results Wildcard \* is supported and can replace any part of the path. For example, to exclude information about databases whose names start with "tmp" on the SQL Server instance "PROD.SQL2012": `PROD.SQL2012:Databases\tmp*`. |
+| omitproplist.txt | Contains a list of attributes to be excluded from being monitored and stored to the Audit Archive. | `object_type_name.property_name.attribute_name` where: - `object_type_name`—Can be found in the found in the Object Type column in change reports. - `property_name`—Can be found in the Details column (property name is bold). - `attribute_name`—Can be found in the Details column (attribute name isn't bold). If an object doesn't have an attribute name, use the \* character. For example to exclude information about the Size attribute of the Database File property in all databases: `Database.Database File.Size`. |
+| omitstorelist.txt | Contains a list of SQL Server objects that you want to exclude from data collection and reporting. This list is only relevant to operations with SQL Server objects; it doesn't affect triggerless data collection mode, SELECT statements auditing and logon activity auditing. To configure exclusions for logon activity auditing (Windows or SQL logons), use the _omitlogonlist.txt_. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | `server_instance:resource_path` where: - `server_instance` — SQL Server instance. For all instances, use wildcard (\*). - ` resource_path` — path as shown in the "**What**" column of SQL Server report, or in search results. Wildcard (\*) Use replace any number of characters. For example, to exclude information about server roles on the SQL Server instances whose names start with _njsqlsrv23_, enter: `njsqlsrv23*:Security\Server Roles\*` |
+| omittracelist.txt | If you don't want the product to enable SQL tracing on some of your SQL Server instances, specify their names in this omitlist. In this case the "Who", "Workstation" and "When" values will not be reported correctly (except for content changes). This omit list doesn't affect triggerless data collection mode, SELECT statements auditing and logon activity auditing. Use the _omitlogonlist.txt_ to exclude logon activity from monitoring. Use the _omitreadaccess.txt_ to exclude SELECT statements from monitoring. | Enter the name of SQL Server instance, use \* for all servers: `server\instance name` Wildcard (\*) is supported and can replace any number of characters, e.g., MYSERVER_SQL\* Examples: \* \*\SQLExpress MYSERVER\\\* |
| propnames.txt | Contains a list of human-readable names for object types and properties to be displayed in the change reports. | `object_type_name.property_name=friendlyname` For example: `*.Date modified=Modification Time` |
diff --git a/docs/auditor/10.8/admin/monitoringplans/vmware/overview.md b/docs/auditor/10.8/admin/monitoringplans/vmware/overview.md
index c0822036b6..60330240a5 100644
--- a/docs/auditor/10.8/admin/monitoringplans/vmware/overview.md
+++ b/docs/auditor/10.8/admin/monitoringplans/vmware/overview.md
@@ -6,8 +6,7 @@ sidebar_position: 190
# VMware
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
-the following topics:
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
collection and activity monitoring configure necessary protocols and ports for inbound and
@@ -26,7 +25,9 @@ For this data source, specify the options you need:
| Monitor VMware configuration changes | Configuration changes are always monitored for VMware data source. See the Data Collection from VMware Servers topic for additional information. |
| Monitor VMware logon activity | Specify what types of logon events you want to monitor for VMware infrastructure. |
| Monitor SSO users/groups on vCenter and Local users on ESXi sever | Select Enable monitoring if you want to audit the following users and groups: - vCenter Single Sign-On (SSO) Users. The product collects data from vCenter. - Localos users. For these users, the product collects data from ESXi and vCenter. - VMware groups. The product collects data from vCenter. To audit users and groups, vCenter 6.5 and above required. Check that your data collecting account has all required rights and permissions. See the [Permissions for VMware Server Auditing ](/docs/auditor/10.8/configuration/vmware/permissions.md) topic for additional information. |
-| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your VMware system configuration required for further state-in-time reports generation. The product updates the latest snapshot on the regular basis to keep users up-to-date on actual system state. Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. To import snapshots, you must be assigned the Global administrator or the Global reviewer role . Follow the steps to import snapshots. **Step 1 –** In the Manage historical snapshots section, click Manage. **Step 2 –** Select the snapshots that you want to import. **Step 3 –** Move the selected snapshots to the Snapshots available for reporting list using the arrow button. **Step 4 –** When finished, click OK. |
+| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your VMware system configuration required for further state-in-time reports generation. The product updates the latest snapshot on the regular basis to keep users up-to-date on actual system state. Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. To import snapshots, you must be assigned the Global administrator or the Global reviewer role:
+
+**Step 1 –** In the Manage historical snapshots section, click Manage. **Step 2 –** Select the snapshots that you want to import. **Step 3 –** Move the selected snapshots to the Snapshots available for reporting list using the arrow button. **Step 4 –** When finished, click OK. |
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the **Data source** list. As a next step, click **Add item** to specify an
@@ -50,7 +51,7 @@ Netwrix administrator does the following:
- Creates a monitoring plan in Netwrix Auditor, specifying the service account (prepared at step 1)
as a data collecting account in the **Monitoring Plan wizard**. Then s/he adds items to the
monitoring plan – these are VMware servers to collect data from.
-- Configures alerts related to VMware data source. Current version does not include predefined
+- Configures alerts related to VMware data source. Current version doesn't include predefined
alerts for that data source, so follow the [Create Alerts](/docs/auditor/10.8/admin/alertsettings/create/create.md) to
create and configure the necessary alerts.
@@ -94,4 +95,4 @@ Complete the following fields:
| Specify VMware ESX, ESXi, or vCenter for monitoring | Specify the ESX or ESXi host URL, or vCenter Server URL. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. A custom account must be granted the same permissions and access rights as the default account used for data collection. See [Permissions for VMware Server Auditing ](/docs/auditor/10.8/configuration/vmware/permissions.md)topic for more information. |
| **Virtual Machines** | |
-| Specify monitoring restrictions | Select the virtual machines to be excluded from search results, reports and Activity Summaries. To add VMs to the list, click Add. Then provide the full path of the machine to exclude. Consider the following: - To exclude a single VM, provide its full path as shown in the "_What_" column of reports and Activity Summary, for example: _Vcenters\VCenterServer021\VMs\vm01_. - To exclude several VMs, you can define a mask using a wildcard, for example: - _\*\TestVM\*_ — exclude VMs with names starting with _TestVM_ (e.g., _TestVM01, TestVM_new_), located anywhere. - _\*TestVM\*_ — exclude VMs with names containing _TestVM_ (e.g., _MyTestVM02_). In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Select the virtual machines to be excluded from search results, reports, and Activity Summaries. To add VMs to the list, click Add. Then provide the full path of the machine to exclude. Consider the following: - To exclude a single VM, provide its full path as shown in the "_What_" column of reports and Activity Summary, for example: _Vcenters\VCenterServer021\VMs\vm01_. - To exclude several VMs, you can define a mask using a wildcard, for example: - _\*\TestVM\*_ — exclude VMs with names starting with _TestVM_ (e.g., _TestVM01, TestVM_new_), located anywhere. - _\*TestVM\*_ — exclude VMs with names containing _TestVM_ (e.g., _MyTestVM02_). In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
diff --git a/docs/auditor/10.8/admin/monitoringplans/vmware/scope.md b/docs/auditor/10.8/admin/monitoringplans/vmware/scope.md
index f0b93193db..31844c2f3b 100644
--- a/docs/auditor/10.8/admin/monitoringplans/vmware/scope.md
+++ b/docs/auditor/10.8/admin/monitoringplans/vmware/scope.md
@@ -6,10 +6,7 @@ sidebar_position: 10
# VMware Monitoring Scope
-You can fine-tune Netwrix Auditor by specifying various data types that you want to exclude/include
-from/in the VMware reports.
-
-Follow the steps to exclude data from the VMware monitoring scope:
+To exclude data from the VMware monitoring scope, fine-tune Netwrix Auditor by specifying various data types you want to exclude/include:
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Vmware Auditing_ folder.
diff --git a/docs/auditor/10.8/admin/monitoringplans/windows/overview.md b/docs/auditor/10.8/admin/monitoringplans/windows/overview.md
index 4fc9eed7fe..8c7fe5894b 100644
--- a/docs/auditor/10.8/admin/monitoringplans/windows/overview.md
+++ b/docs/auditor/10.8/admin/monitoringplans/windows/overview.md
@@ -6,8 +6,7 @@ sidebar_position: 200
# Windows Server
-**NOTE:** Prior to configuring your monitoring plan, please read and complete the instructions in
-the following topics:
+**NOTE:** Before configuring your monitoring plan, read and complete the instructions in the following topics:
- [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) – To ensure successful data
collection and activity monitoring configure necessary protocols and ports for inbound and
@@ -26,10 +25,10 @@ Complete the following fields:
| Monitor this data source and collect activity data | Enable monitoring of the selected data source and configure Auditor to collect and store audit data. |
| Monitor changes to system components | Select the system components that you want to audit for changes. Review the following for additional information: - General computer settings—Enables auditing of general computer settings. For example, computer name or workgroup changes. - Hardware—Enables auditing of hardware devices configuration. For example, your network adapter configuration changes. - Add/Remove programs—Enables auditing of installed and removed programs. For example, Microsoft Office package has been removed from the audited Windows Server. - Services—Enables auditing of started/stopped services. For example, the Windows Firewall service stopped. - Audit policies—Enables auditing of local advanced audit policies configuration. For example, the Audit User Account Management advanced audit policy is set to "_Failure_". - DHCP configuration—Enables auditing of DHCP configuration changes. - Scheduled tasks—Enables auditing of enabled / disabled / modified scheduled tasks. For example, the GoogleUpdateTaskMachineUA scheduled task trigger changes. - Local users and groups—Enables auditing of local users and groups. For example, an unknown user was added to the Administrators group. - DNS configuration—Enables auditing of your DNS configuration changes. For example, your DNS security parameters' changes. - DNS resource records—Enables auditing of all types of DNS resource records. For example, A-type resource records (Address record) changes. - File shares—Enables auditing of created / removed / modified file shares and their properties. For example, a new file share was created on the audited Windows Server. - Removable media—Enables auditing of USB thumb drives insertion. |
| Specify data collection method | You can enable **network traffic compression.** If enabled, a Compression Service will be automatically launched on the audited computer, collecting and prefiltering data. This significantly improves data transfer and minimizes the impact on the target computer performance. |
-| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Do not select the checkbox if you want to configure audit settings manually. See the [Windows Server](/docs/auditor/10.8/configuration/windowsserver/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
-| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.8/admin/reports/types/stateintime/overview.md) topic for additional information. When auditing file servers, changes to effective access permissions can be tracked in addition to audit permissions. By default, Combination of file and share permissions is tracked. File permissions define who has access to local files and folders. Share permissions provide or deny access to the same resources over the network. The combination of both determines the final access permissions for a shared folder—the more restrictive permissions are applied. Upon selecting Combination of file and share permissions only the resultant set will be written to the Audit Database. Select File permissions option too if you want to see difference between permissions applied locally and the effective file and share permissions set. To disable auditing of effective access, unselect all checkboxes under Include details on effective permissions. In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select day(s) of week you want your snapshot to be collected. In the Manage historical snapshots section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must be assigned the Global administrator or the Global reviewer role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot on the regular basis to keep users up to date on actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. |
+| Configure audit settings | You can adjust audit settings automatically. Your current audit settings will be checked on each data collection and adjusted if necessary. This method is recommended for evaluation purposes in test environments. If any conflicts are detected with your current audit settings, automatic audit configuration will not be performed. Don't select the checkbox if you want to configure audit settings manually. See the [Windows Server](/docs/auditor/10.8/configuration/windowsserver/overview.md) configuration topic for additional information about audit settings required to collect comprehensive audit data and the instructions on how to configure them. |
+| Collect data for state-in-time reports | Configure Auditor to store daily snapshots of your system configuration required for further state-in-time reports generation. See the [State–In–Time Reports](/docs/auditor/10.8/admin/reports/types/stateintime/overview.md) topic for additional information. When auditing file servers, changes to effective access permissions can be tracked in addition to audit permissions. By default, Combination of file and share permissions is tracked. File permissions define who has access to local files and folders. Share permissions provide or deny access to the same resources over the network. The combination of both determines the final access permissions for a shared folder—the more restrictive permissions are applied. Upon selecting Combination of file and share permissions only the resultant set will be written to the Audit Database. Select File permissions option too if you want to see difference between permissions applied locally and the effective file and share permissions set. To disable auditing of effective access, unselect all checkboxes under Include details on effective permissions. In the Schedule state-in-time data collection section, you can select a custom weekly interval for snapshots collection. Click Modify and select days of week you want your snapshot to be collected. In the Manage historical snapshots section, you can click **Manage** and select the snapshots that you want to import to the Audit Database to generate a report on the data source's state at the specific moment in the past. You must be assigned the Global administrator or the Global reviewer role to import snapshots. Move the selected snapshots to the Snapshots available for reporting list using the arrow button. The product updates the latest snapshot on the regular basis to keep users up to date on actual system state. Users can also configure Only the latest snapshot is available for reporting in Auditor. If you want to generate reports based on different snapshots, you must import snapshots to the Audit Database. |
| Activity | |
-| Specify monitoring restrictions | Specify restriction filters to narrow your Windows Server monitoring scope (search results, reports and Activity Summaries). For example, you can exclude system activity on a particular objects on all computers. All filters are applied using AND logic. Click Add and complete the following fields: - User who initiated the change: – provide the name of the user whose changes you want to ignore as shown in the "_Who_" column of reports and Activity Summaries. Example: _mydomain\user1_. You can provide the "_System_" value to exclude events containing the “_System_” instead of an account name in the “_Who_” column. - Windows Server which setting was changed: – provide the name of the server in your IT infrastructure whose changes you want to ignore as shown in the "_What_" column of reports and Activity Summaries. Example: _winsrv2016-01.mydomain.local_. - Setting changed: – provide the name for unwanted settings as shown in the "_What_" column in reports and Activity Summaries. Example: _System Properties\*_. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your Windows Server monitoring scope (search results, reports, and Activity Summaries). For example, you can exclude system activity on a particular objects on all computers. All filters are applied using AND logic. Click Add and complete the following fields: - User who initiated the change: – provide the name of the user whose changes you want to ignore as shown in the "_Who_" column of reports and Activity Summaries. Example: _mydomain\user1_. You can provide the "_System_" value to exclude events containing the “_System_” instead of an account name in the “_Who_” column. - Windows Server which setting was changed: – provide the name of the server in your IT infrastructure whose changes you want to ignore as shown in the "_What_" column of reports and Activity Summaries. Example: _winsrv2016-01.mydomain.local_. - Setting changed: – provide the name for unwanted settings as shown in the "_What_" column in reports and Activity Summaries. Example: _System Properties\*_. You can use a wildcard (\*) to replace any number of characters in filters. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
Review your data source settings and click **Add** to go back to your plan. The newly created data
source will appear in the **Data source** list. As a next step, click **Add item** to specify an
@@ -71,11 +70,11 @@ Complete the following fields:
| Option | Description |
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General | |
-| Specify AD container | Specify a whole AD domain, OU or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you do not want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers does not include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
+| Specify AD container | Specify a whole AD domain, OU, or container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be audited within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify AD domains, OUs, and containers you don't want to audit. In the Exclude Containers dialog, click Add and specify an object. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer, IP range** to specify the target computers. |
| Specify the account for collecting data | Select the account that will be used to collect data for this item. If you want to use a specific account (other than the one you specified during monitoring plan creation), select **Custom account** and enter credentials. The credentials are case sensitive. If using a group Managed Service Account (gMSA), you can specify only the account name in the _domain\account$_ format. Password field can be empty. Starting with version 10.7, you can implement the integration between Netwrix Auditor and Netwrix Privilege Secure. See the [Netwrix Privilege Secure](/docs/auditor/10.8/admin/settings/privilegesecure.md) topic for additional information. Refer to the [Permissions for Active Directory Auditing](/docs/auditor/10.8/configuration/activedirectory/permissions.md) topic for more information on using Netwrix Privilege Secure as an account for data collection. A custom account must be granted the same permissions and access rights as the default account used for data collection. See the[Data Collecting Account](/docs/auditor/10.8/admin/monitoringplans/dataaccounts.md) topic for additional information. |
| Containers and Computers | |
| Monitor hidden shares | By default, Auditor will monitor all shares stored in the specified location, except for hidden shares (both default and user-defined). Select **Monitor user-defined hidden shares** if necessary. Even when this option is selected, the product will not collect data from administrative hidden shares such as: default system root or Windows directory (ADMIN$), default drive shares (D$, E$, etc.), shares used by printers to enable remote administration (PRINT$), etc. |
-| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU or container. - Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) are not supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. Note that the new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
+| Specify monitoring restrictions | Specify restriction filters to narrow your monitoring scope (search results, reports, and Activity Summaries). All filters are applied using AND logic. Depending on the type of the object you want to exclude, select one of the following: - Add AD Container – Browse for a container to be excluded from being audited. You can select a whole AD domain, OU, or container. - Add Computer – Provide the name of the computer you want to exclude as shown in the "_Where_" column of reports and Activity Summaries. For example, _backupsrv01.mydomain.local_. Wildcards (\*) aren't supported. In addition to the restrictions for a monitoring plan, you can use the \*.txt files to collect more granular audit data. The new monitoring scope restrictions apply together with previous exclusion settings configured in the \*.txt files. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md)topic for additional information. |
## Use Netwrix Privilege Secure as a Data Collecting Account
@@ -86,9 +85,9 @@ integration and supported data sources. In this case, the credentials will not b
Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand, ensuring
password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
+To use Netwrix Privilege Secure as an account for data collection.
-**Step 1 –** Select the desired item.
+**Step 1 –** Select the item you want to configure.
**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
collection.
@@ -96,9 +95,7 @@ collection.
**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
-Credential-based is the default option. Refer to the
-[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+Credential-based is the default option. Refer to the [Netwrix Privilege Secure Access Policies documentation](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement) for details.
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
@@ -109,7 +106,7 @@ sources.
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.8/admin/monitoringplans/windows/scope.md b/docs/auditor/10.8/admin/monitoringplans/windows/scope.md
index c74c2a2d14..e199686d19 100644
--- a/docs/auditor/10.8/admin/monitoringplans/windows/scope.md
+++ b/docs/auditor/10.8/admin/monitoringplans/windows/scope.md
@@ -9,7 +9,7 @@ sidebar_position: 10
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Windows
Server monitoring scope.
-Follow the steps to exclude data from the Windows Server monitoring scope:
+To exclude data from the Windows Server monitoring scope:
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Windows Server Auditing_ folder.
@@ -22,8 +22,8 @@ Follow the steps to exclude data from the Windows Server monitoring scope:
| File | Description | Syntax |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| omitcollectlist.txt | Contains a list of objects and their properties to be excluded from being monitored. If you want to restart monitoring these objects, remove them from the omitcollectlist.txt and run data collection at least twice. | `monitoring plan name,server name,class name,property name,property value` `class name` is a mandatory parameter, it cannot be replaced with a wildcard. `property name` and `property value` are optional, but cannot be replaced with wildcards either. For example: `#*,server,MicrosoftDNS_Server `````` #*,*,StdServerRegProv` |
+| omitcollectlist.txt | Contains a list of objects and their properties to be excluded from being monitored. If you want to restart monitoring these objects, remove them from the omitcollectlist.txt and run data collection at least twice. | `monitoring plan name,server name,class name,property name,property value` `class name` is a mandatory parameter, it can't be replaced with a wildcard. `property name` and `property value` are optional, but can't be replaced with wildcards either. For example: `#*,server,MicrosoftDNS_Server `````` #*,*,StdServerRegProv` |
| omiterrors.txt | Contains a list of errors/warnings to be omitted from logging to the Netwrix Auditor System Health event log. | `monitoring plan name,server name,error text` For example: `*,productionserver1.corp.local,*Access is denied*` |
| omitreportlist.txt | Contains a list of objects to be excluded from reports and Activity Summary emails. In this case audit data is still being collected. | `monitoring plan name,who,where,object type,what,property name` For example: `*,CORP\\jsmith,*,*,*,*` |
-| omitsitcollectlist.txt | Contains a list of objects to be excluded from State-in-time reports. | `monitoring planname,server name,class name,property name,property value` `class name` is a mandatory parameter, it cannot be replaced with a wildcard. `property name` and `property value` are optional, but cannot be replaced with wildcards either. For example: `*,server,MicrosoftDNS_Server` `*,*,StdServerRegProv` |
+| omitsitcollectlist.txt | Contains a list of objects to be excluded from State-in-time reports. | `monitoring planname,server name,class name,property name,property value` `class name` is a mandatory parameter, it can't be replaced with a wildcard. `property name` and `property value` are optional, but can't be replaced with wildcards either. For example: `*,server,MicrosoftDNS_Server` `*,*,StdServerRegProv` |
| omitstorelist.txt | Contains a list of objects to be excluded from being stored to the Audit Archive and showing up in reports. In this case audit data is still being collected. | `monitoring plan name,who,where,object type,what,property name` For example: `*,*,*,Scheduled task,Scheduled Tasks\\User_Feed_Synchronization*,*` |
diff --git a/docs/auditor/10.8/admin/navigation/customizeexamples.md b/docs/auditor/10.8/admin/navigation/customizeexamples.md
index 7d19f5723d..85e99e0497 100644
--- a/docs/auditor/10.8/admin/navigation/customizeexamples.md
+++ b/docs/auditor/10.8/admin/navigation/customizeexamples.md
@@ -10,7 +10,7 @@ Here are several examples of why and how you might customize the Netwrix Auditor
## View Report and Add to Favorites
-Follow the steps to view a report and add it to the list of Favorites.
+To view a report and add it to your favorites:
**Step 1 –** On the main Auditor page, click the Reports tile in the upper left corner.
@@ -28,7 +28,7 @@ The report is added to the Favorite reports section on the home page and you can
## Run Search and Create Alert
-Follow the steps to run search and create the alert based on the search filters.
+To run a search and create an alert based on the search filters:
**Step 1 –** On the main Auditor page, click the Search Activity Records tile.
@@ -51,7 +51,7 @@ on the home page, which opens the Alerts overview dashboard.
## Review and Pin Risks
-Follow the steps to review risks and pin important ones to the Home Screen.
+To review risks and pin important ones to the home screen:
**Step 1 –** On the main Auditor page, click the Risk Assessment tile.
@@ -72,7 +72,7 @@ such as "_User Accounts with administrative permissions_". See the
The selected risks group is added to the home screen.
-## What is Next?
+## What's Next
Personalize the home page of the product depending on your business needs. Review the customization
settings and collect only required tiles for quick access on the Auditor home page. See the
diff --git a/docs/auditor/10.8/admin/navigation/customizefavorite.md b/docs/auditor/10.8/admin/navigation/customizefavorite.md
index a2f5fa74c3..b3454639fc 100644
--- a/docs/auditor/10.8/admin/navigation/customizefavorite.md
+++ b/docs/auditor/10.8/admin/navigation/customizefavorite.md
@@ -6,17 +6,16 @@ sidebar_position: 30
# Customizing Favorite Reports
-The Favorite reports tile displays a shortened list of your favorite reports. To view, edit or
+The Favorite reports tile displays a shortened list of your favorite reports. To view, edit, or
update the full list, click View all.
-The Home > Reports page opens. This page includes several folders: Favorites, Predefined, Compliance
-and Custom. Favorite reports are located in the Favorites folder.
+The Home > Reports page opens. This page includes several folders: Favorites, Predefined, Compliance, and Custom. Favorite reports are located in the Favorites folder.
-Follow the steps to add or remove a Favorite report
+To add or remove a favorite report:
-**Step 1 –** Locate the desired report in one of the other folders.
+**Step 1 –** Locate the report in one of the other folders.
**Step 2 –** Click the name of the report to view its description.
diff --git a/docs/auditor/10.8/admin/navigation/customizehome.md b/docs/auditor/10.8/admin/navigation/customizehome.md
index 75c46d5824..604c38f091 100644
--- a/docs/auditor/10.8/admin/navigation/customizehome.md
+++ b/docs/auditor/10.8/admin/navigation/customizehome.md
@@ -14,24 +14,23 @@ make to the home screen.
## Add a Tile to the Home Screen
-Follow the steps to add tile on the Home Screen.
+To add a tile to the home screen:
**Step 1 –** Click Customize in the upper right corner of the home screen.
**Step 2 –** Select Add tile.
-Either search for the tile you want by name, or select it from the list of tiles. Note that tiles
-are grouped into menus; to view all tiles within a menu, check Show all menu tiles.
+Either search for the tile you want by name, or select it from the list of tiles. Tiles are grouped into menus; to view all tiles within a menu, check **Show all menu tiles**.
**Step 3 –** Click Add and the selected tile appears on the home screen.
-**Step 4 –** Drag and drop it to the desired location.
+**Step 4 –** Drag and drop it to where you want to place it.
**Step 5 –** Click Apply.
## Remove a Tile from the Home Screen
-Follow the steps to remove a tile from the Home Screen.
+To remove a tile from the home screen:
**Step 1 –** Click Customize in the upper right corner of the home screen.
@@ -48,12 +47,12 @@ Follow the steps to remove a tile from the Home Screen.
You can change the size of the tile to plan your screen placement and view detailed information on
what you are interested in. There are several types of size: small, medium, wide, large, extra
large, extra tall. However, not every tile supports all types of sizes. Tiles with graphic
-information have medium, large and extra large sizes. These sizes provide more screen space,
+information have medium, large, and extra large sizes. These sizes provide more screen space,
resulting in a better visual representation of data. Additionally, tiles with less information have
small and wide sizes. They are designed to open separate windows, providing easy access to features
such as search, reports, and live news updates.
-Follow the steps to resize a tile.
+To resize a tile:
**Step 1 –** Click Customize in the upper right corner of the home screen.
@@ -63,11 +62,11 @@ Follow the steps to resize a tile.
-**Step 4 –** Select the preferred size from the drop-down list.
+**Step 4 –** Select the preferred size from the dropdown list.
## Restore the Default View
-Follow the steps to restore the default Home Screen view.
+To restore the default home screen view:
**Step 1 –** Click Customize in the upper right corner of the Home Screen.
diff --git a/docs/auditor/10.8/admin/navigation/overview.md b/docs/auditor/10.8/admin/navigation/overview.md
index 2b43ac15b6..c21d93f186 100644
--- a/docs/auditor/10.8/admin/navigation/overview.md
+++ b/docs/auditor/10.8/admin/navigation/overview.md
@@ -13,8 +13,7 @@ illustrates the customization process with several common scenarios.
## Home Screen Tiles
-Home Screen Tiles in the Netwrix Auditor provide an interface that allows users to access main
-information. The following tiles are displayed on the initially configured Home Screen:
+Home Screen Tiles in the Netwrix Auditor help you access main information. The following tiles are displayed on the initially configured Home Screen:
- Welcome to Netwrix Auditor Tile
- Audit Intelligence Tiles
@@ -65,8 +64,8 @@ following links:
| Option | Description |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Monitoring plans | Opens the Monitoring plans wizard, where you can add, edit and delete monitoring plans, as well as group them into folders. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md) topic for additional information. |
-| Subscriptions | Opens the Subscriptions wizard, which enables you to subscribe to Auditor reports and searches, so you can easily stay informed about what is going on in your infrastructure. See the [Subscriptions](/docs/auditor/10.8/admin/subscriptions/overview.md) topic for additional information. |
+| Monitoring plans | Opens the Monitoring plans wizard, where you can add, edit, and delete monitoring plans, as well as group them into folders. See the [Monitoring Plans](/docs/auditor/10.8/admin/monitoringplans/overview.md) topic for additional information. |
+| Subscriptions | Opens the Subscriptions wizard, which lets you subscribe to Auditor reports and searches, so you can easily stay informed about what is going on in your infrastructure. See the [Subscriptions](/docs/auditor/10.8/admin/subscriptions/overview.md) topic for additional information. |
| Alert settings | Opens the All Alerts wizard, where you can create, edit, and enable or disable alerts on critical events in your environment. See the [Alerts](/docs/auditor/10.8/admin/alertsettings/overview.md)topic for additional information. |
## Risk Assessment, Compliance Mapping, Live News, and Health Tiles
@@ -74,14 +73,14 @@ following links:
| Tile | Description |
| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| RISK ASSESSMENT | Opens the Risk Assessment Overview dashboard, which identifies possible configuration issues in your environment that could impact security. See the [IT Risk Assessment Overview ](/docs/auditor/10.8/admin/riskassessment/overview.md) topic for additional information. |
-| COMPLIANCE MAPPING | Enables you to review how Auditor can help you comply common standards and regulations. See the [Compliance Mappings](/docs/auditor/10.8/admin/compliancemappings.md) topic for additional information. |
+| COMPLIANCE MAPPING | Let you review how Auditor can help you comply common standards and regulations. See the [Compliance Mappings](/docs/auditor/10.8/admin/compliancemappings.md) topic for additional information. |
| LIVE NEWS | Shows the latest Netwrix news, including product updates. |
-| HEALTH STATUS | Opens the Health Status dashboard, which provides at-a-glance insight into product health, data collection, storage and more. See the [Health Status Dashboard](/docs/auditor/10.8/admin/healthstatus/dashboard/overview.md) topic for additional information. |
+| HEALTH STATUS | Opens the Health Status dashboard, which provides at-a-glance insight into product health, data collection, storage, and more. See the [Health Status Dashboard](/docs/auditor/10.8/admin/healthstatus/dashboard/overview.md) topic for additional information. |
| ALERTS HISTORY | Clicking this tile opens the Alerts History dashboard, which provides detailed information about the latest alerts triggered in your IT infrastructure, enriched with actionable charts and timelines. See the [Alerts Overview Dashboard](/docs/auditor/10.8/admin/alertsettings/dashboard.md) topic for additional information. |
## Favorite Reports
-Initially, the Favorite Reports tile lists the reports that our customers use most frequently. You
+Initially, the Favorite Reports tile lists the reports that customers use most frequently. You
can add and remove reports to reflect your needs and interests. If you have more favorite reports
than can fit in the tile, simply click **View all** to see the complete list. See the
[Customizing Favorite Reports](/docs/auditor/10.8/admin/navigation/customizefavorite.md) topic for additional information.
diff --git a/docs/auditor/10.8/admin/navigation/recommendations.md b/docs/auditor/10.8/admin/navigation/recommendations.md
index 5f4cff1b9e..956aa41d22 100644
--- a/docs/auditor/10.8/admin/navigation/recommendations.md
+++ b/docs/auditor/10.8/admin/navigation/recommendations.md
@@ -7,21 +7,21 @@ sidebar_position: 10
# Recommendations
This section covers the Recommendations interface that contains detailed guidance on the Auditor
-usage patterns. Once you installed the product, configured your IT infrastructure, and prepared
+usage patterns. After installing the product, configured your IT infrastructure, and prepared
Netwrix Service Accounts, you can start collecting data and review it with Netwrix Auditor. The
recommendations are based on your current product configuration and help you to experience the
Auditor capabilities in earnest.
-Follow the steps to review the recommendations provided by Netwrix industry experts.
+To review the recommendations provided by Netwrix industry experts.
**Step 1 –** On the Auditor home page, click the **Recommendations** tile.
**Step 2 –** Review the recommendations applicable to your current Auditor configuration and take
required steps.
-Once the required steps are done, the recommendation goes to the '**Complete**' list. You can move
+After the required steps are done, the recommendation goes to the '**Complete**' list. You can move
it back to the active state any time you want by clicking the **Move to active** link.
## Available Recommendations
@@ -99,7 +99,7 @@ For completed recommendations, you can configure the retention period to keep th
select their categories for further displaying on the tile. If you want to proceed with a completed
recommendation, click the '**Move to active**' link below the recommendation.
-Follow the steps to manage recommendations:
+## Manage Recommendations Procedure
**Step 1 –** On the Auditor home page, click the **Recommendations** tile.
diff --git a/docs/auditor/10.8/admin/reports/custom.md b/docs/auditor/10.8/admin/reports/custom.md
index f3ef93c961..2d4cffab75 100644
--- a/docs/auditor/10.8/admin/reports/custom.md
+++ b/docs/auditor/10.8/admin/reports/custom.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Custom Search-Based Reports
-Netwrix Auditor allows you to save your favorite searches as reports to access them instantly. For
+Save your favorite searches as reports in Netwrix Auditor to access them instantly. For
your convenience, the product provides predefined templates for some popular usage scenarios. You
can save your custom report or use one of the templates provided by Netwrix. Navigate to Reports →
Custom to review these reports. Click View to generate the selected report.
@@ -38,7 +38,7 @@ Review the following for additional information:
audit data.
3. Navigate to Tools and select Save as report.
-4. In the Specify a name for your custom report dialog, specify a name. Make sure to specify a
+4. In the Specify a name for your custom report dialog, specify a name. Ensure to specify a
unique name.
## To modify a custom report
diff --git a/docs/auditor/10.8/admin/reports/reviewstatus.md b/docs/auditor/10.8/admin/reports/reviewstatus.md
index 285e023727..c99005b015 100644
--- a/docs/auditor/10.8/admin/reports/reviewstatus.md
+++ b/docs/auditor/10.8/admin/reports/reviewstatus.md
@@ -9,8 +9,7 @@ sidebar_position: 20
Change management is one of the critical processes for many companies referring to such areas as
requesting, planning, implementing, and evaluating changes to various systems. For your change
management workflow, Netwrix Auditor offers several reports with interactive capabilities – not only
-they list changes in your infrastructure but also allow you to track, analyze, assign appropriate
-status and comment on these changes.
+they list changes in your infrastructure but also let you track, analyze, assign appropriate status, and comment on these changes.
This capability can supplement your organization's workflow of monitoring and resolving potential
issues through the following automated course of action:
@@ -21,7 +20,7 @@ issues through the following automated course of action:
.
In the **Review status** dialog for the selected change, set its status to In Review and provide a
reason.
-3. Once the change has been approved or rolled back, you can set its status to Resolved.
+3. When the change has been approved or rolled back, you can set its status to Resolved.
This capability is supported for the following reports:
diff --git a/docs/auditor/10.8/admin/reports/types/compliance.md b/docs/auditor/10.8/admin/reports/types/compliance.md
index ecb234e6d6..9b2dc7d223 100644
--- a/docs/auditor/10.8/admin/reports/types/compliance.md
+++ b/docs/auditor/10.8/admin/reports/types/compliance.md
@@ -21,8 +21,8 @@ standards and regulations, including but not limited to:
- SOX
- CJIS
-Each compliance folder provides overview on a selected standard, to read it, click on the folder
-name. Click Read More to learn more about mapping between these standards and Auditor reports.
+Each compliance folder provides overview on a selected standard, to read it, click the folder
+name. See [Compliance Mappings](/docs/auditor/10.8/admin/compliancemappings.md) for details on how Auditor reports align with these standards.
In the report filters, select a monitoring plan you want to generate a report for. To review data
sources and items included in each plan, navigate to the Monitoring Plans section.
diff --git a/docs/auditor/10.8/admin/reports/types/datadiscoveryclassification.md b/docs/auditor/10.8/admin/reports/types/datadiscoveryclassification.md
index 2e39dc6992..856ac4bc07 100644
--- a/docs/auditor/10.8/admin/reports/types/datadiscoveryclassification.md
+++ b/docs/auditor/10.8/admin/reports/types/datadiscoveryclassification.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Data Discovery and Classification Reports
-Follow these steps to review Data Discovery and Classification reports:
+To review Data Discovery and Classification reports:
**Step 1 –** Navigate to **Reports > Data Discovery and Classification** and select a report you
are interested in.
@@ -36,19 +36,19 @@ The table below lists the reports available for Data Discovery and Classificatio
| Activity Related to Sensitive Data Objects | This report shows changes and read operations on SharePoint sites and documents that contain sensitive information. Use this report to detect suspicious activity around your sensitive data. |
| State-in-Time reports | |
| Sensitive Data Objects by Site Collection | For each SharePoint site collection listed, this report shows the categories of sensitive data stored there and the number of documents in each category. Use this report to reveal the number of sensitive files stored in your SharePoint site collections. |
-| Sensitive Data Objects | For each site collection listed, this report shows the SharePoint objects (sites, lists and documents) that have been classified as containing sensitive information. Use this report to plan and control data protection measures for sensitive information stored on your SharePoint. |
-| Sensitive Data Object Permissions | For each SharePoint object (site, list or document) listed, this report shows the user accounts that have access to this object, their effective permissions and how those permissions were granted (for example, permissions can be granted directly, via group membership or using SharePoint policy). Use this report to control access to SharePoint objects that contain sensitive data. |
-| Overexposed Sensitive Data Objects | For each user account listed, this report shows the SharePoint objects (sites, lists and documents) containing sensitive data that the user can access based on their effective permissions. Use this report to identify overexposed data and plan measures to mitigate your risk. |
-| Most Exposed Sensitive Data Objects | This report lists the SharePoint objects (sites, lists and documents) containing sensitive data that can be accessed by the most users (or even Everyone), based on effective permissions. Use this report to identify data at high risk and plan corrective actions. |
+| Sensitive Data Objects | For each site collection listed, this report shows the SharePoint objects (sites, lists, and documents) that have been classified as containing sensitive information. Use this report to plan and control data protection measures for sensitive information stored on your SharePoint. |
+| Sensitive Data Object Permissions | For each SharePoint object (site, list, or document) listed, this report shows the user accounts that have access to this object, their effective permissions and how those permissions were granted (for example, permissions can be granted directly, via group membership or using SharePoint policy). Use this report to control access to SharePoint objects that contain sensitive data. |
+| Overexposed Sensitive Data Objects | For each user account listed, this report shows the SharePoint objects (sites, lists, and documents) containing sensitive data that the user can access based on their effective permissions. Use this report to identify overexposed data and plan measures to mitigate your risk. |
+| Most Exposed Sensitive Data Objects | This report lists the SharePoint objects (sites, lists, and documents) containing sensitive data that can be accessed by the most users (or even Everyone), based on effective permissions. Use this report to identify data at high risk and plan corrective actions. |
| SharePoint Online | |
| Activity reports | |
| Activity Related to Sensitive Data Objects | **Status**: Obsolete. **Replacement**: SharePoint Online > SharePoint Online Activity > Activity Related to Sensitive Data Objects. This report shows changes and read operations on SharePoint Online sites and documents that contain sensitive information. Use this report to detect suspicious activity around your sensitive data. |
| State-in-Time reports | |
| Sensitive Data Objects by Site Collection | For each SharePoint Online site collection listed, this report shows the categories of sensitive data stored there and the number of files in each category. |
-| Sensitive Data Objects | For each site collection listed, this report shows the SharePoint Online objects (sites, lists and documents) that have been classified as containing sensitive information. Use this report to plan and control data protection measures for sensitive information stored on your SharePoint Online. |
+| Sensitive Data Objects | For each site collection listed, this report shows the SharePoint Online objects (sites, lists, and documents) that have been classified as containing sensitive information. Use this report to plan and control data protection measures for sensitive information stored on your SharePoint Online. |
| Sensitive Data Object Permissions | **Status**: Obsolete. **Replacement**: SharePoint Online > SharePoint Online — State-in-Time > SharePoint Online Object Permissions. This report shows user accounts with effective permissions and means granted to access to this object. Permissions may be granted directly, via group membership, or using SharePoint Online policy. |
| Overexposed Sensitive Data Objects | **Status**: Obsolete. **Replacement**: SharePoint Online > SharePoint Online — State-in-Time > Account Permissions in SharePoint Online. This report shows the SharePoint Online objects with sensitive data that a user can access based on effective permissions. This applies to every user account in the list. Use this report to identify overexposed data and plan corrective measures.|
-| Most Exposed Sensitive Data Objects | This report lists the SharePoint Online objects (sites, lists and documents) with sensitive data that can be accessed by the most users (or even Everyone), based on effective permissions. |
+| Most Exposed Sensitive Data Objects | This report lists the SharePoint Online objects (sites, lists, and documents) with sensitive data that can be accessed by the most users (or even Everyone), based on effective permissions. |
| Sensitive Data External Sharing by Site Collection | For each SharePoint Online site collection listed, this report shows the categories of sensitive data shared with users via any level of external sharing. Clicking a link will open the "Sensitive Data Object Permissions" report for the selected site collection. |
diff --git a/docs/auditor/10.8/admin/reports/types/enterprise.md b/docs/auditor/10.8/admin/reports/types/enterprise.md
index c8419a52de..b4c6d174cf 100644
--- a/docs/auditor/10.8/admin/reports/types/enterprise.md
+++ b/docs/auditor/10.8/admin/reports/types/enterprise.md
@@ -7,8 +7,8 @@ sidebar_position: 10
# Enterprise Overview Dashboard
Enterprise Overview dashboard provide a high-level overview of activity trends by date, user,
-server, object type or audited system in your IT infrastructure. They allow you to see the activity
-trends by date, user, object type, server or audited IT system, and drill through to detailed
+server, object type or audited system in your IT infrastructure. They let you see the activity
+trends by date, user, object type, server, or audited IT system, and drill through to detailed
reports for further analysis. The Enterprise diagram aggregates data on all Managed Objects and all
audited systems, while system-specific diagrams provide quick access to important statistics within
one audited system.
@@ -24,7 +24,7 @@ The current version of Netwrix Auditor contains the following diagrams:
- VMware
- Windows Server
-If you are sure that some audit data is missing (e.g., you do not see information on your file
+If you are sure that some audit data is missing (e.g., you don't see information on your file
servers in reports and search results), verify that the Audit Database settings are configured and
that data is written to databases that reside on the default SQL Server instance.
@@ -36,7 +36,7 @@ All diagrams provide the drill-down functionality, which means that by clicking
will be redirected to a report with the corresponding filtering and grouping of data that renders
the next level of detail.
-Follow the steps to review a diagram:
+To review a diagram:
- On the Auditor home screen, click the **Reports** tile and open the Enterprise Overview section.
Click a tile to open a corresponding diagram.
diff --git a/docs/auditor/10.8/admin/reports/types/overview.md b/docs/auditor/10.8/admin/reports/types/overview.md
index 6b2c969f60..9a9cd66db5 100644
--- a/docs/auditor/10.8/admin/reports/types/overview.md
+++ b/docs/auditor/10.8/admin/reports/types/overview.md
@@ -10,8 +10,8 @@ Netwrix Auditor is shipped with 250+ ready-to-use reports designed by Netwrix in
find a report that is right for you, check out the predefined report types available in the product.
- Enterprise Overview—A dashboard with a set of widgets that provide quick access to important
- statistics across the audited IT infrastructure. They allow you to see the activity trends by
- date, user, data source, server or audited IT system, and drill through to detailed reports for
+ statistics across the audited IT infrastructure. You can see the activity trends by
+ date, user, data source, server, or audited IT system, and drill through to detailed reports for
further analysis. The Enterprise Overview dashboard aggregates the information on changes from all
data sources and provides a centralized overview. System-specific dashboards reflect all changes
across all monitoring plans where audit of this target system is enabled. See the
@@ -27,13 +27,13 @@ find a report that is right for you, check out the predefined report types avail
drill through to detailed reports for further analysis.
- Change and activity reports—System-specific reports that aggregate audit data for a specific data
source within specified monitoring plans. These reports show detailed data on changes and activity
- and provide grouping, sorting and filtering capabilities. Each report has a different set of
+ and provide grouping, sorting, and filtering capabilities. Each report has a different set of
filters allowing you to manage collected data in the most convenient way. See the
[Change and Activity Reports](/docs/auditor/10.8/admin/reports/types/activity.md) topic for additional information.
- State-in-time reports—System-specific reports that aggregate data for a specific data source
within a specified individual monitoring plan and allow reviewing the point-in-time state of the
data source. These reports are based on daily snapshots and help you paint a picture of your
- system configuration at a specific moment in time. Currently, the Windows Server State-in-Time
+ system configuration at a specific moment in time. the Windows Server State-in-Time
report set provides baselining functionality that help identify aberrant servers. See the
[State–In–Time Reports](/docs/auditor/10.8/admin/reports/types/stateintime/overview.md) topic for additional information.
- Changes with video reports—Windows server-based reports that provide video recordings of user
diff --git a/docs/auditor/10.8/admin/reports/types/stateintime/activedirectory.md b/docs/auditor/10.8/admin/reports/types/stateintime/activedirectory.md
index dc6118e772..959982e765 100644
--- a/docs/auditor/10.8/admin/reports/types/stateintime/activedirectory.md
+++ b/docs/auditor/10.8/admin/reports/types/stateintime/activedirectory.md
@@ -10,7 +10,7 @@ Examine the Active Directory state-in-time data on the user account attributes:
- User Accounts - Attributes
-To instruct Netwrix Auditor to collect data needed for the report, make sure that **Collect data for
+To instruct Netwrix Auditor to collect data needed for the report, ensure that **Collect data for
state-in-time reports** option is selected in the corresponding monitoring plan properties. See the
[Settings for Data Collection](/docs/auditor/10.8/admin/monitoringplans/create.md#settings-for-data-collection)
topic for additional information.
@@ -43,7 +43,7 @@ topic for additional information.
6. If you have more than 2000 entities within the report scope, sorting might work incorrectly.
Apply filters to narrow your report scope.
-Please consider that if you are going to export the report in .csv format or want to subscribe to
+consider that if you are going to export the report in .csv format or want to subscribe to
the .csv report, the file will contain the full list of available attributes regardless of which
filters you specified.
@@ -65,7 +65,7 @@ filters and values:
### Reported Data
-For the account(s) you selected using filters, the summary section includes:
+For the accounts you selected using filters, the summary section includes:
- **Total account count** — total number of accounts that meet selected filtering criteria.
- **Enabled accounts** —total number of enabled accounts that meet selected filtering criteria.
@@ -103,7 +103,7 @@ The following account attributes are reported:
| ZIP/postal code | Equals the Postal-Code attribute. See the corresponding Microsoft article for more information: [Postal-Code attribute](https://docs.microsoft.com/en-us/windows/win32/adschema/a-postalcode). | Example: _61441_ | + |
| Country/region | Shows the country/region in which the user is located. | Example: _Ireland_ | + |
| Security | | | |
-| Account cannot be delegated | Shows whether the account can be delegated or not based on the User-Account-Control attribute. See the corresponding Microsoft article for more information: [User-Account-Control attribute](https://docs.microsoft.com/en-us/windows/win32/adschema/a-useraccountcontrol). | Yes No | + |
+| Account can't be delegated | Shows whether the account can be delegated or not based on the User-Account-Control attribute. See the corresponding Microsoft article for more information: [User-Account-Control attribute](https://docs.microsoft.com/en-us/windows/win32/adschema/a-useraccountcontrol). | Yes No | + |
| Account expiration date | Equals the Account-Expires attribute. See the corresponding Microsoft article for more information: [Account-Expires attribute](https://docs.microsoft.com/en-us/windows/win32/adschema/a-accountexpires). | Date | – |
| Password age | Shows password age for the account based on the Pwd-Last-Set attribute. See the corresponding Microsoft article for more information: [Pwd-Last-Set attribute](https://docs.microsoft.com/en-us/windows/win32/adschema/a-pwdlastset). | Number of days N/A — if password never set When the filter applied, the report shows above or equal results | + |
| Password expired | Shows whether the account has the "_Password expired_" flag set under the AccountControl attribute. | Yes No | + |
@@ -111,7 +111,7 @@ The following account attributes are reported:
| Never – if password never set | + | | |
| Password never expires | Shows whether the account has the "_Password never expires_" flag set on the Account tab in properties. | Yes No | + |
| Password not required | Shows whether the account has the "_Password not required_" flag set under the AccountControl attribute. Such account may have empty password. | Yes No | + |
-| User cannot change password | Shows whether the account has the "_User cannot change password_" flag set on the Account tab in properties. | Yes No | + |
+| User can't change password | Shows whether the account has the "_User can't change password_" flag set on the Account tab in properties. | Yes No | + |
| User must change password | Shows whether the account has the "_User must change password_" flag set on the Account tab in properties. | Yes No | + |
| Other | | | |
| Creation date | Shows account creation date. | Date | – |
@@ -132,7 +132,7 @@ account.
### Usage Example
-An IT administrators wants to find all user accounts from the OU named _Finance_ that are currently
+An IT administrators wants to find all user accounts from the OU named _Finance_ that are
locked out and disabled with information about their managers to contact them in case of any
questions. This OU is included in the monitoring plan named _Active Directory Monitoring_. They need
to set report filters as follows:
diff --git a/docs/auditor/10.8/admin/reports/types/stateintime/fileservers.md b/docs/auditor/10.8/admin/reports/types/stateintime/fileservers.md
index 8e1108aa25..eda6713dc3 100644
--- a/docs/auditor/10.8/admin/reports/types/stateintime/fileservers.md
+++ b/docs/auditor/10.8/admin/reports/types/stateintime/fileservers.md
@@ -11,7 +11,7 @@ generation.
## Limitations
-1. For the following File Server State-in-Time reports wildcard _%_ is not supported for the
+1. For the following File Server State-in-Time reports wildcard _%_ isn't supported for the
"_Object Path_" field:
- Account permissions
diff --git a/docs/auditor/10.8/admin/reports/types/stateintime/microsoftentraid.md b/docs/auditor/10.8/admin/reports/types/stateintime/microsoftentraid.md
index 0e09b804f6..4b7ffe85de 100644
--- a/docs/auditor/10.8/admin/reports/types/stateintime/microsoftentraid.md
+++ b/docs/auditor/10.8/admin/reports/types/stateintime/microsoftentraid.md
@@ -6,11 +6,11 @@ sidebar_position: 20
# Microsoft Entra ID State-In-Time Reports
-To instruct Netwrix Auditor to collect data needed for the report, make sure that Collect data for
+To instruct Netwrix Auditor to collect data needed for the report, ensure that Collect data for
state-in-time reports option is selected in the corresponding monitoring plan properties. See
[Create a New Monitoring Plan](/docs/auditor/10.8/admin/monitoringplans/create.md).
-**NOTE:** For Microsoft Entra ID, only the current date snapshot can be used for Reports.
+**NOTE:** For Microsoft Entra ID, only the current date snapshot helps you Reports.
## User Accounts - Attributes
@@ -52,7 +52,7 @@ filters and values:
### Reported Data
-For the account(s) you selected using filters, the summary section includes:
+For the accounts you selected using filters, the summary section includes:
- Total account count — total number of accounts that meet selected filtering criteria.
@@ -73,7 +73,7 @@ The following account attributes are reported:
| Country | country | Example: "_US_" | The country/region in which the user is located. Example: "US" or "UK". Maximum length 128. |
| Creation date | createdDateTime | 1/21/2021 4:08:00 PM | The created date of the user object. |
| Department | department | Example: "_Accounting and Finance_" | The name for the department in which the user works. Maximum length is 64 characters. |
-| Display name | displayName | Example: "_John Smith_" | The name displayed in the address book for the user. This is usually the combination of the user's first name, middle initial and last name. This property is required when a user is created and it cannot be cleared during updates. Maximum length is 256 characters. |
+| Display name | displayName | Example: "_John Smith_" | The name displayed in the address book for the user. This is usually the combination of the user's first name, middle initial and last name. This property is required when a user is created and it can't be cleared during updates. Maximum length is 256 characters. |
| First name | givenName | Example: "_John_" | The given name (first name) of the user. Maximum length is 64 characters. |
| Is licensed | – | – | – |
| Last DirSync time | onPremisesLastSyncDateTime | Example: _3/20/2021 2:13:00 PM_ | M Indicates the last time at which the object was synchronized with the on-premises directory; for example: "2013- 02- 16T03:04:54Z". The Timestamp type represents date and time information using ISO 8601 format and is always in UTC time. |
@@ -86,8 +86,8 @@ The following account attributes are reported:
| Password never expires | passwordPolicies | Yes/No | Specifies password policies for the user. This value is an enumeration with one possible value being "DisableStrongPassword", which allows weaker passwords than the default policy to be specified. "DisablePasswordExpiration" can also be specified. The two may be specified together; for example: "DisablePasswordExpiration, DisableStrongPassword". |
| Phone number | businessPhones | Example: _+1-202-555-155_ | The telephone numbers for the user. Although this is a string collection, only one number can be set for this property. |
| Role membership | – | Example: "_Exchange Service Administrator, Company Administrator_" | – |
-| Sign in names | identities | _Example: "user_company.com#EXT#@officenwxqc.onmicrosoft.com"_ | Represents the identities that can be used to sign into this user account. An identity can be provided by Microsoft (also known as a local account), by organizations, or by social identity providers such as Facebook, Google, and Microsoft, and tied to a user account. May contain multiple items with the same signInType value. https://docs.microsoft.com/en- us/graph/api/resources/objectid entity?view=graph-rest-1.0 |
+| Sign in names | identities | _Example: "user_company.com#EXT#@officenwxqc.onmicrosoft.com"_ | Represents the identities that lets you sign into this user account. An identity can be provided by Microsoft (also known as a local account), by organizations, or by social identity providers such as Facebook, Google, and Microsoft, and tied to a user account. May contain multiple items with the same signInType value. https://docs.microsoft.com/en- us/graph/api/resources/objectid entity?view=graph-rest-1.0 |
| Strong password required | passwordPolicies | Yes/No | Specifies password policies for the user. This value is an enumeration with one possible value being "DisableStrongPassword", which allows weaker passwords than the default policy to be specified. "DisablePasswordExpiration" can also be specified. The two may be specified together; for example: "DisablePasswordExpiration, DisableStrongPassword". |
| Title | jobTitle | Example: "_Business development manager_" | The user's job title. Max length is 128. |
| User principal name | userPrincipalName | Example: "_user_company.com#EXT#@officenwxqc.onmicrosoft.com_" | The user principal name (UPN) of wxq the user. The UPN is an Internet- style login name for the user based on the Internet standard RFC 822. By convention, this should map to the user's email name. The general format is alias@domain, where the domain must be present in the tenant's collection of verified domains. This property is required when a user is created. The verified domains for the tenant can be accessed from the verifiedDomains property of organization. NOTE: While this property can contain accent characters, they can cause access issues to first-party applications for the user. |
-| User type | userType | Example: "_Member_" | A string value that can be used to classify user types in your directory, such as "Member" and "Guest". |
+| User type | userType | Example: "_Member_" | A string value that lets you classify user types in your directory, such as "Member" and "Guest". |
diff --git a/docs/auditor/10.8/admin/reports/types/stateintime/overview.md b/docs/auditor/10.8/admin/reports/types/stateintime/overview.md
index c1e6820098..4be11b1b41 100644
--- a/docs/auditor/10.8/admin/reports/types/stateintime/overview.md
+++ b/docs/auditor/10.8/admin/reports/types/stateintime/overview.md
@@ -10,7 +10,7 @@ The state-in-time reports functionality allows generating reports on the system'
specific moment of time in addition to change and activity reports. State-in-time reports are based
on the daily configuration snapshots, and reflect a particular aspect of the audited environment.
-This functionality is currently available for the following data sources:
+This functionality is available for the following data sources:
- Active Directory
- Microsoft Entra ID
@@ -24,7 +24,7 @@ This functionality is currently available for the following data sources:
- Group Policy
- VMware
-**NOTE:** The State-in-Time functionality is not available for SQL Server Availability Groups.
+**NOTE:** The State-in-Time functionality isn't available for SQL Server Availability Groups.
To provide data for state-in-time reports, remember to select the **Collect data for state-in-time
reports** option when you configure a monitoring plan for the selected data source. See the
@@ -51,9 +51,9 @@ corresponding snapshot from the Snapshot Date filter.
To be able to generate reports based on different snapshots, ask your Auditor Global administrator
to import historical snapshots to the Audit Database, otherwise only the Current Session option is
-available in the drop-down list.
+available in the dropdown list.
-**NOTE:** Importing historical snapshots is not available for Office 365.
+**NOTE:** Importing historical snapshots isn't available for Office 365.
When auditing file servers, changes to both access and audit permissions are tracked. To exclude
information on access permissions, contact your Auditor Global administrator or Configurator of this
@@ -61,7 +61,7 @@ plan.
## Baseline Reports
-Most reports in Windows Server—State-in-Time folder allow you to specify baselines. A _baseline_
+Most reports in Windows Server—State-in-Time folder let you specify baselines. A _baseline_
defines a certain safe level or state. If a server parameter falls below it, it is a considered a
threat or at least merits your special attention. With baselines specified right in report filters,
you can easily identify servers that are different from your corporate policies or best practices.
diff --git a/docs/auditor/10.8/admin/reports/types/stateintime/sqlroles.md b/docs/auditor/10.8/admin/reports/types/stateintime/sqlroles.md
index 23c4e66a31..0a23e124e7 100644
--- a/docs/auditor/10.8/admin/reports/types/stateintime/sqlroles.md
+++ b/docs/auditor/10.8/admin/reports/types/stateintime/sqlroles.md
@@ -4,10 +4,9 @@ This report shows the server-level fixed and custom roles for the selected SQL S
grouped by role name. The details for each role include its name, type, and a list of the effective
role members and member types. Use this report to control role membership and permissions.
-To read more about SQL server-level roles, refer to
-[this Microsoft article](https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles?view=sql-server-ver15).
+For more information about SQL server-level roles, see the [Microsoft SQL Server-level roles documentation](https://docs.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles?view=sql-server-ver15).
-To instruct Netwrix Auditor to collect data needed for this report, make sure that **Collect data
+To instruct Netwrix Auditor to collect data needed for this report, ensure that **Collect data
for state-in-time reports** option is selected in the monitoring plan properties. See Settings for
Data Collection in the monitoring plan documentation.
@@ -42,7 +41,7 @@ This report has the following filters:
UTC-08:00.
- **Snapshot date** —select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in the SQL Server monitoring plan
documentation.
- **Item**— name of the SQL Server instance monitored with selected monitoring plan.
@@ -52,7 +51,7 @@ This report has the following filters:
## Considerations and limitations
-- Reporting for case-sensitive SQL Servers and databases is not supported.
+- Reporting for case-sensitive SQL Servers and databases isn't supported.
## Related reports
diff --git a/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlaccountpermissions.md b/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlaccountpermissions.md
index 7b18589e91..0be596ffdb 100644
--- a/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlaccountpermissions.md
+++ b/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlaccountpermissions.md
@@ -51,7 +51,7 @@ This report has the following filters:
value is filled in automatically.
- **Snapshot date** —select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in
[SQL Server](/docs/auditor/10.8/admin/monitoringplans/sqlserver/overview.md)
- **Item**— name of the SQL Server instance monitored with selected monitoring plan.
@@ -70,7 +70,7 @@ This report has the following filters:
## Considerations and limitations
-- Reporting for case-sensitive SQL Servers and databases is not supported.
+- Reporting for case-sensitive SQL Servers and databases isn't supported.
- Permissions for INFORMATION*SCHEMA granted via \_master db* will not be reported.
- The report will not show the RESTORE capability for the database owner.
diff --git a/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqldatabases.md b/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqldatabases.md
index 8e436b589e..0aa273e7e1 100644
--- a/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqldatabases.md
+++ b/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqldatabases.md
@@ -58,7 +58,7 @@ This report has the following filters:
## Considerations and recommendations
-Reporting for case-sensitive SQL Servers and databases is not supported.
+Reporting for case-sensitive SQL Servers and databases isn't supported.
## Usage example
diff --git a/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlmeansgranted.md b/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlmeansgranted.md
index eb93672be3..8672b5f2c6 100644
--- a/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlmeansgranted.md
+++ b/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlmeansgranted.md
@@ -13,7 +13,7 @@ investigate how permissions are granted.
Supported object types and attributes are listed in the
[SQL Server](/docs/auditor/10.8/configuration/sqlserver/overview.md) section.
-To instruct Netwrix Auditor to collect data needed for this report, make sure that **Collect data
+To instruct Netwrix Auditor to collect data needed for this report, ensure that **Collect data
for state-in-time reports** option is selected in the monitoring plan properties.
@@ -49,7 +49,7 @@ The detailed information under summary includes:
- **Type** — the security principal type, e.g. _Server role_.
- **Grant** — the set of permissions granted to this account on the selected object by all means.
-Covering rules do not need to be applied, since **Grant** permissions are reported automatically
+Covering rules don't need to be applied, since **Grant** permissions are reported automatically
using these rules.
## Filters
@@ -62,7 +62,7 @@ This report has the following filters:
value is filled in automatically.
- **Snapshot date** — select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in the SQL Server monitoring plan
documentation.
- **Item** — name of the SQL Server instance monitored with selected monitoring plan.
@@ -77,11 +77,11 @@ This report has the following filters:
## Considerations and limitations
-- Reporting is not supported for the following objects:
+- Reporting isn't supported for the following objects:
- Case-sensitive SQL Servers and databases
- Read-only Filegroups
- Contained databases.
-- Permissions assigned using **With Grant option** are not reported (see
+- Permissions assigned using **With Grant option** aren't reported (see
[this Microsoft article](https://docs.microsoft.com/en-us/sql/t-sql/statements/grant-object-permissions-transact-sql?view=sql-server-ver15)
on that means).
- When calculating effective rights and permissions, the following will not be considered:
diff --git a/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlobjectpermissions.md b/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlobjectpermissions.md
index 3954356ee5..df479b54ae 100644
--- a/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlobjectpermissions.md
+++ b/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlobjectpermissions.md
@@ -43,7 +43,7 @@ The detailed information under summary includes:
- **Effective grant** —the effective set of permissions granted to this account on the selected
object.
-Covering rules do not need to be applied, since **Effective grant** permissions are reported
+Covering rules don't need to be applied, since **Effective grant** permissions are reported
automatically using these rules.
## Filters
@@ -56,7 +56,7 @@ This report has the following filters:
value is filled in automatically.
- **Snapshot date** —select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in the
[SQL Server](/docs/auditor/10.8/admin/monitoringplans/sqlserver/overview.md) topic.
- **Item**—name of the SQL Server instance monitored with selected monitoring plan.
@@ -77,7 +77,7 @@ This report has the following filters:
## Considerations and limitations
-- Reporting for case-sensitive SQL Servers and databases is not supported.
+- Reporting for case-sensitive SQL Servers and databases isn't supported.
- The report will not show the RESTORE capability for the database owner.
- When calculating effective rights and permissions, the following will not be considered:
@@ -96,7 +96,7 @@ This report has the following filters:
## Usage example
-Database administrators need to discover who currently has access permissions to **FinReports**
+Database administrators need to discover who has access permissions to **FinReports**
database stored on the **SQLSrv01\SQLServer2016** instance. This instance is included in the
monitoring plan named _SQL Servers Monitoring_.
diff --git a/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlserveroverview.md b/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlserveroverview.md
index 0aadbee3cf..241c6599c5 100644
--- a/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlserveroverview.md
+++ b/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlserveroverview.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# SQL Server State-In-Time Reports
-These are reports on the SQL Server state-in-time data, including roles, permissions and other
+These are reports on the SQL Server state-in-time data, including roles, permissions, and other
configuration settings:
- [Account Permissions in SQL Server](/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlaccountpermissions.md)
@@ -15,7 +15,7 @@ configuration settings:
- [SQL Server Means Granted](/docs/auditor/10.8/admin/reports/types/stateintime/sqlserveroverview/sqlmeansgranted.md)
- [SQL Server-Level Roles](/docs/auditor/10.8/admin/reports/types/stateintime/sqlroles.md)
-To instruct Netwrix Auditor to collect data needed for these reports, make sure that **Collect data
+To instruct Netwrix Auditor to collect data needed for these reports, ensure that **Collect data
for state-in-time reports** option is selected in the corresponding monitoring plan properties. See
the [Settings for Data Collection](/docs/auditor/10.8/admin/monitoringplans/create.md#settings-for-data-collection)
topic for additional information. By default, data collection will run daily at 4 AM.
diff --git a/docs/auditor/10.8/admin/reports/types/stateintime/vmware.md b/docs/auditor/10.8/admin/reports/types/stateintime/vmware.md
index 5869fb93ae..c5fdf8127d 100644
--- a/docs/auditor/10.8/admin/reports/types/stateintime/vmware.md
+++ b/docs/auditor/10.8/admin/reports/types/stateintime/vmware.md
@@ -13,7 +13,7 @@ permissions:
- Detailed Account Permissions in vCenter
- Object Permissions in vCenter
-To instruct Netwrix Auditor to collect data needed for these reports, make sure that **Collect data
+To instruct Netwrix Auditor to collect data needed for these reports, ensure that **Collect data
for state-in-time reports** option is selected in the corresponding monitoring plan properties. See
the [Settings for Data Collection](/docs/auditor/10.8/admin/monitoringplans/create.md#settings-for-data-collection)
topic for more information.
@@ -41,7 +41,7 @@ filters and values:
- Time zone — is set automatically.
- **Snapshot date** —select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in
[VMware](/docs/auditor/10.8/admin/monitoringplans/vmware/overview.md)
- Item — name of the item within your monitoring plan.
@@ -77,7 +77,7 @@ filters and values:
- Time zone — is set automatically.
- **Snapshot date** —select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in
[VMware](/docs/auditor/10.8/admin/monitoringplans/vmware/overview.md)
- Item — name of the item within your monitoring plan.
@@ -110,7 +110,7 @@ filters and values:
- Time zone — is set automatically.
- **Snapshot date** —select the date of state-in-time snapshot you want to report on. By default,
the report includes data obtained during the latest data collection session (_Current Session_).
- To report on other snapshots, make sure they are available through import. For details, see
+ To report on other snapshots, ensure they are available through import. For details, see
**Manage historical snapshots** option description in
[VMware](/docs/auditor/10.8/admin/monitoringplans/vmware/overview.md)
- Item — name of the item within your monitoring plan.
diff --git a/docs/auditor/10.8/admin/reports/view.md b/docs/auditor/10.8/admin/reports/view.md
index bdd2867018..0dcf2151a5 100644
--- a/docs/auditor/10.8/admin/reports/view.md
+++ b/docs/auditor/10.8/admin/reports/view.md
@@ -15,7 +15,7 @@ To view reports, users need the following:
- Users with _Global administrator_ or _Global reviewer_ role can also create subscriptions to
reports.
-2. The Browser role on the SSRS Report Server. See the
+2. The Browser role on the SSRS (SQL Server Reporting Services) Report Server. See the
[SQL Server Reporting Services](/docs/auditor/10.8/requirements/sqlserverreportingservice.md) topic for
additional information.
@@ -41,7 +41,7 @@ To learn how to subscribe to a report, see [Create Subscriptions](/docs/auditor/
If no data is displayed in the report, you may need to do the following:
-1. Make sure that the Audit Database settings are configured properly in the monitoring plan, and
+1. Ensure that the Audit Database settings are configured properly in the monitoring plan, and
that data is written to databases that reside on the default SQL Server instance. See the
[Audit Database](/docs/auditor/10.8/admin/settings/auditdatabase.md) topic for additional information.
2. For SSRS-based reports - verify that SSRS (SQL Server Reporting Services) settings are configured
@@ -53,9 +53,9 @@ If no data is displayed in the report, you may need to do the following:
## Customize Report with Filters
-Report filters allow you to display changes matching certain criteria. For example, you can filter
-changes by audited domain or object type. Filtering does not delete changes, but modifies the report
-view allowing you to see changes you are interested in. Filters can be found in the upper part of
+Use report filters to display changes matching certain criteria. For example, you can filter
+changes by audited domain or object type. Filtering doesn't delete changes; instead, it modifies the report
+view to show the changes you're interested in. Filters are located in the upper part of
the Preview Report page.
To apply filters
@@ -66,16 +66,16 @@ To apply filters
Wildcards are supported. For example, type _%companydomain\admin2%_ in the Who domain\user field if you want to view changes made by the companydomain\admin2 user only.
-Do not use % in the exclusive filters (e.g., Who (Exclude domain\user)). Otherwise, you will receive
+Don't use % in the exclusive filters (e.g., Who (Exclude domain\user)). Otherwise, you will receive
an empty report.
-`escape_characters` are not supported.
+`escape_characters` aren't supported.
The filters may vary slightly depending on the audited system and report type.
-Below is the All Active Directory Changes report with the default filter:
+The following shows the All Active Directory Changes report with the default filter:
-Below is the same report, but filtered by a specific user on a selected domain controller, sorted by a specific type:
+The following shows the same report, but filtered by a specific user on a selected domain controller, sorted by a specific type:
diff --git a/docs/auditor/10.8/admin/riskassessment/dashboard.md b/docs/auditor/10.8/admin/riskassessment/dashboard.md
index bf5967650e..67973d6282 100644
--- a/docs/auditor/10.8/admin/riskassessment/dashboard.md
+++ b/docs/auditor/10.8/admin/riskassessment/dashboard.md
@@ -29,16 +29,15 @@ displayed with the color indicators in accordance with the level:
-After reviewing general risks assessment results in each category, you can drill-down to details
+After reviewing general risk assessment results in each category, you can view details
covered in the underlying report. To do so, double-click the selected metric or use the View Report
button.
## Customizing Metrics for Your Organization
Default threshold values for risk levels are set in accordance with recommendations of
-Netwrix industry experts, as described in the [How Risk Levels Are Estimated ](/docs/auditor/10.8/admin/riskassessment/levels.md) topic. They
-can be, however, easily customized to reflect your organization's internal security policies and
-standards. Follow the steps to customize the metrics.
+Netwrix industry experts, as described in the [How Risk Levels Are Estimated ](/docs/auditor/10.8/admin/riskassessment/levels.md) topic. You can customize these values to reflect your organization's internal security policies and
+standards.
**Step 1 –** In the dashboard pane, select the metric you need and in the **Actions** section on the
right click Modify thresholds.
@@ -59,9 +58,9 @@ Also, for several metrics the Customize risk indicators command is available.
| Servers with unauthorized antivirus software | Edit the whitelist of permitted antivirus tools. Any other antivirus will be considered a risk factor. |
| Administrative group membership sprawl | Edit the whitelist of permitted accounts that can be the members of local administrative groups. Any other account will be considered a risk factor. |
-**Note:** Special characters such as %, *, and ? are not interpreted as wildcards in risk indicator customization and are treated as literal characters. The only exception is the domain portion of
-domain\account entries in Administrative group membership sprawl, where % can be used to represent any domain. In all other cases (for example, account names, file names, operating system names, and antivirus names),
-values must be entered explicitly and are not matched using wildcard patterns.
+**Note:** Special characters such as %, *, and ? aren't interpreted as wildcards in risk indicator customization and are treated as literal characters. The only exception is the domain portion of
+domain\account entries in Administrative group membership sprawl, where % represents any domain. In all other cases (for example, account names, file names, operating system names, and antivirus names),
+values must be entered explicitly and aren't matched using wildcard patterns.
New settings will be applied/risk level thresholds will be refreshed after the next data collection
session.
diff --git a/docs/auditor/10.8/admin/riskassessment/levels.md b/docs/auditor/10.8/admin/riskassessment/levels.md
index afe40e9b97..6f71bd851d 100644
--- a/docs/auditor/10.8/admin/riskassessment/levels.md
+++ b/docs/auditor/10.8/admin/riskassessment/levels.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# How Risk Levels Are Estimated
-As mentioned, dashboard and built-in reports give you a bird's eye view of the following high-risk
+As mentioned, the dashboard and built-in reports provide a comprehensive overview of the following high-risk
areas:
- User and computer accounts
@@ -66,7 +66,7 @@ The following signs are used to define risk level intervals and threshold values
| Data | | |
| Files and folders accessible by Everyone | Files and folders shared with _Everyone_ security group /Overall number of shared folders (%) | - ≤ 1% — Low - (1% – 5%) — Medium - ≥ 5% — High |
| Sensitive data shared with Everyone | Number of sensitive files shared with the security groups "Everyone" and "Authenticated" / Total number of sensitive files (%). | - 0% — Low - (1% – 2%) — Medium - ≥ 2% — High |
-| Sensitive files shared with external users | Number of sensitive files shared with external users / Total number of sensitive files (%). Sharing sensitive data with external users (authenticated users who are not members of your Office 365 organization) may lead to data leaks. To reduce the risk of data leaks and non-compliance, control data sharing to external users. | - ≤ 5% — Low - (5% – 10%) — Medium - ≥ 10% — High |
+| Sensitive files shared with external users | Number of sensitive files shared with external users / Total number of sensitive files (%). Sharing sensitive data with external users (authenticated users who aren't members of your Office 365 organization) may lead to data leaks. To reduce the risk of data leaks and non-compliance, control data sharing to external users. | - ≤ 5% — Low - (5% – 10%) — Medium - ≥ 10% — High |
| Sensitive files shared with anonymous users | Number of sensitive files shared with anonymous users / Total number of sensitive files (%). Files may be shared with any users outside the Office 365 organization, so that any user with the link can access the file. This may lead to your sensitive content being highly exposed. To reduce the risk of data leaks, control data sharing to anonymous users. | - 0% — Low - (0% – 2%) — Medium - ≥ 2% — High |
| Sensitive documents accessible by Everyone | Number of sensitive documents accessible by Everyone or similar groups / Total number of sensitive documents (%). Only designated personnel should have access to your sensitive data. Thus, only public data should be accessible by the following predefined Office 365 groups: - Everyone - Everyone Except External Users - All Authenticated Users - All Forms Users - All Users | - 0% — Low - (0% – 5%) — Medium - ≥ 5% — High |
| File and folder names containing sensitive data | Number of files and folders with names that suggest they contain sensitive data | - 0 — Low - 1 — Medium - > 1 — High |
@@ -84,5 +84,5 @@ The following signs are used to define risk level intervals and threshold values
| Servers with unauthorized antivirus software\* | Number of Windows servers with antivirus tools not included in the whitelist / Overall number of servers (%) | - 0% — Low - >0% — High |
\* -here the _Overall number of servers_ means the number of Windows servers for which data
-collection was a success. That said, this count may vary across the risks. In such a case, it is
-recommended to examine Netwrix Auditor health log and omit lists.
+collection was a success. That said, this count may vary across the risks. In such a case, examine
+the Netwrix Auditor health log for omitted items.
diff --git a/docs/auditor/10.8/admin/riskassessment/overview.md b/docs/auditor/10.8/admin/riskassessment/overview.md
index b32ccb25e3..63a99082e7 100644
--- a/docs/auditor/10.8/admin/riskassessment/overview.md
+++ b/docs/auditor/10.8/admin/riskassessment/overview.md
@@ -7,10 +7,9 @@ sidebar_position: 90
# IT Risk Assessment Overview
To help you identify configuration gaps in your environment and understand their impact on overall
-security, Netwrix Auditor offers a dashboard with a number of metrics and drill-down reports on IT
-risk assessment. They pinpoint the weak points in your IT infrastructure such as overly broad
-assignment of access rights, loose password policies, and stale accounts. This information will help
-you to take corrective measures in the required area, ensuring the IT risks stay in the safe zone.
+security, Netwrix Auditor offers a dashboard with metrics and detailed reports on IT
+risk assessment. These reports pinpoint weak points in your IT infrastructure, such as overly broad
+access rights assignment, loose password policies, and stale accounts. This information helps you take corrective measures to keep IT risks in the safe zone.
Risk assessment dashboard can be accessed by clicking the Risk assessment tile in the main window of
Netwrix Auditor. For details about using the dashboard, see
@@ -60,9 +59,7 @@ have at least one item added. See the following table for the certain reports:
connection. To check configuration status, go to Settings > Sensitive Data Discovery. See
[Sensitive Data Discovery ](/docs/auditor/10.8/admin/settings/sensitivedatadiscovery.md)for more information.
-**NOTE:** Right after setting up the integration the drill down reports might be empty, while the
-risk indicator is already completed. Please wait until Auditor gets all the information from Netwrix
-Data Classification it needs.
+**NOTE:** After setting up the integration, detailed reports might be empty while the risk indicator is already complete. Wait until Auditor retrieves all the information it needs from Netwrix Data Classification.
## Required Monitoring Plan Settings
@@ -78,16 +75,16 @@ To verify the necessary settings of the existing plan
1. Select the monitoring plan you need and click the **Edit** button.
2. In the right pane of the dialog displayed, select Edit settings from the Monitoring plan section.
-3. Go to the Audit Database section and make sure that Disable security intelligence ... checkbox is
+3. Go to the Audit Database section and ensure that Disable security intelligence ... checkbox is
cleared. This will instruct Netwrix Auditor to store data to both Long-Term Archive and audit
database:
-4. Save the settings and return to the window with the monitoring plan details. Make sure you have
+4. Save the settings and return to the window with the monitoring plan details. Ensure you have
at least one monitored item in the plan. If necessary, add an item.
5. Select the data source you need (for example, Active Directory) and click Edit data source from
the Data source section on the right.
-6. Make sure that:
+6. Ensure that:
1. Monitor this data source and collect activity data is switched ON.
2. Collect data for state-in-time reports is switched ON.
7. Save the settings and close the dialog.
diff --git a/docs/auditor/10.8/admin/search/filteradvanced.md b/docs/auditor/10.8/admin/search/filteradvanced.md
index 5295c557cf..b8b83ad872 100644
--- a/docs/auditor/10.8/admin/search/filteradvanced.md
+++ b/docs/auditor/10.8/admin/search/filteradvanced.md
@@ -6,8 +6,7 @@ sidebar_position: 20
# Use Filters in Advanced Mode
-Netwrix Auditor provides an advanced set of filters and match type operators that enable you to
-customize your searches even more precisely.
+Netwrix Auditor provides advanced filters and match type operators to customize your searches with greater precision.
Switch to Advanced mode to review your current search in details and modify it if necessary. Click
Add to add a new filter to your search.
@@ -32,7 +31,7 @@ information:
| Item | Limits your search to the selected item only. This filter can be helpful if you have several items of the same type in your monitoring plan (e.g., two Active Directory domains). Specify the name from the Value list or type it yourself. | Your monitoring plan is configured to track domains and includes your secured corporate domain and a domain for temporary employees. You are investigating who logged in your secured corporate domain outside business hours. You can set the Item filter to this domain name to limit the search results and exclude logons to computers from a less important domain. |
| Working hours | Limits your search results to entries that occurred within the specified hours. You can use this filter together with When if you need, for example, to search for activity in the non-business hours during the last week. | You are investigating an incident and want to know who accessed sensitive data outside business hours. You can set this filter as Not equal to and specify the time interval from 8:00 AM to 6:00 PM. Filtered data will include only operations that occurred outside this interval, that is, during non-business hours. |
| Data categories | Limits your search results to entries that contain sensitive data complying with a classification rule. You can use this filter together with Equal to PCIDSS to, for example, search for sensitive files that contain data regulated by the PCIDSS. | You are searching all documents containing cardholder data that can potentially be mapped with the PCIDSS compliance standard. You can set this filter as equal to and specify the value as PCIDSS. Filtered data will contain only files that match this criteria. This filter shows activity records collected from the following data sources: Windows File Servers, SharePoint, SharePoint Online. |
-| Details | Limits your search results to entries that contain the specified information in the Details column. The Details column normally contains data specific to your target, e.g., assigned permissions, before and after values, start and end dates. This filter can be helpful when you are looking for a unique entry. | You discovered that a registry key was updated to "242464". Now you want to investigate who made the change and what the value was before. You can set the Details filter to 242464 to find this change faster. |
+| Details | Limits your search results to entries that contain the specified information in the Details column. The Details column normally contains data specific to your target, e.g., assigned permissions, before and after values, and start and end dates. This filter can be helpful when you are looking for a unique entry. | You discovered that a registry key was updated to "242464". Now you want to investigate who made the change and what the value was before. You can set the Details filter to 242464 to find this change faster. |
| Everywhere | Limits your search results to entries that contain the specified value in any column. | You are investigating a security incident. You have already identified the intruder (e.g., BadActor) and now you want to see all actions made by the intruder's account or with it. Since the intruder can be the actor (Who), the object (What), or can even show up in details, set the Everywhere filter to the intruder's name. |
@@ -44,21 +43,21 @@ example, Contains, Starts with, and so on.
-The following operators can be used to specify search conditions:
+The following operators let you specify search conditions:
| Operator | Description | Example |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Equals | This operator shows all entries with the exact value specified. Make sure to provide a full object name or path. To apply this operator when adding filters in the Simple mode, provide a value in quotation marks (e.g., _"Domain1\John"_). | Use this operator if you want to get precise results, e.g., _\\FS\Share\NewPolicy.docx_. |
+| Equals | This operator shows all entries with the exact value specified. Ensure to provide a full object name or path. To apply this operator when adding filters in the Simple mode, provide a value in quotation marks (e.g., _"Domain1\John"_). | Use this operator if you want to get precise results, e.g., _\\FS\Share\NewPolicy.docx_. |
| Not equal to | This operator shows all entries except those with the exact value specified. In the Search field in the Simple mode, this operator appears as not, e.g., Who not for the Who filter. | If you set the Who filter to not equal to _Domain1\John_, you will exclude the exact user specified and find all changes performed by other users, e.g., _Domain1\Johnson, Domain2\John_. |
| Starts with | This operator shows all entries that start with the specified value. | If you set the Who filter to starts with _Domain1\John_, you will find all changes performed by _Domain1\John_, _Domain1\Johnson_, and _Domain1\Johnny_. |
| Ends with | This operator shows all entries that end with the exact specified value. | If you set the Who filter to ends with _John_, you will find all changes performed by _Domain1\John_, _Domain2\Dr.John_, _Domain3\John_. |
| Contains | This operator shows all entries that contain a value specified in the filter. | If you set the Who filter to contains _John_, you will get the following results: _Domain1\John_, _Domain1\Johnson_, _Domain2\Johnny_, _John@domain.com_. |
-| Does not contain | This operator shows all entries except those that contain the specified value. In the Search field in the Simple mode, this operator appears as not, e.g., Who not for the Who filter. | If you set the Who filter to does not contain _John_, you will exclude the following users: _Domain1\John_, _Domain2\Johnson_, and _Johnny@domain.com_. |
+| Doesn't contain | This operator shows all entries except those that contain the specified value. In the Search field in the Simple mode, this operator appears as not, e.g., Who not for the Who filter. | If you set the Who filter to doesn't contain _John_, you will exclude the following users: _Domain1\John_, _Domain2\Johnson_, and _Johnny@domain.com_. |
| In group | This operator relates to the Who filter. It instructs Netwrix Auditor to show only data for the accounts included in the specified group. | If you set the In group condition for Who filter to _Domain\Administrators_, only the data for the accounts included in that group will be displayed. |
| Not in group | This operator relates to the Who filter. It instructs Netwrix Auditor to show only data for the accounts not included in the specified group. | If you set the Not in group condition for Who filter to _Domain\Administrators_, only the data for the accounts not included in that group will be displayed. |
-To modify conditions for the selected filters, make sure you have switched to the Advanced search
+To modify conditions for the selected filters, ensure you have switched to the Advanced search
mode.
diff --git a/docs/auditor/10.8/admin/search/filtersimple.md b/docs/auditor/10.8/admin/search/filtersimple.md
index bd2c8e39bb..5731244cbd 100644
--- a/docs/auditor/10.8/admin/search/filtersimple.md
+++ b/docs/auditor/10.8/admin/search/filtersimple.md
@@ -13,8 +13,8 @@ Filters are used to narrow your search results. To create a unique set of filter
- Specify several values in the same filter to search for any of them (e.g., Action: Modified
or Action: Removed). To do this, select a filter again and specify a new value.
- Spaces do not separate values, so the whole expression will be included in your search as a
- single value. For example, if you want to search for any of three names, do not enter **Anna
+ Spaces don't separate values, so the whole expression will be included in your search as a
+ single value. For example, if you want to search for any of three names, don't enter **Anna
Mark Bill** but instead create a separate filter entry for each name.
## Filter Types
@@ -22,18 +22,18 @@ Filters are used to narrow your search results. To create a unique set of filter
| Filter | Description |
| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Who | Filter data by user (initiator) account. Specify an account name (e.g., John) to find all entries containing it (e.g., `Domain1\John`, `Domain1\Johnson`, `Domain2\Johnny`, `John@domain.com`). For exact match, use quotation marks and provide a user name in Domain\User or UPN format (e.g., `Domain1\John` or `John@domain.com`) . |
-| Action | Filter data by action type (Added, Removed, etc.) Select an action type from the list (Added, Removed, Modified, Read). For additional actions, navigate to the Advanced mode. See the [Use Filters in Advanced Mode](/docs/auditor/10.8/admin/search/filteradvanced.md) topic for additional information. |
+| Action | Filter data by action enter (Added, Removed, etc.) Select an action enter from the list (Added, Removed, Modified, Read). For additional actions, navigate to the Advanced mode. See the [Use Filters in Advanced Mode](/docs/auditor/10.8/admin/search/filteradvanced.md) topic for additional information. |
| What | Specify an object name (e.g., _Policy_) to find all entries containing it (e.g., _HiSecPolicy_, `\\FileSserver\Share\NewFolder\NewPolicy.docx`, `http://sharepoint/sites/collection1/Lists/Policy`). Netwrix Auditor searches across all data sources. For an exact match, use quotation marks and provide an object name in the format that is typical for your data source (e.g., `HiSecPolicy`). |
-| When | Filter data by the time interval when the change occurred. Specify a timeframe or provide a custom date range. Netwrix Auditor allows you to see changes that occurred today, yesterday, in the last 7 or 30 days, or within the specified date range. |
+| When | Filter data by the time interval when the change occurred. Specify a timeframe or provide a custom date range. View changes that occurred today, yesterday, in the last 7 or 30 days, or within a custom date range. |
| Where | Specify a resource name (e.g., _Enterprise_) to find all entries containing it (e.g., `Enterprise-SQL`, `FileStorage.enterprise.local`). The resource name can be a FQDN or NETBIOS server name, Active Directory domain or container, SQL Server instance, SharePoint farm, VMware host, etc. Netwrix Auditor searches across all data sources. For an exact match, use quotation marks and provide a resource name in the format that is typical for your data source (e.g., `Enterprise-SQL`). |
-Follow the steps to add a filter to your search.
+## Add a filter to your search
-**Step 1 –** Click a filter type icon. Enter a value you want to search for.
+1. Click a filter enter icon. Enter a value you want to search for.
-Alternatively, you can type a value directly into the Search field.
+Alternatively, you can enter a value directly into the Search field.
- For exact match, use quotation marks.
- To further restrict your search, right-click the value and select a filter from the pop-up menu.
@@ -49,7 +49,7 @@ value are shown.
| To... | Do... |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Modify filter | Double-click the filter and type a new value.  If you need to modify the When filter, delete it and add a new value, or navigate to the Advanced mode (Simple mode does not support its modification). |
+| Modify filter | Double-click the filter and enter a new value.  If you need to modify the When filter, delete it and add a new value, or navigate to the Advanced mode (Simple mode doesn't support its modification). |
| Remove filter | Click the **Close** icon next to it. |
## Exporting and Importing Filters
@@ -58,5 +58,5 @@ To export or import filters as regular expressions, use the **Tools** menu comma
| To... | Use... |
| ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Export | **Copy search** — copy the search filters that are currently applied to your search. This can be helpful if you want to share your search with a colleague (e.g., by pasting it in an email) or to modify a saved search query with your current filters. |
+| Export | **Copy search** — copy the search filters that are applied to your search. This can be helpful if you want to share your search with a colleague (e.g., by pasting it in an email) or to modify a saved search query with your current filters. |
| Import | **Paste search** — paste the search filters you copied before. These can be filters copied from a previous search or those someone shared with you. |
diff --git a/docs/auditor/10.8/admin/search/overview.md b/docs/auditor/10.8/admin/search/overview.md
index 538ea55724..a14ff65bfd 100644
--- a/docs/auditor/10.8/admin/search/overview.md
+++ b/docs/auditor/10.8/admin/search/overview.md
@@ -6,11 +6,11 @@ sidebar_position: 40
# View and Search Collected Data
-Netwrix Auditor delivers complete visibility into your IT infrastructure. Its convenient interactive
-search interface enables you to investigate incidents and browse data collected across the entire IT
-infrastructure. When running a search, you are not limited to a certain data source, change type, or
-object name. You can create flexible searches that provide you with precise results on _who_ changed
-_what_, and _when_ and _where_ each change was made.
+Netwrix Auditor provides complete visibility into your IT infrastructure through a convenient, interactive
+search interface. Investigate incidents and browse data collected across your entire IT
+infrastructure without being limited to a specific data source, change type, or
+object name. Create flexible searches that show precisely _who_ changed
+_what_, _when_, and _where_.
To review collected data, you must be assigned the **Global administrator** or **Global reviewer**
Netwrix Auditor role. Users with the **Reviewer** role on a certain plan or folder have limited
@@ -18,7 +18,7 @@ access to data—only within their delegated scope. See the
[Role-Based Access and Delegation](/docs/auditor/10.8/admin/monitoringplans/delegation.md) topic for additional
information.
-This functionality is currently available for the following data sources:
+This functionality is available for the following data sources:
- Active Directory
- Microsoft Entra ID (formerly Azure AD)
@@ -48,9 +48,7 @@ Archive. See [Investigations](/docs/auditor/10.8/admin/settings/investigations.m
## Browsing Your Audit Data
-On the main Netwrix Auditor page, click
-
-on the left.
+On the main Netwrix Auditor page, click the search icon (), located on the left.
You can add any elements (a dashboard, report, alert, risk, etc.) to the Auditor Home screen to
access them instantly. See the [Navigation](/docs/auditor/10.8/admin/navigation/overview.md) and
@@ -81,7 +79,7 @@ the data you need.
- Regardless of the selected filtering mode, Netwrix Auditor combines conditions as follows:
- Filters of the same type with positive operators are combined using the OR logical operator.
- Filters of different types are combined using the AND logical operator.
- - All filters with negative operators, regardless of type, are combined using the AND logical operator. Negative operators include: not equal to, does not contain, not in group.
+ - All filters with negative operators, regardless of type, are combined using the AND logical operator. Negative operators include: not equal to, doesn't contain, not in group.
- By default, search results are open in the same window, so the subsequent search results will
overwrite the previous search results. To view them in different windows, click Open in new
@@ -119,7 +117,7 @@ a column or change its position, or hide the Details pane on the right.
To modify view:
1. Navigate to Tools
-2. Click Select columns. The dialog that opens shows the search columns currently selected for
+2. Click Select columns. The dialog that opens shows the search columns selected for
display.
3. Check the columns you want to include and clear unwanted ones.
4. Set the order of displayed columns using arrows on the right.
@@ -156,15 +154,15 @@ Navigate to **Tools** in the top right corner of the Search window and select th
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Save as report | Save your search results as custom reports. |
| Create alert | Create an alert with the same set of filters you have just specified for your search. |
-| Subscribe | Create subscription for periodic delivery of the search query results. Subscription to the search results is not the same as creation of a custom report using this search. |
+| Subscribe | Create subscription for periodic delivery of the search query results. Subscription to the search results isn't the same as creation of a custom report using this search. |
| Export data | Save your search results as a _.pdf_ or _.csv_ file. All audit data from your search query results will be exported (unlike the interactive view which is limited to the top 2,000 entries). When exporting large amount of data (e.g., changes made by a newly retired employee during the last 8 months), it is recommended to use _.csv_ format. |
## Troubleshooting Tips
-If you do not see the expected information in search results, try the following:
+If you don't see the expected information in search results, try the following:
- Verify the Audit Database retention and SQL Server settings.
-- Make sure that data collection is configured properly in the monitoring plan settings.
+- Ensure that data collection is configured properly in the monitoring plan settings.
- Check the required audit settings in your monitored infrastructure.
- Verify the data collecting account.
diff --git a/docs/auditor/10.8/admin/settings/auditdatabase.md b/docs/auditor/10.8/admin/settings/auditdatabase.md
index c19db8ed6d..4ea5812590 100644
--- a/docs/auditor/10.8/admin/settings/auditdatabase.md
+++ b/docs/auditor/10.8/admin/settings/auditdatabase.md
@@ -26,7 +26,7 @@ will use a dedicated database to store data. So, there are two types of database
if needed.) See the [Fine-Tune Your Plan and Edit Settings](/docs/auditor/10.8/admin/monitoringplans/finetune.md) topic
for additional information.
-Follow the steps to review and update global Audit Database settings:
+## Review and update global Audit Database settings
**Step 1 –** Navigate to **Settings** > **Audit Database**.
@@ -39,8 +39,8 @@ Follow the steps to review and update global Audit Database settings:
| Option | Description |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Default SQL Server settings | Specify SQL Server instance name and connection settings. |
-| Database retention | Configure retention if you want audit data to be deleted automatically from your Audit Database after a certain period of time. These settings cannot be modified for a certain plan. |
-| SQL Server Reporting Services settings | Define the Report Server URL and account used to upload data to Report Server. These settings cannot be modified for a certain plan. |
+| Database retention | Configure retention if you want audit data to be deleted automatically from your Audit Database after a certain period of time. These settings can't be modified for a certain plan. |
+| SQL Server Reporting Services settings | Define the Report Server URL and account used to upload data to Report Server. These settings can't be modified for a certain plan. |
## Configure Default SQL Server Settings
@@ -49,7 +49,7 @@ Server settings section.
| Option | Description |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| SQL Server instance | Specify the name of the SQL Server instance to store audit data. If you have more than one Auditor Server running in your network, make sure to configure them to use different SQL Server instances. The same SQL Server instance cannot be used to store audit data collected by several Auditor Servers. |
+| SQL Server instance | Specify the name of the SQL Server instance to store audit data. If you have more than one Auditor Server running in your network, ensure to configure them to use different SQL Server instances. The same SQL Server instance can't be used to store audit data collected by several Auditor Servers. |
| Authentication | Select the authentication type you want to use to connect to the SQL Server instance: - Windows authentication - SQL Server authentication |
| User name | Specify the account to be used to connect to the SQL Server instance. This account must be granted the **database owner (db_owner)** role and the dbcreator server role. |
| Password | Enter a password. |
@@ -78,7 +78,7 @@ Reporting Services settings section.
| Option | Description |
| ------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Report Server URL | Specify the Report Server URL. Make sure that the resource is reachable. |
-| Report Manager URL | Specify the Report Manager URL. Make sure that the resource is reachable. |
-| User name | Specify the account to connect to SSRS. Use the following format: _domain\username_ or _hostname\username_ Workgroup format (_.\username_) is not supported. Use _hostname\username_ instead. Make sure this account is granted the Content Manager role on the Report Server. See the [SQL Server Reporting Services](/docs/auditor/10.8/requirements/sqlserverreportingservice.md) topic for additional information. |
+| Report Server URL | Specify the Report Server URL. ensure that the resource is reachable. |
+| Report Manager URL | Specify the Report Manager URL. ensure that the resource is reachable. |
+| User name | Specify the account to connect to SSRS. Use the following format: _domain\username_ or _hostname\username_ Workgroup format (_.\username_) isn't supported. Use _hostname\username_ instead. ensure this account is granted the Content Manager role on the Report Server. See the [SQL Server Reporting Services](/docs/auditor/10.8/requirements/sqlserverreportingservice.md) topic for additional information. |
| Password | Enter a password. |
diff --git a/docs/auditor/10.8/admin/settings/custombrand.md b/docs/auditor/10.8/admin/settings/custombrand.md
index 946c4855ee..54297e00c3 100644
--- a/docs/auditor/10.8/admin/settings/custombrand.md
+++ b/docs/auditor/10.8/admin/settings/custombrand.md
@@ -7,7 +7,7 @@ sidebar_position: 110
# Customize Branding
Netwrix Auditor allows customizing look and feel of your reports, search subscriptions and exported
-search results—you can skip Netwrix logo, add your company logo and title. However, users are not
+search results—you can skip Netwrix logo, add your company logo and title. However, users aren't
empowered to customize layout or color scheme.
Review the following for additional information:
@@ -26,11 +26,13 @@ You can customize branding for the following AuditIntelligence outputs:
- Overview dashboard exported to pdf file;
- Overview dashboard delivered in the subscription email.
-Please note the following rebranding limitations and requirements to the logo file:
+:::note
+**Rebranding limitations and logo requirements:**
+:::
-1. Make sure you have full Netwrix Auditor installation: Netwrix Auditor Server and Client to enable
+1. Ensure you have full Netwrix Auditor installation: Netwrix Auditor Server and Client to enable
rebranding.
-2. Since Netwrix applies company's logo as is, keep in mind reasonable limitations of your logo
+2. Since Netwrix applies company's logo as is, be aware of these logo limitations:
dimensions. You can find examples of appropriate logo files in the rebranding archive (file
LLogo.webp). Re-size your logo and verify that subscriptions emails and pdf files look fine after
rebranding.
@@ -40,14 +42,14 @@ Please note the following rebranding limitations and requirements to the logo fi
- For subscription emails, just put the logo file to _%ALLUSERSPROFILE%\Netwrix
Auditor\Branding_ and run the script to update email look and feel.
- - For exported pdf files, make sure that the logo file is located in the default directory for
+ - For exported pdf files, ensure that the logo file is located in the default directory for
each user that is going to work with exported search results, Risk Assessment and Overview
dashboards. Otherwise, specify custom path to logo file. Default path to logo for exported
files is _%LOCALAPPDATA%\Netwrix Auditor\Audit Intelligence\Resources_.
-Follow the steps t o customize branding
+## Customize branding
-**Step 1 –** On the computer where the Netwrix Auditor Server is installed, navigate to
+1. On the computer where the Netwrix Auditor Server is installed, navigate to
_%ALLUSERSPROFILE%\Netwrix Auditor_ and locate the Rebranding.zip package.
**Step 2 –** Unzip the package to any folder on the computer where Netwrix Auditor Server is
@@ -55,7 +57,7 @@ installed.
**Step 3 –** Run SearchRebranding.ps1 considering the following:
-- Use default paths to logo files—Run the script and type your company name as the `report_title`.
+- Use default paths to logo files—Run the script and enter your company name as the `report_title`.
- Use custom paths to logo files—run the script as follows:
`SearchRebranding.ps1 -subscriptions_logo_path -export_logo_path `
@@ -75,8 +77,6 @@ By default, Netwrix Auditor reports look as follows:
Report branding is customized on Netwrix Auditor Server side that means that all clients connected
to this server will have the same look and feel for reports.
-Follow the steps to customize branding.
-
**Step 1 –** On the computer where Auditor Server resides, navigate to _C:\Program Data\Netwrix
Auditor\Rebranding_.
@@ -105,9 +105,9 @@ be updated.
-Follow the steps to restore original look.
+## Restore original branding
-**Step 1 –** On the computer where Auditor Server resides, navigate to the script location.
+1. On the computer where Auditor Server resides, navigate to the script location.
**Step 2 –** Right-click a script and select Edit. Windows PowerShell ISE will start.
diff --git a/docs/auditor/10.8/admin/settings/general.md b/docs/auditor/10.8/admin/settings/general.md
index 612d9a5540..e2a03d1fce 100644
--- a/docs/auditor/10.8/admin/settings/general.md
+++ b/docs/auditor/10.8/admin/settings/general.md
@@ -6,15 +6,15 @@ sidebar_position: 10
# General
-On the General tab you can configure global Netwrix Auditor settings, e.g., self-audit, tags,
-accounts and passwords.
+On the General tab you can configure global Netwrix Auditor settings, e.g., self-audit, tags, accounts, and passwords.
Review the following for additional information:
| Option | Description |
| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Self-audit | Select to enable data collection for product self-auditing. Self-audit allows tracking every change to monitoring plan, data source, and audit scope and details about it (before-after values) so that you know that scope of data to be audited is complete and changed only in line with workflows adopted by our organization. Review the following for additional information: - [Netwrix Auditor Operations and Health](/docs/auditor/10.8/admin/healthstatus/overview.md) |
+| Self-audit | Select to enable data collection for product self-auditing. Self-audit tracks every change to monitoring plans, data sources, and audit scopes with before-and-after values, so you know the scope of audited data is complete and changed only in accordance with organizational workflows. Review the following for additional information: - [Netwrix Auditor Operations and Health](/docs/auditor/10.8/admin/healthstatus/overview.md) |
| Netwrix Auditor usage statistics | It is optional on your part to help Netwrix improve the quality, reliability, and performance of Netwrix products and services. If selected, Netwrix collects statistical information on how the Licensee uses the product in accordance with applicable law. Visit [Netwrix Corporation Software License Agreement](https://www.netwrix.com/eula.html) for additional information about the program. You can review a sample piece of data if you are interested in data acquired by Netwrix. |
-| Tags | Netwrix Auditor allows you to apply tags when creating an alert. With alerts, you can distinguish one alert from another, create groups of similar alerts, etc. The Tags page contains a complete list of alerts that were ever created in the product. See the [Alerts](/docs/auditor/10.8/admin/alertsettings/overview.md) topic for additional information. Currently, you cannot assign or create tags on this page. To apply tags to an alert, navigate to alert settings and locate the Apply tags section on the General tab. See the [Create Alerts](/docs/auditor/10.8/admin/alertsettings/create/create.md) topic for additional information. |
-| Account and passwords | Netwrix Auditor allows you to assign different accounts for monitoring plans. Click **Manage** to review the full list of accounts and associated auditing scope. You can also change accounts' password if necessary. |
+| Netwrix Auditor usage statistics | It is optional on your part to help Netwrix improve the quality, reliability, and performance of Netwrix products and services. If selected, Netwrix collects statistical information on how the Licensee uses the product in accordance with applicable law. Visit [Netwrix Corporation Software License Agreement](https://www.netwrix.com/eula.html) for additional information about the program. You can review a sample piece of data if you are interested in data acquired by Netwrix. |
+| Tags | Apply tags when creating alerts to distinguish one alert from another and create groups of similar alerts. The Tags page lists all alerts ever created in the product. See the [Alerts](/docs/auditor/10.8/admin/alertsettings/overview.md) topic for additional information. You can't assign or create tags on this page. To apply tags to an alert, navigate to alert settings and locate the Apply tags section on the General tab. See the [Create Alerts](/docs/auditor/10.8/admin/alertsettings/create/create.md) topic for additional information. |
+| Account and passwords | Assign different accounts for monitoring plans. Click **Manage** to review the full list of accounts and associated auditing scope. You can also change account passwords if necessary. |
| Access Reviews | Netwrix Auditor supports integration with Netwrix Auditor Access Reviews, which enables business owners to conduct resource and group reviews and recommend changes. See the [Access Reviews](/docs/auditor/10.8/accessreviews/accessreviews.md) topic for additional information. |
diff --git a/docs/auditor/10.8/admin/settings/integrations.md b/docs/auditor/10.8/admin/settings/integrations.md
index 3428cf1a31..70dd910f3f 100644
--- a/docs/auditor/10.8/admin/settings/integrations.md
+++ b/docs/auditor/10.8/admin/settings/integrations.md
@@ -6,7 +6,7 @@ sidebar_position: 60
# Integrations
-Netwrix Auditor Integration API—endless integration, auditing and reporting capabilities.
+Netwrix Auditor Integration API—endless integration, auditing, and reporting capabilities.
The Netwrix Auditor Integration API provides access to audit data collected by Netwrix Auditor
through REST API endpoints. According to the RESTful model, each operation is associated with a URL.
@@ -26,5 +26,4 @@ Netwrix recommends adding a special data source to your monitoring plan—Netwri
In Netwrix Auditor 9.0, Netwrix has updated API schemas. See the
[Compatibility Notice](/docs/auditor/10.8/api/compatibility.md) topic for additional information.
-To learn more about Integration API capabilities, refer to the
-[Integration API](/docs/auditor/10.8/api/overview.md).
+For more information about Integration API capabilities, see [Integration API](/docs/auditor/10.8/api/overview.md).
diff --git a/docs/auditor/10.8/admin/settings/investigations.md b/docs/auditor/10.8/admin/settings/investigations.md
index a8b23ae4b0..608eaa9c4c 100644
--- a/docs/auditor/10.8/admin/settings/investigations.md
+++ b/docs/auditor/10.8/admin/settings/investigations.md
@@ -6,13 +6,13 @@ sidebar_position: 40
# Investigations
-By default, the Audit Database stores data up to 180 days. Once the retention period is over, the
+By default, the Audit Database stores data for up to 180 days. When the retention period expires, the
data is deleted from the Audit Database and becomes unavailable for reporting and search.
-Depending on your company requirements you may need to investigate past incidents and browse old
-data stored in the Long-Term Archive. Netwrix Auditor allows importing data from the Long-Term
-Archive to a special "investigation" database. Having imported data there, you can run searches and
-generate reports with your past data.
+Depending on your company requirements, you may need to investigate past incidents and review old
+data stored in the Long-Term Archive. Netwrix Auditor lets you import data from the Long-Term
+Archive to a special "investigation" database. After importing data there, you can run searches and
+generate reports with your historical data.
@@ -28,11 +28,11 @@ investigation data, you must be assigned the Global administrator or Global revi
| Option | Description |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| SQL Server Instance | Specify the name of the SQL Server instance to import your audit data to. If you want to run searches and generate reports, select the same SQL Server instance as the one specified on Settings → Audit Database page. See [Audit Database](/docs/auditor/10.8/admin/settings/auditdatabase.md) topic for more information. |
- | Database | Select import database name. By default, data is imported to a specially created the Netwrix_ImportDB database but you can select any other. Do not select databases that already contain data. Selecting such databases leads to data overwrites and loss. |
+ | Database | Select import database name. By default, data is imported to a specially created the Netwrix_ImportDB database but you can select any other. Don't select databases that already contain data. Selecting such databases leads to data overwrites and loss. |
| Authentication | Select the authentication type you want to use to connect to the SQL Server instance: - Windows authentication - SQL Server authentication |
| User name | Specify the account to be used to connect to the SQL Server instance. This account must be granted the **database owner (db_owner)** role and the dbcreator server role. |
| Password | Enter a password. |
- | Clear imported data | Select to delete all previously imported data. To prevent SQL Server from overfilling, it is recommended to clear imported data once it is longer needed. |
+ | Clear imported data | Select to delete all previously imported data. Clear imported data when it's no longer needed to prevent SQL Server from running out of space. |
3. Review your New investigation configuration. Click Configure to specify the import scope.
@@ -40,6 +40,6 @@ investigation data, you must be assigned the Global administrator or Global revi
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| From... To... | Specify the time range for which you want to import past audit data. |
| Data sources | Select data sources whose audit data you want to import to the Audit Database. |
- | Monitoring plans | Select monitoring plans whose audit data you want to import to the Audit Database. Netwrix Auditor lists monitoring plans that are currently available in the product configuration. Select All to import audit data for all monitoring plans, including those that were removed from the product (or removed and then recreated with the same name—Netwrix Auditor treats them as different monitoring plans). For example, you had a monitoring plan corp.local used for auditing Active Directory. You removed this monitoring plan, but its audit data was preserved in the Long-Term Archive. Then, you created a new monitoring plan for auditing Exchange and named it corp.local again. Its data is also stored in the Long-Term Archive. Netwrix Auditor treats both corp.local monitoring plans—the removed and the current—as different. If you select corp.local in the monitoring plans list, only Exchange data will be imported to Audit Database (as it corresponds to the current monitoring plan configuration). To import Active Directory data from the removed monitoring plan, select All monitoring plans. |
+ | Monitoring plans | Select monitoring plans whose audit data you want to import to the Audit Database. Netwrix Auditor lists monitoring plans that are available in the product configuration. Select All to import audit data for all monitoring plans, including those that were removed from the product (or removed and then recreated with the same name—Netwrix Auditor treats them as different monitoring plans). For example, you had a monitoring plan corp.local used for auditing Active Directory. You removed this monitoring plan, but its audit data was preserved in the Long-Term Archive. Then, you created a new monitoring plan for auditing Exchange and named it corp.local again. Its data is also stored in the Long-Term Archive. Netwrix Auditor treats both corp.local monitoring plans—the removed and the current—as different. If you select corp.local in the monitoring plans list, only Exchange data will be imported to Audit Database (as it corresponds to the current monitoring plan configuration). To import Active Directory data from the removed monitoring plan, select All monitoring plans. |
4. Click Run.
diff --git a/docs/auditor/10.8/admin/settings/licenses.md b/docs/auditor/10.8/admin/settings/licenses.md
index c45c23a416..37e9f703c6 100644
--- a/docs/auditor/10.8/admin/settings/licenses.md
+++ b/docs/auditor/10.8/admin/settings/licenses.md
@@ -6,11 +6,9 @@ sidebar_position: 90
# Licenses
-The Licenses tab allows you to review the status of your current licenses, update them and add new
-licenses. To learn about Netwrix Auditor licenses, refer to the following Netwrix Knowledge Base
-article: [Netwrix Auditor Licensing FAQs]([https://www.netwrix.com/kb/2113](https://docs.netwrix.com/docs/kb/auditor/features-and-operations/glossaries-and-faqs/netwrix-auditor-licensing-faqs).
+Use the Licenses tab to review your current license status, update licenses, and add new ones. For information about Netwrix Auditor licensing, see [Netwrix Auditor Licensing FAQs](https://docs.netwrix.com/docs/kb/auditor/features-and-operations/glossaries-and-faqs/netwrix-auditor-licensing-faqs).
-Follow the steps to update or add a license.
+## Update or add a license
**Step 1 –** Click **Upload License File**.
diff --git a/docs/auditor/10.8/admin/settings/longtermarchive.md b/docs/auditor/10.8/admin/settings/longtermarchive.md
index 49a1751121..dd1bc440df 100644
--- a/docs/auditor/10.8/admin/settings/longtermarchive.md
+++ b/docs/auditor/10.8/admin/settings/longtermarchive.md
@@ -17,7 +17,7 @@ Review the following for additional information:
| Option | Description |
| ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Long-Term Archive settings | |
-| Write audit data to | Specify the path to a local or shared folder where your audit data will be stored. By default, it is set to _"C:\ProgramData\Netwrix Auditor\Data"_. By default, the LocalSystem account is used to write data to the local-based Long-Term Archive and computer account is used for the file share-based storage. Subscriptions created in the Auditor client are uploaded to file servers under the Long-Term Archive service account as well. It is not recommended to store your Long-Term Archive on a system disk. If you want to move the Long-Term Archive to another location, refer to the following Netwrix Knowledge base article: [How to move Long-Term Archive to a new location](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/how-to-move-long-term-archive-to-a-new-location). |
+| Write audit data to | Specify the path to a local or shared folder where your audit data will be stored. By default, it is set to _"C:\ProgramData\Netwrix Auditor\Data"_. By default, the LocalSystem account is used to write data to the local-based Long-Term Archive and computer account is used for the file share-based storage. Subscriptions created in the Auditor client are uploaded to file servers under the Long-Term Archive service account as well. It isn't recommended to store your Long-Term Archive on a system disk. If you want to move the Long-Term Archive to another location, see the Netwrix Knowledge base article: [How to move Long-Term Archive to a new location](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/how-to-move-long-term-archive-to-a-new-location). |
| Keep audit data for (in months) | Specify how long data will be stored. By default, it is set to 120 months. |
| Use custom credentials (for the file share-based Long-Term Archive only) | Select the checkbox and provide user name and password for the Long-Term Archive service account. You can specify a custom account only for the Long-Term Archive stored on a file share. The custom Long-Term Archive service account can be granted the following rights and permissions: - Advanced permissions on the folder where the Long-term Archive is stored: - List folder / read data - Read attributes - Read extended attributes - Create files / write data - Create folders / append data - Write attributes - Write extended attributes - Delete subfolders and files - Read permissions - On the file shares where report subscriptions are saved: - Change share permission - Create files / write data folder permission Subscriptions created in the Auditor client are uploaded to file servers under the Long-Term Archive service account as well. See the [Subscriptions](/docs/auditor/10.8/admin/subscriptions/overview.md) topic for additional information. |
@@ -28,10 +28,10 @@ Setting Recording Settings
| | |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Configure custom location of session recordings | Default location for storing session recordings is set to _"\\``\Netwrix_UAVR$"_. However, storing extra files on the Auditor Server may produce additional load on it, so consider using this option to specify another location where session recordings will be stored. |
-| Enter UNC path to shared folder: | Specify UNC path to the shared folder where user session video recordings will be stored. You can use server name or IP address, for example: _\\172.28.6.33\NA_UserSessions_ Using a local folder for that purpose is not recommended, as storing extra files on the Auditor Server will produce additional load on it. Make sure the specified shared folder has enough capacity to store the video files. Retention period for the video files can be adjusted in the related monitoring plan settings (targeted at User Activity data source); default retention is 7 days. See the [User Activity](/docs/auditor/10.8/admin/monitoringplans/overview_1.md) topic for additional information. After you specify and save settings for session recordings, it is recommended that you leave them unchanged. Otherwise — if you change the storage location while using Netwrix Auditor for User Activity — please be aware of possible data loss, as Auditor will not automatically move session recordings to a new location. |
-| User name / Password | Provide user name and password for the account that will be used to store session recordings to the specified shared folder. Make sure the account has at least the Write permission for that folder. |
+| Enter UNC path to shared folder: | Specify UNC path to the shared folder where user session video recordings will be stored. You can use server name or IP address, for example: _\\172.28.6.33\NA_UserSessions_ Using a local folder for that purpose isn't recommended, as storing extra files on the Auditor Server will produce additional load on it. ensure the specified shared folder has enough capacity to store the video files. Retention period for the video files can be adjusted in the related monitoring plan settings (targeted at User Activity data source); default retention is 7 days. See the [User Activity](/docs/auditor/10.8/admin/monitoringplans/overview_1.md) topic for additional information. After you specify and save settings for session recordings, don't change them. Otherwise — if you change the storage location while using Netwrix Auditor for User Activity — be aware of possible data loss, as Auditor will not automatically move session recordings to a new location. |
+| User name / Password | Provide user name and password for the account that will be used to store session recordings to the specified shared folder. ensure the account has at least the Write permission for that folder. |
Auditor informs you if you are running out of space on a system disk where the Long-Term Archive is
-stored by default. You will see events in the Netwrix Auditor **System Health** log once the free
+stored by default. You will see events in the Netwrix Auditor **System Health** log when the free
disk space starts approaching minimum level. When the free disk space is less than 3 GB, the
Netwrix services responsible for audit data collection will be stopped.
diff --git a/docs/auditor/10.8/admin/settings/notifications.md b/docs/auditor/10.8/admin/settings/notifications.md
index dc2ba3d743..32c5089205 100644
--- a/docs/auditor/10.8/admin/settings/notifications.md
+++ b/docs/auditor/10.8/admin/settings/notifications.md
@@ -57,11 +57,11 @@ could use the application to send email. To do this, the following actions requi
### Create a Group
-Follow the steps to create a group.
+To create a group.
**Step 1 –** Log in to the Exchange admin center with your administrator account.
-**Step 2 –** Under Groups click on the **Mail-enabled security** tab.
+**Step 2 –** Under Groups click the **Mail-enabled security** tab.
**Step 3 –** Click **Add a group**.
@@ -78,15 +78,15 @@ the group.
### Add Email to a Group
-Follow the steps to add emails to group.
+To add emails to group.
-**Step 1 –** In the Exchange admin center go to Groups and click on the [Mail-enabled security] tab.
+**Step 1 –** In the Exchange admin center go to Groups and click the [Mail-enabled security] tab.
-**Step 2 –** Click on the group you have created and add emails you want to allow APIs to access.
+**Step 2 –** Click the group you have created and add emails you want to allow APIs to access.
### Apply Restriction Using PowerShell Commands
-Follow the steps to run following commands using PowerShell.
+To run following commands using PowerShell.
**Step 1 –** Open PowerShell
@@ -124,14 +124,14 @@ and click Modify to adjust them if necessary.
| Port number | Specify your SMTP server port number. |
| Sender address | Enter the address that will appear in the From field. **_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. |
| SMTP authentication | Select this checkbox if your mail server requires the SMTP authentication. |
-| Sender email (from) | Enter the address that will appear in the "_From_" field in email notifications. This option does not affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, make sure that your Exchange supports this option. |
+| Sender email (from) | Enter the address that will appear in the "_From_" field in email notifications. This option doesn't affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, ensure that your Exchange supports this option. |
| User name | Enter a user name for the SMTP authentication. |
| Password | Enter a password for SMTP authentication. |
| Use Secure Sockets Layer encrypted connection (SSL/TLS) | Select this checkbox if your SMTP server requires SSL to be enabled. |
| Use implicit SSL authentication | Select this checkbox if the implicit SSL mode is used, which means that an SSL connection is established before any meaningful data is sent. |
-| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option is not available for auditing User Activity as well Netwrix Auditor tools. |
+| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option isn't available for auditing User Activity as well Netwrix Auditor tools. |
-You can configure Activity Summary frequency, format and delivery time for each monitoring plan
+You can configure Activity Summary frequency, format, and delivery time for each monitoring plan
individually. See the [Fine-Tune Your Plan and Edit Settings](/docs/auditor/10.8/admin/monitoringplans/finetune.md) topic
for more information.
@@ -140,17 +140,17 @@ emails.
## Summary Emails and Notifications about Critical Events
-Follow the steps to send summary emails and notifications about critical events.
+To send summary emails and notifications about critical events.
**Step 1 –** Navigate to the Summary email recipient and click Modify.
**Step 2 –** Specify recipient address:
- To send to a single recipient, enter personal mailbox address.
-- To send to multiple recipients, make sure they are added to a distribution group, and enter the
- group address. Entering multiple individual addresses is not supported.
+- To send to multiple recipients, ensure they are added to a distribution group, and enter the
+ group address. Entering multiple individual addresses isn't supported.
-To learn more about product health, you can also navigate to the Health status tile in the main
-window. It will take you to the Health Status dashboard that contains information on the product
-activity and system health state. See the
-[Health Status Dashboard](/docs/auditor/10.8/admin/healthstatus/dashboard/overview.md) topic for additional information.
+For more information about product health, see the
+[Health Status Dashboard](/docs/auditor/10.8/admin/healthstatus/dashboard/overview.md) topic. You can also navigate to the Health status tile in the main
+window to access the Health Status dashboard, which contains information on the product
+activity and system health state.
diff --git a/docs/auditor/10.8/admin/settings/sensitivedatadiscovery.md b/docs/auditor/10.8/admin/settings/sensitivedatadiscovery.md
index 82fd011119..8dd338cadc 100644
--- a/docs/auditor/10.8/admin/settings/sensitivedatadiscovery.md
+++ b/docs/auditor/10.8/admin/settings/sensitivedatadiscovery.md
@@ -6,12 +6,11 @@ sidebar_position: 80
# Sensitive Data Discovery
-Sensitive Data Discovery is an integration module between Auditor and Netwrix Data Classification.
-It allows Auditor users to generate reports and configure alerts and search for the sensitive data
-collected and classified with Netwrix Data Classification (NDC). Refer to the following
-documentation to learn more about NDC:
+Sensitive Data Discovery integrates Auditor with Netwrix Data Classification.
+Use it to generate reports, configure alerts, and search for sensitive data
+collected and classified with Netwrix Data Classification (NDC). For more information about NDC, see:
-- [ ](https://helpcenter.netwrix.com/bundle/DataClassification_5.6.2/page/NDC_Overview.html)[Netwrix Data Classification Documentation](https://helpcenter.netwrix.com/category/dataclassification)
+- [Netwrix Data Classification Documentation](https://helpcenter.netwrix.com/category/dataclassification)
The integration can be configured for the following Auditor data sources:
@@ -35,10 +34,10 @@ Databases
The following integration options are available:
-- NDC SQL Database Provider – This integration allows users to generate State-in-Time reports
+- NDC SQL Database Provider – This integration lets users generate State-in-Time reports
showing data categories for the sensitive data classified with Netwrix Data Classification.
Available for File storage systems, SharePoint, and SharePoint Online.
-- NDC Endpoint Provider – This integration allows users to receive alerts triggered by specific
+- NDC Endpoint Provider – This integration lets users receive alerts triggered by specific
events related to the sensitive data classified with Netwrix Data Classification. When enabled,
Netwrix users can also browse sensitive data with the search. Available for File storage systems
(including Windows file server, EMC, NetApp, Nutanix File server, Synology, and Qumulo),
@@ -58,7 +57,7 @@ The account must be granted the following rights and permissions:
Netwrix recommends using different accounts to connect to the SQL Server instances where NDC SQL
database and Categories database reside.
-**NOTE:** Netwrix Data Classification and Netwrix Auditor integration (NDC Provider) currently does
+**NOTE:** Netwrix Data Classification and Netwrix Auditor integration (NDC Provider) does
not support Single Sign-On. Single Sign-on needs to be disabled in Netwrix Data Classification in
order for the account used by the NDC Provider to authenticate.
@@ -137,9 +136,8 @@ steps to enable and configure Sensitive Data Discovery:
for additional information.
- Password – Provide a password for that account
-## What is Next
+## Run Data Collection and Review Sensitive Data
-Follow the steps to run a data collection and review sensitive data.
**Step 1 –** Navigate to your File storage system, SharePoint, SharePoint Online, or SQL Server
monitoring plan.
@@ -156,16 +154,18 @@ Netwrix suggests the following integration scenarios:
For NDC SQL Database Provider:
-Review your sensitive data in Data Discovery and Classification reports. Refer to the following
+Review your sensitive data in Data Discovery and Classification reports. See the following
Netwrix Auditor help center article for more information about these reports:
[Data Discovery and Classification Reports](/docs/auditor/10.8/admin/reports/types/datadiscoveryclassification.md).
ForNDC Endpoint Provider:
- Browse your data with Netwrix search.
-- **NOTE:** Shortly after the data collection, changes related to sensitive content are reported
- without data categories. For example, if a user adds some sensitive data to the SharePoint Online
- document that initially does not contain sensitive data; this will be reported as document
+:::note
+Shortly after the data collection, changes related to sensitive content are reported
+without data categories. For example, if a user adds some sensitive data to the SharePoint Online
+document that initially doesn't contain sensitive data; this will be reported as document
+:::
modification with empty "_data categories_" field. Another example: a user creates a new document
containing sensitive data on a file server; this will be reported as a file add with empty "data
categories" field. In this case, you have to wait until Netwrix Auditor processes information
diff --git a/docs/auditor/10.8/api/activityrecordreference.md b/docs/auditor/10.8/api/activityrecordreference.md
index 4d19baaa7a..ab777b5716 100644
--- a/docs/auditor/10.8/api/activityrecordreference.md
+++ b/docs/auditor/10.8/api/activityrecordreference.md
@@ -23,10 +23,10 @@ Records.
| ObjectType | Yes | nvarchar 255 | A type of affected object or its class (e.g., _user_, _mailbox_). |
| Monitoring Plan | No | nvarchar 255 | The Auditor object that is responsible for monitoring a given data source and item. Sub-elements: Name and ID. If you provide a monitoring plan name for input Activity Records, ensure the plan is created in Auditor, the Netwrix API data source is added to the plan, and enabled for monitoring. This ensures data is written to the database associated with this plan. |
| DataSource | No | nvarchar max | IT infrastructure monitored with Auditor (e.g., _Active Directory_). For input Activity Records, the data source is automatically set to Netwrix API. |
-| Item | No | nvarchar max | The exact object that is monitored (e.g., a domain name, SharePoint farm name) or integration name. Sub-element: Name. The item type is added inside the name value in brackets (e.g., _enterprise.local (Domain)_). For input Activity Records, the type is automatically set to Integration, you do not need to provide it. The output Activity Records may contain various item types depending on the monitoring plan configuration: - AD container
- NetApp
- Computer
- Office 365 tenant
- Domain
- Oracle Database instance
- EMC Isilon
- SharePoint farm
- Dell VNX/VNXe
- SQL Server instance
- Integration
- VMware ESX/ESXi/vCenter
- IP range
- Windows file share. If you provide an item name for input Activity Records, ensure this item is included in the monitoring plan within the Netwrix API data source. If you specify an item that does not exist, data will be written to the plan's database anyway but will not be available for search using the Item filter.
|
+| Item | No | nvarchar max | The exact object that is monitored (e.g., a domain name, SharePoint farm name) or integration name. Sub-element: Name. The item type is added inside the name value in brackets (e.g., _enterprise.local (Domain)_). For input Activity Records, the type is automatically set to Integration, you don't need to provide it. The output Activity Records may contain various item types depending on the monitoring plan configuration: - AD container
- NetApp
- Computer
- Office 365 tenant
- Domain
- Oracle Database instance
- EMC Isilon
- SharePoint farm
- Dell VNX/VNXe
- SQL Server instance
- Integration
- VMware ESX/ESXi/vCenter
- IP range
- Windows file share. If you provide an item name for input Activity Records, ensure this item is included in the monitoring plan within the Netwrix API data source. If you specify an item that doesn't exist, data will be written to the plan's database anyway but will not be available for search using the Item filter.
|
| Workstation | No | nvarchar max | An originating workstation from which the change was made (e.g., _WKSwin12.enterprise.local_). |
| IsArchiveOnly | No | — | IsArchiveOnly allows saving Activity Record to the Long-Term Archive only. In this case, these Activity Records will not be available for search in the Auditor client. |
-| DetailList | No | — | Information specific to the data source, e.g., assigned permissions, before and after values, start and end dates. References details. |
+| DetailList | No | — | Information specific to the data source, e.g., assigned permissions, before and after values, and start and end dates. References details. |
| Detail sub-elements (provided that DetailList exists) | | | |
| PropertyName | Yes | nvarchar 255 | The name of a modified property. |
| Message | No | string | Object-specific details about the change. Message is included in output Activity Records only. |
diff --git a/docs/auditor/10.8/api/compatibility.md b/docs/auditor/10.8/api/compatibility.md
index d265b62e05..a24a3ada1e 100644
--- a/docs/auditor/10.8/api/compatibility.md
+++ b/docs/auditor/10.8/api/compatibility.md
@@ -6,7 +6,7 @@ sidebar_position: 130
# Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
+Ensure to check your product version, and then review and update your add-ons and scripts
leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
| Property in 8.0 – 8.5 | New property in 9.0 and above |
@@ -15,4 +15,4 @@ leveraging Netwrix Auditor Integration API. Download the latest add-on version i
| XML: ``, JSON: `"ManagedObject"` | XML: ` Name Unique ID `, JSON: `"MonitoringPlan" : { "ID": "{Unique ID}", "Name": "Name" }` Now the MonitoringPlan contains two sub-entries: ID and Name. The ID property is optional and is assigned automatically by the product. |
| — | XML: `- Item name
`, JSON: `"Item": {"Name": "Item name"` |
-To learn more about input and output Activity Record structure, refer to [Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md).
+For more information about input and output Activity Record structure, see [Activity Records](/docs/auditor/10.8/api/postdata/activityrecords.md).
diff --git a/docs/auditor/10.8/api/filterreference/filteroperators.md b/docs/auditor/10.8/api/filterreference/filteroperators.md
index 4dd053dbc1..940ee5a7e8 100644
--- a/docs/auditor/10.8/api/filterreference/filteroperators.md
+++ b/docs/auditor/10.8/api/filterreference/filteroperators.md
@@ -6,15 +6,15 @@ sidebar_position: 20
# Operators
-Review the table below to learn more about operators.
+The following table describes the available operators.
| Operator | Description | Example |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Contains | This operator shows all entries that contain a value specified in the filter. | If you set the Who filter to contains _John_, you will get the following results: _Domain1\John_, _Domain1\Johnson_, _Domain2\Johnny_, _John@domain.com_. |
-| Equals | This operator shows all entries with the exact value specified. Make sure to provide a full object name or path. To apply this operator when adding filters in the Simple mode, provide a value in quotation marks (e.g., _"Domain1\John"_). | Use this operator if you want to get precise results, e.g., _\\FS\Share\NewPolicy.docx_. |
+| Equals | This operator shows all entries with the exact value specified. Ensure to provide a full object name or path. To apply this operator when adding filters in the Simple mode, provide a value in quotation marks (e.g., _"Domain1\John"_). | Use this operator if you want to get precise results, e.g., _\\FS\Share\NewPolicy.docx_. |
| Not equal to | This operator shows all entries except those with the exact value specified. In the Search field in the Simple mode, this operator appears as not, e.g., Who not for the Who filter. | If you set the Who filter to not equal to _Domain1\John_, you will exclude the exact user specified and find all changes performed by other users, e.g., _Domain1\Johnson, Domain2\John_. |
| Starts with | This operator shows all entries that start with the specified value. | If you set the Who filter to starts with _Domain1\John_, you will find all changes performed by _Domain1\John_, _Domain1\Johnson_, and _Domain1\Johnny_. |
| Ends with | This operator shows all entries that end with the exact specified value. | If you set the Who filter to ends with _John_, you will find all changes performed by _Domain1\John_, _Domain2\Dr.John_, _Domain3\John_. |
-| Does not contain | This operator shows all entries except those that contain the specified value. In the Search field in the Simple mode, this operator appears as not, e.g., Who not for the Who filter. | If you set the Who filter to does not contain _John_, you will exclude the following users: _Domain1\John_, _Domain2\Johnson_, and _Johnny@domain.com_. |
+| Doesn't contain | This operator shows all entries except those that contain the specified value. In the Search field in the Simple mode, this operator appears as not, e.g., Who not for the Who filter. | If you set the Who filter to doesn't contain _John_, you will exclude the following users: _Domain1\John_, _Domain2\Johnson_, and _Johnny@domain.com_. |
| In group | This operator relates to the Who filter. It instructs Netwrix Auditor to show only data for the accounts included in the specified group. | If you set the In group condition for Who filter to _Domain\Administrators_, only the data for the accounts included in that group will be displayed. |
| Not in group | This operator relates to the Who filter. It instructs Netwrix Auditor to show only data for the accounts not included in the specified group. | If you set the Not in group condition for Who filter to _Domain\Administrators_, only the data for the accounts not included in that group will be displayed. |
diff --git a/docs/auditor/10.8/api/filterreference/filterreference.md b/docs/auditor/10.8/api/filterreference/filterreference.md
index 7f0152872a..8a435bda61 100644
--- a/docs/auditor/10.8/api/filterreference/filterreference.md
+++ b/docs/auditor/10.8/api/filterreference/filterreference.md
@@ -6,7 +6,7 @@ sidebar_position: 80
# Reference for Creating Search Parameters File
-Review this section to learn more about operators and how to apply them to Activity Record filters
+This section describes how to use operators and how to apply them to Activity Record filters
to create a unique search. You can:
- Add different filters to your search. Search results will be sorted by all selected filters since
diff --git a/docs/auditor/10.8/api/filterreference/filters.md b/docs/auditor/10.8/api/filterreference/filters.md
index f64e207fb0..abcbb66722 100644
--- a/docs/auditor/10.8/api/filterreference/filters.md
+++ b/docs/auditor/10.8/api/filterreference/filters.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Filters
-Review the table below to learn more about filters. The filters correspond to Activity Record
+The following table describes the available filters. The filters correspond to Activity Record
fields.
| Filter | Description | Supported Operators |
diff --git a/docs/auditor/10.8/api/overview.md b/docs/auditor/10.8/api/overview.md
index ed6aab34fe..ff73b69b78 100644
--- a/docs/auditor/10.8/api/overview.md
+++ b/docs/auditor/10.8/api/overview.md
@@ -6,12 +6,10 @@ sidebar_position: 70
# Integration API
-Netwrix Auditor Netwrix Risk Insights leverages Netwrix Auditor Integration API. Although you can
-always use the add-on as is, but Netwrix encourages customers to create their own integration
-add-ons. The add-ons created based on Netwrix Auditor Integration API capabilities are easily
-tailored to your specific environment and business requirements.
+Netwrix Auditor integrates with Netwrix Risk Insights using the Netwrix Auditor Integration API. You can use the add-on as-is, or Netwrix encourages you to create custom integration
+add-ons. Add-ons based on Netwrix Auditor Integration API capabilities let you tailor integration to your specific environment and business requirements.
-Netwrix Auditor Integration API—endless integration, auditing and reporting capabilities.
+Netwrix Auditor Integration API—endless integration, auditing, and reporting capabilities.
The Netwrix Auditor Integration API provides access to audit data collected by Netwrix Auditor
through REST API endpoints. According to the RESTful model, each operation is associated with a URL.
@@ -25,7 +23,7 @@ Integration API provides the following capabilities:
Netwrix Auditor Integration API operates with XML- and JSON-formatted Activity Records—minimal
-chunks of audit data containing information on _who_ changed _what_, _when_ and _where_ this change
+chunks of audit data containing information on _who_ changed _what_, _when_, and _where_ this change
was made. XML format is set as default.
With Integration API you can write Activity Records to the SQL Server-based Audit Database and
@@ -37,7 +35,7 @@ is installed along with Netwrix Auditor Server and is enabled automatically. By
Auditor Integration API works over HTTPS protocol using an automatically generated certificate.
Default communication port is 9699.
-Netwrix does not limit you with applications that can be used with Integration API. You can write
+Netwrix doesn't limit you with applications that can be used with Integration API. You can write
RESTful requests using any tool or application you prefer—cURL, Telerik Fiddler, various Google
Chrome or Mozilla FireFox plug-ins, etc.
@@ -53,7 +51,7 @@ Complete the following fields:
| ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Specify a name for your integration | Specify the add-on name or provide any other name that distinguishes this custom source from any other. This name will be listed in the Item filter in the interactive search. |
-Make sure Integration API is enabled. To check it, navigate to Settings → Integrations tab. See
+Ensure Integration API is enabled. To check it, navigate to Settings → Integrations tab. See
[Integrations](/docs/auditor/10.8/admin/settings/integrations.md) for more information.
-Make sure to provide a monitoring plan name and item name in activity records before importing data.
+Ensure to provide a monitoring plan name and item name in activity records before importing data.
diff --git a/docs/auditor/10.8/api/postdata/activityrecords.md b/docs/auditor/10.8/api/postdata/activityrecords.md
index 88baf64039..ede99d6b4f 100644
--- a/docs/auditor/10.8/api/postdata/activityrecords.md
+++ b/docs/auditor/10.8/api/postdata/activityrecords.md
@@ -79,13 +79,13 @@ Records. [Write Activity Records](/docs/auditor/10.8/api/writeactivityrecords.md
## Schema
The Activity Records you want to feed to Netwrix Auditor must be compatible with input schema. The
-output schema resembles the input schema and can be used to validate Activity Records returned
+output schema resembles the input schema and lets you validate Activity Records returned
by Netwrix Auditor before further data parsing.
| Format | Schema description |
| ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| XML | The file must be compatible with the XML schema. On the computer where Auditor Server resides, you can find XSD file under _Netwrix_Auditor_installation_folder\Audit Core\API Schemas_. The `ActivityRecordList` root element includes the `ActivityRecord `elements. Each `ActivityRecord` contains values in the `Who`, `When`, `Where`, etc. fields. The `MonitoringPlan` element contains sub-elements such as `Name `and `ID`, the `Item `element contains `Name`. Both `MonitoringPlan` and `Item `are optional for input Activity Records. The `DetailList `element is optional too, it may include one or more `Detail `entries. The `Detail `element may contain sub-elements with values (e.g., before and after values). For input Activity Records, the data source is automatically set to Netwrix API. minOccurs="0" indicates that element is optional and may be absent when writing data to the Audit Database. |
-| JSON | Activity Records are sent as an array collected within square brackets [ ]. Each `ActivityRecord` object is collected in braces {} and contains values in the `Who`, `When`, `Where`, etc. fields. The `DetailList `field is not mandatory, it may include one or more detail. The `Detail `field may contain sub-fields with values (e.g., before and after values). For input Activity Records, the data source is automatically set to Netwrix API. |
+| JSON | Activity Records are sent as an array collected within square brackets [ ]. Each `ActivityRecord` object is collected in braces {} and contains values in the `Who`, `When`, `Where`, etc. fields. The `DetailList `field isn't mandatory, it may include one or more detail. The `Detail `field may contain sub-fields with values (e.g., before and after values). For input Activity Records, the data source is automatically set to Netwrix API. |
## Example
diff --git a/docs/auditor/10.8/api/postdata/overview.md b/docs/auditor/10.8/api/postdata/overview.md
index 4e485ad9fc..c70679b903 100644
--- a/docs/auditor/10.8/api/postdata/overview.md
+++ b/docs/auditor/10.8/api/postdata/overview.md
@@ -7,12 +7,12 @@ sidebar_position: 90
# Post Data
While running requests to Netwrix Auditor Integration API endpoints, you will need to post data,
-e.g., a Continuation mark in order to continue retrieving Activity Records, Search parameters to
+e.g., a Continuation mark to continue retrieving Activity Records, Search parameters to
find Activity Records matching your search, or Activity Records you want to feed to the Audit
Database. Data is sent in the request body and must be formatted according to XML convention and
compatible with Netwrix-provided XSD schemas.
-In Netwrix Auditor 9.0, Netwrix has updated API schemas. Make sure to check and update your custom
+In Netwrix Auditor 9.0, Netwrix has updated API schemas. Ensure to check and update your custom
scripts and add-ons. [Compatibility Notice](/docs/auditor/10.8/api/compatibility.md)
The file must be formatted in accordance with XML standard. The following symbols must be replaced
@@ -30,7 +30,7 @@ and > (greater than) symbols.
Also, Netwrix allows transferring data in JSON format (organized as name and value pairs). JSON file
must be formatted in accordance with JSON specification. Special characters in JSON strings must be
preceded with the \ character: " (double quotes), / (slash), \ (backslash). E.g.,
-"\\local\\enterprise\\Users\\Jason Smith". Trailing comma is not supported.
+"\\local\\enterprise\\Users\\Jason Smith". Trailing comma isn't supported.
Review the following for additional information:
diff --git a/docs/auditor/10.8/api/prerequisites.md b/docs/auditor/10.8/api/prerequisites.md
index 295b0c572a..8faaf54dd8 100644
--- a/docs/auditor/10.8/api/prerequisites.md
+++ b/docs/auditor/10.8/api/prerequisites.md
@@ -14,11 +14,9 @@ manage other API settings.
## Configure Integration API Settings
-Follow the steps to change the port.
-
**Step 1 –** In the Netwrix Auditor main window, navigate to the Integration tile.
-**Step 2 –** Make sure the Leverage Integration API option is enabled.
+**Step 2 –** Ensure the Integration API option is enabled.
**Step 3 –** Click Modify under the API settings section and specify a port number. Windows firewall
rule will be automatically created.
@@ -34,10 +32,10 @@ When you first configure the Audit Database settings in Netwrix Auditor, the pro
several databases for special purposes, including Netwrix_Auditor_API. This database is designed to
store data imported from the other sources using Netwrix Auditor Integration API.
-Make sure that the Audit Database settings are configured in Netwrix Auditor. To check or configure
+Ensure that the Audit Database settings are configured in Netwrix Auditor. To check or configure
these settings, navigate to the **Settings > Audit Database**.
-You cannot use Netwrix Auditor Integration API without configuring the Audit Database.
+You can't use Netwrix Auditor Integration API without configuring the Audit Database.
Refer to the [Audit Database](/docs/auditor/10.8/admin/settings/auditdatabase.md) topic for detailed instructions on
how to configure SQL Server settings.
diff --git a/docs/auditor/10.8/api/responsestatuscodes.md b/docs/auditor/10.8/api/responsestatuscodes.md
index 83a541c0c5..6a46677652 100644
--- a/docs/auditor/10.8/api/responsestatuscodes.md
+++ b/docs/auditor/10.8/api/responsestatuscodes.md
@@ -9,14 +9,14 @@ sidebar_position: 100
| Code | Status | Write Activity Records | Retrieve, search Activity Records |
| ---------------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 200 OK | Success | Success. The body is empty. Activity Records were written to the Audit Database and the Long-Term Archive. | Success. The body contains Activity Records. Activity Records were retrieved from the Audit Database. |
-| 400 Bad Request | Error | Error validating Activity Records. Make sure the Activity Records are compatible with the [Schema](postdata/activityrecords.md#schema). | Error validating request parameters or post data. Make sure the post data files (Continuation mark, Search parameters) are compatible with their schemas and the `?count=` parameter is valid. |
+| 400 Bad Request | Error | Error validating Activity Records. Ensure the Activity Records are compatible with the [Schema](postdata/activityrecords.md#schema). | Error validating request parameters or post data. Ensure the post data files (Continuation mark, Search parameters) are compatible with their schemas and the `?count=` parameter is valid. |
| 401 Unauthorized | Error | The request is unauthorized and the body is empty. See for [API Endpoints](/docs/auditor/10.8/api/endpoints.md) more information. | |
-| 404 Not Found | Error | Error addressing the endpoint. The body is empty. The requested endpoint does not exist (e.g., /netwrix/api/v1/mynewendpoint/). | |
+| 404 Not Found | Error | Error addressing the endpoint. The body is empty. The requested endpoint doesn't exist (e.g., /netwrix/api/v1/mynewendpoint/). | |
| 405 Method Not Allowed | Error | Error addressing the endpoint. The body is empty. Wrong HTTP request was sent (any except POST). | Error addressing the endpoint. The body is empty. Wrong HTTP request was sent (any except GET or POST). |
| 413 Request Entity Too Large | Error | Error transferring files. The body is empty. The posted file exceeds supported size. | |
-| 500 Internal Server Error | Error | Error writing Activity Records to the Audit Database or the Long-Term Archive: - One or more Activity Records were not processed.
- Netwrix Auditor license has expired.
- Internal error occurred.
| Error retrieving Activity Records from the Audit Database: - Netwrix Auditor license has expired.
- The Netwrix Auditor Archive Service is unreachable. Try restarting the service on the computer that hosts Netwrix Auditor Server.
- Internal error occurred.
|
+| 500 Internal Server Error | Error | Error writing Activity Records to the Audit Database or the Long-Term Archive: - One or more Activity Records weren't processed.
- Netwrix Auditor license has expired.
- Internal error occurred.
| Error retrieving Activity Records from the Audit Database: - Netwrix Auditor license has expired.
- The Netwrix Auditor Archive Service is unreachable. Try restarting the service on the computer that hosts Netwrix Auditor Server.
- Internal error occurred.
|
| 503 Service Unavailable | Error | The Netwrix Auditor Archive Service is busy or unreachable. Try restarting the service on the computer that hosts Netwrix Auditor Server. | — |
-Most failed requests contain error in the response body (except those with empty body, e.g., 404,
+Most failed requests contain an error in the response body (except those with empty body, e.g., 404,
405). [Error Details](/docs/auditor/10.8/api/errordetails.md)
diff --git a/docs/auditor/10.8/api/retrieveactivityrecords.md b/docs/auditor/10.8/api/retrieveactivityrecords.md
index 1645ed992c..3205aac9a8 100644
--- a/docs/auditor/10.8/api/retrieveactivityrecords.md
+++ b/docs/auditor/10.8/api/retrieveactivityrecords.md
@@ -8,7 +8,7 @@ sidebar_position: 40
## Endpoint
-Use to export data from the Audit Database. By default, first 1,000 Activity Records are returned.
+Use this endpoint to export data from the Audit Database. By default, the first 1,000 Activity Records are returned.
To get the next Activity Records, send a POST request to the same endpoint containing a Continuation
mark.
diff --git a/docs/auditor/10.8/api/searchactivityrecords.md b/docs/auditor/10.8/api/searchactivityrecords.md
index 9b6c8a03bc..cbaa82064f 100644
--- a/docs/auditor/10.8/api/searchactivityrecords.md
+++ b/docs/auditor/10.8/api/searchactivityrecords.md
@@ -12,8 +12,7 @@ available in the Netwrix Auditor client. See the
and [View and Search Collected Data](/docs/auditor/10.8/admin/search/overview.md) topic for detailed instruction on
how to search and filter audit data.
-As the interactive search in the Netwrix Auditor client, this REST API endpoint allows you to
-retrieve Activity Records matching a certain criteria. You can create your own set of filters in the
+Like the interactive search in the Netwrix Auditor client, use this REST API endpoint to retrieve Activity Records matching a certain criteria. You can create your own set of filters in the
Search parameters file. See the [Search Parameters](/docs/auditor/10.8/api/postdata/searchparameters.md) topic for more
information. Activity Records are retrieved according to the account's delegated scope.
@@ -69,7 +68,7 @@ Follow the steps- to retrieve all Activity Records matching search criteria.
[Search Parameters](/docs/auditor/10.8/api/postdata/searchparameters.md) topic for more information.
As an example, this request retrieves Activity Records where administrator added new objects to the
-Active Directory domain. Groups and group policies are not taken into account. Changes could only
+Active Directory domain. Groups and group policies aren't taken into account. Changes could only
occur between September 16, 2016 and March 16, 2017.
Ensure to pass information about transferred data, including `Content-Type:application/xml` or
diff --git a/docs/auditor/10.8/api/writeactivityrecords.md b/docs/auditor/10.8/api/writeactivityrecords.md
index e7d5b93331..73e11a385e 100644
--- a/docs/auditor/10.8/api/writeactivityrecords.md
+++ b/docs/auditor/10.8/api/writeactivityrecords.md
@@ -10,8 +10,8 @@ sidebar_position: 60
Write data to the Audit Database and to the Long-Term Archive. By default, all imported data is
written to a special Netwrix_Auditor_API database and recognized as the Netwrix API data source.
-This data is not associated with any monitoring plan in the product. You can associate Activity
-Records with a plan, in this case data will be written to a database linked to this plan. Make sure
+This data isn't associated with any monitoring plan in the product. You can associate Activity
+Records with a plan, in this case data will be written to a database linked to this plan. ensure
the plan you specify is already created in Netwrix Auditor, the Netwrix API data source is added to
the plan and enabled for monitoring.
diff --git a/docs/auditor/10.8/configuration/activedirectory/additional.md b/docs/auditor/10.8/configuration/activedirectory/additional.md
index 81d3551bd5..2e8186491b 100644
--- a/docs/auditor/10.8/configuration/activedirectory/additional.md
+++ b/docs/auditor/10.8/configuration/activedirectory/additional.md
@@ -8,7 +8,7 @@ sidebar_position: 40
If you have an on-premises Exchange server in your Active Directory domain, consider that some
changes can be made through this Exchange server. To be able to audit and report who made those
-changes, make sure that the account used for data collection meets one of the following
+changes, ensure that the account used for data collection meets one of the following
requirements:
- Membership in the Organization Management or Records Management group
@@ -44,7 +44,7 @@ reports, search results and activity summaries.
## Configure Manage Auditing and Security Log Policy
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
Domain Admins group. Follow the steps:
**Step 1 –** Open the **Group Policy Management** console on any domain controller in the target
@@ -68,20 +68,20 @@ policy for.
**Step 7 –** Run the following command to update group policy: `gpupdate /force`
-**Step 8 –** Type `repadmin /syncall` command and press Enter for replicate GPO changes to other
+**Step 8 –** Enter `repadmin /syncall` command and press Enter for replicate GPO changes to other
domain controllers.
**Step 9 –** Ensure that new GPO settings applied on any audited domain controller.
## Grant Permissions for Deleted Objects Container
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
Domain Admins group. Follow the steps:
**Step 1 –** Log on to any domain controller in the target domain with a user account that is a
member of the **Domain Admins** group.
-**Step 2 –** Navigate to **Start > Run** and type **cmd**.
+**Step 2 –** Navigate to **Start > Run** and enter **cmd**.
**Step 3 –** Input the following command: `dsacls /takeownership`
@@ -90,7 +90,7 @@ where `deleted_object_dn` is the distinguished name of the deleted directory obj
For example: `dsacls "CN=Deleted Objects,DC=Corp,DC=local" /takeownership`
**Step 4 –** To grant permission to view objects in the Deleted Objects container to a user or a
-group, type the following command:
+group, enter the following command:
`dsacls /G :`
@@ -102,7 +102,7 @@ For example, `dsacls "CN=Deleted Objects,DC=Corp,DC=local" /G Corp\jsmith:LCRP`
In this example, the user CORP\jsmith has been granted **List Contents** and **Read Property**
permissions for the **Deleted Objects** container in the **corp.local** domain. These permissions
-let this user view the contents of the **Deleted Objects** container, but do not let this user make
+let this user view the contents of the **Deleted Objects** container, but don't let this user make
any changes to objects in this container. These permissions are equivalent to the default
permissions that are granted to the **Domain Admins** group.
@@ -119,8 +119,6 @@ Management console.
### Configure the Log On As a Batch Job policy via Local Security Policy Snap-in
-Follow the steps to configure the Log On As a Batch Job policy via Local Security Policy snap-in.
-
**Step 1 –** On any domain controller in the target domain, open the Local Security Policy snap-in:
navigate to Start > Windows Administrative Tools and select Local Security Policy.
@@ -134,7 +132,7 @@ Specify the account that you want to define this policy for.
### Configure the Log On As a Batch Job Policy Using the Group Policy Management Console
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
Domain Admins group. Follow the steps:
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
@@ -155,17 +153,17 @@ the left and navigate to Policies > Windows Settings > Security Settings > Local
**Step 6 –** In the Log on as a batch job Properties dialog, click Add User or Group and specify the
user that you want to define this policy for.
-**Step 7 –** Navigate to Start > Run and type cmd. Input the `gpupdate /force` command and press
+**Step 7 –** Navigate to Start > Run and enter cmd. Input the `gpupdate /force` command and press
Enter. The group policy will be updated.
-**Step 8 –** Type `repadmin /syncall` command and press Enter for replicate GPO changes to other
+**Step 8 –** Enter `repadmin /syncall` command and press Enter for replicate GPO changes to other
domain controllers.
**Step 9 –** Ensure that new GPO settings applied on any audited domain controller.
## Assign Permission to Read the Registry Key
-This permission is required only if the account selected for data collection is not a member of the
+This permission is required only if the account selected for data collection isn't a member of the
Domain Admins group.
This permission should be assigned on each domain controller in the audited domain, so if your
@@ -178,8 +176,6 @@ console.
Assign Permission Via the Registry Editor Snap-in
-Follow the steps to assign permission via the Registry Editor snap-in:
-
**Step 1 –** On your target server, open Registry Editor: navigate to **Start > Run** and type
_"regedit"_.
@@ -199,8 +195,6 @@ To assign permission using the Group Policy Management console
Assign Permission Using the Group Policy Management Console
-Follow the steps to assign permission using the Group Policy Management console:
-
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
navigate to Start > Windows Administrative Tools (Windows Server 2016/2019) or Administrative Tools
(Windows 2012 R2 and below) > Group Policy Management.
@@ -231,10 +225,10 @@ OK.
**Step 10 –** Close the Group Policy Management console.
-**Step 11 –** Navigate to Start > Run and type **cmd**. Input the `gpupdate /force` command and
+**Step 11 –** Navigate to Start > Run and enter **cmd**. Input the `gpupdate /force` command and
press Enter. The group policy will be updated.
-**Step 12 –** Type `repadmin /syncall` command and press Enter for replicate GPO changes to other
+**Step 12 –** Enter `repadmin /syncall` command and press Enter for replicate GPO changes to other
domain controllers.
**Step 13 –** Ensure that new GPO settings were applied to the domain controllers.
diff --git a/docs/auditor/10.8/configuration/activedirectory/advancedpolicy.md b/docs/auditor/10.8/configuration/activedirectory/advancedpolicy.md
index 8aaecef089..0ac4237b59 100644
--- a/docs/auditor/10.8/configuration/activedirectory/advancedpolicy.md
+++ b/docs/auditor/10.8/configuration/activedirectory/advancedpolicy.md
@@ -33,7 +33,7 @@ To do it, perform the following steps:
and navigate to Policies → Windows Settings → Security Settings → Local Policies → Security
Options.
4. Locate the Audit: Force audit policy subcategory settings to override audit policy category
- settings and make sure that policy setting is set to _"Enabled"_.
+ settings and ensure that policy setting is set to _"Enabled"_.
diff --git a/docs/auditor/10.8/configuration/activedirectory/manual.md b/docs/auditor/10.8/configuration/activedirectory/manual.md
index f2f59bd9f4..824ac5c4e3 100644
--- a/docs/auditor/10.8/configuration/activedirectory/manual.md
+++ b/docs/auditor/10.8/configuration/activedirectory/manual.md
@@ -16,13 +16,11 @@ To configure your domain for monitoring manually, you will need:
- ADSI Edit — Required if you plan to perform configuration steps from a server other than domain
controller
-**NOTE:** If these tools are not installed, refer to the following Microsoft articles:
+**NOTE:** If these tools aren't installed, see the following Microsoft articles:
- [Group Policy Management Console](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn265969(v=ws.11))
- [ADSI Edit](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc773354(v=ws.10)?redirectedfrom=MSDN)
-Follow the steps to configure your domain for monitoring.
-
**Step 1 –** Configure effective domain controllers policy (by default, Default Domain Controllers
Policy). See the [Configure Basic Domain Audit Policies](/docs/auditor/10.8/configuration/activedirectory/basicpolicy.md) or
[Configure Advanced Audit Policies](/docs/auditor/10.8/configuration/activedirectory/advancedpolicy.md) topics for additional information.
@@ -54,12 +52,10 @@ Also, remember to perform the following steps for AD auditing:
## Enable Secondary Logon Service
-Follow the steps to Enable Secondary Logon Service.
-
**Step 1 –** On the computer where Auditor Server resides, navigate to Start > Windows
Administrative Tools > **Services**.
**Step 2 –** In the **Services** dialog, locate the **Secondary Logon** service.
-**Step 3 –** Right-click the service and on the **General** tab make sure that **Startup type** for
+**Step 3 –** Right-click the service and on the **General** tab ensure that **Startup type** for
this service is other than _Disabled_. The startup type can be either _Automatic_ or _Manual_.
diff --git a/docs/auditor/10.8/configuration/activedirectory/objectlevel.md b/docs/auditor/10.8/configuration/activedirectory/objectlevel.md
index 7a4e96014f..35700e195c 100644
--- a/docs/auditor/10.8/configuration/activedirectory/objectlevel.md
+++ b/docs/auditor/10.8/configuration/activedirectory/objectlevel.md
@@ -14,7 +14,7 @@ Auditing of the Configuration partition is enabled by default. See the
[Active Directory](/docs/auditor/10.8/admin/monitoringplans/activedirectory/overview.md) topic for detailed
instructions on how to enable monitoring of changes to the Schema partition in the target AD domain.
-Perform the following procedures to configure object-level auditing for the Domain, Configuration
+Perform the following procedures to configure object-level auditing for the Domain, Configuration,
and Schema partitions:
- Configuring object-level auditing for the Domain partition
@@ -42,10 +42,10 @@ dialog, select the **Auditing** tab.
1. Click **Add**. In the **Auditing Entry** dialog, click the **Select a principal** link.
2. In the **Select user, Computer, Service account, or Group** dialog, type _"Everyone"_ in the
**Enter the object name to select** field.
-3. Set **Type** to _"Success"_ and **Applies to** to _"This object and all descendant objects"_.
+3. Set **Type** to _"Success"_ and **Applies to** _"This object and all descendant objects"_.
4. Under **Permissions**, select all checkboxes except the following: _Full Control_, _List
Contents_, _Read All Properties_ and _Read Permissions_.
-5. Scroll to the bottom of the list and make sure that the **Only apply these auditing settings to
+5. Scroll to the bottom of the list and ensure that the **Only apply these auditing settings to
objects and/or containers within this container** checkbox is cleared.
@@ -61,7 +61,7 @@ Administrative Tools **> ADSI Edit**.
**Step 2 –** Right-click the **ADSI Edit** node and select **Connect To**. In the **Connection
Settings** dialog, enable **Select a well-known Naming Context** and select **Configuration** from
-the drop-down list.
+the dropdown list.
@@ -77,10 +77,10 @@ dialog, open the **Auditing** tab.
1. Click **Add**. In the **Auditing Entry** dialog, click the **Select a principal** link.
2. In the **Select user, Computer, Service account, or Group** dialog, type _"Everyone"_ in the
**Enter the object name to select** field.
-3. Set **Type** to _"Success"_ and **Applies to** to _"This object and all descendant objects"_.
+3. Set **Type** to _"Success"_ and **Applies to** _"This object and all descendant objects"_.
4. Under **Permissions**, select all checkboxes except the following: _Full Control_, _List
Contents_, _Read All Properties_ and _Read Permissions_.
-5. Scroll to the bottom of the list and make sure that the **Only apply these auditing settings to
+5. Scroll to the bottom of the list and ensure that the **Only apply these auditing settings to
objects and/or containers within this container** checkbox is cleared.
diff --git a/docs/auditor/10.8/configuration/activedirectory/overview.md b/docs/auditor/10.8/configuration/activedirectory/overview.md
index 537362ea46..48da0e6863 100644
--- a/docs/auditor/10.8/configuration/activedirectory/overview.md
+++ b/docs/auditor/10.8/configuration/activedirectory/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -40,15 +40,15 @@ You can configure your IT Infrastructure for monitoring in one of the following
**50** hours). See the [Adjust Security Event Log Size and Retention](/docs/auditor/10.8/configuration/activedirectory/securitylog.md)
topic.
- - To provide for event data collection, the Secondary Logon service must be up and running.
+ - To provide for event data collection, the Secondary Logon service must be running.
Open **Administrative Tools** > **Services**, right-click the **Secondary Logon** service
- and on the **General** tab make sure that Startup type for this service is other than
+ and on the **General** tab ensure that Startup type for this service is other than
_Disabled_.
## Monitored Objects
Netwrix Auditor tracks changes made to all object classes and attributes in the Active Directory
-Domain, Configuration and Schema partitions. It also tracks changes to new object classes and
+Domain, Configuration, and Schema partitions. It also tracks changes to new object classes and
attributes added due to the Active Directory Schema extension. For detailed information, refer to
Microsoft articles:
@@ -57,15 +57,15 @@ Microsoft articles:
Review the following limitations:
-- Netwrix Auditor does not track changes to non-replicated attributes, such as badPwdCount,
+- Netwrix Auditor doesn't track changes to non-replicated attributes, such as badPwdCount,
Last-Logon, Last-Logoff, etc. The non-replicated attributes pertain to a particular domain
- controller and are not replicated to other domain controllers.
+ controller and aren't replicated to other domain controllers.
- Changes made through the Exchange Management Console in the Organization Configuration node
(Federation Trust, Organization Relationships and Hybrid Configuration tabs) are displayed in an
internal Active Directory format that can be difficult to interpret.
- Netwrix Auditor tracks changes to membership in all groups inside the monitored domain (Domain
local groups) and Universal and Global groups of domains in the same forest. Changes to Domain
- local groups of a different domain in the same forest are not reported.
+ local groups of a different domain in the same forest aren't reported.
State-in-time data collection is supported for Active Directory.
@@ -142,7 +142,7 @@ you should:
- Configure the Exchange Administrator Audit Logging (AAL) settings, as described the
[Exchange Administrator Audit Logging Settings](/docs/auditor/10.8/configuration/exchange/auditlog.md) topic.
-- Make sure that the account used for data collection has the following:
+- Ensure that the account used for data collection has the following:
- Membership in the Organization Management or Records Management group
diff --git a/docs/auditor/10.8/configuration/activedirectory/permissions.md b/docs/auditor/10.8/configuration/activedirectory/permissions.md
index ace5331e87..a5e81bc5e8 100644
--- a/docs/auditor/10.8/configuration/activedirectory/permissions.md
+++ b/docs/auditor/10.8/configuration/activedirectory/permissions.md
@@ -38,7 +38,7 @@ additional information.
If you have an on-premises Exchange server in your Active Directory domain, consider that some
changes can be made via that Exchange server. To be able to audit and report who made those changes,
-you should make sure that the account used for data collection has any of the following:
+you should ensure that the account used for data collection has any of the following:
- Membership in the **Organization Management** or **Records Management** group.
@@ -73,11 +73,9 @@ reports, search results and activity summaries.
## Configure the Manage Auditing and Security Log Policy
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
Domain Admins group.
-Follow the steps to configure the Manage Auditing and Security Log Policy.
-
**Step 1 –** Open the **Group Policy Management** console on any domain controller in the target
domain: navigate to Start > Windows Administrative Tools (Windows Server 2016 and higher) or
Administrative Tools (Windows 2012) **Group Policy Management.**
@@ -99,22 +97,20 @@ Group**, specify the user that you want to define this policy for.
**Step 7 –** Run the following command to update group policy: `gpupdate /force`
-**Step 8 –** Type `repadmin /syncall` command and press Enter for replicate GPO changes to other
+**Step 8 –** Enter `repadmin /syncall` command and press Enter for replicate GPO changes to other
domain controllers.
**Step 9 –** Ensure that new GPO settings applied on any audited domain controller.
## Grant Permissions for the Deleted Objects Container
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
Domain Admins group.
-Follow the steps to grant permissions for the Deleted Objects Container.
-
**Step 1 –** Log on to any domain controller in the target domain with a user account that is a
member of the **Domain Admins** group.
-**Step 2 –** Navigate to **Start > Run** and type _"cmd"_.
+**Step 2 –** Navigate to **Start > Run** and enter _"cmd"_.
**Step 3 –** Input the following command: `dsacls /takeownership`
@@ -123,7 +119,7 @@ where `deleted_object_dn` is the distinguished name of the deleted directory obj
For example: `dsacls "CN=Deleted Objects,DC=Corp,DC=local" /takeownership`
**Step 4 –** To grant permission to view objects in the **Deleted Objects** container to a user or a
-group, type the following command:
+group, enter the following command:
`dsacls /G :`
@@ -135,7 +131,7 @@ For example, `dsacls "CN=Deleted Objects,DC=Corp,DC=local" /G Corp\jsmith:LCRP`
In this example, the user CORP\jsmith has been granted **List Contents** and **Read Property**
permissions for the **Deleted Objects** container in the **corp.local** domain. These permissions
-let this user view the contents of the **Deleted Objects** container, but do not let this user make
+let this user view the contents of the **Deleted Objects** container, but don't let this user make
any changes to objects in this container. These permissions are equivalent to the default
permissions that are granted to the **Domain Admins** group.
@@ -148,8 +144,6 @@ policy will be reset. In this case, redefine the Deny log on as a service policy
Security Policy console on your computer or on the domain level through the Group Policy Management
console.
-Follow the steps to define the Log On As a Service policy.
-
**Step 1 –** On the computer where Auditor Server is installed, open the **Local Security Policy**
snap-in: navigate to Start > Windows Administrative Tools and select Local Security Policy.
@@ -174,8 +168,6 @@ Management console.
### Configure the Log On As a Batch Job policy via Local Security Policy Snap-in
-Follow the steps to configure the Log On As a Batch Job policy via Local Security Policy snap-in.
-
**Step 1 –** On any domain controller in the target domain, open the **Local Security Policy**
snap-in: navigate to Start > Windows Administrative Tools and select Local Security Policy.
@@ -189,12 +181,9 @@ Specify the account that you want to define this policy for.
### Configure the Log On As a Batch Job Policy Using the Group Policy Management Console
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
Domain Admins group.
-Follow the steps to configure the Log On As a Batch Job policy using the Group Policy Management
-Console.
-
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
navigate to Start > Windows Administrative Tools (Windows Server 2016/2019) or Administrative Tools
(Windows 2012 R2 and below) > Group Policy Management.
@@ -213,10 +202,10 @@ the left and navigate to Policies > Windows Settings > Security Settings > Local
**Step 6 –** In the Log on as a batch job Properties dialog, click Add User or Group and specify the
user that you want to define this policy for.
-**Step 7 –** Navigate to Start > Run and type `cmd`. Input the `gpupdate /force` command and press
+**Step 7 –** Navigate to Start > Run and enter `cmd`. Input the `gpupdate /force` command and press
Enter. The group policy will be updated.
-**Step 8 –** Type `repadmin /syncall` command and press Enter for replicate GPO changes to other
+**Step 8 –** Enter `repadmin /syncall` command and press Enter for replicate GPO changes to other
domain controllers.
**Step 9 –** Ensure that new GPO settings applied on any audited domain controller.
diff --git a/docs/auditor/10.8/configuration/activedirectory/registrykey.md b/docs/auditor/10.8/configuration/activedirectory/registrykey.md
index de306fd580..4610ae3244 100644
--- a/docs/auditor/10.8/configuration/activedirectory/registrykey.md
+++ b/docs/auditor/10.8/configuration/activedirectory/registrykey.md
@@ -14,12 +14,12 @@ Netwrix Auditor. On the computer whereNetwrix Auditor Server is installed, navig
| ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\AD Change Reporter | |
| CleanAutoBackupLogs | Defines the retention period for the security log backups: - 0—Backups are never deleted from Domain controllers - [X]— Backups are deleted after [X] hours |
-| IgnoreAuditCheckResultError | Defines whether audit check errors should be displayed in the Activity Summary footer: - 0—Display errors - 1—Do not display errors |
-| IgnoreRootDCErrors | Defines whether to display audit check errors for the root domain (when data is collected from a child domain) in the Activity Summary footer: - 0—Display errors - 1—Do not display errors |
-| MonitorModifiedAndRevertedBack | Defines whether the Activity Summary must display the attributes whose values were modified and then restored between data collections: - 0—These attributes are not displayed - 1—These attributes are displayed as "modified and reverted back" |
+| IgnoreAuditCheckResultError | Defines whether audit check errors should be displayed in the Activity Summary footer: - 0—Display errors - 1—Don't display errors |
+| IgnoreRootDCErrors | Defines whether to display audit check errors for the root domain (when data is collected from a child domain) in the Activity Summary footer: - 0—Display errors - 1—Don't display errors |
+| MonitorModifiedAndRevertedBack | Defines whether the Activity Summary must display the attributes whose values were modified and then restored between data collections: - 0—These attributes aren't displayed - 1—These attributes are displayed as "modified and reverted back" |
| ProcessBackupLogs | Defines whether to process security log backups: - 0—No - 1—Yes Even if this key is set to _"0"_, the security log backups will not be deleted regardless of the value of the CleanAutoBackupLogs key. |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\AD Change Reporter\ | |
| CollectLogsMaxThreads | Defines the number of Domain Controllers to simultaneously start log collection on. |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\Management Console\Database settings | |
-| SqlOperationTimeout | Defines the timeout for executing SQL queries such as data selection, insertion or deletion (in seconds). |
+| SqlOperationTimeout | Defines the timeout for executing SQL queries such as data selection, insertion, or deletion (in seconds). |
| timeout | Defines the Audit Database connection timeout (in seconds). |
diff --git a/docs/auditor/10.8/configuration/activedirectory/securitylog.md b/docs/auditor/10.8/configuration/activedirectory/securitylog.md
index 3ed4cd67d3..5bec5b5069 100644
--- a/docs/auditor/10.8/configuration/activedirectory/securitylog.md
+++ b/docs/auditor/10.8/configuration/activedirectory/securitylog.md
@@ -15,7 +15,7 @@ method for this log to “_Overwrite events as needed_”.
To adjust your Security event log size and retention method, follow the procedure described below.
-To read about event log settings recommended by Microsoft, refer to the following article:
+To read about event log settings recommended by Microsoft, see the following article:
[Event Log](https://support.microsoft.com/en-us/help/957662/recommended-settings-for-event-log-sizes-in-windows).
To increase the maximum size of the Security event log and set its retention method
@@ -39,7 +39,7 @@ To increase the maximum size of the Security event log and set its retention met
`gpupdate /force`
-If "Overwrite" option is not enough to meet your data retention requirements, you can use
+If "Overwrite" option isn't enough to meet your data retention requirements, you can use
_auto-archiving_ option for Security event log to preserve historical event data in the archive
files. With that option enabled, you may want to adjust the retention settings for log archives
(backups). Related procedures are described in the
diff --git a/docs/auditor/10.8/configuration/activedirectory/tombstone.md b/docs/auditor/10.8/configuration/activedirectory/tombstone.md
index d49208ef68..a9b9c62384 100644
--- a/docs/auditor/10.8/configuration/activedirectory/tombstone.md
+++ b/docs/auditor/10.8/configuration/activedirectory/tombstone.md
@@ -13,23 +13,21 @@ Archive, a local file-based storage of audit data) and AD tombstones.
To be able to restore deleted Active Directory objects longer, increase the **Active Directory
tombstone lifetime** property (set by default to 180 days). Netwrix recommends setting it to 2 years
-(**730 days**). You can specify any number of days, but a selected value should not exceed the
+(**730 days**). You can specify any number of days, but a selected value shouldn't exceed the
Long-Term Archive retention period.
Take into consideration that increasing tombstone lifetime may affect Active Directory performance
and operability.
To perform this procedure, you will need the
-[ADSI Edit](http://technet.microsoft.com/en-us/library/cc773354(v=ws.10).aspx) utility.utility.
-
-Follow the steps to change the tombstone lifetime attribute.
+[ADSI Edit](http://technet.microsoft.com/en-us/library/cc773354(v=ws.10).aspx) utility.
**Step 1 –** On any domain controller in the target domain, navigate to Start > Windows
Administrative Tools **> ADSI Edit**.
**Step 2 –** Right-click the **ADSI Edit** node and select **Connect To**. In the **Connection
Settings** dialog, enable **Select a well-known Naming Context** and select **Configuration** from
-the drop-down list.
+the dropdown list.
diff --git a/docs/auditor/10.8/configuration/activedirectoryfederatedservices/overview.md b/docs/auditor/10.8/configuration/activedirectoryfederatedservices/overview.md
index 6f65573e5f..e4c51e7b95 100644
--- a/docs/auditor/10.8/configuration/activedirectoryfederatedservices/overview.md
+++ b/docs/auditor/10.8/configuration/activedirectoryfederatedservices/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -27,7 +27,7 @@ configuration replicated between them. The first AD FS federation server you set
becomes the **primary** server. Other federation servers you add to the farm will become
**secondary** servers.
-Make sure you have Windows Remote Management properly configured on your Auditor console computer.
+Ensure you have Windows Remote Management properly configured on your Auditor console computer.
See the [Software Requirements](/docs/auditor/10.8/requirements/software.md) topic for additional information.
You can configure your IT Infrastructure for monitoring in one of the following ways:
@@ -81,7 +81,7 @@ need to configure audit settings manually, as described later in this section.
**Step 2 –** In the **Configure audit settings** section, select **Adjust audit settings
-automatically** check box.
+automatically** checkbox.
@@ -92,8 +92,6 @@ necessary log settings on these servers.
## Configure AD FS farm manually
-Follow the steps to enable AD FS audit settings and set up Windows audit policy.
-
**Step 1 –** AD FS audit settings must be configured on the primary AD FS server, i.e. on the first
server you have set up in the farm:
diff --git a/docs/auditor/10.8/configuration/activedirectoryfederatedservices/permissions.md b/docs/auditor/10.8/configuration/activedirectoryfederatedservices/permissions.md
index 5dc29490e8..a3681998b3 100644
--- a/docs/auditor/10.8/configuration/activedirectoryfederatedservices/permissions.md
+++ b/docs/auditor/10.8/configuration/activedirectoryfederatedservices/permissions.md
@@ -14,5 +14,5 @@ you will provide this account in the monitoring plan wizard.
- If the target AD FS federation server is a domain controller, then the account must belong to the
**Administrators** or **Domain Admins** group
-- Otherwise, if the server is not a domain controller, the account must belong to the **Local
+- Otherwise, if the server isn't a domain controller, the account must belong to the **Local
Administrators** group.
diff --git a/docs/auditor/10.8/configuration/exchange/auditlog.md b/docs/auditor/10.8/configuration/exchange/auditlog.md
index 6c4079f97a..e2f38478c0 100644
--- a/docs/auditor/10.8/configuration/exchange/auditlog.md
+++ b/docs/auditor/10.8/configuration/exchange/auditlog.md
@@ -33,7 +33,7 @@ Programs → Exchange Management Shell**.
**Step 2 –** Execute the following command depending on your Exchange version:
-- Exchange 2019, 2016 and 2013
+- Exchange 2019, 2016, and 2013
`Set-AdminAuditLogConfig -AdminAuditLogEnabled $true -AdminAuditLogAgeLimit 30 -AdminAuditLogCmdlets * -LogLevel Verbose`
@@ -52,4 +52,4 @@ Exchange logging. For that:
`.\SetAALExcludedCmdlets.ps1`
-Make sure your policies allow script execution.
+Ensure your policies allow script execution.
diff --git a/docs/auditor/10.8/configuration/exchange/mailboxacccess.md b/docs/auditor/10.8/configuration/exchange/mailboxacccess.md
index a5e0d03d87..e576e312d3 100644
--- a/docs/auditor/10.8/configuration/exchange/mailboxacccess.md
+++ b/docs/auditor/10.8/configuration/exchange/mailboxacccess.md
@@ -16,12 +16,12 @@ information.
However, in some scenarios users may need to apply required audit settings manually. For that,
review the following procedures:
-- Configuring mailbox access tracking for Exchange 2019, 2016 and 2013 manually
+- Configuring mailbox access tracking for Exchange 2019, 2016, and 2013 manually
- Configuring mailbox access tracking for Exchange 2010 manually
-## Configuring mailbox access tracking for Exchange 2019, 2016 and 2013 manually
+## Configuring mailbox access tracking for Exchange 2019, 2016, and 2013 manually
-Perform the procedures below only if you do not want to enable the automatic audit configuration
+Perform the procedures below only if you don't want to enable the automatic audit configuration
option when setting up monitoring in Netwrix Auditor.
You can configure auditing for:
@@ -36,7 +36,7 @@ You can configure auditing for:
## Configuring mailbox access tracking for Exchange 2010 manually
-Perform the procedure below only if you do not want to enable network traffic compression option
+Perform the procedure below only if you don't want to enable network traffic compression option
when setting up Exchange monitoring in Netwrix Auditor.
**Step 1 –** On the computer where the monitored Exchange server is installed, navigate to **Start →
diff --git a/docs/auditor/10.8/configuration/exchange/overview.md b/docs/auditor/10.8/configuration/exchange/overview.md
index de8618eb8d..e103a16783 100644
--- a/docs/auditor/10.8/configuration/exchange/overview.md
+++ b/docs/auditor/10.8/configuration/exchange/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -42,19 +42,19 @@ You can configure your IT Infrastructure for monitoring in one of the following
- The Maximum Security event log size must be set to 4GB. The retention method of the
Security event log must be set to _“Overwrite events as needed.”_
- Auto archiving must be enabled to prevent audit data loss if log overwrites occur.
- - The Object-level audit settings must be configured for the Domain, Configuration and
+ - The Object-level audit settings must be configured for the Domain, Configuration, and
Schema partitions.
- The AD tombstoneLifetime attribute must be set to _"730"_.
- - If you have an on-premises Exchange server 2019, 2016, 2013 or 2010 in your Active
+ - If you have an on-premises Exchange server 2019, 2016, 2013, or 2010 in your Active
Directory domain, consider that some changes can be made via that Exchange server. To be
able to audit and report who made those changes, you should configure the Exchange
Administrator Audit Logging (AAL) settings, as described in the
[Exchange Administrator Audit Logging Settings](/docs/auditor/10.8/configuration/exchange/auditlog.md) topic.
- The Administrator Audit Logging settings must be configured (only required for Exchange
- 2019, 2016, 2013 or 2010). See the
+ 2019, 2016, 2013, or 2010). See the
[Exchange Administrator Audit Logging Settings](/docs/auditor/10.8/configuration/exchange/auditlog.md) topic for additional
information.
- - In order to audit mailbox access, native audit logging must be enabled for user, shared,
+ - To audit mailbox access, native audit logging must be enabled for user, shared,
equipment, linked, and room mailboxes:
- Access types: administrator , delegate user
@@ -76,9 +76,9 @@ You can configure your IT Infrastructure for monitoring in one of the following
**50** hours). See the
[Adjust Security Event Log Size and Retention](/docs/auditor/10.8/configuration/activedirectory/securitylog.md) topic.
- - To provide for event data collection, the Secondary Logon service must be up and running.
+ - To provide for event data collection, the Secondary Logon service must be running.
Open **Administrative Tools** > **Services**, right-click the **Secondary Logon** service
- and on the **General** tab make sure that Startup type for this service is other than
+ and on the **General** tab ensure that Startup type for this service is other than
_Disabled_.
_Remember,_ for Exchange auditing, do the following:
diff --git a/docs/auditor/10.8/configuration/exchange/permissions.md b/docs/auditor/10.8/configuration/exchange/permissions.md
index d5233628f5..189be60349 100644
--- a/docs/auditor/10.8/configuration/exchange/permissions.md
+++ b/docs/auditor/10.8/configuration/exchange/permissions.md
@@ -61,8 +61,6 @@ The following is required if auto-backup is _enabled_ for the domain controller
## Add Account to the Organization Management Group
-Follow the steps to add account to the Organization Management group.
-
**Step 1 –** Navigate to **Start > Active Directory Users and Computers** on any domain controller
in the root domain of the forest where Microsoft Exchange 2019, 2016, or 2013 is installed.
@@ -75,18 +73,16 @@ tab and click **Add**.
-If for some reason you do not want this account to belong to the Organization Management group, you
+If for some reason you don't want this account to belong to the Organization Management group, you
can add it to the Records Management group in the same way. The Records Management group is less
powerful, and accounts belonging to it have fewer rights and permissions.
## Assign Management Roles
-Perform this procedure only if the account selected for data collection is not a member of the
+Perform this procedure only if the account selected for data collection isn't a member of the
**Organization Management** or the **Records Management** group.
-Follow the steps to assign management roles.
-
-**Step 1 –** On the computer where Microsoft Exchange 2019, 2016, 2013 or is installed, open the
+**Step 1 –** On the computer where Microsoft Exchange 2019, 2016, or 2013 is installed, open the
**Exchange Management Shell** under an account that belongs to the **Organization Management**
group.
@@ -102,7 +98,7 @@ In this example, the user _CORP\jsmith_ has been assigned the **Audit Logs** rol
## Assign Permission to Read the Registry Key
-This permission is required only if the account selected for data collection is not a member of the
+This permission is required only if the account selected for data collection isn't a member of the
Domain Admins group.
This permission should be assigned on each domain controller in the audited domain, so if your
@@ -115,8 +111,6 @@ console.
### Assign Permission Via the Registry Editor Snap-in
-Follow the steps to assign permission via the Registry Editor snap-in.
-
**Step 1 –** On your target server, open Registry Editor: navigate to **Start > Run** and type
_"regedit"_.
@@ -134,8 +128,6 @@ _HKEY_LOCAL_MACHINE\SECURITY\Policy\PolAdtEv_ registry key.
### Assign Permission Using the Group Policy Management Console
-Follow the steps to assign permission using the Group Policy Management console.
-
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
navigate to Start > Windows Administrative Tools (Windows Server 2016/2019) or Administrative Tools
(Windows 2012 R2 and below) > Group Policy Management.
diff --git a/docs/auditor/10.8/configuration/exchange/permissionsregistrykeys.md b/docs/auditor/10.8/configuration/exchange/permissionsregistrykeys.md
index b3e92468c0..7704ec97f1 100644
--- a/docs/auditor/10.8/configuration/exchange/permissionsregistrykeys.md
+++ b/docs/auditor/10.8/configuration/exchange/permissionsregistrykeys.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Assign Permission To Read the Registry Key
-This permission is required only if the account selected for data collection is not a member of the
+This permission is required only if the account selected for data collection isn't a member of the
Domain Admins group. This permission should be assigned on each domain controller in the audited
domain, so if your domain contains multiple domain controllers, it is recommended to assign
permissions through Group Policy, or automatically using
@@ -17,8 +17,6 @@ information.
## Assign Permission Via the Registry Editor Snap-in
-Follow the steps to assign permission via the Registry Editor snap-in.
-
**Step 1 –** On your target server, open Registry Editor: navigate to **Start > Run** and type
_"regedit"_.
@@ -36,8 +34,6 @@ _HKEY_LOCAL_MACHINE\SECURITY\Policy\PolAdtEv_ registry key.
## Assign Permission Using the Group Policy Management Console
-Follow the steps to assign permission using the Group Policy Management console.
-
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
navigate to Start > Windows Administrative Tools (Windows Server 2016/2019) or Administrative Tools
(Windows 2012 R2 and below) > Group Policy Management.
diff --git a/docs/auditor/10.8/configuration/exchange/registrykey.md b/docs/auditor/10.8/configuration/exchange/registrykey.md
index 76937a0941..42f8982bd6 100644
--- a/docs/auditor/10.8/configuration/exchange/registrykey.md
+++ b/docs/auditor/10.8/configuration/exchange/registrykey.md
@@ -13,13 +13,13 @@ Auditor. Navigate to Start → Run and type _"regedit"_.
| ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\AD Change Reporter | |
| CleanAutoBackupLogs | Defines the retention period for the security log backups: - 0—Backups are never deleted from Domain controllers - [X]— Backups are deleted after [X] hours |
-| IgnoreAuditCheckResultError | Defines whether audit check errors should be displayed in the Activity Summary footer: - 0—Display errors - 1—Do not display errors |
-| IgnoreRootDCErrors | Defines whether to display audit check errors for the root domain (when data is collected from a child domain) in the Activity Summary footer: - 0—Display errors - 1—Do not display errors |
-| MonitorModifiedAndRevertedBack | Defines whether the Activity Summary must display the attributes whose values were modified and then restored between data collections: - 0—These attributes are not displayed - 1—These attributes are displayed as "modified and reverted back" |
+| IgnoreAuditCheckResultError | Defines whether audit check errors should be displayed in the Activity Summary footer: - 0—Display errors - 1—Don't display errors |
+| IgnoreRootDCErrors | Defines whether to display audit check errors for the root domain (when data is collected from a child domain) in the Activity Summary footer: - 0—Display errors - 1—Don't display errors |
+| MonitorModifiedAndRevertedBack | Defines whether the Activity Summary must display the attributes whose values were modified and then restored between data collections: - 0—These attributes aren't displayed - 1—These attributes are displayed as "modified and reverted back" |
| ProcessBackupLogs | Defines whether to process security log backups: - 0—No - 1—Yes Even if this key is set to _"0"_, the security log backups will not be deleted regardless of the value of the CleanAutoBackupLogs key. |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\AD Change Reporter\ | |
| CollectLogsMaxThreads | Defines the number of Domain Controllers to simultaneously start log collection on. |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\Management Console\Database settings | |
| overwrite_datasource | Defines whether to overwrite the database connection settings (stored in the reports data source) if they differ from the SQL server settings specified when configuring the monitoring plan: - 0—No - 1—Yes |
-| SqlOperationTimeout | Defines the timeout for executing SQL queries such as data selection, insertion or deletion (in seconds). |
+| SqlOperationTimeout | Defines the timeout for executing SQL queries such as data selection, insertion, or deletion (in seconds). |
| timeout | Defines the Audit Database connection timeout (in seconds). |
diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/cifss.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/cifss.md
index 6e8502f3da..d7cc15e0f0 100644
--- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/cifss.md
+++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/cifss.md
@@ -57,19 +57,17 @@ information:
| Auditing Entry |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Successful reads** |
-| The Auditing Entry below shows Advanced Permissions for auditing successful reads only: - Apply onto—Select _"Files only"_.
- Check _"Successful"_ and _"Failed"_ next to List folder / read data.
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing successful reads only: - Apply onto—Select _"Files only"_.
- Check _"Successful"_ and _"Failed"_ next to List folder / read data.
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
| **Successful changes** |
-| The Auditing Entry below shows Advanced Permissions for auditing successful changes only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Successful"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing successful changes only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Successful"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
| **Failed read attempts** |
-| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to List folder / read data.
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to List folder / read data.
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
| **Failed change attempts** |
-| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
## Configure Object-level Access Auditing on Windows Server 2012 and Above
-Follow the steps to configure Object-level access auditing on Windows Server 2012 and above.
-
**Step 1 –** Navigate to the target file share, right-click it and select **Properties**.
**Step 2 –** In the `` Properties dialog box, select the Security tab and click
@@ -100,10 +98,10 @@ Review the following for additional information:
| Auditing Entry | |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- |
| Successful reads | |
-| The Auditing Entry below shows Advanced Permissions for auditing successful reads only:  - Type—Set to _"Success"_.
- Applies to—Set to _"Files only"_.
- Advanced permissions—Select List folder / read data.
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing successful reads only:  - Type—Set to _"Success"_.
- Applies to—Set to _"Files only"_.
- Advanced permissions—Select List folder / read data.
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Successful changes | |
-| The Auditing Entry below shows Advanced Permissions for auditing successful changes only:  - Type—Set to _"Success"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing successful changes only:  - Type—Set to _"Success"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Failed read attempts | |
-| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions—Select List folder / read data.
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions—Select List folder / read data.
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Failed change attempts | |
-| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md
index fb700bc191..f4a8dc8a1b 100644
--- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md
+++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/objectaccess.md
@@ -8,12 +8,10 @@ sidebar_position: 30
Netwrix recommends you to avoid linking a GPO to the top level of the domain due to the potential
impact. Instead, create a new organization unit for your file servers within your domain and assign
-GPO there. For detailed instructions on how to create a new OU, refer to the following Microsoft
+GPO there. For detailed instructions on how to create a new OU, see the following Microsoft
article:
[Create a New Organizational Unit](https://technet.microsoft.com/en-us/library/cc771564.aspx).
-Follow the steps to configure Audit Object Access Policy:
-
**Step 1 –** Open the **Group Policy Management** console on any domain controller in the target
domain: navigate to Start > Windows Administrative Tools**→ Group Policy Management.**
diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md
index 6d763ac158..0c409d781e 100644
--- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md
+++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md
@@ -13,7 +13,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
diff --git a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md
index ec3ee353a8..a6022912a1 100644
--- a/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md
+++ b/docs/auditor/10.8/configuration/fileservers/delldatastorage/securityeventlog.md
@@ -6,20 +6,10 @@ sidebar_position: 20
# Configure Security Event Log Maximum Size
-Follow the steps to configure Event Log maximum size:
-
-**Step 1 –** On your file server, create a new file system where the security log will be stored.
-
-**Step 2 –** Mount this file system on a mount point, e.g., **/events**.
-
-**Step 3 –** Make sure that it is accessible via the **\\``\C$\events** UNC path.
-
-**Step 4 –** On the computer where Auditor Server is installed, open **Registry Editor**: navigate
-to **Start → Run** and type _"regedit"_.
-
-**Step 5 –** Navigate to **File → Connect Network Registry** and specify the file server name.
-
-**Step 6 –** Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security**
-and set the **File** value to _"C:\events\security.evt"_.
-
-**Step 7 –** Set the **MaxSize** value to _"4 000 000 000 (decimal)"_.
+1. On your file server, create a new file system where the security log will be stored.
+2. Mount this file system on a mount point, e.g., **/events**.
+3. Ensure that it is accessible via the **\\``\C$\events** UNC path.
+4. On the computer where Auditor Server is installed, open **Registry Editor**: navigate to **Start → Run** and type `regedit`.
+5. Navigate to **File → Connect Network Registry** and specify the file server name.
+6. Navigate to **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security** and set the **File** value to `C:\events\security.evt`.
+7. Set the **MaxSize** value to `4 000 000 000 (decimal)`.
diff --git a/docs/auditor/10.8/configuration/fileservers/dellisilon/compliance.md b/docs/auditor/10.8/configuration/fileservers/dellisilon/compliance.md
index fc744dc94e..ab3cfcf895 100644
--- a/docs/auditor/10.8/configuration/fileservers/dellisilon/compliance.md
+++ b/docs/auditor/10.8/configuration/fileservers/dellisilon/compliance.md
@@ -16,26 +16,16 @@ You can configure your cluster for monitoring in one of the following ways:
## Configure Dell Isilon/PowerScale Cluster in Compliance Mode Via Shell Script
-Follow the steps to configure Dell Isilon/PowerScale cluster in Compliance mode via the shell
-script:
-
-**Step 1 –** On the computer where Auditor Server resides, navigate to _C:\Program Files
-(x86)\Netwrix Auditor\File Server Auditing_ and copy the configure*ifs.sh shell script to
-*/ifs/data\_ catalog on your cluster.
-
-**Step 2 –** Navigate to your cluster command prompt through the SSH connection.
-
-**Step 3 –** Log in to your cluster as a **compadmin** user.
-
-**Step 4 –** Run the shell script by executing the following command:
+1. On the computer where Auditor Server resides, navigate to `C:\Program Files (x86)\Netwrix Auditor\File Server Auditing` and copy the `configure_ifs.sh` shell script to `/ifs/data` on your cluster.
+2. Navigate to your cluster command prompt through the SSH connection.
+3. Log in to your cluster as a **compadmin** user.
+4. Run the shell script by executing the following command:
`sh /ifs/data/configure_ifs.sh -z zone1 -a 1`
-where
-
-`zone1` is the name of the audited access zone on your file server.
-
-`1` is a combination of the bitwise flags. The table below shows the example combination of 4 flags:
+Where:
+- `zone1` is the name of the audited access zone on your file server.
+- `1` is a combination of the bitwise flags. The table below shows the example combination of 4 flags:
| | |
| ------------------------ | ---- |
@@ -45,18 +35,15 @@ where
| `Failed read attempts` | `8` |
| `Total:` | `15` |
-**Step 5 –** Create a shared folder named netwrix*audit$ on a system zone. This folder points to
-*/ifs\_:
+5. Create a shared folder named `netwrix_audit$` on a system zone. This folder points to `/ifs`:
`isi smb shares create --name=netwrix_audit$ --path=/ifs/ --zone=system --browsable=true`
-**Step 6 –** Add the BUILTIN\Administrators group in the share permissions for netwrix*audit$ folder
-with *"full access"\_ rights:
+6. Add the `BUILTIN\Administrators` group in the share permissions for `netwrix_audit$` folder with `full access` rights:
`isi smb shares permission create --share=netwrix_audit$ --group="BUILTIN\Administrators" --permission-type=allow --permission=full --zone=system`
-**Step 7 –** Grant your data collection account the _"read access"_ rights to the catalog
-_/ifs/.ifsvar/audit_ :
+7. Grant your data collection account `read access` rights to the `/ifs/.ifsvar/audit` catalog:
`isi zone modify system --add-user-mapping-rules="Enterprise\Administrator ++ compadmin [group]"`
@@ -64,31 +51,23 @@ Where `Enterprise\Administrator` is your account name.
## Configure Dell Isilon/PowerScale Cluster in Compliance Mode Manually
-Follow the steps to configure Dell Isilon/PowerScale cluster in Compliance mode manually:
-
-**Step 1 –** Navigate to your cluster command prompt through the SSH connection.
-
-**Step 2 –** Log in to your cluster as a **compadmin** user.
-
-**Step 3 –** Create a shared folder named netwrix*audit$ on a system zone. This folder points to
-*/ifs\_:
+1. Navigate to your cluster command prompt through the SSH connection.
+2. Log in to your cluster as a **compadmin** user.
+3. Create a shared folder named `netwrix_audit$` on a system zone. This folder points to `/ifs`:
`isi smb shares create --name=netwrix_audit$ --path=/ifs/ --zone=system --browsable=true`
-**Step 4 –** Add the BUILTIN\Administrators group in the share permissions for netwrix*audit$ folder
-with *"full access"\_ rights:
+4. Add the `BUILTIN\Administrators` group in the share permissions for `netwrix_audit$` folder with `full access` rights:
`isi smb shares permission create --share=netwrix_audit$ --group="BUILTIN\Administrators" --permission-type=allow --permission=full --zone=system`
-**Step 5 –** Grant your data collecting account the _"read access"_ rights to the catalog
-_/ifs/.ifsvar/audit_ :
+5. Grant your data collection account `read access` rights to the `/ifs/.ifsvar/audit` catalog:
`isi zone modify system --add-user-mapping-rules="Enterprise\Administrator ++ compadmin [group]"`
Where `Enterprise\Administrator` is your account name.
-**Step 6 –** Enable protocol auditing for a selected zone (for example, _"zone1"_). Do one of the
-following, depending on your Dell Isilon/PowerScale version:
+6. Enable protocol auditing for a selected zone (for example, `zone1`). Do one of the following, depending on your Dell Isilon/PowerScale version:
| EMC Isilon/PowerScale 7.x | EMC Isilon/PowerScale 8.x |
| -------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------- |
@@ -108,8 +87,7 @@ your cluster.
| Failed read attempts | |
| `isi zone zones modify ` `zone1 ` `--audit-failure= create,read` | `isi audit settings ` `modify --zone=zone1 ` `--audit-failure=create,read, open` |
-**Step 7 –** Create the _"netwrix_audit"_ role and add the required privileges to this role. For
-example:
+7. Create the `netwrix_audit` role and add the required privileges to this role. For example:
```isi auth roles create --name=netwrix_audit
diff --git a/docs/auditor/10.8/configuration/fileservers/dellisilon/normal.md b/docs/auditor/10.8/configuration/fileservers/dellisilon/normal.md
index 06a0b5fbe4..d76f7621ad 100644
--- a/docs/auditor/10.8/configuration/fileservers/dellisilon/normal.md
+++ b/docs/auditor/10.8/configuration/fileservers/dellisilon/normal.md
@@ -16,28 +16,18 @@ You can configure your cluster for monitoring in one of the following ways:
## Configure Dell Isilon/PowerScale Cluster in Normal or Enterprise Mode via Shell Script
-Follow the steps to configure Dell Isilon/PowerScale cluster in Normal or Enterprise mode using
-shell script:
-
-**Step 1 –** On the computer where Auditor Server resides, navigate to _C:\Program Files
-(x86)\Netwrix Auditor\File Server Auditing_ and copy the configure*ifs.sh shell script to
-*/ifs/data\_ catalog on your cluster.
-
-**Step 2 –** Navigate to your cluster command prompt through the SSH connection.
-
-**Step 3 –** Log in to your cluster as a root user.
-
-**Step 4 –** Run the shell script by executing the following command:
+1. On the computer where Auditor Server resides, navigate to `C:\Program Files (x86)\Netwrix Auditor\File Server Auditing` and copy the `configure_ifs.sh` shell script to `/ifs/data` on your cluster.
+2. Navigate to your cluster command prompt through the SSH connection.
+3. Log in to your cluster as a root user.
+4. Run the shell script by executing the following command:
```
sh /ifs/data/configure_ifs.sh -z zone1 -a 1
```
-where
-
-`zone1` is the name of the audited access zone on your file server.
-
-`1` is a combination of the bitwise flags. The table below shows the example combination of 4 flags:
+Where:
+- `zone1` is the name of the audited access zone on your file server.
+- `1` is a combination of the bitwise flags. The table below shows the example combination of 4 flags:
| | |
| ------------------------ | ---- |
@@ -49,13 +39,9 @@ where
## Configure Dell Isilon/PowerScale Cluster in Normal or Enterprise Mode Manually
-Follow the steps to configure Dell Isilon/PowerScale cluster in Normal or Enterprise mode manually:
-
-**Step 1 –** Navigate to your cluster command prompt through the SSH connection.
-
-**Step 2 –** Log in to your cluster as a root user.
-
-**Step 3 –** Grant full access to the catalog _/ifs/.ifsvar/audit/_ for BUILTIN\Administrators:
+1. Navigate to your cluster command prompt through the SSH connection.
+2. Log in to your cluster as a root user.
+3. Grant full access to the `/ifs/.ifsvar/audit/` catalog for `BUILTIN\Administrators`:
```
chmod -R +a group "BUILTIN\Administrators" allow dir_gen_all,object_inherit,container_inherit, inherited /ifs/.ifsvar/audit/
@@ -64,45 +50,42 @@ chmod +a group "BUILTIN\Administrators" allow dir_gen_all,object_inherit,contain
chmod +a user root allow dir_gen_read /ifs/.ifsvar/audit/
```
-**Step 4 –** Create a shared folder named netwrix*audit$ on a system zone. This folder points to
-*/ifs/.ifsvar/audit/\_:
+4. Create a shared folder named `netwrix_audit$` on a system zone. This folder points to `/ifs/.ifsvar/audit/`:
```
/usr/likewise/bin/lwnet share add "netwrix_audit$"="c:\\ifs\\.ifsvar\\audit\\"
isi smb shares modify netwrix_audit$ --new-zone=system
```
-Starting from Dell Isilon/PowerScale 9.2.0 and above, the `lwnet` command is considered as
-deprecated. When configuring audit manually, you see the following warning:
+Starting from Dell Isilon/PowerScale 9.2.0 and above, the `lwnet` command is considered deprecated. When configuring audit manually, you see the following warning:
+```
WARNING: lwnet has been deprecated.
-
-Please use `isi smb ...` equivalents instead.
+use `isi smb ...` equivalents instead.
+```
See `isi smb --help` for more information.
-This command is required to create a shared folder pointed to _/ifs/.ifsvar/audit/_. Please ignore
-the warning.
+This command is required to create a shared folder pointed to `/ifs/.ifsvar/audit/`. Ignore the warning.
-**Step 5 –** Add the BUILTIN\Administrators group in the share permissions for the netwrix*audit$
-folder with *"full access"\_ rights:
+5. Add the `BUILTIN\Administrators` group in the share permissions for the `netwrix_audit$` folder with `full access` rights:
```
isi smb shares permission create --share=netwrix_audit$ --group="BUILTIN\Administrators"
--permission-type=allow --permission=full --zone=system
```
-**NOTE:** Please verify the correctness of the path to the Isilon audit log files in
-`_Monitoring Plans -> -> -> Edit item -> General -> File share UNC path to audit logs_`
+:::note
+Verify the correctness of the path to the Isilon audit log files in **Monitoring Plans** > **** > **** > **Edit item** > **General** > **File share UNC path to audit logs**.
It must follow the format:
```
\\\netwrix_audit$\logs
```
+:::
-**Step 6 –** Enable protocol auditing for a selected zone (for example, _"zone1"_). Do one of the
-following, depending on your Dell Isilon/PowerScale storage version:
+6. Enable protocol auditing for a selected zone (for example, `zone1`). Do one of the following, depending on your Dell Isilon/PowerScale storage version:
| Dell Isilon/PowerScale 7.x | Dell Isilon/PowerScale 8.x |
| ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------- |
@@ -122,8 +105,7 @@ your cluster.
| Failed read attempts | |
| `isi zone zones modify zone1 --audit-failure= create,read` | `isi audit settings modify --zone=zone1 --audit-failure=create,read, open` |
-**Step 7 –** Create the _"netwrix_audit"_ role in your access zone (for example, "zone1") and add
-the required privileges to this role:
+7. Create the `netwrix_audit` role in your access zone (for example, `zone1`) and add the required privileges to this role:
```
isi auth roles create --name=netwrix_audit --zone=zone1
@@ -136,7 +118,7 @@ isi auth roles modify netwrix_audit --add-group="BUILTIN\Administrators" --zone=
When preparing to audit your Dell Isilon/PowerScale storage system, consider the following:
- If you plan to configure audit settings for Dell Isilon/PowerScale storage below the version 8.2
- manually (without using the**configure_ifs.sh** script), make sure that auditing of the
+ manually (without using the**configure_ifs.sh** script), ensure that auditing of the
`success create` events is **disabled**.
For Dell Isilon/PowerScale storage below the version 8.2, the storage system logging will become
@@ -146,7 +128,7 @@ When preparing to audit your Dell Isilon/PowerScale storage system, consider the
For Dell Isilon/PowerScale storage 8.2 and above, this option for manual audit configuration can
be safely enabled.
-- Auditing of the _System_ zone is not supported. As stated by Dell, this zone should be reserved
+- Auditing of the _System_ zone isn't supported. As stated by Dell, this zone should be reserved
for configuration access only. Current data should be stored in other access zones. See the
[Isilon OneFS 9.10.0.0 Web Administration Guide](https://www.dell.com/support/manuals/en-al/isilon-onefs/ifs-pub-91000-administration-guide-gui/access-zones-best-practices?guid=guid-49c42b04-e9cd-4520-bfe4-ce2d2c389d87&lang=en-us)
topic for additional information.
diff --git a/docs/auditor/10.8/configuration/fileservers/dellisilon/overview.md b/docs/auditor/10.8/configuration/fileservers/dellisilon/overview.md
index a50b101398..739b8d6ff0 100644
--- a/docs/auditor/10.8/configuration/fileservers/dellisilon/overview.md
+++ b/docs/auditor/10.8/configuration/fileservers/dellisilon/overview.md
@@ -9,8 +9,7 @@ sidebar_position: 20
Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
-certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data integrity; otherwise, your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -71,7 +70,7 @@ The following table lists actions that can be performed on Dell Isilon/PowerScal
| Remove (failed attempt) | +\* | +\* | – |
| Copied | – | – | – |
-**NOTE:** For Dell Isilon/PowerScale storage, auditing of _System_ zone is not supported. As stated
+**NOTE:** For Dell Isilon/PowerScale storage, auditing of _System_ zone isn't supported. As stated
by Dell, this zone should be reserved for configuration access only. Current data should be stored
in other access zones. See the
[Dell Upsilon CLI Administration Guide](https://www.dellemc.com/en-us/collaterals/unauth/technical-guides-support-information/2019/09/docu95372.pdf)
diff --git a/docs/auditor/10.8/configuration/fileservers/netappcmode/cifs.md b/docs/auditor/10.8/configuration/fileservers/netappcmode/cifs.md
index c2c7df71b4..fc4a11e6ba 100644
--- a/docs/auditor/10.8/configuration/fileservers/netappcmode/cifs.md
+++ b/docs/auditor/10.8/configuration/fileservers/netappcmode/cifs.md
@@ -57,52 +57,40 @@ Do one of the following depending on the OS:
| Auditing Entry |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Successful reads |
- | The Auditing Entry below shows Advanced Permissions for auditing successful reads only: - Apply onto—Select _"Files only"_. - Check _"Successful"_ and _"Failed"_ next to List folder / read data. - Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
+ | The Auditing Entry below shows Advanced Permissions for auditing successful reads only: - Apply onto—Select _"Files only"_. - Check _"Successful"_ and _"Failed"_ next to List folder / read data. - ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
| Successful changes |
- | The Auditing Entry below shows Advanced Permissions for auditing successful changes only: - Apply onto—Select _"This folder, subfolders and files"_. - Check _"Successful"_ next to the following permissions: - Create files / write data - Create folders / append data - Write extended attributes - Delete subfolders and files - Delete - Change permissions - Take ownership - Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
+ | The Auditing Entry below shows Advanced Permissions for auditing successful changes only: - Apply onto—Select _"This folder, subfolders and files"_. - Check _"Successful"_ next to the following permissions: - Create files / write data - Create folders / append data - Write extended attributes - Delete subfolders and files - Delete - Change permissions - Take ownership - ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
| Failed read attempts |
- | The Auditing Entry below shows Advanced Permissions for auditing failed read attempts only: - Apply onto—Select _"This folder, subfolders and files"_. - Check _"Failed"_ next to List folder / read data. - Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
+ | The Auditing Entry below shows Advanced Permissions for auditing failed read attempts only: - Apply onto—Select _"This folder, subfolders and files"_. - Check _"Failed"_ next to List folder / read data. - ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
| Failed change attempts |
- | The Auditing Entry below shows Advanced Permissions for auditing failed change attempts only: - Apply onto—Select _"This folder, subfolders and files"_. - Check _"Failed"_ next to the following permissions: - Create files / write data - Create folders / append data - Write extended attributes - Delete subfolders and files - Delete - Change permissions - Take ownership - Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
+ | The Auditing Entry below shows Advanced Permissions for auditing failed change attempts only: - Apply onto—Select _"This folder, subfolders and files"_. - Check _"Failed"_ next to the following permissions: - Create files / write data - Create folders / append data - Write extended attributes - Delete subfolders and files - Delete - Change permissions - Take ownership - ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared. |
## Configure Object-level Access Auditing on Windows Server 2012 and Above
-Follow the steps to configure Object-level access auditing on Windows Server 2012 and above.
-
-**Step 1 –** Navigate to the target file share, right-click it and select **Properties**.
-
-**Step 2 –** In the `` Properties dialog box, select the Security tab and click
-**Advanced**.
-
-**Step 3 –** In the Advanced Security Settings for `` dialog box, navigate to the
-Auditing tab.
+1. Navigate to the target file share, right-click it, and select **Properties**.
+2. In the `` Properties dialog box, select the **Security** tab and click **Advanced**.
+3. In the **Advanced Security Settings for ``** dialog box, navigate to the **Auditing** tab.
-**Step 4 –** Click **Add** to add a new principal. You can select **Everyone** (or another
-user-defined group containing users that are granted special permissions) and click **Edit**.
-
-**Step 5 –** In the Auditing Entry for `` dialog box, click the **Select a principal**
-link and specify **Everyone**.
+4. Click **Add** to add a new principal. You can select **Everyone** (or another user-defined group containing users that are granted special permissions) and click **Edit**.
+5. In the **Auditing Entry for ``** dialog box, click the **Select a principal** link and specify **Everyone**.
-**NOTE:** You can specify any other user group, but in this case the emails will be sent with
-warnings on incorrect audit configuration. The product will audit only user accounts that belong to
-the selected group.
+:::note
+You can specify any other user group, but in this case emails will be sent with warnings on incorrect audit configuration. The product will audit only user accounts that belong to the selected group.
+:::
-**Step 6 –** Apply settings to your Auditing Entries depending on the access types that you want to
-audit. If you want to audit all access types (successful reads, modification as well as failed read
-and modification attempts), you need to add separate Auditing Entries for each file share.
-Otherwise, reports will contain limited data and warning messages.
+6. Apply settings to your Auditing Entries depending on the access types that you want to audit. If you want to audit all access types (successful reads, modification, as well as failed read and modification attempts), you need to add separate Auditing Entries for each file share. Otherwise, reports will contain limited data and warning messages.
Review the following for additional information:
| Auditing Entry | |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- |
| Successful reads | |
-| The Auditing Entry below shows Advanced Permissions for auditing successful reads only:  - Type—Set to _"Success"_.
- Applies to—Set to _"Files only"_.
- Advanced permissions—Select List folder / read data.
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing successful reads only:  - Type—Set to _"Success"_.
- Applies to—Set to _"Files only"_.
- Advanced permissions—Select List folder / read data.
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Successful changes | |
-| The Auditing Entry below shows Advanced Permissions for auditing successful changes only:  - Type—Set to _"Success"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing successful changes only:  - Type—Set to _"Success"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Failed read attempts | |
-| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions—Select List folder / read data.
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions—Select List folder / read data.
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Failed change attempts | |
-| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
diff --git a/docs/auditor/10.8/configuration/fileservers/netappcmode/eventcategories.md b/docs/auditor/10.8/configuration/fileservers/netappcmode/eventcategories.md
index 43a626996f..0878a77c41 100644
--- a/docs/auditor/10.8/configuration/fileservers/netappcmode/eventcategories.md
+++ b/docs/auditor/10.8/configuration/fileservers/netappcmode/eventcategories.md
@@ -37,7 +37,7 @@ name.
In the example above, the `vserver audit create -destination /audit` command executed on the
`svm1` SVM creates and enables audit on the volume `/audit`.
- Netwrix Auditor accesses audit logs via file shares. Make sure the volume you specified is
+ Netwrix Auditor accesses audit logs via file shares. Ensure the volume you specified is
mounted on SVM and shared (e.g., `audit$` is a share name and its path is `/audit`).
4. Enable audit:
@@ -59,14 +59,14 @@ name.
| Option | Setting |
| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `Auditing State` | `true` |
- | `Categories of Events to Audit` | `file-ops` Only required if you use Clustered Data ONTAP 8.3, ONTAP 9.0, ONTAP 9.1 or later. You cannot select event categories if you use Clustered Data ONTAP 8.2. For ONTAP 9.0 and later, also check the following options: `file-ops, file-share, audit-policy-change`. For ONTAP 8.3, just check `file-ops`. |
+ | `Categories of Events to Audit` | `file-ops` Only required if you use Clustered Data ONTAP 8.3, ONTAP 9.0, ONTAP 9.1 or later. You can't select event categories if you use Clustered Data ONTAP 8.2. For ONTAP 9.0 and later, also check the following options: `file-ops, file-share, audit-policy-change`. For ONTAP 8.3, just check `file-ops`. |
| Log Format | "XML" or "EVTX" |
7. Modify the log file size limit—set to 300 MB. Execute:
svm1::> vserver audit modify -rotate-size 300MB
- 300MB is the recommended maximum log size proceeding from performance evaluations. Make sure
+ 300MB is the recommended maximum log size proceeding from performance evaluations. Ensure
there is enough disk space allocated for the security logs archives. Depending on the file
access activity, audit data may grow rapidly, and the location specified for the security log
(and security log auto archives) must be large enough to hold data until it is processed by
@@ -120,5 +120,6 @@ To configure logs retention period
-6. **NOTE:** If the **CleanAutoBackupLogs** registry value is set to _"0"_, you will have to remove
- the old logs manually, or you may run out of space on your hard drive.
+6. :::note
+If the **CleanAutoBackupLogs** registry value is set to `"0"`, you will have to remove the old logs manually, or you may run out of space on your hard drive.
+ :::
diff --git a/docs/auditor/10.8/configuration/fileservers/netappcmode/overview.md b/docs/auditor/10.8/configuration/fileservers/netappcmode/overview.md
index f5813aef43..5c765f7b5b 100644
--- a/docs/auditor/10.8/configuration/fileservers/netappcmode/overview.md
+++ b/docs/auditor/10.8/configuration/fileservers/netappcmode/overview.md
@@ -9,8 +9,7 @@ sidebar_position: 30
Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
-certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data integrity; otherwise, your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -23,7 +22,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
automatically configure audit in the target environment, your current audit settings will be
checked on each data collection and adjusted if necessary.
- - To use this option for NetApp Clustered Data ONTAP 8 or ONTAP 9, make sure that audit
+ - To use this option for NetApp Clustered Data ONTAP 8 or ONTAP 9, ensure that audit
configuration has been created (with `vserver audit create` command) for the target system
enabling audit configuration is optional.
@@ -138,9 +137,9 @@ the following administration and management guides.
Perform the following steps before proceeding with the audit configuration.
-**Step 1 –** Configure CIFS server and make sure it functions properly.
+**Step 1 –** Configure CIFS server and ensure it functions properly.
-**NOTE**: NFS file shares are not supported.
+**NOTE**: NFS file shares aren't supported.
**Step 2 –** Configure System Access Control List (SACL) on your file share. See
[Configure Audit Settings for CIFS File Shares](/docs/auditor/10.8/configuration/fileservers/netappcmode/cifs.md) topic for additional information.
@@ -152,4 +151,4 @@ the _"ntfs"_ or _"mixed"_.
volumes section in
[Clustered Data ONTAP® 8.3 File Access Management Guide for CIFS.](https://library.netapp.com/ecm/ecm_download_file/ECMP1610207)
-**NOTE:** The current version of Netwrix Auditor does not support auditing of Infinite Volumes.
+**NOTE:** The current version of Netwrix Auditor doesn't support auditing of Infinite Volumes.
diff --git a/docs/auditor/10.8/configuration/fileservers/netappcmode/servicepolicy.md b/docs/auditor/10.8/configuration/fileservers/netappcmode/servicepolicy.md
index 49368c263c..e2e36a592e 100644
--- a/docs/auditor/10.8/configuration/fileservers/netappcmode/servicepolicy.md
+++ b/docs/auditor/10.8/configuration/fileservers/netappcmode/servicepolicy.md
@@ -10,7 +10,7 @@ sidebar_position: 30
For older NetApp ONTAP versions use [System Service Firewall Policies](#configure-system-service-firewall-policies) instead.
By default, the 'default-data-files' policy is applied to the SVM CIFS/SMB interface and HTTP/HTTPS
-options are not available. To make the ONTAPI available through HTTP/HTTPS ports on your SVM
+options aren't available. To make the ONTAPI available through HTTP/HTTPS ports on your SVM
interface for Netwrix Auditor Server, configure the 'interface service'-policy. Below is an example
of the configuration:
diff --git a/docs/auditor/10.8/configuration/fileservers/netappcmode/webaccess.md b/docs/auditor/10.8/configuration/fileservers/netappcmode/webaccess.md
index 396185baa8..00a2917392 100644
--- a/docs/auditor/10.8/configuration/fileservers/netappcmode/webaccess.md
+++ b/docs/auditor/10.8/configuration/fileservers/netappcmode/webaccess.md
@@ -6,17 +6,11 @@ sidebar_position: 10
# Configure ONTAPI\RESTAPI Web Access
-Netwrix Auditor uses ONTAPI to obtain the current CIFS audit configuration and force the audit data
-flush from the internal filer format to an MS Event Viewer compatible format. Netwrix Auditor
-supports both the SSL and non-SSL HTTP access, trying HTTPS first, and falling back to HTTP if it is
-unavailable.
+Netwrix Auditor uses ONTAPI to obtain the current CIFS audit configuration and force the audit data flush from the internal filer format to an MS Event Viewer compatible format. Netwrix Auditor supports both the SSL and non-SSL HTTP access, trying HTTPS first, and falling back to HTTP if it is unavailable.
-Follow the steps to configure ONTAPI\RESTAPI Web Access.
+1. Navigate to your cluster management command prompt through the SSH/Telnet connection.
-**Step 1 –** Navigate to your cluster management command prompt through the SSH/Telnet connection.
-
-**Step 2 –** Log in as a cluster administrator and review your current web access settings. Make
-sure that External Web Services are allowed. For example:
+2. Log in as a cluster administrator and review your current web access settings. Ensure that External Web Services are allowed. For example:
| | |
| ------------------------------------------------------------------------------------------------------ | ------ |
@@ -35,7 +29,7 @@ If the result of the` External Web Services` command is '`false`', execute the f
cluster1::> system services web modify -external true
```
-**Step 3 –** Enable ONTAPI access on the 'Storage VM' (SVM) where CIFS server is installed. Run the
+3. Enable ONTAPI access on the 'Storage VM' (SVM) where CIFS server is installed. Run the
following command where svm1 is the name of your SVM:
```
@@ -56,10 +50,10 @@ To display the current settings of web services for SVM svm1, use the following
cluster1::> vserver services web show -vserver svm1
```
-**Step 4 –** Review the [Permissions for NetApp Auditing](/docs/auditor/10.8/configuration/fileservers/netappcmode/permissions.md) topic for additional
+4. Review the [Permissions for NetApp Auditing](/docs/auditor/10.8/configuration/fileservers/netappcmode/permissions.md) topic for additional
information on how to create the role and enable AD user access.
-**Step 5 –** Enable HTTP/HTTPS access. For example:
+5. Enable HTTP/HTTPS access. For example:
ONTAPI
@@ -73,7 +67,7 @@ RESTAPI
cluster1::> vserver services web modify -vserver svm1 -name rest -enabled true
```
-**Step 6 –** Enable only SSL access (HTTPS in Netwrix Auditor). For example:
+6. Enable only SSL access (HTTPS in Netwrix Auditor). For example:
ONTAPI
@@ -87,7 +81,7 @@ RESTAPI
cluster1::> vserver services web modify -vserver svm1 -name rest -enabled true -ssl-only true
```
-**Step 7 –** Make sure that the custom role (e.g., netwrix_role for ONTAPI or netwrix_rest_role for
+7. Ensure that the custom role (e.g., netwrix_role for ONTAPI or netwrix_rest_role for
RESTAPI) assigned to your account specified for data collection can access ONTAPI or RESTAPI. See
[Permissions for NetApp Auditing](/docs/auditor/10.8/configuration/fileservers/netappcmode/permissions.md) topic for additional information.
diff --git a/docs/auditor/10.8/configuration/fileservers/nutanix/notificationpolicy.md b/docs/auditor/10.8/configuration/fileservers/nutanix/notificationpolicy.md
index 2f20a9c87d..fb9747076b 100644
--- a/docs/auditor/10.8/configuration/fileservers/nutanix/notificationpolicy.md
+++ b/docs/auditor/10.8/configuration/fileservers/nutanix/notificationpolicy.md
@@ -22,7 +22,7 @@ include any of them.
| Successful _delete_ operations | FILE_DELETE DIRECTORY_DELETE |
| Failed _read/modify/delete_ attempts\* | FILE_OPEN |
-\* - Failed attempt to move/rename file are not audited.
+\* - Failed attempt to move/rename file aren't audited.
## Configuration Procedure
@@ -96,7 +96,7 @@ here:
_"all_mount_targets" : true_ - instructs to notify on changes to all shares
-_"protocol_type_list" : ["SMB"]_ - instructs to track SMB shares (the only currently supported)
+_"protocol_type_list" : ["SMB"]_ - instructs to track SMB shares (the only supported)
_``_ – enter the name of notification policy you want to create
@@ -143,9 +143,7 @@ _`_ – enter the uuid of target you want to audit.
## Example
-The JSON-formatted structure below is an example of the request body that can be used to create a
-notification policy named _MOUNT_POINT_POLICY_ to audit the mounted share on Nutanix File Server
-with the _uuid=378896fd-e829-4869-84a2-6c29268acfff_. The following operations will be audited:
+The JSON-formatted structure below is an example of the request body for creating a notification policy named `MOUNT_POINT_POLICY` to audit the mounted share on Nutanix File Server with the `uuid=378896fd-e829-4869-84a2-6c29268acfff`. The following operations will be audited:
- "FILE_READ",
- "FILE_CREATE",
diff --git a/docs/auditor/10.8/configuration/fileservers/nutanix/overview.md b/docs/auditor/10.8/configuration/fileservers/nutanix/overview.md
index dca9c5fad1..2197633816 100644
--- a/docs/auditor/10.8/configuration/fileservers/nutanix/overview.md
+++ b/docs/auditor/10.8/configuration/fileservers/nutanix/overview.md
@@ -9,8 +9,7 @@ sidebar_position: 40
Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
-certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data integrity; otherwise, your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -84,12 +83,9 @@ The following table lists the actions that can be performed with Nutanix Files:
The following considerations refer to Nutanix Files auditing and reporting:
-- All changes performed on Nutanix File Shares initiated from the machine(s) where Auditor Server
+- All changes performed on Nutanix File Shares initiated from the machines where Auditor Server
resides, will not displayed in Netwrix search and reports because Nutanix Files unable to generate
such Activity Records for Auditor.
- Auditing of NFS file shares in not supported due to known limitations.
-- Currently, not every detail about permission and attribute changes may be provided by Nutanix
- Files, so they cannot be reported by Auditor.
-- As for the state-in-time data collection, note that effective permissions (as a combination of
- NTFS and Shared permissions) are not calculated properly for the local Administrator group
- members.
+- not every detail about permission and attribute changes may be provided by Nutanix Files, so they can't be reported by Auditor.
+- For state-in-time data collection, effective permissions (as a combination of NTFS and Shared permissions) aren't calculated properly for the local Administrator group members.
diff --git a/docs/auditor/10.8/configuration/fileservers/nutanix/permissions.md b/docs/auditor/10.8/configuration/fileservers/nutanix/permissions.md
index 5ff8d1e0fe..17dc49a0f3 100644
--- a/docs/auditor/10.8/configuration/fileservers/nutanix/permissions.md
+++ b/docs/auditor/10.8/configuration/fileservers/nutanix/permissions.md
@@ -39,25 +39,14 @@ See the section below for the instructions on user role assignment.
## Role Assignment Procedure
-Before starting the role assignment, make sure your Nutanix File Server is included in the AD
-domain.
-
-Follow the steps to assign the required roles to the corresponding accounts using Nutanix Prism.
-
-**Step 1 –** Open Nutanix Prism web portal.
-
-**Step 2 –** Select **File Server** category. In the list of servers, select the server you want to
-audit.
-
-**Step 3 –** Click **Manage roles**.
-
-**Step 4 –** In the **Manage roles** dialog locate the **Add admins** section and click **+New
-user**.
-
-**Step 5 –** Enter the AD user account (to be used as data collection account) in the _domain\name_
-format and select the **File Server Admin** or **Backup Admin** role to assign
-
-**Step 6 –** Click **Save** next to these cells to save the settings.
+Before starting the role assignment, ensure your Nutanix File Server is included in the AD domain.
+
+1. Open Nutanix Prism web portal.
+2. Select **File Server** category. In the list of servers, select the server you want to audit.
+3. Click **Manage roles**.
+4. In the **Manage roles** dialog, locate the **Add admins** section and click **+New user**.
+5. Enter the AD user account (to be used as data collection account) in the `domain\name` format and select the **File Server Admin** or **Backup Admin** role to assign.
+6. Click **Save** next to these cells to save the settings.
**Step 7 –** Next, in the **REST API access users** section click **+New user**.
diff --git a/docs/auditor/10.8/configuration/fileservers/nutanix/ports.md b/docs/auditor/10.8/configuration/fileservers/nutanix/ports.md
index 0739a37a7c..0ac96cf8fc 100644
--- a/docs/auditor/10.8/configuration/fileservers/nutanix/ports.md
+++ b/docs/auditor/10.8/configuration/fileservers/nutanix/ports.md
@@ -6,18 +6,10 @@ sidebar_position: 10
# Nutanix Ports
-Follow the steps to open Nutanix port for inbound connections.
-
-**Step 1 –** On a target computer navigate to **Start** > **Control Panel** and select **Windows
-Firewall.**
-
-**Step 2 –** In the Help Protect your computer with Windows Firewall page, click **Advanced
-settings** on the left.
-
-**Step 3 –** In the Windows Firewall with Advanced Security dialog, select Inbound Rules on the
-left.
-
-**Step 4 –** Click New Rule. In the New Inbound Rule wizard, complete the steps as described below.
+1. On a target computer, navigate to **Start** > **Control Panel** and select **Windows Firewall**.
+2. In the **Help Protect your computer with Windows Firewall** page, click **Advanced settings** on the left.
+3. In the **Windows Firewall with Advanced Security** dialog, select **Inbound Rules** on the left.
+4. Click **New Rule**. In the **New Inbound Rule** wizard, complete the steps as described below.
| Option | Setting |
| ------------------- | -------------------------------------------------------------------------------------------------------- |
diff --git a/docs/auditor/10.8/configuration/fileservers/overview.md b/docs/auditor/10.8/configuration/fileservers/overview.md
index 1521e803cf..a4425347ea 100644
--- a/docs/auditor/10.8/configuration/fileservers/overview.md
+++ b/docs/auditor/10.8/configuration/fileservers/overview.md
@@ -30,13 +30,11 @@ by Auditor on these supported storage systems.:
## State-in-Time Data
-State-in-time data collection is supported for files, folders and shares on Windows-based file
-servers, Dell and NetApp storage systems, and Nutanix File Servers. Remember to select the
-corresponding option in the data source settings within the monitoring plan.
+State-in-time data collection is supported for files, folders, and shares on Windows-based file servers, Dell, and NetApp storage systems, and Nutanix File Servers. Remember to select the corresponding option in the data source settings within the monitoring plan.
## Sensitive Data
-Starting with the version 10, the product is able to report about sensitive data in your IT
+Starting with the version 10, the product can report about sensitive data in your IT
infrastructure. Pay attention to the "_Data categories_" column in search and reports (for the
"_File_" object types only). See the
[Sensitive Data Discovery ](/docs/auditor/10.8/admin/settings/sensitivedatadiscovery.md) topic for additional
@@ -46,17 +44,18 @@ information on how to enable monitoring of sensitive data in Auditor.
The table below lists the object types and attributes that can be monitored by Auditor.
-For more information on the attributes marked with (\*) , refer to the following Microsoft article:
+For more information on the attributes marked with (\*), see the Microsoft article:
[File Attribute Constants](https://msdn.microsoft.com/en-us/library/windows/desktop/gg258117(v=vs.85).aspx).
| Object type | Attributes |
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| File | - Attributes\* - Location - Name - Ownership - Permissions: - Group Permissions - User Permissions - Primary Group - Security descriptor control flags - Size - Data categories |
-| Folder | - Attributes\* The Reparse point attribute content is available for reviewing only when State-In-Time snapshot collection is enabled. Mind that reparse point content changes cannot be audited. - Location - Name - Ownership - Permissions: - Group Permissions - User Permissions - Primary Group - Security descriptor control flags |
+| Folder | - Attributes\* The Reparse point attribute content is available for reviewing only when State-In-Time snapshot collection is enabled. Mind that reparse point content changes can't be audited. - Location - Name - Ownership - Permissions: - Group Permissions - User Permissions - Primary Group - Security descriptor control flags |
| Share | - Access-based Enumeration - Caching - Continuous Availability - Description - Enable BranchCache - Encrypt Data Access - Local Path - User Limit |
-**CAUTION:** File and folder attributes marked with the (\*) are not monitored by default. Please
-contact Netwrix Technical Support team to monitor these file and folder attributes.
+:::caution
+File and folder attributes marked with (\*) aren't monitored by default. Contact Netwrix Technical Support to monitor these file and folder attributes.
+:::
In addition to general object attributes, Auditor generates the following attributes associated with
the object and reserved for internal use:
diff --git a/docs/auditor/10.8/configuration/fileservers/qumulo/configure.md b/docs/auditor/10.8/configuration/fileservers/qumulo/configure.md
index fdb7b6d294..67c5acd565 100644
--- a/docs/auditor/10.8/configuration/fileservers/qumulo/configure.md
+++ b/docs/auditor/10.8/configuration/fileservers/qumulo/configure.md
@@ -24,5 +24,5 @@ To configure Core Audit for Qumulo file servers
When you see the green line “_Connected_”, the environment is ready.
-For detailed information about Qumulo Web UI. refer to the following Qumulo how-to article:
+For detailed information about Qumulo Web UI, see the Qumulo how-to article:
[Qumulo Core Audit Logging](https://care.qumulo.com/hc/en-us/articles/360021454193-Qumulo-Core-Audit-Logging).
diff --git a/docs/auditor/10.8/configuration/fileservers/qumulo/overview.md b/docs/auditor/10.8/configuration/fileservers/qumulo/overview.md
index 4e9c637522..6422635a8b 100644
--- a/docs/auditor/10.8/configuration/fileservers/qumulo/overview.md
+++ b/docs/auditor/10.8/configuration/fileservers/qumulo/overview.md
@@ -9,8 +9,7 @@ sidebar_position: 50
Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
-certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data integrity; otherwise, your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
diff --git a/docs/auditor/10.8/configuration/fileservers/synology/configure.md b/docs/auditor/10.8/configuration/fileservers/synology/configure.md
index 53de1c34e7..67503caf10 100644
--- a/docs/auditor/10.8/configuration/fileservers/synology/configure.md
+++ b/docs/auditor/10.8/configuration/fileservers/synology/configure.md
@@ -6,15 +6,9 @@ sidebar_position: 10
# Configure Synology File Servers for Audit
-Follow the steps to configure your Synology NAS devices to transmit the local system logs for
-monitoring.
-
-**Step 1 –** Navigate to **Control Panel > File Services > SMB > Log Settings**. Please note that
-all audit types should be enabled.
-
-**Step 2 –** Log in to the Synology Web Administration Console.
-
-**Step 3 –** Navigate to **Log Center > Log Sending** and configure the following:
+1. Navigate to **Control Panel** > **File Services** > **SMB** > **Log Settings**. All audit types should be enabled.
+2. Log in to the Synology Web Administration Console.
+3. Navigate to **Log Center** > **Log Sending** and configure the following:
- Server – Provide the IP address or the computer listened by Syslog. It should be a running Netwrix
Syslog service or a third-party Syslog forward service.
@@ -24,11 +18,12 @@ all audit types should be enabled.
- Enable secure connection – Use the default value.
- Import certificate – Use the default value.
-**Step 4 –** Click Apply.
+4. Click **Apply**.
-> **NOTE:** Currently, Netwrix Auditor cannot collect activities using a local Synology user. Data
-collection only supported via a domain user with the necessary access privileges to the Synology
-file server.
+:::note
+Netwrix Auditor can't collect activities using a local Synology user. Data collection is only supported via a domain user with the necessary access privileges to the Synology file server.
+:::
-> **NOTE:** Currently, Netwrix Auditor cannot collect activities on shared folders hidden using
-the Synology option **Hide this shared folder in "My Network Places"**.
+:::note
+Netwrix Auditor can't collect activities on shared folders hidden using the Synology option **Hide this shared folder in "My Network Places"**.
+:::
diff --git a/docs/auditor/10.8/configuration/fileservers/synology/overview.md b/docs/auditor/10.8/configuration/fileservers/synology/overview.md
index 53bbd5c6c3..5b997a203a 100644
--- a/docs/auditor/10.8/configuration/fileservers/synology/overview.md
+++ b/docs/auditor/10.8/configuration/fileservers/synology/overview.md
@@ -9,8 +9,7 @@ sidebar_position: 60
Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
-certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data integrity; otherwise, your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
diff --git a/docs/auditor/10.8/configuration/fileservers/windows/advancedpolicy.md b/docs/auditor/10.8/configuration/fileservers/windows/advancedpolicy.md
index de5805f3c1..1e839a187f 100644
--- a/docs/auditor/10.8/configuration/fileservers/windows/advancedpolicy.md
+++ b/docs/auditor/10.8/configuration/fileservers/windows/advancedpolicy.md
@@ -12,21 +12,14 @@ below instead of the [Configure Local Audit Policies](/docs/auditor/10.8/configu
## Configure Security Options
-Setting up both basic and advanced audit policies may lead to incorrect audit reporting. To force
-basic audit policies to be ignored and prevent conflicts, enable the _Audit: Force audit policy
-subcategory settings_ policy.
+Setting up both basic and advanced audit policies may lead to incorrect audit reporting. To force basic audit policies to be ignored and prevent conflicts, enable the **Audit: Force audit policy subcategory settings** policy.
-Follow the steps to enforce advanced policies.
+1. On the audited server, open the **Local Security Policy** snap-in and navigate to **Start** > **Windows Administrative Tools** > **Local Security Policy**.
+2. Navigate to **Security Settings** > **Local Policies** > **Security Options** and locate the **Audit: Force audit policy subcategory settings** policy.
-**Step 1 –** On the audited server, open the Local Security Policy snap-in and navigate to Start >
-Windows Administrative Tools > Local Security Policy.
+
-**Step 2 –** Navigate to Security Settings > Local Policies > Security Options and locate the Audit:
-Force audit policy subcategory settings policy.
-
-
-
-**Step 3 –** Double-click the policy and enable it.
+3. Double-click the policy and enable it.
## Configure Advanced Audit Policy on Windows Server 2016 and Above
diff --git a/docs/auditor/10.8/configuration/fileservers/windows/configuration.md b/docs/auditor/10.8/configuration/fileservers/windows/configuration.md
index a81b5966f6..23cf75c510 100644
--- a/docs/auditor/10.8/configuration/fileservers/windows/configuration.md
+++ b/docs/auditor/10.8/configuration/fileservers/windows/configuration.md
@@ -6,55 +6,46 @@ sidebar_position: 80
# Configure the Back up Files and Directories Policy
-Configure this Back up Files and Directories policy via the Local Security Policy Snap-in or using
-the Group Policy Management Console.
+Configure this Back up Files and Directories policy via the Local Security Policy Snap-in or using the Group Policy Management Console.
-Follow the steps to configure the Back up Files and Directories policy via the Local Security Policy
-Snap-in.
+## Configure the Policy via Local Security Policy
-**Step 1 –** On any domain controller in the target domain, open the Local Security Policy snap-in:
-navigate to Start > Windows Administrative Tools > Local Security Policy.
-
-**Step 2 –** Navigate to **Security Settings** > **Local Policies** > **User right Assignment**.
-
-**Step 3 –** Locate the Back up files and directories policy and double-click it.
-
-**Step 4 –** In the Back up files and directories Properties dialog, click **Add User or Group**,
-specify the user that you want to define this policy for.
+1. On any domain controller in the target domain, open the **Local Security Policy** snap-in: navigate to **Start** > **Windows Administrative Tools** > **Local Security Policy**.
+2. Navigate to **Security Settings** > **Local Policies** > **User right Assignment**.
+3. Locate the **Back up files and directories** policy and double-click it.
+4. In the **Back up files and directories Properties** dialog, click **Add User or Group** and specify the user that you want to define this policy for.
The policy is now configured.
-Follow the steps to configure the Back up Files and Directories policy using the Group Policy
-Management Console.
+## Configure the Policy via Group Policy Management Console
-**NOTE:** Perform this procedure only if the account selected for data collection is not a member of
-the Domain Admins group.
+:::note
+Perform this procedure only if the account selected for data collection isn't a member of the Domain Admins group.
+:::
-**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
-navigate to **Start** > **Windows Administrative Tools (Windows Server 2016/2019) or Administrative
-Tools (Windows 2012 R2 and below)** > **Group Policy Management**.
+1. Open the **Group Policy Management** console on any domain controller in the target domain: navigate to **Start** > **Windows Administrative Tools (Windows Server 2016/2019) or Administrative Tools (Windows 2012 R2 and below)** > **Group Policy Management**.
-**Step 2 –** In the left pane, navigate to Forest: `` > Domains > `` >
+2. In the left pane, navigate to Forest: `` > Domains > `` >
Domain Controllers. Right-click the **effective domain controllers policy** (by default, it is the
Default Domain Controllers Policy), and select **Edit**.
-**Step 3 –** In the Group Policy Management Editor dialog, expand the Computer Configuration node on
+3. In the Group Policy Management Editor dialog, expand the Computer Configuration node on
the left and navigate to **Policies** > **Windows Settings** > **Security Settings** > **Local
Policies**.
-**Step 4 –** On the right, double-click the User Rights Assignment policy.
+4. On the right, double-click the User Rights Assignment policy.
-**Step 5 –** Locate the Back up files and directories policy and double-click it.
+5. Locate the Back up files and directories policy and double-click it.
-**Step 6 –** In the Back up files and directories Properties dialog, click Add User or Group and
+6. In the Back up files and directories Properties dialog, click Add User or Group and
specify the user that you want to define this policy for.
-**Step 7 –** Navigate to Start > Run and type **cmd**. Input the `gpupdate /force` command and press
+7. Navigate to Start > Run and type **cmd**. Input the `gpupdate /force` command and press
Enter. The group policy will be updated.
-**Step 8 –** Type `repadmin /syncall` command and press Enter for replicate GPO changes to other
+8. Type `repadmin /syncall` command and press Enter for replicate GPO changes to other
domain controllers.
-**Step 9 –** Ensure that new GPO settings applied on any audited domain controller.
+9. Ensure that new GPO settings applied on any audited domain controller.
The policy is now configured.
diff --git a/docs/auditor/10.8/configuration/fileservers/windows/eventlog.md b/docs/auditor/10.8/configuration/fileservers/windows/eventlog.md
index ee1f453d21..30b608a185 100644
--- a/docs/auditor/10.8/configuration/fileservers/windows/eventlog.md
+++ b/docs/auditor/10.8/configuration/fileservers/windows/eventlog.md
@@ -9,25 +9,17 @@ sidebar_position: 50
The procedure below describes one of the possible ways to adjust event log settings. If you have
multiple target computers, you need to perform this procedure on each of them.
-If you move security log files from the default system folder to a non-default one, you must reboot
-your target server for the reports and search functionality to work properly.
+If you move security log files from the default system folder to a non-default one, you must reboot your target server for the reports and search functionality to work properly.
-Follow the steps to configure Event Log Size and Retention Settings.
-
-**Step 1 –** On a target server, navigate to Start > Windows Administrative Tools > Event Viewer.
-
-**Step 2 –** Navigate to Event Viewer tree > Windows Logs, right-click **Security** and select
-**Properties**.
+1. On a target server, navigate to **Start** > **Windows Administrative Tools** > **Event Viewer**.
+2. Navigate to **Event Viewer** tree > **Windows Logs**, right-click **Security**, and select **Properties**.
-**Step 3 –** Make sure Enable logging is selected.
-
-**Step 4 –** In the Maximum log size field, specify the desired log size.
-
-**Step 5 –** Make sure the Do not overwrite events (Clear logs manually) check box is cleared. If
-selected, change the retention method to _Overwrite events as needed (oldest events first)_.
+3. Ensure **Enable logging** is selected.
+4. In the **Maximum log size** field, specify the log size you want.
+5. Ensure the **Don't overwrite events (Clear logs manually)** checkbox is cleared. If selected, change the retention method to **Overwrite events as needed (oldest events first)**.
-Make sure the Maximum security log size group policy does not overwrite your log settings. To check
+Ensure the Maximum security log size group policy doesn't overwrite your log settings. To check
this, start the Group Policy Management console, proceed to the GPO that affects your server, and
navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Event Log.
diff --git a/docs/auditor/10.8/configuration/fileservers/windows/localpolicy.md b/docs/auditor/10.8/configuration/fileservers/windows/localpolicy.md
index 61a891cd1f..0db1191451 100644
--- a/docs/auditor/10.8/configuration/fileservers/windows/localpolicy.md
+++ b/docs/auditor/10.8/configuration/fileservers/windows/localpolicy.md
@@ -6,17 +6,11 @@ sidebar_position: 30
# Configure Local Audit Policies
-You can choose to configure local audit policies or advanced audit policies.See the
-[Configure Advanced Audit Policies](/docs/auditor/10.8/configuration/fileservers/windows/advancedpolicy.md) topic for more information.
+You can choose to configure local audit policies or advanced audit policies. See the [Configure Advanced Audit Policies](/docs/auditor/10.8/configuration/fileservers/windows/advancedpolicy.md) topic for more information.
-Follow the steps to configure local audit policies.
-
-**Step 1 –** On the audited server, open the Local Security Policy snap-in: navigate to Start >
-Windows Administrative Tools > Local Security Policy.
-
-**Step 2 –** Navigate to Security Settings > Local Policies > Audit Policy.
-
-**Step 3 –** Configure the following audit policies.
+1. On the audited server, open the **Local Security Policy** snap-in: navigate to **Start** > **Windows Administrative Tools** > **Local Security Policy**.
+2. Navigate to **Security Settings** > **Local Policies** > **Audit Policy**.
+3. Configure the following audit policies:
| Policy Name | Audit Events |
| ------------------------ | ------------ |
diff --git a/docs/auditor/10.8/configuration/fileservers/windows/objectlevel.md b/docs/auditor/10.8/configuration/fileservers/windows/objectlevel.md
index 43c7493a67..922cb5f2a0 100644
--- a/docs/auditor/10.8/configuration/fileservers/windows/objectlevel.md
+++ b/docs/auditor/10.8/configuration/fileservers/windows/objectlevel.md
@@ -28,29 +28,20 @@ Perform one of the following procedures depending on the OS version you are usin
## Configure Object-level Access Auditing on Windows Server 2012 and Above
-Follow the steps to configure Object-level access auditing on Windows Server 2012 and above.
-
-**Step 1 –** Navigate to the target file share, right-click it and select **Properties**.
-
-**Step 2 –** In the `` Properties dialog box, select the Security tab and click
-**Advanced**.
-
-**Step 3 –** In the Advanced Security Settings for `` dialog box, navigate to the
-Auditing tab.
+1. Navigate to the target file share, right-click it, and select **Properties**.
+2. In the `` Properties dialog box, select the **Security** tab and click **Advanced**.
+3. In the **Advanced Security Settings for ``** dialog box, navigate to the **Auditing** tab.
-**Step 4 –** Click **Add** to add a new principal. You can select **Everyone** (or another
-user-defined group containing users that are granted special permissions) and click **Edit**.
-
-**Step 5 –** In the Auditing Entry for `` dialog box, click the **Select a principal**
-link and specify **Everyone**.
+4. Click **Add** to add a new principal. You can select **Everyone** (or another user-defined group containing users that are granted special permissions) and click **Edit**.
+5. In the **Auditing Entry for ``** dialog box, click the **Select a principal** link and specify **Everyone**.
**NOTE:** You can specify any other user group, but in this case the emails will be sent with
warnings on incorrect audit configuration. The product will audit only user accounts that belong to
the selected group.
-**Step 6 –** Apply settings to your Auditing Entries depending on the access types that you want to
+6. Apply settings to your Auditing Entries depending on the access types that you want to
audit. If you want to audit all access types (successful reads, modification as well as failed read
and modification attempts), you need to add separate Auditing Entries for each file share.
Otherwise, reports will contain limited data and warning messages.
@@ -60,35 +51,35 @@ Review the following for additional information:
| Auditing Entry | |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --- |
| Successful reads | |
-| The Auditing Entry below shows Advanced Permissions for auditing successful reads only:  - Type—Set to _"Success"_.
- Applies to—Set to _"Files only"_.
- Advanced permissions—Select List folder / read data.
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing successful reads only:  - Type—Set to _"Success"_.
- Applies to—Set to _"Files only"_.
- Advanced permissions—Select List folder / read data.
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Successful changes | |
-| The Auditing Entry below shows Advanced Permissions for auditing successful changes only:  - Type—Set to _"Success"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing successful changes only:  - Type—Set to _"Success"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Failed read attempts | |
-| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions—Select List folder / read data.
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions—Select List folder / read data.
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
| Failed change attempts | |
-| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
+| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts:  - Type—Set to _"Fail"_.
- Applies to—Set to _"This folder, subfolders and files"_.
- Advanced permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the Only apply these auditing settings to objects and/or containers within this container checkbox is cleared.
| |
## Configure Object-level access auditing on pre-Windows Server 2012 versions
-**Step 1 –** Navigate to the target file share, right-click it and select **Properties**.
+1. Navigate to the target file share, right-click it and select **Properties**.
-**Step 2 –** In the **`` Properties** dialog, select the **Security** tab and click
+2. In the **`` Properties** dialog, select the **Security** tab and click
**Advanced**.
-**Step 3 –** In the **Advanced Security Settings for ``** dialog, navigate to the
+3. In the **Advanced Security Settings for ``** dialog, navigate to the
**Auditing** tab, click Edit.
-**Step 4 –** In a separate **Advanced Security Settings for ``** dialog, click Add to
+4. In a separate **Advanced Security Settings for ``** dialog, click Add to
add a principal. You can select **Everyone** (or another user-defined group containing users that
are granted special permissions) and click **Edit**.
-**Step 5 –** You can specify any other user group, but in this case Netwrix Auditor will send emails
+5. You can specify any other user group, but in this case Netwrix Auditor will send emails
with errors on incorrect audit configuration. This will not affect the reports or data searches
performed in the Auditor client and the product will only audit user accounts that belong to the
selected group.
-**Step 6 –** Apply settings to your Auditing Entries depending on the access types that you want to
+6. Apply settings to your Auditing Entries depending on the access types that you want to
audit. If you want to audit all access types (successful reads and changes as well as failed read
and change attempts), you need to add separate Auditing Entries for each file share. Otherwise,
reports will contain limited data and warning messages. Review the following for additional
@@ -102,10 +93,10 @@ information:
| Auditing Entry |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Successful reads** |
-| The Auditing Entry below shows Advanced Permissions for auditing successful reads only: - Apply onto—Select _"Files only"_.
- Check _"Successful"_ and _"Failed"_ next to List folder / read data.
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing successful reads only: - Apply onto—Select _"Files only"_.
- Check _"Successful"_ and _"Failed"_ next to List folder / read data.
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
| **Successful changes** |
-| The Auditing Entry below shows Advanced Permissions for auditing successful changes only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Successful"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing successful changes only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Successful"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
| **Failed read attempts** |
-| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to List folder / read data.
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing failed read attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to List folder / read data.
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
| **Failed change attempts** |
-| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- Make sure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
+| The Auditing Entry below shows Advanced Permissions for auditing failed change attempts only: - Apply onto—Select _"This folder, subfolders and files"_.
- Check _"Failed"_ next to the following permissions:
- Create files / write data
- Create folders / append data
- Write extended attributes
- Delete subfolders and files
- Delete
- Change permissions
- Take ownership
- ensure that the **Apply these auditing entries to objects and/or containers within this container only** checkbox is cleared.
|
diff --git a/docs/auditor/10.8/configuration/fileservers/windows/overview.md b/docs/auditor/10.8/configuration/fileservers/windows/overview.md
index 3d7483d608..3f703e1565 100644
--- a/docs/auditor/10.8/configuration/fileservers/windows/overview.md
+++ b/docs/auditor/10.8/configuration/fileservers/windows/overview.md
@@ -9,8 +9,7 @@ sidebar_position: 70
Netwrix Auditor relies on native logs for collecting audit data. Therefore, successful change and
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
-certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data integrity; otherwise, your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -45,25 +44,24 @@ You can configure your IT Infrastructure for monitoring in one of the following
| Change Permissions\* | "Success" and "Fail" |
| Take Ownership\* | "Success" and "Fail" |
- \* Select "Fail" only if you want to track failure events, it is not required for
- success events monitoring.
+ \* Select "Fail" only if you want to track failure events; it isn't required for success events monitoring.
- **NOTE:** If you want to get only state-in-time snapshots of your system configuration,
- limit your settings to the permissions marked with \* and set it to "Success" (Apply
- onto: This folder, subfolders and files).
+ :::note
+ If you want to get only state-in-time snapshots of your system configuration, limit your settings to the permissions marked with \* and set it to "Success" (Apply onto: This folder, subfolders and files).
+ :::
- The following Advanced audit policy settings must be configured:
- - The Audit: Force audit policy subcategory settings (Windows 7 or later) security
- option must be enabled.
- - **NOTE:** If you want to get only state-in-time snapshots of your system
- configuration, limit your audit settings to the following policies:
+ - The **Audit: Force audit policy subcategory settings** (Windows 7 or later) security option must be enabled.
+ - :::note
+If you want to get only state-in-time snapshots of your system configuration, limit your audit settings to the following policies:
+ :::
| Advanced Audit Policy | Setting |
| ----------------------------------------- | --------- |
| Object Access > Audit File Share | "Success" |
| Object Access > Audit Handle Manipulation | "Success" |
- | Policy Change > Audit Audit Policy Change | "Success" |
+ | Policy Change > Audit Policy Change | "Success" |
- The following legacy policies can be configured instead of advanced:
@@ -88,11 +86,11 @@ You can configure your IT Infrastructure for monitoring in one of the following
- File and Printer Sharing (Echo Request - ICMPv4-In)
- File and Printer Sharing (Echo Request - ICMPv6-In)
- **NOTE:** The rules marked with \* are required only if you do not want to use
+ **NOTE:** The rules marked with \* are required only if you don't want to use
network traffic compression for auditing.
- If you plan to audit Windows Server 2019 or Windows 10 Update 1803 without network
- compression service, make sure the following inbound connection rules are enabled:
+ compression service, ensure the following inbound connection rules are enabled:
- Remote Scheduled Tasks Management (RPC)
- Remote Scheduled Tasks Management (RPC-EMAP)
@@ -107,21 +105,17 @@ Consider the following:
- To collect data from 32-bit operating systems, network traffic compression must be disabled.
- To collect data from Windows Failover Cluster, network traffic compression must be enabled.
-- Scale-Out File Server (SOFS) cluster is not supported.
-- Auditing of files and folders placed directly into the DFS namespace root is not supported, as
- such configuration is not recommended by Microsoft. (See the Microsoft
+- Scale-Out File Server (SOFS) cluster isn't supported.
+- Auditing of files and folders placed directly into the DFS namespace root isn't supported, as
+ such configuration isn't recommended by Microsoft. (See the Microsoft
[Placing files directly in the namespace share](https://learn.microsoft.com/en-us/archive/blogs/askds/common-dfsn-configuration-mistakes-and-oversights#placing-files-directly-in-the-namespace-share)
- article for additional information.) Make sure the UNC path of a shared folder is placed within a
+ article for additional information.) ensure the UNC path of a shared folder is placed within a
share targeted by a DFS folder.
## Configuration Steps
-Follow the steps to configure Windows File Servers for auditing:
-
-**Step 1 –** Check requirements. Make sure the Windows File Servers you want to monitor meet the
-requirements.
-
-**Step 2 –** Decide on audit data to collect.
+1. Check requirements. Ensure the Windows File Servers you want to monitor meet the requirements.
+2. Decide on audit data to collect.
- Review the list of objects and attributes that can be monitored by Auditor: See the
[File Servers](/docs/auditor/10.8/configuration/fileservers/overview.md)topic for additional information.
@@ -132,7 +126,7 @@ requirements.
- Audit flags must be set on every file share you want to audit.
- If your file shares are stored within one folder (or disk drive), you can configure audit
settings for this folder only. As a result, you will receive reports on all required access
- types applied to all file shares within this folder. It is not recommended to configure audit
+ types applied to all file shares within this folder. It isn't recommended to configure audit
settings for system disks.
- By default, Auditor will monitor all shares stored in the specified location, except for
hidden shares (both default and user-defined). If you want to monitor user-defined hidden
@@ -140,13 +134,13 @@ requirements.
- Administrative hidden shares like default system root or Windows directory (_ADMIN$_), default
drive shares (_D$, E$_), etc. will not be monitored, unless explicitly added as a share Item.
-**Step 3 –** Review considerations and limitations:
+3. Review considerations and limitations:
**The following considerations and limitations refer to data collection:**
- To collect data from 32-bit operating systems, network traffic compression must be disabled.
- To collect data from Windows Failover Cluster, network traffic compression must be enabled.
-- Scale-Out File Server (SOFS) cluster is not supported.
+- Scale-Out File Server (SOFS) cluster isn't supported.
- Several constraints apply to DFS auditing. See the DFS-Related Constraints topic for additional
information.
@@ -155,18 +149,18 @@ requirements.
- In the reports and search results, in some cases, Auditor displays not the actual time when the
event occurred but data collection time.
- Auditor may report on several unexpected changes with _who_ (initiator's account) reported as
- _system_ due to the native Windows File Servers audit peculiarities. If you do not want to see
+ _system_ due to the native Windows File Servers audit peculiarities. If you don't want to see
these changes, exclude them from the audit. See the [File Servers](/docs/auditor/10.8/configuration/fileservers/overview.md) topic for
additional information. For example - mass file removals, when target Windows server generates too
many events at a time and the product is unable to parse their sequences correctly.
- Due to Windows limitations, the _copy/rename/move_ actions on remote file shares may be reported
as two sequential actions: copying – as adding a new file and reading the initial file;
renaming/moving – as removing the initial file and adding a new file with the same name.
-- To report on _copy_ actions on remote file shares, make sure that audit of successful read
+- To report on _copy_ actions on remote file shares, ensure that audit of successful read
operations is enabled. See the [Configure Object-Level Access Auditing](/docs/auditor/10.8/configuration/fileservers/windows/objectlevel.md) topic for
additional information.
-**Step 4 –** Apply required audit settings.
+4. Apply required audit settings.
Depending on your auditing requirements, you may need to audit your file server objects for:
@@ -222,22 +216,21 @@ is enabled on DFS file shares or on every cluster node.
**Step 2 –** When adding a cluster file server for auditing, it is recommended to specify a server
name of the **Role** server or a UNC path of the shared folder located on the **Role** server.
-**Step 3 –** When adding a DFS file share for auditing, specify a Windows file share item and
+3. When adding a DFS file share for auditing, specify a Windows file share item and
provide the UNC path of the whole namespace or UNC path of the DFS link (folder). For example:
- _"\\domain\dfsnamespace\"_ (domain-based namespace)
- _"\\server\dfsnamespace\"_ (in case of stand-alone namespace);
-Auditing of files and folders placed directly into the DFS namespace root is not supported, as such
-configuration is not recommended by Microsoft. See the
+Auditing of files and folders placed directly into the DFS namespace root isn't supported, as such
+configuration isn't recommended by Microsoft. See the
[Placing files directly in the namespace share](https://docs.microsoft.com/en-us/archive/blogs/askds/common-dfsn-configuration-mistakes-and-oversights#placing-files-directly-in-the-namespace-share)
-section of the Microsoft article for additional information. Make sure the UNC path of a shared
+section of the Microsoft article for additional information. Ensure the UNC path of a shared
folder is placed within a share targeted by a DFS folder.
-For recommendations on configuring DFS replication, refer to the following Netwrix knowledge base
-article:
+For recommendations on configuring DFS replication, see the Netwrix knowledge base article:
[Why did loss of performance occur when configuring audit settings for Windows File Servers?](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/auditing-distributed-file-systems-with-replication-in-netwrix-auditor).
-Remember that replication of namespace roots is not supported.
+Remember that replication of namespace roots isn't supported.
## File Servers and Antivirus
diff --git a/docs/auditor/10.8/configuration/fileservers/windows/remoteregistryservice.md b/docs/auditor/10.8/configuration/fileservers/windows/remoteregistryservice.md
index cc51fe8ae2..35a75e1e0f 100644
--- a/docs/auditor/10.8/configuration/fileservers/windows/remoteregistryservice.md
+++ b/docs/auditor/10.8/configuration/fileservers/windows/remoteregistryservice.md
@@ -6,8 +6,6 @@ sidebar_position: 60
# Enable Remote Registry Service
-Follow the steps to enable the Remote Registry service.
-
**Step 1 –** Navigate to Start > Windows Administrative Tools > Services.
@@ -15,7 +13,7 @@ Follow the steps to enable the Remote Registry service.
**Step 2 –** In the Services window, locate the Remote Registry service, right-click it and select
**Properties**.
-**Step 3 –** In the Remote Registry Properties dialog box, make sure the Startup type parameter is
+**Step 3 –** In the Remote Registry Properties dialog box, ensure the Startup type parameter is
set to _Automatic_ and click **Start**.
diff --git a/docs/auditor/10.8/configuration/grouppolicy/overview.md b/docs/auditor/10.8/configuration/grouppolicy/overview.md
index 66b5a68d7c..5941c26818 100644
--- a/docs/auditor/10.8/configuration/grouppolicy/overview.md
+++ b/docs/auditor/10.8/configuration/grouppolicy/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -40,7 +40,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
**50** hours). See the
[Adjust Security Event Log Size and Retention](/docs/auditor/10.8/configuration/activedirectory/securitylog.md) topic.
- - To provide for event data collection, the Secondary Logon service must be up and running.
+ - To provide for event data collection, the Secondary Logon service must be running.
Open **Administrative Tools** > **Services**, right-click the **Secondary Logon** service
- and on the **General** tab make sure that Startup type for this service is other than
+ and on the **General** tab ensure that Startup type for this service is other than
_Disabled_.
diff --git a/docs/auditor/10.8/configuration/grouppolicy/permissions.md b/docs/auditor/10.8/configuration/grouppolicy/permissions.md
index 41ac100ee0..96da9bf730 100644
--- a/docs/auditor/10.8/configuration/grouppolicy/permissions.md
+++ b/docs/auditor/10.8/configuration/grouppolicy/permissions.md
@@ -54,7 +54,7 @@ The following is required if auto-backup is _enabled_ for the domain controller
## Assign Permission to Read the Registry Key
-This permission is required only if the account selected for data collection is not a member of the
+This permission is required only if the account selected for data collection isn't a member of the
Domain Admins group.
This permission should be assigned on each domain controller in the audited domain, so if your
@@ -67,8 +67,6 @@ console.
Assign Permission Via the Registry Editor Snap-in
-Follow the steps to assign permission via the Registry Editor snap-in:
-
**Step 1 –** On your target server, open Registry Editor: navigate to **Start > Run** and type
_"regedit"_.
@@ -88,8 +86,6 @@ To assign permission using the Group Policy Management console
Assign Permission Using the Group Policy Management Console
-Follow the steps to assign permission using the Group Policy Management console:
-
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
navigate to Start > Windows Administrative Tools (Windows Server 2016/2019) or Administrative Tools
(Windows 2012 R2 and below) > Group Policy Management.
@@ -137,9 +133,7 @@ about integration and supported data sources. In this case, the credentials will
Netwrix Auditor. Instead, they will be managed by Netwrix Privilege Secure and provided on demand,
ensuring password rotation or using temporary accounts for data collection.
-Follow the steps to use Netwrix Privilege Secure as an account for data collection.
-
-**Step 1 –** Select the desired item.
+**Step 1 –** Select the item.
**Step 2 –** In the item configuration menu, select Netwrix Privilege Secure as an option for data
collection.
@@ -147,9 +141,7 @@ collection.
**Step 3 –** Select the type of the Access Policy you want to use in Netwrix Privilege Secure.
-Credential-based is the default option. Refer to the
-[Netwrix Privilege Secure](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement)
-documentation to learn more about Access Policies.
+Credential-based is the default option. Refer to the [Netwrix Privilege Secure documentation for Access Policies](https://helpcenter.netwrix.com/category/privilegesecure_accessmanagement).
In this case, you need to provide the username of the account managed by Netwrix Privilege Secure,
and to which Netwrix Auditor has the access through a Credential-based access policy.
@@ -160,7 +152,7 @@ sources.
The second option is Resource-based. To use this option, you need to provide the Activity and
-Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Make sure
+Resource names, assigned to Netwrix Auditor in the corresponding Resource-based policy. Ensure
that you specified the same names as in Netwrix Privilege Secure.
The Resource name in this case is where the activity will be performed. For example, if you grant
diff --git a/docs/auditor/10.8/configuration/grouppolicy/registrykey.md b/docs/auditor/10.8/configuration/grouppolicy/registrykey.md
index 1815b48baa..0cc62df069 100644
--- a/docs/auditor/10.8/configuration/grouppolicy/registrykey.md
+++ b/docs/auditor/10.8/configuration/grouppolicy/registrykey.md
@@ -15,8 +15,8 @@ Netwrix Auditor. Navigate to Start → Run and type _"regedit"_.
| CleanAutoBackupLogs | Defines the retention period for the security log backups: - 0—Backups are never deleted from Domain controllers - [X]— Backups are deleted after [X] hours |
| GPOBackup | Defines whether to backup GPOs during data collection: - 0—No - 1—Yes |
| GPOBackupDays | Defines the backup frequency: - 0—Backup always - X—Once in X days GPOBackup must be set to _"1"_. |
-| IgnoreAuditCheckResultError | Defines whether audit check errors should be displayed in the Activity Summary footer: - 0—Display errors - 1—Do not display errors |
-| IgnoreRootDCErrors | Defines whether to display audit check errors for the root domain (when data is collected from a child domain) in the Activity Summary footer: - 0—Display errors - 1—Do not display errors |
+| IgnoreAuditCheckResultError | Defines whether audit check errors should be displayed in the Activity Summary footer: - 0—Display errors - 1—Don't display errors |
+| IgnoreRootDCErrors | Defines whether to display audit check errors for the root domain (when data is collected from a child domain) in the Activity Summary footer: - 0—Display errors - 1—Don't display errors |
| ProcessBackupLogs | Defines whether to process security log backups: - 0—No - 1—Yes Even if this key is set to _"0"_, the security log backups will not be deleted regardless of the value of the CleanAutoBackupLogs key. |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\AD Change Reporter\ | |
| CollectLogsMaxThreads | Defines the number of Domain Controllers to simultaneously start log collection on. |
@@ -24,5 +24,5 @@ Netwrix Auditor. Navigate to Start → Run and type _"regedit"_.
| SessionImportDays | Defines the frequency of a full snapshot upload: - X—Once in X days |
| HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Netwrix Auditor\Management Console\Database settings | |
| overwrite_datasource | Defines whether to overwrite the database connection settings (stored in the reports data source) if they differ from the SQL server settings specified when configuring the monitoring plan: - 0—No - 1—Yes |
-| SqlOperationTimeout | Defines the timeout for executing SQL queries such as data selection, insertion or deletion (in seconds). |
+| SqlOperationTimeout | Defines the timeout for executing SQL queries such as data selection, insertion, or deletion (in seconds). |
| timeout | Defines the Audit Database connection timeout (in seconds). |
diff --git a/docs/auditor/10.8/configuration/logonactivity/advancedpolicy.md b/docs/auditor/10.8/configuration/logonactivity/advancedpolicy.md
index bab0e22308..fbd63fc23d 100644
--- a/docs/auditor/10.8/configuration/logonactivity/advancedpolicy.md
+++ b/docs/auditor/10.8/configuration/logonactivity/advancedpolicy.md
@@ -32,7 +32,7 @@ To do it, perform the following steps:
and navigate to Policies → Windows Settings → Security Settings → Local Policies → Security
Options.
4. Locate the Audit: Force audit policy subcategory settings to override audit policy category
- settings and make sure that policy setting is set to _"Enabled"_.
+ settings and ensure that policy setting is set to _"Enabled"_.
diff --git a/docs/auditor/10.8/configuration/logonactivity/overview.md b/docs/auditor/10.8/configuration/logonactivity/overview.md
index c2e41a213e..a1c5cc306b 100644
--- a/docs/auditor/10.8/configuration/logonactivity/overview.md
+++ b/docs/auditor/10.8/configuration/logonactivity/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -61,13 +61,13 @@ See the following topics for additional information:
Review a full list of actions captured when monitoring Logon Activity with Netwrix Auditor.
-**NOTE:** Please consider the following:
+**NOTE:** consider the following:
-- Logon activity by local accounts is not reported
-- Logoff activity from workstations is not reported
+- Logon activity by local accounts isn't reported
+- Logoff activity from workstations isn't reported
- Logoff activity from Domain Controllers is reported
-For the attributes marked with asterisk (\*) _what_ changed is not reported.
+For the attributes marked with asterisk (\*) _what_ changed isn't reported.
| Action | Object Type | Attributes |
| ----------------- | -------------------------- | ------------------------------------------------------------------------------------------------------------------------- |
diff --git a/docs/auditor/10.8/configuration/logonactivity/permissions/networkaccess.md b/docs/auditor/10.8/configuration/logonactivity/permissions/networkaccess.md
index 389db4c39e..b15806c00a 100644
--- a/docs/auditor/10.8/configuration/logonactivity/permissions/networkaccess.md
+++ b/docs/auditor/10.8/configuration/logonactivity/permissions/networkaccess.md
@@ -3,7 +3,8 @@ title: 'Configure Access this computer from the network Policy'
description: "Configure Access this computer from the network Policy"
sidebar_position: 20
---
-Follow the steps to configure the Access this computer from the network Policy.
+
+# Configure Access this computer from the network Policy
**Step 1** – Open the **Group Policy Management console** on any domain controller in the target domain: navigate to Start > Windows Administrative Tools (Windows Server 2016 and higher) or Administrative Tools (Windows 2012) **Group Policy Management**.
@@ -19,7 +20,7 @@ Follow the steps to configure the Access this computer from the network Policy.
**Step 7** - Locate the **Deny access to this computer from the network** policy and double-click it.
-**Step 8** - Verify that the policy is enabled and that the account selected for data collection **is not included** in the list, either explicitly or through group membership.
+**Step 8** - Verify that the policy is enabled and that the account selected for data collection **isn't included** in the list, either explicitly or through group membership.
**Step 9** - Close Group Policy Management Editor.
diff --git a/docs/auditor/10.8/configuration/logonactivity/securityeventlog.md b/docs/auditor/10.8/configuration/logonactivity/securityeventlog.md
index 9d54cbba74..3fc20687bd 100644
--- a/docs/auditor/10.8/configuration/logonactivity/securityeventlog.md
+++ b/docs/auditor/10.8/configuration/logonactivity/securityeventlog.md
@@ -6,8 +6,6 @@ sidebar_position: 40
# Configure Security Event Log Size and Retention Settings
-Follow the steps to configure Security Event Log settings:
-
**Step 1 –** Open the **Group Policy Management** console on any domain controller in the target
domain: navigate to Start > Windows Administrative Tools (Windows Server 2016 and higher) or
Administrative Tools (Windows 2012) **Group Policy Management.**
@@ -31,6 +29,6 @@ needed**.
**Step 6 –** Run the following command to update group policy: `gpupdate /force`
**NOTE:** After configuring security event settings via Group Policy, you may notice that the log
-size on a specific computer is not set correctly. In this case, follow the resolution steps from the
+size on a specific computer isn't set correctly. In this case, follow the resolution steps from the
Netwrix Knowledge base article to fix the issue:
-[Security log settings do not apply via GPO](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/security-log-settings-do-not-apply-via-gpo).
+[Security log settings don't apply via GPO](/docs/kb/auditor/features-and-operations/glossaries-and-faqs/security-log-settings-do-not-apply-via-gpo).
diff --git a/docs/auditor/10.8/configuration/microsoft365/exchangeonline/modernauth/manifest.md b/docs/auditor/10.8/configuration/microsoft365/exchangeonline/modernauth/manifest.md
index 57f9f1ab95..f0528cd428 100644
--- a/docs/auditor/10.8/configuration/microsoft365/exchangeonline/modernauth/manifest.md
+++ b/docs/auditor/10.8/configuration/microsoft365/exchangeonline/modernauth/manifest.md
@@ -6,8 +6,6 @@ sidebar_position: 20
# Assigning Application Permissions Using Manifest
-Follow the steps to assign Exchange Online application permissions using manifest.
-
**Step 1 –** Under App registrations, select the newly created app.
**Step 2 –** Select **Manifest** on the left.
diff --git a/docs/auditor/10.8/configuration/microsoft365/exchangeonline/modernauth/manualconfig.md b/docs/auditor/10.8/configuration/microsoft365/exchangeonline/modernauth/manualconfig.md
index 78c17390e1..f3a6f3c856 100644
--- a/docs/auditor/10.8/configuration/microsoft365/exchangeonline/modernauth/manualconfig.md
+++ b/docs/auditor/10.8/configuration/microsoft365/exchangeonline/modernauth/manualconfig.md
@@ -32,8 +32,6 @@ This section will be helpful for any case below:
- You encountered errors related to the ExchangeOnlineManagement PowerShell module
- You want to install the module manually
-Follow the steps to install the module.
-
**Step 1 –** Install the Windows Management Framework for your OS:
[Windows Management Framework 5.1](https://www.microsoft.com/en-us/download/details.aspx?id=54616)
diff --git a/docs/auditor/10.8/configuration/microsoft365/exchangeonline/modernauth/modernauth.md b/docs/auditor/10.8/configuration/microsoft365/exchangeonline/modernauth/modernauth.md
index f96197e369..d3a42fdf13 100644
--- a/docs/auditor/10.8/configuration/microsoft365/exchangeonline/modernauth/modernauth.md
+++ b/docs/auditor/10.8/configuration/microsoft365/exchangeonline/modernauth/modernauth.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Access Exchange Online Using Modern Authentication
-Support for modern authentication will allow you to audit the organizations where MFA is enabled for
+Support for modern authentication enables auditing of the organizations where MFA is enabled for
all users, including service accounts.
This option is recommended for organizations that use modern authentication as the identity
@@ -29,7 +29,6 @@ You will need to create a dedicated app for each cloud-based data source you pla
If you plan to audit all of them, you need to create 4 apps.
-Follow the steps to register a new Microsoft Entra ID application.
**Step 1 –** Sign into the **Microsoft 365 Admin Center** with your _Global Administrator_,
_Application Administrator_ or _Cloud Application Administrator_ account and go to the **Microsoft
@@ -91,7 +90,6 @@ article: [ Microsoft Entra app manifest](https://learn.microsoft.com/en-us/azur
#### Grant Admin Consent to a Tenant
-Follow the steps to grant Admin consent to a tenant.
Go back to the **Microsoft Entra ID admin center** > **Applications** > **App registrations** >
**API permissions** and click **Grant admin consent for** *``*. When prompted to
@@ -106,7 +104,6 @@ service principal using Microsoft Entra ID Admin portal:
### Grant Required Roles
-Follow the steps to grant the required Microsoft Entra ID (formerly Azure AD) roles to the new
application.
**Step 1 –** In the Entra portal, click **View** under Manage Microsoft Entra ID.
@@ -126,7 +123,6 @@ service principal using Microsoft Entra ID Admin portal:
### Configure Client Secret
-Follow the steps to create a new client secret to be used by the app.
**Step 1 –** Go to **Manage** > **Certificates & secrets** and click **New client secret**.
@@ -142,7 +138,6 @@ See the following Microsoft article for more information on how to add a client
## Add an Exchange Online Monitoring Plan
-Follow the steps to add Exchange Online monitoring plan in the Netwrix Auditor:
**Step 1 –** In the Monitoring Plans, click **Add Plan** button.
@@ -164,7 +159,6 @@ Exchange Online monitoring plan has been added to Auditor and initial data colle
### Obtain the Tenant Name
-Follow the steps to obtain the tenant name.
**Step 1 –** Navigate to **Microsoft Entra ID** > **Overview**.
diff --git a/docs/auditor/10.8/configuration/microsoft365/exchangeonline/overview.md b/docs/auditor/10.8/configuration/microsoft365/exchangeonline/overview.md
index d4c581610a..6fc7b19c77 100644
--- a/docs/auditor/10.8/configuration/microsoft365/exchangeonline/overview.md
+++ b/docs/auditor/10.8/configuration/microsoft365/exchangeonline/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -101,7 +101,7 @@ Refer to the table to see Properties used in the Snapshot collection.
| Type | Properties |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| User Mailbox Shared Mailbox Equipment Mailbox Room Mailbox Linked Mailbox Mail-enabled security Dynamic distribution list Distribution list Microsoft 365 | Identity Name DisplayName DistinguishedName PrimarySmtpAddress Guid ArchiveGuid ExternalDirectoryObjectId ExchangeObjectId AuditEnabled AuditAdmin AuditDelegate AuditLogAgeLimit Type OwnerUPN ExchangeSecurityDescriptorSddl SendOnBehalfPrincipals Sid IsDirSynced SerializationData ForwardingAddress ForwardingSMTPAddress DeliverToMailboxAndForward |
-| ExchangeSecurityGroup | RecipientTypeDetails ExchangeObjectId ExternalDirectoryObjectId ExternalDirectoryObjectId Name |
+| ExchangeSecurityGroup | RecipientTypeDetails ExchangeObjectId ExternalDirectoryObjectId Name |
| RoleGroup | ExchangeObjectId Name Sid UserFriendlyName UserPrincipalName |
| MailUser GuestMailUser User | Identity Name DisplayName DistinguishedName SamAccountName UserPrincipalName ObjectCategory Id ExchangeObjectId ExternalDirectoryObjectId OrganizationId OriginatingServer RecipientType RecipientTypeDetails IsDirSynced Sid |
| MailFolder | ObjectType ObjectId DisplayName MailboxGuid SecurityDescriptorSddl ParentFolderId ChildFolderCount UnreadItemCount TotalItemCount WellKnownName Childs |
diff --git a/docs/auditor/10.8/configuration/microsoft365/exchangeonline/permissions.md b/docs/auditor/10.8/configuration/microsoft365/exchangeonline/permissions.md
index 6ee9b8fbf1..15b98c09e6 100644
--- a/docs/auditor/10.8/configuration/microsoft365/exchangeonline/permissions.md
+++ b/docs/auditor/10.8/configuration/microsoft365/exchangeonline/permissions.md
@@ -6,11 +6,10 @@ sidebar_position: 20
# Permissions for Exchange Online Auditing
-Auditor allows you to audit Office 365 organizations that have established modern authentication as
+Auditor enables auditing of Office 365 organizations that have established modern authentication as
their identity management approach, including support for
[multi-factor authentication (MFA)](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks).
-To learn more about modern authentication, refer to the following Microsoft article:
-[What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication).
+For more information about modern authentication, see [What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication).
In this scenario, Netwrix Auditor will access the cloud-based infrastructure via Microsoft Graph and
other modern APIs, being authenticated through a pre-configured Microsoft Entra ID (formerly Azure
@@ -19,15 +18,13 @@ app and provide its settings to Auditor when configuring a monitored item.
## Configure the Microsoft Entra ID App for Auditing Exchange Online
-Follow the steps to use a data collecting account with modern authentication.
-
**Step 1 –** Create a Microsoft Entra ID app that will be used for modern authentication. See the
[Create and Register a New App in Microsoft Entra ID](/docs/auditor/10.8/configuration/microsoft365/exchangeonline/modernauth/modernauth.md#create-and-register-a-new-app-in-microsoft-entra-id)
topic for additional information.
**NOTE:** After you start a new monitoring plan and select a data source in the first step, you will
-be asked to enter a default data collection account. However, this step is not needed for Exchange
-Online as it cannot be used. Thus, there is no need to grant any permissions to this account.
+be asked to enter a default data collection account. However, this step isn't needed for Exchange
+Online as it can't be used. Thus, there is no need to grant any permissions to this account.
Instead, you will need to configure a modern authentication app and give the necessary permissions
there.
@@ -51,12 +48,11 @@ To prepare for non-owner mailbox access auditing in the Exchange Online organiza
to take several configuration steps, creating a Microsoft Entra ID app with the required permissions
and instructing this app to automatically apply the necessary audit settings.
-Follow the steps to configure a non-owner mailbox access audit.
**Step 1 –** Install the **Exchange Online PowerShell V3** module. There are three versions in the
repository: 3.0.0, 3.1.0 and 3.2.0.
-**NOTE:** Make sure you are using the version specified in the
+**NOTE:** Ensure you are using the version specified in the
[App-only authentication for unattended scripts in Exchange Online PowerShell and Security & Compliance PowerShell ](https://docs.microsoft.com/en-us/powershell/exchange/app-only-auth-powershell-v2?view=exchange-ps)Microsoft
article.
@@ -68,7 +64,7 @@ article.
**Step 3 –** At the top of the **Request API permissions** pane, click the **APIs my organization
uses** tab and search for _Office 365 Exchange Online_.
-**Step 4 –** Click on the _Office 365 Exchange Online_ entry in the list of apps found.
+**Step 4 –** Click the _Office 365 Exchange Online_ entry in the list of apps found.
**Step 5 –** Proceed with adding the permissions for this app: select **Application permissions**
and then select **Exchange.ManageAsApp**.
@@ -85,13 +81,13 @@ Administrator** role.
If you plan to manually apply the audit settings required to audit non-owner mailbox access in
Exchange Online organization, you will need to create a remote PowerShell session to Exchange
-Online. Follow the steps to do so.
+Online.
**Step 1 –** Install the Exchange Online PowerShell V2 module as described in the
[About the Exchange Online PowerShell module](https://docs.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps)
Microsoft article.
-Make sure to install the latest version.
+Ensure to install the latest version.
**Step 2 –** Launch PowerShell and connect to Exchange Online, as described in the
[About the Exchange Online PowerShell module](https://docs.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps)
diff --git a/docs/auditor/10.8/configuration/microsoft365/exchangeonline/ports.md b/docs/auditor/10.8/configuration/microsoft365/exchangeonline/ports.md
index 7328653298..4b7f250be1 100644
--- a/docs/auditor/10.8/configuration/microsoft365/exchangeonline/ports.md
+++ b/docs/auditor/10.8/configuration/microsoft365/exchangeonline/ports.md
@@ -19,5 +19,5 @@ Tip for reading the table: For example, on the computer where Netwrix Auditor Se
| Port | Protocol | Source | Target | Purpose |
| --------------- | -------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
| Exchange Online | | | | |
-| 80 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
-| 443 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
+| 80 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, see [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
+| 443 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, see [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
diff --git a/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/overview.md b/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/overview.md
index 15e2f9321f..02f45a8b72 100644
--- a/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/overview.md
+++ b/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -110,7 +110,7 @@ ServicePrincipals properties:
| Data source | Data usage |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Audit logs Collected via MS Graph on endpoint _/auditLogs/directoryaudits_ | Activity Record: who, when and some event-based Activity Record |
+| Audit logs Collected via MS Graph on endpoint _/auditLogs/directoryaudits_ | Activity Record: who, when, and some event-based Activity Record |
| Sign-in logs Collected via MS Graph on endpoint _/auditLogs/signIns_ | Logon Activity Record |
| Users changes Collected via MS Graph on endpoint _/users/delta/…_ | Activity Record for users |
| Groups changes Collected via MS Graph on endpoint _/groups/delta/…_ | Activity Record for groups |
diff --git a/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/basicauth.md b/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/basicauth.md
index b77abd164e..0537f517f5 100644
--- a/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/basicauth.md
+++ b/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/basicauth.md
@@ -17,7 +17,7 @@ Further permission assignment will depend on the data you plan to collect:
- To collect activity data including **logon attempts**, the administrative role is required, as
well as the Premium Plan license.
- To collect activity data without logons, the privileged role can be revoked from the specified
- account after the initial data collection. Ongoing audit data collection will leverage Microsoft
+ account after the initial data collection. Ongoing audit data collection will use Microsoft
APIs access permissions granted to Microsoft Entra ID app and, therefore, requires no tenant-level
administrative permissions.
@@ -49,8 +49,6 @@ your Netwrix Auditor, consider that after the upgrade you will have to perform t
procedure again, selecting one of these approaches. Until then, data collection will not be
performed.
-Follow the steps to assign a privileged role to the account.
-
**Step 1 –** Sign in to Microsoft Entra ID portal using your Microsoft account.
**Step 2 –** Select Microsoft Entra ID on the left.
@@ -58,7 +56,7 @@ Follow the steps to assign a privileged role to the account.
**Step 3 –** Select the account that you want to use as data collecting account, or create a new
user.
-**Step 4 –** Make sure you have disabled multi-factor authentication for this account.
+**Step 4 –** ensure you have disabled multi-factor authentication for this account.
**Step 5 –** Expand Directory role and select the role you need (for example, Global admin or any
other privileged role).
@@ -82,7 +80,7 @@ A less privileged role has now been assigned to the account.
## Assigning 'Security Administrator' or 'Security Reader' Role
To audit _Successful_ and/or _Failed Logons_ in Microsoft Entra ID, the Security Administrator or
-Security Reader role is required. Follow the steps to assign the role you need:
+Security Reader role is required. To assign the role you need:
**Step 1 –** Sign in to [Microsoft Entra ID portal](https://portal.azure.com/) using your Microsoft
account.
@@ -95,6 +93,4 @@ account.
**Step 5 –** Click Add member and select the account that you want to assign the role to.
-Refer to the following Microsoft article:
-[Microsoft Entra built-in roles](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles)
-for additional information on the Administrator role permissions.
+See the [Microsoft Entra built-in roles](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles) article for more information on Administrator role permissions.
diff --git a/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/manifest.md b/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/manifest.md
index 2c7b7128f3..9fc2384fd5 100644
--- a/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/manifest.md
+++ b/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/manifest.md
@@ -6,7 +6,6 @@ sidebar_position: 10
# Assign Application Permissions Using Manifest
-Follow the steps to assign application permissions using manifest.
**Step 1 –** Under App registrations, select the newly created app.
diff --git a/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md b/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md
index bee5e4cea7..2a9044b390 100644
--- a/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md
+++ b/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/modernauth/modernauth.md
@@ -17,7 +17,6 @@ provide its settings to Auditor when configuring a monitored item.
## Configuring Microsoft Entra ID App for Auditing Microsoft Entra ID
-Follow the steps to use a data collecting account with modern authentication.
**Step 1 –** Create and Register a New App in Microsoft Entra ID app that will be used for modern
authentication. See the Create and Register a New App in Microsoft Entra ID section for additional
@@ -43,7 +42,6 @@ You will need to create a dedicated app for each cloud-based data source you pla
If you plan to audit all of them, you need to create 4 apps.
-Follow the steps to register a new Microsoft Entra ID application.
**Step 1 –** Sign into the **Microsoft 365 Admin Center** with your _Global Administrator_,
_Application Administrator_ or _Cloud Application Administrator_ account and go to the **Microsoft
@@ -117,7 +115,6 @@ service principal using Microsoft Entra ID Admin portal:
### Configure Client Secret
-Follow the steps to create a new client secret to be used by the app.
**Step 1 –** Go to **Manage** > **Certificates & secrets** and click **New client secret**.
@@ -133,7 +130,6 @@ See the following Microsoft article for more information on how to add a client
### Add Microsoft Entra ID monitoring plan
-Follow the steps to add Microsoft Entra ID monitoring plan in the Netwrix Auditor.
**Step 1 –** In the Monitoring Plans, click **Add Plan** button.
@@ -155,7 +151,6 @@ Microsoft Entra ID monitoring plan has been added to Auditor and initial data co
### Obtain Tenant Name
-Follow the steps to obtain the tenant name.
**Step 1 –** Navigate to **Microsoft Entra ID** > **Overview**.
diff --git a/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/permissions.md b/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/permissions.md
index a007e474e0..819504486b 100644
--- a/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/permissions.md
+++ b/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/permissions/permissions.md
@@ -6,11 +6,10 @@ sidebar_position: 20
# Permissions for Microsoft Entra ID Auditing
-Auditor allows you to audit Office 365 organizations that have established modern authentication as
+Use Auditor to audit Office 365 organizations that have established modern authentication as
their identity management approach, including support for
[multi-factor authentication (MFA)](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks).
-To learn more about modern authentication, refer to the following Microsoft article:
-[What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication).
+For more information about modern authentication, see [What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication).
In this scenario, Netwrix Auditor will access the cloud-based infrastructure via Microsoft Graph and
other modern APIs, being authenticated through a pre-configured Microsoft Entra ID (formerly Azure
@@ -20,7 +19,7 @@ app and provide its settings to Auditor when configuring a monitored item.
## For Microsoft Entra ID Auditing
To collect audit data in your cloud-based environment, Netwrix uses a dedicated Microsoft Entra ID
-application and leverages APIs access permissions granted to that app. To register such application
+application and uses APIs access permissions granted to that app. To register such application
and assign required permissions, a Microsoft Entra ID account with an administrative role will be
required:
@@ -72,7 +71,6 @@ service principal using Microsoft Entra ID Admin portal:
### Configure Client Secret
-Follow the steps to create a new client secret to be used by the app.
**Step 1 –** Go to **Manage** > **Certificates & secrets** and click **New client secret**.
@@ -88,7 +86,6 @@ See the following Microsoft article for more information on how to add a client
### Obtain Tenant Name
-Follow the steps to obtain the tenant name.
**Step 1 –** Go to **Microsoft Entra ID** > **Overview**.
diff --git a/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/ports.md b/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/ports.md
index ef03513b55..cf770f3929 100644
--- a/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/ports.md
+++ b/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/ports.md
@@ -19,5 +19,5 @@ Tip for reading the table: For example, on the computer where Netwrix Auditor Se
| Port | Protocol | Source | Target | Purpose |
| ---- | -------- | ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- |
-| 80 | TCP/UDP | Netwrix Auditor Server | For a full list of Microsoft Entra ID URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | login.windows.net graph.windows.net manage.office.com |
-| 443 | TCP/UDP | Netwrix Auditor Server | For a full list of Microsoft Entra ID URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | login.windows.net graph.windows.net manage.office.com |
+| 80 | TCP/UDP | Netwrix Auditor Server | For a full list of Microsoft Entra ID URLs, see Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | login.windows.net graph.windows.net manage.office.com |
+| 443 | TCP/UDP | Netwrix Auditor Server | For a full list of Microsoft Entra ID URLs, see Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | login.windows.net graph.windows.net manage.office.com |
diff --git a/docs/auditor/10.8/configuration/microsoft365/sharepointonline/overview.md b/docs/auditor/10.8/configuration/microsoft365/sharepointonline/overview.md
index 915ac7c119..68260ba075 100644
--- a/docs/auditor/10.8/configuration/microsoft365/sharepointonline/overview.md
+++ b/docs/auditor/10.8/configuration/microsoft365/sharepointonline/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -48,7 +48,7 @@ OneDrive for Business changes are reported as SharePoint Online.
## Sensitive data
-Starting with the version 10, Netwrix Auditor is able to report about sensitive data in your IT
+Starting with the version 10, Netwrix Auditor can report about sensitive data in your IT
infrastructure. Pay attention to the "_Data categories_" column in search and reports (for the
"_Document_" object types only). See the
[Sensitive Data Discovery ](/docs/auditor/10.8/admin/settings/sensitivedatadiscovery.md)topic for additional
diff --git a/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/basicauth.md b/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/basicauth.md
index 24c21bc3e7..562d06ae05 100644
--- a/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/basicauth.md
+++ b/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/basicauth.md
@@ -47,7 +47,6 @@ your Netwrix Auditor, consider that after the upgrade you will have to perform t
procedure again, selecting one of these approaches. Until then, data collection will not be
performed.
-Follow the steps to assign a privileged role to the account.
**Step 1 –** Sign in to Microsoft Entra ID portal using your Microsoft account.
@@ -56,7 +55,7 @@ Follow the steps to assign a privileged role to the account.
**Step 3 –** Select the account that you want to use as data collecting account, or create a new
user.
-**Step 4 –** Make sure you have disabled multi-factor authentication for this account.
+**Step 4 –** ensure you have disabled multi-factor authentication for this account.
**Step 5 –** Expand Directory role and select the role you need (for example, Global admin or any
other privileged role).
diff --git a/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/modernauth/manifest.md b/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/modernauth/manifest.md
index 922faf4cad..5241f30019 100644
--- a/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/modernauth/manifest.md
+++ b/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/modernauth/manifest.md
@@ -6,7 +6,6 @@ sidebar_position: 10
# Assigning Application Permissions Using Manifest
-Follow the steps to assign application permissions using Manifest.
**Step 1 –** Under **App registrations**, select the newly created app.
diff --git a/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/modernauth/modernauth.md b/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/modernauth/modernauth.md
index cb27c6e2a2..0223a7b034 100644
--- a/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/modernauth/modernauth.md
+++ b/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/modernauth/modernauth.md
@@ -15,8 +15,8 @@ appropriate access permissions.
If you plan to implement such scenario, you should register an Microsoft Entra ID app manually and
provide its settings to Auditor when configuring a monitored item.
-Support for modern authentication will allow you to audit the organizations where MFA is enabled for
-all users, including service accounts.
+Modern authentication support lets you audit organizations where MFA is enabled for all users,
+including service accounts.
Required configuration procedure includes several manual steps, as described in the corresponding
section:
@@ -48,7 +48,6 @@ You will need to create a dedicated app for each cloud-based data source you pla
If you plan to audit all of them, you need to create 4 apps.
-Follow the steps to register a new Microsoft Entra ID application.
**Step 1 –** Sign into the **Microsoft 365 Admin Center** with your _Global Administrator_,
_Application Administrator_ or _Cloud Application Administrator_ account and go to the **Microsoft
@@ -122,7 +121,6 @@ service principal using Microsoft Entra ID Admin portal:
### Configuring client secret
-Follow the steps to create a new client secret to be used by the app.
**Step 1 –** Go to **Manage** > **Certificates & secrets** and click **New client secret**.
@@ -138,7 +136,6 @@ See the following Microsoft article for more information on how to add a client
### Obtaining tenant name
-Follow the steps to obtain the tenant name.
**Step 1 –** Navigate to **Microsoft Entra ID** > **Overview**.
diff --git a/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/permissions.md b/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/permissions.md
index 11df37c027..25dce300bd 100644
--- a/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/permissions.md
+++ b/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/permissions.md
@@ -6,11 +6,10 @@ sidebar_position: 20
# Permissions for SharePoint Online Auditing
-Auditor allows you to audit Office 365 organizations that have established modern authentication as
+Use Auditor to audit Office 365 organizations that have established modern authentication as
their identity management approach, including support for
[multi-factor authentication (MFA)](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks).
-To learn more about modern authentication, refer to the following Microsoft article:
-[What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication).
+For more information about modern authentication, see [What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication).
In this scenario, Netwrix Auditor will access the cloud-based infrastructure via Microsoft Graph and
other modern APIs, being authenticated through a pre-configured Microsoft Entra ID (formerly Azure
@@ -20,13 +19,13 @@ app and provide its settings to Auditor when configuring a monitored item.
## Authentication for SharePoint Online Auditing
To collect audit data from your SharePoint Online and OneDrive for Business, Netwrix Auditor uses a
-dedicated Microsoft Entra ID application and leverages APIs access permissions granted to that app.
+dedicated Microsoft Entra ID application and uses APIs access permissions granted to that app.
To register this application and assign required permissions, an Microsoft Entra ID account with an
administrative role will be required:
- If Modern Authentication is used:
- Microsoft Entra ID application should be created manually by user with administrative role and
- assigned required permissions. This app will allow you to collect both activity and
+ assigned required permissions. This app allows collecting both activity and
state-in-time data. See the
[Configuring Microsoft Entra ID App for Auditing SharePoint Online](/docs/auditor/10.8/configuration/microsoft365/sharepointonline/permissions/modernauth/modernauth.md#configuring-microsoft-entra-id-app-for-auditing-sharepoint-online)
section for additional information.
diff --git a/docs/auditor/10.8/configuration/microsoft365/sharepointonline/ports.md b/docs/auditor/10.8/configuration/microsoft365/sharepointonline/ports.md
index 9fd482404b..5ff9aba27f 100644
--- a/docs/auditor/10.8/configuration/microsoft365/sharepointonline/ports.md
+++ b/docs/auditor/10.8/configuration/microsoft365/sharepointonline/ports.md
@@ -18,5 +18,5 @@ Tip for reading the table: For example, on the computer where Netwrix Auditor Se
| Port | Protocol | Source | Target | Purpose |
| ---- | -------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------- |
-| 80 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | login.windows.net graph.windows.net manage.office.com `{TenantName}`-admin.sharepoint.com `{TenantName}`.sharepoint.com `{TenantName}`-my.sharepoint.com |
-| 443 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | login.windows.net graph.windows.net manage.office.com `{TenantName}`-admin.sharepoint.com `{TenantName}`.sharepoint.com `{TenantName}`-my.sharepoint.com |
+| 80 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, see Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | login.windows.net graph.windows.net manage.office.com `{TenantName}`-admin.sharepoint.com `{TenantName}`.sharepoint.com `{TenantName}`-my.sharepoint.com |
+| 443 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, see Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | login.windows.net graph.windows.net manage.office.com `{TenantName}`-admin.sharepoint.com `{TenantName}`.sharepoint.com `{TenantName}`-my.sharepoint.com |
diff --git a/docs/auditor/10.8/configuration/microsoft365/teams/overview.md b/docs/auditor/10.8/configuration/microsoft365/teams/overview.md
index 87695f69b9..4a427abb49 100644
--- a/docs/auditor/10.8/configuration/microsoft365/teams/overview.md
+++ b/docs/auditor/10.8/configuration/microsoft365/teams/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -36,7 +36,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
Auditor can monitor for operations with MS Teams entities, collect state-in-time snapshots and track
changes to the object attributes. This section provides detailed information on these activities.
-Starting with the version 10.5, Auditor is able to report about sensitive data in your IT
+Starting with the version 10.5, Auditor can report about sensitive data in your IT
infrastructure. Pay attention to the "_Data categories_" column in search and reports (for the
"_Document_" object types only). Refer to
[Sensitive Data Discovery ](/docs/auditor/10.8/admin/settings/sensitivedatadiscovery.md) for detailed
diff --git a/docs/auditor/10.8/configuration/microsoft365/teams/permissions/basicauth.md b/docs/auditor/10.8/configuration/microsoft365/teams/permissions/basicauth.md
index 5e3c1061c9..e6ff45b115 100644
--- a/docs/auditor/10.8/configuration/microsoft365/teams/permissions/basicauth.md
+++ b/docs/auditor/10.8/configuration/microsoft365/teams/permissions/basicauth.md
@@ -39,7 +39,6 @@ your Netwrix Auditor, consider that after the upgrade you will have to perform t
procedure again, selecting one of these approaches. Until then, data collection will not be
performed.
-Follow the steps to assign a privileged role to the account.
**Step 1 –** Sign in to Microsoft Entra ID portal using your Microsoft account.
@@ -48,7 +47,7 @@ Follow the steps to assign a privileged role to the account.
**Step 3 –** Select the account that you want to use as data collecting account, or create a new
user.
-**Step 4 –** Make sure you have disabled multi-factor authentication for this account.
+**Step 4 –** ensure you have disabled multi-factor authentication for this account.
**Step 5 –** Expand Directory role and select the role you need (for example, Global admin or any
other privileged role).
diff --git a/docs/auditor/10.8/configuration/microsoft365/teams/permissions/modernauth/manifest.md b/docs/auditor/10.8/configuration/microsoft365/teams/permissions/modernauth/manifest.md
index dfc7c8ce8a..7ea13e87d2 100644
--- a/docs/auditor/10.8/configuration/microsoft365/teams/permissions/modernauth/manifest.md
+++ b/docs/auditor/10.8/configuration/microsoft365/teams/permissions/modernauth/manifest.md
@@ -6,7 +6,6 @@ sidebar_position: 10
# Assign Application Permissions Using Manifest
-Follow the steps to assign application permissions using manifest.
**Step 1 –** Under **App registrations**, select the newly created app.
diff --git a/docs/auditor/10.8/configuration/microsoft365/teams/permissions/modernauth/modernauth.md b/docs/auditor/10.8/configuration/microsoft365/teams/permissions/modernauth/modernauth.md
index c1fcf5f4cb..6ed9d36474 100644
--- a/docs/auditor/10.8/configuration/microsoft365/teams/permissions/modernauth/modernauth.md
+++ b/docs/auditor/10.8/configuration/microsoft365/teams/permissions/modernauth/modernauth.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Using Modern Authentication with MS Teams
-Modern authentication allows you to audit MS Teams environments without using an account with basic
+Use modern authentication to audit MS Teams environments without using an account with basic
authentication. The configuration procedure includes several manual steps, as described below.
### Access MS Teams Using Modern Authentication
@@ -22,7 +22,7 @@ provide its settings to Netwrix Auditor when configuring a monitored item.
## Configure the Microsoft Entra ID App for Auditing MS Teams
-Follow the steps to use a data collecting account with modern authentication:
+To use a data collecting account with modern authentication, complete these steps:
**Step 1 –** Create an Microsoft Entra ID app that will be used for modern authentication. See the
Create and Register a New App in Microsoft Entra ID section for additional information.
@@ -47,7 +47,7 @@ You will need to create a dedicated app for each cloud-based data source you pla
If you plan to audit all of them, you need to create 4 apps.
-Follow the steps to register a new Microsoft Entra ID application.
+To register a new Microsoft Entra ID application, complete these steps:
**Step 1 –** Sign into the **Microsoft 365 Admin Center** with your _Global Administrator_,
_Application Administrator_ or _Cloud Application Administrator_ account and go to the **Microsoft
@@ -120,7 +120,7 @@ service principal using Microsoft Entra ID Admin portal:
### Configure Client Secret
-Follow the steps to create a new client secret to be used by the app.
+To create a new client secret to be used by the app, complete these steps:
**Step 1 –** Go to **Manage** > **Certificates & secrets** and click **New client secret**.
@@ -136,7 +136,7 @@ See the following Microsoft article for more information on how to add a client
### Add MS Teams monitoring plan
-Follow the steps to add MS Teams monitoring plan in the Netwrix Auditor.
+To add an MS Teams monitoring plan in the Netwrix Auditor, complete these steps:
**Step 1 –** In the Monitoring Plans, click **Add Plan** button.
@@ -158,7 +158,7 @@ MS Teams monitoring plan has been added to Auditor and initial data collection
### Obtain Tenant Name
-Follow the steps to obtain the tenant name.
+To obtain the tenant name, complete these steps:
**Step 1 –** Navigate to **Microsoft Entra ID** > **Overview**.
diff --git a/docs/auditor/10.8/configuration/microsoft365/teams/permissions/permissions.md b/docs/auditor/10.8/configuration/microsoft365/teams/permissions/permissions.md
index cd383669e4..0b1d30638f 100644
--- a/docs/auditor/10.8/configuration/microsoft365/teams/permissions/permissions.md
+++ b/docs/auditor/10.8/configuration/microsoft365/teams/permissions/permissions.md
@@ -6,18 +6,17 @@ sidebar_position: 20
# Permissions for Teams Auditing
-Auditor allows you to audit Office 365 organizations that have established modern authentication as
+Use Auditor to audit Office 365 organizations that have established modern authentication as
their identity management approach, including support for
[multi-factor authentication (MFA)](https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks).
-To learn more about modern authentication, refer to the following Microsoft article:
-[What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication).
+For more information on modern authentication, see [What is modern authentication](https://docs.microsoft.com/en-us/office365/enterprise/hybrid-modern-auth-overview#what-is-modern-authentication).
In this scenario, Netwrix Auditor will access the cloud-based infrastructure via Microsoft Graph and
other modern APIs, being authenticated through a pre-configured Microsoft Entra ID (formerly Azure
AD) application with appropriate access permissions. So, you should register an Microsoft Entra ID
app and provide its settings to Auditor when configuring a monitored item.
-**NOTE:** In some scenarios multi-factor authentication cannot be enabled for Auditor service
+**NOTE:** In some scenarios multi-factor authentication can't be enabled for Auditor service
account. If so, you will need to configure an account with basic authentication to access Microsoft
Entra ID/Office 365 tenant.
@@ -27,7 +26,7 @@ Before you start creating a monitoring plan to audit your Active Directory, plan
that will be used for data collection – it should meet the requirements listed in this topic. Then
you will provide this account in the monitoring plan wizard (or in the monitored item settings).
-Refer to the following topics to access Microsoft teams:
+See the following topics for information on accessing Microsoft Teams:
- [Using Basic Authentication with MS Teams](/docs/auditor/10.8/configuration/microsoft365/teams/permissions/basicauth.md)
- [Using Modern Authentication with MS Teams](/docs/auditor/10.8/configuration/microsoft365/teams/permissions/modernauth/modernauth.md)
diff --git a/docs/auditor/10.8/configuration/microsoft365/teams/ports.md b/docs/auditor/10.8/configuration/microsoft365/teams/ports.md
index 0c23e694f7..3dc62a8347 100644
--- a/docs/auditor/10.8/configuration/microsoft365/teams/ports.md
+++ b/docs/auditor/10.8/configuration/microsoft365/teams/ports.md
@@ -18,5 +18,5 @@ Tip for reading the table: For example, on the computer where Netwrix Auditor Se
| Port | Protocol | Source | Target | Purpose |
| ---- | -------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
-| 80 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
-| 443 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, refer to the following Microsoft support article: [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
+| 80 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, see [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
+| 443 | TCP | Netwrix Auditor Server | For a full list of Office 365 URLs, see [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2) | outlook.office365.com graph.windows.net manage.office.com |
diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md
index 541311a546..ad7697d84c 100644
--- a/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md
+++ b/docs/auditor/10.8/configuration/networkdevices/ciscoasa.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -33,7 +33,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
- The `logging host` parameter is set to the host address of the audited CiscoASA device.
And UDP port (for, example 514) is used for sending messages.
- **NOTE:** Do not select the EMBLEM format logging for the syslog server option.
+ **NOTE:** Don't select the EMBLEM format logging for the syslog server option.
- The `logging timestamp` option enabled.
- The `logging trap` option is selected from 1 to 6 inclusive.
@@ -53,12 +53,12 @@ To configure your Cisco ASA devices, do the following:
hostname(config)# logging enable
4. Set the IP address of the computer that hosts Netwrix Auditor Server as the `logging host`
- parameter. And make sure that the UDP port is used for sending syslog messages (e.g., 514 UDP
+ parameter. And ensure that the UDP port is used for sending syslog messages (e.g., 514 UDP
port). For example:
hostname(config)# logging host ``
- Do not select the EMBLEM format logging for the syslog server option.
+ Don't select the EMBLEM format logging for the syslog server option.
5. Enable the `logging timestamp` option. For example:
diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md
index b4f9448cd2..e014dbb206 100644
--- a/docs/auditor/10.8/configuration/networkdevices/ciscoios.md
+++ b/docs/auditor/10.8/configuration/networkdevices/ciscoios.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -48,7 +48,7 @@ To configure your Cisco IOS devices, do the following:
Router# logging trap 5
-5. Set the IP address of the Netwrix Auditor Server as the logging host parameter. And make sure
+5. Set the IP address of the Netwrix Auditor Server as the logging host parameter. And ensure
that the UDP port is used for sending syslog messages (e.g., 514 UDP port). For example:
Router# logging 192.168.1.5
diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscomerakidashboard.md b/docs/auditor/10.8/configuration/networkdevices/ciscomerakidashboard.md
index f68dd27d90..576a875040 100644
--- a/docs/auditor/10.8/configuration/networkdevices/ciscomerakidashboard.md
+++ b/docs/auditor/10.8/configuration/networkdevices/ciscomerakidashboard.md
@@ -31,10 +31,10 @@ item.
For Basic Authorization
-Since accounts with multi-factor authentication are not supported, you need to create a special
+Since accounts with multi-factor authentication aren't supported, you need to create a special
cloud account with read-only permissions and disabled multi-factor authentication.
-Follow the steps to configure Cisco Meraki Dashboard item.
+To configure a Cisco Meraki Dashboard item, complete these steps:
**Step 1 –** Sign in to the
[Cisco Meraki Dashboard](https://account.meraki.com/secure/login/dashboard_login).
@@ -42,19 +42,19 @@ Follow the steps to configure Cisco Meraki Dashboard item.
**Step 2 –** Create a dashboard account as described in the following Cisco Meraki article:
[Getting Started](https://documentation.meraki.com/Getting_Started)
-**Step 3 –** Make sure that the read-only permissions assigned to the account. For more information
-about Meraki permissions, refer to the following Cisco Meraki article:
+**Step 3 –** ensure that the read-only permissions assigned to the account. For more information
+about Meraki permissions, see Cisco Meraki article:
[Managing Dashboard Administrators and Permissions](https://documentation.meraki.com/zGeneral_Administration/Managing_Dashboard_Access/Managing_Dashboard_Administrators_and_Permissions).
**Step 4 –** Log in to this account and navigate to **My Profile** at the top of the dashboard.
**Step 5 –** Find the section labeled SMS authentication.
-**Step 6 –** Make sure that the SMS authentication parameter is set to **OFF**. For more information
-about authentication, refer to the following Cisco Meraki article:
+**Step 6 –** ensure that the SMS authentication parameter is set to **OFF**. For more information
+about authentication, see Cisco Meraki article:
[Two-Factor Authentication](https://documentation.meraki.com/zGeneral_Administration/Other_Topics/Two-Factor_Authentication).
-**NOTE:** This account is for Netwrix Auditor purposes. Do not forget to switch back to your
+**NOTE:** This account is for Netwrix Auditor purposes. Don't forget to switch back to your
account.
To Collect Data via API Key
@@ -62,21 +62,21 @@ To Collect Data via API Key
To work with multi-factor authentication (MFA) accounts, you need to generate an API key during
authorization.
-Follow the steps to create an API key for the Meraki Dashboard API.
+To create an API key for the Meraki Dashboard API, complete these steps:
**Step 1 –** Log in to your Cisco Meraki Dashboard account.
-**Step 2 –** Click on your username in the top-right corner of the dashboard to open the drop-down
+**Step 2 –** Click your username in the top-right corner of the dashboard to open the dropdown
menu.
**Step 3 –** Select **My profile**.
**Step 4 –** In the **My profile** page, scroll down to the **API access** section.
-**Step 5 –** Click on the **Generate new API key** button. You may be prompted to enter your account
+**Step 5 –** Click the **Generate new API key** button. You may be prompted to enter your account
password for security verification.
-Once generated, the API key will be displayed on the screen. Make sure to copy and save the API key
+Once generated, the API key will be displayed on the screen. Ensure to copy and save the API key
in a secure location, as it won't be displayed again for security reasons.
-**NOTE:** Logons are not collected on the board due to technical limitations from the Meraki API.
+**NOTE:** Logons aren't collected on the board due to technical limitations from the Meraki API.
diff --git a/docs/auditor/10.8/configuration/networkdevices/ciscomerakidevices.md b/docs/auditor/10.8/configuration/networkdevices/ciscomerakidevices.md
index 0c05810d1e..1431222955 100644
--- a/docs/auditor/10.8/configuration/networkdevices/ciscomerakidevices.md
+++ b/docs/auditor/10.8/configuration/networkdevices/ciscomerakidevices.md
@@ -11,7 +11,7 @@ To configure Cisco Meraki devices, configure the Syslog server for each of your
Netwrix recommends assigning a unique identifier to each Cisco Meraki device; otherwise, the
product may count them as a single anonymous device.
-Follow the steps to configure the Syslog server.
+To configure the Syslog server, complete these steps:
**Step 1 –** Sign in to
[Cisco Meraki Dashboard](https://account.meraki.com/secure/login/dashboard_login).
diff --git a/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md b/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md
index e2ec396d9b..f29d12a3c2 100644
--- a/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md
+++ b/docs/auditor/10.8/configuration/networkdevices/fortinetfortigate.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
diff --git a/docs/auditor/10.8/configuration/networkdevices/hpearuba.md b/docs/auditor/10.8/configuration/networkdevices/hpearuba.md
index 43a8e0725b..d53ab828e8 100644
--- a/docs/auditor/10.8/configuration/networkdevices/hpearuba.md
+++ b/docs/auditor/10.8/configuration/networkdevices/hpearuba.md
@@ -61,7 +61,7 @@ To configure HPE Aruba devices through the Management Console
5. Click Submit. The new server is added to the Syslog Servers list.
6. Click Pending Changes on the right.
-7. In the Pending Changes for `` Managed Controller(s) dialog, select the device you want to
+7. In the Pending Changes for `` Managed Controllers dialog, select the device you want to
apply changes to.
8. Click Deploy Changes.
9. If the configuration is correct, you will see the following wizard:
diff --git a/docs/auditor/10.8/configuration/networkdevices/juniper.md b/docs/auditor/10.8/configuration/networkdevices/juniper.md
index 3110d05547..c1a0c85495 100644
--- a/docs/auditor/10.8/configuration/networkdevices/juniper.md
+++ b/docs/auditor/10.8/configuration/networkdevices/juniper.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
diff --git a/docs/auditor/10.8/configuration/networkdevices/paloalto.md b/docs/auditor/10.8/configuration/networkdevices/paloalto.md
index 4f14fc45d3..59952b141c 100644
--- a/docs/auditor/10.8/configuration/networkdevices/paloalto.md
+++ b/docs/auditor/10.8/configuration/networkdevices/paloalto.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -32,7 +32,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
To configure your PaloAlto devices, create a Syslog server profile and assign it to the log settings
for each log type.
-Follow the steps to configure a Syslog server profile.
+To configure a Syslog server profile, complete these steps:
**Step 1 –** Connect to your PaloAlto device: launch an Internet browser and enter the IP address of
the firewall in the URL field (https://``).
@@ -52,7 +52,7 @@ the firewall in the URL field (https://``).
| Format | Select IETF. |
| Facility | Netwrix recommends using default values. |
-Follow the steps to configure syslog forwarding.
+To configure syslog forwarding, complete these steps:
**Step 1 –** In the Web Interface, navigate to **Device** > **Log Settings**.
diff --git a/docs/auditor/10.8/configuration/networkdevices/permissions.md b/docs/auditor/10.8/configuration/networkdevices/permissions.md
index 2f2caf7d1f..e8d69c8bb9 100644
--- a/docs/auditor/10.8/configuration/networkdevices/permissions.md
+++ b/docs/auditor/10.8/configuration/networkdevices/permissions.md
@@ -12,5 +12,5 @@ provide this account in the monitoring plan wizard.
| For... | Requirement |
| ----------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| - Cisco ASA - Cisco IOS - Cisco FTD - Fortinet - HPE Aruba - Juniper - Palo Alto - Pulse Secure - SonicWall - HPE | You can use any account (not necessarily the credentials used to connect to the device itself), as long as these credentials do not affect Netwrix Auditor or monitored IT infrastructure. Provide this account in the monitoring plan wizard. |
+| - Cisco ASA - Cisco IOS - Cisco FTD - Fortinet - HPE Aruba - Juniper - Palo Alto - Pulse Secure - SonicWall - HPE | You can use any account (not necessarily the credentials used to connect to the device itself), as long as these credentials don't affect Netwrix Auditor or monitored IT infrastructure. Provide this account in the monitoring plan wizard. |
| - Cisco Meraki | See the [Configure Cisco Meraki Dashboard Account](ciscomerakidashboard.md#configure-cisco-meraki-dashboard-account) section for additional information. |
diff --git a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md
index 49d7dc0148..9dfde5be35 100644
--- a/docs/auditor/10.8/configuration/networkdevices/sonicwall.md
+++ b/docs/auditor/10.8/configuration/networkdevices/sonicwall.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -112,16 +112,16 @@ Review a full list of object types Netwrix Auditor can collect on SonicWall netw
| Object type | Actions | Event ID |
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Logon | - Successful logon | - User login from an internal zone allowed - User login successful - XAUTH Succeeded with VPN - VPN zone remote user login allowed - WAN zone remote user login allowed - PPP: Authentication successful - Local Authentication Success - RADIUS/LDAP Authentication Success - Successful authentication received for Remotely Triggered - IKEv2 Authentication successful - SSL VPN zone remote user login allowed |
-| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User login to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | |
+| - Failed logon | - User login denied - User login failed - XAUTH Failed with VPN - L2TP PPP Authentication Failed - check username / password - RADIUS/LDAP reports Authentication Failure - Local Authentication Failure - User log in to Administration Portal denied - User login failure rate exceeded - User Name authentication Failure locally - ISAKMP_AUTH_FAILED - Guest service limit reached - Guest login denied - Incorrect authentication received for Remotely Triggered - Authentication Timeout during Remotely Triggered - Problem occurred during user group membership retrieval - An error has occurred while sending your - IPsec Authentication Failed | |
| - Logoff | - User logged out - logged out - Guest Session Timeout - Guest Account Timeout - Guest Idle Timeout - Guest traffic quota exceeded | |
| Authentication | - Successful Logon | - Administrator login allowed - CLI administrator login allowed - VPN zone administrator login allowed - WAN zone administrator login allowed - Configuration mode administration session started - Read-only mode GUI administration session started - Non-config mode GUI administration session started - User login successful - Session Start: - EventMessage: Session Start Success |
-| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - is not permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | |
+| - Failed Logon | - Administrator login denied - CLI administrator login denied due to bad credentials - User login failed - The account has been disabled for - isn't permitted for this Web App - Authentication for user - Authentication failed - maximum authentication attempts exceeded for - EventMessage: Session Start Failed | |
| - Logoff | - Administrator logged out - CLI administrator logged out - Configuration mode administration session ended - GUI administration session ended - Logged out - Session End: - EventMessage: Session End - Command='Tunnel' | |
| Configuration | - Add / Added (Failed attempt) | - m=1333 - Scheduled settings generated - A new default Self-Signed certificate was generated successfully - Scheduled Tech Support Report generated - Restarted Tech Support Report generated |
-| - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP(S) Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | |
-| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, Please restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | |
+| - Modified / Modify (Failed attempt) | - Mail attachment disabled - Watch and report possible SYN floods - Watch and proxy WAN connections when under attack - Always proxy WAN connections - SYN Flood blacklisting enabled by user - SYN Flood blacklisting disabled by user - Administrator name changed - VPN disabled by administrator - VPN enabled by administrator - WLAN disabled by administrator - WLAN enabled by administrator - WLAN disabled by schedule - WLAN enabled by schedule - is added into Group - is removed from Group - m=1334 - Update administrator/user lockout params - Settings imported - Critical Operating System Update failed - msg=\"WAF restarted - HTTP or HTTPS Cache settings were updated - database has been updated - Web Server Fingerprint Protection enforced - About to reconfigure service: - Finished applying configuration changes - Started - Start failed - Stopped | |
+| - Read / Read (Failed attempt) | - m=1203 - m=1204 - Problem loading the URL list - Registration Update Needed, restore your existing security service subscriptions - Failed to synchronize license information with Licensing Server - Current settings exported - Error sending - settings sent successfully - Automated scheduled settings successful - Scheduled settings downloaded - Tech Support Report - Tech Support Report sent successfully - Loaded WAF signature database successfully - Error sending - logs sent out successfully | |
| | - Remove / Removed (Failed attempt) | - Scheduled settings deleted - Oldest scheduled Tech Support Report deleted - has been deleted - Event Logs cleared - Audit Logs cleared - Access Logs cleared - Deleting log files - Deleting core files - Deleting snapshots older |
-| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, Please restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server |
+| Device state | - Modified / Modify (Failed attempt) | - Registration Update Needed, restore your existing security service subscriptions - Intrusion Prevention (IDP) subscription has expired - Failed to synchronize license information with Licensing Server |
| Folder | - Add / Added (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=9&Arg1= |
| - Read / Read (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=16&Arg1= | |
| - Remove / Removed (Failed attempt) | - Request='GET /cgi-bin/sonicfiles?RacNumber=13&Arg1= | |
diff --git a/docs/auditor/10.8/configuration/oracle/database.md b/docs/auditor/10.8/configuration/oracle/database.md
index 472cb71e2d..136915c1c2 100644
--- a/docs/auditor/10.8/configuration/oracle/database.md
+++ b/docs/auditor/10.8/configuration/oracle/database.md
@@ -31,10 +31,10 @@ The following auditing modes are available for Oracle Database 12c, 18c, 19c:
changes, user actions, component actions, etc.
- Mixed Mode—Default auditing in a newly installed database. It enables both traditional and the new
- **Unified Auditing** facilities. Netwrix recommends using **Unified Auditing** mode if you do not
+ **Unified Auditing** facilities. Netwrix recommends using **Unified Auditing** mode if you don't
have any trail audit facilities in your infrastructure.
- The product does not log any errors on these events to the Netwrix Auditor System Health log.
+ The product doesn't log any errors on these events to the Netwrix Auditor System Health log.
To configure Oracle Database 12c, 18c, 19c Unified Auditing
@@ -81,7 +81,7 @@ Oracle Database administration documents:
- `[CREATE AUDIT POLICY](https://docs.oracle.com/database/121/SQLRF/statements_5001.htm#create-audit-policy)`
- `[AUDIT POLICY](http://docs.oracle.com/database/121/SQLRF/statements_4008.htm#audit-policy)`
-Currently, Netwrix Auditor checks audit settings for Unified Auditing when compatibility is enabled
+Netwrix Auditor checks audit settings for Unified Auditing when compatibility is enabled
for `ACTIONS`. If any of your current settings conflict with the audit configuration required for
Netwrix Auditor, these conflicts will be listed in the Netwrix Auditor System Health event log.
@@ -106,10 +106,10 @@ Starting with version 10.5, Auditor provides limited support of Oracle Database
for additional information.
Verify that Oracle Data Provider for .NET and Oracle Instant Client are installed and properly
-configured on the computer where Auditor Server is installed. The product does not provide any
+configured on the computer where Auditor Server is installed. The product doesn't provide any
special notification for that.
-Follow the steps to configure **Standard Auditing** on your Oracle Database 11g:
+To configure **Standard Auditing** on your Oracle Database 11gcomplete these steps:
**Step 1 –** Select the audit trail to store audit records. Oracle Database has the following
options:
@@ -122,7 +122,7 @@ options:
### Store Oracle Audit Records
-Follow the steps to select Audit Trail to store Oracle Audit Records:
+To select Audit Trail to store Oracle Audit Recordscomplete these steps:
**Step 1 –** On the computer where your database is deployed, run the sqlplus tool.
@@ -148,7 +148,7 @@ the following:
`STARTUP`
-If you only changed auditing settings, database restart is not required.
+If you only changed auditing settings, database restart isn't required.
If you are using Oracle Real Application Clusters (RAC), see the
[Starting and Stopping Instances and Oracle RAC Databases](https://docs.oracle.com/cd/E11882_01/rac.112/e41960/admin.htm#starting-and-stopping-instances-and-oracle-rac-databases)
@@ -157,7 +157,7 @@ on restarting your instances.
### Enable Auditing of Oracle Database Changes
-Follow the steps to enable auditing of Oracle Database changes:
+To enable auditing of Oracle Database changescomplete these steps:
**Step 1 –** On the computer where your database is deployed, run the sqlplus tool.
diff --git a/docs/auditor/10.8/configuration/oracle/finegained.md b/docs/auditor/10.8/configuration/oracle/finegained.md
index 25712703df..fdc42a49c3 100644
--- a/docs/auditor/10.8/configuration/oracle/finegained.md
+++ b/docs/auditor/10.8/configuration/oracle/finegained.md
@@ -7,11 +7,11 @@ sidebar_position: 40
# Configure Fine Grained Auditing
When configuring Fine Grained Auditing, you need to create an audit policy with required parameters
-set. The section below explains how to create, disable and delete such audit policies.
+set. The section below explains how to create, disable, and delete such audit policies.
Fine Grained audit policies can be configured for Oracle Database Enterprise Edition only. Keep in
mind that if you have Fine Grained policies configured, you will receive a permanent error in the
-Netwrix Auditor System Health log because Netwrix Auditor cannot detect it. Use Unified and Standard
+Netwrix Auditor System Health log because Netwrix Auditor can't detect it. Use Unified and Standard
audit policies to keep track of data changes.
To configure Fine Grained Auditing:
diff --git a/docs/auditor/10.8/configuration/oracle/overview.md b/docs/auditor/10.8/configuration/oracle/overview.md
index f80c0c336b..e8d77735ab 100644
--- a/docs/auditor/10.8/configuration/oracle/overview.md
+++ b/docs/auditor/10.8/configuration/oracle/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -42,7 +42,7 @@ different auditing types:
| --------------------------------------- | --------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Unified Auditing | Oracle Database 23c, 21c, 19c, 18c, 12c | Consolidates all auditing into a single repository and view. This provides a two-fold simplification: audit data can now be found in a single location and all audit data is in a single format. See [Configure Oracle Database for Auditing](/docs/auditor/10.8/configuration/oracle/database.md) topic for more information. |
| Fine Grained Auditing | Oracle Database 23c, 21c, 19c, 18c, 12c, 11g Available for **Enterprise Edition** only. | Supports auditing of actions associated with columns in application tables — along with conditions necessary for an audit record to be generated. Helps to focus on security-relevant columns and rows, ignoring areas that are less important. See [Configure Fine Grained Auditing](/docs/auditor/10.8/configuration/oracle/finegained.md) topic for more information. |
-| Standard Auditing (trail auditing mode) | Oracle Database 11g | See topic for more information. Use initialization parameters and the `AUDIT` and `NOAUDIT` SQL statements to audit: - SQL statements - privileges - schema objects - network and multitier activities See [Oracle documentation](https://docs.oracle.com/cd/E11882_01/server.112/e10575/tdpsg_auditing.htm#oracle-documentation) for more information. Starting with version 10.5, Netwrix Auditor provides limited support of Oracle Database 11g and trail auditing mode, in particular: Netwrix Auditor client UI does not display any warnings and / or errors related to Standard Auditing mode operation. |
+| Standard Auditing (trail auditing mode) | Oracle Database 11g | See topic for more information. Use initialization parameters and the `AUDIT` and `NOAUDIT` SQL statements to audit: - SQL statements - privileges - schema objects - network and multitier activities See [Oracle documentation](https://docs.oracle.com/cd/E11882_01/server.112/e10575/tdpsg_auditing.htm#oracle-documentation) for more information. Starting with version 10.5, Netwrix Auditor provides limited support of Oracle Database 11g and trail auditing mode, in particular: Netwrix Auditor client UI doesn't display any warnings and / or errors related to Standard Auditing mode operation. |
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -58,16 +58,16 @@ dates set by the vendor. So, when planning your Netwrix Auditor deployment, cons
- Several limitations apply to Oracle 11g support in Netwrix Auditor 9.96:
- - Oracle wallets are not supported
- - Lightweight drivers for Oracle Instant Client are not supported
- - Auditor client UI does not display any warnings and / or errors regarding trail audit mode
+ - Oracle wallets aren't supported
+ - Lightweight drivers for Oracle Instant Client aren't supported
+ - Auditor client UI doesn't display any warnings and / or errors regarding trail audit mode
operation
- If you are using Oracle Database 11g and have performed seamless upgrade to the latest version of
- Auditor, the audit data collection will operate properly. However, consider and keep in mind
+ Auditor, the audit data collection will operate properly. However, be aware of
Oracle Database 11g support expiration dates.
-If you are using Oracle Database 12c or later, make sure you have Unified auditing mode enabled.
+If you are using Oracle Database 12c or later, ensure you have Unified auditing mode enabled.
Otherwise, Netwrix Auditor may not operate properly. See the [Migrate to Unified Audit](/docs/auditor/10.8/configuration/oracle/unified.md)
topic for additional information.
@@ -78,7 +78,7 @@ See the [Software Requirements](/docs/auditor/10.8/requirements/software.md) top
If you are using Oracle Wallet to connect to your database, see the
[Create and Configure Oracle Wallet](/docs/auditor/10.8/configuration/oracle/wallet.md) topic for configuration details.
-Oracle Wallet is not supported for Oracle 11g. If you are unsure of your audit settings, refer to
+Oracle Wallet isn't supported for Oracle 11g. If you are unsure of your audit settings, refer to
the [Verify Your Oracle Database Audit Settings](/docs/auditor/10.8/configuration/oracle/verifysettings.md)
Follow the steps for proper configuration.
@@ -111,7 +111,7 @@ displayed).
| - Directory | - Added / Add (Failed attempt) - Removed / Remove (Failed attempt) | - Cause (for failed attempts) - Container name\*\* - Database User - Program name / Database session requester\*\* - Privilege for action - Session ID - Object schema |
| Executable objects | | |
| - Procedure - Function - Package - Package body - Java | - Added / Add (Failed attempt) - Modified / Modify (Failed attempt) - Removed / Remove (Failed attempt) | - Cause (for failed attempts) - Container name\*\* - Database User - Privilege for action - Program name / Database session requester\*\* - Session ID - Unified policy name\*\* |
-| For Oracle 11g database Modified / Modify (Failed attempt) events will not be monitored for the following objects: _Procedure, Function, Package, Package body_ since native audit of these events is not supported. See the [Database SQL Language Reference](https://docs.oracle.com/cd/B28359_01/server.111/b28286/statements_4007.htm#database-sql-language-reference) for additional information. | | |
+| For Oracle 11g database Modified / Modify (Failed attempt) events will not be monitored for the following objects: _Procedure, Function, Package, Package body_ since native audit of these events isn't supported. See the [Database SQL Language Reference](https://docs.oracle.com/cd/B28359_01/server.111/b28286/statements_4007.htm#database-sql-language-reference) for additional information. | | |
| Logons | | |
| - Logon | - Successful logon / Failed logon - Logoff | - Cause (for failed attempts) - Client IP (only for logon events) - Container name\*\* - Database User - Privilege for action - Program name / Database session requester\*\* - Session ID - Object schema - Unified policy name\*\* |
| Materialized views | | |
diff --git a/docs/auditor/10.8/configuration/oracle/permissions.md b/docs/auditor/10.8/configuration/oracle/permissions.md
index 5b982b94ce..463dd77c54 100644
--- a/docs/auditor/10.8/configuration/oracle/permissions.md
+++ b/docs/auditor/10.8/configuration/oracle/permissions.md
@@ -18,7 +18,7 @@ Alternatively, you can assign the default administrator role to that account.
You can grant the required privileges to the existing account, or create a new one. Follow the
procedure described below.
-Follow the steps to grant CREATE SESSION and SELECT privileges to the account.
+To grant CREATE SESSION and SELECT privileges to the account.
**Step 1 –** On the computer where your database is deployed, run the sqlplus tool.
diff --git a/docs/auditor/10.8/configuration/oracle/unified.md b/docs/auditor/10.8/configuration/oracle/unified.md
index 1fe9ec7543..534ba97716 100644
--- a/docs/auditor/10.8/configuration/oracle/unified.md
+++ b/docs/auditor/10.8/configuration/oracle/unified.md
@@ -54,7 +54,7 @@ detailed upgrade scenario.
| Windows systems | Stop the Oracle service: net stop OracleService%ORACLE_SID% |
| Oracle RAC installations | Shut down each database instance as follows: srvctl stop database -db db_name |
-5. Stop the listener. Stopping the listener is not necessary for Oracle RAC and Grid Infrastructure
+5. Stop the listener. Stopping the listener isn't necessary for Oracle RAC and Grid Infrastructure
listeners.
lsnrctl stop listener_name
diff --git a/docs/auditor/10.8/configuration/oracle/verifysettings.md b/docs/auditor/10.8/configuration/oracle/verifysettings.md
index 89fa82a90d..55c284091d 100644
--- a/docs/auditor/10.8/configuration/oracle/verifysettings.md
+++ b/docs/auditor/10.8/configuration/oracle/verifysettings.md
@@ -16,6 +16,6 @@ your Oracle Database version and edition.
| Oracle Database Enterprise Edition (Fine Grained Auditing) | `SELECT POLICY_NAME, ENABLED from DBA_AUDIT_POLICIES;` |
| Oracle Database 11g(Standard Auditing) Starting with version 10.5, Netwrix Auditor provides limited support of Oracle Database 11g and trail auditing mode accordingly. | `SELECT audit_option, success, failure FROM dba_stmt_audit_opts;` To review your initialization parameters, execute the following command: `SHOW PARAMETERS audit%r;` |
-If you want to clean your audit settings periodically, refer to the following Oracle Help Center
+If you want to clean your audit settings periodically, see Oracle Help Center
article for more information:
[Database PL/SQL Packages and Types Reference.](https://docs.oracle.com/database/121/ARPLS/d_audit_mgmt.htm#database-plsql-packages-and-types-reference)
diff --git a/docs/auditor/10.8/configuration/oracle/wallet.md b/docs/auditor/10.8/configuration/oracle/wallet.md
index 1c3c8ab323..1c2158d41c 100644
--- a/docs/auditor/10.8/configuration/oracle/wallet.md
+++ b/docs/auditor/10.8/configuration/oracle/wallet.md
@@ -18,11 +18,11 @@ directory
There are multiple methods to create Oracle Wallet files. For example:
-- Using Oracle Wallet Manager. Refer to the following Oracle help article for more information:
+- Using Oracle Wallet Manager. See the Oracle help article for more information:
[Creating a New Oracle Wallet](https://docs.oracle.com/database/121/DBIMI/walet.htm#creating-a-new-oracle-wallet).
-- Using a console. As an example, refer to the following Oracle help article for WebLogic JDBC:
+- Using a console. As an example, see the Oracle help article for WebLogic JDBC:
[Creating and Managing Oracle Wallet](https://docs.oracle.com/middleware/1213/wls/JDBCA/oraclewallet.htm#creating-and-managing-oracle-wallet).
-- Using other Oracle products. For example, Autonomous Data Warehouse. Refer to the following Oracle
+- Using other Oracle products. For example, Autonomous Data Warehouse. See the Oracle
help article for more information:
[Download Client Credentials (Wallets)](https://docs.oracle.com/en/cloud/paas/autonomous-data-warehouse-cloud/user/connect-download-wallet.html#download-client-credentials-wallets).
@@ -32,7 +32,7 @@ To perform clear install of Oracle Instant Client, follow the instructions below
Client installed, see the Update Existing Oracle Client Installation topic for additional
information.
-Follow the steps to install Oracle Instant Client
+To install Oracle Instant Client
**Step 1 –** Download the appropriate package from Oracle website:
[Instant Client Packages](https://www.oracle.com/database/technologies/instant-client/downloads.html).
@@ -83,7 +83,7 @@ myOracle =
)
-Keep in mind that the wallet alias in the configuration file must equal to Netwrix Auditor item
+Remember that the wallet alias in the configuration file must equal to Netwrix Auditor item
name.
## Configure Oracle Instant Client for HTTP Proxy Connections
diff --git a/docs/auditor/10.8/configuration/sharepoint/overview.md b/docs/auditor/10.8/configuration/sharepoint/overview.md
index b9e9769956..80de19764b 100644
--- a/docs/auditor/10.8/configuration/sharepoint/overview.md
+++ b/docs/auditor/10.8/configuration/sharepoint/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -40,7 +40,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
## Configure Audit Log Trimming
-Follow the steps to configure Audit Log Trimming on your SharePoint farm.
+To configure Audit Log Trimming on your SharePoint farm.
**Step 1 –** Log in as an administrator to the audited SharePoint site collection.
@@ -65,7 +65,7 @@ settings.
## Configure Events Auditing Settings
-Follow the steps to configure event auditing settings.
+To configure event auditing settings.
**Step 1 –** Log in as an administrator to the audited SharePoint site collection.
@@ -94,11 +94,11 @@ information.
## Enable SharePoint Administration Service
This service is must be started to ensure the Netwrix Auditor for SharePoint Core Service successful
-installation. Perform the procedure below, prior to the Core Service installation. See the
+installation. Perform the procedure below, before the Core Service installation. See the
[Install for SharePoint Core Service](/docs/auditor/10.8/install/sharepointcoreservice.md) topic for additional
information.
-Follow the steps to enable SharePoint Administration Service.
+To enable SharePoint Administration Service.
**Step 1 –** On the computer where SharePoint Central Administration is installed and where you
intend to deploy Netwrix Auditor for SharePoint Core Service, open the Services Management Console.
@@ -172,7 +172,7 @@ Review the following for additional information:
| -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Permission level | Default permission levels are predefined sets of permissions that you can assign to individual users, groups of users, or security groups, based on their functional requirements and on security considerations. SharePoint Server permission levels are defined at the site collection level; by default, they are inherited from the parent object. For more information on SharePoint permissions and permission levels read the following Microsoft article: [User permissions and permission levels in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/sites/user-permissions-and-permission-levels). |
| Zone: Default (policy) Zone: Intranet (policy) Zone: Internet (policy) Zone: Custom (policy) Zone: Extranet (policy) | Zone If you want to expose the same content in a web application to different types of users by using additional URLs or authentication methods, you can extend an existing web application into a new zone. When you extend the web application into a new zone, you create a separate Internet Information Services (IIS) web site to serve the same content, but with a unique URL and authentication type. For more information on SharePoint zones read the following Microsoft article: [Extend claims-based web applications in SharePoint](https://learn.microsoft.com/en-us/sharepoint/administration/extend-a-claims-based-web-application)[ ](https://social.technet.microsoft.com/wiki/contents/articles/38031.sharepoint-2016-extend-a-web-application.aspx). Policies Web application policies represent a concept that allows SharePoint administrators to grant or deny permissions to users and groups for sites under a web application. These granted or denied permissions take preference over the permissions set for the sites in the web application. For more information on SharePoint web application policies read the following Microsoft article: [Manage permissions for a web application in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/administration/manage-permissions-for-a-web-application). |
-| Site collection administrator | The _SharePoint site collection administrator_ is a permission type that overrides Full Control permission. It cannot be locked out of any subsite, list, library, item, or page on the site. The permissions inheritance for any of these elements can be broken at any time, and permissions can be changed so that even users with Full Control will have lesser permissions or even no permissions at all. In all cases the SharePoint site collection administrator will always have full access to all elements and all data. For more information, read the following Microsoft article: [Change site collection administrators in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/sites/change-site-collection-administrators). |
+| Site collection administrator | The _SharePoint site collection administrator_ is a permission type that overrides Full Control permission. It can't be locked out of any subsite, list, library, item, or page on the site. The permissions inheritance for any of these elements can be broken at any time, and permissions can be changed so that even users with Full Control will have lesser permissions or even no permissions at all. In all cases the SharePoint site collection administrator will always have full access to all elements and all data. For more information, read the following Microsoft article: [Change site collection administrators in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/sites/change-site-collection-administrators). |
| Site Collection lock status | Lock statuses apply to a site collection and are used to control the actions allowed on site collection. For more information on lock statuses, read the following Microsoft article: [Manage the lock status for site collections in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/sites/manage-the-lock-status-for-site-collections). |
| Web application user permissions | Sites and site collections have a variety of permissions that can be set, such as adding or editing list items or documents. These permissions are normally given to a user by assigning a particular permission level, such as _Full Control_, _Contribute_, or _View Only_. Each individual permission can be enabled or disabled for entire web application. For more information on web application user permissions, read the following Microsoft article: [Manage permissions for a web application in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/administration/manage-permissions-for-a-web-application). |
| Farm account | Farm account is a service account used to run the Central Administration web site application pool. It has _dbo_ access to the configuration database. For more information on SharePoint service accounts, read the following Microsoft articles: - [Plan for administrative and service accounts in SharePoint Server](https://docs.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/plan-for-administrative-and-service-accounts) - [Account permissions and security settings in SharePoint Servers 2016 and 2019 Public Preview](https://docs.microsoft.com/en-us/sharepoint/install/account-permissions-and-security-settings-in-sharepoint-server-2016) |
diff --git a/docs/auditor/10.8/configuration/sharepoint/permissions.md b/docs/auditor/10.8/configuration/sharepoint/permissions.md
index 51cb2d7f92..b722692239 100644
--- a/docs/auditor/10.8/configuration/sharepoint/permissions.md
+++ b/docs/auditor/10.8/configuration/sharepoint/permissions.md
@@ -21,9 +21,7 @@ These group Managed Service Accounts should meet the related requirements.
**On the target SharePoint farm:**
1. On the SharePoint server where the Netwrix Auditor Core Service will be deployed: the account
- must be a member of the local Administrators group.
- To learn more about Netwrix Auditor Core Services, refer to
- [Installation](/docs/auditor/10.8/install/overview.md) topic.
+ must be a member of the local Administrators group. See the [Installation](/docs/auditor/10.8/install/overview.md) topic for details.
2. On the SQL Server hosting SharePoint database: the SharePoint_Shell_Access role.
See the Assigning 'SharePoint_Shell_Access' Role topic for additional information.
3. If you plan to collect state-in-time data from a SharePoint farm, the account should also meet
@@ -61,7 +59,7 @@ a service policy defined locally or on the domain level, the local Log on as a s
be reset. In this case, redefine the Deny log on as a service policy through the Local Security
Policy console on your computer or on the domain level through the Group Policy Management console.
-Follow the steps to define log on as a service policy:
+To define log on as a service policycomplete these steps:
**Step 1 –** On the computer where Auditor Server is installed, open the **Local Security Policy**
snap-in: navigate to Start > Windows Administrative Tools and select Local Security Policy.
diff --git a/docs/auditor/10.8/configuration/sqlserver/configuringtracelogging.md b/docs/auditor/10.8/configuration/sqlserver/configuringtracelogging.md
index 4213c2edca..6ba326157a 100644
--- a/docs/auditor/10.8/configuration/sqlserver/configuringtracelogging.md
+++ b/docs/auditor/10.8/configuration/sqlserver/configuringtracelogging.md
@@ -9,7 +9,7 @@ sidebar_position: 30
If trace logging is disabled in SQL Server, then changes will be reported in Netwrix Auditor as made
by _system_. To detect actual change initiator, Netwrix Auditor needs native trace logs data. During
every data collection, Netwrix Auditor will check if the internal SQL audit mechanism is enabled,
-and enable it if necessary. To read more, refer to
+and enable it if necessary. See
[this Netwrix Knowledge Base article](https://kb.netwrix.com/728).
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
@@ -22,7 +22,7 @@ follow the procedure below.
If you enable monitoring of SQL logons, SQL trace for these logons will be created anyway.
-Follow the steps to exclude SQL Server instance from turning trace logging on automatically.
+To exclude SQL Server instance from turning trace logging on automatically.
**Step 1 –** On Netwrix Auditor server, go to the _%Netwrix Auditor installation folder%\SQL Server
Auditing_ folder.
@@ -44,7 +44,7 @@ Files\Microsoft SQL Server\MSSQL13.``\MSSQL\Log_.
You can change this default location, using the _pathstotracelogs.txt_ file.
-Follow the steps to change trace log location.
+To change trace log location.
**Step 1 –** On Netwrix Auditor server, go to _%Netwrix Auditor installation folder%\SQL Server
Auditing_ folder.
@@ -61,7 +61,7 @@ will be ignored.
`SQLSRV01\MSSQL2016|C:\Logs\NA trace logs\`
-If you want to change trace logs location for multiple instances of one SQL server, make sure that
+If you want to change trace logs location for multiple instances of one SQL server, ensure that
specified UNC paths are unique across these instances.
Correct:
diff --git a/docs/auditor/10.8/configuration/sqlserver/overview.md b/docs/auditor/10.8/configuration/sqlserver/overview.md
index 4e303517e3..db56c89d6d 100644
--- a/docs/auditor/10.8/configuration/sqlserver/overview.md
+++ b/docs/auditor/10.8/configuration/sqlserver/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -23,7 +23,7 @@ be checked on each data collection and adjusted if necessary.
## Checking for Primary Key
If you plan to audit an SQL Server for data changes and browse the results using '_Before_' and
-'_After_' filter values, make sure that the audited SQL database tables have a primary key (or a
+'_After_' filter values, ensure that the audited SQL database tables have a primary key (or a
unique column). Otherwise, '_Before_' and '_After_' values will not be reported.
## SQL Server Objects
diff --git a/docs/auditor/10.8/configuration/sqlserver/permissions.md b/docs/auditor/10.8/configuration/sqlserver/permissions.md
index 30f198da99..42e552b1b3 100644
--- a/docs/auditor/10.8/configuration/sqlserver/permissions.md
+++ b/docs/auditor/10.8/configuration/sqlserver/permissions.md
@@ -17,7 +17,7 @@ You can use group Managed Service Accounts (gMSA) as data collecting accounts.
1. To access SQL Server, Windows authentication will be used, so data collection account should be a
Windows account specified in the _domain\user_ format (_domain\user$_ for Managed Service
Account).
- SQL Server logins and authentication method are not supported.
+ SQL Server logins and authentication method aren't supported.
2. The account must be assigned the **System Administrator** server role for this SQL Server. See
Assigning 'System Administrator' Role section for more information.
3. For auditing SQL Server availability on groups, the account must have the sysadmin server role
diff --git a/docs/auditor/10.8/configuration/useractivity/datacollection.md b/docs/auditor/10.8/configuration/useractivity/datacollection.md
index 6a84706e37..ce1f170e6d 100644
--- a/docs/auditor/10.8/configuration/useractivity/datacollection.md
+++ b/docs/auditor/10.8/configuration/useractivity/datacollection.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Configure Data Collection Settings
-To successfully track user activity, make sure that the following settings are configured on the
+To successfully track user activity, ensure that the following settings are configured on the
audited computers and on the computer where Netwrix Auditor Server is installed:
- The **Windows Management Instrumentation** and the **Remote Registry** services are running and
@@ -25,23 +25,23 @@ audited computers and on the computer where Netwrix Auditor Server is installed:
## Check the Windows Services Status
-Follow the steps to check the status and startup type of Windows services.
+To check the status and startup type of Windows services.
**Step 1 –** Navigate to Start > Windows Administrative Tools > Services.
-**Step 2 –** In the **Services** snap-in, locate the **Remote Registry** service and make sure that
+**Step 2 –** In the **Services** snap-in, locate the **Remote Registry** service and ensure that
its status is _"Started"_ (on pre-Windows Server 2012 versions) and _"Running"_ (on Windows Server
-2012 and above). If it is not, right-click the service and select Start from the pop-up menu.
+2012 and above). If it isn't, right-click the service and select Start from the pop-up menu.
-**Step 3 –** Check that the **Startup Type** is set to _"Automatic"_. If it is not, double-click the
+**Step 3 –** Check that the **Startup Type** is set to _"Automatic"_. If it isn't, double-click the
service. In the **Remote Registry Properties** dialog, in the **General** tab, select _"Automatic"_
-from the drop-down list.
+from the dropdown list.
**Step 4 –** Perform the steps above for the **Windows Management Instrumentation** service.
## Windows Features Communication
-Follow the steps to allow Windows features to communicate through Firewall.
+To allow Windows features to communicate through Firewall.
**Step 1 –** Navigate to **Start → Control Panel** and select **Windows Firewall.**
@@ -49,14 +49,14 @@ Follow the steps to allow Windows features to communicate through Firewall.
program or feature through Windows Firewall** on the left.
**Step 3 –** In the Allow an app or feature through Windows Firewall page that opens, locate the
-**File and Printer Sharing** feature and make sure that the corresponding checkbox is selected under
+**File and Printer Sharing** feature and ensure that the corresponding checkbox is selected under
Domain.
**Step 4 –** Repeat step 3 for the **Windows Management Instrumentation (WMI)** feature.
## Open Local TCP Port 9004
-Follow the steps to open Local TCP Port 9004 for inbound connections.
+To open Local TCP Port 9004 for inbound connections.
**Step 1 –** On the computer where Netwrix Auditor is installed, navigate to **Start → Control
Panel** and select **Windows Firewall.**
@@ -73,7 +73,7 @@ left.
- On the Program step, specify the path: %Netwrix Auditor installation folder%/Netwrix Auditor/User
Activity Video Recording/UAVRServer.exe.
- On the Action step, select the Allow the connection action.
-- On the Profile step, make sure that the rule applies to Domain.
+- On the Profile step, ensure that the rule applies to Domain.
- On the Name step, specify the rule's name, for example UA Server inbound rule.
**Step 5 –** Double-click the newly created rule and open the Protocols and Ports tab.
@@ -85,7 +85,7 @@ left.
## Open Local TCP Port 9003
-Follow the steps to open Local TCP Port 9003 for inbound connections.
+To open Local TCP Port 9003 for inbound connections.
**Step 1 –** On a target computer navigate to **Start → Control Panel** and select **Windows
Firewall.**
@@ -115,7 +115,7 @@ left.
## Open Remote TCP Port 9004
-Follow the steps to open Remote TCP Port 9004 for outbound connections.
+To open Remote TCP Port 9004 for outbound connections.
**Step 1 –** On a target computer, navigate to **Start → Control Panel** and select **Windows
Firewall.**
diff --git a/docs/auditor/10.8/configuration/useractivity/overview.md b/docs/auditor/10.8/configuration/useractivity/overview.md
index ee66b3d7e0..135477a24a 100644
--- a/docs/auditor/10.8/configuration/useractivity/overview.md
+++ b/docs/auditor/10.8/configuration/useractivity/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -30,7 +30,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
**IMPORTANT:** Even if automatic configuration is selected, the following prerequisites must be configured manually.
- - On the audited system(s):
+ - On the audited systems:
- The **Windows Management Instrumentation** and the **Remote Registry** services must be
running and their **Startup Type** must be set to "Automatic".
@@ -92,12 +92,12 @@ By default, the agent is installed automatically on the audited computers upon t
Object** wizard completion. If, for some reason, installation has failed, you must install the agent
manually on each of the audited computers.
-Before installing Netwrix Auditor agent to audit user activity, make sure that:
+Before installing Netwrix Auditor agent to audit user activity, ensure that:
- The audit settings are configured properly.
- The Data Processing Account has access to the administrative shares.
-Follow the steps to install Netwrix Auditor agent to audit user activity.
+To install Netwrix Auditor agent to audit user activity.
**Step 1 –** Navigate to _%Netwrix Auditor Installation Folder%\User Activity Video Recording_ and
copy the UACoreSvcSetup.msi file to the audited computer.
diff --git a/docs/auditor/10.8/configuration/useractivity/videorecordings.md b/docs/auditor/10.8/configuration/useractivity/videorecordings.md
index 7d513caae3..3e3c4eda61 100644
--- a/docs/auditor/10.8/configuration/useractivity/videorecordings.md
+++ b/docs/auditor/10.8/configuration/useractivity/videorecordings.md
@@ -17,7 +17,7 @@ be configured:
- The user must have read permissions (resultant set) to the **Netwrix_UAVR$** shared folder where
video files are stored. By default, all members of the **Netwrix Auditor Client Users** group can
access this shared folder. Both the group and the folder are created automatically by Netwrix
- Auditor. Make sure to grant sufficient permissions on folder or explicitly add user to the group
+ Auditor. Ensure to grant sufficient permissions on folder or explicitly add user to the group
(regardless his or her role delegated in the product). See the To Add an Account to Netwrix
Auditor Client Users Group topic for additional information.
- A dedicated codec must be installed. This codec is installed automatically on the computer where
@@ -45,13 +45,11 @@ Auditor console.
**NOTE:** Microsoft is in the process of deprecating Internet Explorer. However, if you are trying
to access the video recordings from browser via direct links (reports on SSRS portal, subscriptions,
activity summaries, search export results), IE engine should be present on the client machine. IE
-might be disabled with GPO, but it should not be removed completely. Recommended option is to use
+might be disabled with GPO, but it shouldn't be removed completely. Recommended option is to use
Edge with "IE mode" option enabled.
## To Configure Internet Explorer Security Settings
-Follow the steps to configure Internet Explorer security settings.
-
**Step 1 –** In Internet Explorer, navigate to **Tools** > **Internet Options**.
**Step 2 –** Switch to the Security tab and select **Local Intranet**. Click **Custom Level**.
@@ -68,8 +66,6 @@ checkbox.
## To Enable JavaScript
-Follow the steps to enable JavaScript.
-
**Step 1 –** In Internet Explorer, navigate to **Tools** > **Internet Options**.
**Step 2 –** Switch to the Security tab and select **Internet**. Click **Custom Level**.
@@ -79,8 +75,6 @@ verify that **Active scripting** is set to **Enable**.
## To Disable Internet Explorer Enhanced Security Configuration (IE ESC)
-Follow the steps to disable Internet Explorer enhanced security configuration.
-
**Step 1 –** Navigate to Start > Windows Administrative Tools > **Server Manager**.
**Step 2 –** In the Security Information section, click Configure IE ESC link on the right to
@@ -91,8 +85,6 @@ disable it.
All members of the Netwrix Auditor Client Users group are granted the Global reviewer role in
Netwrix Auditor and have access to all collected data.
-Follow the steps to add an account to the Netwrix Auditor Client Users group.
-
**Step 1 –** On the computer where Netwrix Auditor Server is installed, start the Local Users and
Computers snap-in.
diff --git a/docs/auditor/10.8/configuration/vmware/overview.md b/docs/auditor/10.8/configuration/vmware/overview.md
index f5c162f9b5..74cb297ad2 100644
--- a/docs/auditor/10.8/configuration/vmware/overview.md
+++ b/docs/auditor/10.8/configuration/vmware/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
diff --git a/docs/auditor/10.8/configuration/windowsserver/advancedpolicy.md b/docs/auditor/10.8/configuration/windowsserver/advancedpolicy.md
index 7bdc69641f..c856f388be 100644
--- a/docs/auditor/10.8/configuration/windowsserver/advancedpolicy.md
+++ b/docs/auditor/10.8/configuration/windowsserver/advancedpolicy.md
@@ -26,8 +26,6 @@ Setting up both basic and advanced audit policies may lead to incorrect audit re
basic audit policies to be ignored and prevent conflicts, enable the _Audit: Force audit policy
subcategory settings_ policy.
-Follow the steps to enforce advanced policies.
-
**Step 1 –** On the audited server, open the Local Security Policy snap-in and navigate to Start >
Windows Administrative Tools > Local Security Policy.
@@ -40,9 +38,9 @@ Force audit policy subcategory settings policy.
## Configure Advanced Audit Policy on Windows Server 2016
-In Windows Server 2016 audit policies are not integrated with the Group Policies and can only be
+In Windows Server 2016 audit policies aren't integrated with the Group Policies and can only be
deployed using logon scripts generated with the native Windows **auditpol.exe** command line tool.
-Therefore, these settings are not permanent and will be lost after server reboot.
+Therefore, these settings aren't permanent and will be lost after server reboot.
The procedure below explains how to configure Advanced audit policy for a single server. If you
audit multiple servers, you may want to create logon scripts and distribute them to all target
@@ -100,4 +98,4 @@ System Audit Policies.
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------ | ------------ |
| Account Management | - Audit Security Group Management
- Audit User Account Management
| "Success" |
| Object Access | - Audit Handle Manipulation
- Audit Other Object Access Events
- Audit Registry
- Audit File Share
| "Success" |
-| Policy Change | - Audit Audit Policy Change
| "Success" |
+| Policy Change | | "Success" |
diff --git a/docs/auditor/10.8/configuration/windowsserver/dhcp.md b/docs/auditor/10.8/configuration/windowsserver/dhcp.md
index 3fb268b52e..58dc1947cf 100644
--- a/docs/auditor/10.8/configuration/windowsserver/dhcp.md
+++ b/docs/auditor/10.8/configuration/windowsserver/dhcp.md
@@ -16,7 +16,7 @@ settings (size and retention method). For that, take the steps described below.
-4. Make sure the **Enable logging** option is selected.
+4. Ensure the **Enable logging** option is selected.
5. Set **Maximum log size** to **4 GB**.
6. Set the retention method to **Overwrite events as needed (oldest events first)**. Click **OK** to
save the settings and close the dialog.
diff --git a/docs/auditor/10.8/configuration/windowsserver/eventlog.md b/docs/auditor/10.8/configuration/windowsserver/eventlog.md
index b763d53811..5525bd089f 100644
--- a/docs/auditor/10.8/configuration/windowsserver/eventlog.md
+++ b/docs/auditor/10.8/configuration/windowsserver/eventlog.md
@@ -21,8 +21,7 @@ for these logs to "_Overwrite events as needed_". This refers to the following e
Windows Server 2012 R2 and above)
- Applications and Services logs > AD FS > Admin log (for AD FS servers )
-Refer to the following Microsoft
-[article to read about the recommended event log settings](https://support.microsoft.com/en-us/help/957662/recommended-settings-for-event-log-sizes-in-windows).
+See the [recommended event log settings](https://support.microsoft.com/en-us/help/957662/recommended-settings-for-event-log-sizes-in-windows) article for more information.
The procedure below provides a possible way to specify the event log settings manually. However, if
you have multiple target computers, consider configuring these settings via Group Policy as also
@@ -30,8 +29,6 @@ described in this section
## Configure the Event Log Size Manually
-Follow the steps to configure Event Log Size and Retention Settings.
-
**Step 1 –** On a target server, navigate to Start > Windows Administrative Tools > Event Viewer.
**Step 2 –** Navigate to Event Viewer tree > Windows Logs, right-click **Security** and select
@@ -39,14 +36,14 @@ Follow the steps to configure Event Log Size and Retention Settings.
-**Step 3 –** Make sure Enable logging is selected.
+**Step 3 –** ensure Enable logging is selected.
-**Step 4 –** In the Maximum log size field, specify the desired log size.
+**Step 4 –** In the Maximum log size field, specify the log size you want.
-**Step 5 –** Make sure the Do not overwrite events (Clear logs manually) check box is cleared. If
+**Step 5 –** ensure the Don't overwrite events (Clear logs manually) checkbox is cleared. If
selected, change the retention method to _Overwrite events as needed (oldest events first)_.
-Make sure the Maximum security log size group policy does not overwrite your log settings. To check
+Ensure the Maximum security log size group policy doesn't overwrite your log settings. To check
this, start the Group Policy Management console, proceed to the GPO that affects your server, and
navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Event Log.
@@ -61,7 +58,7 @@ Repeat these steps for the following event logs:
- **Applications and Services Logs > Microsoft > Windows > DNS-Server > Audit**
Configure setting for DNS log only if you want to monitor DNS changes. The log is available on
- Windows Server 2012 R2 and above and is not enabled by default. See Microsoft documentation for
+ Windows Server 2012 R2 and above and isn't enabled by default. See Microsoft documentation for
more information on how to enable this log.
- **Applications and Services Logs** **>** **AD FS** **>** **Admin**
@@ -73,7 +70,7 @@ Repeat these steps for the following event logs:
Personnel with administrative rights can use Group Policy Objects to apply configuration settings to
multiple servers in bulk.
-Follow the steps to configure settings for Application, System and Security event logs.
+To configure settings for Application, System, and Security event logs:
**Step 1 –** Open the Group Policy Management Editor on the domain controller and go to **Computer
Configuration > Policies > Administrative Templates > Windows Components > Event Log Service**.
@@ -85,7 +82,7 @@ KB_.
**Step 4 –** Specify retention settings for the log; usually it is Overwrite as needed.
-Follow the steps to configure settings for other logs.
+To configure settings for other logs:
**Step 1 –** Open the registry editor and go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\. For example:
diff --git a/docs/auditor/10.8/configuration/windowsserver/iis.md b/docs/auditor/10.8/configuration/windowsserver/iis.md
index a378e700c1..c8f515616f 100644
--- a/docs/auditor/10.8/configuration/windowsserver/iis.md
+++ b/docs/auditor/10.8/configuration/windowsserver/iis.md
@@ -19,7 +19,7 @@ To configure the Operational log size and retention method
-4. Make sure **Enable logging** is enabled.
+4. Ensure **Enable logging** is enabled.
5. Set **Maximum log size** to 4 GB.
-6. Make sure **Do not overwrite events (Clear logs manually)** is cleared. If selected, change the
+6. Ensure **Don't overwrite events (Clear logs manually)** is cleared. If selected, change the
retention method to **Overwrite events as needed (oldest events first)**.
diff --git a/docs/auditor/10.8/configuration/windowsserver/localpolicy.md b/docs/auditor/10.8/configuration/windowsserver/localpolicy.md
index ad7acc6f16..c947a37788 100644
--- a/docs/auditor/10.8/configuration/windowsserver/localpolicy.md
+++ b/docs/auditor/10.8/configuration/windowsserver/localpolicy.md
@@ -28,8 +28,6 @@ While there are several methods to configure local audit policies, this topic co
them: how to configure policies locally with the Local Security Policy snap-in. To apply settings to
the whole domain, use the Group Policy but consider the possible impact on your environment.
-Follow the steps to configure local audit policies.
-
**Step 1 –** On the audited server, open the Local Security Policy snap-in: navigate to Start >
Windows Administrative Tools > Local Security Policy.
diff --git a/docs/auditor/10.8/configuration/windowsserver/overview.md b/docs/auditor/10.8/configuration/windowsserver/overview.md
index 2c6e30487c..7fbac706b7 100644
--- a/docs/auditor/10.8/configuration/windowsserver/overview.md
+++ b/docs/auditor/10.8/configuration/windowsserver/overview.md
@@ -10,7 +10,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity, otherwise your change reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -41,7 +41,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
Change subcategories must be enabled for _"Success"_.
- For Windows Server 2008 R2 / Windows 7 and above—Audit Security Group Management, Audit
User Account Management, Audit Handle Manipulation, Audit Other Object Access Events,
- Audit Registry, Audit File Share, and Audit Audit Policy Change advanced audit policies
+ Audit Registry, Audit File Share, and Audit Policy Change advanced audit policies
must be set to _"Success"_.
- See the [Configure Local Audit Policies](/docs/auditor/10.8/configuration/windowsserver/localpolicy.md) topic and the
[Configure Advanced Audit Policies](/docs/auditor/10.8/configuration/windowsserver/advancedpolicy.md) topic for additional information.
@@ -49,7 +49,7 @@ You can configure your IT Infrastructure for monitoring in one of the following
- The following legacy audit policies can be configured instead of advanced: Audit object
access, Audit policy change, and **Audit account management** must be set to _"Success"_.
- The Enable Persistent Time Stamp local group policy must be enabled. This policy should be
- configured manually since Auditor does not enable it automatically. See the
+ configured manually since Auditor doesn't enable it automatically. See the
[Configure Enable Persistent Time Stamp Policy](/docs/auditor/10.8/configuration/windowsserver/persistenttimestamp.md) topic for additional
information.
- The Application, Security, and System event log maximum size must be set to 4 GB. The
@@ -83,12 +83,12 @@ You can configure your IT Infrastructure for monitoring in one of the following
- Performance Logs and Alerts (TCP-In)
- If the audited servers are behind the Firewall, review the list of protocols and ports
- required for Netwrix Auditor and make sure that these ports are opened. See the
+ required for Netwrix Auditor and ensure that these ports are opened. See the
[Windows Server Ports](/docs/auditor/10.8/configuration/windowsserver/ports.md) topic for additional information.
- For auditing removable storage media, two Event Trace Session objects must be created. See the
[Configure Removable Storage Media for Monitoring](/docs/auditor/10.8/configuration/windowsserver/removablestorage.md) topic for additional
information.
- - If you want to use Network traffic compression, make sure that the Auditor console computer is
+ - If you want to use Network traffic compression, ensure that the Auditor console computer is
accessible by its FQDN name.
- For auditing IIS:
@@ -111,8 +111,6 @@ remember to do the following:
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Windows
Server monitoring scope.
-Follow the steps to exclude data from the Windows Server monitoring scope:
-
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Windows Server Auditing_ folder.
**Step 2 –** Edit the \*.txt files, based on the following guidelines:
@@ -124,10 +122,10 @@ Follow the steps to exclude data from the Windows Server monitoring scope:
| File | Description | Syntax |
| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| omitcollectlist.txt | Contains a list of objects and their properties to be excluded from being monitored. If you want to restart monitoring these objects, remove them from the omitcollectlist.txt and run data collection at least twice. | `monitoring plan name,server name,class name,property name,property value` `class name` is a mandatory parameter, it cannot be replaced with a wildcard. `property name` and `property value` are optional, but cannot be replaced with wildcards either. For example: `#*,server,MicrosoftDNS_Server `````` #*,*,StdServerRegProv` |
+| omitcollectlist.txt | Contains a list of objects and their properties to be excluded from being monitored. If you want to restart monitoring these objects, remove them from the omitcollectlist.txt and run data collection at least twice. | `monitoring plan name,server name,class name,property name,property value` `class name` is a mandatory parameter, it can't be replaced with a wildcard. `property name` and `property value` are optional, but can't be replaced with wildcards either. For example: `#*,server,MicrosoftDNS_Server `````` #*,*,StdServerRegProv` |
| omiterrors.txt | Contains a list of errors/warnings to be omitted from logging to the Netwrix Auditor System Health event log. | `monitoring plan name,server name,error text` For example: `*,productionserver1.corp.local,*Access is denied*` |
| omitreportlist.txt | Contains a list of objects to be excluded from reports and Activity Summary emails. In this case audit data is still being collected. | `monitoring plan name,who,where,object type,what,property name` For example: `*,CORP\\jsmith,*,*,*,*` |
-| omitsitcollectlist.txt | Contains a list of objects to be excluded from State-in-time reports. | `monitoring planname,server name,class name,property name,property value` `class name` is a mandatory parameter, it cannot be replaced with a wildcard. `property name` and `property value` are optional, but cannot be replaced with wildcards either. For example: `*,server,MicrosoftDNS_Server` `*,*,StdServerRegProv` |
+| omitsitcollectlist.txt | Contains a list of objects to be excluded from State-in-time reports. | `monitoring planname,server name,class name,property name,property value` `class name` is a mandatory parameter, it can't be replaced with a wildcard. `property name` and `property value` are optional, but can't be replaced with wildcards either. For example: `*,server,MicrosoftDNS_Server` `*,*,StdServerRegProv` |
| omitstorelist.txt | Contains a list of objects to be excluded from being stored to the Audit Archive and showing up in reports. In this case audit data is still being collected. | `monitoring plan name,who,where,object type,what,property name` For example: `*,*,*,Scheduled task,Scheduled Tasks\\User_Feed_Synchronization*,*` |
## Monitored Objects
@@ -197,12 +195,12 @@ value is reported as _“Not Applicable”_.
| DHCP Reservation | - Type:
- IPv4
- IPv6
- Action:
- Added
- Removed
- Modified
|
| DHCP Policy | - Type:
- IPv4
- IPv4 server-wide
- Action:
- Added
- Removed
- Modified
- Renamed
|
| Removable media | |
-| Removable Storage Media\*\* | Netwrix Auditor does not report on floppy/optical disk and memory card storage medias. For removable storages, the When value reports actual time when a change was made and/or a target server was started. - Device class:
- CD and DVD
- Floppy Drives
- Removable Disk
- Tape Drives
- Windows Portable Devices When the Audit Object Access local audit policy and/or the Audit Central Access Policy Staging \ Audit Removable Storage advanced audit policies are enabled on the target server, the `gpupdate /force` command execution issues removable storage restart. These actions are disclosed in Netwrix Auditor reports, search, and activity summaries. Note that these actions are system, not user-effected.
|
+| Removable Storage Media\*\* | Netwrix Auditor doesn't report on floppy/optical disk and memory card storage medias. For removable storages, the When value reports actual time when a change was made and/or a target server was started. - Device class:
- CD and DVD
- Floppy Drives
- Removable Disk
- Tape Drives
- Windows Portable Devices When the Audit Object Access local audit policy and/or the Audit Central Access Policy Staging \ Audit Removable Storage advanced audit policies are enabled on the target server, the `gpupdate /force` command execution issues removable storage restart. These actions are disclosed in Netwrix Auditor reports, search, and activity summaries. These actions are system-generated, not user-initiated.
|
| Scheduled Tasks | |
| Scheduled Task | - Account Name
- Application
- Comment
- Creator
- Enabled
- Parameters
- Triggers
|
| Local Users and Groups | |
| Local Group | |
-| Local User | - Description
- Disabled/Enabled
- Full Name
- Name
- User cannot change password
- Password Never Expires
- User must change password at next logon
|
+| Local User | - Description
- Disabled/Enabled
- Full Name
- Name
- User can't change password
- Password Never Expires
- User must change password at next logon
|
| DNS Configuration | |
| The Who value will be reported for DNS configuration settings only if the DNS server runs on Windows Server 2012 R2. See the following Microsoft article for additional information: [Update adds query logging and change auditing to Windows DNS servers](https://support.microsoft.com/en-us/kb/2956577). | |
| DNS Server | - Address Answer Limit
- Allow Update
- Auto Cache Update
- Auto Config File Zones
- Bind Secondaries
- Boot Method
- Default Aging State
- Default No Refresh Interval
- Default Refresh Interval
- Disable Auto Reverse Zones
- Disjoint Nets
- Ds Available
- Ds Polling Interval
- Ds Tombstone Interval
- EDns Cache Timeout
- Enable Directory Partitions
- Enable Dns Sec
- Enable EDns Probes
- CD-ROM D Enable Netmask Ordering
- Event Log Level
- Fail On Load If Bad Zone Data
- Forward Delegations
- Forwarders
- Forwarding Timeout
- Is Slave
- Listen Addresses
- Log File Max Size
- Log File Path
- Log Level
- Loose Wildcarding
- Max Cache TTL
- Max Negative Cache TTL
- Name Check Flag
- No Recursion
- Recursion Retry
- Recursion Timeout
- Round Robin
- Rpc Protocol
- Scavenging Interval
- Secure Cache Against Pollution
- Send Port
- Server Addresses
|
@@ -238,7 +236,7 @@ value is reported as _“Not Applicable”_.
| DNS SIG | - Algorithm
- Container name
- Key tag
- Labels
- Original TTL
- Owner name
- Record class
- Signature expiration (GMT)
- Signature inception (GMT)
- Signature (base 64)
- Signer's name
- TTL
- Type covered
- Zone type
|
| DNS SRV | - Container name
- Host offering this service
- Owner name
- Port number
- Priority
- Record class
- TTL
- Weight
- Zone type
|
| DNS TEXT | - Container name
- Owner name
- Record class
- Text
- TTL
- Zone type
|
-| DNS WINS | - Cache time-out
- Container name
- Do not replicate this record
- Lookup time-out
- Owner name
- Record class
- Wins servers
- Zone type
|
+| DNS WINS | - Cache time-out
- Container name
- Don't replicate this record
- Lookup time-out
- Owner name
- Record class
- Wins servers
- Zone type
|
| DNS WKS | - Container name
- IP address
- Owner name
- Protocol
- Record class
- Services
- TTL
- Zone type
|
| DNS X25 | - Container name
- Owner name
- Record
- Record class
- TTL
- X.121 PSDN address
- Zone type
|
| File Shares | |
@@ -247,7 +245,7 @@ value is reported as _“Not Applicable”_.
### Windows Server Registry Keys
-If you want to monitor changes to system components on a Windows Server, make sure that Windows
+If you want to monitor changes to system components on a Windows Server, ensure that Windows
Registry audit settings are configured on that Windows server.
This refers to the following keys:
@@ -287,7 +285,7 @@ The below is the full list of keys (and subkeys) involved in Windows Server audi
Consider that audit data for the registry keys themselves will not appear in Netwrix Auditor
-reports, alerts or search results, as it is only used as one of the sources for the Activity Records
+reports, alerts, or search results, as it is only used as one of the sources for the Activity Records
formation.
- You can configure these settings automatically using Netwrix Auditor, as described in the
@@ -309,8 +307,6 @@ will adjust the audit settings for the following subkeys:
#### Monitoring Custom Registry Keys
-Follow the steps to monitor custom registry keys.
-
**Step 1 –** On the computer where Auditor Server resides, navigate to _%Netwrix Auditor
installation folder%\Windows Server Auditing._
@@ -346,8 +342,6 @@ To ensure proper operation, the VM template must be excluded from the monitoring
Omitting the VM template will allow Netwrix Auditor to assign unique IDs correctly and collect data
as intended.
-Follow the steps to add the template server to exclusions.
-
**Step 1 –** In main Netwrix Auditor menu, select **Monitoring plans**.
**Step 2 –** Select your Windows Server monitoring plan and click **Edit**.
diff --git a/docs/auditor/10.8/configuration/windowsserver/permissions.md b/docs/auditor/10.8/configuration/windowsserver/permissions.md
index eccac05e99..c97acce91a 100644
--- a/docs/auditor/10.8/configuration/windowsserver/permissions.md
+++ b/docs/auditor/10.8/configuration/windowsserver/permissions.md
@@ -20,7 +20,7 @@ The account used for data collection must meet the following requirements on the
## Assign Permission To Read the Registry Key
-**NOTE:** This permission is required only if the account selected for data collection is not a
+**NOTE:** This permission is required only if the account selected for data collection isn't a
member of the Domain Admins group.
This permission should be assigned on each domain controller in the audited domain, so if your
@@ -32,8 +32,6 @@ console.
### Assign Permission via the Registry Editor Snap-in
-Follow the steps to assign permission via the Registry Editor snap-in:
-
**Step 1 –** On your target server, open Registry Editor: navigate to **Start > Run** and type
_"regedit"_.
@@ -48,7 +46,7 @@ Set\Services\EventLog\Security_.
### Assign Permission using the Group Policy Management Console
-Follow the steps to assign permission using the Group Policy Management console;
+To assign permission using the Group Policy Management console:
**Step 1 –** Open the Group Policy Management console on any domain controller in the target domain:
navigate to Start > Windows Administrative Tools (Windows Server 2016/2019) or Administrative Tools
diff --git a/docs/auditor/10.8/configuration/windowsserver/ports.md b/docs/auditor/10.8/configuration/windowsserver/ports.md
index 42b824d52c..c4c67fddea 100644
--- a/docs/auditor/10.8/configuration/windowsserver/ports.md
+++ b/docs/auditor/10.8/configuration/windowsserver/ports.md
@@ -63,7 +63,7 @@ left.
- Performance Logs and Alerts (Tcp-In)
If you plan to audit Windows Server 2019 or Windows 10 Update 1803 without network compression
-service, make sure the following inbound connection rules are enabled:
+service, ensure the following inbound connection rules are enabled:
- Remote Scheduled Tasks Management (RPC)
- Remote Scheduled Tasks Management (RPC-EMAP)
diff --git a/docs/auditor/10.8/configuration/windowsserver/remoteregistry.md b/docs/auditor/10.8/configuration/windowsserver/remoteregistry.md
index 18b0e50980..611104a4e7 100644
--- a/docs/auditor/10.8/configuration/windowsserver/remoteregistry.md
+++ b/docs/auditor/10.8/configuration/windowsserver/remoteregistry.md
@@ -6,8 +6,6 @@ sidebar_position: 20
# Enable Remote Registry and Windows Management Instrumentation Services
-Follow the steps to enable the Remote Registry service.
-
**Step 1 –** Navigate to Start > Windows Administrative Tools > Services.
@@ -15,7 +13,7 @@ Follow the steps to enable the Remote Registry service.
**Step 2 –** In the Services window, locate the Remote Registry service, right-click it and select
**Properties**.
-**Step 3 –** In the Remote Registry Properties dialog box, make sure the Startup type parameter is
+**Step 3 –** In the Remote Registry Properties dialog box, ensure the Startup type parameter is
set to _Automatic_ and click **Start**.
diff --git a/docs/auditor/10.8/configuration/windowsserver/removablestorage.md b/docs/auditor/10.8/configuration/windowsserver/removablestorage.md
index 15f5977f97..eb19bef373 100644
--- a/docs/auditor/10.8/configuration/windowsserver/removablestorage.md
+++ b/docs/auditor/10.8/configuration/windowsserver/removablestorage.md
@@ -17,8 +17,8 @@ To configure removable storage media monitoring on the local server
Server Audit\ETS\"_ to store event logs. To review Event Trace Session objects' configuration, see how
to modify the root directory.
- If you do not want to use the Netwrix Auditor for Windows Server Compression Service for data
- collection, make sure that this path is readable via any shared resource.
+ If you don't want to use the Netwrix Auditor for Windows Server Compression Service for data
+ collection, ensure that this path is readable via any shared resource.
After environment variable substitution, the path shall be as follows:
@@ -40,7 +40,7 @@ To configure removable storage media monitoring on the local server
where:
- `NetwrixAuditorForWindowsServer`—Fixed name the product uses to identify the Event Trace
- Session object. The name cannot be changed.
+ Session object. The name can't be changed.
- ``—Path to the Event Trace Session
template file that comes with Netwrix Auditor. The default path is _"C:\Program Files
(x86)\Netwrix Auditor\Windows Server Auditing\EventTraceSessionTemplate.xml"_.
@@ -51,8 +51,8 @@ To configure removable storage media monitoring remotely
Server Audit\ETS\"_ to write data to. To review Event Trace Session objects' configuration, see how to
modify the root directory.
- If you do not want to use the Netwrix Auditor for Windows Server Compression Service for data
- collection, make sure that this path is readable via any shared resource.
+ If you don't want to use the Netwrix Auditor for Windows Server Compression Service for data
+ collection, ensure that this path is readable via any shared resource.
After environment variable substitution, the path shall be as follows:
@@ -74,16 +74,16 @@ To configure removable storage media monitoring remotely
where:
- `NetwrixAuditorForWindowsServer`—Fixed name the product uses to identify the Event Trace
- Session object. The name cannot be changed.
+ Session object. The name can't be changed.
- ``—Path to the Event Trace Session
template file that comes with Netwrix Auditor. The default path is _"C:\Program Files
(x86)\Netwrix Auditor\Windows Server Auditing\EventTraceSessionTemplate.xml"_.
- ``—Name of the target server. Provide a server name by entering its
- FQDN, NETBIOS or IPv4 address.
+ FQDN, NETBIOS, or IPv4 address.
To review Event Trace Session objects' configuration
-An Administrator can only modify the root directory and log file name. Other configurations are not
+An Administrator can only modify the root directory and log file name. Other configurations aren't
supported by Netwrix Auditor.
1. On the target server, navigate to Start → Administrative Tools → Performance Monitor.
diff --git a/docs/auditor/10.8/configuration/windowsserver/windowsregistry.md b/docs/auditor/10.8/configuration/windowsserver/windowsregistry.md
index 02bbace08b..9985bb7e2b 100644
--- a/docs/auditor/10.8/configuration/windowsserver/windowsregistry.md
+++ b/docs/auditor/10.8/configuration/windowsserver/windowsregistry.md
@@ -7,7 +7,7 @@ sidebar_position: 30
# Configure Windows Registry Audit Settings
Windows Registry audit permissions must be configured on each Windows server you want to audit so
-that the “Who” and “When” values are reported correctly for each change. For test environment, PoC
+that the “Who” and “When” values are reported correctly for each change. For test environment, PoC,
or evaluation you can use automatic audit configuration. If you want to configure Windows Registry
manually, follow the instructions below.
@@ -69,7 +69,7 @@ and click **Add**.
**Step 5 –** Click **Select a principal link** and specify the **Everyone** group in the **Enter the
object name to select** field.
-**Step 6 –** Set **Type** to _"Success"_ and **Applies to** to _"This key and subkeys_.
+**Step 6 –** Set **Type** to _"Success"_ and **Applies to** field to _"This key and subkeys_.
**Step 7 –** Click **Show advanced permissions** and select the following access types:
@@ -83,5 +83,5 @@ object name to select** field.
Repeat the same steps for the `HKEY_LOCAL_MACHINE\SYSTEM` key.
-Using Group Policy for configuring registry audit is not recommended, as registry DACL settings may
+Using Group Policy for configuring registry audit isn't recommended, as registry DACL settings may
be lost.
diff --git a/docs/auditor/10.8/index.md b/docs/auditor/10.8/index.md
index 6aa09207fe..6f63758ebc 100644
--- a/docs/auditor/10.8/index.md
+++ b/docs/auditor/10.8/index.md
@@ -7,7 +7,7 @@ sidebar_position: 1
# Netwrix Auditor v10.8 Documentation
Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables
-control over changes, configurations and access in hybrid IT environments to protect data regardless
+control over changes, configurations, and access in hybrid IT environments to protect data regardless
of its location. The platform provides security analytics to detect anomalies in user behavior and
investigate threat patterns before a data breach occurs.
@@ -43,5 +43,5 @@ Major benefits:
To learn how Netwrix Auditor can help you achieve your specific business objectives, refer to the
[Netwrix Auditor Best Practices Guide](https://helpcenter.netwrix.com/bundle/Auditor_BestPractices_10.0/resource/NetwrixAuditor_BestPractices_10.0.pdf).
-**CAUTION:** To keep your systems safe, Auditor should not be exposed to inbound access from the
+**CAUTION:** To keep your systems safe, Auditor shouldn't be exposed to inbound access from the
internet.
diff --git a/docs/auditor/10.8/install/firstlaunch.md b/docs/auditor/10.8/install/firstlaunch.md
index 93a40bc5d6..d692e52107 100644
--- a/docs/auditor/10.8/install/firstlaunch.md
+++ b/docs/auditor/10.8/install/firstlaunch.md
@@ -22,7 +22,7 @@ To start using Netwrix Auditor
can log in with your Windows credentials by simply clicking Connect. Select Use specified
credentials if you want to log in as another user.
- Make sure you have sufficient permissions to access the product. If you cannot log into Netwrix
+ ensure you have sufficient permissions to access the product. If you can't log into Netwrix
Auditor with your Windows credentials, contact your Netwrix Auditor administrator.
After logging into Netwrix Auditor, you will see the following window:
diff --git a/docs/auditor/10.8/install/overview.md b/docs/auditor/10.8/install/overview.md
index 660e15dd71..12b94111dd 100644
--- a/docs/auditor/10.8/install/overview.md
+++ b/docs/auditor/10.8/install/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 40
# Installation
This chapter provides step-by-step instructions on how to install Netwrix Auditor and its
-Compression Services. Refer to the following sections for detailed information:
+Compression Services. See the following sections for detailed information:
- Install Netwrix Auditor
- Installing Core Services
@@ -21,17 +21,17 @@ It also includes advanced scenarios such as:
For instructions on upgrade procedures, refer to [Upgrade to the Latest Version](/docs/auditor/10.8/install/upgrade.md).
-**CAUTION:** To keep your systems safe, Netwrix Auditor should not be exposed to inbound access from
+**CAUTION:** To keep your systems safe, Netwrix Auditor shouldn't be exposed to inbound access from
the internet.
-Follow these steps to install Netwrix Auditor
-
**Step 1 –** Download Netwrix Auditor 10.8 from
[Netwrix website](https://www.netwrix.com/auditor.html).
-NOTE: Before installing Netwrix Auditor, make sure that the Windows Firewall service is started. If
+:::note
+Before installing Netwrix Auditor, ensure that the Windows Firewall service is started. If
you use a third-party firewall, see [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md). Also,
you must be a member of the local Administrators group to run the Netwrix Auditor installation.
+:::
**Step 2 –** Unpack the installation package. The following window will be displayed on successful
operation completion:
@@ -56,7 +56,7 @@ type:
Netwrix Customer Experience Program. It is optional on your part to help Netwrix improve the
quality, reliability, and performance of Netwrix products and services. If you accept, Netwrix
collects statistical information on how the Licensee uses the product in accordance with applicable
-law. Select Skip if you do not want to participate in the program.
+law. Select Skip if you don't want to participate in the program.
You can always opt-out of the Netwrix Customer Experience Program later. See the
[About Netwrix Auditor](/docs/auditor/10.8/admin/settings/about.md) topic for additional information.
@@ -81,7 +81,7 @@ To audit SharePoint farms and user activity, Netwrix Auditor provides Core Servi
installed in the audited environment to collect audit data. Both Core Services can be installed
either automatically when setting up auditing in Netwrix Auditor, or manually.
-Refer to the following sections below for manual installation instructions:
+For manual installation instructions, see the following sections:
- [Install for SharePoint Core Service](/docs/auditor/10.8/install/sharepointcoreservice.md)
- [Install for User Activity Core Service](/docs/auditor/10.8/install/useractivitycoreservice.md)
diff --git a/docs/auditor/10.8/install/sharepointcoreservice.md b/docs/auditor/10.8/install/sharepointcoreservice.md
index ab4643b301..658515f89b 100644
--- a/docs/auditor/10.8/install/sharepointcoreservice.md
+++ b/docs/auditor/10.8/install/sharepointcoreservice.md
@@ -11,8 +11,8 @@ This section contains instructions on how to install Netwrix Auditor for SharePo
During the Netwrix Auditor for SharePoint Core Service installation / uninstallation your SharePoint
sites may be unavailable.
-Prior to the Netwrix Auditor for SharePoint Core Service installation, review the following
-prerequisites and make sure that:
+Before installing Netwrix Auditor for SharePoint Core Service, review the following
+prerequisites and ensure that:
- Netwrix Auditor for SharePoint Core Service is going to be installed on the computer that hosts
SharePoint Central Administration in the audited SharePoint farm.
@@ -27,8 +27,6 @@ prerequisites and make sure that:
See [Permissions for SharePoint Auditing](/docs/auditor/10.8/configuration/sharepoint/permissions.md) topic
for more information.
-Follow the steps to install Netwrix Auditor for SharePoint Core Service manually.
-
**Step 1 –** On the computer where Auditor Server resides,navigate to _%Netwrix Auditor installation
folder%\SharePoint Auditing\_\_\SharePointPackage_ and copy SpaPackage\_``.msi to the
computer where Central Administration is installed.
diff --git a/docs/auditor/10.8/install/silentmode.md b/docs/auditor/10.8/install/silentmode.md
index 33a1e56703..0e7c36c3d1 100644
--- a/docs/auditor/10.8/install/silentmode.md
+++ b/docs/auditor/10.8/install/silentmode.md
@@ -8,8 +8,6 @@ sidebar_position: 20
Silent installation provides a convenient method for deploying Netwrix Auditor without UI.
-Follow the steps to install Auditor in a silent mode.
-
**Step 1 –** Download the product installation package.
**Step 2 –** Open the command prompt: navigate to Start > Run and type "_cmd_".
diff --git a/docs/auditor/10.8/install/uninstall.md b/docs/auditor/10.8/install/uninstall.md
index 67c4ad2144..0978cadf21 100644
--- a/docs/auditor/10.8/install/uninstall.md
+++ b/docs/auditor/10.8/install/uninstall.md
@@ -8,12 +8,10 @@ sidebar_position: 90
This topic provides instructions to uninstall Netwrix Auditor.
-**NOTE:** If you enabled network traffic compression for data collection, make sure to disable it
+**NOTE:** If you enabled network traffic compression for data collection, ensure to disable it
before uninstalling the product. Some network compression services must be removed manually. See the
Uninstall Compression and Core Services topic for additional information.
-Follow the steps to uninstall Auditor.
-
**Step 1 –** On the computer where Auditor is installed, navigate to **Start > Control Panel >
Programs and Features**.
@@ -28,12 +26,10 @@ Perform the procedures below if you used Compression Services and Core Services
(i.e., the **Network traffic compression** option was enabled).
Some Auditor Compression services are stopped but not removed when the product is uninstalled. You
-need to delete them manually prior to uninstalling Auditor.
+need to delete them manually before uninstalling Auditor.
### Delete Netwrix Auditor for Active Directory Compression Service
-Follow the steps to uninstall the service.
-
**Step 1 –** Navigate to the Active Directory monitoring plan you are using. In the command prompt,
execute the following command:
@@ -52,8 +48,6 @@ sc delete adcrsvc
### Delete Netwrix Auditor for SharePoint Core Service
-Follow the steps to delete the Netwrix Auditor for the SharePoint Core Service.
-
**Step 1 –** In the audited SharePoint farm, navigate to the computer where Central Administration
is installed and where the Netwrix Auditor for SharePoint Core Service resides.
@@ -61,15 +55,13 @@ is installed and where the Netwrix Auditor for SharePoint Core Service resides.
**Step 3 –** Select the Netwrix Auditor **for SharePoint Core Service** and click Uninstall.
-**CAUTION:** Once you click Uninstall you cannot cancel the uninstallation. The Netwrix Auditor
+**CAUTION:** When you click Uninstall you can't cancel the uninstallation. The Netwrix Auditor
**for SharePoint Core Service** will be uninstalled even if you click Cancel.
### Delete Netwrix Auditor for Windows Server Compression Service
**NOTE:** Perform this procedure only if you enabled the Compression Service for data collection.
-Follow the steps to delete the Netwrix Auditor for Windows Server Compression Service.
-
**Step 1 –** On the target servers, navigate to **Start > Control Panel > Programs and Features**.
**Step 2 –** Select **Netwrix Auditor for Windows Server** **Compression Service** and click
@@ -77,8 +69,6 @@ Follow the steps to delete the Netwrix Auditor for Windows Server Compression Se
### Delete Netwrix Auditor Mailbox Access Core Service
-Follow the steps to delete a Netwrix Auditor Mailbox Access Core Service.
-
**Step 1 –** In the command prompt, execute the following command:
```
@@ -92,9 +82,6 @@ If any argument contains spaces, use double quotes.
### Delete Netwrix Auditor User Activity Core Service
-Follow the steps to remove the Core Service via Auditor client on the computer where the Auditor
-Server resides:
-
**Step 1 –** In Auditor client, navigate to All **monitoring plans** and specify the plan.
**Step 2 –** In the right pane, select the **Items** tab.
@@ -103,11 +90,11 @@ Server resides:
Core Service** will be deleted from the selected computer. Perform this action with other computers.
**Step 4 –** In the left pane navigate to **All monitoring plans >\_\_**User Activity monitoring
-plan > Monitored Computers.\_\_ Make sure that the computers you have removed from auditing are no
+plan > Monitored Computers.\_\_ ensure that the computers you have removed from auditing are no
longer present in the list.
**Step 5 –** In case some computers are still present in the list, select them one by one and click
-**Retry Uninstallation**. If this does not help, remove the Core Services manually from the target
+**Retry Uninstallation**. If this doesn't help, remove the Core Services manually from the target
computers through **Programs and Features**.
Remove the Netwrix Auditor User Activity Core Service manually on each audited computer:
@@ -116,7 +103,7 @@ Remove the Netwrix Auditor User Activity Core Service manually on each audited c
**Step 2 –** Select the **Netwrix Auditor User Activity** **Core Service** and click **Uninstall**.
-**NOTE:** You may also use the attached PowerShell script in order to remove the User Activity Core Service from multiple systems: [Uninstall-NetwrixProduct.ps1](/files/auditor/Uninstall-NetwrixProduct.ps1)
+**NOTE:** You may also use the attached PowerShell script to remove the User Activity Core Service from multiple systems: [Uninstall-NetwrixProduct.ps1](/files/auditor/Uninstall-NetwrixProduct.ps1)
### Delete the Netwrix Auditor Application Deployment Service
@@ -126,7 +113,7 @@ service runs on the target servers.
**NOTE:** Perform this procedure only if you enabled the Network traffic compression option for
Windows File Servers data collection.
-Follow the steps to delete the Netwrix Auditor Application Deployment Service.
+To delete the Netwrix Auditor Application Deployment Service:
**Step 1 –** On the target server, navigate to **Start > Registry Editor > Programs and Features**.
@@ -143,7 +130,6 @@ designed.
**NOTE:** This is applicable for NetApp and Dell Data Storage sources. Delete the service
irrespective of the Network traffic compression option for Dell Isilon source.
-Follow the steps to delete the Netwrix Auditor for File Servers Compression Service.
**Step 1 –** On the computer where AuditorServer resides, navigate to **Start > Control Panel >
Programs and Features**.
@@ -156,8 +142,6 @@ Deployment Service and runs on the File Server directly.
### Delete the Netwrix Auditor Event Log Compression Service
-Follow the steps to delete the Netwrix Auditor Event Log Compression Service.
-
**Step 1 –** Navigate to **Start > Control Panel > Programs and Features**.
**Step 2 –** Select **Netwrix Auditor Event Log Compression** > **Service** and click **Uninstall**.
diff --git a/docs/auditor/10.8/install/upgrade.md b/docs/auditor/10.8/install/upgrade.md
index 29df3334d6..8378efc34d 100644
--- a/docs/auditor/10.8/install/upgrade.md
+++ b/docs/auditor/10.8/install/upgrade.md
@@ -50,7 +50,7 @@ operation. The issues listed below apply to upgrade from 9.96 and 10.
- After the upgrade you may receive temporary data collection errors – they occur when the program
tries to upload collected data to the Audit Database before the database upgrade is finished.
-- Microsoft Exchange Server 2010 is no longer supported. Please upgrade your Exchange Server to a
+- Microsoft Exchange Server 2010 is no longer supported. upgrade your Exchange Server to a
new version.
- For Netwrix Auditor for SharePoint Online, the following data will be available within 24 hours
after upgrade:
@@ -62,7 +62,7 @@ operation. The issues listed below apply to upgrade from 9.96 and 10.
- For auditing cloud-based applications (Microsoft Entra ID, Exchange Online, SharePoint Online, and
MS Teams) with Netwrix Auditor using basic authentication: before an upgrade from version 10.0 and
- earlier, make sure that the account under which the upgrade will be performed has sufficient
+ earlier, ensure that the account under which the upgrade will be performed has sufficient
rights and permissions to perform initial data collection and upgrade. Review the following for
more information about required rights and permissions:
@@ -82,7 +82,7 @@ operation. The issues listed below apply to upgrade from 9.96 and 10.
- [Permissions for Teams Auditing](/docs/auditor/10.8/configuration/microsoft365/teams/permissions/permissions.md)
- Netwrix Auditor for Oracle Database. If you use the following combination of the audit settings:
- Mixed Mode + Fine Grained Auditing, please check your configuration. You may need to re-configure
+ Mixed Mode + Fine Grained Auditing, check your configuration. You may need to re-configure
your audit since the Oracle Database data collection mechanism was changed. See the
[Supported Data Sources](/docs/auditor/10.8/requirements/supporteddatasources/supporteddatasources.md) and
[Verify Your Oracle Database Audit Settings](/docs/auditor/10.8/configuration/oracle/verifysettings.md) topics for
@@ -119,12 +119,10 @@ topic for information on how to register for a Customer Portal account.
Partners and MSPs who are logged into the Netwrix Partner Portal can download the latest version of
their software products from the My Product page:
[https://www.netwrix.com/par/site/products](https://www.netwrix.com/my_products.html). To receive an
-invitation to the Partner Portal, please contact
+invitation to the Partner Portal, contact
[netwrix.msp@netwrix.com](http://netwrix.msp@netwrix.com/).
-Follow the steps to perform the upgrade.
-
-**Step 1 –** Make sure you have completed the preparatory steps above.
+**Step 1 –** Ensure you have completed the preparatory steps above.
**Step 2 –** Run the setup on the computer where the Auditor Server resides. See the
[Installation](/docs/auditor/10.8/install/overview.md) topic for additional information.
diff --git a/docs/auditor/10.8/install/useractivitycoreservice.md b/docs/auditor/10.8/install/useractivitycoreservice.md
index 7bcfb0a400..fcb88bbcd4 100644
--- a/docs/auditor/10.8/install/useractivitycoreservice.md
+++ b/docs/auditor/10.8/install/useractivitycoreservice.md
@@ -10,8 +10,6 @@ By default, the Core Service is installed automatically on the audited computers
auditing in Netwrix Auditor. If, for some reason, installation has failed, you must install the Core
Service manually on each audited computer.
-Follow the steps to install Netwrix Auditor User Activity Core Service.
-
**Step 1 –** On the computer where Auditor Server resides, navigate to _%ProgramFiles% (x86)\Netwrix
Auditor\User Activity Video Recording_ and copy the UACoreSvcSetup.msi file to the audited computer.
@@ -25,12 +23,9 @@ computer where Netwrix Auditor is installed) and the server TCP port.
## Install User Activity Core Service with the Command Prompt
-Follow the steps to perform a silent installation of the User Activity Core Service with the command
-prompt.
-
-**Step 1 –** On the computer where Auditor Server resides,, navigate to _%ProgramFiles%
+**Step 1 –** On the computer where Auditor Server resides, navigate to _%ProgramFiles%
(x86)\Netwrix Auditor\User Activity Video Recording_ and copy the **UACoreSvcSetup.msi** file to the
-audited computer or to a file share the target server(s) can access.
+audited computer or to a file share the target servers can access.
**Step 2 –** Run the following commands on target servers:
diff --git a/docs/auditor/10.8/install/viagrouppolicy.md b/docs/auditor/10.8/install/viagrouppolicy.md
index 57f2f3e7fc..f1cf828477 100644
--- a/docs/auditor/10.8/install/viagrouppolicy.md
+++ b/docs/auditor/10.8/install/viagrouppolicy.md
@@ -10,7 +10,7 @@ The Netwrix Auditor client can be deployed on multiple computers via Group Polic
helpful if you want to grant access to configuration and audit data to a significant number of
employees and, therefore, have to run Netwrix Auditor installation on multiple computers.
-If installing via Group Policy, make sure to deploy Netwrix Auditor client and Netwrix Auditor
+If installing via Group Policy, ensure to deploy Netwrix Auditor client and Netwrix Auditor
server on different machines. If both components are installed on the same machine, you may
experience issues with future upgrades.
@@ -32,7 +32,7 @@ To run the Netwrix Auditor installation, you must be a member of the local Admin
1. Create a shared folder that will be used for distributing the installation package.
- Make sure that the folder is accessible from computers where the Netwrix Auditor clients are
+ ensure that the folder is accessible from computers where the Netwrix Auditor clients are
going to be deployed. You must grant the Read permissions on this folder to these computer
accounts.
@@ -43,7 +43,6 @@ To run the Netwrix Auditor installation, you must be a member of the local Admin
It is recommended to create a dedicated organizational unit using Active Directory Users and
Computers and add computers where you want to deploy the Netwrix Auditor client.
-Follow the steps to create a Group Policy
**Step 1 –** Open the **Group Policy Management** console on any domain controller in the target
domain: navigate to Start > Windows Administrative Tools (Windows Server 2016 and higher) or
diff --git a/docs/auditor/10.8/install/virtualappliance/configure.md b/docs/auditor/10.8/install/virtualappliance/configure.md
index 53deccdaf5..30e33f6159 100644
--- a/docs/auditor/10.8/install/virtualappliance/configure.md
+++ b/docs/auditor/10.8/install/virtualappliance/configure.md
@@ -26,7 +26,7 @@ the license agreement and then press `Y` to accept it.
| Rename virtual machine | Specify a new name for the virtual machine (e.g., _`NA-Server`_). The computer name must be properly formatted. It may contain letters (a-z, A-Z), numbers (0-9), and hyphens (-), but no spaces and periods (.). The name may not consist entirely of digits and may not be longer than 15 characters. |
| Add additional input languages | Select `Y` if you want to specify additional input languages. Select `N` to proceed with English. |
| Configure network | - Select `Y` to use DHCP server to configure network settings automatically. - Select `N` to configure required parameters manually. In this case, you will be prompted to set up IP settings manually. |
-| Join computer to the domain or workgroup | **To join a domain** Select `Y`. Specify the fully qualified domain name to join (e.g., `corp.local`). Then specify domain administrator name and password. For your convenience, the account specified will be added to the local Administrators group and set as account for collecting data from the target systems. Domain Users group will be removed from the local Users group after the machine with the appliance joins the domain. The script is starting to test your domain controller: by NETBIOS name first, then by DNS name and finally, using an IP address. If at least one of the tests is successful, the computer will be added to a domain. In case of failure, you will be prompted to do one of the following: - Re-try to joint to the selected domain. In this case, the script uses the DNS name of your domain controller. The name must be resolved. - Continue with Workgroup. See the procedure below on how to join the computer to a workgroup. - Cancel and **Return to Main Menu**. Select if you want to cancel the domain join and re-configure the machine. Press Enter and repeat menu section. You will return to step 5. **To join a workgroup** Select `N`. Specify the local administrator name and credentials. For your convenience, the account specified will be set as account for collecting data from the target systems. Netwrix Auditor is unable to work in a workgroup. Please confirm if you want to proceed. Otherwise, you will not be able to run reviews on data collected by Auditor. See the [Access Reviews](/docs/auditor/10.8/accessreviews/accessreviews.md) topic for additional information about integration with Access Reviews. |
+| Join computer to the domain or workgroup | **To join a domain** Select `Y`. Specify the fully qualified domain name to join (e.g., `corp.local`). Then specify domain administrator name and password. For your convenience, the account specified will be added to the local Administrators group and set as account for collecting data from the target systems. Domain Users group will be removed from the local Users group after the machine with the appliance joins the domain. The script is starting to test your domain controller: by NETBIOS name first, then by DNS name and finally, using an IP address. If at least one of the tests is successful, the computer will be added to a domain. In case of failure, you will be prompted to do one of the following: - Re-try to joint to the selected domain. In this case, the script uses the DNS name of your domain controller. The name must be resolved. - Continue with Workgroup. See the procedure below on how to join the computer to a workgroup. - Cancel and **Return to Main Menu**. Select if you want to cancel the domain join and re-configure the machine. Press Enter and repeat menu section. You will return to step 5. **To join a workgroup** Select `N`. Specify the local administrator name and credentials. For your convenience, the account specified will be set as account for collecting data from the target systems. Netwrix Auditor is unable to work in a workgroup. confirm if you want to proceed. Otherwise, you will not be able to run reviews on data collected by Auditor. See the [Access Reviews](/docs/auditor/10.8/accessreviews/accessreviews.md) topic for additional information about integration with Access Reviews. |
| Configure SQL Server | The shell script automatically configures SQL Server instance. The sysadmin server role on SQL Server instance is granted automatically to the BUILTIN\Administrators group. |
In the example below, review how the shell script configures the new VM:
@@ -43,7 +43,7 @@ workgroup).
For the first time, Auditor Client starts automatically. Later, you can always run it from the Start
menu or launch it by double-clicking the Auditor shortcut on the desktop.
-Do not close the Virtual Appliance Configuration window until the product configuration completes.
+Don't close the Virtual Appliance Configuration window until the product configuration completes.
## What Is Next
@@ -56,5 +56,5 @@ Now you can evaluate Auditor functionality. Review the table below for more info
| - Browse data with interactive search - Review diagrams - Generate reports - Configure report subscriptions - Create alerts | Auditor Client | - [Reports](/docs/auditor/10.8/admin/reports/overview.md) - [Subscriptions](/docs/auditor/10.8/admin/subscriptions/overview.md) - [Alerts](/docs/auditor/10.8/admin/alertsettings/overview.md) |
| See the data collected by Auditor | Auditor Client | - [Access Reviews](/docs/auditor/10.8/accessreviews/accessreviews.md) |
-**NOTE:** If any errors occur, please contact
+**NOTE:** If any errors occur, contact
[Netwrix technical support](https://www.netwrix.com/support.html).
diff --git a/docs/auditor/10.8/install/virtualappliance/importvmware.md b/docs/auditor/10.8/install/virtualappliance/importvmware.md
index 6ddfea60ae..f6ba0a4672 100644
--- a/docs/auditor/10.8/install/virtualappliance/importvmware.md
+++ b/docs/auditor/10.8/install/virtualappliance/importvmware.md
@@ -43,4 +43,4 @@ in this VMware article:
**Step 6 –** On the Select a template step, select NetwrixAuditor from your ContentLibrary.
-**Step 7 –** Proceed with the wizard: select name and folder, resources and storage for the VM.
+**Step 7 –** Proceed with the wizard: select name and folder, resources, and storage for the VM.
diff --git a/docs/auditor/10.8/install/virtualappliance/overview.md b/docs/auditor/10.8/install/virtualappliance/overview.md
index a0021662ac..d5e06fec89 100644
--- a/docs/auditor/10.8/install/virtualappliance/overview.md
+++ b/docs/auditor/10.8/install/virtualappliance/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 70
# Virtual Deployment Overview
In addition to on-premises deployment, Netwrix Auditor offers the deployment option that can speed
-time-to-value by getting you up and running in less than 15 minutes.
+time-to-value by getting you operational in less than 15 minutes.
Virtual appliance — If you run a Microsoft Hyper-V or VMware vSphere, you can deploy Auditor as a
virtual appliance. Virtual appliance is a VM image file with installed Netwrix Auditor. The image is
@@ -62,7 +62,7 @@ The virtual appliance also contains Access Information Center for Auditor versio
[Microsoft Licensing Activation Centers worldwide telephone numbers](https://www.microsoft.com/en-us/licensing/existing-customer/activation-centers)
for additional information.
-- Microsoft SQL Server Express Edition is only recommended for evaluation, PoC or small deployments.
+- Microsoft SQL Server Express Edition is only recommended for evaluation, PoC, or small deployments.
For production deployment planning in bigger environments, refer to requirements and
recommendations listed in the
[Requirements for SQL Server to Store Audit Data](/docs/auditor/10.8/requirements/sqlserver.md) section.
diff --git a/docs/auditor/10.8/overview/gettingstarted.md b/docs/auditor/10.8/overview/gettingstarted.md
index f4880741d4..1576026c57 100644
--- a/docs/auditor/10.8/overview/gettingstarted.md
+++ b/docs/auditor/10.8/overview/gettingstarted.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Getting Started
-In this section, we will cover:
+This section covers:
- Pre-installation procedures
- Installation
@@ -21,7 +21,7 @@ In this section, we will cover:
| -------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
| Pre-installation procedures | |
| Review recommendations and considerations for Netwrix Auditor deployment planning. | - [Requirements](/docs/auditor/10.8/requirements/overview.md) |
-| Make sure the data source you are going to audit is supported. | - [Supported Data Sources](/docs/auditor/10.8/requirements/supporteddatasources/supporteddatasources.md) |
+| Ensure the data source you are going to audit is supported. | - [Supported Data Sources](/docs/auditor/10.8/requirements/supporteddatasources/supporteddatasources.md) |
| Open the required ports for connections. | - [Protocols and Ports Required](/docs/auditor/10.8/requirements/ports.md) |
| Review system requirements. | - [Requirements](/docs/auditor/10.8/requirements/overview.md) |
| Installation | |
@@ -30,7 +30,7 @@ In this section, we will cover:
| IT infrastructure configuration | |
| Configure target IT infrastructure depending on your data source. | - [Supported Data Sources](/docs/auditor/10.8/requirements/supporteddatasources/supporteddatasources.md) |
| Configure Auditor service accounts. | - [Software Requirements](/docs/auditor/10.8/requirements/software.md) |
-| If you are going to use Group Managed Service Account (gMSA) for data collection and storage, refer to the following article for more information. | - [Use Group Managed Service Account (gMSA)](/docs/auditor/10.8/requirements/gmsa.md) |
+| If you are going to use Group Managed Service Account (gMSA) for data collection and storage, see the following article for more information. | - [Use Group Managed Service Account (gMSA)](/docs/auditor/10.8/requirements/gmsa.md) |
| Product configuration | |
| Configure role-based access and delegation. | - [Role-Based Access and Delegation](/docs/auditor/10.8/admin/monitoringplans/delegation.md) |
| Configure general product settings. | - [Netwrix Auditor Settings](/docs/auditor/10.8/admin/settings/overview.md) |
diff --git a/docs/auditor/10.8/overview/producteditions.md b/docs/auditor/10.8/overview/producteditions.md
index deb86319fa..0f5cf4e4d6 100644
--- a/docs/auditor/10.8/overview/producteditions.md
+++ b/docs/auditor/10.8/overview/producteditions.md
@@ -18,7 +18,7 @@ Enterprise Advanced version. Alternatively, you can switch to Free Community Edi
Free Community Edition helps you maintain visibility into your environment by delivering daily
reports that summarize changes that took place in the last 24 hours. However, you will no longer be
-able to use interactive search, predefined reports, alerts and dashboards, or store your security
+able to use interactive search, predefined reports, alerts, and dashboards, or store your security
intelligence. After switching to free mode, you may need to re-arrange your audit configuration due
to the limitations.
@@ -63,7 +63,7 @@ Refer to a table below to compare product editions.
| Activity Summary | 1 recipient | Multiple recipients |
| AuditArchive | – | Both Long-Term Archive and Audit Database |
| Search | – | + |
-| Reports (including organization–level reports, overview diagrams, change and activity reports, reports with video and review status) and special report packs | – | + |
+| Reports (including organization–level reports, overview diagrams, change, and activity reports, reports with video and review status) and special report packs | – | + |
| State–in–time reports | – | + |
| Ability to save search as a custom report | – | + |
| Subscriptions | – | + |
diff --git a/docs/auditor/10.8/overview/whatsnew.md b/docs/auditor/10.8/overview/whatsnew.md
index 2469c90a4b..7f05735f7b 100644
--- a/docs/auditor/10.8/overview/whatsnew.md
+++ b/docs/auditor/10.8/overview/whatsnew.md
@@ -10,7 +10,7 @@ sidebar_position: 30
All Netwrix product announcements have moved to the new Netwrix Community. See announcements for
Netwrix Auditor in the [Auditor](https://community.netwrix.com/c/auditor/announcements/90) area of
-our new community.
+the Netwrix Community.
The following information highlights the new and enhanced features introduced in this Netwrix
Auditor 10.7 version.
@@ -19,7 +19,7 @@ Auditor 10.7 version.
Integration with Netwrix Privilege Secure
-Netwrix Auditor is able to store its collection credentials in Netwrix Privilege Secure, making the
+Netwrix Auditor can store its collection credentials in Netwrix Privilege Secure, making the
usage of Auditor more secure.
Data sensitivity tags in searches and alerts for NetApp, Qumulo, and Synology
@@ -27,7 +27,7 @@ Data sensitivity tags in searches and alerts for NetApp, Qumulo, and Synology
Data sensitivity tags in searches and alerts enable customers using NetApp, Qumulo, and Synology
systems to reduce the time to detect incidents involving sensitive data and accelerate the response
to these kinds of threats. They can set up alerts that will be triggered whenever sensitive
-documents are accessed, modified or deleted, or filter out all activity that isn’t related to
+documents are accessed, modified, or deleted, or filter out all activity that isn’t related to
sensitive data.
New sensitive data-related risks for SharePoint Online
diff --git a/docs/auditor/10.8/requirements/console.md b/docs/auditor/10.8/requirements/console.md
index daebf6e660..6358a4a461 100644
--- a/docs/auditor/10.8/requirements/console.md
+++ b/docs/auditor/10.8/requirements/console.md
@@ -12,7 +12,7 @@ the resources required for Netwrix Auditor deployment.
The actual hardware requirements will depend on the number of activities collected per day in
addition to the number of files and folders monitored.
-**CAUTION:** To keep your systems safe, Auditor should not be exposed to inbound access from the
+**CAUTION:** To keep your systems safe, Auditor shouldn't be exposed to inbound access from the
internet.
## Full Installation
@@ -39,7 +39,7 @@ Netwrix Auditor and SQL Server instance will be deployed on different servers.
Requirements below apply to Netwrix Auditor server.
-| Hardware component | Evaluation, PoC or starter environment | Regular environment (up to 1m ARs\*/day) | Large environment (1-10m ARs\*/day) | XLarge environment (10m ARs\*/day or more) |
+| Hardware component | Evaluation, PoC, or starter environment | Regular environment (up to 1m ARs\*/day) | Large environment (1-10m ARs\*/day) | XLarge environment (10m ARs\*/day or more) |
| ------------------ | -------------------------------------- | ---------------------------------------- | ----------------------------------------- | ---------------------------------------------------------------- |
| CPUs | 2 cores | 4 CPUs | 8 CPUs | 16 CPUs |
| RAM | 8 GB | min 8 GB | min 16 GB | 64 GB |
@@ -58,7 +58,7 @@ details, see:
- [Working Folder](/docs/auditor/10.8/requirements/workingfolder.md)
Netwrix Auditor informs you if you are running out of space on a system disk where the Long-Term
-Archive is stored by default. You will see related events in the Health log once the free disk space
+Archive is stored by default. You will see related events in the Health log when the free disk space
starts approaching the minimum level. When the free disk space is less than 3 GB, the Netwrix
services responsible for audit data collection will be stopped.
@@ -97,7 +97,7 @@ by clicking
## Client Installation
-The client installation includes only Netwrix Auditor client console that enables you to connect to
+The client installation includes only Netwrix Auditor client console for connecting to
the Netwrix Auditor Server installed remotely.
Virtual deployment is recommended.
diff --git a/docs/auditor/10.8/requirements/deploymentscenarios.md b/docs/auditor/10.8/requirements/deploymentscenarios.md
index e1f3e9e3f3..e5653143e6 100644
--- a/docs/auditor/10.8/requirements/deploymentscenarios.md
+++ b/docs/auditor/10.8/requirements/deploymentscenarios.md
@@ -21,17 +21,16 @@ dedicated servers:
- Netwrix Data Classification server
- SQL server with 2 instances: for Netwrix Auditor databases and for NDC SQL Database
-Also, ensure these servers have enough RAM to prevent from performance loss - minimum 12 GB
+Also, ensure these servers have enough RAM to prevent performance loss—minimum 12 GB
required, 16+ GB recommended.
-To learn more, see the How It Works and Deployment Planning topics in the Netwrix Data
-Classification Knowledge center:
-[Netwrix Data Classification Documentation](https://helpcenter.netwrix.com/category/dataclassification)..
+For information on How It Works and Deployment Planning topics, see the
+[Netwrix Data Classification Documentation](https://helpcenter.netwrix.com/category/dataclassification).
When planning for hardware resources, consider that insufficient CPU and RAM may lead to performance
-bottlenecks. Thus, try to provide not minimal but recommended configuration. Same recommendations
-refer to planning for storage capacity, especially if you plan to keep historical data for longer
-periods (e.g., to provide for investigations, compliance audit, etc.) - SSD
+bottlenecks. Provide the recommended configuration, not the minimal one. The same applies to storage capacity,
+especially if you plan to keep historical data for longer periods (for example, to support investigations
+or compliance audits)—use SSD storage.
## Small Environment
@@ -61,10 +60,10 @@ Hyper-V virtualization server. For more information on this deployment option, r
- If you are implementing a PoC project, it is strongly recommended that after its completion you
create a new Netwrix Auditor server VM dedicated for use in production. Migrating the VM that
- hosted Netwrix Auditor server during the PoC into production environment is not recommended, as it
+ hosted Netwrix Auditor server during the PoC into production environment isn't recommended, as it
may lead to performance problems.
- Consider using a dedicated SQL Server for the PoC project. Production database servers are often
- configured with the features that are not necessary for Netwrix Auditor (like cluster support,
+ configured with the features that aren't necessary for Netwrix Auditor (like cluster support,
frequent backup, and so on). If you have no opportunity to use a dedicated SQL Server, then create
an dedicated instance for Netwrix Auditor databases on your existing server.
@@ -129,7 +128,7 @@ approximately 1+ million of activity records generated per day):
| Software Component | Requirement |
|---------------------------------------|---------------------------------------------------------------------------------------------|
-| Microsoft SQL Server 2012 or later | Standard or Enterprise edition (Express cannot be used due to its database size limitation) |
+| Microsoft SQL Server 2012 or later | Standard or Enterprise edition (Express can't be used due to its database size limitation) |
| Dedicated SQL Server instance or cluster is recommended | |
| SQL Server Reporting Services for reporting | |
@@ -168,7 +167,7 @@ more than 20 000 users (10+ million of activity records generated per day):
| Software Component | Requirement |
|-----------------------------------------|------------------------------------------------------------------------------------------------------|
-| Microsoft SQL Server 2012 or later | Standard or Enterprise edition (Express cannot be used due to its database size limitation) |
+| Microsoft SQL Server 2012 or later | Standard or Enterprise edition (Express can't be used due to its database size limitation) |
| Dedicated SQL Server instance or cluster| Recommended |
| SQL Server Reporting Services | For reporting |
diff --git a/docs/auditor/10.8/requirements/gmsa.md b/docs/auditor/10.8/requirements/gmsa.md
index 53d04a9a4e..6be53111a5 100644
--- a/docs/auditor/10.8/requirements/gmsa.md
+++ b/docs/auditor/10.8/requirements/gmsa.md
@@ -7,23 +7,23 @@ sidebar_position: 100
# Use Group Managed Service Account (gMSA)
Auditor supports using Group Managed Service Accounts (gMSA) for data collection and storage. This
-can help you to simplify product administration, providing the following benefits:
+simplifies product administration, providing the following benefits:
- There is no password to manage for this account: Windows handles the password management for it.
- User interaction for password update on a regular basis is not required.
+ User interaction for password update on a regular basis isn't required.
- Using the gMSA also eliminates a need in service accounts with static passwords that are set upon
creation and then never cycled.
- The gMSA also helps to ensure that service account is only used to run a service (gMSA accounts
- cannot be used to log on interactively to domain computers).
+ can't be used to log on interactively to domain computers).
- The gMSA is allowed to audit trusted domains using configured and validated gMSA from the target
domain.
-Currently, gMSA is supported:
+gMSA is supported:
- As a data collecting account for the following data sources:
- Active Directory (including Group Policy and Logon Activity)
- - File Server (currently for Windows File Servers)
+ - File Server (for Windows File Servers)
- SQL Server
- SharePoint
- User Activity (including User Activity Video Recording)
@@ -41,21 +41,20 @@ Currently, gMSA is supported:
- As an account for accessing Audit Databases. See
[Requirements for SQL Server to Store Audit Data](/docs/auditor/10.8/requirements/sqlserver.md) topic for additional information.
- **NOTE:** If you use a Group Managed Service Account (gMSA) to access the SQL Server instance that hosts the Netwrix Auditor database, SSRS-based reports cannot be generated.
- This limitation occurs because SQL Server Reporting Services does not support using gMSA for the Unattended Execution Account.
+ **NOTE:** If you use a Group Managed Service Account (gMSA) to access the SQL Server instance that hosts the Netwrix Auditor database, SSRS-based reports can't be generated.
+ This limitation occurs because SQL Server Reporting Services doesn't support using gMSA for the Unattended Execution Account.
For more details, see the Microsoft documentation:
[Configure the Unattended Execution Account (Report Server Configuration Manager)](https://docs.microsoft.com/en-us/sql/reporting-services/install-windows/configure-the-unattended-execution-account-ssrs-configuration-manager?view=sql-server-ver15)
**_RECOMMENDED:_** Prepare a dedicated gMSA for these purposes.
-The gMSA would work only within one domain, the parent domain and NA also should be joined within
-the same domain. The reason is that gMSAs are designed to be scoped within a single Active Directory
-domain or subdomain.
+gMSA accounts work only within a single domain. The Auditor Server and any audited domain must be in the
+same domain, because gMSAs are scoped to a single Active Directory domain or subdomain.
See the following Microsoft article for more information:
[Get started with Group Managed Service Accounts](https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts/getting-started-with-group-managed-service-accounts)
-By default, the gMSA account is not a member of any domain groups. After creating gMSA account, you
+By default, the gMSA account isn't a member of any domain groups. After creating gMSA account, you
need to add this account to one of the domain groups as required for the data source you are going
to audit.
@@ -65,22 +64,17 @@ To generate password for gMSA accounts, domain controllers require a Key Distrib
root key. This key is created once, so if there are any gMSA accounts in your domain, this means the
root key already exists.
-Follow the steps to check whether the root key exists in your domain.
-
**Step 1 –** Open the **Active Directory Sites and Services** Console and select **View** > **Show
Services Node**.
**Step 2 –** Browse to **Services** > **Group Key Distribution Services** > **Master Root Keys**.
-**Step 3 –** Alternatively, you can run the `Get-KdsRootKey` cmdlet. If the key does not exist, it
+**Step 3 –** Alternatively, you can run the `Get-KdsRootKey` cmdlet. If the key doesn't exist, it
will not return any output.
## Create a KDS Root Key
-If the KDS root key does not exist, then you can create a KDS root key as described below, or
-contact your Active Directory administrator.
-
-Follow the steps to create a KDS key (on a domain controller running Windows Server 2012 or later).
+If the KDS root key doesn't exist, you can create it on a domain controller running Windows Server 2012 or later, or contact your Active Directory administrator.
**Step 1 –** On the domain controller, run **Windows PowerShell**.
@@ -104,9 +98,7 @@ Microsoft article for additional information.
This cmdlet generates a KDS root key that will take effect on the specified date. Use the
_mm/dd/yyyy_ format, for example: `Add-KdsRootKey -EffectiveTime 02/27/21`
-**CAUTION:** This approach, however, should be used with care. Waiting up to 10 hours is a safety
-measure to prevent password generation from occurring before all DCs in the environment are capable
-of answering gMSA requests. For more information, refer to the following microsoft article:
+**CAUTION:** This approach requires care. Waiting 10 hours is a safety measure to prevent password generation before all domain controllers can answer gMSA requests. For more details, see the Microsoft article:
[Create the Key Distribution Services KDS Root Key](https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/create-the-key-distribution-services-kds-root-key).
To make the KDS Root Key work immediately you can use the following powershell command:
@@ -123,7 +115,7 @@ wait 10 hours for replication.
To create a new gMSA, you will need to specify:
- New account name and FQDN
-- Computer account(s) that will be allowed to make use of that gMSA. Here it will be your Auditor
+- Computer accounts that will be allowed to make use of that gMSA. Here it will be your Auditor
Server
- The account must be a member of the **Administrators** group on the Auditor Server.
@@ -132,7 +124,7 @@ For example, you can create a gMSA using the `New-ADServiceAccount` PowerShell c
should specify your Auditor Server account in the `-PrincipalsAllowedToRetrieveManagedPassword`
attribute.
-Make sure you specify a valid computer object in this attribute.
+Ensure you specify a valid computer object in this attribute.
If you have multiple Auditor servers, you can specify the computer accounts using a comma separated
list, or specify a security group and add the required computer accounts to that security group.
@@ -145,7 +137,7 @@ To create a new gMSA in the root domain using PowerShell:
here:
- - _name_ — new gMSA name, here **nagmsa**. Make sure the name refers to a valid computer
+ - _name_ — new gMSA name, here **nagmsa**. Ensure the name refers to a valid computer
objects.
- _DNSHostName_ — FQDN of the new gMSA account, here **nagmsa.mydomain.local**
- _PrincipalsAllowedToRetrieveManagedPassword_ — your Netwrix Auditor Server NETBIOS name ended
@@ -190,10 +182,10 @@ account, depending on what purpose a gMSA account will be used for.
- [Requirements for SQL Server to Store Audit Data](/docs/auditor/10.8/requirements/sqlserver.md)
- _Remember,_ that a gMSA account cannot access SSRS due to Microsoft restrictions.
+ _Remember,_ that a gMSA account can't access SSRS due to Microsoft restrictions.
- If you are going to use a gMSA as a data collection account for User Activity or User Activity
- Video Recording, refer to the following topics:
+ Video Recording, see these topics:
- [User Activity](/docs/auditor/10.8/configuration/useractivity/overview.md)
- [Configure Video Recordings Playback Settings](/docs/auditor/10.8/configuration/useractivity/videorecordings.md)
@@ -214,8 +206,6 @@ To process the corresponding monitored items using gMSA, you can specify this ac
monitored plan properties. See the
[Create a New Monitoring Plan](/docs/auditor/10.8/admin/monitoringplans/create.md) topic for additional information.
-Follow the steps to set a custom account in the monitored item properties.
-
**Step 1 –** Open the monitored item properties for editing.
**Step 2 –** On the **General** tab, under **Specify account for collecting data**, select **gMSA**
diff --git a/docs/auditor/10.8/requirements/longtermarchive.md b/docs/auditor/10.8/requirements/longtermarchive.md
index 92c0319a5c..57aa5e32e7 100644
--- a/docs/auditor/10.8/requirements/longtermarchive.md
+++ b/docs/auditor/10.8/requirements/longtermarchive.md
@@ -19,10 +19,7 @@ To reduce the impact on the system drive in large and extra-large environments,
move Long-Term Archive to another disk. For that, you should estimate the required capacity using
recommendations in the next section.
-Then you should prepare the new folder for repository, target Netwrix Auditor at that folder, and,
-if necessary, move repository data from the old to the new location.
-
-Follow the steps to modify Long-Term Archive location and other settings.
+Then prepare the new folder for the repository, target Auditor at that folder, and move repository data from the old to the new location if necessary.
**Step 1 –** In Auditor client, click Settings > Long-Term Archive; alternatively, if you are
viewing the Long-Term Archive widget of the Health Status dashboard, click Open settings.
@@ -111,10 +108,7 @@ The custom account must be granted the following rights and permissions:
### Assign Permissions on the Long-Term Archive Folder
-The procedure below applies to Windows Server 2012 R2 and above and may vary slightly depending on
-your OS.
-
-Follow the steps to assign permissions on the Long-Term Archive folder:
+The procedure below applies to Windows Server 2012 R2 and later and may vary depending on your OS.
**Step 1 –** Navigate to a folder where the Long-Term Archive will be stored, right-click it and
select Properties.
@@ -128,7 +122,7 @@ select Properties.
- Specify an account as principal.
- Set Type to _"Allow"_.
-- Set Applies to to _"This folder, subfolders and files"_.
+- Set **Applies to** field to _"This folder, subfolders, and files"_.
- Switch to the Advanced permissions section.
- Check the following permissions:
- List folder / read data
@@ -143,11 +137,7 @@ select Properties.
### Assign Change and Create Files/Write Data Permissions to Upload Subscriptions to File Shares
-The procedure below applies to Windows Server 2012 R2 and above and may vary slightly depending on
-your OS.
-
-Follow the steps to assign the **Change** and **Create Files/Write Data** permissions to upload
-subscriptions to file shares:
+The procedure below applies to Windows Server 2012 R2 and later and may vary depending on your OS.
**Step 1 –** Navigate to a folder where report subscriptions will be stored, right-click it and
select Properties.
@@ -172,11 +162,11 @@ check the Allow flag next to Change.
- Specify a Netwrix Auditor user as principal.
- Set Type to _"Allow"_.
-- Set Applies to to _"This folder, subfolders and files"_.
+- Set **Applies to** field to _"This folder, subfolders, and files"_.
- Check Create files / write data in the Advanced permissions section.
-The users who are going to access report subscriptions must be granted read access to these shares.
-Netwrix recommends you to create a dedicated folder and grant access to the entire Netwrix Auditor
+The users who are going to access report subscriptions must have read access to these shares.
+Netwrix recommends creating a dedicated folder and granting access to the entire Netwrix Auditor
Client Users group or any other group assigned the Global reviewer role in Auditor.
## System Health
diff --git a/docs/auditor/10.8/requirements/overview.md b/docs/auditor/10.8/requirements/overview.md
index e6faacb5a8..43c784901e 100644
--- a/docs/auditor/10.8/requirements/overview.md
+++ b/docs/auditor/10.8/requirements/overview.md
@@ -15,32 +15,29 @@ following topics for additional information:
## Architecture Overview
-Netwrix Auditor provides comprehensive auditing of applications, platforms and storage systems. The
-product architecture and components interactions are shown in the figure below.
+Netwrix Auditor provides comprehensive auditing of applications, platforms, and storage systems. The
+product architecture and component interactions are shown below.
-- Netwrix Auditor Server — the central component that handles the collection, transfer and
- processing of audit data from the various data sources (audited systems). Data from the sources
- not yet supported out of the box is collected using RESTful Integration API.
-- Netwrix Auditor Client — a component that provides a friendly interface to authorized personnel
- who can use this console UI to manage product settings, examine alerts, reports and search
- results. Other users can obtain audit data by email or with 3rd party tools — for example, reports
- can be provided to the management team via the intranet portal. The Client may be installed on
- other hosts using the same installer as the server.
+- Netwrix Auditor Server — the central component that handles the collection, transfer, and
+ processing of audit data from various data sources (audited systems). Data from sources without built-in
+ support is collected using the RESTful Integration API.
+- Netwrix Auditor Client — a component that provides an interface for authorized personnel to
+ manage product settings, examine alerts, reports, and search results using the console UI. Other users can obtain audit data via email or third-party tools—for example, reports can be provided to
+ the management team through an intranet portal. The Client can be installed on other hosts using the
+ same installer as the server.
- Data sources — entities that represent the types of audited systems supported by Netwrix Auditor
(for example, Active Directory, Exchange Online, NetApp storage system, and so on), or the areas
you are interested in (Group Policy, User Activity, and others).
- Long-Term Archive — a file-based storage repository that keeps the audit data collected from all your
data sources or imported using Integration API in a compressed format for a long period of time.
Default retention period is **120 months**.
-- Audit databases — these are Microsoft SQL Server databases used as operational storage. This type
- of data storage allows you to browse recent data, run search queries, generate reports and
- alerts.
- Typically, data collected from the certain data source (for example, Exchange Server) is stored to
- the dedicated Audit database and the long-term archive. So, you can configure as many databases as
- the data sources you want to process. Default retention period for data stored in the Audit
- database is **180 days**.
+- Audit databases — these are Microsoft SQL Server databases that serve as operational storage where you
+ can browse recent data, run search queries, generate reports, and create alerts. Typically, data from a
+ particular data source (for example, Exchange Server) is stored in a dedicated Audit database and the
+ long-term archive. You can configure as many databases as needed, one for each data source. The default
+ retention period for data in the Audit database is **180 days**.
**NOTE:** When auditing Active Directory domains, Exchange servers, expired passwords, and inactive
users, the data sent by the product can be encrypted using [Signing and Sealing](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/enable-ldap-signing-in-windows-server). See the following
diff --git a/docs/auditor/10.8/requirements/software.md b/docs/auditor/10.8/requirements/software.md
index 0ccb4cf025..4648889581 100644
--- a/docs/auditor/10.8/requirements/software.md
+++ b/docs/auditor/10.8/requirements/software.md
@@ -25,7 +25,7 @@ Server, in the monitored environment, or in both locations.
| - AD FS | _On the computer where_ Auditor _Server_ _is installed:_ - Windows Remote Management must be configured to allow remote PowerShell usage. For that, set up the **TrustedHosts** list: - to include all AD FS servers, use the following cmdlet: `Set-Item wsman:\localhost\Client\TrustedHosts -value '*' -Force;` - to include specific AD FS servers (monitored items), do the following: 1. Use Get cmdlet to obtain the existing **TrustedHosts** list. 2. If necessary, add the IP addresses of required AD FS servers to existing list (use comma as a separator). 3. Provide the updated list to the cmdlet as a parameter. For example: `Set-Item wsman:\localhost\Client\TrustedHosts -value '172.28.57.240,172.28.57.127' -Force;` See the following Microsoft article [Installation and configuration for Windows Remote Management](https://docs.microsoft.com/en-us/windows/win32/winrm/installation-and-configuration-for-windows-remote-management) for additional information about TrustedHosts. |
| - Windows Server (with enabled network traffic compression) - User Activity | _In the monitored environment:_ - .NET Framework 4.8 and above. See the following Microsoft article for additional information about .Net Framework installer redistributable: [Microsoft .NET Framework 4.8 offline installer for Windows.](https://support.microsoft.com/en-us/topic/microsoft-net-framework-4-8-offline-installer-for-windows-9d23f658-3b97-68ab-d013-aa3c3e7495e0) |
| - Microsoft Entra ID Ports - SharePoint Online | Usually, there is no need in any additional components for data collection. |
-| - Oracle Database | Oracle Database 12c and above: _On the computer where_ Auditor _Server_ _is installed:_ - Oracle Instant Client. - Download the appropriate package from Oracle website: [Instant Client Packages](https://www.oracle.com/database/technologies/instant-client.html). Netwrix recommends installing the latest available version (Netwrix Auditor is compatible with version 12 and above). - Install, following the instructions, for example,[ Instant Client Installation for Microsoft Windows 64-bit](https://www.oracle.com/database/technologies/instant-client/winx64-64-downloads.html#instant-client-installation-for-microsoft-windows-64-bit). Check your Visual Studio Redistributable version. Applicable packages for each Oracle Database version with downloading links are listed in the installation instructions: [Instant Client Installation for Microsoft Windows 64-bit](https://www.oracle.com/database/technologies/instant-client/winx64-64-downloads.html#instant-client-installation-for-microsoft-windows-64-bit). Oracle Database 11g: Auditor provides limited support of Oracle Database 11g. See the [Considerations for Oracle Database 11g](/docs/auditor/10.8/configuration/oracle/overview.md#considerations-for-oracle-database-11g) topic for additional information. _On the computer where_ Auditor _Server_ _is installed:_ - [Microsoft Visual C++ 2010 Redistributable Package](https://www.microsoft.com/en-us/download/details.aspx?id=14632)—can be installed automatically during the monitoring plan creation. - Oracle Data Provider for .NET and Oracle Instant Client Netwrix recommends the following setup steps: 1. Download the [64-bit Oracle Data Access Components 12c Release 4 (12.1.0.2.4) for Windows x64 (ODAC121024_x64.zip)](http://www.oracle.com/technetwork/database/windows/downloads/index-090165.html) package. 2. Run the setup and select the Data Provider for .NET checkbox. Oracle Instant Client will be installed, too. 3. On the ODP.NET (Oracle Data Provider) step make sure the Configure ODP.NET and/or Oracle Providers for ASP.Net at machine-wide level checkbox is selected . |
+| - Oracle Database | Oracle Database 12c and above: _On the computer where_ Auditor _Server_ _is installed:_ - Oracle Instant Client. - Download the appropriate package from Oracle website: [Instant Client Packages](https://www.oracle.com/database/technologies/instant-client.html). Netwrix recommends installing the latest available version (Netwrix Auditor is compatible with version 12 and above). - Install, following the instructions, for example,[ Instant Client Installation for Microsoft Windows 64-bit](https://www.oracle.com/database/technologies/instant-client/winx64-64-downloads.html#instant-client-installation-for-microsoft-windows-64-bit). Check your Visual Studio Redistributable version. Applicable packages for each Oracle Database version with downloading links are listed in the installation instructions: [Instant Client Installation for Microsoft Windows 64-bit](https://www.oracle.com/database/technologies/instant-client/winx64-64-downloads.html#instant-client-installation-for-microsoft-windows-64-bit). Oracle Database 11g: Auditor provides limited support of Oracle Database 11g. See the [Considerations for Oracle Database 11g](/docs/auditor/10.8/configuration/oracle/overview.md#considerations-for-oracle-database-11g) topic for additional information. _On the computer where_ Auditor _Server_ _is installed:_ - [Microsoft Visual C++ 2010 Redistributable Package](https://www.microsoft.com/en-us/download/details.aspx?id=14632)—can be installed automatically during the monitoring plan creation. - Oracle Data Provider for .NET and Oracle Instant Client Netwrix recommends the following setup steps: 1. Download the [64-bit Oracle Data Access Components 12c Release 4 (12.1.0.2.4) for Windows x64 (ODAC121024_x64.zip)](http://www.oracle.com/technetwork/database/windows/downloads/index-090165.html) package. 2. Run the setup and select the Data Provider for .NET checkbox. Oracle Instant Client will be installed, too. 3. On the ODP.NET (Oracle Data Provider) step ensure the Configure ODP.NET and/or Oracle Providers for ASP.Net at machine-wide level checkbox is selected . |
| - Group Policy | _On the computer where_ Auditor _Server_ _is installed:_ - Group Policy Management Console. Download Remote Server Administration Tools that include GPMC for: - [Windows 8.1](http://www.microsoft.com/en-us/download/details.aspx?id=39296) - [Windows 10](https://www.microsoft.com/en-us/download/details.aspx?id=45520) - For Windows Server 2012 R2/2016, Group Policy Management is turned on as a Windows feature. |
## Using SSRS-based Reports
@@ -33,12 +33,12 @@ Server, in the monitored environment, or in both locations.
SQL Server Reporting Services are needed for these types of reports. See the
[Requirements for SQL Server to Store Audit Data](/docs/auditor/10.8/requirements/sqlserver.md) topic for additional information.
-**NOTE:** It is not recommended to install SQL Server (including Express edition), SQL Server Reporting Services (SSRS), or Netwrix Auditor on a domain controller.
+**NOTE:** It isn't recommended to install SQL Server (including Express edition), SQL Server Reporting Services (SSRS), or Netwrix Auditor on a domain controller.
**Microsoft Edge WebView2**
To view SSRS-based reports in Netwrix Auditor, the WebView2 runtime component must be installed.
-If the component is not detected on the system, it will be automatically installed during the Netwrix Auditor setup process.
+If the component isn't detected on the system, it will be automatically installed during the Netwrix Auditor setup process.
See the following Microsoft article for additional information about the WebView2 runtime component: [Microsoft Edge WebView2](https://developer.microsoft.com/en-us/microsoft-edge/webview2).
## Server and Client
@@ -65,10 +65,10 @@ information.
You can deploy Auditor on servers or workstations running supported Windows OS version. See system
requirements for details.
-Installation on the domain controller is not supported.
+Installation on the domain controller isn't supported.
If you plan to have the audited system and Auditor Server residing in the workgroups, consider that
-in such scenario the product cannot be installed on the machine running Windows 7.
+in such scenario the product can't be installed on the machine running Windows 7.
Domain trusts, however, may affect data collection from different data sources. To prevent this,
consider the recommendations and restrictions listed below.
@@ -87,10 +87,9 @@ Activity record stands for one operable chunk of information in Auditor workflow
### Simple Deployment
-This scenario can be used for PoC, evaluation, or testing purposes. It can be also suitable for
-small infrastructures, producing only several thousands of activity records per day. In this
-scenario, you only deploy Auditor Server and default client, selecting Full installation option
-during the product setup.
+Use this scenario for PoC, evaluation, or testing purposes, or for small infrastructures that
+produce only a few thousand activity records per day. In this scenario, you deploy Auditor Server
+and the default client, selecting Full installation during setup.
@@ -101,8 +100,6 @@ in the Auditor documentation.
In this scenario, multiple Auditor clients are installed on different machines.
-Follow the steps to perform distributed deployment.
-
**Step 1 –** Install Auditor Server and default Client, selecting Full installation during the
product setup.
diff --git a/docs/auditor/10.8/requirements/sqlserver.md b/docs/auditor/10.8/requirements/sqlserver.md
index 97e9cd727f..09762a0336 100644
--- a/docs/auditor/10.8/requirements/sqlserver.md
+++ b/docs/auditor/10.8/requirements/sqlserver.md
@@ -16,14 +16,14 @@ Due to limited database size, Netwrix recommends Express Edition (with Reporting
evaluation, PoC, or small environments **when using SQL Server 2022 or earlier**. For production
environments, consider using Standard or Enterprise Edition.
-**NOTE:** SQL Server 2025 Express Edition does not include Power BI Report Server (PBIRS) or any
+**NOTE:** SQL Server 2025 Express Edition doesn't include Power BI Report Server (PBIRS) or any
built-in reporting services. If reporting functionality is required, use Standard or Enterprise
Edition with SQL Server 2025, or remain on SQL Server Express 2022 or earlier. See the SQL Server
2025 row in the table below for details.
| Version | Edition |
| ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| SQL Server 2025 | - Standard or Enterprise Edition
**NOTE:** Express Edition is supported for SQL Server 2025, but does not include Power BI Report Server (PBIRS) or any built-in reporting services. Reporting functionality is not available with SQL Server 2025 Express. If reporting is required, use Standard or Enterprise Edition with SQL Server 2025, or remain on [SQL Server 2022 Express](https://www.microsoft.com/en-us/download/details.aspx?id=104781) with [SQL Server Reporting Services 2022](https://www.microsoft.com/en-us/download/details.aspx?id=104502). Note that using SSRS 2022 (or earlier) with SQL Server 2025 Express is not an officially supported configuration and may break if Microsoft introduces incompatible changes in a future update. |
+| SQL Server 2025 | - Standard or Enterprise Edition
**NOTE:** Express Edition is supported for SQL Server 2025, but doesn't include Power BI Report Server (PBIRS) or any built-in reporting services. Reporting functionality isn't available with SQL Server 2025 Express. If reporting is required, use Standard or Enterprise Edition with SQL Server 2025, or remain on [SQL Server 2022 Express](https://www.microsoft.com/en-us/download/details.aspx?id=104781) with [SQL Server Reporting Services 2022](https://www.microsoft.com/en-us/download/details.aspx?id=104502). Using SSRS 2022 (or earlier) with SQL Server 2025 Express isn't an officially supported configuration and may break if Microsoft introduces incompatible changes in a future update. |
| SQL Server 2022 | - Standard or Enterprise Edition - [Express Edition](https://www.microsoft.com/en-us/download/details.aspx?id=104781) with [Reporting Services](https://www.microsoft.com/en-us/download/details.aspx?id=104502) (for evaluation, PoC, and small environments) |
| SQL Server 2019 (on-premises Windows version) cumulative update 10 and above | - Standard or Enterprise Edition - [Express Edition](https://www.microsoft.com/en-us/download/details.aspx?id=101064) with [Reporting Services](https://www.microsoft.com/en-us/download/details.aspx?id=100122) (for evaluation, PoC, and small environments) |
| SQL Server 2017 | - Standard or Enterprise Edition - [Express Edition](https://www.microsoft.com/en-us/download/details.aspx?id=55994) with [Reporting Services](https://www.microsoft.com/en-us/download/details.aspx?id=55252) (for evaluation, PoC, and small environments) |
@@ -119,7 +119,7 @@ Consider the following:
- Supported versions are 2012 and later.
- Reporting Services supports only English-language operating systems.
- Supported editions are Enterprise, Standard, and Express with Advanced Services (it includes
- Reporting Services). **Note:** SQL Server 2025 Express Edition does not include any reporting
+ Reporting Services). **Note:** SQL Server 2025 Express Edition doesn't include any reporting
services. For SQL Server 2025, only Standard and Enterprise Editions support report generation.
- If downloading SQL Server Express Edition with Advanced Services from Microsoft site, ensure
you download the file whose name contains SQLEXPRADV. Otherwise, the installer won't deploy Reporting Services, and you won't be able to analyze and report on collected data.
diff --git a/docs/auditor/10.8/requirements/supporteddatasources/monitoredobjecttypes.md b/docs/auditor/10.8/requirements/supporteddatasources/monitoredobjecttypes.md
index beb3ad50ba..a84d5adb97 100644
--- a/docs/auditor/10.8/requirements/supporteddatasources/monitoredobjecttypes.md
+++ b/docs/auditor/10.8/requirements/supporteddatasources/monitoredobjecttypes.md
@@ -6,8 +6,8 @@ sidebar_position: 10
# Monitored Object Types, Actions, and Attributes
-Netwrix Auditor monitored object types, actions, attributes and components for each data source are
-located in the following topics:
+Netwrix Auditor monitored object types, actions, attributes, and components for each data source are
+listed in the following topics:
- [Active Directory](/docs/auditor/10.8/configuration/activedirectory/overview.md)
- [AD FS](/docs/auditor/10.8/configuration/activedirectoryfederatedservices/overview.md)
@@ -42,7 +42,7 @@ located in the following topics:
Review the list of actions audited and reported by Netwrix Auditor. Actions vary depending on the
data source and the object type.
-| Action | Active Directory | Active Directory Federation Services | Exchange Exchange Online | File Servers | Group Policy | Logon Activity | Microsoft Entra ID (formerly Azure AD) | Oracle database | SharePoint SharePoint Online | SQL Server | User Activity | VMware Servers | Windows Server |
+| Action | Active Directory | Active Directory Federation Services | Exchange Online | File Servers | Group Policy | Logon Activity | Microsoft Entra ID (formerly Azure AD) | Oracle database | SharePoint Online | SQL Server | User Activity | VMware Servers | Windows Server |
| ----------------------------------------- | ---------------- | ------------------------------------ | ------------------------ | ------------ | ------------ | -------------- | -------------------------------------- | --------------- | ---------------------------- | ---------- | ------------- | -------------- | -------------- |
| Added | + | - | +\* | + | + | – | + | + | + | + | – | + | + |
| Removed | + | - | +\* | + | + | – | + | + | + | + | – | + | + |
diff --git a/docs/auditor/10.8/requirements/supporteddatasources/supporteddatasources.md b/docs/auditor/10.8/requirements/supporteddatasources/supporteddatasources.md
index 467b5c4f4d..7765ea5567 100644
--- a/docs/auditor/10.8/requirements/supporteddatasources/supporteddatasources.md
+++ b/docs/auditor/10.8/requirements/supporteddatasources/supporteddatasources.md
@@ -72,7 +72,9 @@ versions:
- Dell VNX/VNXe/Celerra families
- Dell PowerStore family
-> **NOTE:** Netwrix Auditor supports only Common Internet File System (CIFS) configuration.
+:::note
+Netwrix Auditor supports only Common Internet File System (CIFS) configuration.
+:::
See the [Dell Data Storage](/docs/auditor/10.8/configuration/fileservers/delldatastorage/overview.md) topic for
additional information.
@@ -83,9 +85,13 @@ Auditor supports monitoring the following device versions:
- Dell Isilon/PowerScale versions 7.2 – 9.12
-> **NOTE:** Netwrix Auditor supports only CIFS configuration.
+:::note
+Netwrix Auditor supports only CIFS configuration.
+:::
-> **IMPORTANT:** Netwrix Auditor does not support auditing of the _System_ zone. Dell designates this zone for configuration access only. Store current data in other access zones.
+:::warning
+Netwrix Auditor doesn't support auditing of the _System_ zone. Dell designates this zone for configuration access only. Store current data in other access zones.
+:::
See the [Dell Isilon/PowerScale](/docs/auditor/10.8/configuration/fileservers/dellisilon/overview.md) topic for
additional information.
@@ -98,7 +104,9 @@ Auditor supports monitoring the following device versions:
- 9.0 – 9.17
- 8.3
-> **NOTE:** Netwrix Auditor supports only CIFS configuration.
+:::note
+Netwrix Auditor supports only CIFS configuration.
+:::
See the [NetApp Data ONTAP](/docs/auditor/10.8/configuration/fileservers/netappcmode/overview.md) topic for
additional information.
@@ -187,7 +195,9 @@ Auditor supports monitoring the following versions:
- Exchange Online version provided within Microsoft Office 365
- Microsoft GCC (government community cloud) and GCC High
-> **NOTE:** Netwrix Auditor does not support Department of Defense (DoD) tenant types.
+:::note
+Netwrix Auditor doesn't support Department of Defense (DoD) tenant types.
+:::
See the [Exchange Online](/docs/auditor/10.8/configuration/microsoft365/exchangeonline/overview.md) topic for
additional information.
@@ -199,7 +209,9 @@ Auditor supports monitoring the following versions:
- Microsoft Entra ID version provided within Microsoft Office 365
- Microsoft GCC (government community cloud) and GCC High
-> **NOTE:** Netwrix Auditor does not support DoD tenant types.
+:::note
+Netwrix Auditor doesn't support DoD tenant types.
+:::
See the
[Microsoft Entra ID (formerly Azure AD)](/docs/auditor/10.8/configuration/microsoft365/microsoftentraid/overview.md)
@@ -212,7 +224,9 @@ Auditor supports monitoring the following versions:
- Microsoft Entra ID version provided within Microsoft Office 365
- Microsoft GCC (government community cloud) and GCC High
-> **NOTE:** Netwrix Auditor does not support DoD tenant types.
+>:::note
+Netwrix Auditor doesn't support DoD tenant types.
+:::
See the [MS Teams](/docs/auditor/10.8/configuration/microsoft365/teams/overview.md) topic for additional
information.
@@ -224,7 +238,9 @@ Auditor supports monitoring the following versions:
- SharePoint Online version provided within Microsoft Office 365
- Microsoft GCC (government community cloud) and GCC High
-> **NOTE:** Netwrix Auditor does not support DoD tenant types.
+>:::note
+Netwrix Auditor doesn't support DoD tenant types.
+:::
See the [SharePoint Online](/docs/auditor/10.8/configuration/microsoft365/sharepointonline/overview.md) topic for
additional information.
@@ -363,7 +379,9 @@ Auditor supports monitoring the following versions:
- Microsoft SQL Server 2014
- Microsoft SQL Server 2012
-> **NOTE:** Netwrix Auditor does not support Linux-based versions.
+:::note
+Netwrix Auditor doesn't support Linux-based versions.
+:::
See the [SQL Server](/docs/auditor/10.8/configuration/sqlserver/overview.md) topic for additional information.
@@ -437,9 +455,13 @@ Auditor supports monitoring the following operating system versions:
- Windows Server 2012 R2
- Windows Server 2012
-> **NOTE:** DNS support on Windows Server 2008 is limited to Windows Server 2008 SP2 (32 and 64-bit).
+:::note
+DNS support on Windows Server 2008 is limited to Windows Server 2008 SP2 (32 and 64-bit).
+:::
-> **NOTE:** Netwrix Auditor does not support DHCP on Windows Server 2008.
+:::note
+Netwrix Auditor doesn't support DHCP on Windows Server 2008.
+:::
Internet Information Services (IIS)
diff --git a/docs/auditor/10.8/requirements/workingfolder.md b/docs/auditor/10.8/requirements/workingfolder.md
index 25247ced0c..7c2172237d 100644
--- a/docs/auditor/10.8/requirements/workingfolder.md
+++ b/docs/auditor/10.8/requirements/workingfolder.md
@@ -6,10 +6,10 @@ sidebar_position: 70
# Working Folder
-The working folder is a file-based storage that also keeps operational information (configuration
-files of the product components, log files, and other data). To ensure audit trail continuity,
-Netwrix Auditor also caches some audit data locally in its working folder for a short period (up to
-30 days) prior to storing it to the Long-Term Archive or audit database.
+The working folder is a file-based storage that keeps operational information (configuration
+files, log files, and other data). To ensure audit trail continuity,
+Netwrix Auditor caches audit data locally in its working folder for a short period (up to
+30 days) before storing it to the Long-Term Archive or audit database.
By default, the working folder is located at _%ProgramData%\Netwrix Auditor_.
diff --git a/docs/auditor/10.8/tools/auditconfigurationassistant.md b/docs/auditor/10.8/tools/auditconfigurationassistant.md
index dfd46ee8a0..04da5bf34b 100644
--- a/docs/auditor/10.8/tools/auditconfigurationassistant.md
+++ b/docs/auditor/10.8/tools/auditconfigurationassistant.md
@@ -25,7 +25,7 @@ Auditor\*\*\*\*>**\*\*Netwrix Auditor Audit Configuration Assistant**. Alternati
this utility from the monitoring plan wizard for Active Directory data source. See the Launch Audit
Configuration Assistant section for additional information.
-Currently, the utility supports Active Directory and Logon Activity data sources.
+the utility supports Active Directory and Logon Activity data sources.
## Prerequisites
@@ -60,9 +60,8 @@ Select **Netwrix Auditor**→**Netwrix Auditor Audit Configuration Assistant**.
- If the utility is installed on the same machine as Netwrix Auditor server, you will be taken to
the **Welcome** step.
-- If the utility is installed on the remote machine together with Netwrix Auditor client, the
- initial window will allow you to enter the settings to connect to Netwrix Auditor Server. Specify
- the following:
+- If the utility is installed on the remote machine together with Netwrix Auditor client, enter the
+ connection settings in the initial window. Specify the following:
| Setting | Description |
| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -83,8 +82,6 @@ Alternatively, you can launch this utility by clicking the corresponding link:
## Start Assessment
-Follow the steps to start assessment.
-
**Step 1 –** Specify the monitoring scope —select what you plan to monitor with Netwrix Auditor. You
can select both **Active Directory** and **Logon Activity**, or any of them.
@@ -112,8 +109,6 @@ At this step, you will be presented the results of the environment readiness ass
-Follow the steps to view results.
-
**Step 1 –** Examine the report.
**Step 2 –** If some issues occurred due to the lack of access rights during the assessment, you can
@@ -133,7 +128,7 @@ audit settings. Operation progress will be reported in the bottom of the window.
**Step 1 –** Wait for the process to complete.
**Step 2 –** Review the results. Successfully applied settings will be reported with a green tick;
-those that did not manage to apply will be with the yellow warning sign and explanatory text.
+those that didn't manage to apply will be with the yellow warning sign and explanatory text.
**Step 3 –** You can click **Start over** to get to the Start Assessment, fix the issues and perform
the procedure again, or click **Finish**.
diff --git a/docs/auditor/10.8/tools/eventlogmanager/eventlog.md b/docs/auditor/10.8/tools/eventlogmanager/eventlog.md
index b7dfeb9bef..7056b08969 100644
--- a/docs/auditor/10.8/tools/eventlogmanager/eventlog.md
+++ b/docs/auditor/10.8/tools/eventlogmanager/eventlog.md
@@ -9,8 +9,6 @@ sidebar_position: 20
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Event Log
monitoring scope.
-Follow the steps to exclude data from the Event Log monitoring scope:
-
**Step 1 –** Navigate to the _%Netwrix Auditor installation folder%\Event Log Management_ folder.
**Step 2 –** Edit the \*.txt files, based on the following guidelines:
diff --git a/docs/auditor/10.8/tools/eventlogmanager/eventlogmanager.md b/docs/auditor/10.8/tools/eventlogmanager/eventlogmanager.md
index 92c2d37cb1..ee7f18abda 100644
--- a/docs/auditor/10.8/tools/eventlogmanager/eventlogmanager.md
+++ b/docs/auditor/10.8/tools/eventlogmanager/eventlogmanager.md
@@ -14,7 +14,7 @@ Netwrix Auditor relies on native logs for collecting audit data. Therefore, succ
access auditing requires a certain configuration of native audit settings in the audited environment
and on the Auditor console computer. Configuring your IT infrastructure may also include enabling
certain built-in Windows services, etc. Proper audit configuration is required to ensure audit data
-integrity, otherwise your change reports may contain warnings, errors or incomplete audit data.
+integrity—otherwise your reports may contain warnings, errors, or incomplete audit data.
**CAUTION:** Folder associated with Netwrix Auditor must be excluded from antivirus scanning. See
the
@@ -46,8 +46,6 @@ Review the following for additional information:
## Create Monitoring Plans for Event Logs
-Follow the steps to configure monitoring plan for event logs.
-
**Step 1 –** Navigate to **Start** **>** Netwrix Auditor **>** Netwrix Auditor**Event Log
Manager\_\_**.\_\_
@@ -65,8 +63,8 @@ new plan.
| Option | Description |
| ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
- | Computer name | Allows specifying a single computer by entering its FQDN, NETBIOS or IP address. You can click Browse to select a computer from the list of computers in your network. |
- | Active Directory container | Allows specifying a whole AD container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be monitored within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify domains, OUs, and containers you do not want to audit. The list of containers does not include child domains of trusted domains. Use other options **(Computer name, IP address range**, or **Import computer names from a file**) to specify the target computers. |
+ | Computer name | Allows specifying a single computer by FQDN, NetBIOS, or IP address. Click **Browse** to select a computer from your network. |
+ | Active Directory container | Allows specifying a whole AD container. Click **Browse** to select from the list of containers in your network. You can also: - Select a particular computer type to be monitored within the chosen AD container: **Domain controllers, Servers (excluding domain controllers)**, or **Workstations**. - Click **Exclude** to specify domains, OUs, and containers you don't want to audit. The list of containers doesn't include child domains of trusted domains. Use other options **(Computer name, IP address range**, or **Import computer names from a file**) to specify the target computers. |
| IP address range / Computers within an IP range | Allows specifying an IP range for the audited computers. To exclude computers from within the specified range, click **Exclude**. Enter the IP range you want to exclude, and click **Add**. |
**Step 4 –** You can specify multiple computer names by importing a list from a .txt file (one
@@ -93,12 +91,12 @@ whether to import the list once, or to update it on every data collection.
| Password | Enter a password for SMTP authentication. |
| Use Secure Sockets Layer encrypted connection (SSL) | Select this checkbox if your SMTP server requires SSL to be enabled. |
| Use implicit SSL | Select this checkbox if the implicit SSL mode is used, which means that an SSL connection is established before any meaningful data is sent. |
-| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option is not available for auditing User Activity as well Netwrix Auditor tools. |
+| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option isn't available for auditing User Activity as well Netwrix Auditor tools. |
**Step 7 –** Navigate to the Audit Database tab to configure Audit Database and review SQL Server
settings. Netwrix Auditor Event Log Manager synchronizes Audit Database and reports settings with
the default Audit Database configuration from Netwrix Auditor Server. If this option is disabled,
-contact your Netwrix Auditor Global administrator and make sure that these settings are properly
+contact your Netwrix Auditor Global administrator and ensure that these settings are properly
configured in Netwrix Auditor Server. Refer to [Audit Database](/docs/auditor/10.8/admin/settings/auditdatabase.md)
for detailed instructions on how to configure the Audit Database settings.
@@ -106,11 +104,11 @@ for detailed instructions on how to configure the Audit Database settings.
| Option | Description |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Write data to Audit Database and enable reports | Select if you want to generate reports. Even if you do not select this checkbox now, you will still be able to configure these settings later, but already collected audit data will not be imported in the Audit Database. |
+| Write data to Audit Database and enable reports | Select if you want to generate reports. Even if you don't select this checkbox now, you will still be able to configure these settings later, but already collected audit data will not be imported in the Audit Database. |
| Write event descriptions to Audit Database | Select if you want to see the exact error or warning text. |
| Store events for... days | Specify the Audit Database retention period. This setting affects all monitoring plans. The minimum value specified across the plans will be applied. When configuring, mind that your data will be deleted automatically when its retention period is over. |
-**NOTE:** You cannot edit SQL Server settings for Netwrix Auditor Event Log Manager.
+**NOTE:** You can't edit SQL Server settings for Netwrix Auditor Event Log Manager.
**Step 9 –** Navigate to the Advanced tab and configure the following:
@@ -136,8 +134,6 @@ existing filters, and create new filters. To do it, click Configure next to Audi
The product allows creating inclusive and exclusive audit archiving filters.
-Follow the steps to configure audit archiving filters.
-
**Step 1 –** To create or modify an audit archiving filter, see Create Monitoring Plans for Event
Logs.
@@ -145,9 +141,7 @@ Logs.
which name coincides with this report’s name. Click Enable and select Filters for Reports. All
filters required to store events for all available reports will be selected automatically.
-Follow the steps to create or edit an audit archiving filter.
-
-**Step 1 –** On the Audit archiving filters page, click Add or select a filter and click Edit.
+**Step 1 –** On the Audit archiving filters page, click **Add** or select a filter and click **Edit**.
**Step 2 –** Complete the fields. Review the following for additional information:
@@ -156,11 +150,11 @@ Follow the steps to create or edit an audit archiving filter.
| The Event tab | |
| Name | Specify the filter name. |
| Description | Enter the description for this filter (optional). |
-| Event Log | Select an event log from the drop-down list. You will be alerted on events from this event log. You can also input a different event log. To find out a log’s name, navigate to Start > Windows Administrative Tools→ Event Viewer → Applications and Services Logs → Microsoft → Windows and expand the required `` node, right-click the file under it and select Properties. Find the event log’s name in the Full Name field. Netwrix Auditor Event Log Manager does not collect the Analytic and Debug logs, so you cannot configure alerts for these logs. You can use a wildcard (`*`). For inclusive filters: all Windows logs except for the ones mentioned above will be saved. For exclusive: all Windows logs events will be excluded. |
+| Event Log | Select an event log from the dropdown list. You will be alerted on events from this event log. You can also input a different event log. To find out a log’s name, navigate to Start > Windows Administrative Tools→ Event Viewer → Applications and Services Logs → Microsoft → Windows and expand the required `` node, right-click the file under it and select Properties. Find the event log’s name in the Full Name field. Netwrix Auditor Event Log Manager doesn't collect the Analytic and Debug logs, so you can't configure alerts for these logs. You can use a wildcard (`*`). For inclusive filters: all Windows logs except for the ones mentioned above will be saved. For exclusive: all Windows logs events will be excluded. |
| Write to/Don't write to | Select the location to write/not to write events to, depending on the filter type (inclusive or exclusive). It is recommended to write events both to the Long-Term Archive and to the Audit Database, because if your database is corrupted, you will be able to import the necessary data from the Long-Term Archive using the DB Importer tool. See Import Audit Data with the Database Importer for more information. |
| The Event Fields tab | |
| Event ID | Enter the identifier of a specific event that you want to be save. You can add several IDs separated by comma. |
-| Event Level | Select the event types that you want to be save. If the Event Level check box is cleared, all event types will be saved. If you want to select the inclusive Success Audit/Failure Audit filters, note that on these platforms these events belong to the “Information” level, so they will not be collected if you select the Information checkbox in the Exclusive Filters. |
+| Event Level | Select the event types that you want to be save. If the Event Level checkbox is cleared, all event types will be saved. If you want to select the inclusive Success Audit/Failure Audit filters, be aware that on these platforms these events belong to the “Information” level, so they will not be collected if you select the Information checkbox in the Exclusive Filters. |
| Computer | Specify a computer (as it is displayed in the Computer field in the event properties). Only events from this computer will be saved. If you want to specify several computers, you can define a case-sensitive mask for this parameter. Below is an example of a mask: - `*` - any machine - computer – a machine named ‘computer’ - `*`computer`*` - machines with names like ‘xXxcomputerxXx’ or ‘newcomputer’ - computer? – machines with names like ‘computer1’ or ‘computerV’ - co?puter - machines with names like ‘computer’ or ‘coXputer’ - ????? – any machine with a 5-character name - ???`*` - any machine with a 3-character name or longer |
| User | Enter a user’s name. Only events created by this user will be saved. If you need to specify several users, you can define a mask for this parameter in the same way as described above. |
| Source | Specify this parameter if you want to save events from a specific source. Input the event source as it is displayed in the Source field in the event properties. If you need to specify several sources, you can define a mask for this parameter in the same way as described above. |
@@ -178,18 +172,16 @@ You can also review and filter Netwrix Auditor health events right in the produc
[Netwrix Auditor Health Log](/docs/auditor/10.8/admin/healthstatus/dashboard/healthlog.md) for additional
information
-Follow the steps to configure the Netwrix Auditor System Health log monitoring.
-
**Step 1 –** Start Netwrix Auditor Event Log Manager and create the new monitoring plan.
-**Step 2 –** Make sure that the Enable event log collection checkbox is selected. Specify the name
+**Step 2 –** ensure that the Enable event log collection checkbox is selected. Specify the name
for the new monitoring plan, for example, _"\_Netwrix Auditor \_Health Status"_.
**Step 3 –** Navigate to the Monitored computers list and add a server where the Netwrix Auditor
Server resides.
**Step 4 –** Navigate to the Audit Database tab and select Write event descriptions to Audit
-Database if you want to see the exact error or warning text. Make sure that Audit Database settings
+Database if you want to see the exact error or warning text. Ensure that Audit Database settings
are configured properly, follow the [Audit Database](/docs/auditor/10.8/admin/settings/auditdatabase.md)
**Step 5 –** Click Configure next to Audit archiving filters and select the Netwrix Auditor System
@@ -201,9 +193,8 @@ used to collect data on Netwrix Auditor health status events.
## Review Past Event Log Entries
Netwrix Auditor Event Log Manager collects event log entries and stores them to the Audit Archive.
-Follow the steps to review past events.
-**Step 1 –** On the main Netwrix Auditor Event Log Manager page, click View next to View collected
+**Step 1 –** On the main Netwrix Auditor Event Log Manager page, click **View** next to View collected
events.
**Step 2 –** In the Netwrix Auditor Event Viewer window, complete the following to narrow results:
@@ -217,9 +208,7 @@ events.
## Import Audit Data with the Database Importer
-Follow the steps to Import Audit Data with the Database Importer.
-
-**Step 1 –** On the main Netwrix Auditor Event Log Manager page, click Import Data.
+**Step 1 –** On the main Netwrix Auditor Event Log Manager page, click **Import Data**.
**Step 2 –** Select a monitoring plan and the time range for which you want to import data.
diff --git a/docs/auditor/10.8/tools/eventlogmanager/windowseventlogs.md b/docs/auditor/10.8/tools/eventlogmanager/windowseventlogs.md
index 4a9a06d9d3..4b95b5a3ba 100644
--- a/docs/auditor/10.8/tools/eventlogmanager/windowseventlogs.md
+++ b/docs/auditor/10.8/tools/eventlogmanager/windowseventlogs.md
@@ -8,8 +8,6 @@ sidebar_position: 10
The Remote Registry service must be enabled on the target computers.
-Follow the steps to enable the Remote Registry service.
-
**Step 1 –** Navigate to Start > Windows Administrative Tools > Services.
@@ -17,7 +15,7 @@ Follow the steps to enable the Remote Registry service.
**Step 2 –** In the Services window, locate the Remote Registry service, right-click it and select
**Properties**.
-**Step 3 –** In the Remote Registry Properties dialog box, make sure the Startup type parameter is
+**Step 3 –** In the Remote Registry Properties dialog box, ensure the Startup type parameter is
set to _Automatic_ and click **Start**.
diff --git a/docs/auditor/10.8/tools/inactiveusertracker.md b/docs/auditor/10.8/tools/inactiveusertracker.md
index d67b6683e9..db77bb7ebc 100644
--- a/docs/auditor/10.8/tools/inactiveusertracker.md
+++ b/docs/auditor/10.8/tools/inactiveusertracker.md
@@ -12,7 +12,7 @@ performs the following tasks:
- Checks the managed domain or specific organizational units by inquiring all domain controllers,
and sends reports to managers and system administrators listing all accounts that have been
inactive for the specified number of days.
-- Automatically deactivates inactive accounts by settings a random password, disabling, deleting or
+- Automatically deactivates inactive accounts by setting a random password, disabling, deleting, or
moving them to a specified organizational unit.
**NOTE:** The password that is generated will contain uppercase and lowercase letters, numbers
@@ -29,8 +29,6 @@ performs the following tasks:
## Create Monitoring Plan to Audit Inactive Users
-Follow the steps to create a monitoring plan to audit inactive users.
-
**Step 1 –** Navigate to Start > Netwrix Auditor > Netwrix Auditor Inactive Users Tracker.
**Step 2 –** On the main page, you will be prompted to select a monitoring plan. Click Add to add a
@@ -90,7 +88,7 @@ The following variables can be used in the Inactive User Tracker message templat
| Option | Description |
| --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Use Netwrix Auditor notification settings | Select this option if you want to use modern authentication. Please note that modern authentication must already be configured in the monitoring plan you are going to use. If you select this option, the fields below are not needed. |
+| Use Netwrix Auditor notification settings | Select this option to use modern authentication. Modern authentication must already be configured in the monitoring plan. If you select this option, the fields below aren't needed. |
| SMTP server | Enter your SMTP server address. It can be your company's Exchange server or any public mail server (e.g., Gmail, Yahoo). |
| Port number | Specify your SMTP server port number. |
| Sender address | Enter the address that will appear in the From field. **_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. |
@@ -99,16 +97,14 @@ The following variables can be used in the Inactive User Tracker message templat
| Password | Enter a password for SMTP authentication. |
| Use Secure Sockets Layer encrypted connection (SSL) | Select this checkbox if your SMTP server requires SSL to be enabled. |
| Use implicit SSL | Select this checkbox if the implicit SSL mode is used, which means that an SSL connection is established before any meaningful data is sent. |
-| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option is not available for auditing User Activity as well Netwrix Auditor tools. |
-| Display the following From address in email notifications | Enter the address that will appear in the "_From_" field in email notifications. This option does not affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, make sure that your Exchange supports this option. |
+| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option isn't available for auditing User Activity as well Netwrix Auditor tools. |
+| Display the following From address in email notifications | Enter the address that will appear in the "_From_" field in email notifications. This option doesn't affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, ensure that your Exchange supports this option. |
Review your configuration and click Save.
## Review Report on Inactive Users
-Follow the steps to review report on inactive users.
-
-**Step 1 –** Click Generate next to Generate report on inactive users to view report immediately.
+**Step 1 –** Click **Generate** next to Generate report on inactive users to view the report immediately.
@@ -129,8 +125,6 @@ your Active Directory domain with Netwrix Auditor. Navigate to Start > Run and t
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from the Inactive User
monitoring scope.
-Follow the steps to exclude data from the Inactive Users monitoring scope:
-
**Step 1 –** Navigate to the `%PROGRAMDATA%\Netwrix Auditor\Inactive Users Tracker` folder.
**NOTE:** This is default location. However, it may be changed because users can move this folder.
@@ -144,5 +138,5 @@ Follow the steps to exclude data from the Inactive Users monitoring scope:
| File | Description | Syntax |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
| filter.txt | Contains a list of accounts to be excluded from processing. | `Username` |
-| omitdclist.txt | Contains a list of domain controllers to be excluded from processing. Auditor skips all automated deactivation actions for inactive accounts (disable, move, delete) even if one domain controller is unavailable during scheduled task execution. Add the unavailable domain controllers to this file to ensure Auditor functions properly. | `Full DNS name` or `NetBIOS name` IP addresses are not supported. |
+| omitdclist.txt | Contains a list of domain controllers to be excluded from processing. Auditor skips all automated deactivation actions for inactive accounts (disable, move, delete) even if one domain controller is unavailable during scheduled task execution. Add the unavailable domain controllers to this file to ensure Auditor functions properly. | `Full DNS name` or `NetBIOS name` IP addresses aren't supported. |
| omitoulist.txt | Contains a list of organizational units to be excluded from processing. | `Path` `*OU=OUNAME*` For example: If the OU is "sampledomain.sample/sampling", the syntax should be: `*OU=sampling*` |
diff --git a/docs/auditor/10.8/tools/objectrestoread.md b/docs/auditor/10.8/tools/objectrestoread.md
index 2f7e6baf87..5d348418fe 100644
--- a/docs/auditor/10.8/tools/objectrestoread.md
+++ b/docs/auditor/10.8/tools/objectrestoread.md
@@ -34,16 +34,14 @@ passwords which then have to be changed manually. If you want to be able to rest
their passwords preserved, you must modify the Schema container settings so that account passwords
are retained when accounts are being deleted.
-To perform this procedure, you will need the
-[ADSI Edit](http://technet.microsoft.com/en-us/library/cc773354(v=ws.10).aspx) utility.utility.
-
-Follow the steps to modify schema container settings.
+To perform this procedure, you need the
+[ADSI Edit](http://technet.microsoft.com/en-us/library/cc773354(v=ws.10).aspx) utility.
**Step 1 –** Navigate to Start > Windows Administrative Tools > ADSI Edit.
**Step 2 –** Right-click the **ADSI Edit** node and select **Connect To**. In the **Connection
Settings** dialog, enable **Select a well-known Naming Context** and select **Schema** from the
-drop-down list.
+dropdown list.
**Step 3 –** Expand the Schema your_Root_Domain_name node. Right-click the CN=Unicode-Pwd attribute
and select Properties.
@@ -58,8 +56,6 @@ Now you will be able to restore deleted accounts with their passwords preserved.
## Roll Back Unwanted Changes
-Follow the steps to roll back unwanted changes.
-
**Step 1 –** Navigate to Start > Netwrix Auditor > Netwrix Auditor Object Restore for Active
Directory.
diff --git a/docs/auditor/10.8/tools/passwordexpirationnotifier/monitoringscope.md b/docs/auditor/10.8/tools/passwordexpirationnotifier/monitoringscope.md
index 0217766595..e460341529 100644
--- a/docs/auditor/10.8/tools/passwordexpirationnotifier/monitoringscope.md
+++ b/docs/auditor/10.8/tools/passwordexpirationnotifier/monitoringscope.md
@@ -9,8 +9,6 @@ sidebar_position: 20
You can fine-tune Netwrix Auditor by specifying data that you want to exclude from monitoring and
alerting on password expiration.
-Follow the steps to exclude data from the Active Directory monitoring scope.
-
**Step 1 –** Navigate to the \_%Netwrix Auditor installation folder%\Password Expiration
Alerting_folder.
diff --git a/docs/auditor/10.8/tools/passwordexpirationnotifier/overview.md b/docs/auditor/10.8/tools/passwordexpirationnotifier/overview.md
index d3bb8721f1..f6e260eb43 100644
--- a/docs/auditor/10.8/tools/passwordexpirationnotifier/overview.md
+++ b/docs/auditor/10.8/tools/passwordexpirationnotifier/overview.md
@@ -28,8 +28,6 @@ Review the following for additional information:
## Configure Password Expiration Alerting
-Follow the steps to configure password expiration alerting.
-
**Step 1 –** Navigate to **Start** > **Netwrix Auditor** > **Password Expiration Notifier**.
**Step 2 –** On the main page, you will be prompted to select a monitoring plan. Click Add to add a
@@ -60,16 +58,16 @@ new monitoring plan.
| List users whose accounts or passwords expire in `<>` days or less | Specify the expiration period for accounts and/or passwords to be included in the administrators and managers reports. |
| Only report on users with expiring accounts | Select this option to deliver reports on users with expiring accounts only and ignore users whose passwords will be valid for a rather long time. |
| Notify users | Select this option to notify users that their passwords and/or accounts are about to expire. |
-| Every day if password expires in `<>` days or less | Select this option for users to be notified daily that their passwords are going to expire, and specify the number of days before the expiration date. To edit a report template, click **Customize**. You can use HTML tags when editing a template. To send a test email, click **Test** and select an account. Make sure this account has a password that expires within the period you specified next to this option. |
-| First/Second/Last time when password expires in `<>` days | Select this option for users to be notified three times, and specify the number of days before the expiration date for each of three notifications. To edit a report template, click **Customize**. You can use HTML tags when editing a template. To send a test email, click Test and select an account. Make sure this account has a password that expires within the period you specified next to this option. |
-| Notify users by email every day if their accounts expire in `<>` days | Select this option for users to be notified daily that their account is going to expire, and specify the number of days before the expiration date. To send a test email, click **Test** and select an account. Make sure this account has a password that expires within the period you specified next to this option. |
+| Every day if password expires in `<>` days or less | Select this option for users to be notified daily that their passwords are going to expire, and specify the number of days before the expiration date. To edit a report template, click **Customize**. You can use HTML tags when editing a template. To send a test email, click **Test** and select an account. ensure this account has a password that expires within the period you specified next to this option. |
+| First/Second/Last time when password expires in `<>` days | Select this option for users to be notified three times, and specify the number of days before the expiration date for each of three notifications. To edit a report template, click **Customize**. You can use HTML tags when editing a template. To send a test email, click Test and select an account. ensure this account has a password that expires within the period you specified next to this option. |
+| Notify users by email every day if their accounts expire in `<>` days | Select this option for users to be notified daily that their account is going to expire, and specify the number of days before the expiration date. To send a test email, click **Test** and select an account. ensure this account has a password that expires within the period you specified next to this option. |
| Notify users by text messages | Select this option for users to receive text messages if their passwords are about to expire. To edit SMS Notifications template, click Customize. - Every day if password expires in `<>` days or less — Select this option for users to be notified daily that their passwords are going to expire, and specify the number of days before the expiration date. - First/Second/Last time when password expires in `<>` days — Select this option for users to be notified three times, and specify the number of days before the expiration date for each of three notifications. - Provider name — Specify provider name. - Property name — Specify the name of the Active Directory User Property where the recipient's phone number is stored. Pager is the default property. If the Pager property of an AD User contains a full email address, Provider Name will be ignored. |
**Step 6 –** Navigate to the **Notifications** tab and complete the following fields:
| Option | Description |
| --------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Use Netwrix Auditor notification settings | Select this option if you want to use modern authentication. Please note that modern authentication must already be configured in the monitoring plan you are going to use. If you select this option, the fields below are not needed. |
+| Use Netwrix Auditor notification settings | Select this option to use modern authentication. Modern authentication must already be configured in the monitoring plan. If you select this option, the fields below aren't needed. |
| SMTP server | Enter your SMTP server address. It can be your company's Exchange server or any public mail server (e.g., Gmail, Yahoo). |
| Port number | Specify your SMTP server port number. |
| Sender address | Enter the address that will appear in the From field. **_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. |
@@ -78,8 +76,8 @@ new monitoring plan.
| Password | Enter a password for SMTP authentication. |
| Use Secure Sockets Layer encrypted connection (SSL) | Select this checkbox if your SMTP server requires SSL to be enabled. |
| Use implicit SSL | Select this checkbox if the implicit SSL mode is used, which means that an SSL connection is established before any meaningful data is sent. |
-| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option is not available for auditing User Activity as well Netwrix Auditor tools. |
-| Display the following From address in email notifications | Enter the address that will appear in the "_From_" field in email notifications. This option does not affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, make sure that your Exchange supports this option. |
+| Enforce certificate validation to ensure security | Select this checkbox if you want to verify security certificate on every email transmission. The option isn't available for auditing User Activity as well Netwrix Auditor tools. |
+| Display the following From address in email notifications | Enter the address that will appear in the "_From_" field in email notifications. This option doesn't affect notifications sent to users' managers and administrators. Before configuring the "_From_" field for user email notifications, ensure that your Exchange supports this option. |
**Step 7 –** Navigate to the **Advanced** tab and complete the following fields:
@@ -90,7 +88,7 @@ new monitoring plan.
| Attach reports as a CSV files | Select this option to receive reports attached to emails as CSV files. |
| Ignore users who must change password at next logon | Select this option to exclude users who must change password at next logon from reports. |
| Ignore users with the "_Password never expires_" option enabled | Select this option to exclude users with the "_Password never expires_" option enabled from reports. |
-| Ignore users who do not have email accounts | Select this option to exclude users who do not have email accounts from reports. |
+| Ignore users who don't have email accounts | Select this option to exclude users who don't have email accounts from reports. |
| Ignore users whose passwords have already expired | Select this option to exclude users whose passwords have already expired from reports. |
| Include data on expiring accounts | Select this option to include data on expiring domain accounts further to expiring passwords information. |
| Only report on users with fine-grained password policies applied | Select this option to include in reports only users who have fine-grained policies applied. |
diff --git a/docs/auditor/10.8/whats-new.md b/docs/auditor/10.8/whats-new.md
index e07ef6cd05..21f2e068a5 100644
--- a/docs/auditor/10.8/whats-new.md
+++ b/docs/auditor/10.8/whats-new.md
@@ -31,7 +31,7 @@ Enhanced database monitoring capabilities for Azure SQL environments:
## Enhanced Search and Monitoring Capabilities
### Advanced Search Features
-- **"Does not contain" Filter**: New filter option for the Details field provides more precise search capabilities
+- **"Doesn't contain" Filter**: New filter option for the Details field provides more precise search capabilities
- **Cancellable Searches**: Improved user experience with the ability to cancel long-running searches on large datasets
### Exchange Online Enhancements
diff --git a/docs/auditor/10.9/accessreviews/accessreviews.md b/docs/auditor/10.9/accessreviews/accessreviews.md
index 1243a5901a..eda8ce5135 100644
--- a/docs/auditor/10.9/accessreviews/accessreviews.md
+++ b/docs/auditor/10.9/accessreviews/accessreviews.md
@@ -24,15 +24,15 @@ the following data sources:
This workflow assumes you already have Netwrix Auditor installed with configured monitoring plans
for a supported data source.
-**NOTE:** Access Reviews is a separately licensed product and is not included with Netwrix Auditor.
-Make sure that you have the Access Reviews license enabled in Auditor.
+**NOTE:** Access Reviews is a separately licensed product and isn't included with Netwrix Auditor.
+ensure that you have the Access Reviews license enabled in Auditor.
See the [Licenses](/docs/auditor/10.9/admin/settings/licenses.md) topic for additional information.
_Remember,_ there is one single Access Review license for all data sources that can send data to the
application.
-Follow the steps to use Netwrix Auditor Access Reviews in conjunction with Auditor.
+To use Netwrix Auditor Access Reviews with Auditor:
**Step 1 –** Install Access Reviews on the same computer where Netwrix Auditor is installed. See the
[Installation Overview](/docs/auditor/10.9/accessreviews/installation/overview.md) topic for prerequisites and
@@ -42,7 +42,7 @@ additional information.
the Administrator role. See the [Administrator Overview](/docs/auditor/10.9/accessreviews/admin/overview.md) topic
for configuration settings and enabling user access.
-**Step 3 –** Use the Access reviews configuration tool to setup the data flow from the Auditor
+**Step 3 –** Use the Access reviews configuration tool to set up the data flow from the Auditor
database to the Access Reviews database. See the
[Select Data Sources](/docs/auditor/10.9/accessreviews/installation/accessreviewsconfiguration.md) topic for additional information.
@@ -70,21 +70,21 @@ Netwrix Auditor Access Reviews is now configured and ready to use.
Review the following considerations:
-1. Enabling State-in-Time data collection for your monitoring plans option is not required for the
- integration works properly.
+1. Enabling State-in-Time data collection for your monitoring plans isn't required for the
+ integration to work properly.
2. The data collected by Auditor is updated at least once a day.
-3. If a monitoring plan or a data source with enabled integration is deleted, all collected data
- will be removed from the Access Reviews database.
-4. If there are errors in upload of data to the Access Reviews database, these errors are reflected
- in the Netwrix Auditor Health Log and text log files; status of items and data sources in Auditor
- is not affected by these errors.
+3. Deleting a monitoring plan or a data source with enabled integration removes all collected data
+ from the Access Reviews database.
+4. If errors occur uploading data to the Access Reviews database, the Netwrix Auditor Health Log
+ and text log files record these errors; these errors don't affect the status of items and data
+ sources in Auditor.
5. Permissions-related considerations:
- - For Windows File Servers, permission data for all items in this data source is sent to the
- Access Reviews application;
- - Only effective top-level permissions are sent (share+NTFS);
- - Permission data is sent per file server (entirely for each server);
- - Transfer of permission data to the Access Reviews application is started when you enable the
+ - For Windows File Servers, Auditor sends permission data for all items in this data source to
+ the Access Reviews application;
+ - Auditor sends only effective top-level permissions (share+NTFS);
+ - Auditor sends permission data per file server (entirely for each server);
+ - Transferring permission data to the Access Reviews application starts when you enable the
integration for a data source.
## Initial Configuration
@@ -100,14 +100,14 @@ Review the following considerations:
[Modify the Builtin Administrator Account](/docs/auditor/10.9/accessreviews/admin/configuration/consoleaccess.md#modify-the-builtin-administrator-account)
topic for additional information.
- - Notification — Configure the Notification settings required in order for the application to
- send email. See the
+ - Notification — Configure the Notification settings required for the application to send
+ email. See the
[Notifications Page](/docs/auditor/10.9/accessreviews/admin/configuration/notifications.md) topic for
information.
## Enable Console Users
- Access Reviews Console users granted one of the available roles should be notified.
+ Notify Access Reviews Console users granted one of the available roles.
**_RECOMMENDED:_** The notification should include:
@@ -130,7 +130,7 @@ Review the following considerations:
## Resource Ownership Configuration
- Ownership of resources must be assigned in order to use the Access Reviews workflow:
+ You must assign ownership of resources to use the Access Reviews workflow:
- Resource Ownership — Assign ownership for resources to be managed through the application. See
the [Resource Owners Interface](/docs/auditor/10.9/accessreviews/resourceowners/interface/interface.md) topic for
@@ -151,6 +151,6 @@ Review the following considerations:
**_RECOMMENDED:_** Set expectations for response time from owners.
- Reviews can be run multiple times, maintaining a historical record for each instance. See the
+ You can run reviews multiple times, maintaining a historical record for each instance. See the
[Reviews Overview](/docs/auditor/10.9/accessreviews/entitlementreviews/overview.md) topic for additional
information.
diff --git a/docs/auditor/10.9/accessreviews/admin/additionalconfig/emailtemplates.md b/docs/auditor/10.9/accessreviews/admin/additionalconfig/emailtemplates.md
index 78d013597c..959bed97aa 100644
--- a/docs/auditor/10.9/accessreviews/admin/additionalconfig/emailtemplates.md
+++ b/docs/auditor/10.9/accessreviews/admin/additionalconfig/emailtemplates.md
@@ -6,9 +6,9 @@ sidebar_position: 10
# Email Templates
-The HTML templates used to format notification email can be customized. These templates are designed
-to make the message viewable within an email client. It is recommended to edit text and layout as
-desired, but NOT to embed new images or logos. The following table shows the notification email
+You can customize the HTML templates used to format notification email. These templates are designed
+to make the message viewable within an email client. Netwrix recommends editing text and layout as
+needed, but not embedding new images or logos. The following table shows the notification email
templates and describes the purpose of each.
| Template Name | Message Type Description |
@@ -23,11 +23,11 @@ provide the message with dynamic content, i.e. inserting values and strings from
the static portion of the message body. These Substitution Tokens begin and end with the “@” symbol,
e.g. @UserName@.
-Substitution Tokens are only valid for certain Notification message templates. Below is a table of
-the Substitution Tokens, the value or string they represent, and the message templates in which they
-may be used.
+Substitution Tokens are only valid for certain Notification message templates. The following table
+lists the Substitution Tokens, the value or string they represent, and the message templates in
+which they may be used.
-| Substitution Token | Description | Applicable Template(s) |
+| Substitution Token | Description | Applicable Templates |
| --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------ |
| @LoginUrl@ | URL that allows a user to access the default (login) page | OwnershipChangeNotification ReminderDigest |
| @ResourceDescription@ | Description of resource - To use the resource's description in emails instead of the path, replace @ResourcePath@ with @ResourceDescription@ | OwnershipConfirm ReminderDigest |
@@ -39,14 +39,13 @@ may be used.
## Customize Email Templates
-Email templates are shipped in a ZIP file and stored in the Access Reviews installation directory:
+The Access Reviews installation directory contains the email templates in a ZIP file:
...\Netwrix\Access Reviews
-Follow the steps to customize the email templates.
+To customize the email templates:
-**NOTE:** To successfully modify these Notifications email templates, a familiarity with basic HTML
-is necessary.
+**NOTE:** To modify these Notifications email templates, you need basic HTML knowledge.
@@ -60,20 +59,20 @@ installation directory to be preserved during future application upgrades.
-**Step 3 –** Locate the desired HTML message template.
+**Step 3 –** Locate the HTML message template you want.
**Step 4 –** Open the file with a text editor, e.g. Notepad, and customize the email body.
**NOTE:** Using a tool other than a text editor to edit HTML files, such as a WYSIWYG web page
-editor which may drastically alter the underlying HTML code, is not supported.
+editor which may drastically alter the underlying HTML code, isn't supported.
-**Step 5 –** Email subject lines can be edited by changing the text between the opening ``
+**Step 5 –** Edit email subject lines by changing the text between the opening `<title>`
tag and the closing `` tag.
-**Step 6 –** After making changes, save the file and view it within a web browser to see what the
-changes will look like. The Substitution Tokens will display without supplied values.
+**Step 6 –** After making changes, save the file and view it in a web browser to see what the
+changes look like. The Substitution Tokens display without supplied values.
-**Step 7 –** After making the desired changes, save and close the text editor. Then re-launch the
+**Step 7 –** After making your changes, save the file, close the text editor, and relaunch the
application.
-The modifications to the HTML email templates are in use by the notification emails.
+The notification emails use your modified HTML email templates.
diff --git a/docs/auditor/10.9/accessreviews/admin/additionalconfig/overview.md b/docs/auditor/10.9/accessreviews/admin/additionalconfig/overview.md
index 34a926b05b..2ea1678a0c 100644
--- a/docs/auditor/10.9/accessreviews/admin/additionalconfig/overview.md
+++ b/docs/auditor/10.9/accessreviews/admin/additionalconfig/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# Additional Configuration Options
-In addition to the settings that are available on the Configuration interface, the following
-configurations and customizations can be done by Administrators:
+In addition to the settings available on the Configuration interface, Administrators can make the
+following configurations and customizations:
- [Email Templates](/docs/auditor/10.9/accessreviews/admin/additionalconfig/emailtemplates.md)
- [Timeout Parameter](/docs/auditor/10.9/accessreviews/admin/additionalconfig/timeoutparameter.md)
diff --git a/docs/auditor/10.9/accessreviews/admin/additionalconfig/timeoutparameter.md b/docs/auditor/10.9/accessreviews/admin/additionalconfig/timeoutparameter.md
index 25b9fef5ae..4d9396c7ac 100644
--- a/docs/auditor/10.9/accessreviews/admin/additionalconfig/timeoutparameter.md
+++ b/docs/auditor/10.9/accessreviews/admin/additionalconfig/timeoutparameter.md
@@ -6,23 +6,23 @@ sidebar_position: 20
# Timeout Parameter
-A user session will end when the timeout parameter for inactivity has been reached, and the user
-will be logged out. By default this is set to 15 minutes.
+A user session ends when the timeout parameter for inactivity is reached, and Access Reviews logs
+out the user. By default, this is set to 15 minutes.
-The timeout parameter is configured within the `AccessInformationCenter.Service.exe.Config` file in
+You configure the timeout parameter in the `AccessInformationCenter.Service.exe.Config` file in
the Access Reviews installation directory:
...\Netwrix\Access Reviews
-Follow the steps to modify the timeout parameter.
+To modify the timeout parameter:
**Step 1 –** Open the `AccessInformationCenter.Service.exe.Config` file with a text editor, e.g.
Notepad.
-**Step 2 –** Change the value for the `AuthSessionTimeout` parameter to the desired number of
-minutes. For example:
+**Step 2 –** Change the value for the `AuthSessionTimeout` parameter to the number of minutes you
+want. For example:
diff --git a/docs/auditor/10.9/accessreviews/admin/configuration/activedirectory.md b/docs/auditor/10.9/accessreviews/admin/configuration/activedirectory.md
index 9f697ae791..dbd60a989b 100644
--- a/docs/auditor/10.9/accessreviews/admin/configuration/activedirectory.md
+++ b/docs/auditor/10.9/accessreviews/admin/configuration/activedirectory.md
@@ -41,8 +41,7 @@ _Remember,_ click **Save** when any changes are made to this page.
## Update the Active Directory Service Account Password
-Follow the steps to update the Active Directory service account password. These steps only apply for
-the **Use the following Active Directory account** option.
+These steps apply only to the **Use the following Active Directory account** option.
**Step 1 –** On the Active Directory page, enter the new password in the correct field.
diff --git a/docs/auditor/10.9/accessreviews/admin/configuration/consoleaccess.md b/docs/auditor/10.9/accessreviews/admin/configuration/consoleaccess.md
index 20bbddf2fe..f77cc7bf65 100644
--- a/docs/auditor/10.9/accessreviews/admin/configuration/consoleaccess.md
+++ b/docs/auditor/10.9/accessreviews/admin/configuration/consoleaccess.md
@@ -20,20 +20,20 @@ There are two levels of access, or roles, which can be granted to domain users o
has created.
- Access can be limited by resource types (File System, SharePoint, or Active Directory)
-**CAUTION:** Before disabling the Builtin Administrator account, it is necessary to first assign at
+**CAUTION:** Before disabling the Builtin Administrator account, you must first assign at
least one domain user account to the Administrator role. Login with another Administrator account to
disable the Builtin Administrator. Failure to do this could result in being locked-out of the
Configuration interface. As an alternative to disabling this account, the password can be changed.
See the Modify the Builtin Administrator Account topic for additional information.
Once users have been granted console access, they can login with their domain credentials. Console
-access is not a requirement for owners to complete Access Reviews. See the
+access isn't a requirement for owners to complete Access Reviews. See the
[URL & Login](/docs/auditor/10.9/accessreviews/admin/login.md) topic for information on how users will log in and where they are
directed after login based on their assigned role or lack of role.
## Add Console Users
-Follow the steps to grant domain users or groups console access.
+To grant domain users or groups console access:
@@ -44,8 +44,8 @@ Access wizard opens.
**Step 2 –** On the Select Trustee page, enter the following information and click Next:
-- Domain — If the Access Reviews Console has been configured for multiple domains, use the drop-down
- menu to select the desired domain
+- Domain — If the Access Reviews Console has been configured for multiple domains, use the dropdown
+ menu to select the domain you want
- Search — Begin typing the sAMAccountName or display name and the field will auto-populate options
from Active Directory sAMAccountName
@@ -53,7 +53,7 @@ Access wizard opens.
**Step 3 –** On the Select Access page, enter the following information and click **Finish**:
-- Select a role for this trustee – Select a role from the drop down list:
+- Select a role for this trustee – Select a role from the dropdown list:
- Unlimited Access — The Administrator role grants unlimited access
- Limited Access — All other roles can be granted limited access
@@ -61,23 +61,23 @@ Access wizard opens.
- Allow access to the following resource — When enabled, users can be limited to only having
visibility into data for the selected types of resources. Check the boxes for the type of resource
data to be made available to this user.
-- Access is enabled – A user's account must be enabled in order to log into the console. Unchecking
- this option allows you to configure access to be granted at a future time.
+- Access is enabled – A user's account must be enabled to log into the console. Uncheck this
+ option to grant access at a future time.
**Step 4 –** The new user displays in the list on the Console Access page. Repeat these steps for
each trustee to be granted console access.
-Once the first user with the role of Administrator has been added, the Builtin Administrator account
-can be disabled by that user. See the Modify the Builtin Administrator Account topic for additional
+After you add the first user with the Administrator role, that user can disable the Builtin
+Administrator account. See the Modify the Builtin Administrator Account topic for additional
information.
## Modify Console Users
-Follow the steps to modify a user’s console access.
+To modify a user’s console access:
-**NOTE:** These steps are for modifying domain users with console access roles and do not apply to
+**NOTE:** These steps are for modifying domain users with console access roles and don't apply to
the Builtin Administrator account. See the Modify the Builtin Administrator Account topic for
additional information.
@@ -86,9 +86,9 @@ modified and click Modify. The Console Access wizard opens to the Select Access
-**Step 2 –** Modify the desired settings and click **Finish**:
+**Step 2 –** Modify the settings you want and click **Finish**:
-- Select a role for this trustee – Select a role from the drop down list:
+- Select a role for this trustee – Select a role from the dropdown list:
- Unlimited Access — The Administrator role grants unlimited access
- Limited Access — All other roles can be granted limited access
@@ -100,17 +100,17 @@ modified and click Modify. The Console Access wizard opens to the Select Access
visibility into data for specific servers. Begin typing server names and the field will
auto-populate with known servers from scanned data. A resource type appears in parentheses after
the host name for quick reference.
-- Access is enabled – A user's account must be enabled in order to log into the console. Unchecking
- this option allows you to configure access to be granted at a future time.
+- Access is enabled – A user's account must be enabled to log into the console. Uncheck this
+ option to grant access at a future time.
Any modifications to the user’s role are visible in the list on the Console Access page.
## Delete Console Users
-**CAUTION:** Confirmation is not requested when deleting users. An alternative to deleting a console
+**CAUTION:** Confirmation isn't requested when deleting users. An alternative to deleting a console
user is to disable their access. See the Modify Console Users topic for additional information.
-Follow the steps to remove a user’s configured console access.
+To remove a user’s configured console access:
@@ -132,8 +132,8 @@ Administrator account and click **Modify**. The Builtin Administrator window ope
**Step 2 –** Modify the account as desired and click **OK**:
-- Access is enabled — Indicates whether the account can be used to login
-- Change Password — Allows you to change the password for this Builtin Administrator account. Check
+- Access is enabled — Indicates whether you can use the account to log in
+- Change Password — Use this option to change the password for this Builtin Administrator account. Check
the box and enter the new password in both entry fields. The password must be eight or more
characters long.
diff --git a/docs/auditor/10.9/accessreviews/admin/configuration/database.md b/docs/auditor/10.9/accessreviews/admin/configuration/database.md
index 09d7654a58..d9f37d61c6 100644
--- a/docs/auditor/10.9/accessreviews/admin/configuration/database.md
+++ b/docs/auditor/10.9/accessreviews/admin/configuration/database.md
@@ -7,8 +7,8 @@ sidebar_position: 40
# Database Page
The Access Reviews application must have access to the SQL Server hosting the database. It is
-configured during installation. If it is necessary to modify these setting after installation, that
-is done on the Database Page of the Configuration interface.
+configured during installation. If you need to modify these settings after installation, do so on
+the Database page of the Configuration interface.
@@ -45,8 +45,7 @@ _Remember,_ click **Save** when any changes are made to this page.
## Update the Database Service Account Password
-Follow the steps to update the Database service account password. These steps only apply for the SQL
-Authentication option.
+These steps apply only to the SQL Authentication option.
**Step 1 –** On the Database page, enter the new password in the correct field.
diff --git a/docs/auditor/10.9/accessreviews/admin/configuration/diagnostics.md b/docs/auditor/10.9/accessreviews/admin/configuration/diagnostics.md
index bd7ec27de8..bcbcaffb85 100644
--- a/docs/auditor/10.9/accessreviews/admin/configuration/diagnostics.md
+++ b/docs/auditor/10.9/accessreviews/admin/configuration/diagnostics.md
@@ -16,8 +16,7 @@ download the archive of all application logs.
## Debug Logs
-When requested by [Netwrix Support](https://www.netwrix.com/support.html) , follow the steps to
-provide debug logs.
+Provide debug logs when requested by [Netwrix Support](https://www.netwrix.com/support.html).
**Step 1 –** On the Diagnostics page, check the Enable debug logging box.
@@ -28,5 +27,5 @@ provide debug logs.
**Step 4 –** On the Diagnostics page, click **Download Logs**.
The downloaded logs have the debug logging information and can be sent to
-[Netwrix Support](https://www.netwrix.com/support.html). When your issue is resolved, do not forget
+[Netwrix Support](https://www.netwrix.com/support.html). When your issue is resolved, don't forget
to turn off Debug logs.
diff --git a/docs/auditor/10.9/accessreviews/admin/configuration/notifications.md b/docs/auditor/10.9/accessreviews/admin/configuration/notifications.md
index ce315f9fcb..04f4873537 100644
--- a/docs/auditor/10.9/accessreviews/admin/configuration/notifications.md
+++ b/docs/auditor/10.9/accessreviews/admin/configuration/notifications.md
@@ -18,8 +18,8 @@ for configuring weekly reminders for owners with outstanding reviews.
## Configure SMTP Server Settings
-SMTP server information is supplied and modified on the Notifications page. Follow the steps to
-configure or modify the SMTP settings.
+SMTP server information is supplied and modified on the Notifications page. To configure or
+modify the SMTP settings:
@@ -29,21 +29,18 @@ configure or modify the SMTP settings.
name (mail.example.com) or IP Address.
**Step 3 –** If needed, modify the Port used by your SMTP server to listen for new messages.
-Historically, the default for SMTP has been port 25. However, if a secure connection is desired
-(SSL/TLS), the SMTPS port needs to be changed, traditionally 465. Alternately, environments with
+Historically, the default for SMTP has been port 25. However, if you want a secure connection (SSL/TLS), change the SMTPS port—traditionally 465. Alternately, environments with
off-premises or outsourced email service, e.g. gmail.com, hotmail.com, etc., may have to supply a
-different submission port, traditionally port 587. Ultimately it is an organization’s
-email/messaging administrator who will know the proper value for the SMTP port.
+different submission port, traditionally port 587. Your organization’s email or messaging administrator will know the correct SMTP port value.
**Step 4 –** SMTP security settings:
-- Use a secure connection for this server (SSL/TLS) – Allows for the use of a secure transport layer
+- Use a secure connection for this server (SSL/TLS) – Enables a secure transport layer
for message relay requests (submissions) and authentication requests
- Enforce certificate validation to ensure security — Forces the use of certificate validation
- This server requires authentication – Enable if the identified SMTP server requires
- authentication. Some SMTP servers traditionally have been configured to deny all but anonymous
- relay requests, i.e. an attempt to authenticate results in a denial, while an anonymous request is
- not denied. Select this checkbox, and then select one of the following radio buttons if
+ authentication. Some SMTP servers have traditionally been configured to deny all but anonymous relay requests:
+ they deny authentication attempts but allow anonymous requests. Select this checkbox, and then select one of the following radio buttons if
authentication is required:
- Use the account running this service
@@ -78,7 +75,7 @@ Notification options.
## Notification Options
-Once the SMTP server is configured, there are additional options. Only the Reply-To field must be
+After you configure the SMTP server, there are additional options. Only the Reply-To field must be
populated:
@@ -111,8 +108,8 @@ Reminders section.
**Step 3 –** Set the date and time for when the reminder will be sent:
-- Day of the week – Select the day of the week from the drop-down menu
-- Time of day – Click on the field to open a clock window. Set the time of day reminders will be
+- Day of the week – Select the day of the week from the dropdown menu
+- Time of day – Click the field to open a clock window. Set the time of day reminders will be
sent, e.g. 12:00 AM
**Step 4 –** Click **Save**. Then click **OK** to confirm.
diff --git a/docs/auditor/10.9/accessreviews/admin/firstlaunch.md b/docs/auditor/10.9/accessreviews/admin/firstlaunch.md
index af325867f3..93997b7d97 100644
--- a/docs/auditor/10.9/accessreviews/admin/firstlaunch.md
+++ b/docs/auditor/10.9/accessreviews/admin/firstlaunch.md
@@ -15,8 +15,8 @@ Use this icon to launch the Access Reviews Console for the first time.
The Access Reviews application is installed with a Builtin Administrator account; "admin" is the
-User Name. You will be prompted to set the account's password. It must be eight or more characters
-long. After setting the password, you will need to login with the "admin" account.
+User Name. You must set the account's password, which must be eight or more characters long. After
+setting the password, log in with the "admin" account.
Using the Configuration interface, the Builtin Administrator account can be disabled once a domain
account has been granted the Administrator role. You can also change the password for the Builtin
@@ -26,13 +26,13 @@ topic for additional information.
-The Resource Owners interface opens. The first thing that should be done is to configure console
-access for domain users and configure notification settings. Select the Configuration tab. See the
+The Resource Owners interface opens. First, configure console access for domain users and
+configure notification settings. Select the Configuration tab. See the
[Console Access Page](/docs/auditor/10.9/accessreviews/admin/configuration/consoleaccess.md) and
[Notifications Page](/docs/auditor/10.9/accessreviews/admin/configuration/notifications.md) topics for additional information.
-The interfaces available to console users are controlled by the role assigned. Owners do not need to
-be assigned console access. See the [URL & Login](/docs/auditor/10.9/accessreviews/admin/login.md) topic for information on how users will
+The role assigned to a console user controls which interfaces that user can access. Owners don't
+need to be assigned console access. See the [URL & Login](/docs/auditor/10.9/accessreviews/admin/login.md) topic for information on how users
log in and where they are directed after login.
See the [Navigation](/docs/auditor/10.9/accessreviews/admin/navigate/navigate.md) topic for information on each of the interfaces.
diff --git a/docs/auditor/10.9/accessreviews/admin/login.md b/docs/auditor/10.9/accessreviews/admin/login.md
index 72c2b61d99..ffc448932e 100644
--- a/docs/auditor/10.9/accessreviews/admin/login.md
+++ b/docs/auditor/10.9/accessreviews/admin/login.md
@@ -1,21 +1,21 @@
---
-title: "URL & Login"
-description: "URL & Login"
+title: "URL & Login"
+description: "URL & Login"
sidebar_position: 50
---
-# URL & Login
+# URL & Login
-The Access Reviews Console can be accessed through a supported browser from a machine within your
+You can access the Access Reviews Console through a supported browser from a machine within your
company's network. The URL is the hosting machine's name and the
-port, http://[HOSTNAME.DOMAIN.COM]:81. For example, if the application was installed on a server
-named NEWYORKSRV10.NWXTech.com with the default port of 81, the URL would be
-http://NEWYORKSRV10.NWXTech.com:81.
+port, `http://[HOSTNAME.DOMAIN.COM]:81`. For example, if the application was installed on a server
+named NEWYORKSRV10.NWXTech.com with the default port of 81, the URL would be
+`http://NEWYORKSRV10.NWXTech.com:81`.
Administrators
Administrators with access to the server hosting the application can use the desktop icon to launch
-the application in their default browser. Alternatively, the localhost URL can be used:
+the application in their default browser. Alternatively, you can use the localhost URL:
- HTTP URL
@@ -27,25 +27,25 @@ the application in their default browser. Alternatively, the localhost URL can b
Remote Access
-Since Access Reviews is a browser-based application, it is possible to access the web interface
-remotely. It is up to the Administrator to provide users with the correct URL for access.
+Because Access Reviews is a browser-based application, you can access the web interface remotely.
+The Administrator is responsible for providing users with the correct URL for access.
Depending on your network environment, you may need to use the NetBIOS name, FQDN, or IP Address of
the hosting server in the browser. Also, additional configurations by network and system
administrators may be necessary to make the web server accessible to remote users (firewall
configurations, DNS settings, etc.).
-The server name in the URL can be replaced with an alias. See the
+You can replace the server name in the URL with an alias. See the
[Notification Options](configuration/notifications.md#notification-options) topic for additional
information.
## Login Page
-Users login with their domain credentials. If only one domain is known to the Access Reviews
-Console, the credentials need only be username and password. If multiple domains are known, then the
-username needs to be entered in the `domain\username` format.
+Users log in with their domain credentials. If only one domain is known to the Access Reviews
+Console, you only need a username and password. If multiple domains are known, enter the username
+in the `domain\username` format.
-**NOTE:** The URL may need to be added to the browser’s list of trusted sites.
+**NOTE:** You may need to add the URL to the browser's list of trusted sites.
@@ -53,37 +53,37 @@ The interface a user arrives at depends upon the assigned role or lack of assign
## User Landing Page
-Role based access controls what interfaces users can see and where each user is directed upon login.
+Role-based access controls what interfaces users can see and where each user goes upon login.
-**_RECOMMENDED:_** Send an email to your users. Let them know why you are implementing use of the
-application, provide the URL, and explain how to login with their domain credentials and the
+**_RECOMMENDED:_** Send an email to your users. Let them know why you're implementing the
+application, provide the URL, and explain how to log in with their domain credentials and the
username format. See the
-[Enable Console Users](/docs/auditor/10.9/accessreviews/accessreviews.md#enable-console-users) topic for additional
+[Enable Console Users](/docs/auditor/10.9/accessreviews/accessreviews.md) topic for additional
information.
### Administrator Role
-Users granted the Administrator role are directed to the Resource Owners interface upon login.
+Users granted the Administrator role go to the Resource Owners interface upon login.
Administrators are the only ones with access to the Configuration interface. The My Reviews
-interface is available if the logged in user is also assigned ownership of a resource.
+interface is available if the logged-in user is also assigned ownership of a resource.
### Security Team Role
-Users granted the Security Team role are directed to the Resource Owners interface upon login.
+Users granted the Security Team role go to the Resource Owners interface upon login.
Security Team members only lack access to the Configuration interface, which is only available to
-Administrators. The My Reviews interface is available if the logged in user is also assigned
+Administrators. The My Reviews interface is available if the logged-in user is also assigned
ownership of a resource.
### Owners Without Role
-Users assigned ownership of a resource but not granted a user role are directed to the My Reviews
-interface upon login.
+Users assigned ownership of a resource but not granted a user role go to the My Reviews interface
+upon login.
diff --git a/docs/auditor/10.9/accessreviews/admin/navigate/datagrid.md b/docs/auditor/10.9/accessreviews/admin/navigate/datagrid.md
index aa531608c8..fa1de3dac9 100644
--- a/docs/auditor/10.9/accessreviews/admin/navigate/datagrid.md
+++ b/docs/auditor/10.9/accessreviews/admin/navigate/datagrid.md
@@ -10,7 +10,7 @@ The data grids within various tables have several features to improve your exper
## Search & Filter
-There is a Search box above a table's header row that can be used to filter the table data.
+Use the Search box above a table's header row to filter the table data.
@@ -18,8 +18,7 @@ Begin typing in the Search box. The filter acts as a wildcard, filtering the tab
## Column Filters
-There is a filter icon to the right of each column name that can be used to apply a column specific
-filter. You can apply filters to multiple columns simultaneously.
+Use the filter icon to the right of each column name to apply a column-specific filter. You can apply filters to multiple columns simultaneously.
@@ -36,25 +35,25 @@ filter, click the filter icon and click **Clear**.
## Resize Columns
-Table column widths can be resized to change the width.
+You can resize table column widths.
-Simply select the edges of the column headers and drag to the desired width.
+Select the edges of the column headers and drag to the width you want.
## Sort
-Data within a table can be sorted alphanumerically for a column.
+You can sort data within a table alphanumerically by column.
-Click on any column header. An arrow will appear next to the column name indicating the sort to be
+Click any column header. An arrow will appear next to the column name indicating the sort to be
ascending or descending order.
## Columns Selector
-Columns can be hidden or unhidden. Available columns for a table are listed in the column selector
-menu that appears when you right-click on a column header.
+You can hide or unhide columns. Available columns for a table are listed in the column selector
+menu that appears when you right-click a column header.
@@ -63,8 +62,8 @@ Unchecked columns are hidden.
## Exports
-There are two export buttons above a table's header row that can be used to export the data
-currently displayed within the table.
+Use the two export buttons above a table's header row to export the data
+displayed within the table.
diff --git a/docs/auditor/10.9/accessreviews/admin/navigate/editnotes.md b/docs/auditor/10.9/accessreviews/admin/navigate/editnotes.md
index e58e9797e9..b1a56e64a6 100644
--- a/docs/auditor/10.9/accessreviews/admin/navigate/editnotes.md
+++ b/docs/auditor/10.9/accessreviews/admin/navigate/editnotes.md
@@ -6,8 +6,7 @@ sidebar_position: 20
# Edit Notes Window
-The Edit Note window can be opened from a variety of interfaces. Follow the steps to add or edit a
-note.
+You can open the Edit Note window from a variety of interfaces. To add or edit a note:
**Step 1 –** Select the item in the interface and click Edit Notes. The Edit Notes window opens.
diff --git a/docs/auditor/10.9/accessreviews/admin/navigate/navigate.md b/docs/auditor/10.9/accessreviews/admin/navigate/navigate.md
index e95629431c..5c6c906b69 100644
--- a/docs/auditor/10.9/accessreviews/admin/navigate/navigate.md
+++ b/docs/auditor/10.9/accessreviews/admin/navigate/navigate.md
@@ -6,8 +6,8 @@ sidebar_position: 20
# Navigation
-The Access Reviews Console has four interfaces. Upon login, users granted console access are brought
-to the Resource Owners interface.
+The Access Reviews Console has four interfaces. Upon login, users granted console access arrive at
+the Resource Owners interface.
@@ -25,8 +25,8 @@ This interface is available only to users with the Administrator role. See the
For Security Team & Administrator
The Resource Owners tab opens the Resource Owners interface. Manage resource ownership by assigning
-owners to resources and requesting ownership confirmation. Resources to be included in the Access
-Reviews workflow must first be assigned at least one owner within the Resource Owners interface.
+owners to resources and requesting ownership confirmation. Before you can include a resource in the
+Access Reviews workflow, you must assign it at least one owner within the Resource Owners interface.
Assigned owners can log in to complete reviews.
This interface is available only to users with either the Security Team or Administrator role. See
@@ -34,8 +34,8 @@ the [Resource Owners Interface](/docs/auditor/10.9/accessreviews/resourceowners/
The Entitlement Reviews tab opens the Entitlement Reviews interface. Create and manage reviews.
There are two types of reviews for resources being managed within the Access Reviews application:
-resource Access reviews and group Membership reviews. This does require the Access Reviews
-application to be configured to send notifications.
+resource Access reviews and group Membership reviews. This requires configuring the Access Reviews
+application to send notifications.
This interface is available only to users with either the Security Team or Administrator role. See
the [Entitlement Reviews Interface](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/interface.md) topic for additional
@@ -44,17 +44,16 @@ information.
For Assigned Owner
The My Reviews tab opens the My Reviews interface. It is only visible if the logged in user is also
-an assigned owner of at least one resource. Assigned owners without a user role are directed to the
-My Reviews interface at login.
+an assigned owner of at least one resource. At login, the console directs assigned owners without a
+user role to the My Reviews interface.
-The My Reviews interface is available to any domain user who has been assigned ownership of a
-resource. See the [Owners & Access Reviews](/docs/auditor/10.9/accessreviews/owneroverview/owneroverview.md) topic for additional
+The My Reviews interface is available to any domain user assigned ownership of a resource. See the [Owners & Access Reviews](/docs/auditor/10.9/accessreviews/owneroverview/owneroverview.md) topic for additional
information.
## Interface Quick Reference
-The table below is a quick reference aligning each interface with its purpose, how to access it, and
-who has access to it:
+The following table is a quick reference aligning each interface with its purpose, how to access it,
+and who has access to it:
| Interface | Purpose | Opened By | Accessible To |
| ------------------- | --------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | ------------------------------------- |
diff --git a/docs/auditor/10.9/accessreviews/admin/overview.md b/docs/auditor/10.9/accessreviews/admin/overview.md
index 0910978440..88354970be 100644
--- a/docs/auditor/10.9/accessreviews/admin/overview.md
+++ b/docs/auditor/10.9/accessreviews/admin/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Administrator Overview
-Access Reviews administrators have access to the Configuration interface where there application
+Access Reviews administrators have access to the Configuration interface where the application
settings reside. This topic includes the following subtopics:
- [Getting Started](/docs/auditor/10.9/accessreviews/accessreviews.md#getting-started)
diff --git a/docs/auditor/10.9/accessreviews/admin/troubleshooting/credentialpasswords.md b/docs/auditor/10.9/accessreviews/admin/troubleshooting/credentialpasswords.md
index 9e147ebeed..9583004dba 100644
--- a/docs/auditor/10.9/accessreviews/admin/troubleshooting/credentialpasswords.md
+++ b/docs/auditor/10.9/accessreviews/admin/troubleshooting/credentialpasswords.md
@@ -6,8 +6,8 @@ sidebar_position: 30
# Update Credential Passwords
-Credential passwords occasionally need to be updated due to various reasons, such as security
-policies that require passwords to be reset on a regular basis. The following types of credentials
+You occasionally need to update credential passwords for various reasons, such as security
+policies that require regular password resets. The following types of credentials
may be impacted by password changes or security policies:
- Database service account
@@ -18,39 +18,39 @@ may be impacted by password changes or security policies:
## Database Service Account
-The Database service account grants access to the SQL Server database. It can be updated on the
+The Database service account grants access to the SQL Server database. You can update it on the
Database page of the Configuration interface. See the
[Update the Database Service Account Password](/docs/auditor/10.9/accessreviews/admin/configuration/database.md#update-the-database-service-account-password)
topic for instructions.
## Active Directory Service Account
-The Active Directory service account handles user authentication to the Access Reviews Console. It
-can be updated on the Active Directory page of the Configuration interface. See the
+The Active Directory service account handles user authentication to the Access Reviews Console. You
+can update it on the Active Directory page of the Configuration interface. See the
[Update the Active Directory Service Account Password](/docs/auditor/10.9/accessreviews/admin/configuration/activedirectory.md#update-the-active-directory-service-account-password)
topic for instructions.
## SMTP Authentication Service Account
An SMTP server is required for the application to send notifications. If the SMTP server requires
-authentication, the service account can be updated on the Notifications page of the Configuration
+authentication, you can update the service account on the Notifications page of the Configuration
interface. See the
[Configure SMTP Server Settings](/docs/auditor/10.9/accessreviews/admin/configuration/notifications.md#configure-smtp-server-settings)
topic for instructions.
## Application Service Account
-The account used to run the Netwrix Auditor Access Reviews service can be updated using Services
-Control Manager console. See the
+You can update the account used to run the Netwrix Auditor Access Reviews service by using the
+Services Control Manager console. See the
[Modify the Service Account via Service Control Manager](serviceaccount.md#modify-the-service-account-via-service-control-manager)
topic for instructions.
## Builtin Administrator Account
-The Builtin Administrator account is an application account that is created during the first launch.
-It is used to complete the initial configuration steps and to grant console access to domain users.
-This account can be disabled after Administrator users are added. However, if it is enabled and a
-security policy requires the password to be reset, it can be updated on the Console Access page of
-the Configuration interface. See the
+The Builtin Administrator account is an application account that the application creates during the
+first launch. You use it to complete the initial configuration steps and to grant console access to
+domain users. You can disable this account after you add Administrator users. However, if it remains
+enabled and a security policy requires you to reset the password, you can update it on the Console
+Access page of the Configuration interface. See the
[Modify the Builtin Administrator Account](/docs/auditor/10.9/accessreviews/admin/configuration/consoleaccess.md#modify-the-builtin-administrator-account)
topic for modification instructions.
diff --git a/docs/auditor/10.9/accessreviews/admin/troubleshooting/loglevel.md b/docs/auditor/10.9/accessreviews/admin/troubleshooting/loglevel.md
index bf5b6f4118..ef7466cbd5 100644
--- a/docs/auditor/10.9/accessreviews/admin/troubleshooting/loglevel.md
+++ b/docs/auditor/10.9/accessreviews/admin/troubleshooting/loglevel.md
@@ -11,7 +11,7 @@ Reviews installation directory:
...\Netwrix\Access Reviews
-Follow the steps to modify the log level.
+To modify the log level:
**Step 1 –** Open the `AccessInformationCenter.Service.exe.Config` file in a text editor, e.g.
Notepad.
@@ -20,7 +20,7 @@ Notepad.
**Step 2 –** The level value is set in the `LogLevel` parameter, where "2" is the default level. As
the logging level increases from 0 to 3, the types of information and level of detail included
-within the log file also increase. Change to the desired log level:
+within the log file also increase. Change to the log level you want:
diff --git a/docs/auditor/10.9/accessreviews/admin/troubleshooting/overview.md b/docs/auditor/10.9/accessreviews/admin/troubleshooting/overview.md
index 58f0ebe3d6..9a5b4ce637 100644
--- a/docs/auditor/10.9/accessreviews/admin/troubleshooting/overview.md
+++ b/docs/auditor/10.9/accessreviews/admin/troubleshooting/overview.md
@@ -6,16 +6,16 @@ sidebar_position: 60
# Troubleshooting
-The following are several troubleshooting tips that can assist with diagnosing trouble with the
-Access Reviews application. If engaging with
-[Netwrix Support](https://www.netwrix.com/support.html), it will be useful to be aware of these.
+The following troubleshooting tips can help you diagnose issues with the Access Reviews application.
+Keep them in mind when you contact
+[Netwrix Support](https://www.netwrix.com/support.html).
Configuration of Permissions on the Installation Directory:
The Windows service account running the Netwrix Auditor Access Reviews service may be used as the
Database service account, the Active Directory service account, and/or the SMTP authentication
account. Check the Database, Active Directory, and Notification pages in the Configuration interface
-to confirm where the account is in use before modifying it to ensure these functionality are not
+to confirm where the account is in use before modifying it to ensure this functionality isn't
impaired. If this account is changed, a new account must have the **Full Control** permission to
files and folders in the Access Reviews installation directory. See the
[Application Service Account](/docs/auditor/10.9/accessreviews/admin/troubleshooting/serviceaccount.md) topic for additional information.
@@ -27,7 +27,7 @@ Netwrix Support, you can enable Debug level from the Diagnostics page of the Con
interface. See the [Diagnostics Page](/docs/auditor/10.9/accessreviews/admin/configuration/diagnostics.md) topic for additional
information.
-If a different log level is needed or desired, the `aic.log` file can be modified. See the
+If you need a different log level, you can modify the `aic.log` file. See the
[Change Log Level](/docs/auditor/10.9/accessreviews/admin/troubleshooting/loglevel.md) topic for additional information.
Credential Password Changes:
diff --git a/docs/auditor/10.9/accessreviews/admin/troubleshooting/serviceaccount.md b/docs/auditor/10.9/accessreviews/admin/troubleshooting/serviceaccount.md
index 7ae8cb036b..5b0493725b 100644
--- a/docs/auditor/10.9/accessreviews/admin/troubleshooting/serviceaccount.md
+++ b/docs/auditor/10.9/accessreviews/admin/troubleshooting/serviceaccount.md
@@ -9,7 +9,7 @@ sidebar_position: 20
The Windows service account running the Netwrix Auditor Access Reviews service may be used as the
Database service account, the Active Directory service account, and/or the SMTP authentication
account. Check the Database, Active Directory, and Notification pages in the Configuration interface
-to confirm where the account is in use before modifying it to ensure these functionality are not
+to confirm where the account is in use before modifying it to ensure this functionality isn't
impaired. If the same account is being used for multiple purposes, it will require the proper
permissions for each purpose.
@@ -24,15 +24,15 @@ Control over the installation directory:
## Modify the Service Account via Service Control Manager
-Follow the steps to enable and/or modify the Windows service account running the Netwrix Auditor
-Access Reviews service.
+To enable or modify the Windows service account running the Netwrix Auditor Access Reviews
+service:
**Step 1 –** Navigate to Service Control Manager (`services.msc`). The Services Control Manager
opens.
-**Step 2 –** Right-click on the Netwrix Auditor Access Reviews service and select **Properties**.
+**Step 2 –** Right-click the Netwrix Auditor Access Reviews service and select **Properties**.
The service Properties window opens.
@@ -42,7 +42,7 @@ using NTAccount format [```DOMAIN\username```]. Optionally, use the **Browse** b
the account. Enter the account's password in both the **Password** and **Confirm password** fields.
Then click **OK**. The Properties window closes.
-**Step 4 –** The selected account is displayed in the Log On As column for the service. Either
-Restart or Stop and Start the service for this change to take effect.
+**Step 4 –** The Log On As column for the service displays the selected account. Either
+restart or stop and start the service for this change to take effect.
The Netwrix Auditor Access Reviews service is now running with the supplied Windows account.
diff --git a/docs/auditor/10.9/accessreviews/entitlementreviews/approvalprocess/approvalprocess.md b/docs/auditor/10.9/accessreviews/entitlementreviews/approvalprocess/approvalprocess.md
index 1d9b857edc..1a206d45be 100644
--- a/docs/auditor/10.9/accessreviews/entitlementreviews/approvalprocess/approvalprocess.md
+++ b/docs/auditor/10.9/accessreviews/entitlementreviews/approvalprocess/approvalprocess.md
@@ -20,7 +20,7 @@ decline, or defer all owner-recommended changes for a review.
## Process Owner Responses
-Follow the steps to perform a granular review of a resource owner's recommended changes.
+To perform a granular review of a resource owner's recommended changes:
**Step 1 –** On the Manage Reviews page, select a review and click **View Details**. The Review
Details page opens.
@@ -33,7 +33,7 @@ opens.
**Step 3 –** By default, the table displays only the recommended changes. Select an item and click
-the desired action button: Accept, Decline, or Defer. The Approval column icon updates. See the
+the action button you want: Accept, Decline, or Defer. The Approval column icon updates. See the
[View Responses Window](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/viewresponses.md) topic for additional information.
**Step 4 –** Repeat Step 3 until all changes have been processed. Then click **Close**. The View
@@ -41,38 +41,38 @@ Responses window closes.
**Step 5 –** Repeat Steps 2-4 for each resource included in the review.
-**Step 6 –** Remediation of the accepted changes must be done manually. Accepted changes must be
-implemented outside of the application by your IT department. Use the **Export Excel** or **Export
+**Step 6 –** Your IT department must manually remediate accepted changes outside of the
+application. Use the **Export Excel** or **Export
CSV** buttons to generate and download an export of accepted changes.
-**Step 7 –** When remediation is complete, return to the Mange Reviews page (click on the
+**Step 7 –** When remediation is complete, return to the Manage Reviews page (click the
breadcrumb). Select the review in the list and click **Mark Completed**.
The review remains marked as Completed until the next instance is started.
## Batch Processing
-Follow the steps to perform a batch processing of a resource owner's recommended changes.
+To batch process a resource owner's recommended changes:
**Step 1 –** On the Manage Reviews page, select a review and click **View Details**. The Review
Details page opens. .
-**Step 2 –** Select a resource in the list and open the **Process Changes** drop-down menu.
+**Step 2 –** Select a resource in the list and open the **Process Changes** dropdown menu.
-**Step 3 –** Select the desired action for all recommended changes: Accept, Decline, or Defer.
+**Step 3 –** Select the action you want for all recommended changes: Accept, Decline, or Defer.
-_Remember,_ all recommended changes for the selected resource will be processed with the same
-resolution.
+_Remember,_ this applies the same resolution to all recommended changes for the selected
+resource.
**Step 4 –** Repeat Steps 2-3 for each resource included in the review.
-**Step 5 –** Remediation of the accepted changes must be done manually. Accepted changes must be
-implemented outside of the application by your IT department. Use the **Export Excel** or **Export
+**Step 5 –** Your IT department must manually remediate accepted changes outside of the
+application. Use the **Export Excel** or **Export
CSV** buttons to generate and download an export of accepted changes.
-**Step 6 –** When remediation is complete, return to the Mange Reviews page (click on the
+**Step 6 –** When remediation is complete, return to the Manage Reviews page (click the
breadcrumb). Select the review in the list and click **Mark Completed**.
The review remains marked as Completed until the next instance is started.
diff --git a/docs/auditor/10.9/accessreviews/entitlementreviews/approvalprocess/removechanges.md b/docs/auditor/10.9/accessreviews/entitlementreviews/approvalprocess/removechanges.md
index c5066eb0cf..fa9181b2ec 100644
--- a/docs/auditor/10.9/accessreviews/entitlementreviews/approvalprocess/removechanges.md
+++ b/docs/auditor/10.9/accessreviews/entitlementreviews/approvalprocess/removechanges.md
@@ -6,13 +6,13 @@ sidebar_position: 10
# Remove Changes Window
-Select the desired resource on a Review Details page and click **Remove Changes**. The Remove
+Select the resource you want on a Review Details page and click **Remove Changes**. The Remove
changes window opens to confirm the action.
**CAUTION:** This will clear all owner-recommended changes and notes for the resource. The owner
-will be required to complete the review again.
+must complete the review again.
Click Yes to clear owner-recommended changes. Click No to cancel it. The Remove changes window
closes.
diff --git a/docs/auditor/10.9/accessreviews/entitlementreviews/create/create.md b/docs/auditor/10.9/accessreviews/entitlementreviews/create/create.md
index 9fe461fb6b..82bd0def2a 100644
--- a/docs/auditor/10.9/accessreviews/entitlementreviews/create/create.md
+++ b/docs/auditor/10.9/accessreviews/entitlementreviews/create/create.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Create Review Wizard
-The Create Review wizard is opened with the **Create** button on the Entitlement Reviews interface.
+You open the Create Review wizard with the **Create** button on the Entitlement Reviews interface.
See the [Manage Reviews Page](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/interface.md#manage-reviews-page) topic for additional information.
@@ -32,7 +32,7 @@ See the Create a Review topic for additional information.
## Create a Review
-Follow the steps to create a review.
+To create a review:
**Step 1 –** On the Manage Reviews page, click Create. The Create Review wizard opens.
@@ -50,8 +50,8 @@ Follow the steps to create a review.
-**Step 3 –** On the Resources page, select the resources to be included in the review. The Search
-feature is available to filter the list of available resource that match the type of review being
+**Step 3 –** On the Resources page, select the resources to be included in the review. Use the
+Search feature to filter the list of available resources that match the type of review being
created.
- The table displays the following information:
@@ -62,18 +62,18 @@ created.
- Description — Description or explanation of the resource as supplied by either the Ownership
Administrator or the assigned owner
- Reviewer — Primary owner assigned to the resource
- - Confirmed — Indicates whether or not the assigned owner has confirmed ownership of that
+ - Confirmed — Indicates whether the assigned owner has confirmed ownership of that
resource. Tool-tips display when hovering over the icons indicating whether the resource
ownership has been confirmed, declined, pending response, or that a confirmation has not been
requested.
- Scan Data — A checkmark indicates the resource has been scanned. Only resources with scan data
can be included in a review.
-- Select the desired resource(s) and click **Add**. The **View Selections** button indicates how
+- Select the resources you want and click **Add**. The **View Selections** button indicates how
many resources have been selected. Click the button to open the Selected Resources window, where
you can view and modify the selections. See the
[Selected Resources Window](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/selectedresources.md) topic for additional information.
-- Once the desired resources have been selected, click **Next**.
+- After you select the resources you want, click **Next**.
@@ -81,8 +81,8 @@ created.
create the review. Action status displays on the page. When the update has completed (100%), click
Close. The Create Review wizard closes.
-The new review displays in the table on the Manage Reviews page. An email was sent to the primary
-owner assigned to the resource(s) in this review. By default, the application is configured to send
-notifications only to the primary owner. However, this can be customized on the Configuration >
+The new review displays in the table on the Manage Reviews page. Access Reviews sends an email to
+the primary owner assigned to the resources in this review. By default, the application sends
+notifications only to the primary owner. However, you can customize this on the Configuration >
Notifications page to send notifications to all assigned owners. See the
[Notifications Page](/docs/auditor/10.9/accessreviews/admin/configuration/notifications.md) topic for additional information.
diff --git a/docs/auditor/10.9/accessreviews/entitlementreviews/create/reviewinstances.md b/docs/auditor/10.9/accessreviews/entitlementreviews/create/reviewinstances.md
index 522c474a35..5a79bfd43f 100644
--- a/docs/auditor/10.9/accessreviews/entitlementreviews/create/reviewinstances.md
+++ b/docs/auditor/10.9/accessreviews/entitlementreviews/create/reviewinstances.md
@@ -6,16 +6,16 @@ sidebar_position: 10
# Review Instances
-After a review has been completed, it can be run again, which creates multiple instances of the
+After you complete a review, you can run it again, which creates multiple instances of the
review. Each instance is identified by date timestamps indicating its start and end times.
-**_RECOMMENDED:_** Prior to running another review instance, ensure the most up to date information
+**_RECOMMENDED:_** Before running another review instance, ensure the most up to date information
is available to owners for review.
-On the Manage Reviews page in the Entitlement Reviews interface, a review with a Completed status
-can be started again. Select the review and click **Run Again**. The Create Review wizard opens
-without the Review Type page. The review can be run as-is by navigating through the wizard with the
-**Next** buttons, or you can modify as desired. Completing the wizard process restarts the review.
+On the Manage Reviews page in the Entitlement Reviews interface, you can restart a review with a
+Completed status. Select the review and click **Run Again**. The Create Review wizard opens
+without the Review Type page. You can run the review as-is by navigating through the wizard with
+the **Next** buttons, or modify it as needed. Completing the wizard process restarts the review.
See the [Create Review Wizard](/docs/auditor/10.9/accessreviews/entitlementreviews/create/create.md) topic for additional information.
diff --git a/docs/auditor/10.9/accessreviews/entitlementreviews/interface/deletereview.md b/docs/auditor/10.9/accessreviews/entitlementreviews/interface/deletereview.md
index 72a62c7c7b..c5cd1fb083 100644
--- a/docs/auditor/10.9/accessreviews/entitlementreviews/interface/deletereview.md
+++ b/docs/auditor/10.9/accessreviews/entitlementreviews/interface/deletereview.md
@@ -17,7 +17,7 @@ The Delete Review window opens from either the
## Delete Entire Review
-Select the desired review on the Manage Reviews page and click **Delete**. The Delete Review window
+Select the review you want on the Manage Reviews page and click **Delete**. The Delete Review window
opens to confirm the action.
@@ -29,7 +29,7 @@ Click **Yes** to complete the deletion. Click **No** to cancel it. The Delete Re
## Delete Review Instance
-Select the desired review instance from the drop-down menu on the Review Details page and click
+Select the review instance you want from the dropdown menu on the Review Details page and click
**Delete**. The Delete Review window opens to confirm the action.
diff --git a/docs/auditor/10.9/accessreviews/entitlementreviews/interface/interface.md b/docs/auditor/10.9/accessreviews/entitlementreviews/interface/interface.md
index 5623addb7b..33852d42ea 100644
--- a/docs/auditor/10.9/accessreviews/entitlementreviews/interface/interface.md
+++ b/docs/auditor/10.9/accessreviews/entitlementreviews/interface/interface.md
@@ -45,14 +45,14 @@ The information displayed in the table includes:
- Responses awaiting review — Owners completed reviews. Waiting on Review Administrator's
approval.
- - All responses processed — Reviews have been approved by Review Administrators. The review can
- be marked as completed.
+ - All responses processed — Review Administrators have approved the reviews. You can mark the
+ review as completed.
- Stopped — Indicates that the review was stopped and is considered complete even if all of the
responses have not been received or processed. The review remains static until it is run
again.
- Completed — Indicates the Review Administrator has processed the owners' responses. The review
- remains static until it is run again. This status can appear by accepting the review as-is
- with the Mark Completed button.
+ remains static until it is run again. This status appears when you accept the review as-is by
+ clicking **Mark Completed**.
- Created By — Name of the Review Administrator who create the review
- Created On — Date timestamp for when the review was created. If it has been run multiple times,
@@ -69,7 +69,7 @@ Use the buttons at the bottom to conduct the following actions:
| -------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Create | Launches the Create Review wizard for creating a new review. See the [Create Review Wizard](/docs/auditor/10.9/accessreviews/entitlementreviews/create/create.md) topic for additional information. |
| Rename | Opens the Rename Review window for modifying the review name. See the [Rename Review Window](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/renamereview.md) topic for additional information. |
-| Delete | Opens the Delete Review window to delete review and its instance history, which asks for confirmation of the action. See the [Delete Review Window](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/deletereview.md) topic for additional information. |
+| Delete | Opens the Delete Review window to delete the review and its instance history, which asks for confirmation of the action. See the [Delete Review Window](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/deletereview.md) topic for additional information. |
| Stop | Opens the Stop Review window, which asks for confirmation of the action. See the [Stop Review Window](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/stopreview.md) topic for additional information. |
| View Details | Opens the Review Details page for the selected review. See the Review Details Page topic for additional information. |
| Mark Completed | Closes the selected review as-is and marks it as completed. Requires the owners to have responded. **CAUTION:** No confirmation is requested for this action. |
@@ -127,5 +127,5 @@ Use the buttons at the top and bottom to conduct the following actions:
| Export CSV | Exports the selected review instance information to a CSV file. This automatically downloads the file. See the [Data Grid Features](/docs/auditor/10.9/accessreviews/admin/navigate/datagrid.md) topic for additional information. |
| Edit Notes | Opens the Edit Notes window for the selected resource and allows free-text editing of the notes. See the [Edit Notes Window](/docs/auditor/10.9/accessreviews/admin/navigate/editnotes.md) topic for additional information. |
| View Responses | Opens the View Responses window, which is only available if the owner has recommended changes for the resource. This window displays all recommended changes, notes provided by the owner for the recommended change, and action buttons to Accept, Decline, or Defer the recommended change. See the [View Responses Window](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/viewresponses.md) topic for additional information. |
-| Process Changes | Opens a dropdown menu to Accept, Decline, or Defer all owner-recommended changes for the selected resource. This option allows the Review Administrator to process responses in batches, so all owner-recommended changes for the selected resource will be processed with the same action. |
+| Process Changes | Opens a dropdown menu to Accept, Decline, or Defer all owner-recommended changes for the selected resource. This option allows the Review Administrator to process responses in batches, applying the same action to all owner-recommended changes for the selected resource. |
| Remove Changes | Opens the Remove changes window. Clears all requested changes for the selected resource. The resource is returned to a ‘Waiting’ status, requiring the owner to review the resource again. See the [Remove Changes Window](/docs/auditor/10.9/accessreviews/entitlementreviews/approvalprocess/removechanges.md) topic for additional information. |
diff --git a/docs/auditor/10.9/accessreviews/entitlementreviews/interface/renamereview.md b/docs/auditor/10.9/accessreviews/entitlementreviews/interface/renamereview.md
index 5e910b8bd0..31835a38b8 100644
--- a/docs/auditor/10.9/accessreviews/entitlementreviews/interface/renamereview.md
+++ b/docs/auditor/10.9/accessreviews/entitlementreviews/interface/renamereview.md
@@ -7,7 +7,7 @@ sidebar_position: 20
# Rename Review Window
The Rename Review window opens from the [Manage Reviews Page](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/interface.md#manage-reviews-page)
-of the Entitlement Reviews interface. Follow the steps to rename a review.
+of the Entitlement Reviews interface. To rename a review:
**Step 1 –** Select the review and click **Rename**. The Rename Review window opens.
diff --git a/docs/auditor/10.9/accessreviews/entitlementreviews/interface/sendreminders.md b/docs/auditor/10.9/accessreviews/entitlementreviews/interface/sendreminders.md
index af3051561d..f41b5236e7 100644
--- a/docs/auditor/10.9/accessreviews/entitlementreviews/interface/sendreminders.md
+++ b/docs/auditor/10.9/accessreviews/entitlementreviews/interface/sendreminders.md
@@ -7,14 +7,14 @@ sidebar_position: 40
# Send Reminders Window
The Send Reminders window opens from the [Manage Reviews Page](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/interface.md#manage-reviews-page)
-of the Entitlement Reviews interface. Select the desired active review(s) and click **Send
+of the Entitlement Reviews interface. Select the active reviews you want and click **Send
Reminders** to send immediate reminder notifications. The Send Reminders window opens to display an
action status.
-The window displays the action status. When a successful status is indicated, assigned owners were
-sent a reminder email. Click **OK** to close the Send Reminders window.
+The window displays the action status. A successful status means the application sent assigned
+owners a reminder email. Click **OK** to close the Send Reminders window.
-_Remember,_ automatic weekly reminders can be configured on the
+_Remember,_ you can configure automatic weekly reminders on the
[Notifications Page](/docs/auditor/10.9/accessreviews/admin/configuration/notifications.md) of the Configuration interface.
diff --git a/docs/auditor/10.9/accessreviews/entitlementreviews/interface/stopreview.md b/docs/auditor/10.9/accessreviews/entitlementreviews/interface/stopreview.md
index 3210d84efd..e0612875dd 100644
--- a/docs/auditor/10.9/accessreviews/entitlementreviews/interface/stopreview.md
+++ b/docs/auditor/10.9/accessreviews/entitlementreviews/interface/stopreview.md
@@ -7,7 +7,7 @@ sidebar_position: 50
# Stop Review Window
The Stop Review window opens from the [Manage Reviews Page](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/interface.md#manage-reviews-page) of
-the Entitlement Reviews interface. Select the desired active review(s) and click **Stop**. The Stop
+the Entitlement Reviews interface. Select the active reviews you want and click **Stop**. The Stop
Review window opens to confirm the action.
diff --git a/docs/auditor/10.9/accessreviews/entitlementreviews/interface/viewresponses.md b/docs/auditor/10.9/accessreviews/entitlementreviews/interface/viewresponses.md
index c5e5be8e11..c00fe9015f 100644
--- a/docs/auditor/10.9/accessreviews/entitlementreviews/interface/viewresponses.md
+++ b/docs/auditor/10.9/accessreviews/entitlementreviews/interface/viewresponses.md
@@ -17,7 +17,7 @@ The information displayed in the table includes:
- Item Reviewed — Item upon which changes were suggested by the owner
- Current — Current state of the item at the time of the review
- Desired — Change suggested by the owner
-- Notes — Icon indicates a Note has been added. Click on the icon to read the attached note(s).
+- Notes — Icon indicates a Note has been added. Click the icon to read the attached notes.
- Approval — Status of the Review Administrator's approval
- Clock — Indicates waiting on the Review Administrator to make an official decision
@@ -27,8 +27,8 @@ The information displayed in the table includes:
later time
The **Show Only Changes** checkbox is selected by default to show only the items with
-owner-recommended changes. If deselected, all items included in the review are displayed. When
-selecting the items with no changes in the grid, the change buttons at the bottom of the page are
+owner-recommended changes. If deselected, the table displays all items included in the review. When
+you select items with no changes in the grid, the change buttons at the bottom of the page are
disabled.
The table data grid functions the same way as other table grids. See the
diff --git a/docs/auditor/10.9/accessreviews/entitlementreviews/overview.md b/docs/auditor/10.9/accessreviews/entitlementreviews/overview.md
index 0664906b4e..19410e8abe 100644
--- a/docs/auditor/10.9/accessreviews/entitlementreviews/overview.md
+++ b/docs/auditor/10.9/accessreviews/entitlementreviews/overview.md
@@ -7,17 +7,17 @@ sidebar_position: 40
# Reviews Overview
The Entitlement Reviews interface is where users with either the Security Team or Administrator role
-(to be referred to as Review Administrators) can manage reviews. The workflow provides a way for
-business users or data custodians (to be referred to as Owners) to attest to the access and
+(referred to as Review Administrators) can manage reviews. The workflow provides a way for
+business users or data custodians (referred to as Owners) to attest to the access and
privileges users have to their resources.
-For the purpose of the Access Reviewsapplication, a “resource” refers to the file system shared
+In the Access Reviews application, a “resource” refers to the file system shared
folders, SharePoint Online site collections, and Active Directory (AD) groups. All data available
within the Access Reviews application is collected by Netwrix Auditor according to the synchronized
monitoring plans.
_Remember,_ Owners are assigned to resources in the Resource Owners interface. Only resources with
-assigned Owners can be included in a reviews.
+assigned Owners can be included in reviews.
Who Can Run Reviews (Review Administrators)?
@@ -36,7 +36,7 @@ Who Can Run Reviews (Review Administrators)?
Who Participates in Reviews?
-- Review Administrators — Create / start reviews and approve / process owner recommended changes
+- Review Administrators — Create / start reviews and approve / process owner-recommended changes
- Owners — Perform reviews and recommend changes
Types of Reviews
@@ -65,7 +65,7 @@ Prerequisite:
Workflow:
**_RECOMMENDED:_** When deploying the Access Reviews application in an organization to process
-reviews, owners should be notified prior to launching the first set of reviews. See the
+reviews, notify owners before launching the first set of reviews. See the
[Notification to Owners](/docs/auditor/10.9/accessreviews/resourceowners/overview.md#notification-to-owners) topic for additional
information.
@@ -75,8 +75,8 @@ information.
information.
3. Review Administrator approves owner recommendations. See the
[Approval Process](/docs/auditor/10.9/accessreviews/entitlementreviews/approvalprocess/approvalprocess.md) topic for additional information.
-4. Implement approved changes in your organization. Manually, export a list of approved changes and
- deliver it to your IT department.
+4. Implement approved changes in your organization by manually exporting a list of approved changes
+ and delivering it to your IT department.
When desired, the Review Administrator runs another instance of the review and the workflow starts
again. See the [Review Instances](/docs/auditor/10.9/accessreviews/entitlementreviews/create/reviewinstances.md) topic for additional information.
diff --git a/docs/auditor/10.9/accessreviews/installation/accessreviewsconfiguration.md b/docs/auditor/10.9/accessreviews/installation/accessreviewsconfiguration.md
index cd0b2c64c0..62744e2d34 100644
--- a/docs/auditor/10.9/accessreviews/installation/accessreviewsconfiguration.md
+++ b/docs/auditor/10.9/accessreviews/installation/accessreviewsconfiguration.md
@@ -18,7 +18,7 @@ You can configure Netwrix Auditor Access Reviews in two ways:
If you plan to use Access Reviews for multiple data sources, configure the settings to work with the
data sources that you select.
-Follow the steps to configure Access Reviews in the Netwrix Auditor.
+To configure Access Reviews in Netwrix Auditor:
**Step 1 –** Go to **Settings > General > Access Reviews**.
@@ -28,7 +28,7 @@ Follow the steps to configure Access Reviews in the Netwrix Auditor.
-**Step 3 –** Select the desired data sources to review.
+**Step 3 –** Select the data sources you want to review.
**Step 4 –** Click **Save**.
@@ -39,13 +39,13 @@ Netwrix Auditor Access Reviews is configured and ready to use in the Netwrix Aud
If you plan to use Access Reviews for a specific monitoring plan, configure Access Reviews in that
monitoring plan.
-Follow the steps to configure Access Reviews in the Netwrix Auditor.
+To configure Access Reviews in Netwrix Auditor:
**Step 1 –** Go to **Configuration > Monitoring plans**.
-**Step 2 –** Double click the desired monitoring plan.
+**Step 2 –** Double-click the monitoring plan you want.
-**Step 3 –** Click **Edit data source** button on the left.
+**Step 3 –** Click the **Edit data source** button on the left.
diff --git a/docs/auditor/10.9/accessreviews/installation/install.md b/docs/auditor/10.9/accessreviews/installation/install.md
index d2c2119dbe..38a5ef8790 100644
--- a/docs/auditor/10.9/accessreviews/installation/install.md
+++ b/docs/auditor/10.9/accessreviews/installation/install.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install
-Once the prerequisites have been met, follow the steps to install the Access Reviews application.
+After you meet the prerequisites, install the Access Reviews application:
**Step 1 –** Run the `AccessReviews.exe` executable, and the Netwrix Auditor Access Reviews Setup
wizard opens.
@@ -26,7 +26,7 @@ Agreement** checkbox and click **Next**.
and a custom folder. Click **Change** to browse for a different location. When the destination is
set as desired, click **Next**.
-**NOTE:** The default location is `C:\Program Files\Netwrix\Access Access Reviews\`. There are no
+**NOTE:** The default location is `C:\Program Files\Netwrix\Access Reviews\`. There are no
specific requirements for changing the path.
@@ -46,7 +46,7 @@ specific requirements for changing the path.
- Database — Enter the name of the database. By default, this is set to NetwrixAR.
-- Authentication – Select the Database service account type from the drop-down menu. Then enter the
+- Authentication – Select the Database service account type from the dropdown menu. Then enter the
account information in the **User Name** and **Password** fields.
- For Windows Authentication – **User Name** format must be `[DOMAIN]\[username]` , for example
`NWXTECH\ad.bruce`
@@ -54,15 +54,15 @@ specific requirements for changing the path.
**NOTE:** See the [Database Page](/docs/auditor/10.9/accessreviews/admin/configuration/database.md) topic for additional
information.
-
+
-**Step 6 –** If there are no errors, you will be asked to confirm creation of the new database.
-Click **Yes**.
+**Step 6 –** If there are no errors, confirm creation of the new database when prompted. Click
+**Yes**.
**Step 7 –** On the Configure Web Server page, you can choose between the default port and a custom
-port on which the application will be accessible. To change the port, enter a new port number in the
+port on which the application is accessible. To change the port, enter a new port number in the
field. When the port is set as desired, click **Next**.
**NOTE:** The default port is 81.
@@ -73,7 +73,7 @@ field. When the port is set as desired, click **Next**.
-**Step 9 –** Once the installation has successfully completed, click **Finish** to exit the wizard.
+**Step 9 –** After the installation completes successfully, click **Finish** to exit the wizard.
The installation wizard placed a Netwrix Auditor Access Reviews icon on the desktop. Now proceed to
the [First Launch](/docs/auditor/10.9/accessreviews/admin/firstlaunch.md) topic for next steps.
diff --git a/docs/auditor/10.9/accessreviews/installation/overview.md b/docs/auditor/10.9/accessreviews/installation/overview.md
index 3eacfb53e2..05caa43c1b 100644
--- a/docs/auditor/10.9/accessreviews/installation/overview.md
+++ b/docs/auditor/10.9/accessreviews/installation/overview.md
@@ -11,8 +11,8 @@ in a Microsoft® SQL® Server database. Netwrix Auditor must be installed and co
installing and using the Access Reviews application. The Access Reviews Configuration tool must be
used after installation to complete the integration of these products.
-**NOTE:** Access Reviews is a separately licensed product and is not included with Netwrix Auditor.
-Make sure that you have the Access Reviews license enabled in Auditor.
+**NOTE:** Access Reviews is a separately licensed product and isn't included with Netwrix Auditor.
+Ensure that you have the Access Reviews license enabled in Auditor.
## Prerequisites
@@ -20,9 +20,9 @@ The Access Reviews application must be installed on the same server as Netwrix A
### Permissions
-Permissions are needed to the Netwrix Auditor database and to Active Directory. This can be one
-account with sufficient rights to each or two separate accounts. For the purpose of this document,
-these will be referred to as the Database service account and the Active Directory service account.
+You need permissions to the Netwrix Auditor database and to Active Directory. This can be one
+account with sufficient rights to each, or two separate accounts. This document refers to these as
+the Database service account and the Active Directory service account.
- Database service account – This is the same account used by Netwrix Auditor for a database service
account. This credential is required for installation.
@@ -37,8 +37,8 @@ these will be referred to as the Database service account and the Active Directo
## Software Compatibility & Versions
-For proper functionality, it is necessary for the version of the Access Reviews to be compatible
-with the existing Netwrix Auditor installation. If necessary,
+For proper functionality, the version of Access Reviews must be compatible with the existing
+Netwrix Auditor installation. If necessary,
[Netwrix Support](https://www.netwrix.com/support.html) can confirm whether the two product versions
are compatible.
diff --git a/docs/auditor/10.9/accessreviews/installation/secure.md b/docs/auditor/10.9/accessreviews/installation/secure.md
index 95129cc5b3..7bd9a1a424 100644
--- a/docs/auditor/10.9/accessreviews/installation/secure.md
+++ b/docs/auditor/10.9/accessreviews/installation/secure.md
@@ -6,45 +6,45 @@ sidebar_position: 30
# Secure Console Access
-Enable Secure Sockets Layer (SSL) for secure, remote connections to the application web server. In
-order to enable SSL, you need to create a certificate and then bind it to the secure port.
+Enable Secure Sockets Layer (SSL) for secure, remote connections to the application web server. To
+enable SSL, you need to create a certificate and then bind it to the secure port.
**NOTE:** Organizations typically have one or more system administrators responsible for Public Key
-Infrastructure (PKI) and certificates. To continue with this configuration, it will first be
-necessary to confer with the PKI administrator to determine which certificate method will conform to
-the organization’s security policies.
+Infrastructure (PKI) and certificates. To continue with this configuration, you first need to
+consult with the PKI administrator to determine which certificate method conforms to your
+organization's security policies.
-Follow the steps to enable SSL.
+To enable SSL:
**Step 1 –** Create an SSL Binding.
**Step 2 –** Modify the AccessInformationCenter.Service.exe.Config File.
-The Access Reviews application is now configured to use SSL for secure, remote connections.
+The Access Reviews application is now configured to use SSL for secure, remote connections.
## Create an SSL Binding
-You run a PowerShell command to create an SSL binding. The binding command has several environmental
+You run a PowerShell command to create an SSL binding. The binding command has several environment
variables:
- The `$certHash` value is the `Thumbprint` value.
-- The `$ip` value of the IP addresses. In the example script below, the value [0.0.0.0] is set for
- all IP addresses.
+- The `$ip` value specifies the IP addresses to bind. In the example script, the value 0.0.0.0 is
+ set for all IP addresses.
- The `$port` value must be accurate for your environment. The HTTP default port is 81. The HTTPS
default is 481. However, it can be customized during installation.
-- The `$guid` value is required for specifying a valid GUID value to identify the owning application
- for a binding purpose. It obtained from any valid GUID.
+- The `$guid` value identifies the owning application for the binding. You can obtain it from any
+ valid GUID.
-If you need to find the `$certHash` value of a certificate that was already created, run the
-PowerShell `dir` command below on the certificate's drive. This will output the Thumbprint (Hash)
+If you need to find the `$certHash` value of a certificate that you already created, run the
+following PowerShell `dir` command on the certificate's drive. This outputs the Thumbprint (Hash)
value and the certificate name:
```powershell
dir cert:\localmachine\my
```
-Replace the environmental variables in the example script below. Then Run the PowerShell command to
-create an SSL binding:
+Replace the environment variables in the following example script. Then run the PowerShell command
+to create an SSL binding:
```powershell
$guid = "1be32670-7644-4dce-9a5d-01643022074e"
@@ -58,24 +58,23 @@ The next step is to modify the `AccessInformationCenter.Service.exe.Config` file
## Modify the AccessInformationCenter.Service.exe.Config File
-Follow the steps to modify the Modify the `AccessInformationCenter.Service.exe.Config` file for
-HTTPS.
+To modify the `AccessInformationCenter.Service.exe.Config` file for HTTPS:
**Step 1 –** Open the `AccessInformationCenter.Service.exe.Config` file in a text editor, e.g.
-Notepad. It is located in the installation directory:
+Notepad. You can find it in the installation directory:
...\Netwrix\Access Reviews
**Step 2 –** Change the `BindingUrl` key value to `"https://+:481"` (ensure the port number matches
-the port number used in the PowerShell command run to create the SSL Binding.
+the port number used in the PowerShell command that created the SSL binding).
**Step 3 –** Save and close the file.
**Step 4 –** Restart the Netwrix Auditor Access Reviews service in Services Manager
-`(services.msc`).
+(`services.msc`).
-The URL for the Access Reviews Console is now accessible
+The URL for the Access Reviews Console is now accessible at
`https://[Fully Qualified Domain Name for the Machine]:481` (if port 481 was used when creating the
-binding). For example, https://NEWYORKSRV10.NWXTech.com:481.
+binding). For example, `https://NEWYORKSRV10.NWXTech.com:481`.
diff --git a/docs/auditor/10.9/accessreviews/installation/upgrade.md b/docs/auditor/10.9/accessreviews/installation/upgrade.md
index b296926d9b..1095f45ca6 100644
--- a/docs/auditor/10.9/accessreviews/installation/upgrade.md
+++ b/docs/auditor/10.9/accessreviews/installation/upgrade.md
@@ -10,63 +10,64 @@ sidebar_position: 40
the Netwrix Auditor Access Reviews application, see the Special Considerations topic for upgrade
steps.
-To upgrade the Access Reviews application to a newer version, simply run the new `AccessReviews.msi`
-executable. It is not necessary to uninstall the existing version. See the [Install](/docs/auditor/10.9/accessreviews/installation/install.md)
+To upgrade the Access Reviews application to a newer version, run the new `AccessReviews.msi`
+executable. You don't need to uninstall the existing version. See the [Install](/docs/auditor/10.9/accessreviews/installation/install.md)
topic for additional information.
-_Remember,_ the Access Reviews version must align to the compatible Netwrix Auditor version.
+_Remember,_ the Access Reviews version must align with the compatible Netwrix Auditor version.
-When the installer is run over an existing version, the following is happening in the backend:
+When you run the installer over an existing version, the following happens in the backend:
-- During the installation process, a Backup folder is created in the Access Reviews installation
- directory
+- During the installation process, the installer creates a Backup folder in the Access Reviews
+ installation directory
...\Netwrix\Access Reviews
- - The Backup folder contains the files where various settings reside listed in the table below
+ - The Backup folder contains the files listed in the following table, where various settings
+ reside
-- The backup folder files are copied over the default files laid down by the installer, preserving
+- The installer copies the backup folder files over the default files it lays down, preserving
customized settings
-- After the installation is complete, the Backup folder is removed
+- After the installation completes, the installer removes the Backup folder
-| File | Location | Guidance |
-| ----------------------------------- | ---------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
-| Email Templates (multiple files) | Located in the Backup folder | The HTML templates that are used to send notification email. These can be customized with logos or corporate branding. |
-| AccessInformationCenter.Service.exe | Located in the Backup folder | Contains custom application settings and logging levels. |
-| Version.txt | Located in the Backup folder | Indicates the version number associated with the backup contents. |
+| File | Location | Guidance |
+| ----------------------------------- | -------------------- | ---------------------------------------------------------------------------------------------------------------------- |
+| Email Templates (multiple files) | Backup folder | The HTML templates that are used to send notification email. These can be customized with logos or corporate branding. |
+| AccessInformationCenter.Service.exe | Backup folder | Contains custom application settings and logging levels. |
+| Version.txt | Backup folder | Indicates the version number associated with the backup contents. |
## Special Considerations
-The originally released Netwrix Access Information Center has been rebranded to Netwrix Auditor
-Access Reviews. This rebranding project included changing the installation directory, the name of
-the service, and the default name of the database created by the installer. Follow the steps to
-replace Netwrix Access Information Center with Netwrix Auditor Access Reviews.
+Netwrix rebranded Netwrix Access Information Center to Netwrix Auditor Access Reviews. This
+rebranding project included changing the installation directory, the name of the service, and the
+default name of the database created by the installer. To replace Netwrix Access Information
+Center with Netwrix Auditor Access Reviews:
-**Step 1 –** Install the Netwrix Auditor Access Reviews application on the same server where the
-Netwrix Access Information Center was installed. See the [Install](/docs/auditor/10.9/accessreviews/installation/install.md) topic for additional
+**Step 1 –** Install the Netwrix Auditor Access Reviews application on the same server where you
+installed the Netwrix Access Information Center. See the [Install](/docs/auditor/10.9/accessreviews/installation/install.md) topic for additional
information. On the SQL Server Connection page:
- Supply the information for the existing database. The default name for the original database was
- NetwrixAIC. However, it could have been Customized.
+ NetwrixAIC. However, it could have been customized.
- Use the same credentials for the SQL Server Connection.
-**NOTE:** The new destination folder will be `...\Netwrix\Access Reviews`.
+**NOTE:** The new destination folder is `...\Netwrix\Access Reviews`.
**Step 2 –** Launch the application and reset the Builtin Administrator password. See the
[First Launch](/docs/auditor/10.9/accessreviews/admin/firstlaunch.md) topic for additional information.
-**Step 3 –** It will be necessary to add your Console Users again. See the
+**Step 3 –** Add your Console Users again. See the
[Console Access Page](/docs/auditor/10.9/accessreviews/admin/configuration/consoleaccess.md) topic for additional information.
-**Step 4 –** It will be necessary to configure the Notification settings. See the
+**Step 4 –** Configure the Notification settings. See the
[Notifications Page](/docs/auditor/10.9/accessreviews/admin/configuration/notifications.md) topic for additional information.
-**Step 5 –** If you have customized your email templates, it will be necessary to copy the Templates
-folder from the old `...\Netwrix\Access Information Center` installation directory to the new
+**Step 5 –** If you customized your email templates, copy the Templates folder from the old
+`...\Netwrix\Access Information Center` installation directory to the new
`...\Netwrix\Access Reviews` installation directory.
-All of the resources with assigned owners will be visible on the Resource Owners tab. All reviews
-will be visible on the Entitlement Reviews tab.
+All resources with assigned owners appear on the Resource Owners tab. All reviews appear on the
+Entitlement Reviews tab.
-After the upgrade has been confirmed to be successful, you can optionally remove/delete the old
-installation directory: `...\Netwrix\Access Information Center`.
+After you confirm the upgrade was successful, you can optionally remove the old installation
+directory: `...\Netwrix\Access Information Center`.
diff --git a/docs/auditor/10.9/accessreviews/owneroverview/confirmationrequest.md b/docs/auditor/10.9/accessreviews/owneroverview/confirmationrequest.md
index f391b23b53..a69ea788d6 100644
--- a/docs/auditor/10.9/accessreviews/owneroverview/confirmationrequest.md
+++ b/docs/auditor/10.9/accessreviews/owneroverview/confirmationrequest.md
@@ -6,19 +6,19 @@ sidebar_position: 10
# Ownership Confirmation Request Email
-The Ownership Administrator may request ownership confirmation for a resource being managed through
-the Access Reviews application. As an assigned owner, you will receive the following email.
+When an Ownership Administrator requests ownership confirmation for a resource being managed
+through the Access Reviews application, you, as the assigned owner, receive the following email.
The Ownership Confirmation Request email provides buttons for confirming (Yes) or declining (No)
-ownership of the listed resource. You will be asked to authenticate for your response to be
-processed. The application will launch in your default browser. Enter your domain credentials to
-complete the process. One of two messages will appear according to if you confirmed or declined.
+ownership of the listed resource. To process your response, you must authenticate. The application
+launches in your default browser. Enter your domain credentials to complete the process. One of two
+messages appears, depending on whether you confirmed or declined.
## Confirmed Ownership Message
-If you have accepted ownership for the assigned resource, the browser will display the following
+If you accept ownership for the assigned resource, the browser displays the following
message after authentication:
@@ -28,7 +28,7 @@ e-mail."
## Declined Ownership Message
-If you have declined ownership for the assigned resource, the browser will display the following
+If you decline ownership for the assigned resource, the browser displays the following
message after authentication:
diff --git a/docs/auditor/10.9/accessreviews/owneroverview/owneroverview.md b/docs/auditor/10.9/accessreviews/owneroverview/owneroverview.md
index 626acb8864..4a1550bf67 100644
--- a/docs/auditor/10.9/accessreviews/owneroverview/owneroverview.md
+++ b/docs/auditor/10.9/accessreviews/owneroverview/owneroverview.md
@@ -8,18 +8,17 @@ sidebar_position: 50
This topic and its subtopics are written for users who have been assigned resource ownership.
-When your organization performs an access review on a resource for which you are the assigned owner,
-it means you, the business user or data custodian, need to attest to the access and privileges users
-have to your resource.
+When your organization performs an access review on a resource you own, you, as the business user
+or data custodian, need to attest to the access and privileges users have to your resource.
**NOTE:** For the Netwrix Auditor Access Reviews application, a “resource” refers to the file system
shared folders, SharePoint Online site collections, and Active Directory (AD) groups.
-Your organization's Ownership Administrator and/or Review Administrator will let you know what URL
-to use for logging in as well as what credentials to use. The URL will require you to be connected
-to your organization's network. Upon login, you will be directed to the My Reviews page where you
-can view pending and historical reviews for your resources.
+Your organization's Ownership Administrator or Review Administrator lets you know what URL to use
+for logging in, as well as what credentials to use. The URL requires you to be connected to your
+organization's network. At login, you go to the My Reviews page, where you can view pending and
+historical reviews for your resources.
You may receive email notifications requesting ownership confirmation from your organization's
-Ownership Administrators. You will receive email notifications when you have a pending access review
-to perform.
+Ownership Administrators. You receive email notifications when you have a pending access review to
+perform.
diff --git a/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/access.md b/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/access.md
index 2bcd5ec790..eec156efc0 100644
--- a/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/access.md
+++ b/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/access.md
@@ -22,8 +22,8 @@ The table displays access information for the resource being reviewed:
- Access Level (Full Control, Modify, and Read) columns — Blue checkmark icon indicates current
access level
-**Step 2 –** Recommend access changes for a trustee by clicking the icon for the desired access
-level (Full Control, Modify, or Read columns). A yellow checkmark icon indicates the new level of
+**Step 2 –** Recommend access changes for a trustee by clicking the icon for the access level you
+want (Full Control, Modify, or Read columns). A yellow checkmark icon indicates the new level of
access you are recommending.
**Step 3 –** Recommend removing access by selecting one or more trustees and clicking the **Remove
@@ -33,7 +33,7 @@ recommending all access be removed; it appears in the column for the current lev
_Remember,_ at any time you can save your recommendations and exit the review. It will remain
pending until you submit all recommendations for this resource.
-**Step 4 –** When the recommended changes are set as desired, click **Next**. The 2 Review changes
+**Step 4 –** When you've set the recommended changes the way you want, click **Next**. The 2 Review changes
tab opens in the Resource Review page.
@@ -45,7 +45,7 @@ notes explaining why the change is recommended.
**NOTE:** To make changes to your recommendations, you must return to the first tab. Click
**Previous**.
-**Step 6 –** When all recommendations are confirmed and the desire notes added, click **Submit**. A
+**Step 6 –** When you've confirmed all recommendations and added any notes, click **Submit**. A
message displays stating that the review is complete. Click **OK** to close the message window.
The review for this resource is now complete. You will be redirected to the Pending Reviews page.
diff --git a/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/groupmembership.md b/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/groupmembership.md
index 0770a451b7..c99ba1f7f0 100644
--- a/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/groupmembership.md
+++ b/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/groupmembership.md
@@ -11,5 +11,5 @@ in addition to the group icon displayed in front of the name.
-Click the hyperlink to open the Group Membership window. The group’s direct membership is listed for
-review. Click **Close** to return to the review.
+Click the hyperlink to open the Group Membership window. The window lists the group’s direct
+membership for review. Click **Close** to return to the review.
diff --git a/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/membership.md b/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/membership.md
index 7c23e84048..14231057d3 100644
--- a/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/membership.md
+++ b/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/membership.md
@@ -6,8 +6,7 @@ sidebar_position: 20
# Perform a Membership Review
-A Membership review is an evaluation of group membership. Follow the steps to perform a Membership
-review.
+A Membership review is an evaluation of group membership. To perform a Membership review:
**Step 1 –** On the Pending Reviews page, select the resource with a pending Membership review and
click **Begin Review**. The Resource Review page opens to the 1 Make changes tab.
@@ -28,7 +27,7 @@ recommending the trustee be removed from the group.
_Remember,_ at any time you can save your recommendations and exit the review. It will remain
pending until you submit all recommendations for this resource.
-**Step 3 –** When the recommended changes are set as desired, click **Next**. The 2 Review changes
+**Step 3 –** When you've set the recommended changes the way you want, click **Next**. The 2 Review changes
tab opens in the Resource Review page.
@@ -40,7 +39,7 @@ notes explaining why the change is recommended.
**NOTE:** To make changes to your recommendations, you must return to the first tab. Click
**Previous**.
-**Step 5 –** When all recommendations are confirmed and the desire notes added, click **Submit**. A
+**Step 5 –** When you've confirmed all recommendations and added any notes, click **Submit**. A
message displays stating that the review is complete. Click **OK** to close the message window.
The review for this resource is now complete. You will be redirected to the Pending Reviews page.
diff --git a/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/pendingreviews.md b/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/pendingreviews.md
index 01f0bc4697..26236f2345 100644
--- a/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/pendingreviews.md
+++ b/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/pendingreviews.md
@@ -73,8 +73,8 @@ features:
- Save Changes — Saves all recommended changes, enabling you to leave the review in progress and
return at a later time to complete it. It opens the Saving review window, which displays a status
for the action.
-- Remove Access — On the 1 Make changes tab, removes access from the selected trustees. Ctrl-click
- can be used for multi-select. Current access blue icon with a checkmark will turn to an empty
+- Remove Access — On the 1 Make changes tab, removes access from the selected trustees. Use
+ Ctrl-click for multi-select. Current access blue icon with a checkmark will turn to an empty
yellow icon.
- Only show changes since last review — Scopes the table to only display those items that have been
modified since the last review instance
diff --git a/docs/auditor/10.9/accessreviews/owneroverview/reviewhistory.md b/docs/auditor/10.9/accessreviews/owneroverview/reviewhistory.md
index cd722337e5..22f8627cf1 100644
--- a/docs/auditor/10.9/accessreviews/owneroverview/reviewhistory.md
+++ b/docs/auditor/10.9/accessreviews/owneroverview/reviewhistory.md
@@ -27,18 +27,18 @@ The table data grid functions the same way as other table grids. See the
## Review Details Window
The View Details button at the bottom of the Review History page opens the Review Details window for
-a resource where changes were recommended.
+a resource with recommended changes.
The information displayed in the table includes:
-- Item Reviewed – Item upon which changes were suggested by the owner
+- Item Reviewed – The item for which the owner suggested changes
- Current – Current state of the item at the time of the review. It could be the type of access (for
Access reviews) or being a member (for Membership reviews).
- Desired – Change suggested by the owner. It could be the new type of access (for Access reviews)
or removing membership (for Membership reviews).
-- Notes – An icon here indicates notes were entered by the owner. Select the item and click the
+- Notes – An icon here indicates that the owner entered notes. Select the item and click the
**View Notes** button to open the View Notes window.
- Status – Icon indicates the decision provided by the Review Administrator: Accept, Decline, Defer,
or Waiting. Hover over a status icon to display its tooltip.
diff --git a/docs/auditor/10.9/accessreviews/resourceowners/confirmation/confirm.md b/docs/auditor/10.9/accessreviews/resourceowners/confirmation/confirm.md
index 12bdef041a..9fb4711536 100644
--- a/docs/auditor/10.9/accessreviews/resourceowners/confirmation/confirm.md
+++ b/docs/auditor/10.9/accessreviews/resourceowners/confirmation/confirm.md
@@ -6,34 +6,34 @@ sidebar_position: 10
# Confirm Ownership Wizard
-The Confirm Ownership wizard is opened with the **Request Confirmation** button in the Resource
-Owners interface. It can be opened for one or multiple resources.
+The **Request Confirmation** button in the Resource Owners interface opens the Confirm Ownership
+wizard. You can open it for one or multiple resources.
It contains one page:
-- 1. Select Owners — Lists the current owner(s) for each selected resource and confirmation status
+- 1. Select Owners — Lists the current owners for each selected resource and confirmation status
## Request Ownership Confirmation
-Follow the steps to request ownership confirmation.
+To request ownership confirmation:
-**Step 1 –** In the Resource Owners interface, select the desired resource or resources and click
+**Step 1 –** In the Resource Owners interface, select the resource or resources you want and click
Request Confirmation. The Confirm Ownership wizard opens.
-**Step 2 –** On the Select Owners page, you can optionally remove owners you do not want or need
+**Step 2 –** On the Select Owners page, you can optionally remove owners you don't want or need
ownership confirmation from. Select those owners and click **Remove**. Those owners will not receive
-the confirmation email. Once the list is set as desired, click **Finish**. The Access Reviews
+the confirmation email. When the list is set the way you want, click **Finish**. The Access Reviews
application begins to send the confirmation email. The table provides the following information:
- Resource Name — The icon indicates the type of resource. The resource name includes its location,
such as the UNC path for a file system resource, the URL for SharePoint resource, or Group name
(e.g., [Domain]\[Group]).
- Owner Name — Name of the assigned owner
-- Confirmed — Indicates whether or not the assigned owner has confirmed ownership of that resource.
+- Confirmed — Indicates whether the assigned owner has confirmed ownership of that resource.
Tool-tips display when hovering over the icons indicating whether the resource ownership has been
confirmed, declined, pending response, or that a confirmation has not been requested.
diff --git a/docs/auditor/10.9/accessreviews/resourceowners/confirmation/confirmation.md b/docs/auditor/10.9/accessreviews/resourceowners/confirmation/confirmation.md
index aafc5116de..f3698fd49b 100644
--- a/docs/auditor/10.9/accessreviews/resourceowners/confirmation/confirmation.md
+++ b/docs/auditor/10.9/accessreviews/resourceowners/confirmation/confirmation.md
@@ -6,10 +6,9 @@ sidebar_position: 20
# Ownership Confirmation
-The reason for assigning owners to resources is to enable those resources to be included in reviews,
-or attestations, conducted through the application. In order for this to work, the assigned owner
-needs to claim that ownership responsibility. Resources that do not have confirmed owners may fall
-through the cracks.
+You assign owners to resources so the application can include those resources in reviews, or
+attestations. For this to work, the assigned owner must claim that ownership responsibility.
+Resources without a confirmed owner might not get included in reviews.
**NOTE:** This does require the Notification settings to be configured for the Access Reviews
application. See the [Notifications Page](/docs/auditor/10.9/accessreviews/admin/configuration/notifications.md) topic for
@@ -25,10 +24,10 @@ this column to indicate the owner confirmation status:
|  | No Status | Indicates ownership confirmation has not been requested, and there is no ownership status at this time |
|  | Waiting | Indicates a request for confirmation has been sent, and you are waiting for a response from the assigned owner. Hover over the icon to view the date timestamp of the request. |
|  | Confirmed | Indicates the assigned owner confirmed ownership of the resource. Hover over the icon to view the date timestamp of the confirmation. |
-|  | Declined | Indicates the assigned owner declined ownership of the resource. These individuals would have been asked to suggest an alternative owner. Check the Notes for the resource to view this information. Hover over the icon to view the date timestamp of the decline. _Remember,_ a resource with declined ownership needs to be updated to assign a new owner. See the [Update Resource Wizard](/docs/auditor/10.9/accessreviews/resourceowners/interface/update.md) topic for additional information. |
+|  | Declined | Indicates the assigned owner declined ownership of the resource. The application asks these individuals to suggest an alternative owner. Check the Notes for the resource to view this information. Hover over the icon to view the date timestamp of the decline. _Remember,_ you need to update a resource with declined ownership to assign a new owner. See the [Update Resource Wizard](/docs/auditor/10.9/accessreviews/resourceowners/interface/update.md) topic for additional information. |
-If multiple owners have been assigned, there is a choice for which assigned owner(s) should receive
-the confirmation. If multiple owners were sent the request, the column remains as a waiting symbol
-until the assigned Primary owner replies.
+If a resource has multiple assigned owners, you can choose which owners receive the confirmation
+request. If you send the request to multiple owners, the column remains a waiting symbol until the
+assigned Primary owner replies.
See the [Confirm Ownership Wizard](/docs/auditor/10.9/accessreviews/resourceowners/confirmation/confirm.md) topic for additional information.
diff --git a/docs/auditor/10.9/accessreviews/resourceowners/interface/add.md b/docs/auditor/10.9/accessreviews/resourceowners/interface/add.md
index b63a7d28ba..5b1c953511 100644
--- a/docs/auditor/10.9/accessreviews/resourceowners/interface/add.md
+++ b/docs/auditor/10.9/accessreviews/resourceowners/interface/add.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Add New Resource Wizard
-The Add new resource wizard is opened with the **Add** button in the Resource Owners interface.
+The **Add** button in the Resource Owners interface opens the Add new resource wizard.
@@ -21,7 +21,7 @@ See the Add a Resource topic for additional information.
## Add a Resource
-Follow the steps to add resources one at a time and assign owners.
+To add resources one at a time and assign owners:
**Step 1 –** In the Resource Owners interface, click **Add**. The Add new resource wizard opens.
@@ -36,8 +36,7 @@ Follow the steps to add resources one at a time and assign owners.
- For example, http://farm.corp.com
- For groups, enter the group name in NTAccount format [DOMAIN\GROUP]
- For example, acme\app.group
-- Browse option – Navigate through the resource tree to select the desired File System or SharePoint
- resource.
+- Browse option – Navigate through the resource tree to select the File System or SharePoint resource you want.
@@ -58,7 +57,7 @@ the owners:
- Owner Mail — Trustee's email address as read from Active Directory
- Owner Title — Trustee's title as read from Active Directory
- Owner Department — Trustee's department as read from Active Directory
-- Confirmed — Indicates whether or not the assigned owner has confirmed ownership of that resource.
+- Confirmed — Indicates whether the assigned owner has confirmed ownership of that resource.
Tool-tips display when hovering over the icons indicating whether the resource ownership has been
confirmed, declined, pending response, or that a confirmation has not been requested.
diff --git a/docs/auditor/10.9/accessreviews/resourceowners/interface/addowner.md b/docs/auditor/10.9/accessreviews/resourceowners/interface/addowner.md
index 58a54950aa..5b70943614 100644
--- a/docs/auditor/10.9/accessreviews/resourceowners/interface/addowner.md
+++ b/docs/auditor/10.9/accessreviews/resourceowners/interface/addowner.md
@@ -6,13 +6,13 @@ sidebar_position: 30
# Add Owner Window
-The Add Owner window opens from either the [Add New Resource Wizard](/docs/auditor/10.9/accessreviews/resourceowners/interface/add.md) of the
-[Update Resource Wizard](/docs/auditor/10.9/accessreviews/resourceowners/interface/update.md). This window is used to search for a user account by
+The Add Owner window opens from either the [Add New Resource Wizard](/docs/auditor/10.9/accessreviews/resourceowners/interface/add.md) or the
+[Update Resource Wizard](/docs/auditor/10.9/accessreviews/resourceowners/interface/update.md). Use this window to search for a user account by
browsing Active Directory.
Enter a name in the search field to find and select users from Active Directory, which populates in
-a drop-down menu as you type. If multiple domains are known to the application, ensure the correct
-domain is selected from the drop-down menu. Click **OK** and the Add Owner window closes. The
+a dropdown menu as you type. If multiple domains are known to the application, ensure the correct
+domain is selected from the dropdown menu. Click **OK** and the Add Owner window closes. The
selected user appears in the Owner list.
diff --git a/docs/auditor/10.9/accessreviews/resourceowners/interface/confirmremoval.md b/docs/auditor/10.9/accessreviews/resourceowners/interface/confirmremoval.md
index ef4f2f1cd6..743e77b995 100644
--- a/docs/auditor/10.9/accessreviews/resourceowners/interface/confirmremoval.md
+++ b/docs/auditor/10.9/accessreviews/resourceowners/interface/confirmremoval.md
@@ -6,17 +6,17 @@ sidebar_position: 40
# Confirm Removal Window
-The process of removing a resource from the Resource Owners interface disassociates the owner(s)
-from the resource, it does not remove the resource from the database or from the available reports.
-Any history of actions performed by the owner for that resource will be maintained, but pending
-actions will be canceled. Pending actions may include s outstanding reviews.
+The process of removing a resource from the Resource Owners interface disassociates the owners
+from the resource; it doesn't remove the resource from the database or from the available reports.
+The application keeps a history of actions the owner performed for that resource, but cancels
+pending actions. Pending actions may include outstanding reviews.
-Follow the steps to remove a resource from being managed through the application.
+To remove a resource from being managed through the application:
**Step 1 –** In the Resource Owners interface, select the resource and click Remove. The Confirm
Removal window opens.
-
+
**Step 2 –** Click Yes to complete the removal process or **No** to cancel it.
diff --git a/docs/auditor/10.9/accessreviews/resourceowners/interface/interface.md b/docs/auditor/10.9/accessreviews/resourceowners/interface/interface.md
index 43d668f78e..6497c28b5f 100644
--- a/docs/auditor/10.9/accessreviews/resourceowners/interface/interface.md
+++ b/docs/auditor/10.9/accessreviews/resourceowners/interface/interface.md
@@ -21,11 +21,11 @@ The information displayed in the table includes:
information.
- Owner Name – Name of the assigned owner. If there are several owners of a resource, the list is
comma-separated.
-- Status – Indicates whether or not the assigned owner has confirmed ownership of that resource.
+- Status – Indicates whether the assigned owner has confirmed ownership of that resource.
Tool-tips display when hovering over the icons indicating whether the resource ownership has been
confirmed, declined, pending response, or that a confirmation has not been requested. See the
[Ownership Confirmation](/docs/auditor/10.9/accessreviews/resourceowners/confirmation/confirmation.md) topic for additional information.
-- Notes – Icon indicates a Note has been added. Click on the icon to read the attached note(s).
+- Notes – Icon indicates a Note has been added. Click the icon to read the attached notes.
Notes can be added by Ownership Administrators or populated with alternative owners by individuals
who declined ownership. See the [Edit Notes Window](/docs/auditor/10.9/accessreviews/admin/navigate/editnotes.md) and the Notes &
Descriptions topics for additional information.
@@ -34,7 +34,7 @@ The information displayed in the table includes:
review instance. See the
[Review Details Page](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/interface.md#review-details-page) topic for additional
information.
-- Active Review – Indicates whether or not there is a pending review. The hyperlink will open the
+- Active Review – Indicates whether there is a pending review. The hyperlink will open the
Entitlement Reviews interface to that Review Details page displaying the active review instance.
See the [Review Details Page](/docs/auditor/10.9/accessreviews/entitlementreviews/interface/interface.md#review-details-page) topic for
additional information.
@@ -42,16 +42,16 @@ The information displayed in the table includes:
The table data grid functions the same way as other table grids. See the
[Data Grid Features](/docs/auditor/10.9/accessreviews/admin/navigate/datagrid.md) topic for additional information.
-The buttons at the bottom enable you to conduct the following actions:
+Use the buttons at the bottom to conduct the following actions:
| Button | Function |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| Add | Launches the Add new resource wizard to add a new resource to the list. This allows you to add one resource at a time and assign an owner. See the [Add New Resource Wizard](/docs/auditor/10.9/accessreviews/resourceowners/interface/add.md) topic for additional information. |
-| Update | Launches the Update resource wizard for the selected resource. This allows you to make changes to the assigned owners or add/edit the resource description. See the [Update Resource Wizard](/docs/auditor/10.9/accessreviews/resourceowners/interface/update.md) topic for additional information. |
-| Remove | Opens the Confirm removal window to removes the selected resource from being managed through the application. _Remember,_ only resources with an assigned owner will be visible in the table. Removing a resource from this table does not delete the resource from the application database. See the [Confirm Removal Window](/docs/auditor/10.9/accessreviews/resourceowners/interface/confirmremoval.md) topic for additional information. |
-| Request Confirmation | Opens the Confirm Ownership wizard. Sends an email to the assigned owner(s) for the selected resource requesting ownership confirmation. See the[Confirm Ownership Wizard](/docs/auditor/10.9/accessreviews/resourceowners/confirmation/confirm.md) topic for additional information. |
+| Add | Launches the Add new resource wizard to add a new resource to the list. Use this wizard to add one resource at a time and assign an owner. See the [Add New Resource Wizard](/docs/auditor/10.9/accessreviews/resourceowners/interface/add.md) topic for additional information. |
+| Update | Launches the Update resource wizard for the selected resource. Use this wizard to change the assigned owners or add or edit the resource description. See the [Update Resource Wizard](/docs/auditor/10.9/accessreviews/resourceowners/interface/update.md) topic for additional information. |
+| Remove | Opens the Confirm removal window to remove the selected resource from being managed through the application. _Remember,_ only resources with an assigned owner will be visible in the table. Removing a resource from this table doesn't delete the resource from the application database. See the [Confirm Removal Window](/docs/auditor/10.9/accessreviews/resourceowners/interface/confirmremoval.md) topic for additional information. |
+| Request Confirmation | Opens the Confirm Ownership wizard. Sends an email to the assigned owners for the selected resource requesting ownership confirmation. See the[Confirm Ownership Wizard](/docs/auditor/10.9/accessreviews/resourceowners/confirmation/confirm.md) topic for additional information. |
| Edit Notes | Opens the Edit Notes window for the selected resource and allows free-text editing of the notes. See the [Edit Notes Window](/docs/auditor/10.9/accessreviews/admin/navigate/editnotes.md) topic for additional information. |
## Notes & Descriptions
diff --git a/docs/auditor/10.9/accessreviews/resourceowners/interface/update.md b/docs/auditor/10.9/accessreviews/resourceowners/interface/update.md
index 27089467d2..11334f772d 100644
--- a/docs/auditor/10.9/accessreviews/resourceowners/interface/update.md
+++ b/docs/auditor/10.9/accessreviews/resourceowners/interface/update.md
@@ -6,13 +6,13 @@ sidebar_position: 20
# Update Resource Wizard
-The Update resource wizard is opened with the **Update** button in the Resource Owners interface.
+The **Update** button in the Resource Owners interface opens the Update resource wizard.
It contains three pages:
-- 1. Select Owners — Lists the current owner(s). Modify by adding new owners, removing owners, or
+- 1. Select Owners — Lists the current owners. Modify by adding new owners, removing owners, or
changing owner priority order (primary, secondary, etc.)
- 2. Description — Enter or modify a note describing the resource
- 3. Summary — Provides a preview of the settings selected within the wizard
@@ -21,14 +21,14 @@ See the Update a Resource topic for additional information.
## Update a Resource
-Follow the steps to update ownership configuration for a resource.
+To update ownership configuration for a resource:
-**Step 1 –** In the Resource Owners interface, select the desired resource and click **Update**. The
+**Step 1 –** In the Resource Owners interface, select the resource you want and click **Update**. The
Update resource wizard opens.
-**Step 2 –** The Select Owners page lists the currently assigned owner(s). Modify as desired and
+**Step 2 –** The Select Owners page lists the assigned owners. Modify as desired and
click **Next** to continue.
- Add new owners — Click **Add** to browse for a new owner. See the
@@ -44,14 +44,14 @@ information on the owners:
- Owner Mail — Trustee's email address as read from Active Directory
- Owner Title — Trustee's title as read from Active Directory
- Owner Department — Trustee's department as read from Active Directory
-- Confirmed — Indicates whether or not the assigned owner has confirmed ownership of that resource.
+- Confirmed — Indicates whether the assigned owner has confirmed ownership of that resource.
Tool-tips display when hovering over the icons indicating whether the resource ownership has been
confirmed, declined, pending response, or that a confirmation has not been requested.
**Step 3 –** The Description page displays any description that has been provided by either the
-Ownership Administrator or the assigned owner(s) for the resource. Modify as desired by typing in
+Ownership Administrator or the assigned owners for the resource. Modify as desired by typing in
the textbox. Then click **Next** to continue.
@@ -64,4 +64,4 @@ application begins to process the ownership changes.
**Step 5 –** The action status displays on the page. When the update has completed (100%), click
**Close**. The Update resource wizard closes.
-This updates to ownership configuration have been processed.
+These updates to ownership configuration have been processed.
diff --git a/docs/auditor/10.9/accessreviews/resourceowners/overview.md b/docs/auditor/10.9/accessreviews/resourceowners/overview.md
index 75936e496a..c71a235a38 100644
--- a/docs/auditor/10.9/accessreviews/resourceowners/overview.md
+++ b/docs/auditor/10.9/accessreviews/resourceowners/overview.md
@@ -7,24 +7,23 @@ sidebar_position: 30
# Resource Owners Overview
The Resource Owners interface is where Access Reviews Console users with either the Security Team or
-Administrator role (to be referred to as Ownership Administrators) can assign ownership of resources
-to be managed through the application. Assigned owners do not require a console user role. Resources
-to be included in the Access Reviews workflow must first be assigned owners within the Resource
-Owners interface.
+Administrator role (referred to as Ownership Administrators) can assign ownership of resources
+to be managed through the application. Assigned owners don't require a console user role. You must
+assign owners to resources within the Resource Owners interface before including them in the
+Access Reviews workflow.
**_RECOMMENDED:_** The Access Reviews application is configured to send Notifications.
_Remember,_ a “resource” refers to the file system shared folders, SharePoint Online site
-collections, and Active Directory (AD) groups. All data available within the Access Reviews
-application is collected by Netwrix Auditor according to the synchronized monitoring plans.
+collections, and Active Directory (AD) groups. Netwrix Auditor collects all data available within
+the Access Reviews application according to the synchronized monitoring plans.
-“Owners” are the users who are responsible for reviewing access to the resources to which they are
-assigned.
+“Owners” are the users responsible for reviewing access to their assigned resources.
-The My Reviews interface provides owners with access to historical and pending reviews. The My
-Reviews interface is only accessible to users who have been assigned ownership of at least one
-resource. Owners without a console user role are directed to the My Reviews interface at login.
-Owners with a console user role access the pending and historical reviews for their resources by
+The My Reviews interface provides owners with access to historical and pending reviews. Only users
+who own at least one resource can access the My Reviews interface. Owners without a console user
+role go directly to the My Reviews interface at login. Owners with a console user role access the
+pending and historical reviews for their resources by
clicking the My Reviews tab. See the [Pending Reviews](/docs/auditor/10.9/accessreviews/owneroverview/pendingreviews/pendingreviews.md)
topic for additional information.
@@ -70,7 +69,7 @@ Prerequisite:
Workflow:
-**NOTE:** This workflow is not numbered because the Notification piece can occur at any time in the
+**NOTE:** This workflow isn't numbered because the Notification piece can occur at any time in the
workflow.
- Add resources to be managed by associating a business data owner with a resource. See the
@@ -88,7 +87,7 @@ information:
- An explanation of what a review is and why your organization is conducting them through the
Netwrix Auditor Access Reviews application.
- How owners should log into the application console, specifically what URL and credentials to use.
-- Expectation on response times
+- Expected response times
- How to access instructions on how to complete a review. You can link to the
[Owners & Access Reviews](/docs/auditor/10.9/accessreviews/owneroverview/owneroverview.md) topic or download that topic and its subtopics as a
PDF and make it available within your corporate resources.
diff --git a/docs/auditor/10.9/accountlockoutexaminer/configure.md b/docs/auditor/10.9/accountlockoutexaminer/configure.md
index 02751fa1d2..4885b6383f 100644
--- a/docs/auditor/10.9/accountlockoutexaminer/configure.md
+++ b/docs/auditor/10.9/accountlockoutexaminer/configure.md
@@ -11,8 +11,8 @@ environment, as described in this section.
## System requirements
-Make sure that the machine where you plan install the solution meets the system requirements listed
-below.
+Ensure that the machine where you plan to install the solution meets the following system
+requirements.
**Hardware:**
@@ -43,15 +43,15 @@ domains.
## Licensing
-Account Lockout Examiner is shipped with a free pre-configured license that will be valid until a
-newer version becomes available. You will be notified on the new version release by the
-corresponding message displayed in the product. Then you will need to download that new version.
+Netwrix ships Account Lockout Examiner with a free pre-configured license that's valid until a
+newer version becomes available. The product notifies you of the new version release with a
+corresponding message. Then you'll need to download the new version.
## Target infrastructure
For the solution to connect to and retrieve the necessary information from the Windows machines that
-may become the potential lockout reasons, your infrastructure should meet the requirements listed
-below.
+may become the potential lockout reasons, your infrastructure should meet the following
+requirements.
### Target systems and platforms
@@ -73,7 +73,7 @@ lockout reason detection:
### Inbound firewall rules
-Make sure the following **Inbound** firewall rules are enabled on the Domain Controllers and domain
+Ensure the following **Inbound** firewall rules are enabled on the Domain Controllers and domain
computers:
- File and Printer Sharing (Echo Request - ICMPv4-In)
@@ -92,16 +92,16 @@ The following **TCP** ports should be open on the Domain Controllers and domain
### Recommended network security settings
-Security researches revealed that NTLM and NTLMv2 authentication is vulnerable to a variety of
+Security research has revealed that NTLM and NTLMv2 authentication is vulnerable to a variety of
malicious attacks, including SMB replay, man-in-the-middle attacks, and brute force attacks.
-To make Windows operating system use more secure protocols (e.g. Kerberos version 5), the outgoing
-NTLM authentication traffic should be disabled for the machine where Netwrix Account Lockout
-Examiner will run. (See also
+To make the Windows operating system use more secure protocols (e.g. Kerberos version 5), disable
+the outgoing NTLM authentication traffic for the machine where Netwrix Account Lockout Examiner
+runs. (See also
[this Microsoft article](https://docs.microsoft.com/en-us/windows/win32/secauthn/microsoft-negotiate).)
For that, you need to set the **Network Security: Restrict NTLM: Outgoing NTLM traffic to remote
-servers** policy setting to **Deny All**. This can be done locally on the machine hosting Netwrix
+servers** policy setting to **Deny All**. You can do this locally on the machine hosting Netwrix
Account Lockout Examiner, or via Group Policy.
To disable outgoing NTLM authentication traffic locally:
diff --git a/docs/auditor/10.9/accountlockoutexaminer/overview.md b/docs/auditor/10.9/accountlockoutexaminer/overview.md
index ed09f54f50..1a2ec66d34 100644
--- a/docs/auditor/10.9/accountlockoutexaminer/overview.md
+++ b/docs/auditor/10.9/accountlockoutexaminer/overview.md
@@ -25,19 +25,19 @@ You can investigate lockouts originating from the following sources:
## Upgrade recommendations
-Since the functionality of older and newer versions does not match one-to-one (see Feature
+Since the functionality of older and newer versions doesn't match one-to-one (see Feature
comparison of Netwrix Account Lockout Examiner 4.1 and 5.x), there is no upgrade path for **Netwrix
Account Lockout Examiner 4.1**.
-Though its users can continue working with that older version, we recommend to use the latest
+Though its users can continue working with that older version, Netwrix recommends using the latest
Netwrix Account Lockout Examiner to benefit from the variety of its new features and enhanced
usability.
## Feature comparison of Netwrix Account Lockout Examiner 4.1 and 5.x
-Netwrix Account Lockout Examiner 5.1 and later is not an evolutionary update, but rather a total
-revamp of version 4.1. Hence, the functionality of the older and newer versions does not match
-one-to-one. Feature comparison is provided in the table below.
+Netwrix Account Lockout Examiner 5.1 and later isn't an evolutionary update, but rather a total
+revamp of version 4.1. Hence, the functionality of the older and newer versions doesn't match
+one-to-one. The following table provides a feature comparison.
| Feature | Version 4.1 | Version 5.x |
| ----------------------------------------------------------------- | ----------------------- | ----------------------------------------------------------------------------------------------------------- |
@@ -64,7 +64,7 @@ one-to-one. Feature comparison is provided in the table below.
Users of Account Lockout Examiner 4.1 can continue using that older version, as there is no upgrade
path, just a new installation of the latest version.
-We welcome any feedback and ideas you might have. You can check in on
+Netwrix welcomes any feedback and ideas you might have. You can check in on
[Netwrix page at Spiceworks](https://community.spiceworks.com/pages/NetWrix?tab=353) or submit
-direct feedback via
-[this link](https://community.spiceworks.com/products/47099-netwrix-account-lockout-examiner).
+direct feedback via the
+[Netwrix Account Lockout Examiner Spiceworks product page](https://community.spiceworks.com/products/47099-netwrix-account-lockout-examiner).
diff --git a/docs/auditor/10.9/accountlockoutexaminer/usage.md b/docs/auditor/10.9/accountlockoutexaminer/usage.md
index 7b88e14031..e33b05f1e9 100644
--- a/docs/auditor/10.9/accountlockoutexaminer/usage.md
+++ b/docs/auditor/10.9/accountlockoutexaminer/usage.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Examining Lockouts
-To start using **Netwrix Account Lockout Examiner**, download it from Netwrix web site. Once the
+To start using **Netwrix Account Lockout Examiner**, download it from Netwrix web site. After the
download completes, run the executable from your browser menu or from your **Downloads** folder.
To find out why an Active Directory account was locked out, perform the following steps:
@@ -26,8 +26,8 @@ To find out why an Active Directory account was locked out, perform the followin
-Once the examination completes, you will be presented with a list of reasons why the account you
-supplied is being locked out.
+After the examination completes, Netwrix Account Lockout Examiner displays a list of reasons why
+the account you supplied was locked out.
## Modifying product settings
@@ -36,7 +36,7 @@ After you click **Settings** in the main window, you can apply the following opt
| Option | Description | Default |
| ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------- |
| **Examining** | | |
-| Skip unresolved IP addresses | For safety reasons, Netwrix Account Lockout Examiner by default does not connect to the unknown and potentially dangerous IP addresses. See [this Knowledge Base article](https://kb.netwrix.com/5810) for more information. | Enabled |
+| Skip unresolved IP addresses | For safety reasons, Netwrix Account Lockout Examiner by default doesn't connect to the unknown and potentially dangerous IP addresses. See [this Knowledge Base article](https://kb.netwrix.com/5810) for more information. | Enabled |
| Examine all domain controllers | Select this option if you want to examine all domain controllers to detect potential lockout reason. | Disabled |
| **Usage statistics** | | |
| Take part in Netwrix Customer Experience Improvement program | Select this option to participate in the program. See [this Knowledge Base article](https://kb.netwrix.com/5820) for more information on the program. | |
@@ -45,17 +45,17 @@ After you click **Settings** in the main window, you can apply the following opt
## Troubleshooting
-Log files of Netwrix Account Lockout Examiner can be found in the _%ProgramData%\Netwrix Account
+Find log files for Netwrix Account Lockout Examiner in the _%ProgramData%\Netwrix Account
Lockout Examiner\Logs_ folder.
| Symptom | Cause | Solution |
| --------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| In the environments with root/child domains, you may receive the "_Could not query ComputerName. Access is denied_." error. | The account used to run Netwrix Account Lockout Examiner is not a member of the local **Administrators** group on the workstations in both root and child domains. Administrative rights are required to access the Security Event logs on these workstations. | Make sure this account is included in the local **Administrators** group. |
-| **Issues encountered during examination** section is shown in the examination results. | Most probably this means that **Netwrix Account Lockout Examiner** cannot reach some of the data sources it needs. | - Check that you have configured the audit settings in the target domain as described in [Required audit settings](configure.md#required-audit-settings) section. - Check that network connectivity between the Account Lockout Examiner machine and the domain controllers in your domain works properly. |
+| In the environments with root/child domains, you may receive the "_Could not query ComputerName. Access is denied_." error. | The account used to run Netwrix Account Lockout Examiner isn't a member of the local **Administrators** group on the workstations in both root and child domains. Administrative rights are required to access the Security Event logs on these workstations. | Ensure this account is included in the local **Administrators** group. |
+| **Issues encountered during examination** section is shown in the examination results. | Most probably this means that **Netwrix Account Lockout Examiner** can't reach some of the data sources it needs. | - Check that you have configured the audit settings in the target domain as described in [Required audit settings](configure.md#required-audit-settings) section. - Check that network connectivity between the Account Lockout Examiner machine and the domain controllers in your domain works properly. |
-We welcome any feedback and ideas you might have. Please take a minute to check in on
+Netwrix welcomes any feedback and ideas you might have. Take a minute to check in on
[Netwrix page at Spiceworks](https://community.spiceworks.com/pages/NetWrix?tab=353) or submit
-direct feedback via
-[this link](https://community.spiceworks.com/products/47099-netwrix-account-lockout-examiner).
+direct feedback via the
+[Netwrix Account Lockout Examiner Spiceworks product page](https://community.spiceworks.com/products/47099-netwrix-account-lockout-examiner).
diff --git a/docs/auditor/10.9/addon/alienvaultusm/automate.md b/docs/auditor/10.9/addon/alienvaultusm/automate.md
index 565034bb6e..e39e18a220 100644
--- a/docs/auditor/10.9/addon/alienvaultusm/automate.md
+++ b/docs/auditor/10.9/addon/alienvaultusm/automate.md
@@ -13,12 +13,12 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
-how often audit data is exported from Auditor and saved to event log. Netwrix recommends scheduling a
-daily task.
+how often the add-on exports audit data from Auditor and saves it to the event log. Netwrix
+recommends scheduling a daily task.
**Step 4 –** On the **Actions** tab, click **New** and specify action details. Review the following
for additional information:
diff --git a/docs/auditor/10.9/addon/alienvaultusm/integrationeventlog.md b/docs/auditor/10.9/addon/alienvaultusm/integrationeventlog.md
index 89e249d88c..25f011b9d7 100644
--- a/docs/auditor/10.9/addon/alienvaultusm/integrationeventlog.md
+++ b/docs/auditor/10.9/addon/alienvaultusm/integrationeventlog.md
@@ -9,8 +9,8 @@ sidebar_position: 60
This section describes how the add-on fills in the Netwrix Auditor **Integration** event log fields
with data retrieved from Activity Records.
-The Activity Record structure is described in the
-[Reference for Creating Activity Records](/docs/auditor/10.9/api/activityrecordreference.md)topic.
+The [Reference for Creating Activity Records](/docs/auditor/10.9/api/activityrecordreference.md)
+topic describes the Activity Record structure.
| Event log field name | Filled in with value | Details |
| -------------------- | --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+The add-on fills in Details only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.9/addon/alienvaultusm/overview.md b/docs/auditor/10.9/addon/alienvaultusm/overview.md
index ae034ef4f2..f52a50ca6c 100644
--- a/docs/auditor/10.9/addon/alienvaultusm/overview.md
+++ b/docs/auditor/10.9/addon/alienvaultusm/overview.md
@@ -15,10 +15,10 @@ data collected by the SIEM solution.
The add-on enriches your SIEM data with actionable context in human-readable format, including the
before and after values for every change and data access attempt, both failed and successful.
Aggregating data into a single audit trail simplifies analysis, makes your SIEM more cost effective,
-and helps you keep tabs on your IT infrastructure.
+and helps you monitor your IT infrastructure.
Implemented as a PowerShell script, this add-on facilitates the audit data transition from Netwrix
-Auditor to the SIEM solution. All you have to do is provide connection details and schedule the
+Auditor to the SIEM solution. Provide connection details and schedule the
script for execution.
On a high level, the add-on works as follows:
@@ -41,10 +41,10 @@ follows:
| On... | Ensure that... |
| ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The Auditor server side | - Auditor version is **10.0** or later. - The Audit Database settings are configured in Auditor Server. See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) and [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topics for additional information. - The TCP 9699 port (default Auditor Integration API port) is open for inbound connections. - The user retrieving data from the Audit Database is granted the Global reviewer role in Auditor or is a member of the Netwrix Auditor Client Users group. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) topic for additional information. Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user will have the most extended permissions in the product. |
-| The computer where the script will be executed | - PowerShell **3.0** or later must be installed. - .NET **4.5** or later must be installed. - Execution policy for powershell scripts is set to _"Unrestricted"_. Run Windows PowerShell as administrator and execute the following command: Set-ExecutionPolicy Unrestricted - The user running the script is granted the write permission on the script folder—the add-on creates a special .bin file with the last exported event. - The user running the script must be a member of the Domain Users group. - At least the first script run should be performed under the account with elevated privileges, as it will be necessary to create event log file and perform other required operations. |
+| The Auditor server side | - Auditor version is **10.0** or later. - The Audit Database settings are configured in Auditor Server. See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) and [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topics for additional information. - The TCP 9699 port (default Auditor Integration API port) is open for inbound connections. - The user retrieving data from the Audit Database is granted the Global reviewer role in Auditor or is a member of the Netwrix Auditor Client Users group. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) topic for additional information. Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user has the most extended permissions in the product. |
+| The computer where the script will be executed | - PowerShell **3.0** or later must be installed. - .NET **4.5** or later must be installed. - Execution policy for powershell scripts is set to _"Unrestricted"_. Run Windows PowerShell as administrator and execute the following command: Set-ExecutionPolicy Unrestricted - The user running the script is granted the write permission on the script folder—the add-on creates a special .bin file with the last exported event. - The user running the script must be a member of the Domain Users group. - The first script run happens under an account with elevated privileges, since creating the event log file and completing other required operations requires those privileges. |
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts
+that use the Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.9/addon/alienvaultusm/parameters.md b/docs/auditor/10.9/addon/alienvaultusm/parameters.md
index d80920cbeb..5db49fb8dd 100644
--- a/docs/auditor/10.9/addon/alienvaultusm/parameters.md
+++ b/docs/auditor/10.9/addon/alienvaultusm/parameters.md
@@ -7,8 +7,8 @@ sidebar_position: 10
# Define Parameters
Before running or scheduling the add-on, you must define connection details: Auditor Server host,
-user credentials, etc. Most parameters are optional, the script uses the default values unless
-parameters are explicitly defined. You can skip or define parameters depending on your execution
+user credentials, etc. Most parameters are optional; the script uses the default values unless you
+explicitly define them. You can skip or define parameters depending on your execution
scenario and security policies. See the [Choose Appropriate Execution Scenario](/docs/auditor/10.9/addon/alienvaultusm/deployment.md) topic
for additional information.
@@ -16,8 +16,8 @@ for additional information.
| --------------------------------- | ------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Connection to Netwrix Auditor** | | |
| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting the Auditor Server and uses default port 9699. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., WKS.enterprise.local:9999). |
-| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format. The account must be assigned the Global reviewer role in Auditor or be a member of the Netwrix Auditor **Client Users** group on the computer hosting Auditor Server. |
-| NetwrixAuditorPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
+| NetwrixAuditorUserName | Current user credentials | By default, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format. The account must be assigned the Global reviewer role in Auditor or be a member of the Netwrix Auditor **Client Users** group on the computer hosting Auditor Server. |
+| NetwrixAuditorPassword | Current user credentials | By default, the script runs with the current user credentials. Provide a different password if necessary. |
## In-Script Parameters
@@ -25,16 +25,16 @@ You may also need to modify the parameters that define how EventIDs should be ge
events, though their default values address most popular usage scenarios. In-script parameters are
listed in the table below. To modify them, open the script for edit and enter the values you need.
-Once set, these parameter values must stay unchanged until the last run of the script — otherwise
-dynamically calculated EventIDs will be modified and applied incorrectly.
+After you set these parameter values, don't change them until the last run of the script — otherwise
+the add-on modifies and applies dynamically calculated EventIDs incorrectly.
| Parameter | Default value | Description |
| -------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.9/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.9/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId\* | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to _TRUE_. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the add-on uses the default value _Netwrix_Auditor_Integration_API_. If the event source for particular DataSource doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
\* When configuring the **IncludeDataSourceToMakeEventId** parameter, consider that the _Object
Type - Action_ pair may be identical for several data sources (e.g., Object='User' and
diff --git a/docs/auditor/10.9/addon/alienvaultusm/powershell.md b/docs/auditor/10.9/addon/alienvaultusm/powershell.md
index f066d2b7b0..1818963c84 100644
--- a/docs/auditor/10.9/addon/alienvaultusm/powershell.md
+++ b/docs/auditor/10.9/addon/alienvaultusm/powershell.md
@@ -8,17 +8,17 @@ sidebar_position: 40
First, provide a path to your add-on followed by script parameters with their values. Each parameter
is preceded with a dash; a space separates a parameter name from its value. You can skip some
-parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
+parameters— the script uses a default value unless you explicitly define one. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
+To run the add-on with PowerShell:
-**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
+**Step 1 –** On the computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on, or drag and drop the add-on file into the console
window.
-**Step 3 –** Add script parameters. The console will look similar to the following:
+**Step 3 –** Add script parameters. The console looks similar to the following:
Windows PowerShell
@@ -33,18 +33,18 @@ quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Ad
**Step 4 –** Hit **Enter**.
Depending on the number of Activity Records stored in Netwrix Auditor Audit Database execution may
-take a while. Ensure the script execution completed successfully. The Netwrix Auditor Integration
-event log will be created and filled with events.
+take a while. Ensure the script execution completed successfully. Netwrix Auditor creates the
+Netwrix Auditor Integration event log and fills it with events.
-By default, the Netwrix Auditor Integration event log size is set to 1GB, and retention is set to
-"_Overwrite events as needed_". For more information about event log fields, see the documentation.
+By default, the add-on sets the Netwrix Auditor Integration event log size to 1GB and the retention
+to "_Overwrite events as needed_". For more information about event log fields, see the documentation.
-**NOTE:** Event records with more than 30,000 characters length will be trimmed.
+**NOTE:** The add-on trims event records longer than 30,000 characters.
At the end of each run, the script creates the
**Netwrix_Auditor_Event_Log_Export_Add-on_EventIDs.txt** file. It defines mapping between the
Activity Records and related Event IDs . You can use this file to track possible duplicates of Event
-IDs created at each script execution. Duplicates, if any, are written to the
+IDs created at each script execution. The script writes duplicates, if any, to the
**Netwrix_Auditor_Event_Log_Export_Add-on_EventIDsDuplicates.txt** file.
Similarly, the add-on also creates the **Netwrix_Auditor_Event_Log_Export_Add-on_CategoriesIDs.txt**
@@ -52,14 +52,14 @@ file that defines mapping between the Data Source and related Category ID.
## Applying Filters
-Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
-start retrieving new Activity Records. Consider the following:
+Every time you run the script, Auditor makes a timestamp. The next time you run the script, it
+retrieves new Activity Records starting from that timestamp. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
- running the add-on for the first time (there is no timestamp yet) with no filters, it will export
- Activity Records for the last month only. This helps to optimize solution performance during the
- first run. At the end of the first run, the timestamp will be created, and the next run will start
- export from that timestamp.
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you're
+ running the add-on for the first time (there is no timestamp yet) with no filters, the add-on
+ exports Activity Records for the last month only. This helps to optimize solution performance
+ during the first run. At the end of the first run, the add-on creates the timestamp, and the next
+ run starts the export from that timestamp.
-- However, if you have specified a time period for Activity Records to be exported, then this filter
- will be applied at the add-on first run and the runs that follow.
+- However, if you specify a time period for Activity Records to export, the add-on applies this
+ filter at the first run and all runs that follow.
diff --git a/docs/auditor/10.9/addon/amazonwebservices/automate.md b/docs/auditor/10.9/addon/amazonwebservices/automate.md
index 3f94bb6b1e..67b72f423e 100644
--- a/docs/auditor/10.9/addon/amazonwebservices/automate.md
+++ b/docs/auditor/10.9/addon/amazonwebservices/automate.md
@@ -13,12 +13,12 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
-how often audit data is exported from Auditor and saved to event log. Netwrix recommends scheduling a
-daily task.
+how often the add-on exports audit data from Auditor and saves it to the event log. Netwrix
+recommends scheduling a daily task.
**Step 4 –** On the **Actions** tab, click **New** and specify action details. Review the following
for additional information:
diff --git a/docs/auditor/10.9/addon/amazonwebservices/collecteddata.md b/docs/auditor/10.9/addon/amazonwebservices/collecteddata.md
index b692a9f7ab..f9c2e1ebfc 100644
--- a/docs/auditor/10.9/addon/amazonwebservices/collecteddata.md
+++ b/docs/auditor/10.9/addon/amazonwebservices/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data.
+To work with collected data:
**Step 1 –** Start the Auditor client and navigate to **Search**.
diff --git a/docs/auditor/10.9/addon/amazonwebservices/overview.md b/docs/auditor/10.9/addon/amazonwebservices/overview.md
index 27b085d92b..dc676abb7a 100644
--- a/docs/auditor/10.9/addon/amazonwebservices/overview.md
+++ b/docs/auditor/10.9/addon/amazonwebservices/overview.md
@@ -7,21 +7,21 @@ sidebar_position: 20
# Amazon Web Services
Amazon Web Services (AWS) provides a wide range of cloud-based services, including solutions and
-management tools for virtualization, data storage and hosting, private networking, relational and
+management tools for virtualization, data storage and hosting, private networking, relational, and
NoSQL databases, and many more. AWS CloudTrail is an internal tracking service that records AWS API
-calls. Companies leverage this information for analyzing user activity patterns and detecting
-potential threats. Unfortunately, collected audit data cannot be used for future reference: AWS
+calls. Companies use this information to analyze user activity patterns and detect
+potential threats. Unfortunately, you can't use collected audit data for future reference: AWS
CloudTrail stores events for 7 days allowing administrators and security analysts to review data for
only short time periods.
Netwrix Auditor helps you gain complete visibility into Amazon Web Services user and service
activity. The Add-on for Amazon Web Services extends native AWS CloudTrail auditing and reporting
possibilities. Aggregating data into a single audit trail simplifies activity analysis and helps you
-keep tabs on your hybrid cloud IT infrastructure. With Netwrix Auditor, AWS audit data is kept for
-much longer periods of time and always ready for review in easy-to-use search interface.
+monitor your hybrid cloud IT infrastructure. With Netwrix Auditor, you keep AWS audit data for
+much longer periods of time and can always review it in an easy-to-use search interface.
Implemented as a PowerShell script, this add-on automates the acquisition of Amazon Web Services
-CloudTrail logs and their transition to Netwrix Auditor. All you have to do is provide connection
+CloudTrail logs and their transition to Netwrix Auditor. Provide connection
details and schedule the script for execution.
On a high level, the add-on works as follows:
@@ -30,8 +30,8 @@ On a high level, the add-on works as follows:
- The add-on processes these events into Netwrix Auditor-compatible format (Activity Records). Each
Activity Record contains the user account, action, time, and other details.
- Currently, Netwrix Auditor processes details for the following AWS events (other events can be
- imported without details):
+ Netwrix Auditor processes details for the following AWS events (it can import other events
+ without details):
| | | | |
| -------------- | ------------------- | ------------------ | --------------- |
@@ -46,8 +46,8 @@ See the [Integration API](/docs/auditor/10.9/api/overview.md) topic for addition
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging the Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts
+that use the Integration API. Download the latest add-on version in the Add-on Store.
See the [Integration API](/docs/auditor/10.9/api/overview.md) topic for additional information about schema
updates.
diff --git a/docs/auditor/10.9/addon/amazonwebservices/parameters.md b/docs/auditor/10.9/addon/amazonwebservices/parameters.md
index 10b38966e5..04a1ccd9b8 100644
--- a/docs/auditor/10.9/addon/amazonwebservices/parameters.md
+++ b/docs/auditor/10.9/addon/amazonwebservices/parameters.md
@@ -7,28 +7,28 @@ sidebar_position: 10
# Define Parameters
Before running or scheduling the add-on, you must define connection details: Auditor Server host,
-user credentials, etc. Most parameters are optional, the script uses the default values unless
-parameters are explicitly defined. You can skip or define parameters depending on your execution
+user credentials, etc. Most parameters are optional; the script uses the default values unless you
+explicitly define them. You can skip or define parameters depending on your execution
scenario and security policies. See the [Choose Appropriate Execution Scenario](/docs/auditor/10.9/addon/amazonwebservices/deployment.md)
topic for additional information.
First, provide a path to your add-on followed by script parameters with their values. Each parameter
is preceded with a dash; a space separates a parameter name from its value. You can skip some
-parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
+parameters— the script uses a default value unless you explicitly define one. If necessary,
modify the parameters as required.
| Parameter or switch | Default value | Description |
| ---------------------- | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| AWSSDKInstallPath | 'C:\Program Files (x86)\AWS SDK for .NET' | Assumes that AWS SDK for .NET is installed by its default path. To specify another location, provide a path in single quotes (e.g., '_C:\Program Files (x86)\My SDKs\AWS SDK for .NET_'). |
-| ImportAllEvents | — | By default, only events with processed details will be imported. To import all events, set the switch during the add-on execution. **NOTE:** Importing all events makes audit data less human-readable. |
-| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add- on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer,WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). |
-| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format. **NOTE:** The account must be assigned the **Contributor** role in Auditor. |
-| NetwrixAuditorPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
-| NetwrixAuditorPlan | — | Unless specified, data is written to the **Netwrix\_ Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. **NOTE:** If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the **Netwrix API** data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the **Audit Database**. |
+| ImportAllEvents | — | By default, the add-on imports only events with processed details. To import all events, set the switch during the add-on execution. **NOTE:** Importing all events makes audit data less human-readable. |
+| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer,WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). |
+| NetwrixAuditorUserName | Current user credentials | By default, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format. **NOTE:** The account must be assigned the **Contributor** role in Auditor. |
+| NetwrixAuditorPassword | Current user credentials | By default, the script runs with the current user credentials. Provide a different password if necessary. |
+| NetwrixAuditorPlan | — | By default, the add-on writes data to the **Netwrix\_ Auditor_API** database and doesn't associate it with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, the add-on writes data to a database linked to that plan. **NOTE:** If you select a plan name in the add-on, create a dedicated plan in Auditor, add the **Netwrix API** data source to the plan, and enable the data source for monitoring. Otherwise, the add-on can't write data to the **Audit Database**. |
## Update In-Script Parameters
-**Step 1 –** Right-click a script and select **Edit**. **Windows PowerShell ISE** will start.
+**Step 1 –** Right-click a script and select **Edit**. **Windows PowerShell ISE** starts.
**Step 2 –** Navigate to the following lines:
@@ -43,7 +43,7 @@ $SecretAccessKey = "your AWS secret access key"
| Parameter | Description |
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| RegionEndpoint | Provide an endpoint for your region, e.g., us-east-1 (N. Virginia). **NOTE:** If you use more than one region in your environment, run the script several times with different region endpoints. See the [AWS service endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html) article for additional information. |
-| AccessKeyID | Provide an AWS access key ID for your account. Access key is used to run requests to AWS SDK, CLIs, and API. |
+| AccessKeyID | Provide an AWS access key ID for your account. The access key authenticates requests to the AWS SDK, CLIs, and API. |
| SecretAccessKey | Provide an AWS secret access key that works with your access key ID. |
**Step 4 –** Save the script.
diff --git a/docs/auditor/10.9/addon/amazonwebservices/powershell.md b/docs/auditor/10.9/addon/amazonwebservices/powershell.md
index 515847bf2b..dcb0dc54a8 100644
--- a/docs/auditor/10.9/addon/amazonwebservices/powershell.md
+++ b/docs/auditor/10.9/addon/amazonwebservices/powershell.md
@@ -6,11 +6,11 @@ sidebar_position: 30
# Run the Add-On with PowerShell
-Follow the steps to run add-on with PowerShell:
+To run the add-on with PowerShell:
-**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
+**Step 1 –** On the computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on, or drag and drop the add-on file into the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -29,6 +29,7 @@ quotes and insert the ampersand (&) symbol in front (e.g., & "`C:\Netwrix Add-on
Depending on the number of events logged by CloudTrail it may take a while. Ensure the script
execution completed successfully. Every time you run a script, Auditor makes a checkpoint with the
-last imported event. The next time you run the script, it will start retrieving new events.
+last imported event. The next time you run the script, it retrieves new events starting from that
+checkpoint.
**NOTE:** By default, CloudTrail keeps events for **7** days.
diff --git a/docs/auditor/10.9/addon/arcsight/automate.md b/docs/auditor/10.9/addon/arcsight/automate.md
index a853cd56d1..92b02a7539 100644
--- a/docs/auditor/10.9/addon/arcsight/automate.md
+++ b/docs/auditor/10.9/addon/arcsight/automate.md
@@ -16,7 +16,7 @@ running the add-on.
**Step 2 –** Select **Create Task**.
**Step 3 –** On the **General** tab, specify a task name, e.g., Netwrix Auditor Add-on for ArcSight.
-Make sure the account that runs the task has all necessary rights and permissions.
+Ensure the account that runs the task has all necessary rights and permissions.
**Step 4 –** On the **Triggers** tab, **click** New and define the schedule. This option controls
how often audit data is exported from Auditor and transferred to ArcSight Logger. Netwrix recommends
diff --git a/docs/auditor/10.9/addon/arcsight/collecteddata.md b/docs/auditor/10.9/addon/arcsight/collecteddata.md
index 739b67d6b1..d419ea2811 100644
--- a/docs/auditor/10.9/addon/arcsight/collecteddata.md
+++ b/docs/auditor/10.9/addon/arcsight/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to see collected data.
+**To see collected data:**
**Step 1 –** Log on to your ArcSight Logger web interface.
diff --git a/docs/auditor/10.9/addon/arcsight/deployment.md b/docs/auditor/10.9/addon/arcsight/deployment.md
index a4bc797a6f..5e2151f404 100644
--- a/docs/auditor/10.9/addon/arcsight/deployment.md
+++ b/docs/auditor/10.9/addon/arcsight/deployment.md
@@ -14,11 +14,11 @@ Netwrix suggests the following execution scenarios:
| Scenario | Example |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The add-on runs on the Auditor Server with the current user credentials. Data is written a remote ArcSight through UDP protocol. | C:\Add-ons\Netwrix*Auditor_Add-on_for_HPE* ArcSight.ps1 -ArcSightHost 172.28.6.18 |
-| The add-on runs on the Auditor Server with the current user credentials. Data is written a remote ArcSight through TCP protocol. | C:\Add-ons\Netwrix*Auditor_Add-on_for_HPE* ArcSight.ps1 -TCP -ArcSightHost 172.28.6.18 |
-| The add-on runs on the Auditor Server with the explicitly specified user credentials. Data is written a remote ArcSight with a non-default UDP port. | C:\Add-ons\Netwrix*Auditor_Add-on_for_HPE* ArcSight.ps1 -ArcSightHost 172.28.6.18:9999 -NetwrixAuditorUserName enterprise\NAuser - NetwrixAuditorPassword NetwrixIsCool |
-| The add-on runs on a remote computer with the current user credentials. Data is retrieved from a remote Auditor repository and written to a remote ArcSight. | C:\Add-ons\Netwrix*Auditor_Add-on_for_HPE* ArcSight.ps1 -ArcSightHost 172.28.6.24 - NetwrixAuditorHost 172.28.6.15 |
-| The add-on runs on a remote computer. Data is retrieved from a remote Auditor repository with the explicitly specified user credentials and written to a remote ArcSight. | C:\Add-ons\Netwrix*Auditor_Add-on_for_HPE* ArcSight.ps1 -ArcSightHost 172.28.6.24 - NetwrixAuditorHost 172.28.6.15 -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool |
+| The add-on runs on the Auditor Server with the current user credentials and writes data to a remote ArcSight through the UDP protocol. | C:\Add-ons\Netwrix*Auditor_Add-on_for_HPE* ArcSight.ps1 -ArcSightHost 172.28.6.18 |
+| The add-on runs on the Auditor Server with the current user credentials and writes data to a remote ArcSight through the TCP protocol. | C:\Add-ons\Netwrix*Auditor_Add-on_for_HPE* ArcSight.ps1 -TCP -ArcSightHost 172.28.6.18 |
+| The add-on runs on the Auditor Server with the explicitly specified user credentials and writes data to a remote ArcSight using a non-default UDP port. | C:\Add-ons\Netwrix*Auditor_Add-on_for_HPE* ArcSight.ps1 -ArcSightHost 172.28.6.18:9999 -NetwrixAuditorUserName enterprise\NAuser - NetwrixAuditorPassword NetwrixIsCool |
+| The add-on runs on a remote computer with the current user credentials, retrieves data from a remote Auditor repository, and writes it to a remote ArcSight. | C:\Add-ons\Netwrix*Auditor_Add-on_for_HPE* ArcSight.ps1 -ArcSightHost 172.28.6.24 - NetwrixAuditorHost 172.28.6.15 |
+| The add-on runs on a remote computer, retrieves data from a remote Auditor repository using the explicitly specified user credentials, and writes it to a remote ArcSight. | C:\Add-ons\Netwrix*Auditor_Add-on_for_HPE* ArcSight.ps1 -ArcSightHost 172.28.6.24 - NetwrixAuditorHost 172.28.6.15 -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool |
For security reasons, Netwrix recommends running the script with current user credentials (skipping
user credentials). Create a special user account with permissions to both Auditor data and event log
diff --git a/docs/auditor/10.9/addon/arcsight/overview.md b/docs/auditor/10.9/addon/arcsight/overview.md
index d178b24d1f..81b22e79ed 100644
--- a/docs/auditor/10.9/addon/arcsight/overview.md
+++ b/docs/auditor/10.9/addon/arcsight/overview.md
@@ -6,17 +6,17 @@ sidebar_position: 30
# ArcSight
-Netwrix Auditor helps you extend auditing possibilities and get most from your ArcSight investment.
+Netwrix Auditor helps you extend auditing possibilities and get more value from your ArcSight investment.
The Netwrix Auditor Add-on for ArcSight works in collaboration with Auditor, supplying additional
data that augments the data collected by ArcSight.
The add-on enriches your SIEM data with actionable context in human-readable format, including the
before and after values for every change and data access attempt, both failed and successful.
Aggregating data into a single audit trail simplifies analysis, makes your SIEM more cost effective,
-and helps you keep tabs on your IT infrastructure.
+and helps you monitor your IT infrastructure.
Implemented as a PowerShell script, this add-on facilitates the audit data transition from Netwrix
-Auditor to ArcSight. All you have to do is provide connection details and schedule the script for
+Auditor to ArcSight. To set it up, provide connection details and schedule the script for
execution.
On a high level, the add-on works as follows:
@@ -44,8 +44,8 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging the Integration API. Download the latest add-on version in the Add-on Store. See the
+Ensure to check your product version, and then review and update your add-ons and scripts
+that use the Integration API. Download the latest add-on version in the Add-on Store. See the
[Integration API](/docs/auditor/10.9/api/overview.md)topic for additional information.
The add-on was renamed due to HPE acquisition by Micro Focus. The former add-on name was Netwrix
diff --git a/docs/auditor/10.9/addon/arcsight/parameters.md b/docs/auditor/10.9/addon/arcsight/parameters.md
index 1434e10e53..ecf7b24fd1 100644
--- a/docs/auditor/10.9/addon/arcsight/parameters.md
+++ b/docs/auditor/10.9/addon/arcsight/parameters.md
@@ -7,20 +7,20 @@ sidebar_position: 10
# Define Parameters
Before running or scheduling the add-on, you must define connection details: Auditor Server host,
-user credentials, etc. Most parameters are optional, the script uses the default values unless
-parameters are explicitly defined. You can skip or define parameters depending on your execution
+user credentials, etc. Most parameters are optional; the script uses the default values unless you
+explicitly define them. You can skip or define parameters depending on your execution
scenario and security policies. See the[Choose Appropriate Execution Scenario](/docs/auditor/10.9/addon/arcsight/deployment.md) topic
for additional information.
First, provide a path to your add-on followed by script parameters with their values. Each parameter
is preceded with a dash; a space separates a parameter name from its value. You can skip some
-parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
+parameters— the script uses a default value unless you explicitly define it. If necessary,
modify the parameters as required.
| Parameter or switch | Default value | Description |
| ---------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| TCP | – | By default, UDP protocol is used. Specify the switch during the add-on execution if you want to use TCP protocol for transferring data. Via UDP, events will be sent one by one, via TCP— in a batch. |
+| TCP | – | By default, the add-on uses the UDP protocol. Specify the switch during the add-on execution if you want to use the TCP protocol for transferring data. Via UDP, the add-on sends events one by one; via TCP, it sends them in a batch. |
| ArcSightHost | – | Provide a name of the computer where ArcSight resides (e.g., 172.28.6.18, ArcSightSRV, ArcSightSRV.enterprise.local). **NOTE:** This is a mandatory parameter. Unless specified, the add- on assumes that the default port 514 is used for UDP and 515 for TCP. To specify a non-default port, provide a server name followed by the port number (e.g., _ArcSightSRV.enterprise.local:9998_). |
-| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add- on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). |
+| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). |
| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format. **NOTE:** The account must be assigned the **Global reviewer** role in Netwrix Auditor or be a member of the **Netwrix Auditor Client Users** group on the computer hosting Auditor Server. |
| NetwrixAuditorPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
diff --git a/docs/auditor/10.9/addon/arcsight/powershell.md b/docs/auditor/10.9/addon/arcsight/powershell.md
index 7718acf4af..7c5fd036c4 100644
--- a/docs/auditor/10.9/addon/arcsight/powershell.md
+++ b/docs/auditor/10.9/addon/arcsight/powershell.md
@@ -6,11 +6,11 @@ sidebar_position: 30
# Run the Add-On with PowerShell
-Follow the steps to run add-on with PowerShell:
+**To run the add-on with PowerShell:**
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on, or drag and drop the add-on file into the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -18,14 +18,17 @@ window.
Windows PowerShell PS C:\Users\AddOnUser> C:\Add-ons\Netwrix_Auditor_Add-on_for_HPE_ArcSight.ps1 -
ArcSightHost 172.28.6.24 -NetwrixAuditorHost 172.28.6.15
-**NOTE:** If the script path contains spaces (e.g., _C:\Netwrix Add-ons_), embrace it in double
+**NOTE:** If the script path contains spaces (e.g., _C:\Netwrix Add-ons_), enclose it in double
quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Add-ons_").
-**Step 4 –** Hit **Enter**.
+**Step 4 –** Press **Enter**.
-Depending on the number of Activity Records stored in the Audit Database execution may take a while.
-Ensure the script execution completed successfully. As a result, data will be exported to ArcSight.
-Note that events exceeding 4000 symbols are trimmed.
+Depending on the number of Activity Records stored in the Audit Database, execution may take a while.
+Ensure the script execution completed successfully. The add-on then exports the data to ArcSight.
+
+:::note
+Events exceeding 4,000 characters are trimmed.
+:::
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records.
diff --git a/docs/auditor/10.9/addon/azuresqlmi/collecteddata.md b/docs/auditor/10.9/addon/azuresqlmi/collecteddata.md
index 1d26a2067f..7c2b244700 100644
--- a/docs/auditor/10.9/addon/azuresqlmi/collecteddata.md
+++ b/docs/auditor/10.9/addon/azuresqlmi/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To use data collected with the add-on, you can do the following in Auditor:
- **Search for required data**. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.9/addon/azuresqlmi/deployment.md b/docs/auditor/10.9/addon/azuresqlmi/deployment.md
index ec903b1f5d..d8fce00b98 100644
--- a/docs/auditor/10.9/addon/azuresqlmi/deployment.md
+++ b/docs/auditor/10.9/addon/azuresqlmi/deployment.md
@@ -32,7 +32,7 @@ To integrate with Microsoft Entra ID, you need to create a separate application
- **Description**: "Netwrix Integration Secret"
- **Expires**: Choose appropriate expiration period (recommended: 12-24 months)
4. Click **Add**
-5. **Important**: Copy the secret value - you cannot retrieve it later
+5. **Important**: Copy the secret value - you can't retrieve it later
### 1.3 Configure API Permissions (Optional)
@@ -382,7 +382,7 @@ Run the Netwrix Auditor Add-on Setup Wizard and follow these configuration steps
This Azure SQL Managed Instance add-on is a **free integration solution** for Netwrix Auditor.
-**We value your feedback!** Your experience and suggestions help us improve the add-on. Please share your feedback on:
+Your feedback helps improve the add-on. Share your feedback on:
- Functionality and features
- Documentation and setup process
- Additional requirements or use cases
diff --git a/docs/auditor/10.9/addon/azuresqlmi/overview.md b/docs/auditor/10.9/addon/azuresqlmi/overview.md
index c1ceb83cd3..792b92c8eb 100644
--- a/docs/auditor/10.9/addon/azuresqlmi/overview.md
+++ b/docs/auditor/10.9/addon/azuresqlmi/overview.md
@@ -10,7 +10,7 @@ sidebar_position: 10
This add-on provides comprehensive audit monitoring for Azure SQL Managed Instance using Netwrix Auditor. The setup involves creating Microsoft Entra ID application registration, configuring Azure Storage for audit logs, setting up database-level auditing, and installing the Netwrix add-on.
-The add-on works in collaboration with Netwrix Auditor, supplying audit data from Azure SQL Managed Instance. Aggregating data into a single audit trail simplifies analysis, makes activity monitoring more cost effective, and helps you keep tabs on your IT infrastructure.
+The add-on works in collaboration with Netwrix Auditor, supplying audit data from Azure SQL Managed Instance. Aggregating data into a single audit trail simplifies analysis, makes activity monitoring more cost effective, and helps you monitor your IT infrastructure.
## Prerequisites
@@ -41,7 +41,7 @@ The solution uses:
On a high level, the add-on works as follows:
1. Azure SQL Managed Instance captures audit events at both server and database levels based on configured audit specifications.
-2. Audit logs are automatically written to Azure Blob Storage in a structured format.
+2. Azure SQL Managed Instance automatically writes audit logs to Azure Blob Storage in a structured format.
3. The Netwrix add-on connects to Azure Blob Storage using Microsoft Entra ID authentication.
4. The add-on processes audit logs and converts them into Netwrix Auditor-compatible format (Activity Records). Each Activity Record contains the user account, action, time, and other details.
5. Using the Integration API, the add-on sends the activity records to the Netwrix Auditor Server, which writes them to the Long-Term Archive and the Audit Database.
@@ -88,11 +88,11 @@ The add-on captures comprehensive audit data including:
This Azure SQL Managed Instance add-on is a **free integration solution** for Netwrix Auditor.
-**We value your feedback!** Your experience and suggestions help us improve the add-on. Please share your feedback on:
+Your feedback helps improve the add-on. Share your feedback on:
- Functionality and features
- Documentation and setup process
- Additional requirements or use cases
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts that use the Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.9/addon/connectwise/configure.md b/docs/auditor/10.9/addon/connectwise/configure.md
index 3e6a26b513..2e293094d5 100644
--- a/docs/auditor/10.9/addon/connectwise/configure.md
+++ b/docs/auditor/10.9/addon/connectwise/configure.md
@@ -10,10 +10,10 @@ This section describes how to configure settings of the main add-on component, N
**ConnectWise Manage Integration Service** that is required for connection to ConnectWise Manage and
service ticket creation.
-Follow the steps to configure ConnectWise.
+To configure ConnectWise:
-**Step 1 –** To connect to ConnectWise Manage REST API, the API keys will be required. To obtain
-them, you will need an API Member account. See
+**Step 1 –** To connect to the ConnectWise Manage REST API, you need API keys. To obtain
+them, you need an API Member account. See
[this article](https://docs.connectwise.com/ConnectWise_Documentation/090/040/010/040) for details.
**Step 2 –** Navigate to the add-on folder and run ConfigureConnection.exe. Follow the steps of the
@@ -40,7 +40,7 @@ step, specify the following:
| Service Team | Service team that will be responsible for tickets handling. |
| Priority | Priority for ticket handling. Default is _Priority 3 — Normal Response_. |
-**Step 4 –** Configure how Auditor activity record fields will be mapped with **ConnectWise Manage**
+**Step 4 –** Configure how Auditor activity record fields map to **ConnectWise Manage**
ticket fields.
@@ -52,8 +52,8 @@ ticket fields.
| Severity Level | Specify what severity level will be assigned to the service tickets. Default is Medium. |
| Business Impact | Specify what business impact level will be assigned to the service tickets. Default is Medium. |
-Optionally, you can click the Create Test Ticket button — then a test ticket will be created in
-ConnectWise Manage to help you verify the connection and ticketing settings you configured.
+Optionally, click the Create Test Ticket button to create a test ticket in
+ConnectWise Manage that helps you verify the connection and ticketing settings you configured.
Its Summary field will contain _[Netwrix Auditor] Test Alert_; its Initial Description field will
contain _This ticket was created to test the functionality of Netwrix Auditor Add-on for ConnectWise
Manage_. Also, the test ticket will have a sample attachment (_TestAttachment.txt_).
diff --git a/docs/auditor/10.9/addon/connectwise/connectionticketingsettings.md b/docs/auditor/10.9/addon/connectwise/connectionticketingsettings.md
index dade7fbb0b..db1eb8f744 100644
--- a/docs/auditor/10.9/addon/connectwise/connectionticketingsettings.md
+++ b/docs/auditor/10.9/addon/connectwise/connectionticketingsettings.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# Connection and Ticketing Settings
-It is recommended that you use configuration wizard to specify connection and ticketing settings.
-However, you can adjust them manually, using the information provided in this section.
+Use the configuration wizard to specify connection and ticketing settings. However, you can adjust
+them manually, using the information provided in this section.
## Settings for ConnectWise Ticket Creation
@@ -23,7 +23,7 @@ values are provided. Add more ticket parameters or update values if necessary.
| `` | `` | Description |
| ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Summary | [Netwrix Auditor] %AlertName% | Instructs the system to fill in the Summary ticket field with the Auditor alert name (e.g., _[Netwrix Auditor] Password Reset)_. |
-| InitialDescription | Alert Details: Who: %Who% Action: %Action% Object type: %ObjectType% What: %What% When: %When% Where: %Where% Workstation: %Workstation% Details: %Details% Data source: %DataSource% Monitoring plan: %MonitoringPlanName% Item: %Item% Sent by Netwrix Auditor from %Computer% | Instructs the system to fill in the InitialDescription ticket field with the Auditor activity record data. To read more about activity records, see the [Reference for Creating Activity Records](/docs/auditor/10.9/api/activityrecordreference.md) topic for additional information. You may need to fill in the internal description intended for use by MSP only (this description will not be visible to managed clients), perform the following steps: **Step 1 –** Run the configuration wizard (or modify _ConnectWiseSettings.xml_) to specify the settings you need. **Step 2 –** Then open _ConnectWiseSettings.xml_ for edit. **Step 3 –** Locate the **InitialDescription** parameter and change the Name attribute to _initialInternalAnalysis_. |
+| InitialDescription | Alert Details: Who: %Who% Action: %Action% Object type: %ObjectType% What: %What% When: %When% Where: %Where% Workstation: %Workstation% Details: %Details% Data source: %DataSource% Monitoring plan: %MonitoringPlanName% Item: %Item% Sent by Netwrix Auditor from %Computer% | Instructs the system to fill in the InitialDescription ticket field with the Auditor activity record data. For more information about activity records, see the [Reference for Creating Activity Records](/docs/auditor/10.9/api/activityrecordreference.md) topic for additional information. You may need to fill in the internal description intended for use by MSP only (this description will not be visible to managed clients), perform the following steps: **Step 1 –** Run the configuration wizard (or modify _ConnectWiseSettings.xml_) to specify the settings you need. **Step 2 –** Then open _ConnectWiseSettings.xml_ for edit. **Step 3 –** Locate the **InitialDescription** parameter and change the Name attribute to _initialInternalAnalysis_. |
| Impact/Urgency | Medium | Instructs the system to set ticket Impact/Urgency to _Medium_. |
## Parameters for Handling Related Tickets
@@ -43,7 +43,7 @@ automatically.
| Name | Description |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| ClosedTicketStates TicketState | Lists closed ticket statuses. By default, resolved, closed, and canceled tickets can be reopened. To specify a new status, provide its ID in the `` tag (e.g., 8 for canceled). |
-| NewState | Defines a ticket status once it is reopened. By default, is set to _new_. To specify another status, provide its ID in the `` tag (e.g., _1_ for _new_). |
+| NewState | Defines a ticket status after it is reopened. By default, is set to _new_. To specify another status, provide its ID in the `` tag (e.g., _1_ for _new_). |
When finished, save your changes to configuration file.
@@ -51,8 +51,8 @@ Remember to restart the add-on service every time you update any of configuratio
## Review Other Parameters
-You can update other parameters with your own values if necessary; however, it is recommended that
-you contact Netwrix before modifying this section.
+You can update other parameters with your own values if necessary; however, contact Netwrix before
+modifying this section.
| Name | Description |
| --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
diff --git a/docs/auditor/10.9/addon/connectwise/deployment.md b/docs/auditor/10.9/addon/connectwise/deployment.md
index a8ed4bee29..ad73781187 100644
--- a/docs/auditor/10.9/addon/connectwise/deployment.md
+++ b/docs/auditor/10.9/addon/connectwise/deployment.md
@@ -6,19 +6,19 @@ sidebar_position: 10
# Deploy the Add-On
-Follow the steps to deploy the Add-On for ConnectWise.
+To deploy the Add-On for ConnectWise:
**Step 1 –** Prepare Auditor for using the add-on:
1. In the Auditor settings, enable Integration API and specify connection port. See the
[Integrations](/docs/auditor/10.9/admin/settings/integrations.md) topic for additional information.
-2. Make sure your monitoring plans set up in Auditor are using Audit Databases to store collected
+2. Ensure your monitoring plans set up in Auditor are using Audit Databases to store collected
data. See the [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topic for additional
information.
**Step 2 –** Download the add-on package and copy it to the computer where Auditor Server resides.
-**Step 3 –** Unpack the ZIP archive to a folder of your choice; by default, it will be unpacked to
+**Step 3 –** Unpack the ZIP archive to a folder of your choice. By default, the archive unpacks to
the Netwrix Auditor Add-On for ConnectWise Manage folder.
**Step 4 –** Run the install.cmd file. It will deploy and enable the Netwrix Auditor **ConnectWise
diff --git a/docs/auditor/10.9/addon/connectwise/msp.md b/docs/auditor/10.9/addon/connectwise/msp.md
index 97e10df2f6..df0e0044fc 100644
--- a/docs/auditor/10.9/addon/connectwise/msp.md
+++ b/docs/auditor/10.9/addon/connectwise/msp.md
@@ -18,10 +18,10 @@ specified the add-on launch as response action.
-Then a new ticket is automatically created shortly after any account password is reset.
+The add-on then automatically creates a new ticket shortly after any account password reset.
-All necessary details about the case are automatically entered into the ConnectWise ticket (_Initial
-Description_ field), including the name of the workstation, the name of the account in question, and
-the time when the event occurred:
+The add-on automatically enters all necessary details about the case into the ConnectWise ticket
+(_Initial Description_ field), including the name of the workstation, the name of the account in
+question, and the time the event occurred:
diff --git a/docs/auditor/10.9/addon/connectwise/operationalsettings.md b/docs/auditor/10.9/addon/connectwise/operationalsettings.md
index 0158fc7200..d50399b635 100644
--- a/docs/auditor/10.9/addon/connectwise/operationalsettings.md
+++ b/docs/auditor/10.9/addon/connectwise/operationalsettings.md
@@ -8,25 +8,25 @@ sidebar_position: 50
This section describes how to configure settings of the main add-on component, Netwrix Auditor
**ConnectWise Manage Integration Service**, required for its operation, including connection to
-Auditor Server, activity records processing, queuing and forwarding, ticket creation, and so on.
+Auditor Server, activity records processing, queuing, and forwarding, ticket creation, and so on.
For that, follow the steps:
**Step 1 –** Navigate to the add-on folder and select ITSMSettings.xml.
**Step 2 –** Define operational parameters such as Auditor connection settings, the number of
-tickets the service can create per hour, ability to reopen closed tickets, etc. For most parameters,
-default values are provided. You can adjust them depending on your execution scenario and security
+tickets the service can create per hour, ability to reopen closed tickets, etc. Most parameters have
+default values. You can adjust them depending on your execution scenario and security
policies. Use the following format: `value`.
| Parameter | Default value | Description |
| ----------------------------------- | ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| NetwrixAuditorHost | https://localhost:9699 | The add-on runs on the computer where Auditor Server resides and uses the default Integration API port (TCP port **9699**). To specify a non-default port, provide a new port number (e.g., _https://localhost:8788_). The add-on must always run locally, on the computer where Auditor Server resides. |
| NetwrixAuditorUserName | — | Unless specified, the Netwrix Auditor **ConnectWise Manage Integration Service** runs under the LocalSystem account. If you want this service to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format in this parameter value. The user account for running the service and connecting to Auditor Server must be granted the Global administrator role in Auditor or be a member of the Netwrix Auditor **Administrators** group. It must also have sufficient permissions to create files on the local computer. |
-| NetwrixAuditorPassword | — | Provide a password for the account. Unless an account is specified, the service runs under the LocalSystem account and does not require a password. |
+| NetwrixAuditorPassword | — | Provide a password for the account. Unless an account is specified, the service runs under the LocalSystem account and doesn't require a password. |
| TicketFloodLimit | 10 | Specify the maximum number of standalone tickets the service can create during TicketFloodInterval. If a ticket flood limit is reached, the service writes all new alerts into a single ticket. |
| TicketFloodInterval | 3600 | Specify the time period, in seconds. During this time period, the service can create as many tickets as specified in TicketFloodLimit. The default value is 3600 seconds, i.e., 1 hour. |
-| ConsolidationInterval | 900 | Specify the time period, in seconds. During this time period, the service does not process similar alerts as they happen but consolidates them before updating open tickets. The default value is 900 seconds (15 minutes). This option works in combination with UpdateTicketOnRepetitiveAlerts and is helpful if you want to reduce the number of ticket updates on ConnectWise Manage side. That is, this option defines the maximum delay for processing alerts and updating existing tickets. Tickets for new alert types are created immediately. For example, a new alert is triggered—the service opens a new ticket. The alert keeps firing 20 times more within 10 minutes. Instead of updating the ticket every time, the service consolidates alerts for 15 minutes, and then updates a ticket just once with all collected data. |
+| ConsolidationInterval | 900 | Specify the time period, in seconds. During this time period, the service doesn't process similar alerts as they happen but consolidates them before updating open tickets. The default value is 900 seconds (15 minutes). This option works in combination with UpdateTicketOnRepetitiveAlerts and is helpful if you want to reduce the number of ticket updates on ConnectWise Manage side. That is, this option defines the maximum delay for processing alerts and updating existing tickets. Tickets for new alert types are created immediately. For example, a new alert is triggered—the service opens a new ticket. The alert keeps firing 20 times more within 10 minutes. Instead of updating the ticket every time, the service consolidates alerts for 15 minutes, and then updates a ticket just once with all collected data. |
| CheckAlertQueueInterval | 5 | Internal parameter. Check and process the alert queue every N seconds; in seconds. |
| UpdateTicketOnRepetitiveAlerts | true | Instead of creating a new ticket, update an existing active ticket if a similar alert occurs within UpdateInterval. To open a new ticket for every alert, set the parameter to _"false"_. |
| ReopenTicketOnRepetitiveAlerts | true | Instead of creating a new ticket, reopen an existing ticket that is in a closed state (be default, closed, canceled, and resolved) if a similar alert occurs within UpdateInterval. This option works only when UpdateTicketOnRepetitiveAlerts is set to _"true"_. If you want to reopen closed tickets, you must be granted the right to perform Write operations on inactive tickets. |
@@ -34,15 +34,15 @@ policies. Use the following format: `value`.
| EnableTicketCorrelation | true | Review history and complement new tickets with information about similar tickets created previously. This information is written to the Description field. This option is helpful if you want to see if there is any correlation between past tickets (from the last month, by default) and a current ticket. |
| CorrelationInterval | 2592000 | Specify the time period, in seconds. During this time period, the service treats similar tickets as related and complements a new ticket with data from a previous ticket. The default value is 2592000 seconds, i.e., 1 month. Information on alerts that are older than 1 month is removed from internal service storage. |
| ProcessActivityRecord QueueInterval | 5 | Internal parameter. Process activity record queue every N seconds; in seconds. |
-| DisplayOnlyFirstActivityRecord | true | Add only the first activity record in the work notes, activity records that update this ticket will be added as attachments to this ticket. If false, all activity records will be displayed in the ticket work notes. |
+| DisplayOnlyFirstActivityRecord | true | When true, the service adds only the first activity record to the work notes and adds activity records that update this ticket as attachments to this ticket. If false, the service displays all activity records in the ticket work notes. |
| ActivityRecordRequestsRetention | | |
-| RequestLimit | 5000 | Internal parameter. The maximum number of activity record requests the service can store in its internal memory. Once the limit is reached, the service clears activity record requests starting with older ones. |
+| RequestLimit | 5000 | Internal parameter. The maximum number of activity record requests the service can store in its internal memory. When the limit is reached, the service clears activity record requests starting with older ones. |
| RequestLimitInterval | 604800 | Internal parameter. The service can store the activity record requests not older than N seconds; in seconds. Older activity record requests are cleared. |
| ActivityRecordWebRequests | | |
| RequestLimit | 200 | Internal parameter. The maximum number of activity records the service can retrieve in a single request. |
| RequestTimeout | 180 | Internal parameter. By default, 3 minutes. Defines the connection timeout. |
| TicketRequestsRetention | | |
-| RequestLimit | 300000 | Internal parameter. The maximum number of ticket requests the service can store in its internal memory. Once the limit is reached, the service clears ticket requests starting with older ones. |
+| RequestLimit | 300000 | Internal parameter. The maximum number of ticket requests the service can store in its internal memory. When the limit is reached, the service clears ticket requests starting with older ones. |
| RequestLimitInterval | 604800 | Internal parameter. The service can store the ticket requests not older than N seconds; in seconds. Older tickets requests are cleared. |
**Step 3 –** Restart the service every time you update ITSMSettings.xml configuration file.
diff --git a/docs/auditor/10.9/addon/connectwise/overview.md b/docs/auditor/10.9/addon/connectwise/overview.md
index 72d3762976..b62e410613 100644
--- a/docs/auditor/10.9/addon/connectwise/overview.md
+++ b/docs/auditor/10.9/addon/connectwise/overview.md
@@ -6,19 +6,19 @@ sidebar_position: 50
# ConnectWise Manage
-Managed Service Providers (MSP) need to effectively utilize and standardize IT service management
-tools. Those who use for that purpose the ConnectWise Manage solution usually have similar processes
+Managed Service Providers (MSP) need to effectively use and standardize IT service management
+tools. Those who use the ConnectWise Manage solution for that purpose usually have similar processes
in place:
- When an incident or a problem occurs in the IT environment, managed client sends (usually by
email) a request to the MSP’s service desk. A service ticket is then created manually or
automatically in ConnectWise Manage.
-- Each ticket is assigned to authorized personnel for investigation and resolution in accordance
- with the existing workflow.
-- To control ticket handling and report on statistics, ConnectWise service boards are used.
+- The existing workflow assigns each ticket to authorized personnel for investigation and
+ resolution.
+- MSP staff use ConnectWise service boards to control ticket handling and report on statistics.
Netwrix has built a ready-to-use add-on that automates incident management, automatically creating
-service tickets for security alerts triggered by Netwrix Auditor This integration brings in the
+service tickets for security alerts triggered by Netwrix Auditor. This integration brings in the
following benefits:
- Seamless integration with the existing MSP service process
@@ -43,17 +43,18 @@ On a high level, the workflow is as follows:
2. Whenever the alert is triggered, the add-on uses the Integration API to retrieve activity record
for the original event from the audit store. An activity record contains the user account,
action, time, and other details. The add-on creates a service ticket in ConnectWise Manage,
- populates it with data from the activity record, and assigns Impact, Priority and SLA status to
+ populates it with data from the activity record, and assigns Impact, Priority, and SLA status to
the ticket.
3. The designated service team performs data analysis and root cause detection to resolve the
- ticket; MSP is notified of the results and possible response actions to take on the client side.
+ ticket, then notifies MSP of the results and possible response actions to take on the client
+ side.
4. MSP performs actions for incident response.
-Solution architecture and key components are shown in the figure below:
+The following figure shows the solution architecture and key components:
-- **Alert Handler (Netwrix.ITSM.AlertResponseAction.exe)** — the executable that is specified in the
+- **Alert Handler (Netwrix.ITSM.AlertResponseAction.exe)** — the executable that you specify in the
Auditor alerts as the response action. Alert Handler:
1. Receives the IDs of the alert and associated activity record.
2. Forwards them to the Netwrix AuditorConnectWise Manage Integration Service over RPC, putting
@@ -68,7 +69,7 @@ additional information.
1. Interacts with Auditor via its Integration API to retrieve the activity records from the
Audit Database by record ID.
2. Forwards activity record data to ConnectWise Manage via its REST API, creates a new service
- ticket and populates its properties, as specified by user in the add-on configuration.
+ ticket and populates its properties, as the user specifies in the add-on configuration.
## Prerequisites
diff --git a/docs/auditor/10.9/addon/copilot/collecteddata.md b/docs/auditor/10.9/addon/copilot/collecteddata.md
index 32c1b9d4a0..e7b6e19787 100644
--- a/docs/auditor/10.9/addon/copilot/collecteddata.md
+++ b/docs/auditor/10.9/addon/copilot/collecteddata.md
@@ -6,9 +6,9 @@ sidebar_position: 20
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To use data collected with the add-on, you can do the following in Auditor:
-- Search for required data. For that, start Auditor client and navigate to **Search**. After
+- Search for required data. To do this, start the Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
detailed information on who did what in the reported time period.
@@ -17,7 +17,7 @@ only.
- You can also click **Tools** in the upper-right corner and select the command you need. For
example:
- - If you want to periodically receive the report on the results of search with the specified
+ - If you want to periodically receive the report on the search results with the specified
criteria, click **Subscribe**. Then specify how you want the report to be delivered – as an
email or as a file stored to the file share.
- To create an alert on the specific occurrences, click **Create alert**.
diff --git a/docs/auditor/10.9/addon/copilot/deployment.md b/docs/auditor/10.9/addon/copilot/deployment.md
index d5105f71bf..6fd8547ff4 100644
--- a/docs/auditor/10.9/addon/copilot/deployment.md
+++ b/docs/auditor/10.9/addon/copilot/deployment.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Deployment Procedure
-Follow the steps to install Microsoft Copilot add-on.
+To install the Microsoft Copilot add-on:
**Step 1 –** Accept EULA.
@@ -16,7 +16,7 @@ Follow the steps to install Microsoft Copilot add-on.
## Configure Copilot for Monitoring
-Follow the steps to configure Copilot for monitoring.
+To configure Copilot for monitoring:
**Step 1 –** Register an Azure App and grant it the following permissions:
@@ -25,12 +25,12 @@ Follow the steps to configure Copilot for monitoring.
## Configure the add-on
-Follow the steps to configure the add-on.
+To configure the add-on:
**Step 1 –** Specify Active Directory credentials.
- Username – Provide the name of the account under which the service runs. Unless specified, the
- service runs under the account currently logged on.
+ service runs under the account logged on.
- Password – Provide the password for the selected account.
diff --git a/docs/auditor/10.9/addon/copilot/overview.md b/docs/auditor/10.9/addon/copilot/overview.md
index fec6313f08..494a551bad 100644
--- a/docs/auditor/10.9/addon/copilot/overview.md
+++ b/docs/auditor/10.9/addon/copilot/overview.md
@@ -6,16 +6,16 @@ sidebar_position: 70
# Copilot
-Microsoft Copilot is an AI-powered assistant designed to help users in Microsoft 365 apps like Word,
-Excel, and Teams. It leverages large language models to assist with tasks such as generating
+Microsoft Copilot is an AI-powered assistant that helps users in Microsoft 365 apps like Word,
+Excel, and Teams. It uses large language models to help with tasks such as generating
content, analyzing data, and automating workflows.
To retrieve activity logs on Copilot interactions, the Add-on requires an Azure App registration.
This allows the application to interact with Microsoft services by obtaining necessary logs and data
related to Copilot activity.
-The Netwrix Auditor Add-On for Microsoft Copilot works in collaboration with Netwrix Auditor. To get
-the add-on up and running, refer the following topics:
+The Netwrix Auditor Add-On for Microsoft Copilot works in collaboration with Netwrix Auditor. To set
+up the add-on, see the following topics:
- [Deployment Procedure](/docs/auditor/10.9/addon/copilot/deployment.md)
- [Work with Collected Data](/docs/auditor/10.9/addon/copilot/collecteddata.md)
@@ -41,10 +41,10 @@ follows:
On a high level, the add-on works as follows:
-- The add-on collects integration logs from the specified Azure storage account. This includes the
- information about the documents that have been used.
-- The add-on reworking the collected logs into the Netwrix Auditor compatible format, which is
- Activity Records. Each Activity Record contains the user information, such as an account, action,
+- The add-on collects integration logs from the specified Azure storage account. This includes
+ information about the documents that users accessed.
+- The add-on reworks the collected logs into the Netwrix Auditor-compatible format, called Activity
+ Records. Each Activity Record contains the user information, such as an account, action,
time, and other details.
- Using the Integration API, the add-on sends the activity records to the Netwrix Auditor Server,
which writes them to the Long-Term Archive and the Audit Database.
diff --git a/docs/auditor/10.9/addon/ctera/collecteddata.md b/docs/auditor/10.9/addon/ctera/collecteddata.md
index 035b197237..a268cbf019 100644
--- a/docs/auditor/10.9/addon/ctera/collecteddata.md
+++ b/docs/auditor/10.9/addon/ctera/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data the add-on collects, do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
@@ -30,28 +30,3 @@ See the following topics for additional information:
- [Alerts](/docs/auditor/10.9/admin/alertsettings/overview.md)
- [View and Search Collected Data](/docs/auditor/10.9/admin/search/overview.md)
- [Subscriptions](/docs/auditor/10.9/admin/subscriptions/overview.md)
-
-To leverage data collected with the add-on, you can do the following in Auditor:
-
-- Search for required data. For that, start Auditor client and navigate to **Search**. After
- specifying the criteria you need, click **Search**. You will get a list of activity records with
- detailed information on who did what in the reported time period.
-
-You can apply a filter to narrow down your search results to the Netwrix **API** data source only.
-
-
-
-- Also, you can click **Tools** in the upper-right corner and select the command you need. For
- example:
- - If you want to periodically receive the report on the results of search with the specified
- criteria, click **Subscribe**. Then specify how you want the report to be delivered – as an
- email or as a file stored to the file share.
- - To create an alert on the specific occurrences, click **Create alert**.
- - To export filtered data to PDF or CSV, click **Export data**.
-- You can also configure and receive alerts on the events you are interested in.
-
-See the following topics for additional information:
-
-- [Alerts](/docs/auditor/10.9/admin/alertsettings/overview.md)
-- [View and Search Collected Data](/docs/auditor/10.9/admin/search/overview.md)
-- [Subscriptions](/docs/auditor/10.9/admin/subscriptions/overview.md)
diff --git a/docs/auditor/10.9/addon/ctera/install.md b/docs/auditor/10.9/addon/ctera/install.md
index 955178db1f..027ba7b593 100644
--- a/docs/auditor/10.9/addon/ctera/install.md
+++ b/docs/auditor/10.9/addon/ctera/install.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Add-On
-Follow the steps to install the Add-On:
+**To install the Add-On:**
**Step 1 –** Navigate to your add-on package.
diff --git a/docs/auditor/10.9/addon/ctera/overview.md b/docs/auditor/10.9/addon/ctera/overview.md
index 9f393fad85..84fda53d7a 100644
--- a/docs/auditor/10.9/addon/ctera/overview.md
+++ b/docs/auditor/10.9/addon/ctera/overview.md
@@ -8,10 +8,10 @@ sidebar_position: 60
The add-on works in collaboration with Netwrix Auditor, supplying data about activity on your
Ctera-based devices. Aggregating data into a single audit trail simplifies analysis, makes activity
-monitoring more cost effective, and helps you keep tabs on your IT infrastructure.
+monitoring more cost effective, and helps you monitor your IT infrastructure.
Implemented as a service, this add-on facilitates the data transition from Ctera-based systems to
-Netwrix Auditor. All you have to do is provide connection details and specify parsing rules.
+Netwrix Auditor. To set it up, provide connection details and specify parsing rules.
On a high level, the add-on works as follows:
@@ -36,7 +36,7 @@ follows:
### Configure Logging for CTERA Edge Filer
-Prior to start using the Add-On, configure syslog logging settings on your CTERA Edge Filers. See
+Before you start using the Add-On, configure syslog logging settings on your CTERA Edge Filers. See
the
[Configuring Syslog Settings](https://kb.ctera.com/docs/configuring-logging#configuring-syslog-settings)
article on the CTERA product documentation portal for detailed instructions.
@@ -59,5 +59,5 @@ installed on the same server.
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts
+that use the Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.9/addon/ctera/parameters.md b/docs/auditor/10.9/addon/ctera/parameters.md
index 2f89a546e9..e65ad9597a 100644
--- a/docs/auditor/10.9/addon/ctera/parameters.md
+++ b/docs/auditor/10.9/addon/ctera/parameters.md
@@ -16,15 +16,15 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (_/ netwrix/ api_ ) |
-| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (_/ netwrix/ api_ ) |
+| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
-| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account currently logged on. |
+| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account logged on. |
| Password | Provide the password for the selected account. |
| Auditor Monitoring Plan settings | |
-| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Auditor Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, Auditor writes the data to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Auditor Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
-| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
+| Address | Specify a list of IP addresses of syslog events sources. The service collects and processes events from these sources only and ignores events from any other source. |
Click **Run** to start collecting data with the Add-On.
diff --git a/docs/auditor/10.9/addon/cyberark/collecteddata.md b/docs/auditor/10.9/addon/cyberark/collecteddata.md
index 059ce074d6..38a06f64b8 100644
--- a/docs/auditor/10.9/addon/cyberark/collecteddata.md
+++ b/docs/auditor/10.9/addon/cyberark/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To work with data the add-on collects, do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.9/addon/cyberark/deployment.md b/docs/auditor/10.9/addon/cyberark/deployment.md
index de4a49456a..4af92051ea 100644
--- a/docs/auditor/10.9/addon/cyberark/deployment.md
+++ b/docs/auditor/10.9/addon/cyberark/deployment.md
@@ -6,7 +6,7 @@ sidebar_position: 20
# Deploy the Add-On
-Follow the steps to deploy the Add-On:
+Deploying the Add-On involves the following steps:
**Step 1 –** Prepare Auditor for data processing.
@@ -22,16 +22,16 @@ Follow the steps to deploy the Add-On:
In Auditor client, go to the Integrations section and verify Integration API settings:
-1. Make sure the **Leverage Integration API** is switched to **ON**.
+1. Ensure the **Leverage Integration API** is switched to **ON**.
2. Check the TCP communication port number – default is **9699**.
See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) topic for additional information.
-By default, activity records are written to _Netwrix_Auditor_API_ database which is not associated
+By default, activity records are written to _Netwrix_Auditor_API_ database which isn't associated
with a specific monitoring plan.
-Optionally, you can create a dedicated monitoring plan in Auditor. In this case, data will be
-written to a database linked to this plan. Target it at Netwrix API data source and enable for
+Optionally, you can create a dedicated monitoring plan in Auditor. In this case, Auditor writes the
+data to a database linked to this plan. Target it at Netwrix API data source and enable for
monitoring. Add a dedicated item of _Integration_ type to the plan for data to be filtered by item
name. See the [Integration API](/docs/auditor/10.9/api/overview.md) topic for additional information.
@@ -45,7 +45,7 @@ On the CyberArk side, you need to specify the server that will receive Syslog me
CyberArk, process them and forward to Auditor Server. This will be the add-on installation server
(the machine where _SyslogService.exe_ runs).
-Follow the steps to configure Syslog message forwarding in CyberArk.
+**To configure Syslog message forwarding in CyberArk:**
**Step 1 –** Log in to your CyberArk system.
@@ -60,8 +60,8 @@ folder and open the **dbparam.ini** file for editing.
%\PrivateArk\Server\Syslog_ folder.
Place the _Netwrix.xsl_ file there, too, so that default relative path should be _\Server\Syslog_.
- **SyslogServerPort** – communication port of the syslog server (i.e. add-on installation server).
- Default is **514**. Note that if you are using Netwrix Auditor for Network Devices, this port may
- be already in use, and you should provide another one.
+ Default is **514**. If you're using Netwrix Auditor for Network Devices, this port might already
+ be in use — provide another one.
- **SyslogServerIP** - IP address of the add-on installation server.
- SyslogServerProtocol – communication protocol for data transfer between CyberArk system and the
add-on. Specify **UDP** protocol.
@@ -83,7 +83,7 @@ _Remember,_ deploy the add-on on the same machine with the Auditor Server.
## Install Add-On
-Follow the steps to install the Add-On:
+**To install the Add-On:**
**Step 1 –** Navigate to your add-on package.
@@ -112,15 +112,15 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (_/ netwrix/ api_ ) |
-| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (_/ netwrix/ api_ ) |
+| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
-| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account currently logged on. |
+| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account logged on. |
| Password | Provide the password for the selected account. |
| Auditor Monitoring Plan settings | |
-| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Auditor Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, Auditor writes the data to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Auditor Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
-| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
+| Address | Specify a list of IP addresses of syslog events sources. The service collects and processes events from these sources only and ignores events from any other source. |
Click **Run** to start collecting data with the Add-On.
diff --git a/docs/auditor/10.9/addon/cyberark/overview.md b/docs/auditor/10.9/addon/cyberark/overview.md
index 2cddde1bd0..21a3a89470 100644
--- a/docs/auditor/10.9/addon/cyberark/overview.md
+++ b/docs/auditor/10.9/addon/cyberark/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 80
# CyberArk Privileged Access Security
Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables
-control over changes, configurations and access in hybrid IT environments to protect data regardless
+control over changes, configurations, and access in hybrid IT environments to protect data regardless
of its location. The platform provides security analytics to detect anomalies in user behavior and
investigate threat patterns before a data breach occurs.
@@ -16,8 +16,8 @@ and SSH Keys. It enables organizations to manage and monitor all activities asso
privileged identities, for example, Windows server administrator, root on a UNIX server, etc. A
featured set of the Privileged Access Security tools includes, in particular:
-- **Privileged Session Manager** - a tool that enables users to securely connect to remote targets
- with a standard remote desktop client application, providing isolated sessions.
+- **Privileged Session Manager** - a tool for securely connecting to remote targets with a standard
+ remote desktop client application, providing isolated sessions.
- **Enterprise Password Vault** – a tool for storage and centralized management of the privileged
accounts; it supports automated changes and logging of the activities associated with all types of
privileged passwords and SSH Keys. This tool also includes Central Policy Manager service.
@@ -44,16 +44,15 @@ works as follows:
1. An IT administrator configures Integration API settings to enable data collection and storage to
the Audit Database for further reporting, search, etc.
- It is recommended to create a dedicated monitoring plan in Auditor and add a dedicated item of
- **Integration** type to it — then you will be able to filter data in reports and search results
- by monitoring plan/item name.
+ Create a dedicated monitoring plan in Auditor and add a dedicated item of **Integration** type
+ to it. This lets you filter data in reports and search results by monitoring plan or item name.
2. On the CyberArk server, the administrator opens the **dbparam.ini** file and specifies the
parameters for syslog message forwarding, including add-on installation server settings, the IDs
of events to be monitored, etc.
See the [Monitored Events](/docs/auditor/10.9/addon/cyberark/monitoredevents.md) topic for additional information on the events
- supported for monitoring out of the box.
+ supported for monitoring by default.
3. On the add-on installation server, the administrator runs the installation file and configures
the Add-On parameters in the configuration wizard.
@@ -83,8 +82,8 @@ follows:
| Where | Prerequisite to check |
| ------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The Auditor Server side | - The Integration API and Audit Database settings are configured in Auditor Server settings. See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) and [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topics for additional information. - The **TCP 9699** port must be open on Windows firewall for inbound connections. - User account under which data will be written to the Audit Database requires the **Contributor** role in Auditor. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) for additional information. Alternatively, you can grant it the **Global administrator** role, or add that account to the **Netwrix Auditor Administrators** group. |
-| The machine where the Add-On will be installed (Auditor Server is recommended) | - The **UDP 514** port must be open on Windows firewall for inbound connections. If you are using Netwrix Auditor for Network Devices, this port may be already in use, and you should provide another one. Another option is to install the add-on and Auditor Server on different machines. - .Net Framework 4.7.2 and above is installed. Review the following Microsoft technical article for additional information on how to install .Net Framework 4.7.2: [Microsoft .NET Framework 4.7.2 offline installer for Windows](https://support.microsoft.com/en-us/topic/microsoft-net-framework-4-7-2-offline-installer-for-windows-05a72734-2127-a15d-50cf-daf56d5faec2). |
+| The Auditor Server side | - The Integration API and Audit Database settings are configured in Auditor Server settings. See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) and [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topics for additional information. - The **TCP 9699** port must be open on Windows firewall for inbound connections. - The user account that writes data to the Audit Database requires the **Contributor** role in Auditor. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) for additional information. Alternatively, you can grant it the **Global administrator** role, or add that account to the **Netwrix Auditor Administrators** group. |
+| The machine where you install the Add-On (Auditor Server is recommended) | - The **UDP 514** port must be open on Windows firewall for inbound connections. If you are using Netwrix Auditor for Network Devices, this port may be already in use, and you should provide another one. Another option is to install the add-on and Auditor Server on different machines. - .Net Framework 4.7.2 and above is installed. Review the following Microsoft technical article for additional information on how to install .Net Framework 4.7.2: [Microsoft .NET Framework 4.7.2 offline installer for Windows](https://support.microsoft.com/en-us/topic/microsoft-net-framework-4-7-2-offline-installer-for-windows-05a72734-2127-a15d-50cf-daf56d5faec2). |
| CyberArk PAS | Version 10.10. |
### Accounts and Rights
diff --git a/docs/auditor/10.9/addon/cyberark/parameters.md b/docs/auditor/10.9/addon/cyberark/parameters.md
index 6a5e5bbea7..aea9b4e3ee 100644
--- a/docs/auditor/10.9/addon/cyberark/parameters.md
+++ b/docs/auditor/10.9/addon/cyberark/parameters.md
@@ -17,29 +17,29 @@ The service uses the default values unless parameters are explicitly defined
Parameters in **Settings.xml** can be grouped as follows:
-- **General parameters** that affect add- on execution. They are listed in the table below.
+- **General parameters** that affect add- on execution. They are listed in the following table.
- Settings for a certain event source (within the _Source_ section) that can override general
settings.
-- **Internal parameters** that should not be modified in most cases. They are listed in the topic.
+- **Internal parameters** that shouldn't be modified in most cases. They are listed in the topic.
| Parameter | Default value | Description |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| General parameters | | |
| ListenUdpPort | 514 | Specify UDP port for listening to the incoming syslog events. |
-| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (/netwrix/api . . . . ) |
-| NetwrixAuditor CertificateThumbprint | NOCHECK | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check the certificate via Windows Certificate Store. - `AB:BB:CC.`—Check the certificate thumbprint identifier. - `NOCHECK`—Do not check the certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
-| NetwrixAuditorPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
-| NetwrixAuditorPlanItem | — | Unless specified, data is not associated with a specific monitoring plan and thus cannot be filtered by item name. Specify an item name here. Make sure to create a dedicated item in Auditor in advance. |
+| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (/netwrix/api . . . . ) |
+| NetwrixAuditor CertificateThumbprint | NOCHECK | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check the certificate via Windows Certificate Store. - `AB:BB:CC.`—Check the certificate thumbprint identifier. - `NOCHECK`—Don't check the certificate. ensure to select this parameter if you plan to specify servers by their IP. |
+| NetwrixAuditorPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, Auditor writes the data to a database linked to this plan. If you select a plan name in the add-on, ensure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
+| NetwrixAuditorPlanItem | — | Unless specified, data isn't associated with a specific monitoring plan and thus can't be filtered by item name. Specify an item name here. ensure to create a dedicated item in Auditor in advance. |
| EventStorePath | — | Select where to store temporary files of syslog messages before the add-on sends them to Auditor Server. Netwrix recommends to store these files in the same directory with the add-on (SyslogService.exe). |
| LogLevel | warning | Specify logging level: - none - info - warning (used by default) - error - debug |
| WriteCriticalIssues ToEventLog | 0 | Instructs the add-on to write important events (like service start or critical issue) not only to its own log but also to Netwrix event log. - 1=yes - 0=no (default) |
| Parameters within SourceList You can specify parsing rules for each specific event source and define parameters to override general settings, such as time zone, default plan name, etc. | | |
| NetwrixAuditorPlan | — | When specified, overrides the general settings. |
| NetwrixAuditorPlanItem | — | When specified, overrides the general settings. |
-| AppNameRegExp | — | Custom regular expression pattern that will be used to retrieve the application name from your syslog messages. The add-on will match the application name and the files with syslog parsing rules to be applied. The pattern you provide here must match the application name in your custom rule file. Unless specified, RFC 3164/5424 format is used. |
-| AppNameGroupID | — | Define application name value by Group ID only if messages are not formatted in accordance with RFC 3164/5424. Otherwise, leave the default value. |
-| RuleFileList PathFile | cyberark-v2.xml | Specify paths to XML file(s) with regular expression parsing rules. You can create a custom file or use rules provided out of the box. Currently, the **cyberark-v2.xml** rule file is shipped with this add-on. You can specify several rule files. The service will check if the AppName parameter in the first rule file matches the AppNameRegExp and AppNameGroupID regular expression in this file. If not, the service will proceed to the next rule file. |
-| AcceptList Address | — | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. The _Address_ parameter may be followed by optional attributes that override parameters specified above: - _naplan_—A name of associated monitoring plan - _naplanitem_—A name of associated item For example: `172.28.3.15 ` |
+| AppNameRegExp | — | Custom regular expression pattern that the add-on uses to retrieve the application name from your syslog messages. The add-on will match the application name and the files with syslog parsing rules to be applied. The pattern you provide here must match the application name in your custom rule file. Unless specified, RFC 3164/5424 format is used. |
+| AppNameGroupID | — | Define application name value by Group ID only if messages aren't formatted in accordance with RFC 3164/5424. Otherwise, leave the default value. |
+| RuleFileList PathFile | cyberark-v2.xml | Specify paths to XML files with regular expression parsing rules. You can create a custom file or use the default rules. The **cyberark-v2.xml** rule file ships with this add-on. You can specify several rule files. The service will check if the AppName parameter in the first rule file matches the AppNameRegExp and AppNameGroupID regular expression in this file. If not, the service will proceed to the next rule file. |
+| AcceptList Address | — | Specify a list of IP addresses of syslog events sources. The service collects and processes events from these sources only and ignores events from any other source. The _Address_ parameter may be followed by optional attributes that override parameters specified above: - _naplan_—A name of associated monitoring plan - _naplanitem_—A name of associated item For example: `172.28.3.15 ` |
Remember to save **Settings.xml** after editing is complete.
@@ -48,7 +48,7 @@ restart the add-on main service (_SyslogService.exe_) for them to take effect.
## Add-on Internal Parameters
-Internal parameters listed in the table below are intended for performance tuning. In most cases the
+Internal parameters, listed in the following table, are intended for performance tuning. In most cases the
default values should be used.
| Parameter | Default value | Description |
diff --git a/docs/auditor/10.9/addon/cyberark/troubleshooting.md b/docs/auditor/10.9/addon/cyberark/troubleshooting.md
index 6eaa4878b7..52a962925e 100644
--- a/docs/auditor/10.9/addon/cyberark/troubleshooting.md
+++ b/docs/auditor/10.9/addon/cyberark/troubleshooting.md
@@ -11,14 +11,13 @@ same folder as **SyslogService.exe.**
To change the add-on logging level, use the **LogLevel** parameter in the **Settings.xml** file.
-- It is recommended that before the first run you set this parameter to `debug`. This will
- facilitate operations tracking and possible problem solving.
-- After that it is strongly recommended to re-set this parameter to `error` to prevent the
- uncontrolled log growth.
+- Before the first run, set this parameter to `debug`. This makes it easier to track operations and
+ troubleshoot problems.
+- After that, reset this parameter to `error` to prevent uncontrolled log growth.
-If you cannot see collected data in Auditor, check the following:
+If you can't see collected data in Auditor, check the following:
-1. In Auditor settings, go to the **Integrations** section and make sure the **Leverage Integration
+1. In Auditor settings, go to the **Integrations** section and ensure the **Leverage Integration
API** is switched to **ON**. Check the communication port number – default is **9699**.
-2. If you configured a dedicated monitoring plan, make sure data source monitoring is enabled.
+2. If you configured a dedicated monitoring plan, ensure data source monitoring is enabled.
3. Verify the parameters you provided in **Settings.xml** and **dbparam.ini**.
diff --git a/docs/auditor/10.9/addon/hyperv/collecteddata.md b/docs/auditor/10.9/addon/hyperv/collecteddata.md
index 1de0fdfa91..5011b79c57 100644
--- a/docs/auditor/10.9/addon/hyperv/collecteddata.md
+++ b/docs/auditor/10.9/addon/hyperv/collecteddata.md
@@ -6,10 +6,10 @@ sidebar_position: 40
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To use data collected with the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
- specifying the criteria you need, click **Search**. You will get a list of activity records with
+ specifying the criteria you need, click **Search**. You get a list of activity records with
detailed information on who did what in the reported time period.
You might want to apply a filter to narrow down your search results to the Netwrix API data source
diff --git a/docs/auditor/10.9/addon/hyperv/deployment.md b/docs/auditor/10.9/addon/hyperv/deployment.md
index 648a56d1f7..d789dafe6c 100644
--- a/docs/auditor/10.9/addon/hyperv/deployment.md
+++ b/docs/auditor/10.9/addon/hyperv/deployment.md
@@ -8,7 +8,7 @@ sidebar_position: 20
The add-on can be deployed on any computer in your environment. For example, you can run the add-on
on the computer where Auditor is installed, or on a remote server. Also, consider different SCVMM
-deployment scenarios. Possible deployment options are as follows (here it is assumed that the add-on
+deployment scenarios. Possible deployment options are as follows (this assumes that the add-on
is installed together with Auditor server):
1. Add-on running on the same machine as SCVMM server (with Management Console):
@@ -27,7 +27,7 @@ Users_ local group on the SCVMM server.
-In this scenario, make sure to specify SCVMM server address in the **DataCollectionServer**
+In this scenario, ensure to specify SCVMM server address in the **DataCollectionServer**
parameter (not the machine where SCVMM console runs) in the **settings.xml** configuration file. See
the [Add-On Parameters](/docs/auditor/10.9/addon/hyperv/parameters.md)topic for additional information.
@@ -78,7 +78,7 @@ Configuration parameters __NetwrixAuditorUserName__ and __NetrixAuditorPassword_
``
-Credentials for **Data Collection Server** (that is, SCVMM) are not required.
+Credentials for **Data Collection Server** (that is, SCVMM) aren't required.
## Example 4
diff --git a/docs/auditor/10.9/addon/hyperv/install.md b/docs/auditor/10.9/addon/hyperv/install.md
index 5eeb6e8cdd..6be2c45f31 100644
--- a/docs/auditor/10.9/addon/hyperv/install.md
+++ b/docs/auditor/10.9/addon/hyperv/install.md
@@ -20,20 +20,20 @@ Follow the step to deploy the Add-On:
In Auditor client, go to the Integrations section and verify Integration API settings:
-1. Make sure the **Leverage Integration API** is switched to **ON**.
+1. Ensure the **Leverage Integration API** is switched to **ON**.
2. Check the TCP communication port number – default is **9699**.
See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) topic for additional information.
-By default, activity records are written to _Netwrix_Auditor_API_ database which is not associated
-with a specific monitoring plan.
+By default, the add-on writes activity records to the _Netwrix_Auditor_API_ database, which isn't
+associated with a specific monitoring plan.
-Optionally, you can create a dedicated monitoring plan in Auditor. In this case, data will be
-written to a database linked to this plan. Target it at Netwrix API data source and enable for
-monitoring. Add a dedicated item of _Integration_ type to the plan for data to be filtered by item
+Optionally, you can create a dedicated monitoring plan in Auditor. In this case, the add-on writes
+data to a database linked to that plan. Target it at Netwrix API data source and enable for
+monitoring. Add a dedicated item of _Integration_ type to the plan so you can filter data by item
name. See the [Integration API](/docs/auditor/10.9/api/overview.md) topic for additional information.
-In such scenario, you will need to specify this monitoring plan in the _NetwrixAuditorPlan_ and
+In this scenario, specify this monitoring plan in the _NetwrixAuditorPlan_ and
_NetwrixAuditorPlanItem_ parameters in the **settings.xml** file. See the
[Add-On Parameters](/docs/auditor/10.9/addon/hyperv/parameters.md) topic for additional information.
@@ -51,18 +51,18 @@ See the [Add-On Parameters](/docs/auditor/10.9/addon/hyperv/parameters.md)topic
| Parameter | Default value | Description |
| ---------------------- | ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| DataCollectionServer | (empty) | Specify SCVMM server to collect data from. You can use IP address, FQDN or NETBIOS name. For _localhost_, leave this parameter empty. |
-| DataCollectionUserName | (empty) | Specify user account that will be used for data collection from SCVMM server. To use the account currently logged in, leave this parameter empty. Make sure the account has administrative rights on that server (see the [Accounts and Rights](overview.md#accounts-and-rights) topic for additional information). |
+| DataCollectionServer | (empty) | Specify SCVMM server to collect data from. You can use IP address, FQDN, or NETBIOS name. For _localhost_, leave this parameter empty. |
+| DataCollectionUserName | (empty) | Specify user account that will be used for data collection from SCVMM server. To use the account logged in, leave this parameter empty. ensure the account has administrative rights on that server (see the [Accounts and Rights](overview.md#accounts-and-rights) topic for additional information). |
| DataCollectionPassword | | Specify user account password. |
| ShortTermFolder | ShortTerm | Specify path to the short-term archive (Netwrix Auditor working folder). You can use full or relative path. |
-Save the **settings.xml** file. New configuration settings will be applied automatically at the next
-data collection.
+Save the **settings.xml** file. The add-on applies new configuration settings automatically at the
+next data collection.
For the full list of parameters, see the [Add-On Parameters](/docs/auditor/10.9/addon/hyperv/parameters.md) topic for additional
information.
## Register Windows Scheduled Task
-Run the **install.ps1** PowerShell script from the add-on folder. It will configure and register a
-Windows scheduled task that will run periodically every 15 min to retrieve audit data from SCVMM.
+Run the **install.ps1** PowerShell script from the add-on folder. It configures and registers a
+Windows scheduled task that runs periodically every 15 min to retrieve audit data from SCVMM.
diff --git a/docs/auditor/10.9/addon/hyperv/overview.md b/docs/auditor/10.9/addon/hyperv/overview.md
index c70b830a1b..432a2b13d8 100644
--- a/docs/auditor/10.9/addon/hyperv/overview.md
+++ b/docs/auditor/10.9/addon/hyperv/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 90
# Hyper-V SCVMM
Netwrix Auditor is a visibility platform for user behavior analysis and risk mitigation that enables
-control over changes, configurations and access in hybrid IT environments to protect data regardless
+control over changes, configurations, and access in hybrid IT environments to protect data regardless
of its location. The platform provides security analytics to detect anomalies in user behavior and
investigate threat patterns before a data breach occurs.
@@ -23,7 +23,7 @@ supporting detailed SCVMM monitoring and effective response to changes.
For that purpose, you can use a specially designed add-on. It works in collaboration with Netwrix
Auditor, supplying data about operations on your SCVMM server to Netwrix database. Aggregating data
into a single audit trail simplifies the analysis, makes activity monitoring more cost-effective,
-and helps you keep tabs on your virtual infrastructure.
+and helps you monitor your virtual infrastructure.
Major benefits:
@@ -42,8 +42,8 @@ On a high level, the solution works as follows:
1. An IT administrator configures the Integration API settings to enable data collection and storage
to the Netwrix database for further reporting, search, etc.
- It is recommended to create a dedicated monitoring plan in Auditor and add a dedicated item of
- **Integration** type to it — then you will be able to filter data in reports and search results
+ Netwrix recommends creating a dedicated monitoring plan in Auditor and adding a dedicated item of
+ **Integration** type to it — then you can filter data in reports and search results
by monitoring plan or item name.
2. On SCVMM side, the IT administrator prepares a dedicated user account for accessing SCVMM server.
@@ -56,7 +56,7 @@ On a high level, the solution works as follows:
collect audit data from VMM server.
See the [Monitoring Scope](/docs/auditor/10.9/addon/hyperv/monitoredevents.md) for additional information on the default list of
- the events supported out-of-the box.
+ the events supported by default.
6. The add-on component **HVARunner.exe** starts collecting activity data from VMM. Data
communication is performed using TCP protocol.
@@ -68,7 +68,7 @@ See the [Integration API](/docs/auditor/10.9/api/overview.md) topic for addition
of the Activity Record and the capabilities of the Integration API.
8. The add-on uses the Integration API to send the Activity Records to Auditor Server, where this
- data becomes available for search, reporting and alerting.
+ data becomes available for search, reporting, and alerting.
9. Users open Auditor Client to work with collected data:
- Search for file changes using certain criteria
- Export data to PDF or CSV files
@@ -78,8 +78,8 @@ of the Activity Record and the capabilities of the Integration API.
### Add-on Delivery Package
-The add-on delivery package is a ZIP archive comprising several files, including DLLs, configuration
-and executable files. The latter ones are listed in the table below.
+The add-on delivery package is a ZIP archive comprising several files, including DLLs, configuration,
+and executable files. The following table lists the executable files.
| File name | Description |
| ----------------- | ------------------------------------------------------------------------------------------------------- |
@@ -101,7 +101,7 @@ follows:
### Accounts and Rights
-It is recommended to create a dedicated account for running the add-on.
+Netwrix recommends creating a dedicated account for running the add-on.
This account should have the following minimal rights and permissions:
diff --git a/docs/auditor/10.9/addon/hyperv/parameters.md b/docs/auditor/10.9/addon/hyperv/parameters.md
index bc678cb5fe..874ff7f719 100644
--- a/docs/auditor/10.9/addon/hyperv/parameters.md
+++ b/docs/auditor/10.9/addon/hyperv/parameters.md
@@ -9,23 +9,23 @@ sidebar_position: 10
To configure the add-on parameters, you need to edit the **settings.xml** file in the add-on folder.
You must define connection details: Auditor Server host, user credentials, etc.
-Most parameters are optional, the service uses the default values unless parameters are explicitly
-defined (`\*\*\_value_\*\*`). You can skip or define parameters depending on
+Most parameters are optional; the service uses the default values unless you explicitly
+define them (`\*\*\_value_\*\*`). You can skip or define parameters depending on
your execution scenario and security policies.
| Parameter | Default value | Description |
| ------------------------------------ | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| NetwrixIntegration | | |
-| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (/netwrix/api . . . . ) |
-| NetwrixAuditor CertificateThumbprint | NOCHECK | Auditor Certificate Thumbprint Property. Possible values: - `AB:BB:CC.`—Check Auditor server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| NetwrixAuditorEndpoint | https://localhost: 9699/netwrix/api/ v1/activity_records | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port **9699**. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15, EnterpriseNAServer, WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (/netwrix/api . . . . ) |
+| NetwrixAuditor CertificateThumbprint | NOCHECK | Auditor Certificate Thumbprint Property. Possible values: - `AB:BB:CC.`—Check Auditor server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| NetwrixAuditorDateTimeFormat | yyyy-MM-ddTHH:mm:ssZ | Auditor time format. By default, set to zero offset. |
-| NetwrixAuditorPlan | — | Unless specified, data is written to Netwrix_Auditor_API database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
-| NetwrixAuditorPlanItem | — | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item in Auditor in advance. |
-| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format. The account must be assigned the Contributor role in Netwrix Auditor. |
-| NetwrixAuditorUserPassword | Current user credentials | Unless specified, the add-on runs with the current user credentials. Provide a different password if necessary. |
+| NetwrixAuditorPlan | — | By default, the add-on writes data to the Netwrix_Auditor_API database and doesn't associate it with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, the add-on writes data to a database linked to that plan. If you select a plan name in the add-on, create a dedicated plan in Auditor, add the Netwrix API data source to the plan, and enable the data source for monitoring. Otherwise, the add-on can't write data to the Audit Database. |
+| NetwrixAuditorPlanItem | — | By default, the add-on doesn't associate data with a specific plan, so you can't filter it by item name. Specify an item name. ensure to create a dedicated item in Auditor in advance. |
+| NetwrixAuditorUserName | Current user credentials | By default, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the _DOMAIN\username_ format. The account must be assigned the Contributor role in Netwrix Auditor. |
+| NetwrixAuditorUserPassword | Current user credentials | By default, the add-on runs with the current user credentials. Provide a different password if necessary. |
| DataCollection | | |
-| DataCollectionServer | (empty) | Specify SCVMM server to collect data from. You can use IP address, FQDN or NETBIOS name. For localhost, leave this parameter empty. |
-| DataCollectionUserName | (empty) | Specify user account that will be used for data collection from SCVMM server. To use the account currently logged in, leave this parameter empty. Make sure the account has administrative rights on that server (see the [Accounts and Rights](overview.md#accounts-and-rights) topic for additional information). |
+| DataCollectionServer | (empty) | Specify SCVMM server to collect data from. You can use IP address, FQDN, or NETBIOS name. For localhost, leave this parameter empty. |
+| DataCollectionUserName | (empty) | Specify user account that will be used for data collection from SCVMM server. To use the account logged in, leave this parameter empty. ensure the account has administrative rights on that server (see the [Accounts and Rights](overview.md#accounts-and-rights) topic for additional information). |
| DataCollectionPassword | | Specify user account password. |
| ShortTermFolder | ShortTerm | Specify path to the short-term archive (Netwrix Auditor working folder). You can use full or relative path. |
diff --git a/docs/auditor/10.9/addon/hyperv/troubleshooting.md b/docs/auditor/10.9/addon/hyperv/troubleshooting.md
index 376a4e1110..03e0a4c978 100644
--- a/docs/auditor/10.9/addon/hyperv/troubleshooting.md
+++ b/docs/auditor/10.9/addon/hyperv/troubleshooting.md
@@ -6,13 +6,13 @@ sidebar_position: 60
# Maintenance and Troubleshooting
-If you cannot see collected data in Auditor, check the following:
+If you can't see collected data in Auditor, check the following:
- Add-on account has sufficient rights to access SCVMM and Auditor.
-- In Netwrix Auditor settings, go to the **Integrations** section and make sure the **Leverage
+- In Netwrix Auditor settings, go to the **Integrations** section and ensure the **Leverage
Integration API** is switched to **ON**. Check the communication port number – default is
**9699**.
-- If you configured a dedicated monitoring plan, make sure data source monitoring is enabled.
+- If you configured a dedicated monitoring plan, ensure data source monitoring is enabled.
- Verify the parameters you provided in **settings.xml**.
## Monitor Several SCVMM
@@ -47,15 +47,15 @@ Follow the steps if you need to modify the task schedule:
Alternatively, you can use **Windows Task Scheduler**.
-- If the solution was deployed using the third scenario (that is, SCVMM server and add-on are
- running on different machines), then the following error may be written in the solution log:
+- If you deployed the solution using the third scenario (that is, SCVMM server and add-on are
+ running on different machines), the solution may write the following error to the solution log:
-The WinRM client cannot process the request.
+The WinRM client can't process the request.
See the [Deployment Scenarios](/docs/auditor/10.9/addon/hyperv/deployment.md)topic for additional information.
-If the authentication scheme is different from Kerberos, or if the client computer is not joined to
-a domain, then HTTPS transport must be used or the destination machine must be added to the
+If the authentication scheme is different from Kerberos, or if the client computer isn't joined to
+a domain, use HTTPS transport or add the destination machine to the
**TrustedHosts** list. To configure this list, use **winrm.cmd**.
Computers included in the **TrustedHosts** list might not be authenticated. To get more information
diff --git a/docs/auditor/10.9/addon/ibmqradar/automate.md b/docs/auditor/10.9/addon/ibmqradar/automate.md
index 6a202cf53f..f9c1ee1d25 100644
--- a/docs/auditor/10.9/addon/ibmqradar/automate.md
+++ b/docs/auditor/10.9/addon/ibmqradar/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.9/addon/ibmqradar/collecteddata.md b/docs/auditor/10.9/addon/ibmqradar/collecteddata.md
index 6f1f0a7795..fb2471af79 100644
--- a/docs/auditor/10.9/addon/ibmqradar/collecteddata.md
+++ b/docs/auditor/10.9/addon/ibmqradar/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
+**To work with collected data:**
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.9/addon/ibmqradar/deployment.md b/docs/auditor/10.9/addon/ibmqradar/deployment.md
index 30ac0a5df3..78dac84be8 100644
--- a/docs/auditor/10.9/addon/ibmqradar/deployment.md
+++ b/docs/auditor/10.9/addon/ibmqradar/deployment.md
@@ -15,8 +15,8 @@ Netwrix suggests the following execution scenarios:
| Scenario | Example |
| ------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The add-on runs on the Auditor Server with the current user credentials. Activity Records are exported to a local event log. | C:\Add-ons\Netwrix_Auditor_Add-on_for_IBM_QRadar.ps1 |
-| The add-on runs on the Auditor Server with explicitly defined credentials. Activity Records are exported to a local event log. | C:\Add-ons\Netwrix*Auditor_Add-on_for_IBM* QRadar.ps1 -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool |
+| The add-on runs on the Auditor Server with the current user credentials and exports Activity Records to a local event log. | C:\Add-ons\Netwrix_Auditor_Add-on_for_IBM_QRadar.ps1 |
+| The add-on runs on the Auditor Server with explicitly defined credentials and exports Activity Records to a local event log. | C:\Add-ons\Netwrix*Auditor_Add-on_for_IBM* QRadar.ps1 -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool |
| The add-on exports Activity Records from a remote Auditor Server using current user credentials and writes data to a local event log. | C:\Add-ons\Netwrix*Auditor_Add-on_for_IBM* QRadar.ps1 -NetwrixAuditorHost 172.28.6.15 |
| The add-on exports Activity Records from a remote Auditor Server using explicitly defined credentials and writes data to a local event log. | C:\Add-ons\Netwrix*Auditor_Add-on_for_IBM* QRadar.ps1 -NetwrixAuditorHost 172.28.6.15 -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool |
diff --git a/docs/auditor/10.9/addon/ibmqradar/integrationeventlog.md b/docs/auditor/10.9/addon/ibmqradar/integrationeventlog.md
index 0a2633fae5..0e8d7483e0 100644
--- a/docs/auditor/10.9/addon/ibmqradar/integrationeventlog.md
+++ b/docs/auditor/10.9/addon/ibmqradar/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.9/addon/ibmqradar/overview.md b/docs/auditor/10.9/addon/ibmqradar/overview.md
index d810dd6e91..1764dd3013 100644
--- a/docs/auditor/10.9/addon/ibmqradar/overview.md
+++ b/docs/auditor/10.9/addon/ibmqradar/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 100
# IBM QRadar
-Netwrix Auditor Add-on for SIEM helps you to get most from your SIEM investment. This topic focuses
+Netwrix Auditor Add-on for SIEM helps you get more value from your SIEM investment. This topic focuses
on the IBM QRadar SIEM solution.
The add-on works in collaboration with Netwrix Auditor, supplying additional data that augments the
@@ -15,10 +15,10 @@ data collected by the SIEM solution.
The add-on enriches your SIEM data with actionable context in human-readable format, including the
before and after values for every change and data access attempt, both failed and successful.
Aggregating data into a single audit trail simplifies analysis, makes your SIEM more cost effective,
-and helps you keep tabs on your IT infrastructure.
+and helps you monitor your IT infrastructure.
Implemented as a PowerShell script, this add-on facilitates the audit data transition from Netwrix
-Auditor to the SIEM solution. All you have to do is provide connection details and schedule the
+Auditor to the SIEM solution. To set it up, provide connection details and schedule the
script for execution.
On a high level, the add-on works as follows:
@@ -46,5 +46,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts
+that use the Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.9/addon/ibmqradar/parameters.md b/docs/auditor/10.9/addon/ibmqradar/parameters.md
index a125e7b06b..3ab52c8463 100644
--- a/docs/auditor/10.9/addon/ibmqradar/parameters.md
+++ b/docs/auditor/10.9/addon/ibmqradar/parameters.md
@@ -7,8 +7,8 @@ sidebar_position: 10
# Define Parameters
Before running or scheduling the add-on, you must define connection details: Auditor Server host,
-user credentials, etc. Most parameters are optional, the script uses the default values unless
-parameters are explicitly defined. You can skip or define parameters depending on your execution
+user credentials, etc. Most parameters are optional; the script uses the default values unless you
+explicitly define them. You can skip or define parameters depending on your execution
scenario and security policies. See the [Choose Appropriate Execution Scenario](/docs/auditor/10.9/addon/ibmqradar/deployment.md) topic
for additional information.
@@ -21,20 +21,21 @@ for additional information.
## In-Script Parameters
-You may also need to modify the parameters that define how EventIDs should be generated for exported
-events, though their default values address most popular usage scenarios. In-script parameters are
-listed in the table below. To modify them, open the script for edit and enter the values you need.
+You may also need to modify the parameters that define how the add-on generates EventIDs for
+exported events, though their default values address most popular usage scenarios. The following
+table lists in-script parameters. To modify them, open the script for edit and enter the values you
+need.
Once set, these parameter values must stay unchanged until the last run of the script — otherwise
-dynamically calculated EventIDs will be modified and applied incorrectly.
+the add-on modifies and applies dynamically calculated EventIDs incorrectly.
| Parameter | Default value | Description |
| -------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.9/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.9/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId\* | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to _TRUE_. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the add-on uses the default value _Netwrix_Auditor_Integration_API_. If the event source for particular DataSource doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
\* When configuring the **IncludeDataSourceToMakeEventId** parameter, consider that the _Object
Type - Action_ pair may be identical for several data sources (e.g., Object='User' and
diff --git a/docs/auditor/10.9/addon/ibmqradar/powershell.md b/docs/auditor/10.9/addon/ibmqradar/powershell.md
index cc1744adc3..ecb26f740f 100644
--- a/docs/auditor/10.9/addon/ibmqradar/powershell.md
+++ b/docs/auditor/10.9/addon/ibmqradar/powershell.md
@@ -8,14 +8,14 @@ sidebar_position: 30
First, provide a path to your add-on followed by script parameters with their values. Each parameter
is preceded with a dash; a space separates a parameter name from its value. You can skip some
-parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
+parameters— the script uses a default value unless you explicitly define it. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
+**To run the add-on with PowerShell:**
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on, or drag and drop the add-on file into the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -27,20 +27,20 @@ Copyright (C) 2014 Microsoft Corporation. All rights reserved.
PS C:\Users\AddOnUser> C:\Add-ons\Netwrix_Auditor_Add-on_for_IBM_QRadar.ps1 - NetwrixAuditorHost
172.28.6.15
-**NOTE:** If the script path contains spaces (e.g., _C:\Netwrix Add-ons_), embrace it in double
+**NOTE:** If the script path contains spaces (e.g., _C:\Netwrix Add-ons_), enclose it in double
quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Add-ons_").
-**Step 4 –** Hit **Enter**.
+**Step 4 –** Press **Enter**.
Depending on the number of Activity Records stored in Netwrix Auditor Audit Database execution may
-take a while. Ensure the script execution completed successfully. The Netwrix Auditor
-**Integration** event log will be created and filled with events.
+take a while. Ensure the script execution completed successfully. The add-on creates the Netwrix Auditor
+**Integration** event log and fills it with events.
By default, the Netwrix Auditor **Integration** event log size is set to **1GB**, and retention is
set to "_Overwrite events as needed_". See the
[Integration Event Log Fields](/docs/auditor/10.9/addon/ibmqradar/integrationeventlog.md) topic for additional information.
-**NOTE:** Event records with more than 30,000 characters length will be trimmed.
+**NOTE:** The add-on trims event records with more than 30,000 characters.
At the end of each run, the script creates the
**Netwrix_Auditor_Event_Log_Export_Add-on_EventIDs.txt** file. It defines mapping between the
@@ -56,11 +56,11 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
- first run. At the end of the first run, the timestamp will be created, and the next run will start
- export from that timestamp.
+ first run. At the end of the first run, the add-on creates the timestamp, and the next run starts
+ exporting from that timestamp.
-- However, if you have specified a time period for Activity Records to be exported, then this filter
- will be applied at the add-on first run and the runs that follow.
+- However, if you specify a time period for exporting Activity Records, the add-on applies this
+ filter at the first run and every run after that.
diff --git a/docs/auditor/10.9/addon/intelsecurity/automate.md b/docs/auditor/10.9/addon/intelsecurity/automate.md
index 58d06c10aa..e2d1379a61 100644
--- a/docs/auditor/10.9/addon/intelsecurity/automate.md
+++ b/docs/auditor/10.9/addon/intelsecurity/automate.md
@@ -13,12 +13,12 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
-how often audit data is exported from Auditor and saved to event log. Netwrix recommends scheduling a
-daily task.
+how often the add-on exports audit data from Auditor and saves it to the event log. Netwrix
+recommends scheduling a daily task.
**Step 4 –** On the **Actions** tab, click **New** and specify action details. Review the following
for additional information:
diff --git a/docs/auditor/10.9/addon/intelsecurity/collecteddata.md b/docs/auditor/10.9/addon/intelsecurity/collecteddata.md
index 6f1f0a7795..5dfce79ca2 100644
--- a/docs/auditor/10.9/addon/intelsecurity/collecteddata.md
+++ b/docs/auditor/10.9/addon/intelsecurity/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
+To work with collected data:
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.9/addon/intelsecurity/deployment.md b/docs/auditor/10.9/addon/intelsecurity/deployment.md
index 533fa8f8c3..32f46ab978 100644
--- a/docs/auditor/10.9/addon/intelsecurity/deployment.md
+++ b/docs/auditor/10.9/addon/intelsecurity/deployment.md
@@ -15,8 +15,8 @@ Netwrix suggests the following execution scenarios:
| Scenario | Example |
| ------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The add-on runs on the Auditor Server with the current user credentials. Activity Records are exported to a local event log. | C:\Add-ons\Netwrix_Auditor_Add-on_for_Intel_Security.ps1 |
-| The add-on runs on the Auditor Server with explicitly defined credentials. Activity Records are exported to a local event log. | C:\Add-ons\Netwrix_Auditor_Add-on_for_Intel_Security.ps1 -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool |
+| The add-on runs on the Auditor Server with the current user credentials and exports Activity Records to a local event log. | C:\Add-ons\Netwrix_Auditor_Add-on_for_Intel_Security.ps1 |
+| The add-on runs on the Auditor Server with explicitly defined credentials and exports Activity Records to a local event log. | C:\Add-ons\Netwrix_Auditor_Add-on_for_Intel_Security.ps1 -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool |
| The add-on exports Activity Records from a remote Auditor Server using current user credentials and writes data to a local event log. | C:\Add-ons\Netwrix_Auditor_Add-on_for_Intel_Security.ps1-NetwrixAuditorHost 172.28.6.15 |
| The add-on exports Activity Records from a remote Auditor Server using explicitly defined credentials and writes data to a local event log. | C:\Add-ons\Netwrix_Auditor_Add-on_for_Intel_Security.ps1-NetwrixAuditorHost 172.28.6.15 -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool |
diff --git a/docs/auditor/10.9/addon/intelsecurity/integrationeventlog.md b/docs/auditor/10.9/addon/intelsecurity/integrationeventlog.md
index dcf2fcf677..a4a84a517b 100644
--- a/docs/auditor/10.9/addon/intelsecurity/integrationeventlog.md
+++ b/docs/auditor/10.9/addon/intelsecurity/integrationeventlog.md
@@ -9,8 +9,8 @@ sidebar_position: 60
This section describes how the add-on fills in the Netwrix Auditor **Integration** event log fields
with data retrieved from Activity Records.
-The Activity Record structure is described in the
-[Reference for Creating Activity Records](/docs/auditor/10.9/api/activityrecordreference.md)topic.
+The [Reference for Creating Activity Records](/docs/auditor/10.9/api/activityrecordreference.md)
+topic describes the Activity Record structure.
| Event log field name | Filled in with value | Details |
| -------------------- | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+The add-on fills in Details only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.9/addon/intelsecurity/overview.md b/docs/auditor/10.9/addon/intelsecurity/overview.md
index 4ad4cc8bc9..cfac54b82d 100644
--- a/docs/auditor/10.9/addon/intelsecurity/overview.md
+++ b/docs/auditor/10.9/addon/intelsecurity/overview.md
@@ -15,7 +15,7 @@ data collected by the SIEM solution.
The add-on enriches your SIEM data with actionable context in human-readable format, including the
before and after values for every change and data access attempt, both failed and successful.
Aggregating data into a single audit trail simplifies analysis, makes your SIEM more cost effective,
-and helps you keep tabs on your IT infrastructure.
+and helps you monitor your IT infrastructure.
Implemented as a PowerShell script, this add-on facilitates the audit data transition from Netwrix
Auditor to the SIEM solution. All you have to do is provide connection details and schedule the
@@ -46,5 +46,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts that use
+the Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.9/addon/intelsecurity/parameters.md b/docs/auditor/10.9/addon/intelsecurity/parameters.md
index 4678e1f733..5183242e35 100644
--- a/docs/auditor/10.9/addon/intelsecurity/parameters.md
+++ b/docs/auditor/10.9/addon/intelsecurity/parameters.md
@@ -21,9 +21,9 @@ for additional information.
## In-Script Parameters
-You may also need to modify the parameters that define how EventIDs should be generated for exported
-events, though their default values address most popular usage scenarios. In-script parameters are
-listed in the table below. To modify them, open the script for edit and enter the values you need.
+You may also need to modify the parameters that define how the script generates EventIDs for
+exported events, though their default values address most popular usage scenarios. In-script
+parameters are listed in the following table. To modify them, open the script for edit and enter the values you need.
Once set, these parameter values must stay unchanged until the last run of the script — otherwise
dynamically calculated EventIDs will be modified and applied incorrectly.
@@ -31,10 +31,10 @@ dynamically calculated EventIDs will be modified and applied incorrectly.
| Parameter | Default value | Description |
| -------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.9/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.9/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId\* | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to _TRUE_. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
\* When configuring the **IncludeDataSourceToMakeEventId** parameter, consider that the _Object
Type - Action_ pair may be identical for several data sources (e.g., Object='User' and
diff --git a/docs/auditor/10.9/addon/intelsecurity/powershell.md b/docs/auditor/10.9/addon/intelsecurity/powershell.md
index c800e4c44e..b6d9258bee 100644
--- a/docs/auditor/10.9/addon/intelsecurity/powershell.md
+++ b/docs/auditor/10.9/addon/intelsecurity/powershell.md
@@ -15,7 +15,7 @@ modify the parameters as required.
**Step 1 –** On computer where you want to execute the add-on, start **Windows PowerShell**.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -40,12 +40,12 @@ By default, the Netwrix Auditor **Integration** event log size is set to 1GB, an
to "_Overwrite events as needed_". See the [Integration Event Log Fields](/docs/auditor/10.9/addon/intelsecurity/integrationeventlog.md)
topic for additional information.
-**NOTE:** Event records with more than 30,000 characters length will be trimmed.
+**NOTE:** The add-on trims event records with more than 30,000 characters in length.
At the end of each run, the script creates the
**Netwrix_Auditor_Event_Log_Export_Add-on_EventIDs.txt** file. It defines mapping between the
Activity Records and related Event IDs . You can use this file to track possible duplicates of Event
-IDs created at each script execution. Duplicates, if any, are written to the
+IDs created at each script execution. The script writes any duplicates to the
**Netwrix_Auditor_Event_Log_Export_Add-on_EventIDsDuplicates.txt** file.
Similarly, the add-on also creates the **Netwrix_Auditor_Event_Log_Export_Add-on_CategoriesIDs.txt**
@@ -56,11 +56,11 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
- first run. At the end of the first run, the timestamp will be created, and the next run will start
+ first run. At the end of the first run, the script creates the timestamp, and the next run starts
export from that timestamp.
-- However, if you have specified a time period for Activity Records to be exported, then this filter
- will be applied at the add-on first run and the runs that follow.
+- However, if you specified a time period for Activity Records to export, the add-on applies this
+ filter at the first run and the runs that follow.
diff --git a/docs/auditor/10.9/addon/linux/collecteddata.md b/docs/auditor/10.9/addon/linux/collecteddata.md
index 2435ba82e2..bedc8b763f 100644
--- a/docs/auditor/10.9/addon/linux/collecteddata.md
+++ b/docs/auditor/10.9/addon/linux/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-Follow the steps to search for collected data:
+**To search for collected data:**
**Step 1 –** Start the Auditor client and navigate to **Search**.
@@ -18,4 +18,4 @@ data source only.
## Expand List of Gathered Events
Based on the activity you get, you may want to adjust the processing rules, add other relevant
-events, etc. To do that, copy and edit the file with processing rules, and then restart the service.
+events, etc. To do that, copy the file with processing rules, edit it, and then restart the service.
diff --git a/docs/auditor/10.9/addon/linux/install.md b/docs/auditor/10.9/addon/linux/install.md
index 955178db1f..027ba7b593 100644
--- a/docs/auditor/10.9/addon/linux/install.md
+++ b/docs/auditor/10.9/addon/linux/install.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Add-On
-Follow the steps to install the Add-On:
+**To install the Add-On:**
**Step 1 –** Navigate to your add-on package.
diff --git a/docs/auditor/10.9/addon/linux/overview.md b/docs/auditor/10.9/addon/linux/overview.md
index a1cee1653b..e8ed4bb3ff 100644
--- a/docs/auditor/10.9/addon/linux/overview.md
+++ b/docs/auditor/10.9/addon/linux/overview.md
@@ -6,15 +6,15 @@ sidebar_position: 120
# Linux Generic Syslog
-The add-on works in collaboration with Netwrix Auditor, supplying data about activity on your Linux-based devices. Aggregating data into a single audit trail simplifies analysis, makes activity monitoring more cost effective, and helps you keep tabs on your IT infrastructure.
+The add-on works in collaboration with Netwrix Auditor, supplying data about activity on your Linux-based devices. Aggregating data into a single audit trail simplifies analysis, makes activity monitoring more cost effective, and helps you monitor your IT infrastructure.
-Implemented as a service, this add-on facilitates the data transition from Linux-based systems to Netwrix Auditor. All you have to do is provide connection details and specify parsing rules.
+Implemented as a service, this add-on facilitates the data transition from Linux-based systems to Netwrix Auditor. To set it up, provide connection details and specify parsing rules.
On a high level, the add-on works as follows:
**Step 1** – The add-on listens to the specified UDP ports and captures designated Syslog messages.
-**Step 2** – Out of the box, messages from Red Hat Enterprise Linux 6, 7, 8, 9, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16 are supported. For other distributions, deployment of the rsyslog package may be required. You can edit the add-on configuration to extend the captured message list.
+**Step 2** – By default, the add-on supports messages from Red Hat Enterprise Linux 6, 7, 8, 9, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16. For other distributions, deployment of the rsyslog package may be required. You can edit the add-on configuration to extend the captured message list.
**Step 3** – The add-on processes these events into Netwrix Auditor-compatible format (Activity Records). Each Activity Record contains the user account, action, time, and other details.
@@ -44,7 +44,7 @@ Before running the add-on, ensure that all the necessary components and policies
### On the target syslog-based platform
- Outbound UDP **514** port must be enabled.
-- The **Syslog daemon** must be configured to redirect events. The procedure below explains how to configure redirection.
+- The **Syslog daemon** must be configured to redirect events. The following procedure explains how to configure redirection.
**NOTE:** The deployment of the rsyslog package may be required.
diff --git a/docs/auditor/10.9/addon/linux/parameters.md b/docs/auditor/10.9/addon/linux/parameters.md
index 021638caa4..96be7279cb 100644
--- a/docs/auditor/10.9/addon/linux/parameters.md
+++ b/docs/auditor/10.9/addon/linux/parameters.md
@@ -16,15 +16,15 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Netwrix Auditor Endpoint | Netwrix Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Netwrix Auditor Server and uses default port _9699_. To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (_/netwrix/api_ ) |
-| Certificate Thumbprint | Possible values:
- `Empty`— Check Auditor certificate via Windows Certificate Store.
- `AB:BB:CC`— Check Auditor Server certificate thumbprint identifier.
- `NOCHECK`— Do not check Auditor certificate.
Make sure to select this parameter if you plan to specify servers by their IP. |
+| Netwrix Auditor Endpoint | Netwrix Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Netwrix Auditor Server and uses default port _9699_. To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (_/netwrix/api_ ) |
+| Certificate Thumbprint | Possible values:
- `Empty`— Check Auditor certificate via Windows Certificate Store.
- `AB:BB:CC`— Check Auditor Server certificate thumbprint identifier.
- `NOCHECK`— Don't check Auditor certificate.
ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
| Username | Specify the account under which the service will authenticate to the **Netwrix_Auditor_API**. |
| Password | Provide the password for the selected account. |
| Monitoring Plan settings | |
-| Monitoring Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Monitoring Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Monitoring Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, Auditor writes the data to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Monitoring Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
-| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
+| Address | Specify a list of IP addresses of syslog events sources. The service collects and processes events from these sources only and ignores events from any other source. |
Click **Run** to start collecting data with the Add-On.
diff --git a/docs/auditor/10.9/addon/logrhythm/automate.md b/docs/auditor/10.9/addon/logrhythm/automate.md
index 983ffca41a..01a022eaef 100644
--- a/docs/auditor/10.9/addon/logrhythm/automate.md
+++ b/docs/auditor/10.9/addon/logrhythm/automate.md
@@ -11,7 +11,7 @@ task manually. To do this, right-click a task and click **Run**.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.9/addon/logrhythm/collecteddata.md b/docs/auditor/10.9/addon/logrhythm/collecteddata.md
index 4eb4fba982..811178caca 100644
--- a/docs/auditor/10.9/addon/logrhythm/collecteddata.md
+++ b/docs/auditor/10.9/addon/logrhythm/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data.
+To work with collected data, complete the following steps.
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.9/addon/logrhythm/integrationeventlog.md b/docs/auditor/10.9/addon/logrhythm/integrationeventlog.md
index 8d66f530df..8b8b7043b0 100644
--- a/docs/auditor/10.9/addon/logrhythm/integrationeventlog.md
+++ b/docs/auditor/10.9/addon/logrhythm/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+Details are filled in only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.9/addon/logrhythm/overview.md b/docs/auditor/10.9/addon/logrhythm/overview.md
index e8f965a87d..ce99a987be 100644
--- a/docs/auditor/10.9/addon/logrhythm/overview.md
+++ b/docs/auditor/10.9/addon/logrhythm/overview.md
@@ -15,7 +15,7 @@ data collected by the SIEM solution.
The add-on enriches your SIEM data with actionable context in human-readable format, including the
before and after values for every change and data access attempt, both failed and successful.
Aggregating data into a single audit trail simplifies analysis, makes your SIEM more cost effective,
-and helps you keep tabs on your IT infrastructure.
+and helps you monitor your IT infrastructure.
Implemented as a PowerShell script, this add-on facilitates the audit data transition from Netwrix
Auditor to the SIEM solution. All you have to do is provide connection details and schedule the
@@ -46,5 +46,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts
+that use the Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.9/addon/logrhythm/parameters.md b/docs/auditor/10.9/addon/logrhythm/parameters.md
index 3ecb11fc07..a2eb201d34 100644
--- a/docs/auditor/10.9/addon/logrhythm/parameters.md
+++ b/docs/auditor/10.9/addon/logrhythm/parameters.md
@@ -22,8 +22,8 @@ for additional information.
## In-Script Parameters
You may also need to modify the parameters that define how EventIDs should be generated for exported
-events, though their default values address most popular usage scenarios. In-script parameters are
-listed in the table below. To modify them, open the script for edit and enter the values you need.
+events, though their default values address most popular usage scenarios. The following table lists
+the in-script parameters. To modify them, open the script for edit and enter the values you need.
Once set, these parameter values must stay unchanged until the last run of the script — otherwise
dynamically calculated EventIDs will be modified and applied incorrectly.
@@ -31,10 +31,10 @@ dynamically calculated EventIDs will be modified and applied incorrectly.
| Parameter | Default value | Description |
| -------------------------------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.9/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.9/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId\* | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to _TRUE_. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the DataSource field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the DataSource field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the DataSource field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular DataSource doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
\* When configuring the **IncludeDataSourceToMakeEventId** parameter, consider that the _Object
Type - Action_ pair may be identical for several data sources (e.g., Object='User' and
diff --git a/docs/auditor/10.9/addon/logrhythm/powershell.md b/docs/auditor/10.9/addon/logrhythm/powershell.md
index 37b4b1f8ff..1a0f2cfc2b 100644
--- a/docs/auditor/10.9/addon/logrhythm/powershell.md
+++ b/docs/auditor/10.9/addon/logrhythm/powershell.md
@@ -11,11 +11,11 @@ is preceded with a dash; a space separates a parameter name from its value. You
parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run the script with PowerShell.
+To run the script with PowerShell, complete the following steps.
**Step 1 –** On computer where you want to execute the add-on, start **Windows PowerShell**.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or simply drag and drop the add-on file in the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -56,7 +56,7 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
first run. At the end of the first run, the timestamp will be created, and the next run will start
diff --git a/docs/auditor/10.9/addon/nasuni/collecteddata.md b/docs/auditor/10.9/addon/nasuni/collecteddata.md
index 059ce074d6..5ebd1a9d4d 100644
--- a/docs/auditor/10.9/addon/nasuni/collecteddata.md
+++ b/docs/auditor/10.9/addon/nasuni/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To use data collected with the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
specifying the criteria you need, click **Search**. You will get a list of activity records with
diff --git a/docs/auditor/10.9/addon/nasuni/install.md b/docs/auditor/10.9/addon/nasuni/install.md
index 955178db1f..7feae4d74e 100644
--- a/docs/auditor/10.9/addon/nasuni/install.md
+++ b/docs/auditor/10.9/addon/nasuni/install.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Install Add-On
-Follow the steps to install the Add-On:
+To install the Add-On:
**Step 1 –** Navigate to your add-on package.
diff --git a/docs/auditor/10.9/addon/nasuni/overview.md b/docs/auditor/10.9/addon/nasuni/overview.md
index 07f502d94a..63ffc016ec 100644
--- a/docs/auditor/10.9/addon/nasuni/overview.md
+++ b/docs/auditor/10.9/addon/nasuni/overview.md
@@ -8,10 +8,10 @@ sidebar_position: 140
The add-on works in collaboration with Netwrix Auditor, supplying data about activity on your
Nasuni-based devices. Aggregating data into a single audit trail simplifies analysis, makes activity
-monitoring more cost effective, and helps you keep tabs on your IT infrastructure.
+monitoring more cost effective, and helps you monitor your IT infrastructure.
Implemented as a service, this add-on facilitates the data transition from Nasuni-based systems to
-Netwrix Auditor. All you have to do is provide connect ion details and specify parsing rules.
+Netwrix Auditor. To set it up, provide connection details and specify parsing rules.
On a high level, the add-on works as follows:
@@ -34,9 +34,7 @@ follows:
| The Auditor Server side | - The Audit Database settings are configured in Auditor Server. See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) and [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topics for additional information. - The TCP **9699** port (default Integration API port) is open for inbound connections. - The user writing data to the Audit Database is granted the **Contributor** role in Auditor. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) topic for additional information. Alternatively, you can grant the **Global administrator** role or add the user to the **Netwrix Auditor Administrators** group. In this case, this user will have the most extended permissions in the product. |
| The computer where the add-on will be installed | - The UDP 514 port is open for inbound connections. - .Net Framework 4.7.2 and above is installed. Review the following Microsoft technical article for additional information on how to install .Net Framework 4.7.2: [Microsoft .NET Framework 4.7.2 offline installer for Windows](https://support.microsoft.com/en-us/topic/microsoft-net-framework-4-7-2-offline-installer-for-windows-05a72734-2127-a15d-50cf-daf56d5faec2). |
-### Configure Logging for
-
-Follow the steps to configure the syslog integration.
+### Configure Logging for Nasuni
**Step 1 –** Log in to the Nasuni Management Console and go to the **Console Settings** > **Syslog
Exports**.
@@ -53,8 +51,8 @@ configuration.
**Step 4 –** Enable auditing:
1. On the Volumes tab, open **Auditing**.
-2. Choose the volume you wish to be audited and click **Edit Volumes**.
-3. Select the **Auditing Enabled** option and choose which Event Types you wish to be reported.
+2. Choose the volume you want to be audited and click **Edit Volumes**.
+3. Select the **Auditing Enabled** option and choose which Event Types you want to be reported.
4. Hit the **Save Auditing Settings** button.
### Accounts and Rights
@@ -77,5 +75,5 @@ admin privileges.
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts
+that use the Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.9/addon/nasuni/parameters.md b/docs/auditor/10.9/addon/nasuni/parameters.md
index dcce4538fe..cdc7e70508 100644
--- a/docs/auditor/10.9/addon/nasuni/parameters.md
+++ b/docs/auditor/10.9/addon/nasuni/parameters.md
@@ -16,15 +16,15 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (_/ netwrix/ api_ ) |
-| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Do not check Auditor certificate. Make sure to select this parameter if you plan to specify servers by their IP. |
+| Auditor Endpoint | Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Auditor Server and uses default port _9699_. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., _172.28.6.15_, _EnterpriseNAServer_, _WKS.enterprise.local_). To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (_/ netwrix/ api_ ) |
+| Certificate Thumbprint | Netwrix Auditor Certificate Thumbprint Property. Possible values: - `Empty`—Check Auditor certificate via Windows Certificate Store. - `AB:BB:CC`—Check Auditor Server certificate thumbprint identifier. - `NOCHECK`—Don't check Auditor certificate. ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
-| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account currently logged on. |
+| Username | Provide the name of the account under which the service runs. Unless specified, the service runs under the account logged on. |
| Password | Provide the password for the selected account. |
| Auditor Monitoring Plan settings | |
-| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Auditor Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Auditor Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, Auditor writes the data to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created in Auditor, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Auditor Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
-| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
+| Address | Specify a list of IP addresses of syslog events sources. The service collects and processes events from these sources only and ignores events from any other source. |
Click **Run** to start collecting data with the Add-On.
diff --git a/docs/auditor/10.9/addon/okta/collecteddata.md b/docs/auditor/10.9/addon/okta/collecteddata.md
index 5655f9d4f0..a2dd8fe6ed 100644
--- a/docs/auditor/10.9/addon/okta/collecteddata.md
+++ b/docs/auditor/10.9/addon/okta/collecteddata.md
@@ -6,10 +6,10 @@ sidebar_position: 20
# Work with Collected Data
-To leverage data collected with the add-on, you can do the following in Auditor:
+To use data collected with the add-on, you can do the following in Auditor:
- Search for required data. For that, start Auditor client and navigate to **Search**. After
- specifying the criteria you need, click **Search**. You will get a list of activity records with
+ specifying the criteria you need, click **Search**. You get a list of activity records with
detailed information on who did what in the reported time period.
You can apply a filter to narrow down your search results to the Netwrix **API** data source only.
diff --git a/docs/auditor/10.9/addon/okta/deployment.md b/docs/auditor/10.9/addon/okta/deployment.md
index e4dabc38c7..ca540c1d2d 100644
--- a/docs/auditor/10.9/addon/okta/deployment.md
+++ b/docs/auditor/10.9/addon/okta/deployment.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Deploy the Add-On
-Follow the steps to deploy the Add-On.
+To deploy the Add-On:
**Step 1 –** Download the distribution package.
diff --git a/docs/auditor/10.9/addon/okta/overview.md b/docs/auditor/10.9/addon/okta/overview.md
index 8f341a29a3..f364927f9e 100644
--- a/docs/auditor/10.9/addon/okta/overview.md
+++ b/docs/auditor/10.9/addon/okta/overview.md
@@ -8,10 +8,10 @@ sidebar_position: 160
The add-on works in collaboration with Netwrix Auditor, supplying data about activity on your
Okta-based devices. Aggregating data into a single audit trail simplifies analysis, makes activity
-monitoring more cost effective, and helps you keep tabs on your IT infrastructure.
+monitoring more cost effective, and helps you monitor your IT infrastructure.
Implemented as a service, this add-on facilitates the data transition from Okta-based systems to
-Netwrix Auditor. All you have to do is provide connect ion details and specify parsing rules.
+Netwrix Auditor. Provide connection details and specify parsing rules.
On a high level, the add-on works as follows:
@@ -31,26 +31,25 @@ follows:
| On... | Ensure that... |
| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The Auditor Server side | - .NET Framework [4.5](https://www.microsoft.com/en-us/download/details.aspx?id=30653) or later is installed. - The Audit Database settings are configured in Auditor Server. See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) and [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topics for additional information. - The TCP **9699** port (default Integration API port) is open for inbound connections. - The user writing data to the Audit Database is granted the **Contributor** role in Auditor. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) topic for additional information. Alternatively, you can grant the **Global administrator** role or add the user to the **Netwrix Auditor Administrators** group. In this case, this user will have the most extended permissions in the product. |
+| The Auditor Server side | - .NET Framework [4.5](https://www.microsoft.com/en-us/download/details.aspx?id=30653) or later is installed. - The Audit Database settings are configured in Auditor Server. See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) and [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topics for additional information. - The TCP **9699** port (default Integration API port) is open for inbound connections. - The user writing data to the Audit Database is granted the **Contributor** role in Auditor. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) topic for additional information. Alternatively, you can grant the **Global administrator** role or add the user to the **Netwrix Auditor Administrators** group. In this case, this user has the most extended permissions in the product. |
### Accounts and Rights
-By default, the add-on will run under the _Local System_ account. So, if the add-on and Auditor will
-be running on different machines, the corresponding computer account will require at least the
+By default, the add-on runs under the _Local System_ account. If the add-on and Auditor
+run on different machines, the corresponding computer account requires at least the
**Contributor** role in Auditor. See the
[Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) topic for additional
information.
-In case the add-on and Auditor are installed on the same server, no special settings are needed.
+If the add-on and Auditor are installed on the same server, you don't need any special settings.
### Considerations and Limitations
- The Add-On must be deployed in the same subnet as Okta and Auditor.
-- If the monitoring plan name in the _``_ add-on configuration parameter is
- specified incorrectly, this may lead to temp files generation and, therefore, to inefficient disk
- space usage.
+- If you specify the monitoring plan name in the _``_ add-on configuration
+ parameter incorrectly, the add-on generates temp files and uses disk space inefficiently.
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts
+that use the Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.9/addon/overview.md b/docs/auditor/10.9/addon/overview.md
index 529c3d4278..61aff34017 100644
--- a/docs/auditor/10.9/addon/overview.md
+++ b/docs/auditor/10.9/addon/overview.md
@@ -7,8 +7,8 @@ sidebar_position: 80
# Add-Ons
The Netwrix Auditor Add-on Store contains free add-ons developed by Netwrix and your peers in
-the community. The add-ons help you leverage integration between your on-premises or cloud
-applications and Netwrix Auditor.
+the community. The add-ons help you integrate your on-premises or cloud applications with
+Netwrix Auditor.
The list of available add-ons keeps growing because with the new RESTful API, the integration
capabilities of Netwrix Auditor are unlimited. Netwrix encourages users to develop add-ons, upload
@@ -17,7 +17,7 @@ them to Netwrix website, and share with community.
Benefits:
- Centralize auditing and reporting of your IT environment — Netwrix unifies auditing of all IT
- systems across your on-premises, cloud or hybrid environment, and enables centralized reporting
+ systems across your on-premises, cloud, or hybrid environment, and enables centralized reporting
for security and compliance.
- Get the most from your SIEM investment — To maximize SIEM value, Netwrix increases the
signal-to-noise ratio and feeds your HP ArcSight, Splunk, IBM QRadar or any other SIEM solution
@@ -39,23 +39,23 @@ The following menu will appear:
Netwrix Auditor Integration API uses HTTPS with an automatically generated certificate for running
-requests to its endpoints. By default, add-ons are configured to accept all certificates that is
-appropriate for evaluation purposes and allows running the script without adjusting.
+requests to its endpoints. By default, add-ons accept all certificates, which is appropriate for
+evaluation purposes and lets you run the script without adjustment.
Refer to [Security](/docs/auditor/10.9/api/security.md) for detailed instructions on how to assign a new certificate
and enable trust on remote computers.
## Use Add-Ons
-Before your start working with the add-on, go through its quick-start guide at
+Before you start working with the add-on, go through its quick-start guide at
[Netwrix Documentation page](https://www.netwrix.com/documentation.html#netwrix-documentation-page).
Each guide contains detailed instructions for deploying and running the add-on, as well as
-prerequisites and configuration settings. Generic steps are described below.
+prerequisites and configuration settings. The following steps describe the generic process.
-Follow the steps to use the add-on.
+To use the add-on:
**Step 1 –** Check prerequisites. Since the add-ons work only in combination with Netwrix Auditor,
-make sure that Netwrix Auditor and its Audit Database are configured, and roles are assigned
+ensure that Netwrix Auditor and its Audit Database are configured, and roles are assigned
properly.
**Step 2 –** Specify parameters required for add-on operation. Before running or scheduling the
diff --git a/docs/auditor/10.9/addon/privilegeduserlinux/collecteddata.md b/docs/auditor/10.9/addon/privilegeduserlinux/collecteddata.md
index 6e78bcc77c..42756940f6 100644
--- a/docs/auditor/10.9/addon/privilegeduserlinux/collecteddata.md
+++ b/docs/auditor/10.9/addon/privilegeduserlinux/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 30
# Work with Collected Data
-Follow the steps to work with collected data:
+To work with collected data, complete the following steps:
**Step 1 –** Start the Auditor client and navigate to **Search**.
diff --git a/docs/auditor/10.9/addon/privilegeduserlinux/overview.md b/docs/auditor/10.9/addon/privilegeduserlinux/overview.md
index fb32a89fc1..84d1f0427f 100644
--- a/docs/auditor/10.9/addon/privilegeduserlinux/overview.md
+++ b/docs/auditor/10.9/addon/privilegeduserlinux/overview.md
@@ -6,13 +6,13 @@ sidebar_position: 170
# Privileged User Monitoring on Linux and Unix Systems
-The add-on works in collaboration with Auditor, supplying data about privileged user activity on Linux and Unix. Aggregating data into a single audit trail simplifies analysis, makes activity monitoring more cost effective, and helps you keep tabs on privilege elevation on your Linux and Unix-based devices. For example, it helps monitor the usage of SUDO as well as remote access with openSSH.
+The add-on works in collaboration with Auditor, supplying data about privileged user activity on Linux and Unix. Aggregating data into a single audit trail simplifies analysis, makes activity monitoring more cost effective, and helps you monitor privilege elevation on your Linux and Unix-based devices. For example, it helps monitor the usage of SUDO as well as remote access with openSSH.
On a high level, the add-on works as follows:
**Step 1** – The add-on listens to the specified UDP ports and captures designated Syslog messages.
-**Step 2** – Out of the box, messages from Red Hat Enterprise Linux 6, 7, 8, 9, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16 are supported. For other distributions, deployment of the rsyslog package may be required. You can edit the add-on configuration to extend the captured message list.
+**Step 2** – By default, messages from Red Hat Enterprise Linux 6, 7, 8, 9, SUSE Linux Enterprise Server 12, openSUSE 42, and Ubuntu 16 are supported. For other distributions, deployment of the rsyslog package may be required. You can edit the add-on configuration to extend the captured message list.
**Step 3** – The add-on processes these events into Netwrix Auditor-compatible format (Activity Records). Each Activity Record contains the user account, action, time, and other details.
@@ -42,7 +42,7 @@ Before running the add-on, ensure that all the necessary components and policies
### On the target syslog-based platform
- Outbound UDP **514** port must be enabled.
-- The **Syslog daemon** must be configured to redirect events. The procedure below explains how to configure redirection.
+- The **Syslog daemon** must be configured to redirect events. The following procedure explains how to configure redirection.
**NOTE:** The deployment of the rsyslog package may be required.
diff --git a/docs/auditor/10.9/addon/privilegeduserlinux/parameters.md b/docs/auditor/10.9/addon/privilegeduserlinux/parameters.md
index 82d3e53903..9966f59797 100644
--- a/docs/auditor/10.9/addon/privilegeduserlinux/parameters.md
+++ b/docs/auditor/10.9/addon/privilegeduserlinux/parameters.md
@@ -16,14 +16,14 @@ Click **Proceed** and complete the following fields:
| ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Specify General Settings | |
| Listed UDP port | Specify UDP port for listening incoming events. (**514** by default). |
-| Netwrix Auditor Endpoint | Netwrix Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Netwrix Auditor Server and uses default port _9699_. To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Do not modify the endpoint part (_/netwrix/api_ ) |
-| Certificate Thumbprint | Possible values:
- `Empty`— Check Auditor certificate via Windows Certificate Store.
- `AB:BB:CC`— Check Auditor Server certificate thumbprint identifier.
- `NOCHECK`— Do not check Auditor certificate.
Make sure to select this parameter if you plan to specify servers by their IP. |
+| Netwrix Auditor Endpoint | Netwrix Auditor Server IP address and port number followed by endpoint for posting Activity Records. Assumes that the add-on runs on the computer hosting Netwrix Auditor Server and uses default port _9699_. To specify a non-default port, provide a server name followed by the port number (e.g., _WKS.enterprise.local:9999_). Don't modify the endpoint part (_/netwrix/api_ ) |
+| Certificate Thumbprint | Possible values:
- `Empty`— Check Auditor certificate via Windows Certificate Store.
- `AB:BB:CC`— Check Auditor Server certificate thumbprint identifier.
- `NOCHECK`— Don't check Auditor certificate.
ensure to select this parameter if you plan to specify servers by their IP. |
| Specify Active Directory credentials | |
| Username | Specify the account under which the service will authenticate to the **Netwrix_Auditor_API**. |
| Password | Provide the password for the selected account. |
| Monitoring Plan settings | |
-| Monitoring Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, make sure a dedicated plan is created, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
-| Monitoring Plan Item | Unless specified, data is not associated with a specific plan and, thus, cannot be filtered by item name. Specify an item name. Make sure to create a dedicated item inAuditor in advance. |
+| Monitoring Plan | Unless specified, data is written to **Netwrix_Auditor_API** database and isn't associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. If you select a plan name in the add- on, ensure a dedicated plan is created, the Netwrix **API** data source is added to the plan and enabled for monitoring. Otherwise, the add- on will not be able to write data to the Audit Database. |
+| Monitoring Plan Item | Unless specified, data isn't associated with a specific plan and, thus, can't be filtered by item name. Specify an item name. ensure to create a dedicated item inAuditor in advance. |
| Accept List | |
| Address | Specify a list of IP addresses of syslog events sources. The service will collect and process events from these sources only. Events collected from any other source will be ignored. |
diff --git a/docs/auditor/10.9/addon/purestorage/monitoredevents.md b/docs/auditor/10.9/addon/purestorage/monitoredevents.md
index 11a2d817b8..e774759411 100644
--- a/docs/auditor/10.9/addon/purestorage/monitoredevents.md
+++ b/docs/auditor/10.9/addon/purestorage/monitoredevents.md
@@ -6,8 +6,8 @@ sidebar_position: 40
# Monitoring Scope
-Review a full list of object types and activities monitored on Pure Storage FlashArray with the
-add-on.
+Review a full list of object types and activities that the add-on monitors on Pure Storage
+FlashArray.
| Object | Action | Property |
| ------------ | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
diff --git a/docs/auditor/10.9/addon/radius/automate.md b/docs/auditor/10.9/addon/radius/automate.md
index 463df57654..f0046f84a4 100644
--- a/docs/auditor/10.9/addon/radius/automate.md
+++ b/docs/auditor/10.9/addon/radius/automate.md
@@ -14,12 +14,12 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task
Scheduler**.Select **Create Task**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
-how often audit data is exported from Auditor and saved to event log. Netwrix recommends scheduling
-a daily task.
+how often the add-on exports audit data from Auditor and saves it to the event log. Netwrix
+recommends scheduling a daily task.
**Step 4 –** On the **Actions** tab, click **New** and specify action details. Review the following
for additional information:
diff --git a/docs/auditor/10.9/addon/radius/collecteddata.md b/docs/auditor/10.9/addon/radius/collecteddata.md
index be0186d42d..41f58034af 100644
--- a/docs/auditor/10.9/addon/radius/collecteddata.md
+++ b/docs/auditor/10.9/addon/radius/collecteddata.md
@@ -6,10 +6,10 @@ sidebar_position: 50
# Work with Collected Data
-Auditor provides a convenient interface for reviewing RADIUS server logons. Once the script
-execution completed, you can start analyzing user activity data with Netwrix search.
+Auditor provides a convenient interface for reviewing RADIUS server logons. After the script
+execution completes, you can start analyzing user activity data with Netwrix search.
-Follow the steps to see results.
+To see results:
**Step 1 –** Start the Auditor client and navigate to Search.
diff --git a/docs/auditor/10.9/addon/radius/customreport.md b/docs/auditor/10.9/addon/radius/customreport.md
index ab922ade8b..5fb3231c95 100644
--- a/docs/auditor/10.9/addon/radius/customreport.md
+++ b/docs/auditor/10.9/addon/radius/customreport.md
@@ -7,11 +7,11 @@ sidebar_position: 60
# Create Custom Report
To speed up data review process and help you find the latest logons faster, Netwrix created an
-additional script, **Netwrix_Auditor_Saved_Search_for_RADIUS_Server_Logons.ps1**. It is shipped with
-the add-on and creates the RADIUS server logons since yesterday custom search-based report in the
-Auditor client.
+additional script, **Netwrix_Auditor_Saved_Search_for_RADIUS_Server_Logons.ps1**. Netwrix ships it
+with the add-on. It creates the RADIUS server logons since yesterday custom search-based report in
+the Auditor client.
-Follow the steps to create a custom report with the script.
+To create a custom report with the script:
**Step 1 –** Copy the **Netwrix_Auditor_Saved_Search_for_RADIUS_Server_Logons.ps1** script to the
Auditor Server.
diff --git a/docs/auditor/10.9/addon/radius/overview.md b/docs/auditor/10.9/addon/radius/overview.md
index 916e2f9518..822de31d96 100644
--- a/docs/auditor/10.9/addon/radius/overview.md
+++ b/docs/auditor/10.9/addon/radius/overview.md
@@ -21,12 +21,12 @@ for future reference.
Because it enhances security and scalability, the RADIUS protocol is widely used in enterprise
network environments to provide authentication and authorization for a variety of network access
servers, such as VPN or dial-in servers and wireless access points. It helps organize and centralize
-sign-in procedures and improve overall security. In a Windows Server environment, the RADIUS server
-is provided by the Network Policy Server (NPS).
+sign-in procedures and improve overall security. In a Windows Server environment, the Network Policy
+Server (NPS) provides the RADIUS server role.
In addition to providing user authentication and authorization, a RADIUS server can grant or deny
-access to a connecting device based on network policies. Companies leverage these policies to
-empower users to connect to the corporate infrastructure using their personal devices, while
+access to a connecting device based on network policies. Companies use these policies to
+let users connect to the corporate infrastructure using their personal devices, while
disallowing potentially vulnerable and unsafe devices to minimize risk.
## Netwrix Auditor Add-on
@@ -42,11 +42,11 @@ security operations teams detect these signs and react promptly to security thre
Netwrix Auditor Add-on for RADIUS Server works in collaboration with Netwrix Auditor for Active
Directory, collecting additional data that augments the data collected by Netwrix Auditor.
-Aggregating data into a single audit trail simplifies logon activity analysis and helps you keep
-tabs on your IT infrastructure.
+Aggregating data into a single audit trail simplifies logon activity analysis and helps you
+monitor your IT infrastructure.
Implemented as a PowerShell script, this add-on automates the acquisition of RADIUS logon events and
-their transition to Netwrix Auditor. All you have to do is provide connection details and schedule
+their transition to Netwrix Auditor. Provide connection details and schedule
the script for execution. Netwrix recommends running this add-on in addition to the Active Directory
auditing provided by Netwrix Auditor.
@@ -72,11 +72,11 @@ follows:
| On... | Ensure that... |
| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The Auditor Server side | - Auditor version is **9.8** or later. - The Audit Database settings are configured in Auditor Server. See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) and [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topics for additional information. - The TCP 9699 port (default Auditor Integration API port) is open for inbound connections. - The user retrieving data from the Audit Database is granted the Global reviewer role in Auditor or is a member of the Netwrix Auditor Client Users group. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) topic for additional information. Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user will have the most extended permissions in the product. |
+| The Auditor Server side | - Auditor version is **9.8** or later. - The Audit Database settings are configured in Auditor Server. See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) and [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topics for additional information. - The TCP 9699 port (default Auditor Integration API port) is open for inbound connections. - The user retrieving data from the Audit Database is granted the Global reviewer role in Auditor or is a member of the Netwrix Auditor Client Users group. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) topic for additional information. Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user has the most extended permissions in the product. |
| The RADIUS server | - The **Remote Event Log Management (RPC)** inbound firewall rule is enabled. - The account collecting RADIUS logon events is member of the **Domain Users** group and have the **Manage auditing and security log** right. |
-| The computer where the script will be executed | - PowerShell **3.0** or later must be installed. - .NET **4.5** or later must be installed. - Execution policy for powershell scripts is set to _"Unrestricted"_. Run Windows PowerShell as administrator and execute the following command: Set-ExecutionPolicy Unrestricted - The user running the script is granted the write permission on the script folder—the add-on creates a special .bin file with the last exported event. - The user running the script must be a member of the Domain Users group. - At least the first script run should be performed under the account with elevated privileges, as it will be necessary to create event log file and perform other required operations. |
+| The computer where the script will be executed | - PowerShell **3.0** or later must be installed. - .NET **4.5** or later must be installed. - Execution policy for powershell scripts is set to _"Unrestricted"_. Run Windows PowerShell as administrator and execute the following command: Set-ExecutionPolicy Unrestricted - The user running the script is granted the write permission on the script folder—the add-on creates a special .bin file with the last exported event. - The user running the script must be a member of the Domain Users group. - The first script run happens under an account with elevated privileges, since creating the event log file and completing other required operations requires those privileges. |
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts
+that use the Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.9/addon/radius/parameters.md b/docs/auditor/10.9/addon/radius/parameters.md
index 220e66d492..ca74239c82 100644
--- a/docs/auditor/10.9/addon/radius/parameters.md
+++ b/docs/auditor/10.9/addon/radius/parameters.md
@@ -7,8 +7,8 @@ sidebar_position: 10
# Define Parameters
Before running or scheduling the add-on, you must define connection details: Auditor Server host,
-user credentials, etc. Most parameters are optional, the script uses the default values unless
-parameters are explicitly defined. You can skip or define parameters depending on your execution
+user credentials, etc. Most parameters are optional; the script uses the default values unless you
+explicitly define them. You can skip or define parameters depending on your execution
scenario and security policies. See the
[Choose Appropriate Execution Scenario](/docs/auditor/10.9/addon/logrhythm/deployment.md) topic for additional
information.
@@ -17,9 +17,9 @@ information.
| ------------------------- | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Connection to Auditor** | | |
| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., WKS.enterprise.local:9999). |
-| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the DOMAIN\username format. The account must be assigned the Global reviewer role in Auditor or be a member of the Netwrix Auditor Client Users group on the computer hosting Auditor Server. |
-| NetwrixAuditorPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
-| NetwrixAuditorPlan | – | Unless specified, data is written to **Netwrix\_ Auditor_API** database and is not associated with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, data will be written to a database linked to this plan. **NOTE:** If you select a plan name in the add-on, make sure a dedicated plan is created in Auditor, the Netwrix API data source is added to the plan and enabled for monitoring. Otherwise, the add-on will not be able to write data to the Audit Database. |
+| NetwrixAuditorUserName | Current user credentials | By default, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the DOMAIN\username format. The account must be assigned the Global reviewer role in Auditor or be a member of the Netwrix Auditor Client Users group on the computer hosting Auditor Server. |
+| NetwrixAuditorPassword | Current user credentials | By default, the script runs with the current user credentials. Provide a different password if necessary. |
+| NetwrixAuditorPlan | – | By default, the add-on writes data to the **Netwrix\_ Auditor_API** database and doesn't associate it with a specific monitoring plan. Specify a name of associated monitoring plan in Auditor. In this case, the add-on writes data to a database linked to that plan. **NOTE:** If you select a plan name in the add-on, create a dedicated plan in Auditor, add the Netwrix API data source to the plan, and enable the data source for monitoring. Otherwise, the add-on can't write data to the Audit Database. |
| RADIUSHost | localhost | Assumes that the script runs on the RADIUS server. If you want to run a script on another machine, provide a name of the computer where RADIUS server resides (e.g., 172.28.6.16, EnterpriseNPS, NPS.enterprise.local). |
-| RADIUSUserName | Current user credentials | Unless specified, the script runs with the current user credentials. If you want the script to use another account to access the RADIUS server, specify the account name in the DOMAIN\username format. **NOTE:** The account must be a member of the **Domain Users** group and have the **Manage auditing and security log** right. |
-| RADIUSPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
+| RADIUSUserName | Current user credentials | By default, the script runs with the current user credentials. If you want the script to use another account to access the RADIUS server, specify the account name in the DOMAIN\username format. **NOTE:** The account must be a member of the **Domain Users** group and have the **Manage auditing and security log** right. |
+| RADIUSPassword | Current user credentials | By default, the script runs with the current user credentials. Provide a different password if necessary. |
diff --git a/docs/auditor/10.9/addon/radius/powershell.md b/docs/auditor/10.9/addon/radius/powershell.md
index 8f0745c084..d67507a3eb 100644
--- a/docs/auditor/10.9/addon/radius/powershell.md
+++ b/docs/auditor/10.9/addon/radius/powershell.md
@@ -8,17 +8,17 @@ sidebar_position: 30
First, provide a path to your add-on followed by script parameters with their values. Each parameter
is preceded with a dash; a space separates a parameter name from its value. You can skip some
-parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
+parameters— the script uses a default value unless you explicitly define one. If necessary,
modify the parameters as required.
-Follow the steps to run the script with PowerShell.
+To run the script with PowerShell:
-**Step 1 –** On computer where you want to execute the add-on, start **Windows PowerShell**.
+**Step 1 –** On the computer where you want to execute the add-on, start **Windows PowerShell**.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on, or drag and drop the add-on file into the console
window.
-**Step 3 –** Add script parameters. The console will look similar to the following:
+**Step 3 –** Add script parameters. The console looks similar to the following:
Windows PowerShell
@@ -35,5 +35,5 @@ quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Ad
Depending on the number of Activity Records stored in Auditor Audit Database execution may take a
while. Ensure the script execution completed successfully.
-Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
-start retrieving new events.
+Every time you run the script, Auditor makes a timestamp. The next time you run the script, it
+retrieves new events starting from that timestamp.
diff --git a/docs/auditor/10.9/addon/radius/troubleshooting.md b/docs/auditor/10.9/addon/radius/troubleshooting.md
index aaa64f3e10..e3e852b4ae 100644
--- a/docs/auditor/10.9/addon/radius/troubleshooting.md
+++ b/docs/auditor/10.9/addon/radius/troubleshooting.md
@@ -8,5 +8,5 @@ sidebar_position: 70
| Error in PowerShell | Resolution |
| -------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| New-Object : Exception calling ".ctor" with "1" argument(s): "Attempted to perform an unauthorized operation." | The account specified for collecting events on the RADIUS server does not have sufficient rights and permissions or the password is incorrect. - Check the password for this account. - Select the account that belongs to the **Domain Users** group and has the **Manage auditing and security log** right in domain where the RADIUS server resides. |
-| New-Object : Exception calling ".ctor" with "1" argument(s): "The RPC server is unavailable" | The firewall on the RADIUS server blocks the script execution. On the server, navigate to the **Help Protect your computer with Windows Firewall** page, select **Advanced Settings** and enable the **Remote Event Log Management (RPC)** inbound rule. |
+| New-Object : Exception calling ".ctor" with "1" arguments: "Attempted to perform an unauthorized operation." | The account specified for collecting events on the RADIUS server doesn't have sufficient rights and permissions or the password is incorrect. - Check the password for this account. - Select the account that belongs to the **Domain Users** group and has the **Manage auditing and security log** right in domain where the RADIUS server resides. |
+| New-Object : Exception calling ".ctor" with "1" arguments: "The RPC server is unavailable" | The firewall on the RADIUS server blocks the script execution. On the server, navigate to the **Help Protect your computer with Windows Firewall** page, select **Advanced Settings** and enable the **Remote Event Log Management (RPC)** inbound rule. |
diff --git a/docs/auditor/10.9/addon/servicenow/alerts.md b/docs/auditor/10.9/addon/servicenow/alerts.md
index 91e9da1c09..fe3027ba74 100644
--- a/docs/auditor/10.9/addon/servicenow/alerts.md
+++ b/docs/auditor/10.9/addon/servicenow/alerts.md
@@ -6,24 +6,24 @@ sidebar_position: 30
# Integrate Alerts with Add-On
-The add-on is shipped with a special set of alerts developed by Netwrix industry experts. These
+Netwrix ships the add-on with a special set of alerts developed by Netwrix industry experts. These
alerts are helpful for handling some routine cases that require service manager's attention, e.g.,
-account lockouts, changes to administrative groups. The alerts have preset filters and can be easily
-uploaded to Auditor, and then integrated with the add-on and your ServiceNow system. These alerts
-have ITSM Addon prefix in their names.
+account lockouts, changes to administrative groups. The alerts have preset filters. You can upload
+them to Auditor, and then integrate them with the add-on and your ServiceNow system. These alerts
+have an ITSM Addon prefix in their names.
Alternatively, you can integrate any default Auditor alert or your custom-built alerts with the
addon.
-By default, none of the alerts are integrated with add-on. To instruct the add-on to create tickets
-for alerts, you should enable integration.
+By default, none of the alerts are integrated with the add-on. To instruct the add-on to create
+tickets for alerts, enable integration.
In Auditor, go to Alerts, select the required alerts, click Edit, and in the Response
Action section of the alert properties specify the full path to Netwrix.ITSM.AlertResponseAction.exe
file (the add-on component responsible for alert handling), for example,
_C:\Addon\ITSM_SI\Netwrix.ITSM.AlertResponseAction.exe_.
-**NOTE:** Make sure to turn on alerting in Auditor. You should manually set the state to "**On**"
+**NOTE:** Ensure that alerting is turned on in Auditor. Manually set the state to "**On**"
for all alerts you want to integrate with the add-on.
Perform the following steps to integrate alerts with the add-on:
@@ -40,4 +40,4 @@ C:\Add-on\Netwrix.ITSM.AlertsUploaderTool.exe
| To... | Execute... |
|------------------------------------------| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Upload alert set shipped with the add-on | Netwrix.ITSM.AlertsUploaderTool.exe /UploadTemplates Once uploaded, the alerts appear in the **All Alerts** list in Auditor, their names start with "_ITSM add-on_". Make sure to set their state to **"On**" (turn them on) manually.
+| Upload alert set shipped with the add-on | Netwrix.ITSM.AlertsUploaderTool.exe /UploadTemplates Once uploaded, the alerts appear in the **All Alerts** list in Auditor; their names start with "_ITSM add-on_". Manually set their state to **"On**" to turn them on.
diff --git a/docs/auditor/10.9/addon/servicenow/deployment.md b/docs/auditor/10.9/addon/servicenow/deployment.md
index d9a95c0a71..4e52fefbe1 100644
--- a/docs/auditor/10.9/addon/servicenow/deployment.md
+++ b/docs/auditor/10.9/addon/servicenow/deployment.md
@@ -6,26 +6,21 @@ sidebar_position: 40
# Deploy the Service
-Follow the steps to deploy the service.
-
**Step 1 –** Locate the add-on folder on the computer where the Auditor Server resides.
**Step 2 –** Run the **install.cmd** file. The file deploys and enables the Auditor **ITSM
Integration Service**.
-**NOTE:** Stop and then restart the service every time you update any of configuration files.
+**NOTE:** Stop and then restart the service every time you update any of the configuration files.
## Configure Integration Service to Use Proxy
-If you are using a proxy to provide access to the Internet, consider that the Auditor ITSM
-Integration Service will need some additional configuration for proxy server to be detected
-properly. The reason is that this service runs under the **LocalSystem** account (non-interactive),
-which requires proxy settings to be specified manually. See the following Microsoft article for
-additional information:
+If you are using a proxy to provide access to the internet, the Auditor ITSM Integration Service
+needs additional configuration to detect the proxy server properly. This is because the service
+runs under the **LocalSystem** account (non-interactive), which requires you to specify proxy
+settings manually. See the following Microsoft article for additional information:
[HTTP proxy.](https://docs.microsoft.com/en-us/dotnet/framework/network-programming/automatic-proxy-detection)
-Follow the step to configure integration service settings.
-
**Step 3 –** Navigate to the add-on folder (default name is _Netwrix_Auditor_Add-on_for_ITSM_) and
select the **Netwrix.ITSM.IntegrationService.exe.config** service configuration file.
@@ -50,7 +45,7 @@ Here:
| Parameter | Description |
| ---------------- | ------------------------------------------------------------------------------------------------- |
| proxyaddress | Specify default proxy address and connection port, e.g., _http://172.28.13.79:8080_ |
-| usesystemdefault | Set to **True** to allow Internet Explorer proxy settings to be overwritten with custom settings. |
+| usesystemdefault | Set to **True** to let custom settings overwrite Internet Explorer proxy settings. |
| autoDetect | Set to **False**. |
**Step 5 –** Start the Auditor ITSM Integration Service.
diff --git a/docs/auditor/10.9/addon/servicenow/install.md b/docs/auditor/10.9/addon/servicenow/install.md
index ce367d9811..e5ce62daaf 100644
--- a/docs/auditor/10.9/addon/servicenow/install.md
+++ b/docs/auditor/10.9/addon/servicenow/install.md
@@ -6,12 +6,12 @@ sidebar_position: 10
# Install Add-On
-After downloading the add-on package from Netwrix add-on store, copy it to the a computer where the
+After downloading the add-on package from Netwrix add-on store, copy it to a computer where the
Auditor Server resides. Unpack the ZIP archive to a folder of your choice.
-The main component of the add- on is implemented as a service named Netwrix Auditor **ITSM
-Integration Service**. This service will run on the computer where the Auditor Server works, and
-will use the default Integration API port **9699**. Unless specified, the service will run under the
+The main component of the add-on is a service named Netwrix Auditor **ITSM
+Integration Service**. This service runs on the computer where the Auditor Server works, and
+uses the default Integration API port **9699**. Unless specified, the service runs under the
**LocalSystem** account.
To use the add-on, you should check the prerequisites and specify configuration settings, as
diff --git a/docs/auditor/10.9/addon/servicenow/overview.md b/docs/auditor/10.9/addon/servicenow/overview.md
index bc246cc05d..43299d83b1 100644
--- a/docs/auditor/10.9/addon/servicenow/overview.md
+++ b/docs/auditor/10.9/addon/servicenow/overview.md
@@ -18,14 +18,14 @@ what actions should lead to ticket creation.
On a high level, the add-on works as follows:
-1. The add-ons comes with a special set of alerts developed by Netwrix industry experts. With a help
- of a straight- forward command- line tool, you upload these alerts to Netwrix Auditor and enable
- integration with add-on.
-2. Whenever the alert is triggered, the add-on retrieves an Activity Records for this action using
+1. The add-on comes with a special set of alerts developed by Netwrix industry experts. With the
+ help of a straightforward command-line tool, you upload these alerts to Netwrix Auditor and
+ enable integration with the add-on.
+2. Whenever the alert is triggered, the add-on retrieves an Activity Record for this action using
the Netwrix Auditor Integration API. Each Activity Record contains the user account, action,
time, and other details.
3. The add-on creates an incident ticket in ServiceNow, populates it with data that was available in
- the alert, and assigns to a proper team. Now, you can process a ticket as usual.
+ the alert, and assigns it to a proper team. Now, you can process a ticket as usual.
To prevent ticket overflow, the service provides an advanced flood suppression mechanism.
@@ -37,6 +37,6 @@ follows:
| On... | Ensure that... |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| The Auditor Server side | - Auditor version is **9.8** or later. - The Audit Database settings are configured in the Auditor. See the [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md)topic for additional information. - The TCP 9699 port (default Auditor Integration API port) is open for inbound connections. - The user retrieving data from the Audit Database is granted the Global reviewer role in the Auditor or is a member of the Netwrix Auditor Client Users group. Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user will have the most extended permissions in the product. |
-| On the ServiceNow side | - ServiceNow version should be any of the following: - Helsinki - Istanbul - Kingston - London **NOTE:** Currently, Jakarta version has only experimental support. - A new user is created and has sufficient permissions to create tickets and update them. The **itil** role is recommended. If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
+| On the ServiceNow side | - ServiceNow version should be any of the following: - Helsinki - Istanbul - Kingston - London **NOTE:** Jakarta version has only experimental support. - A new user is created and has sufficient permissions to create tickets and update them. The **itil** role is recommended. If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
See the [Integration API](/docs/auditor/10.9/api/overview.md) topic for additional information.
diff --git a/docs/auditor/10.9/addon/servicenow/parameters.md b/docs/auditor/10.9/addon/servicenow/parameters.md
index d574a8a695..7cf6da7511 100644
--- a/docs/auditor/10.9/addon/servicenow/parameters.md
+++ b/docs/auditor/10.9/addon/servicenow/parameters.md
@@ -13,8 +13,8 @@ Perform the following steps to define general parameters for the Add-On:
**Step 1 –** Navigate to your add-on folder and select the **ITSMSettings.xml** file.
**Step 2 –** Define general parameters such as Auditor connection parameters, the number of tickets
-the service can create per hour, ability to reopen closed tickets, etc. For most parameters, default
-values are provided.
+the service can create per hour, ability to reopen closed tickets, etc. For most parameters, the
+service provides default values.
**Step 3 –** Provide new values as follows: `value`. You can skip or define
parameters depending on your execution scenario and security policies.
@@ -22,34 +22,34 @@ parameters depending on your execution scenario and security policies.
| Parameter | Default value | Description |
| ----------------------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Connection to Netwrix Auditor** | | |
-| NetwrixAuditorHost | localhost:9699 | - The add-on runs on the computer where the Auditor Server resides and uses the default Integration API port **9699**. To specify a non-default port, provide a new port number (e.g., _https://localhost:8788_). - The add- on must always run locally, on the computer where the Auditor Server resides. |
-| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs under the **LocalSystem** account. If you want the add-on to use another account to connect to the Auditor Server, specify the account name in the _DOMAIN\username_ format. Alternatively, after deploying the **Netwrix Auditor ITSM Integration Service** service, specify an account in its properties. The account must be assigned the Global reviewer role in the Auditor or be a member of the Netwrix Auditor**Administrators** group. The user must have sufficient permissions to create files on the computer. |
-| NetwrixAuditorPassword | – | Provide a password for the account. Unless an account is specified, the service runs under the **LocalSystem** account and does not require a password. |
+| NetwrixAuditorHost | localhost:9699 | - The add-on runs on the computer where the Auditor Server resides and uses the default Integration API port **9699**. To specify a non-default port, provide a new port number (e.g., _https://localhost:8788_). - The add-on must always run locally, on the computer where the Auditor Server resides. |
+| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs under the **LocalSystem** account. If you want the add-on to use another account to connect to the Auditor Server, specify the account name in the _DOMAIN\username_ format. Alternatively, after deploying the **Netwrix Auditor ITSM Integration Service**, specify an account in its properties. The account must be assigned the Global reviewer role in the Auditor or be a member of the Netwrix Auditor**Administrators** group. The user must have sufficient permissions to create files on the computer. |
+| NetwrixAuditorPassword | – | Provide a password for the account. Unless an account is specified, the service runs under the **LocalSystem** account and doesn't require a password. |
| TicketFloodLimit | 10 | Specify the maximum number of standalone tickets the service can create during **TicketFloodInterval**. If a ticket flood limit is reached, the service writes all new alerts into a single ticket. |
| TicketFloodInterval | 3600 | Specify the time period, in seconds. During this time period, the service can create as many tickets as specified in **TicketFloodLimit**. The default value is 3600 seconds, i.e., 1 hour. |
-| ConsolidationInterval | 900 | Specify the time period, in seconds. During this time period, the service does not process similar alerts as they happen but consolidates them before updating open tickets in your ITSM. The default values is 900 seconds, i.e., 15 minutes. This option works in combination with **UpdateTicketOnRepetitiveAlerts** and is helpful if you want to reduce the number of ticket updates on ITSM side. I.e., this option defines the maximum delay for processing alerts and updating existing tickets. Tickets for new alert types are created immediately. For example, a new alert is triggered—the service opens a new incident ticket. The alert keeps firing 20 times more within 10 minutes. Instead of updating the ticket every time, the service consolidates alerts for 15 minutes, and then updates a ticket just ones with all collected data. |
+| ConsolidationInterval | 900 | Specify the time period, in seconds. During this time period, the service doesn't process similar alerts as they happen but consolidates them before updating open tickets in your ITSM. The default values is 900 seconds, i.e., 15 minutes. This option works in combination with **UpdateTicketOnRepetitiveAlerts** and is helpful if you want to reduce the number of ticket updates on ITSM side. In other words, this option defines the maximum delay for processing alerts and updating existing tickets. The service creates tickets for new alert types immediately. For example, a new alert is triggered—the service opens a new incident ticket. The alert keeps firing 20 times more within 10 minutes. Instead of updating the ticket every time, the service consolidates alerts for 15 minutes, and then updates a ticket just once with all collected data. |
| CheckAlertQueueInterval | 5 | Internal parameter. Check and process the alert queue every N seconds; in seconds. |
-| UpdateTicketOnRepetitiveAlerts | true | Instead of creating a new ticket, reopen an existing ticket that is in a closed state (be default, closed, canceled, and resolved) if a similar alert occurs within **UpdateInterval**. This option works only when **UpdateTicketOnRepetitiveAlerts** is set to "_true_". **NOTE:** If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
-| UpdateInterval | 86400 | Specify the time period, in seconds. If a similar alert occurs in less than N seconds, it is treated as a part of an existing incident. The default value is 86400 seconds, i.e., 24 hours. If an alerts is triggered after the **UpdateInterval** is over, a new ticket is created. |
-| EnableTicketCorrelation | true | Review history and complement new tickets with information about similar tickets created previously. This information is written to the **Description** field. This option is helpful if you want to see if there is any correlation between past incidents (occurred during last month, by default) and a current incident. |
-| CorrelationInterval | 2592000 | Specify the time period, in seconds. During this time period, the service treats similar tickets as related and complements a new ticket with data from a previous ticket. The default value is 2592000 seconds, i.e., 1 month. Information on alerts that are older than 1 month is removed from internal service storage. |
+| UpdateTicketOnRepetitiveAlerts | true | Instead of creating a new ticket, reopen an existing ticket that is in a closed state (by default, closed, canceled, and resolved) if a similar alert occurs within **UpdateInterval**. This option works only when **UpdateTicketOnRepetitiveAlerts** is set to "_true_". **NOTE:** If you want to reopen closed tickets, your account must have the right to perform **Write** operations on inactive incidents. |
+| UpdateInterval | 86400 | Specify the time period, in seconds. If a similar alert occurs in less than N seconds, the service treats it as part of an existing incident. The default value is 86400 seconds, i.e., 24 hours. If an alert is triggered after the **UpdateInterval** passes, the service creates a new ticket. |
+| EnableTicketCorrelation | true | Review history and complement new tickets with information about similar tickets created previously. The service writes this information to the **Description** field. This option is helpful if you want to see if there is any correlation between past incidents (which occurred during the last month, by default) and a current incident. |
+| CorrelationInterval | 2592000 | Specify the time period, in seconds. During this time period, the service treats similar tickets as related and complements a new ticket with data from a previous ticket. The default value is 2592000 seconds, i.e., 1 month. The service removes information on alerts older than 1 month from internal storage. |
| ProcessActivityRecordQueueInterval | 5 | Internal parameter. Process Activity Record queue every N seconds; in seconds. |
-| DisplayOnlyFirstActivityRecord | true | Add only the first Activity Record in the work notes, Activity Records that update this ticket will be added as attachments to this ticket. If false, all Activity Records will be displayed in the ticket work notes. |
+| DisplayOnlyFirstActivityRecord | true | Add only the first Activity Record in the work notes; the service adds Activity Records that update this ticket as attachments to this ticket. If false, the service displays all Activity Records in the ticket work notes. |
| **ActivityRecordRequestsRetention** | | |
-| RequestLimit | 5000 | Internal parameter. The maximum number of Activity Record requests the service can store in its internal memory. Once the limit is reached, the service clears Activity Record requests starting with older ones. |
-| RequestLimitInterval | 604800 | Internal parameter. The service can store the Activity Record requests not older than N seconds; in seconds. Older Activity Record requests are cleared. |
+| RequestLimit | 5000 | Internal parameter. The maximum number of Activity Record requests the service can store in its internal memory. After the limit is reached, the service clears Activity Record requests starting with older ones. |
+| RequestLimitInterval | 604800 | Internal parameter. The service can store Activity Record requests that are no older than N seconds. It clears older Activity Record requests. |
| **ActivityRecordWebRequests** | | |
| RequestLimit | 200 | Internal parameter. The maximum number of Activity Records the service can retrieve in a single request. |
| RequestTimeout | 180 | Internal parameter. By default, 3 minutes. Defines the connection timeout. |
| **TicketRequestsRetention** | | |
-| RequestLimit | 300000 | Internal parameter. The maximum number of ticket requests the service can store in its internal memory. Once the limit is reached, the service clears ticket requests starting with older ones. |
-| RequestLimitInterval | 604800 | Internal parameter. The service can store the ticket requests not older than N seconds; in seconds. Older tickets requests are cleared. |
+| RequestLimit | 300000 | Internal parameter. The maximum number of ticket requests the service can store in its internal memory. After the limit is reached, the service clears ticket requests starting with older ones. |
+| RequestLimitInterval | 604800 | Internal parameter. The service can store ticket requests that are no older than N seconds. It clears older ticket requests. |
-**NOTE:** Stop and then restart the service every time you update any of configuration files.
+**NOTE:** Stop and then restart the service every time you update any of the configuration files.
## ServiceNow Parameters
-Follow the steps to define ServiceNow parameters:
+To define ServiceNow parameters:
**Step 1 –** Navigate to your add-on folder and select **ServiceNowSettings.xml**.
@@ -61,7 +61,7 @@ section.
| `` parameter | Default value | Description |
| ------------------------ | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| URL | — | Provide a link to your ServiceNow system (e.g., _https://enterprise.service-now.com_). |
-| UserName | — | Specify a user account. Make sure the user has sufficient permissions to create tickets and update them. The **itil** role is recommended. **NOTE:** If you want to reopen closed tickets, you must be granted the right to perform **Write** operations on inactive incidents. |
+| UserName | — | Specify a user account. Ensure the user has sufficient permissions to create tickets and update them. Netwrix recommends the **itil** role. **NOTE:** If you want to reopen closed tickets, your account must have the right to perform **Write** operations on inactive incidents. |
| Password | — | Provide a password. |
**Step 4 –** Review the `` section. The parameters inside this section correspond
@@ -69,10 +69,10 @@ to ServiceNow ticket fields and use the same naming (e.g., priority, urgency). T
name in ServiceNow, switch to XML view (on the ticket header, navigate to Show XML).
Each `` includes the` ` and` ` pair that defines a
-ServiceNow ticket field and a value that will be assigned to it. For most parameters, default values
-are provided. Add more ticket parameters or update values if necessary.
+ServiceNow ticket field and the value to assign to it. For most parameters, the add-on provides
+default values. Add more ticket parameters or update values if necessary.
-**NOTE:** The template remains the same for all alerts and cannot be adjusted per individual alerts.
+**NOTE:** The template remains the same for all alerts; you can't adjust it per individual alert.
| Name | Value | Description |
| ------------------ | -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
@@ -81,12 +81,12 @@ are provided. Add more ticket parameters or update values if necessary.
| impact | 1 | Sets **Impact** to "_1 – High_". |
| urgency | 1 | Sets **Urgency** to "_1 – High_". |
| severity | 1 | Sets **Severity** to "_1 – High_". |
-| assignment\_ group | d625dccec0a8016700a22a0 f7900d06 | Sets **Assignment** group to "_Service Desk_". **NOTE:** You cannot use a group name as a value. Provide its guid instead. |
+| assignment\_ group | d625dccec0a8016700a22a0 f7900d06 | Sets **Assignment** group to "_Service Desk_". **NOTE:** You can't use a group name as a value. Provide its guid instead. |
| description | %AlertDescription% %PreviousTicketReference% | Provides an alert description and references to related tickets in **Description**. |
| work_notes | Alert Details: ... | Adds the full alert text to Work notes, including data source, who, what, where, etc. To find out what is included in the alert details, see the **ServiceNowSettings.xml** file. **NOTE:** You can write alert details in the **Additional comments** field instead of Work notes. To do this, rename `work_notes `into `comments`. If you want to write alert details into both fields, create a copy of `` entry containing work_notes and `work_notes` into `comments` section. It shows what information about related
-tickets will be included in your current ticket. Update the template if necessary.
+tickets the add-on includes in your current ticket. Update the template if necessary.
| CorrelationTicketFormat | Description |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
@@ -97,7 +97,7 @@ reopen automatically.
| Name | Description |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| ClosedTicketStates TicketState | Lists ticket statuses. Only tickets with this status can be reopened. By default, resolved, closed, and canceled tickets can be reopened. To specify a new status, provide its ID in the `` tag (e.g., 8 for canceled). |
-| NewState | Defines a ticket status once it is reopened. By default, new. To specify another status, provide its ID in the `` tag (e.g., 1 for new). |
+| ClosedTicketStates TicketState | Lists ticket statuses. The add-on can reopen only tickets with this status. By default, it can reopen resolved, closed, and canceled tickets. To specify a new status, provide its ID in the `` tag (e.g., 8 for canceled). |
+| NewState | Defines a ticket status when it's reopened. By default, new. To specify another status, provide its ID in the `` tag (e.g., 1 for new). |
-**NOTE:** Stop and then restart the service every time you update any of configuration files.
+**NOTE:** Stop and then restart the service every time you update any of the configuration files.
diff --git a/docs/auditor/10.9/addon/siem/activityrecords.md b/docs/auditor/10.9/addon/siem/activityrecords.md
index 0d3f3f07dc..50df54fba0 100644
--- a/docs/auditor/10.9/addon/siem/activityrecords.md
+++ b/docs/auditor/10.9/addon/siem/activityrecords.md
@@ -15,19 +15,19 @@ information.
## Export Activity Records in Bulk
-As said, Netwrix recommends exporting the most important data, using the script described above.
-However, if you need to export all Activity Records in bulk, follow the recommendations below.
+Netwrix recommends exporting the most important data using the script described in the previous section.
+However, if you need to export all Activity Records in bulk, follow these recommendations.
First, provide a path to your add-on followed by script parameters with their values. Each parameter
is preceded with a dash; a space separates a parameter name from its value. You can skip some
parameters—the script uses a default value unless a parameter is explicitly defined. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
+To run the add-on with PowerShell:
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on, or drag and drop the add-on file into the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -44,18 +44,18 @@ insert the ampersand (&) symbol in front (e.g., `& "C:\Netwrix Add-ons\"`).
**Step 4 –** Hit **Enter**.
Depending on the number of Activity Records stored in Auditor Audit Database execution may take a
-while. Ensure the script execution completed successfully. The Netwrix Auditor Integration event log
-will be created and filled with events.
+while. Ensure the script execution completed successfully. The script creates the Netwrix Auditor
+Integration event log and fills it with events.
By default, the Netwrix Auditor Integration event log size is set to _1GB_, and retention is set to
_"Overwrite events as needed"_. See the [Integration Event Log Fields](/docs/auditor/10.9/addon/siem/integrationeventlog.md) topic
for additional information.
-Event records with more than 30,000 characters length will be trimmed.
+The script trims event records with more than 30,000 characters.
At the end of each run, the script creates the
**Netwrix_Auditor_Event_Log_Export_Add-on_EventIDs.txt** file. It defines mapping between the
-Activity Records and related Event IDs .
+Activity Records and related Event IDs.
You can use this file to track possible duplicates of Event IDs created at each script execution.
Duplicates, if any, are written to the
@@ -69,28 +69,25 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
- first run. At the end of the first run, the timestamp will be created, and the next run will start
- export from that timestamp.
-- However, if you have specified a time period for Activity Records to be exported, then this filter
- will be applied at the add-on first run and the runs that follow.
+ first run. At the end of the first run, the add-on creates the timestamp, and the next run starts
+ the export from that timestamp.
+- However, if you specify a time period for exporting Activity Records, the add-on applies this
+ filter on the first run and all runs that follow.
### Automate Add-On Execution
-To ensure you feed the most recent data to your SIEM solution, you can schedule a daily task for
-running the Activity Records to Event Log add-on.
-
To ensure you feed the most recent data to your SIEM solution, Netwrix recommends scheduling a daily
-task for running the add-on.
+task for running the Activity Records to Event Log add-on.
**Perform the following steps to create a scheduled task:**
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task
-Scheduler**.Task Scheduler.
+Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.9/addon/siem/collecteddata.md b/docs/auditor/10.9/addon/siem/collecteddata.md
index 2a5c298623..0183985c19 100644
--- a/docs/auditor/10.9/addon/siem/collecteddata.md
+++ b/docs/auditor/10.9/addon/siem/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Work with Collected Data
-Follow the steps to work with collected data:
+To work with collected data:
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.9/addon/siem/configure.md b/docs/auditor/10.9/addon/siem/configure.md
index 02e72ec6f8..c850cea117 100644
--- a/docs/auditor/10.9/addon/siem/configure.md
+++ b/docs/auditor/10.9/addon/siem/configure.md
@@ -25,18 +25,18 @@ for more information.
You may also need to modify the parameters that define how EventIDs should be generated for exported
events, though their default values address most popular usage scenarios. In-script parameters are
-listed in the table below. To modify them, open the script for edit and enter the values you need.
+listed in the following table. To modify them, open the script for edit and enter the values you need.
Once set, these parameter values must stay unchanged until the last run of the script — otherwise
-dynamically calculated EventIDs will be modified and applied incorrectly.
+the script will incorrectly modify and apply dynamically calculated EventIDs.
| Parameter | Default value | Description |
| ------------------------------ | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **EventID generation** | | |
-| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — do not generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.9/api/postdata/activityrecords.md) topic for additional information. |
+| GenerateEventId | True | Defines whether to generated unique EventIDs. Possible parameter values: - True — generate unique EventIDs using Activity Record fields - False — don't generate a unique ID, set EventID=0 for all cases EventID is generated through CRC32 calculation that involves the following Activity Record field values: - ObjectType - Action - DataSource (optional, see below for details) Only the lowest 16 bits of the calculation result are used. See the [Activity Records](/docs/auditor/10.9/api/postdata/activityrecords.md) topic for additional information. |
| IncludeDataSourceToMakeEventId | True | Defines whether the DataSource field of Activity Record should be used in the EventID calculation. This parameter is applied only if GenerateEventId is set to TRUE. _Object Type - Action_ pair may be identical for several data sources (e.g., Object='User' and Action='Added'); thus, excluding DataSource from calculation may lead to the same EventID (duplicates). See the [Export Activity Records ](/docs/auditor/10.9/addon/siem/activityrecords.md) topic for additional information.. |
-| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the **DataSource** field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — do not generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the **DataSource** field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
-| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the **DataSource** field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script cannot fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular **DataSource** does not exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
+| SetDataSourceAsEventCategory | True | Defines whether to fill in Event Category event field with a numeric value derived from the **DataSource** field of Activity Record. Possible parameter values: - True — generate a numeric value for Event Category using Activity Record field - False — don't generate a numeric value, set Event Category=1 for all cases The Event Category field value is generated through CRC32 calculation that involves the **DataSource** field of Activity Record. Only the lowest 9 bits of the calculation result are used. |
+| SetDataSourceAsEventSource | False | Defines whether to fill in the Event Source event field with the value from the **DataSource** field of Activity Record. Possible parameter values: - True — fill in the Event Source with the value from DataSource field of Activity Record, adding the prefix defined by $EventSourcePrefix. Default prefix is _NA_, for example:_NA Windows Server_ - False — set Event Source to _Netwrix_Auditor_Integration_API_ for all cases If the script can't fill in the Event Source for some DataSource, the default value _Netwrix_Auditor_Integration_API_ will be used. If the event source for particular **DataSource** doesn't exist in the Netwrix_Auditor_Integration event log, elevated privileges are required for add-on execution. |
## Alerts to Event Log Add-on Settings
diff --git a/docs/auditor/10.9/addon/siem/deployment.md b/docs/auditor/10.9/addon/siem/deployment.md
index 978d0c9c99..674cc1cf59 100644
--- a/docs/auditor/10.9/addon/siem/deployment.md
+++ b/docs/auditor/10.9/addon/siem/deployment.md
@@ -28,11 +28,11 @@ and use it for running the script.
## Alerts to Event Log Add-on
-The script will be executed on Auditor Server.
+The script executes on Auditor Server.
By default, Auditor uses the _LocalSystem_ account to run PowerShell scripts. If you want to use
another account, in the alert settings go to **Response Action**, select the **Use custom
-credentials** checkbox and specify user name and password. Make sure this account has **Log on as
+credentials** checkbox and specify user name and password. Ensure this account has **Log on as
batch job** privilege. See the
[Configure a Response Action for Alert](/docs/auditor/10.9/admin/alertsettings/responseaction.md) topic for
additional information.
diff --git a/docs/auditor/10.9/addon/siem/integrationeventlog.md b/docs/auditor/10.9/addon/siem/integrationeventlog.md
index a7eb59a5f6..0643c772b4 100644
--- a/docs/auditor/10.9/addon/siem/integrationeventlog.md
+++ b/docs/auditor/10.9/addon/siem/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+The add-on fills in Details only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.9/addon/siem/overview.md b/docs/auditor/10.9/addon/siem/overview.md
index eea8eca9bf..af2aa95d45 100644
--- a/docs/auditor/10.9/addon/siem/overview.md
+++ b/docs/auditor/10.9/addon/siem/overview.md
@@ -15,11 +15,11 @@ data collected by the SIEM solution.
The add-on enriches your SIEM data with actionable context in human-readable format, including the
before and after values for every change and data access attempt, both failed and successful.
Aggregating data into a single audit trail simplifies analysis, makes your SIEM more cost effective,
-and helps you keep tabs on your IT infrastructure.
+and helps you track your IT infrastructure.
Implemented as a PowerShell script, this add-on facilitates the audit data transition from Netwrix
-Auditor to the SIEM solution. All you have to do is provide connection details and schedule the
-script for execution.
+Auditor to the SIEM solution. To use it, provide connection details and schedule the script for
+execution.
On a high level, the add-on works as follows:
@@ -50,12 +50,12 @@ follows:
| On... | Ensure that... |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The Auditor Server side | - Auditor version is **9.96** or 10. - The alert response action settings in Auditor Server are configured as follows: - **Take action when alert occurs** is switched **ON** - **Run** field contains the path to Windows PowerShell: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` - **With parameters** field contains the required parameters, including the path to **Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1** file. Example: `-File C:\Netwrix_Auditor_Add-on_for_SIEM\Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1 -NetwrixPathToCsvData` For details on script parameters, see the section below. - **Write data to CSV file** option is selected - **Command line preview** looks like this: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File C:\Netwrix_Auditor_Add-on_for_SIEM\Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1 -NetwrixPathToCsvData {CsvFile}` - By default, the executable file will be launched under the _LocalSystem_ account. If you want to use another account, make sure it has **Log on as batch job** privilege on Netwrix Auditor server. You may want to perform the test run after configuring the script as the alert response action. If so, consider that current user account (logged on to Auditor client) must have local **Administrator** privileges on AuditorServer where the executable file is located. |
+| The Auditor Server side | - Auditor version is **9.96** or 10. - The alert response action settings in Auditor Server are configured as follows: - **Take action when alert occurs** is switched **ON** - **Run** field contains the path to Windows PowerShell: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe` - **With parameters** field contains the required parameters, including the path to **Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1** file. Example: `-File C:\Netwrix_Auditor_Add-on_for_SIEM\Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1 -NetwrixPathToCsvData` For details on script parameters, see the section below. - **Write data to CSV file** option is selected - **Command line preview** looks like this: `C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File C:\Netwrix_Auditor_Add-on_for_SIEM\Netwrix_Auditor_Alerts_to_Event_Log_Add-on.ps1 -NetwrixPathToCsvData {CsvFile}` - By default, the executable file will be launched under the _LocalSystem_ account. If you want to use another account, ensure it has **Log on as batch job** privilege on Netwrix Auditor server. You may want to perform the test run after configuring the script as the alert response action. If so, consider that current user account (logged on to Auditor client) must have local **Administrator** privileges on AuditorServer where the executable file is located. |
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts that use
+the Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
## Activity Records to Event Log Add-on
@@ -77,7 +77,7 @@ This add-on works as response action to the alert, as follows:
1. The administrator enables and configured response action for selected alert, as described in the
following topic:
- [Configure a Response Action for Alert](/docs/auditor/10.9/admin/alertsettings/responseaction.md). Make sure
+ [Configure a Response Action for Alert](/docs/auditor/10.9/admin/alertsettings/responseaction.md). Ensure
to provide correct path to the script file and to select the Write data to CSV file option.
2. When the alert is triggered, the script starts - it retrieves audit data (activity record fields)
from the CSV file and processes it into log events. Each event contains the user account, action,
diff --git a/docs/auditor/10.9/addon/siemcefexport/automate.md b/docs/auditor/10.9/addon/siemcefexport/automate.md
index a498e2ad5e..082a61b140 100644
--- a/docs/auditor/10.9/addon/siemcefexport/automate.md
+++ b/docs/auditor/10.9/addon/siemcefexport/automate.md
@@ -13,7 +13,7 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
diff --git a/docs/auditor/10.9/addon/siemcefexport/collecteddata.md b/docs/auditor/10.9/addon/siemcefexport/collecteddata.md
index eb9595672d..1556bcb8c1 100644
--- a/docs/auditor/10.9/addon/siemcefexport/collecteddata.md
+++ b/docs/auditor/10.9/addon/siemcefexport/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
+**To work with collected data:**
**Step 1 –** Navigate to the destination folder and open a CEF log file.
diff --git a/docs/auditor/10.9/addon/siemcefexport/deployment.md b/docs/auditor/10.9/addon/siemcefexport/deployment.md
index 4e3892fd14..67ac4f7ee8 100644
--- a/docs/auditor/10.9/addon/siemcefexport/deployment.md
+++ b/docs/auditor/10.9/addon/siemcefexport/deployment.md
@@ -15,8 +15,8 @@ Netwrix suggests the following execution scenarios:
| Scenario | Example |
| ---------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The add-on runs on the Auditor Server with the current user credentials. Activity Records are exported to a local folder. | C:\Add-ons\Netwrix_Auditor_CEF_Export_Addon.ps1 -OutputFolder C:\CEF_Export -OutputFolder C:\CEF_Export |
-| The add-on runs on the Auditor Server with explicitly defined credentials. Activity Records are exported to a local folder. | C:\Add-ons\Netwrix_Auditor_CEF_Export_Addon.ps1 -OutputFolder C:\CEF_Export -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool |
+| The add-on runs on the Auditor Server with the current user credentials and exports Activity Records to a local folder. | C:\Add-ons\Netwrix_Auditor_CEF_Export_Addon.ps1 -OutputFolder C:\CEF_Export -OutputFolder C:\CEF_Export |
+| The add-on runs on the Auditor Server with explicitly defined credentials and exports Activity Records to a local folder. | C:\Add-ons\Netwrix_Auditor_CEF_Export_Addon.ps1 -OutputFolder C:\CEF_Export -NetwrixAuditorUserName enterprise\NAuser -NetwrixAuditorPassword NetwrixIsCool |
| The add-on exports Activity Records from a remote Auditor Server using current user credentials and writes data to a local folder. | C:\Add-ons\Netwrix_Auditor_CEF_Export_Addon.ps1 -OutputFolder C:\CEF_Export -NetwrixAuditorHost 172.28.6.15 |
| The add-on exports Activity Records from a remote Auditor Server using explicitly defined credentials and writes data to a local folder. | C:\Add-ons\Netwrix_Auditor_CEF_Export_Addon. ps1 -OutputFolder C:\CEF_Export - NetwrixAuditorHost 172.28.6.15 - NetwrixAuditorUserName enterprise\NAuser - NetwrixAuditorPassword NetwrixIsCool |
diff --git a/docs/auditor/10.9/addon/siemcefexport/overview.md b/docs/auditor/10.9/addon/siemcefexport/overview.md
index 237fbc7a1d..cabc03b9d9 100644
--- a/docs/auditor/10.9/addon/siemcefexport/overview.md
+++ b/docs/auditor/10.9/addon/siemcefexport/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 220
# SIEM Generic Integration for CEF Export
-Netwrix Auditor Add-on for SIEM helps you to get most from your SIEM investment. This topic focuses
+Netwrix Auditor Add-on for SIEM helps you get more value from your SIEM investment. This topic focuses
on the CEF Export SIEM solution.
The add-on works in collaboration with Netwrix Auditor, supplying additional data that augments the
@@ -15,10 +15,10 @@ data collected by the SIEM solution.
The add-on enriches your SIEM data with actionable context in human-readable format, including the
before and after values for every change and data access attempt, both failed and successful.
Aggregating data into a single audit trail simplifies analysis, makes your SIEM more cost effective,
-and helps you keep tabs on your IT infrastructure.
+and helps you monitor your IT infrastructure.
Implemented as a PowerShell script, this add-on facilitates the audit data transition from Netwrix
-Auditor to the SIEM solution. All you have to do is provide connection details and schedule the
+Auditor to the SIEM solution. To set it up, provide connection details and schedule the
script for execution.
On a high level, the add-on works as follows:
@@ -46,5 +46,5 @@ follows:
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure to check your product version, and then review and update your add-ons and scripts
+that use the Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
diff --git a/docs/auditor/10.9/addon/siemcefexport/parameters.md b/docs/auditor/10.9/addon/siemcefexport/parameters.md
index cea8c1bd5b..9943ef72ac 100644
--- a/docs/auditor/10.9/addon/siemcefexport/parameters.md
+++ b/docs/auditor/10.9/addon/siemcefexport/parameters.md
@@ -7,15 +7,15 @@ sidebar_position: 10
# Define Parameters
Before running or scheduling the add-on, you must define connection details: Auditor Server host,
-user credentials, etc. Most parameters are optional, the script uses the default values unless
-parameters are explicitly defined. You can skip or define parameters depending on your execution
+user credentials, etc. Most parameters are optional; the script uses the default values unless you
+explicitly define them. You can skip or define parameters depending on your execution
scenario and security policies. See the
[Choose Appropriate Execution Scenario](deployment.md#choose-appropriate-execution-scenario) topic
for additional information.
First, provide a path to your add-on followed by script parameters with their values. Each parameter
is preceded with a dash; a space separates a parameter name from its value. You can skip some
-parameters—the script uses a default value unless a parameter is explicitly defined. If necessary,
+parameters—the script uses a default value unless you explicitly define it. If necessary,
modify the parameters as required.
| Parameter | Default value | Description |
diff --git a/docs/auditor/10.9/addon/siemcefexport/powershell.md b/docs/auditor/10.9/addon/siemcefexport/powershell.md
index 26a4c47f31..39b5ca8e1b 100644
--- a/docs/auditor/10.9/addon/siemcefexport/powershell.md
+++ b/docs/auditor/10.9/addon/siemcefexport/powershell.md
@@ -8,14 +8,14 @@ sidebar_position: 30
First, provide a path to your add-on followed by script parameters with their values. Each parameter
is preceded with a dash; a space separates a parameter name from its value. You can skip some
-parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
+parameters— the script uses a default value unless you explicitly define it. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
+**To run the add-on with PowerShell:**
**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on, or drag and drop the add-on file into the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -27,14 +27,18 @@ Copyright (C) 2014 Microsoft Corporation. All rights reserved.
PS C:\Users\AddOnUser> C:\Add-ons\Netwrix_Auditor_CEF_Export_Add-on.ps1 -OutputFolder C:\CEF_Export
-NetwrixAuditorHost 172.28.6.15
-**NOTE:** If the script path contains spaces (e.g., _C:\Netwrix Add-ons_), embrace it in double
+**NOTE:** If the script path contains spaces (e.g., _C:\Netwrix Add-ons_), enclose it in double
quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Add-ons_").
-**Step 4 –** Hit **Enter**.
+**Step 4 –** Press **Enter**.
-Depending on the number of Activity Records stored in Auditor Audit Database execution may take a
-while. Ensure the script execution completed successfully. The CEF log file will be created in the
-destination folder. Note that details (or 'msg' in CEF terms) exceeding 16000 symbols are trimmed.
+Depending on the number of Activity Records stored in Auditor Audit Database, execution may take a
+while. Ensure the script execution completed successfully. The add-on creates the CEF log file in the
+destination folder.
+
+:::note
+Details (or "msg" in CEF terms) exceeding 16,000 characters are trimmed.
+:::
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records.
diff --git a/docs/auditor/10.9/addon/siemeventlogexport/automate.md b/docs/auditor/10.9/addon/siemeventlogexport/automate.md
index f436e20c0b..cd5a1c281f 100644
--- a/docs/auditor/10.9/addon/siemeventlogexport/automate.md
+++ b/docs/auditor/10.9/addon/siemeventlogexport/automate.md
@@ -13,12 +13,12 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
-how often audit data is exported from Auditor and saved to event log. Netwrix recommends scheduling a
-daily task.
+how often the add-on exports audit data from Auditor and saves it to the event log. Netwrix
+recommends scheduling a daily task.
**Step 4 –** On the **Actions** tab, click **New** and specify action details. Review the following
for additional information:
diff --git a/docs/auditor/10.9/addon/siemeventlogexport/collecteddata.md b/docs/auditor/10.9/addon/siemeventlogexport/collecteddata.md
index f54d6b1dc3..aaa1f40e17 100644
--- a/docs/auditor/10.9/addon/siemeventlogexport/collecteddata.md
+++ b/docs/auditor/10.9/addon/siemeventlogexport/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
+To work with collected data:
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
diff --git a/docs/auditor/10.9/addon/siemeventlogexport/overview.md b/docs/auditor/10.9/addon/siemeventlogexport/overview.md
index b1a90ae98a..802b669e6f 100644
--- a/docs/auditor/10.9/addon/siemeventlogexport/overview.md
+++ b/docs/auditor/10.9/addon/siemeventlogexport/overview.md
@@ -13,10 +13,10 @@ data collected by SIEM.
The add-on enriches your SIEM data with actionable context in human-readable format, including the
before and after values for every change and data access attempt, both failed and successful.
Aggregating data into a single audit trail simplifies analysis, makes your SIEM more cost effective,
-and helps you keep tabs on your IT infrastructure.
+and helps you monitor your IT infrastructure.
Implemented as a PowerShell script, this add-on facilitates the audit data transition from Netwrix
-Auditor to SIEM. All you have to do is provide connection details and schedule the script for
+Auditor to SIEM. Provide connection details and schedule the script for
execution.
On a high level, the add-on works as follows:
@@ -37,11 +37,11 @@ follows:
| On... | Ensure that... |
| ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| The Auditor server side | - Auditor version is **10.0** or later. - The Audit Database settings are configured in Auditor Server. See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) and [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topics for additional information. - The TCP 9699 port (default Auditor Integration API port) is open for inbound connections. - The user retrieving data from the Audit Database is granted the Global reviewer role in Auditor or is a member of the Netwrix Auditor Client Users group. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) topic for additional information. Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user will have the most extended permissions in the product. |
-| The computer where the script will be executed | - PowerShell **3.0** or later must be installed. - .NET **4.5** or later must be installed. - Execution policy for powershell scripts is set to _"Unrestricted"_. Run Windows PowerShell as administrator and execute the following command: Set-ExecutionPolicy Unrestricted - The user running the script is granted the write permission on the script folder—the add-on creates a special .bin file with the last exported event. - The user running the script must be a member of the Domain Users group. - At least the first script run should be performed under the account with elevated privileges, as it will be necessary to create event log file and perform other required operations. |
+| The Auditor server side | - Auditor version is **10.0** or later. - The Audit Database settings are configured in Auditor Server. See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) and [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topics for additional information. - The TCP 9699 port (default Auditor Integration API port) is open for inbound connections. - The user retrieving data from the Audit Database is granted the Global reviewer role in Auditor or is a member of the Netwrix Auditor Client Users group. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) topic for additional information. Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user has the most extended permissions in the product. |
+| The computer where the script will be executed | - PowerShell **3.0** or later must be installed. - .NET **4.5** or later must be installed. - Execution policy for powershell scripts is set to _"Unrestricted"_. Run Windows PowerShell as administrator and execute the following command: Set-ExecutionPolicy Unrestricted - The user running the script is granted the write permission on the script folder—the add-on creates a special .bin file with the last exported event. - The user running the script must be a member of the Domain Users group. - The first script run happens under an account with elevated privileges, since creating the event log file and completing other required operations requires those privileges. |
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging the Integration API. Download the latest add- on version in the Add- on Store. See the
+Ensure to check your product version, and then review and update your add-ons and scripts
+that use the Integration API. Download the latest add-on version in the Add-on Store. See the
[Integration API](/docs/auditor/10.9/api/overview.md) topic for additional information about schema updates.
diff --git a/docs/auditor/10.9/addon/siemeventlogexport/parameters.md b/docs/auditor/10.9/addon/siemeventlogexport/parameters.md
index 02379805f1..7e245009d8 100644
--- a/docs/auditor/10.9/addon/siemeventlogexport/parameters.md
+++ b/docs/auditor/10.9/addon/siemeventlogexport/parameters.md
@@ -7,17 +7,17 @@ sidebar_position: 10
# Define Parameters
Before running or scheduling the add-on, you must define connection details: Auditor Server host,
-user credentials, etc. Most parameters are optional, the script uses the default values unless
-parameters are explicitly defined. You can skip or define parameters depending on your execution
+user credentials, etc. Most parameters are optional; the script uses the default values unless you
+explicitly define them. You can skip or define parameters depending on your execution
scenario and security policies. See [Choose Appropriate Execution Scenario](/docs/auditor/10.9/addon/siemeventlogexport/deployment.md) for
additional information.
First provide a path to your add-on followed by script parameters with their values. Each parameter
is preceded with a dash; a space separates a parameter name from its value. You can skip some
-parameters— the script uses a default value unless a parameter is explicitly defined.
+parameters— the script uses a default value unless you explicitly define one.
| Parameter | Default value | Description |
| ---------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add- on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., WKS.enterprise.local:9999). |
-| NetwrixAuditorUserName | Current user credentials | Unless specified, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the DOMAIN\username format. **NOTE:** The account must be assigned the **Global reviewer** role in Auditor or be a member of the **Netwrix Auditor Client Users** group on the computer hosting Auditor Server. |
-| NetwrixAuditorPassword | Current user credentials | Unless specified, the script runs with the current user credentials. Provide a different password if necessary. |
+| NetwrixAuditorHost | localhost:9699 | Assumes that the add-on runs on the computer hosting Auditor Server and uses default port 9699. If you want to run the add-on on another machine, provide a name of the computer where Auditor Server resides (e.g., 172.28.6.15, EnterpriseNAServer, WKS.enterprise.local). To specify a non-default port, provide a server name followed by the port number (e.g., WKS.enterprise.local:9999). |
+| NetwrixAuditorUserName | Current user credentials | By default, the add-on runs with the current user credentials. If you want the add-on to use another account to connect to Auditor Server, specify the account name in the DOMAIN\username format. **NOTE:** The account must be assigned the **Global reviewer** role in Auditor or be a member of the **Netwrix Auditor Client Users** group on the computer hosting Auditor Server. |
+| NetwrixAuditorPassword | Current user credentials | By default, the script runs with the current user credentials. Provide a different password if necessary. |
diff --git a/docs/auditor/10.9/addon/siemeventlogexport/powershell.md b/docs/auditor/10.9/addon/siemeventlogexport/powershell.md
index 4bb7b4194a..6f0d56ecf5 100644
--- a/docs/auditor/10.9/addon/siemeventlogexport/powershell.md
+++ b/docs/auditor/10.9/addon/siemeventlogexport/powershell.md
@@ -8,17 +8,17 @@ sidebar_position: 30
First, provide a path to your add-on followed by script parameters with their values. Each parameter
is preceded with a dash; a space separates a parameter name from its value. You can skip some
-parameters— the script uses a default value unless a parameter is explicitly defined. If necessary,
+parameters— the script uses a default value unless you explicitly define one. If necessary,
modify the parameters as required.
-Follow the steps to run add-on with PowerShell:
+To run the add-on with PowerShell:
-**Step 1 –** On computer where you want to execute the add-on, start Windows PowerShell.
+**Step 1 –** On the computer where you want to execute the add-on, start Windows PowerShell.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on, or drag and drop the add-on file into the console
window.
-**Step 3 –** Add script parameters. The console will look similar to the following:
+**Step 3 –** Add script parameters. The console looks similar to the following:
Windows PowerShell
@@ -33,8 +33,8 @@ quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Ad
**Step 4 –** Hit **Enter**.
Depending on the number of Activity Records stored in Netwrix Auditor Audit Database execution may
-take a while. Ensure the script execution completed successfully. The Netwrix Auditor
-**Integration** event log will be created and filled with events.
+take a while. Ensure the script execution completed successfully. Netwrix Auditor creates the
+**Integration** event log and fills it with events.
-By default, the Netwrix Auditor **Integration** event log size is set to **1GB**, and retention is
-set to "_Overwrite events as needed_".
+By default, the add-on sets the Netwrix Auditor **Integration** event log size to **1GB** and the
+retention to "_Overwrite events as needed_".
diff --git a/docs/auditor/10.9/addon/solarwinds/automate.md b/docs/auditor/10.9/addon/solarwinds/automate.md
index 082a39da0e..45604c4dd2 100644
--- a/docs/auditor/10.9/addon/solarwinds/automate.md
+++ b/docs/auditor/10.9/addon/solarwinds/automate.md
@@ -13,12 +13,12 @@ task for running the add-on.
**Step 1 –** On the computer where you want to execute the add-on, navigate to **Task Scheduler**.
-**Step 2 –** On the **General** tab, specify a task name. Make sure the account that runs the task
+**Step 2 –** On the **General** tab, specify a task name. Ensure the account that runs the task
has all necessary rights and permissions.
**Step 3 –** On the **Triggers** tab, click **New** and define the schedule. This option controls
-how often audit data is exported from Auditor and saved to event log. Netwrix recommends scheduling a
-daily task.
+how often the task exports audit data from Auditor and saves it to the event log. Netwrix recommends
+scheduling a daily task.
**Step 4 –** On the **Actions** tab, click **New** and specify action details. Review the following
for additional information:
diff --git a/docs/auditor/10.9/addon/solarwinds/collecteddata.md b/docs/auditor/10.9/addon/solarwinds/collecteddata.md
index 6f1f0a7795..c0a75918b0 100644
--- a/docs/auditor/10.9/addon/solarwinds/collecteddata.md
+++ b/docs/auditor/10.9/addon/solarwinds/collecteddata.md
@@ -6,7 +6,7 @@ sidebar_position: 50
# Work with Collected Data
-Follow the steps to work with collected data:
+To work with collected data:
**Step 1 –** On the computer where you executed the add-on, navigate to **Start** > **All
Programs** > **Event Viewer**.
@@ -18,4 +18,4 @@ Services Logs** >Netwrix Auditor Integration log.
-Now you can augment Windows event log with data collected by the Auditor.
+Now you can augment the Windows event log with data collected by Auditor.
diff --git a/docs/auditor/10.9/addon/solarwinds/integrationeventlog.md b/docs/auditor/10.9/addon/solarwinds/integrationeventlog.md
index ca8f7696f8..939ad1a52b 100644
--- a/docs/auditor/10.9/addon/solarwinds/integrationeventlog.md
+++ b/docs/auditor/10.9/addon/solarwinds/integrationeventlog.md
@@ -35,6 +35,6 @@ EventData is filled in with data from the Activity Record fields as follows:
| Workstation | `{Workstation}` |
| Details | `{Details}` |
-Details are filled in only if this Activity Record field is not empty.
+The add-on fills in Details only if this Activity Record field isn't empty.
diff --git a/docs/auditor/10.9/addon/solarwinds/overview.md b/docs/auditor/10.9/addon/solarwinds/overview.md
index 7e694dafde..3d13344190 100644
--- a/docs/auditor/10.9/addon/solarwinds/overview.md
+++ b/docs/auditor/10.9/addon/solarwinds/overview.md
@@ -6,8 +6,8 @@ sidebar_position: 240
# Solarwinds Log and Event Manager
-Netwrix Auditor Add-on for SIEM helps you to get most from your SIEM investment. This topic focuses
-on the Solarwinds Log & Event Manager SIEM solution.
+Netwrix Auditor Add-on for SIEM helps you get the most from your SIEM investment. This topic focuses
+on the Solarwinds Log & Event Manager SIEM solution.
The add-on works in collaboration with Netwrix Auditor, supplying additional data that augments the
data collected by the SIEM solution.
@@ -42,9 +42,10 @@ follows:
| On... | Ensure that... |
| ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| The Auditor server side | - Auditor version is **10.0** or later. - The Audit Database settings are configured in Auditor Server. See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) and [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topics for additional information. - The TCP 9699 port (default Auditor Integration API port) is open for inbound connections. - The user retrieving data from the Audit Database is granted the Global reviewer role in Auditor or is a member of the Netwrix Auditor Client Users group. See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) topic for additional information. Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user will have the most extended permissions in the product. |
-| The computer where the script will be executed | - PowerShell **3.0** or later must be installed. - .NET **4.5** or later must be installed. - Execution policy for powershell scripts is set to _"Unrestricted"_. Run Windows PowerShell as administrator and execute the following command: Set-ExecutionPolicy Unrestricted - The user running the script is granted the write permission on the script folder—the add-on creates a special .bin file with the last exported event. - The user running the script must be a member of the Domain Users group. - At least the first script run should be performed under the account with elevated privileges, as it will be necessary to create event log file and perform other required operations. |
+| The computer that runs the script | - PowerShell **3.0** or later must be installed. - .NET **4.5** or later must be installed. - Execution policy for powershell scripts is set to _"Unrestricted"_. Run Windows PowerShell as administrator and execute the following command: Set-ExecutionPolicy Unrestricted - The user running the script is granted the write permission on the script folder—the add-on creates a special .bin file with the last exported event. - The user running the script must be a member of the Domain Users group. - Run at least the first script execution under an account with elevated privileges; creating the event log file and performing other required operations needs these privileges. |
## Compatibility Notice
-Make sure to check your product version, and then review and update your add-ons and scripts
-leveraging Netwrix Auditor Integration API. Download the latest add-on version in the Add-on Store.
+Ensure that you check your product version, and then review and update your add-ons and scripts
+that use the Netwrix Auditor Integration API. Download the latest add-on version from the Add-on
+Store.
diff --git a/docs/auditor/10.9/addon/solarwinds/parameters.md b/docs/auditor/10.9/addon/solarwinds/parameters.md
index ba9e5fef4f..f7762e6f12 100644
--- a/docs/auditor/10.9/addon/solarwinds/parameters.md
+++ b/docs/auditor/10.9/addon/solarwinds/parameters.md
@@ -7,8 +7,8 @@ sidebar_position: 10
# Define Parameters
Before running or scheduling the add-on, you must define connection details: Auditor Server host,
-user credentials, etc. Most parameters are optional, the script uses the default values unless
-parameters are explicitly defined. You can skip or define parameters depending on your execution
+user credentials, etc. Most parameters are optional; the script uses default values unless you
+explicitly define parameters. You can skip or define parameters depending on your execution
scenario and security policies. See the [Choose Appropriate Execution Scenario](/docs/auditor/10.9/addon/solarwinds/deployment.md) topic
for additional information.
diff --git a/docs/auditor/10.9/addon/solarwinds/powershell.md b/docs/auditor/10.9/addon/solarwinds/powershell.md
index efa73dad95..8e588f04cb 100644
--- a/docs/auditor/10.9/addon/solarwinds/powershell.md
+++ b/docs/auditor/10.9/addon/solarwinds/powershell.md
@@ -15,7 +15,7 @@ modify the parameters as required.
**Step 1 –** On computer where you want to execute the add-on, start **Windows PowerShell**.
-**Step 2 –** Type a path to the add-on. Or simply drag and drop the add-on file in the console
+**Step 2 –** Enter a path to the add-on. Or drag and drop the add-on file into the console
window.
**Step 3 –** Add script parameters. The console will look similar to the following:
@@ -32,20 +32,20 @@ quotes and insert the ampersand (**&**) symbol in front (e.g., & "_C:\Netwrix Ad
**Step 4 –** Hit **Enter**.
-Depending on the number of Activity Records stored in Netwrix Auditor Audit Database execution may
-take a while. Ensure the script execution completed successfully. The Netwrix Auditor
-**Integration** event log will be created and filled with events.
+Depending on the number of Activity Records stored in the Netwrix Auditor Audit Database, execution
+may take a while. Ensure the script execution completed successfully. The script creates the
+Netwrix Auditor **Integration** event log and fills it with events.
By default, the Netwrix Auditor **Integration** event log size is set to 1GB, and retention is set
to "_Overwrite events as needed_". See the [Integration Event Log Fields](/docs/auditor/10.9/addon/solarwinds/integrationeventlog.md)
topic for additional information.
-**NOTE:** Event records with more than 30,000 characters length will be trimmed.
+**NOTE:** The script trims event records with more than 30,000 characters.
At the end of each run, the script creates the
**Netwrix_Auditor_Event_Log_Export_Add-on_EventIDs.txt** file. It defines mapping between the
-Activity Records and related Event IDs . You can use this file to track possible duplicates of Event
-IDs created at each script execution. Duplicates, if any, are written to the
+Activity Records and related Event IDs. You can use this file to track possible duplicates of Event
+IDs created at each script execution. The script writes duplicates, if any, to the
**Netwrix_Auditor_Event_Log_Export_Add-on_EventIDsDuplicates.txt** file.
Similarly, the add-on also creates the **Netwrix_Auditor_Event_Log_Export_Add-on_CategoriesIDs.txt**
@@ -56,11 +56,11 @@ file that defines mapping between the Data Source and related Category ID.
Every time you run the script, Auditor makes a timestamp. The next time you run the script, it will
start retrieving new Activity Records. Consider the following:
-- By default, the add-on does not apply any filters when exporting Activity Records. If you are
+- By default, the add-on doesn't apply any filters when exporting Activity Records. If you are
running the add-on for the first time (there is no timestamp yet) with no filters, it will export
Activity Records for the last month only. This helps to optimize solution performance during the
- first run. At the end of the first run, the timestamp will be created, and the next run will start
- export from that timestamp.
+ first run. At the end of the first run, the add-on creates the timestamp, and the next run starts
+ exporting from that timestamp.
-- However, if you have specified a time period for Activity Records to be exported, then this filter
- will be applied at the add-on first run and the runs that follow.
+- However, if you have specified a time period for exporting Activity Records, the add-on applies
+ this filter on its first run and all subsequent runs.
diff --git a/docs/auditor/10.9/addon/splunk/collecteddata.md b/docs/auditor/10.9/addon/splunk/collecteddata.md
index 9c66e08749..4f17429046 100644
--- a/docs/auditor/10.9/addon/splunk/collecteddata.md
+++ b/docs/auditor/10.9/addon/splunk/collecteddata.md
@@ -6,11 +6,11 @@ sidebar_position: 20
# Work with Collected Data
-Review the examples below for the possible scenarios on how to work with collected data.
+Review the following examples for scenarios on how to work with collected data.
## Search by Index
-Follow the steps to search by index:
+To search by index:
**Step 1 –** Navigate to the **Search** page of the add-on or **Search & Reporting** Splunk app
@@ -26,14 +26,14 @@ for example:
index=netwrix_index
```
-**Step 3 –** Press the **Last 24 hours** button and choose **All time** time range.
+**Step 3 –** Press the **Last 24 hours** button and choose the **All time** range.
-**Step 4 –** Press the search button; you should see list of the events currently indexed in Splunk.
+**Step 4 –** Press the search button; you should see list of the events indexed in Splunk.
-**Step 5 –** Click on the arrow button next to any of the returned event to expand the list of
+**Step 5 –** Click the arrow button next to any of the returned event to expand the list of
parsed fields and confirm that fields are populated properly.
-> If you do not see any fields, make sure that you are running the search in Smart or Verbose mode.
+> If you don't see any fields, ensure that you are running the search in Smart or Verbose mode.
## Use Index Search and Netwrix Auditor Fields
@@ -48,13 +48,13 @@ index=netwrix_index Action=Added ObjectType=user
| table Who Action ObjectType What Where
```
-**Step 3 –** Press the **Last 24 hours** button and choose **All time** time range.
+**Step 3 –** Press the **Last 24 hours** button and choose the **All time** range.
**Step 4 –** Press the search button.
## Search by CIM Data Model
-Follow the steps to search by data model:
+To search by data model:
**Step 1 –** Navigate to the **Search** page of the add-on or **Search & Reporting** Splunk app
@@ -72,12 +72,12 @@ for example:
| search sourcetype=netwrix
```
-**Step 3 –** Press the **Last 24 hours** button and choose **All time** time range.
+**Step 3 –** Press the **Last 24 hours** button and choose the **All time** range.
-**Step 4 –** Press the search button; you should see list of the events currently indexed in Splunk
+**Step 4 –** Press the search button; you should see list of the events indexed in Splunk
and mapped to the selected data model.
-**Step 5 –** Click on the arrow button next to any of the returned event to expand the list of
+**Step 5 –** Click the arrow button next to any of the returned event to expand the list of
parsed fields and confirm that fields are populated properly.
## Use CIM Data Model Search and Data Model Fields
@@ -94,6 +94,6 @@ The following example shows how to get all events for account deletion.
| table All_Changes.vendor_product All_Changes.action All_Changes.src All_Changes.dest All_Changes.user All_Changes.object All_Changes.object_attrs
```
-**Step 3 –** Press the **Last 24 hours** button and choose **All time** time range.
+**Step 3 –** Press the **Last 24 hours** button and choose the **All time** range.
**Step 4 –** Press the search button.
diff --git a/docs/auditor/10.9/addon/splunk/datamodelmap.md b/docs/auditor/10.9/addon/splunk/datamodelmap.md
index c5119f02c6..2fb6b0d0fc 100644
--- a/docs/auditor/10.9/addon/splunk/datamodelmap.md
+++ b/docs/auditor/10.9/addon/splunk/datamodelmap.md
@@ -9,7 +9,7 @@ sidebar_position: 30
The Splunk Common Information Model (CIM) is installed with an add-on and adds a set of data models
that allow data normalization to simplify search.
-The CIM contains a number of standard data models that can be used for search. Each of them has
+The CIM contains a number of standard data models you can use for search. Each of them has
predefined set of standard fields common for different data sources.
Netwrix Auditor add-on for Splunk will map some of the Activity Records that match certain scenario
diff --git a/docs/auditor/10.9/addon/splunk/deployment.md b/docs/auditor/10.9/addon/splunk/deployment.md
index 7256d627da..60e936afdd 100644
--- a/docs/auditor/10.9/addon/splunk/deployment.md
+++ b/docs/auditor/10.9/addon/splunk/deployment.md
@@ -8,15 +8,13 @@ sidebar_position: 10
## Download and install the add-on
-Follow the steps below.
-
**Step 1 –** Download the distribution package.
**Step 2 –** Unpack it to a folder on the computer from which you can access Splunk Web.
-**Step 3 –** Login to Splunk Web using Splunk Administrator account.
+**Step 3 –** log in to Splunk Web using Splunk Administrator account.
-**Step 4 –** Expand the drop-down list at the top panel and choose **Manage Apps**.
+**Step 4 –** Expand the dropdown list at the top panel and choose **Manage Apps**.
**Step 5 –** On the **Apps** screen, click **Install app from file**.
@@ -29,9 +27,9 @@ The installed add-on should appear in the Apps list. Splunk might not display ad
## Configure the add-on
-Follow the steps to configure the add-on.
+To configure the add-on:
-**Step 1 –** Open **Netwrix Auditor Add-on for Splunk** from the drop-down list at the top panel and navigate to the **Configuration** page.
+**Step 1 –** Open **Netwrix Auditor Add-on for Splunk** from the dropdown list at the top panel and navigate to the **Configuration** page.
**Step 2 –** Configure the account:
@@ -42,7 +40,7 @@ Follow the steps to configure the add-on.
- For the Account name provide a unique name for the account that will be visible to the add-on
users
- In the Username field insert the user name of the account that will be used to access Netwrix
- Auditor Integration API. If a domain account is used, make sure to use the _DOMAIN\User_
+ Auditor Integration API. If a domain account is used, ensure to use the _DOMAIN\User_
format.
- In the Password field insert the account password
@@ -63,13 +61,13 @@ Follow the steps to configure the add-on.
## Configure Data Input
Splunk uses indexes to store data and manage access to it. While you can send Netwrix Auditor data
-to one of the existing indexes it is strongly recommended to create a separate index.
+to one of the existing indexes, Netwrix strongly recommends creating a separate index.
-Follow the steps to configure data input.
+To configure data input:
**Step 1 –** Create a new index to store data from Netwrix Auditor:
-1. In Splunk expand the **Settings** drop-down menu and click on the **Indexes** option under the **DATA**
+1. In Splunk expand the **Settings** dropdown menu and click the **Indexes** option under the **DATA**
section.
2. Press the **New Index** button to create an index.
3. Provide the new index parameters:
@@ -95,7 +93,7 @@ Follow the steps to configure data input.
**CAUTION:** This field should never be empty.
- - Checkpoint type specifies location for continuation mark data. Do not change this setting unless advised by your Splunk Administrator.
+ - Checkpoint type specifies location for continuation mark data. Don't change this setting unless advised by your Splunk Administrator.
4. Click the **Add** button.
@@ -121,16 +119,16 @@ The index name must exactly match the index created in Splunk Cloud.
### CIM data model support
-To use CIM data models in Splunk Cloud, install the Netwrix Auditor Add-on for Splunk in Splunk Cloud. No input or account configuration is required. The add-on is installed only to provide CIM field extractions and data model mappings.
+To use CIM data models in Splunk Cloud, install the Netwrix Auditor Add-on for Splunk in Splunk Cloud. The add-on doesn't require input or account configuration; you install it only to provide CIM field extractions and data model mappings.
> For additional information on configuring Splunk Cloud and forwarders, refer to the official Splunk documentation.
## Migrating from the legacy Event Log add-on
If you were using the older (Windows event log-based) version of Netwrix Auditor add-on for Splunk
-and plan to migrate to the new version, remember to take the additional steps described below. They
-will help to ensure imported data consistency and avoid excessive operations. Otherwise, the new
-add-on will pull Netwrix Auditor’s activity data that had already been imported into your Splunk
-system by the old add-on.
+and plan to migrate to the new version, take the following additional steps. They
+help ensure imported data consistency and avoid excessive operations. Otherwise, the new
+add-on pulls Netwrix Auditor’s activity data that the old add-on already imported into your Splunk
+system.
**Step 1 –** Stop the old version of Netwrix Auditor add-on for Splunk. You can do this with the
Windows Scheduled Tasks.
diff --git a/docs/auditor/10.9/addon/splunk/overview.md b/docs/auditor/10.9/addon/splunk/overview.md
index 6ac3314c6e..26f2acd47e 100644
--- a/docs/auditor/10.9/addon/splunk/overview.md
+++ b/docs/auditor/10.9/addon/splunk/overview.md
@@ -7,7 +7,7 @@ sidebar_position: 250
# Splunk
**Netwrix Auditor** is a visibility platform for user behavior analysis and risk mitigation that enables
-control over changes, configurations and access in hybrid IT environments to protect data regardless
+control over changes, configurations, and access in hybrid IT environments to protect data regardless
of its location. The platform provides security analytics to detect anomalies in user behavior and
investigate threat patterns before a data breach occurs.
@@ -18,9 +18,9 @@ company's IT assets.
Splunk to pull the audit data collected by Netwrix Auditor and stored to the audit databases in
Netwrix-compatible form (activity records). This data is saved in the event log format recognized by
Splunk and also mapped to the CIM data models — for normalization and better correlation with other
-log sources. With that automated flow, you can use Splunk Enterprise as your single pane of glass
-for aggregated data analysis. This makes the IT infrastructure monitoring more efficient and helps
-you keep tabs on your IT assets.
+log sources. With that automated flow, you can use Splunk Enterprise as a unified console for
+aggregated data analysis. This makes IT infrastructure monitoring more efficient and helps
+you track your IT assets.
The major benefits are:
@@ -50,17 +50,17 @@ See [CIM Data Model Mapping](/docs/auditor/10.9/addon/splunk/datamodelmap.md) fo
## How It Works
Netwrix Auditor add-on for Splunk allows pulling activity records data from the Netwrix Auditor via
-its Integration API. Data is retrieved in JSON format, transferred over HTTPS and stored to Splunk
-index.
+its Integration API. The add-on retrieves data in JSON format, transfers it over HTTPS, and stores
+it in the Splunk index.
-To learn more about Netwrix Auditor activity records, see the
-[Activity Records](/docs/auditor/10.9/api/postdata/activityrecords.md) topic for additional information.
+For more information about Netwrix Auditor activity records, see the
+[Activity Records](/docs/auditor/10.9/api/postdata/activityrecords.md) topic.
-For this data to be provided to Splunk, it adds a new Splunk source type, performing additional data
-parsing and field extraction. The audit data is also mapped into the Common Information Model (CIM)
-data models — for normalization and better correlation with other log sources.
+To provide this data to Splunk, the add-on adds a new Splunk source type, performing additional data
+parsing and field extraction. The add-on also maps the audit data into the Common Information Model
+(CIM) data models — for normalization and better correlation with other log sources.
On a high level, the solution works in the following steps.
@@ -71,15 +71,15 @@ sharing Netwrix Auditor data with external applications.
the necessary parameters for its operation: Netwrix Auditor Integration API host and account to
access it with sufficient access rights.
-**Step 3 –** The IT administrator prepares a Splunk index to store the data that will be collected
-from Netwrix Auditor.
+**Step 3 –** The IT administrator prepares a Splunk index to store the data collected from Netwrix
+Auditor.
**Step 4 –** Splunk starts pulling activity records via Netwrix Auditor Integration API by sending
-POST requests with Continuation Mark. Data is received in JSON format and stored in the specified
-Splunk index — to make it available for further search by Splunk.
+POST requests with Continuation Mark. Splunk receives data in JSON format and stores it in the
+specified index, making it available for further search.
-**Step 5 –** When search is performed, Splunk attempts to extract additional information available
-in the audit data and to map it to CIM data models.
+**Step 5 –** When a user runs a search, Splunk attempts to extract additional information available
+in the audit data and map it to CIM data models.
**Step 6 –** User opens Splunk Enterprise to work with collected data:
@@ -95,7 +95,7 @@ Before running the add-on, ensure that all the necessary components and policies
### Auditor Server side
1. Auditor version is 9.96 or higher.
-2. Netwrix Auditor Integration API and Audit Database are configured. Make sure that Netwrix Auditor Integration API is configured to use HTTPS protocol.
+2. Netwrix Auditor Integration API and Audit Database are configured. Ensure that Netwrix Auditor Integration API is configured to use HTTPS protocol.
See the [Prerequisites](/docs/auditor/10.9/api/prerequisites.md) and [Audit Database](/docs/auditor/10.9/admin/settings/auditdatabase.md) topics for additional information.
3. The user retrieving data from the Audit Database is granted the Global reviewer role in Auditor or is a member of the Netwrix Auditor Client Users group. It is recommended to create a dedicated account for that purpose.
Alternatively, you can grant the Global administrator role or add the user to the Netwrix Auditor Administrators group. In this case, this user will have the most extended permissions in the product.
@@ -110,7 +110,7 @@ See the [Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringpl
### HTTPS certificate requirements
-Starting with version **1.7.0**, the Netwrix Auditor add-on for Splunk requires the HTTPS certificate used by the Netwrix Auditor Integration API to be trusted by the Splunk add-on. If the certificate is not trusted, the add-on will not be able to retrieve data from the Integration API.
+Starting with version **1.7.0**, the Netwrix Auditor add-on for Splunk requires the HTTPS certificate used by the Netwrix Auditor Integration API to be trusted by the Splunk add-on. If the certificate isn't trusted, the add-on will not be able to retrieve data from the Integration API.
You can satisfy this requirement using one of the following options:
@@ -133,7 +133,7 @@ After updating the trust store, proceed with add-on configuration.
## Considerations and limitations
-- If the information is not available in the activity record received from Auditor, it will also not
+- If the information isn't available in the activity record received from Auditor, it will also not
be available in Splunk.
-- CIM might not have data models for some of the activity records received from Auditor; such
- information can only be accessed in Splunk using search by index.
+- CIM might not have data models for some of the activity records received from Auditor; you can
+ only access such information in Splunk using search by index.
diff --git a/docs/auditor/10.9/addon/splunk/troubleshooting.md b/docs/auditor/10.9/addon/splunk/troubleshooting.md
index df77c395d2..38b78f10ad 100644
--- a/docs/auditor/10.9/addon/splunk/troubleshooting.md
+++ b/docs/auditor/10.9/addon/splunk/troubleshooting.md
@@ -6,7 +6,7 @@ sidebar_position: 40
# Maintenance and Troubleshooting
-Splunk records service logs to the `_internal` index. Follow the steps to troubleshoot data input
+Splunk records service logs to the `_internal` index. To troubleshoot data input
from Netwrix Auditor API:
**Step 1 –** Navigate to the **Search** page of the add-on or **Search & Reporting** Splunk app.
@@ -23,7 +23,7 @@ For example:
index=_internal netwrix_data_input
```
-**Step 3 –** Press the **Last 24 hours** button and choose **All time** time range.
+**Step 3 –** Press the **Last 24 hours** button and choose the **All time** range.
**Step 4 –** Press the search button; you should see list of the events with Splunk service
information.
diff --git a/docs/auditor/10.9/admin/alertsettings/create/create.md b/docs/auditor/10.9/admin/alertsettings/create/create.md
index 1b32a8d6ed..5201a38b34 100644
--- a/docs/auditor/10.9/admin/alertsettings/create/create.md
+++ b/docs/auditor/10.9/admin/alertsettings/create/create.md
@@ -13,12 +13,12 @@ To set up a response action, this account must also be a member of the local _Ad
on Auditor Server.
See the
-[](https://helpcenter.netwrix.com/Roles/Role_Based_Access.html)[Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md)
+[Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md)
topic for additional information.
## Create a Custom Alert
-Follow the steps to create a custom alert.
+To create a custom alert:
**Step 1 –** On the main Auditor page, click the Alert settings link under the Configuration section
on the left:
@@ -31,9 +31,9 @@ See the [Navigation](/docs/auditor/10.9/admin/navigation/overview.md) topic for
| Option | Description |
| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| General | - Specify a name and enter the description for the new alert.
**NOTE:** Make sure that the Send alert when the action occurs option is enabled. Otherwise, the new alert will be disabled. - Email subject — Specify the subject of the email. It is possible to insert variables into the subject line. You can choose between "_Who_", "_What_" and"_Where_" variables. Consider the following:
- Only one variable of each type can be added
- You need to cut off the full path from the object names in "_What_" alert and leave only the actual name. For example, "_\com\Corp\Users\Departments\IT\Username_" should be just "_Username_". If you want to get back to the default Email subject line, click the **Restore Default** button.
- Apply tags — Create a set of tags to more efficiently identify and sort your alerts. Select Edit under Apply tags to associate tags with your alert. Later, you can quickly find an alert of interest using Filter by tags in the upper part of the All Alerts window. To see a full list of alerts ever created in the product, navigate to Settings > Tags.
|
-| Recipients | Select alert recipients. Click Add Recipient and select alert delivery type: - Email — Specify the email address where notifications will be delivered. You can add as many recipients as necessary.
**_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. - SMS-enabled email — Netwrix uses the sms gateway technology to deliver notifications to a phone number assigned to a dedicated email address. Specify email address to receive SMS notifications. Make sure that your carrier supports sms to email gateway technology.
|
-| Filters | Apply a set of filters to narrow events that trigger a new alert. Alerts use the same interface and logic as search. - Filter — Select general type of filter (e.g., "Who", "Data Source", "Monitoring plan", etc.)
- Operator — Configure match types for selected filter (e.g., "Equals", "Does not contain", etc.)
- Value — Specify filter value. See the [View and Search Collected Data](/docs/auditor/10.9/admin/search/overview.md) topic for additional information on how to create and modify filters. The Filters section contains required fields highlighted with red. Once you completed all filters, click Preview on the right pane to see search-based list of events that will trigger your alert. 
|
-| Thresholds | If necessary, enable threshold to trigger the new alert. In this case, a single alert will be sent instead of many alerts. This can be helpful when Auditor detects many activity records matching the filters you specified. Slide the switch under the Send alert when the threshold is exceeded option and configure the following: - Limit alerting to activity records with the same... — Select a filter in the drop-down list (e.g., who). Note that, Auditor will search for activity records with the same value in the filter you selected. Only alerts grouped by the Who parameter can be included in the Behavior Anomalies list. Mind that in this case, the product does not summarize risk scores and shows the value you associated with this alert. This may significantly reduce risk score accuracy.
- Send alert for `<...>` activity records within `<...>` seconds — Select a number of changes that occurred in a given period (in seconds). For example, you want to receive an alert on suspicious activity. You select "_Action_" in the Limit alerting to activity records with the same list and specify a number of actions to be considered an unexpected behavior: _1000_ changes in _60_ seconds. When the selected threshold exceeded, an alert will be delivered to the specified recipients: one for every 1000 removals in 60 seconds, one for every 1000 failed removals in 60 seconds. So you can easily discover what is going on in your IT infrastructure.
|
-| Risk Score | - Slide the switch to On under Include this alert in Behavior Anomalies assessment. See the [Behavior Anomalies](/docs/auditor/10.9/admin/behavioranomalies/overview.md) topic for additional information.
- Associate a risk score with the alert — Assign a risk score based on the type of anomaly and the severity of the deviation from the normal behavior. An action's risk score is a numerical value from 1 (Low) to 100 (High) that designates the level of risk with 100 being the riskiest and 1 the least risky. These are general guidelines you can adopt when setting a risk score:
- High score — Assign to an action that requires your immediate response (e.g., adding account to a privileged group). Configure a non-threshold alert with email recipients.
- Above medium score — Assign to a repetitive action occurring during a short period of time. While a standalone action is not suspicious, multiple actions merit your attention (e.g., mass deletions from a SharePoint site). Configure a threshold-based alert with email recipients.
- Low score — Assign to an infrequent action. While a single action is safe, multiple occurrences aggregated over a long period of time may indicate a potential in-house bad actor (e.g., creation of potentially harmful files on a file share). Configure a non-threshold alert, email recipients are optional but make sure to regularly review the Behavior Anomalies dashboard.
- Low score — Assign to a repetitive action that does not occur too often (e.g., rapid logons). Multiple occurrences of action sets may indicate a potential in-house bad actor or account compromise. Configure a threshold-based alert, email recipients are optional but make sure to regularly review the Behavior Anomalies dashboard.
|
+| General | - Specify a name and enter the description for the new alert.
**NOTE:** ensure that the Send alert when the action occurs option is enabled. Otherwise, the new alert will be disabled. - Email subject — Specify the subject of the email. You can insert variables into the subject line. You can choose between "_Who_", "_What_" and"_Where_" variables. Consider the following:
- Only one variable of each type can be added
- You need to cut off the full path from the object names in "_What_" alert and leave only the actual name. For example, "_\com\Corp\Users\Departments\IT\Username_" should be just "_Username_". If you want to get back to the default Email subject line, click the **Restore Default** button.
- Apply tags — Create a set of tags to more efficiently identify and sort your alerts. Select Edit under Apply tags to associate tags with your alert. Later, you can quickly find an alert of interest using Filter by tags in the upper part of the All Alerts window. To see a full list of alerts ever created in the product, navigate to Settings > Tags.
|
+| Recipients | Select alert recipients. Click Add Recipient and select alert delivery type: - Email — Specify the email address where notifications will be delivered. You can add as many recipients as necessary.
**_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified email address and inform you if any problems are detected. - SMS-enabled email — Netwrix uses the sms gateway technology to deliver notifications to a phone number assigned to a dedicated email address. Specify email address to receive SMS notifications. Ensure that your carrier supports SMS-to-email gateway technology.
|
+| Filters | Apply a set of filters to narrow events that trigger a new alert. Alerts use the same interface and logic as search. - Filter — Select general type of filter (e.g., "Who", "Data Source", "Monitoring plan", etc.)
- Operator — Configure match types for selected filter (e.g., "Equals", "Doesn't contain", etc.)
- Value — Specify filter value. See the [View and Search Collected Data](/docs/auditor/10.9/admin/search/overview.md) topic for additional information on how to create and modify filters. The Filters section contains required fields highlighted with red. After you complete all filters, click Preview on the right pane to see a search-based list of events that will trigger your alert. 
|
+| Thresholds | If necessary, enable threshold to trigger the new alert. In this case, a single alert will be sent instead of many alerts. This can be helpful when Auditor detects many activity records matching the filters you specified. Slide the switch under the Send alert when the threshold is exceeded option and configure the following: - Limit alerting to activity records with the same... — Select a filter in the dropdown list (e.g., who). **NOTE:** Auditor will search for activity records with the same value in the filter you selected. Only alerts grouped by the Who parameter can be included in the Behavior Anomalies list. Mind that in this case, the product doesn't summarize risk scores and shows the value you associated with this alert. This may significantly reduce risk score accuracy.
- Send alert for `<...>` activity records within `<...>` seconds — Select a number of changes that occurred in a given period (in seconds). For example, you want to receive an alert on suspicious activity. You select "_Action_" in the Limit alerting to activity records with the same list and specify a number of actions to be considered an unexpected behavior: _1000_ changes in _60_ seconds. When the selected threshold exceeded, an alert will be delivered to the specified recipients: one for every 1000 removals in 60 seconds, one for every 1000 failed removals in 60 seconds. So you can discover what is going on in your IT infrastructure.
|
+| Risk Score | - Slide the switch to On under Include this alert in Behavior Anomalies assessment. See the [Behavior Anomalies](/docs/auditor/10.9/admin/behavioranomalies/overview.md) topic for additional information.
- Associate a risk score with the alert — Assign a risk score based on the type of anomaly and the severity of the deviation from the normal behavior. An action's risk score is a numerical value from 1 (Low) to 100 (High) that designates the level of risk with 100 being the riskiest and 1 the least risky. These are general guidelines you can adopt when setting a risk score:
- High score — Assign to an action that requires your immediate response (e.g., adding account to a privileged group). Configure a non-threshold alert with email recipients.
- Above medium score — Assign to a repetitive action occurring during a short period of time. While a standalone action isn't suspicious, multiple actions merit your attention (e.g., mass deletions from a SharePoint site). Configure a threshold-based alert with email recipients.
- Low score — Assign to an infrequent action. While a single action is safe, multiple occurrences aggregated over a long period of time may indicate a potential in-house bad actor (e.g., creation of potentially harmful files on a file share). Configure a non-threshold alert, email recipients are optional but ensure to regularly review the Behavior Anomalies dashboard.
- Low score — Assign to a repetitive action that doesn't occur too often (e.g., rapid logons). Multiple occurrences of action sets may indicate a potential in-house bad actor or account compromise. Configure a threshold-based alert, email recipients are optional but ensure to regularly review the Behavior Anomalies dashboard.
|
| Response Action | You can instruct Auditor to perform a response action when the alert occurs — for example, start an executable file (command, batch file, or other) that will remediate the issue, or open a ticket with the help desk, and so on. For that, you will need an executable file stored locally on the Auditor server. Slide the switch to turn the feature **ON**, and see the [Configure a Response Action for Alert](/docs/auditor/10.9/admin/alertsettings/responseaction.md) topic for additional information. |
diff --git a/docs/auditor/10.9/admin/alertsettings/create/createeventlog.md b/docs/auditor/10.9/admin/alertsettings/create/createeventlog.md
index 6edaf2eed4..27ca48687a 100644
--- a/docs/auditor/10.9/admin/alertsettings/create/createeventlog.md
+++ b/docs/auditor/10.9/admin/alertsettings/create/createeventlog.md
@@ -10,20 +10,20 @@ Alerts are configurable notifications triggered by certain events and sent to th
recipients. You can enable or disable, and modify existing alerts, and create new alerts. To do it,
click Configure next to Alerts.
-Follow the steps to create new alert.
+To create a new alert:
**Step 1 –** In the Alerts window, click Add to start new alert.
**Step 2 –** On the Alert Properties step, specify the alert name and enter alert description
-(optional). Specify the number alerts per email. Grouped alerts for different computers will be
-delivered in separate email messages. This value is set to 1 by default, which means that each alert
-will be delivered as a separate email message.
+(optional). Specify the number alerts per email. Auditor delivers grouped alerts for different
+computers in separate email messages. This value is set to 1 by default, so Auditor delivers each
+alert as a separate email message.
**Step 3 –** On the Notifications step, configure email notifications and customize the notification
template, if needed. Click Edit next to Customize notifications template. Edit the template by
deleting or inserting information fields.
-The %ManagedObjectName% variable will be replaced with your monitoring plan name.
+Auditor replaces the %ManagedObjectName% variable with your monitoring plan name.
**Step 4 –** On the Event filters step, specify an event that will trigger the alert.
@@ -35,7 +35,7 @@ The %ManagedObjectName% variable will be replaced with your monitoring plan name
| ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Name | Specify the filter name. |
| Description | Enter the description for this filter (optional). |
- | Event Log | Select an event log from the drop-down list. You will be alerted on events from this event log. You can also input a different event log. To find out a log’s name, navigate to Start > Windows Administrative Tools > **Event Viewer** > **Applications and Services Logs** > Microsoft > Windows and expand the required Log_Name node, right-click the file under it and select Properties. Find the event log’s name in the Full Name field. Auditor does not collect the Analytic and Debug logs, so you cannot configure alerts for these logs. You can use a wildcard (\*). In this case you will be alerted on events from all Windows logs except for the ones mentioned above. |
+ | Event Log | Select an event log from the dropdown list. You will be alerted on events from this event log. You can also input a different event log. To find out a log’s name, navigate to Start > Windows Administrative Tools > **Event Viewer** > **Applications and Services Logs** > Microsoft > Windows and expand the required Log_Name node, right-click the file under it and select Properties. Find the event log’s name in the Full Name field. Auditor doesn't collect the Analytic and Debug logs, so you can't configure alerts for these logs. You can use a wildcard (\*). In this case you will be alerted on events from all Windows logs except for the ones mentioned above. |
- In the Event Fields tab:
diff --git a/docs/auditor/10.9/admin/alertsettings/create/createhealthstatus.md b/docs/auditor/10.9/admin/alertsettings/create/createhealthstatus.md
index f97d28cda7..00d1f1639c 100644
--- a/docs/auditor/10.9/admin/alertsettings/create/createhealthstatus.md
+++ b/docs/auditor/10.9/admin/alertsettings/create/createhealthstatus.md
@@ -6,29 +6,28 @@ sidebar_position: 30
# Create Alerts on Health Status
-You can configure alerts to be triggered by important events in the Netwrix AuditorSystem Health
+You can configure alerts to be triggered by important events in the Netwrix Auditor System Health
log.
-To create alerts to be notified on Auditor Health Status.
-
-Follow the basic steps, required for creation of the monitoring plan that will be used to collect
-data on Auditor health status events. See the topic for additional information.
+To create alerts to be notified on Auditor Health Status, follow the basic steps for creating the
+monitoring plan used to collect data on Auditor health status events. See the topic for additional
+information.
**Step 1 –** Start Netwrix Auditor Event Log Manager and create the new monitoring plan.
-**Step 2 –** Make sure that the Enable event log collection checkbox is selected. Specify the name
+**Step 2 –** Ensure that the Enable event log collection checkbox is selected. Specify the name
for the new plan, for example, _"\_Netwrix Auditor \_Health Status"_.
**Step 3 –** Navigate to the Monitored computers list and add a server where the Auditor server
resides.
-**Step 4 –** On the General tab, click Configure next to Alerts. Make sure the predefined alerts are
-disabled. Click Add to create anew alert.
+**Step 4 –** On the General tab, click Configure next to Alerts. Ensure the predefined alerts are
+disabled. Click Add to create a new alert.
**Step 5 –** In the Alert Properties wizard, specify the alert name and enter alert description
-(optional). Specify the number alerts per email. Grouped alerts for different computers will be
-delivered in separate email messages. This value is set to 1 by default, which means that each alert
-will be delivered as a separate email message.
+(optional). Specify the number alerts per email. Auditor delivers grouped alerts for different
+computers in separate email messages. This value is set to 1 by default, so Auditor delivers each
+alert as a separate email message.
**Step 6 –** Specify alert recipient if you want the alert to be delivered to a non-default email.
@@ -44,7 +43,7 @@ alert.
**Step 9 –** Click OK to save the changes and close the Event Filters dialog.
**Step 10 –** In the Netwrix Auditor Event Log Manager wizard, navigate to the Notifications section
-and specify the email address where notifications will be delivered.
+and specify the email address to receive notifications.
**_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified
email address and inform you if any problems are detected.
@@ -56,5 +55,5 @@ inclusive filter.
-If an event occurs that triggers an alert, an email notification will be sent immediately to the
+If an event occurs that triggers an alert, Auditor immediately sends an email notification to the
specified recipients.
diff --git a/docs/auditor/10.9/admin/alertsettings/create/createmailboxaccess.md b/docs/auditor/10.9/admin/alertsettings/create/createmailboxaccess.md
index e5d7f23942..5d5d253c5e 100644
--- a/docs/auditor/10.9/admin/alertsettings/create/createmailboxaccess.md
+++ b/docs/auditor/10.9/admin/alertsettings/create/createmailboxaccess.md
@@ -13,27 +13,27 @@ need to create a monitoring plan for auditing event logs.
## Create Alerts for Non-Owner Mailbox Access Events
-The procedure below describes the basic steps, required for creation of a monitoring plan that will
-be used to collect data on non-owner mailbox access events. See
+The following procedure describes the basic steps for creating a monitoring plan that collects data
+on non-owner mailbox access events. See
[Event Log Manager](/docs/auditor/10.9/tools/eventlogmanager/eventlogmanager.md) topic for additional information.
-Follow the steps to create alert for non-owner mailbox access events.
+To create an alert for non-owner mailbox access events:
**Step 1 –** Create a monitoring plan in Netwrix Auditor Event Log Manager.
-**Step 2 –** Make sure that the Enable event log collection checkbox is selected. Specify the name
+**Step 2 –** Ensure that the Enable event log collection checkbox is selected. Specify the name
for the new plan, for example, "_Non-owner mailbox access auditing_".
**Step 3 –** Navigate to the Monitored computers list and add a server where your Exchange
organization resides.
-**Step 4 –** On the General tab, click Configure next to Alerts. Make sure the predefined alerts are
+**Step 4 –** On the General tab, click Configure next to Alerts. Ensure the predefined alerts are
disabled. Click Add to create an alert for non-owner mailbox access event.
**Step 5 –** In the Alert Properties wizard, specify the alert name and enter alert description
-(optional). Specify the number alerts per email. Grouped alerts for different computers will be
-delivered in separate email messages. This value is set to 1 by default, which means that each alert
-will be delivered as a separate email message.
+(optional). Specify the number alerts per email. Auditor delivers grouped alerts for different
+computers in separate email messages. This value is set to 1 by default, so Auditor delivers each
+alert as a separate email message.
**Step 6 –** Specify alert recipient if you want the alert to be delivered to a non-default email.
@@ -74,20 +74,20 @@ alert.
**Step 9 –** Click OK to save the changes and close the Event Filters dialog.
**Step 10 –** In the Netwrix Auditor Event Log Manager wizard, navigate to Notifications and specify
-the email address where notifications will be delivered.
+the email address to receive notifications.
**_RECOMMENDED:_** click **Send Test Email**. The system will send a test message to the specified
email address and inform you if any problems are detected.
**Step 11 –** Click Edit next to Audit Archiving Filters step, in the Inclusive Filters section
-clear the filters you do not need, click Add and specify the following information:
+clear the filters you don't need, click Add and specify the following information:
- The filter name and description (e.g., Non-owner mailbox access event)
- In Event Log, enter _"Netwrix Non-Owner Mailbox Access Agent"_.
-- In Write to, select Long-Term Archive. The events will be saved into the local repository.
+- In Write to, select Long-Term Archive. Auditor saves the events into the local repository.
-**Step 12 –** Click Save. If an event occurs that triggers an alert, an email notification will be
-sent immediately to the specified recipients.
+**Step 12 –** Click Save. If an event occurs that triggers an alert, Auditor immediately sends an
+email notification to the specified recipients.
## Review Event Description
diff --git a/docs/auditor/10.9/admin/alertsettings/dashboard.md b/docs/auditor/10.9/admin/alertsettings/dashboard.md
index 07e662b4fd..5573ca69c0 100644
--- a/docs/auditor/10.9/admin/alertsettings/dashboard.md
+++ b/docs/auditor/10.9/admin/alertsettings/dashboard.md
@@ -6,28 +6,28 @@ sidebar_position: 10
# Alerts Overview Dashboard
-Aggregated statistics on the alerts is provided in the Alerts overview widget. It displays currently
+The Alerts overview widget provides aggregated statistics on alerts. It displays
triggered alerts with detailed information.
To view the dashboard, on the main Auditor page, click the Alerts tile.
The dashboard includes the following widgets:
-- Alerts triggered – Shows amount of alerts triggered for the last 7 days (by default). Use this
+- Alerts triggered – Shows the number of alerts triggered for the last 7 days (by default). Use this
tile to inspect the trend.
- Top 5 alerts by count – Shows most recently triggered alerts for the selected time period (7 days
by default).
- Risk score by top 5 users – Shows potentially harmful users for the selected time period (7 days
by default). Clicking the tile opens the Behavior Anomalies dashboard. See the
[Behavior Anomalies](/docs/auditor/10.9/admin/behavioranomalies/overview.md) topic for additional information.
-- Alerts timeline – Shows the number of alerts triggered at the specific day.
+- Alerts timeline – Shows the number of alerts triggered on a specific day.
- Recent alerts – Shows all the triggered alerts in chronological order.
-Clicking any tile except for Risk score by top 5 users drills down to the Alert history dashboard
-that provides users with the detailed information about the latest alerts triggered in their IT
-infrastructure enriched with the actionable chart and timeline.
+Clicking any tile except Risk score by top 5 users opens the Alert history dashboard, which provides
+detailed information about the latest alerts triggered in your IT infrastructure, enriched with
+actionable charts and timelines.
@@ -37,7 +37,7 @@ additional information.
On the Details pane, you can review alert details and manage your alerts:
-- Select columns – Select columns to be displayed.
+- Select columns – Select columns to display.
- Show reviewed alerts – Click to view all alerts you have already reviewed.
- Mark all as reviewed – Click to mark all alerts in the list as reviewed. Netwrix recommends doing
this only if you are completely sure that there are no critical alerts in your infrastructure.
@@ -48,6 +48,6 @@ On the Details pane, you can review alert details and manage your alerts:
[Activity Records Statistics](/docs/auditor/10.9/admin/healthstatus/dashboard/activityrecordstatistics.md) topic for
additional information.
-You can also refresh the alerts information by clicking the Refresh button at the bottom or go to
-the general alerts settings page clicking the Alert settings. See the [Manage Alerts](/docs/auditor/10.9/admin/alertsettings/manage.md)
+You can also refresh the alerts information by clicking the Refresh button at the bottom, or go to
+the general alert settings page by clicking Alert settings. See the [Manage Alerts](/docs/auditor/10.9/admin/alertsettings/manage.md)
topic for additional information.
diff --git a/docs/auditor/10.9/admin/alertsettings/manage.md b/docs/auditor/10.9/admin/alertsettings/manage.md
index 3ef63c73c4..46f3746bb4 100644
--- a/docs/auditor/10.9/admin/alertsettings/manage.md
+++ b/docs/auditor/10.9/admin/alertsettings/manage.md
@@ -6,11 +6,10 @@ sidebar_position: 30
# Manage Alerts
-For your convenience, Netwrix provides you with a set of predefined alerts that are commonly used
-for IT infrastructure monitoring. The out-of-the-box alerts include those that help you detect
-suspicious activity and inform you on critical changes to your environment. The alerts contain
-pre-configured filters and in most cases you only need to enable an alert and select who will
-receive notifications.
+Netwrix provides a set of predefined alerts commonly used for IT infrastructure monitoring. These
+alerts include ones that help you detect suspicious activity and notify you about critical changes
+to your environment. The alerts contain pre-configured filters, and in most cases you only need to
+enable an alert and select who receives notifications.
You can add any elements (a dashboard, report, alert, risk, etc.) to the Auditor Home screen to
access them instantly. See the [Navigation](/docs/auditor/10.9/admin/navigation/overview.md) and
@@ -18,7 +17,7 @@ access them instantly. See the [Navigation](/docs/auditor/10.9/admin/navigation/
| To... | Follow the steps... |
| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Enable / disable an existing alert | **Step 1 –** Select an alert from the list and enable it using the slider in the Mode column. **Step 2 –** Double-click the selected alert and specify alert recipients or set a risk score want to include an alert in Behavior Anomalies assessment. You can go on with a score suggested by Netwrix industry experts or fine-tune it to fit your organization's priorities. See the [Risk Score](/docs/auditor/10.9/admin/alertsettings/create/create.md) topic for additional information on how to configure scoring settings. **Step 3 –** Review and update filters. For some alerts you should provide filter values, such as group name or user. |
+| Enable / disable an existing alert | **Step 1 –** Select an alert from the list and enable it using the slider in the Mode column. **Step 2 –** Double-click the selected alert and specify alert recipients, or set a risk score if you want to include the alert in the Behavior Anomalies assessment. You can use the score suggested by Netwrix industry experts or fine-tune it to fit your organization's priorities. See the [Risk Score](/docs/auditor/10.9/admin/alertsettings/create/create.md) topic for additional information on how to configure scoring settings. **Step 3 –** Review and update filters. For some alerts, you need to provide filter values, such as a group name or user. |
| Modify an existing alert | Select an alert from the list and click Edit. |
| Create a new alert from existing | Select an alert from the list and click Duplicate at the bottom of the window. |
| Remove an alert | Select an alert from the list and click  in the right pane. |
diff --git a/docs/auditor/10.9/admin/alertsettings/overview.md b/docs/auditor/10.9/admin/alertsettings/overview.md
index b3795bc834..e04ab16886 100644
--- a/docs/auditor/10.9/admin/alertsettings/overview.md
+++ b/docs/auditor/10.9/admin/alertsettings/overview.md
@@ -6,14 +6,14 @@ sidebar_position: 70
# Alerts
-If you want to be notified about suspicious activity, you can configure alerts that will be
-triggered by specific events. Alerts are sent after the specified action has been detected. Alerts
-are helpful if you want to be notified about actions critical to your organization security and have
-to mitigate risks once the suspicious action occurs.
+If you want to be notified about suspicious activity, you can configure alerts that trigger on
+specific events. Auditor sends alerts after it detects the specified action. Alerts are helpful if
+you want to be notified about actions critical to your organization's security and need to mitigate
+risks when the suspicious action occurs.
-Review the following to take advantage of the Alerts functionality:
+Review the following topics about the Alerts functionality:
-- See the[Manage Alerts](/docs/auditor/10.9/admin/alertsettings/manage.md) topic for additional information on how to edit and enable
+- See the [Manage Alerts](/docs/auditor/10.9/admin/alertsettings/manage.md) topic for additional information on how to edit and enable
existing predefined alerts, and create new alerts based on the predefined ones.
- See the [Create Alerts](/docs/auditor/10.9/admin/alertsettings/create/create.md) topic for additional information on how to create custom alerts
with your personal filters.
@@ -28,13 +28,13 @@ The example alert is triggered when a new user is created in the monitored domai
## Tags
-Netwrix Auditor allows you to apply tags when creating an alert. Applying tags to alerts allows you
-to distinguish one alert from another or create groups of similar alerts.
+You can apply tags when creating an alert. Tags help you distinguish one alert from another or
+create groups of similar alerts.
-The Tags page contains a complete list of alerts that were created in the product. Currently, you
-cannot assign or create tags on this page.
+The Tags page contains a complete list of alerts that exist in the product. You
+can't assign or create tags on this page.
To apply tags to an alert, navigate to alert settings and locate the Apply tags section on the
-General tab. See the [Create Alerts](/docs/auditor/10.9/admin/alertsettings/create/create.md) topic to receive information about tags applying.
+General tab. See the [Create Alerts](/docs/auditor/10.9/admin/alertsettings/create/create.md) topic for more information about applying tags.
diff --git a/docs/auditor/10.9/admin/alertsettings/responseaction.md b/docs/auditor/10.9/admin/alertsettings/responseaction.md
index f071ea9718..cdd1c2051e 100644
--- a/docs/auditor/10.9/admin/alertsettings/responseaction.md
+++ b/docs/auditor/10.9/admin/alertsettings/responseaction.md
@@ -6,9 +6,9 @@ sidebar_position: 40
# Configure a Response Action for Alert
-Upon the alert triggering, you can instruct Auditor to perform several actions such as run a
-command, a script or other executable file that will perform a remediation action, open a ticket
-with the organization help desk, etc.
+When an alert triggers, you can instruct Auditor to perform actions such as running a command,
+script, or other executable file to perform a remediation action, or opening a ticket with the
+organization's help desk.
@@ -19,109 +19,103 @@ Response Action settings contain the following configuration options:
- With parameters – If your script contains parameters, specify them here
- Working directory – If you need to specify a working directory for your script to perform the
operation, insert the path here
-- Write data to CSV file – If this checkbox is selected, Netwrix Auditor will save activity records
+- Write data to CSV file – If you select this checkbox, Netwrix Auditor saves activity records
in a CSV file. You can use it to pass information into your response action to receive a more
targeted response.
-- Limit row count in a file to – Select the desired number of rows you want for the file
+- Limit row count in a file to – Select the number of rows you want for the file
- Use custom credentials – Enter the username and password if you want the script to be run as an
account different from LocalSystem
-- Command line preview – Showing a preview of the command line script. Click **Test run** button to
- test its performance.
+- Command line preview – Shows a preview of the command line script. Click the **Test run** button
+ to test its performance.
-Follow the steps to configure the required settings in the Response Action tab of the alert
-properties.
+To configure the required settings in the Response Action tab of the alert properties:
**Step 1 –** Turn the switch to On if you want a response action to be taken when the alert occurs.
**Step 2 –** In the Run field, specify the path to the executable file (_.exe_, ._cmd_, _.bat_; for
-_.ps1_ files see step 3 below). The file must be located on the machine where Netwrix Auditor server
-runs.
+_.ps1_ files, see step 3). The executable file must reside on the machine where the Netwrix Auditor
+server runs.
-**Step 3 –** In the With parameters field, enter the parameters to be used by the executable file.
-Use space character as a separator.
+**Step 3 –** In the With parameters field, enter the parameters for the executable file to use. Use
+a space character as a separator.
**Step 4 –** To run _.exe_, _.cmd_ and _.bat_ files, you can enter the path to your command-line or
batch file directly in the Run field, for example:
-To run the ._ps1_ files, you will need to enter the path to _powershell.exe_ and path to your
-script. For example:
+To run _.ps1_ files, enter the path to _powershell.exe_ and the path to your script. For example:
- In the Run field, enter _C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe_
- In the With parameters field, enter `–File `
-Unless you select to Write data to CSV file, Auditor will also pass the following parameters to the
+Unless you select Write data to CSV file, Auditor also passes the following parameters to the
command line:
- _AlertID_ — alert ID
- _RecordID_ — ID of the activity record that triggered the alert
-Selecting Write data to CSV file will change this behavior, as described in the Configure a Response
-Action for Alert section below.
+Selecting Write data to CSV file changes this behavior, as described in the Write Data to a CSV
+File section of this topic.
**Step 5 –** In the Working directory field, specify path to the working directory of the executable
file on NAuditor server.
-**Step 6 –** In the Working directory field, specify path to the working directory of the executable
-file on NAuditor server.
-
-If you leave this field empty, then the path to the file specified in the Run field will be used as
-a working directory. As shown in the example with the _.ps_ file, this may be the system directory.
-So, to avoid system directory cluttering, it is recommended not to leave the Working directory field
-empty but to explicitly specify the directory where your executable file is located, or a dedicated
-directory for that purpose. In the latter case, make sure the directory exists on Auditor server.
+If you leave this field empty, the path to the file specified in the Run field becomes the working
+directory. As shown in the example with the _.ps_ file, this may be the system directory. So, to
+avoid cluttering the system directory, don't leave the Working directory field empty. Specify the
+directory that contains your executable file, or a dedicated directory for that purpose. In the
+latter case, ensure the directory exists on the Auditor server.
-**Step 7 –** Write data to CSV file — select this option if you want Auditor to locate the activity
+**Step 6 –** Write data to CSV file — select this option if you want Auditor to locate the activity
records associated with the alert, and write the record fields and their values in a structured way
-to a ._csv_ file. For each new alert being created, this option is selected by default, as well as
+to a ._csv_ file. For each new alert you create, Auditor selects this option by default, as it does
for the predefined alerts installed with Auditor.
-After the upgrade, all alerts with previously configured response action will have this option
-cleared.
+The upgrade clears this option for all alerts that have a previously configured response action.
-**Step 8 –** Limit row count in a file to `` — limit the number of rows (activity records) to be
-written to a single ._csv_ file. Enter a value from _1_ to _1000_.
+**Step 7 –** Limit row count in a file to `` — limit the number of rows (activity records) that
+Auditor writes to a single ._csv_ file. Enter a value from _1_ to _1000_.
-Learn more about how these options work in the Configure a Response Action for Alert section.
+For more information about how these options work, see the Write Data to a CSV File section of this
+topic.
-By default, the executable file will be launched under the _LocalSystem_ account. If you want to use
-another account, select the Use custom credentials checkbox and specify user name and password. Make
-sure this account has **Log on as batch job** privilege.
+By default, Auditor launches the executable file under the _LocalSystem_ account. If you want to use
+another account, select the Use custom credentials checkbox and specify a user name and password.
+Ensure this account has the **Log on as batch job** privilege.
-The resulting command line including executable file name and execution parameters will appear in
+The resulting command line, including the executable file name and execution parameters, appears in
the Command line preview.
-If you selected to **Write data to CSV file**, the command line will include
-_`{CsvFile_}`_, i.e. the file path. Alternatively, the command line will include _`{AlertID}`_ and _`{RecordID}`\_,
-i.e. related IDs
+If you select **Write data to CSV file**, the command line includes `{CsvFile}` (the file path).
+Otherwise, the command line includes `{AlertID}` and `{RecordID}` (the related IDs).
-**Step 9 –** Test run — if you click this button, the executable file will be run with the specified
-parameters on Netwrix Auditor server. This can be helpful, for example, if you want to ensure script
-operability before the related alert is triggered.
+**Step 9 –** Test run — if you click this button, the executable file runs with the specified
+parameters on the Netwrix Auditor server. This can be helpful, for example, if you want to ensure
+the script works correctly before the alert triggers.
-As there is no actual alert triggering in this case, sample alert ID and sample activity record ID
-will be passed to the executable file. If you selected to write data to CSV file, a sample file will
-be created and populated with these sample IDs.
+Because no alert actually triggers in this case, Auditor passes a sample alert ID and sample
+activity record ID to the executable file. If you selected Write data to CSV file, Auditor creates
+and populates a sample file with these sample IDs.
-To be able to perform the test run, current user account (logged on to Auditor client) must have
-local Administrator privileges on Auditor server where the executable file is located.
+To perform the test run, the current user account (logged on to the Auditor client) must have local
+Administrator privileges on the Auditor server that hosts the executable file.
-After the test run, you will get a notification message with the exit code. Typical values are as
+After the test run, you get a notification message with the exit code. Typical values are as
follows:
- **0** — the response action completed successfully
-- Any other value — the response action was not a success
+- Any other value — the response action failed
**_RECOMMENDED:_** Apply similar logic if you plan to use custom exit codes in your response action
script.
-Same exit codes will be returned by response action regular runs.
+Regular runs of the response action return the same exit codes.
-If the action is not a success (exit code is not 0), the program will try to perform response action
-again (up to 200 times) with increasing time interval.
+If the action fails (the exit code isn't 0), the program tries to perform the response action again
+(up to 200 times) at increasing intervals.
## Write Data to a CSV File
@@ -132,19 +126,24 @@ Here is an example of a CSV file structure:
-The number of activity records retrieved per every response action launch will be only limited by
-user (see below for details). If the number of records associated with the alert exceeds this limit,
-the program will create multiple CSV files, storing data in chunks.
-
-For example, if there are 50 records associated with the alert (e.g., “_Scanning threat is detected
-on network device_” alert), and the number of records for one CSV is set to 10, the program will
-create 5 CSV files, with 10 records in each chunk. Also notice that the response action will be
-launched once for every such chunk (5 times in this example), and will retrieve multiple activity
-records per launch (not more than the specified limit, i.e. 10 records in this example).
-
-A CSV file is named using the timestamp and GUID and stored in the subfolder of Netwrix Auditor
-working folder (by default, _%ProgramData%\Netwrix
-Auditor\AuditCore\AuditArchive\AlertsToolLauncher\Csv_). Note that a CSV file will exist only while
-the executable file is running – after the execution is completed, the CSV file will be deleted. So
-if you plan, for example, to obtain some data from that file for further processing, you may need to
-copy it to a permanent location in a timely manner, e.g., using a script.
+You limit the number of activity records retrieved per response action launch using the Limit row
+count in a file to setting (see step 8). If the number of records associated with the alert exceeds
+this limit, the program creates multiple CSV files, storing data in chunks.
+
+For example, if there are 50 records associated with the alert (for example, the Scanning threat is
+detected on network device alert) and the number of records for one CSV file is set to 10, the
+program creates 5 CSV files, with 10 records in each chunk. The program also launches the response
+action once for each chunk (5 times in this example) and retrieves multiple activity records per
+launch, up to the specified limit (10 records in this example).
+
+Auditor names a CSV file using the timestamp and GUID and stores it in a subfolder of the Netwrix
+Auditor working folder (by default, _%ProgramData%\Netwrix
+Auditor\AuditCore\AuditArchive\AlertsToolLauncher\Csv_).
+
+:::note
+A CSV file exists only while the executable file is running. After the run completes, Auditor
+deletes the CSV file.
+:::
+
+If you plan to use data from that file for further processing, copy it to a permanent location
+before Auditor deletes it, for example using a script.
diff --git a/docs/auditor/10.9/admin/behavioranomalies/dashboard.md b/docs/auditor/10.9/admin/behavioranomalies/dashboard.md
index f19052dd1f..0fb9e48d23 100644
--- a/docs/auditor/10.9/admin/behavioranomalies/dashboard.md
+++ b/docs/auditor/10.9/admin/behavioranomalies/dashboard.md
@@ -6,7 +6,7 @@ sidebar_position: 10
# Review Behavior Anomalies Dashboard
-To review the Behavior Anomalies dashboard, process and filter anomalies in user profiles, you must
+To review the Behavior Anomalies dashboard, process, and filter anomalies in user profiles, you must
be assigned the Global administrator or Global reviewer role in the product. See the
[Role-Based Access and Delegation](/docs/auditor/10.9/admin/monitoringplans/delegation.md) topic for additional
information.
@@ -23,16 +23,16 @@ on the left.
-The dashboards includes the following sections:
+The dashboard includes the following sections:
- The Risk score timeline that helps you review anomaly surges over time.
- The Risk score by top five users chart that helps you identify the most active users. To see the
chart, click the pie chart icon in the upper left corner of the page.
- The user list with all users who provoked alerts and their total risk scores.
-Once you reviewed the general anomaly trend and identified users that merit your special attention,
-review their profiles and process anomalies. Click View Profile next to a user name to dive into
-user activity and investigate each action in details.
+After you review the general anomaly trend and identify users that merit your special attention,
+review their profiles and process anomalies. Click View Profile next to a user name to examine
+user activity and investigate each action in detail.
[Review User Profiles and Process Anomalies](/docs/auditor/10.9/admin/behavioranomalies/userprofile.md)
[Review User Profiles and Process Anomalies](/docs/auditor/10.9/admin/behavioranomalies/userprofile.md)
diff --git a/docs/auditor/10.9/admin/behavioranomalies/overview.md b/docs/auditor/10.9/admin/behavioranomalies/overview.md
index fb191743c9..4f4c8ddb6e 100644
--- a/docs/auditor/10.9/admin/behavioranomalies/overview.md
+++ b/docs/auditor/10.9/admin/behavioranomalies/overview.md
@@ -6,45 +6,50 @@ sidebar_position: 80
# Behavior Anomalies
-Netwrix Auditor enables you to detect behavior anomalies in your IT environment, such as activity
+Use Netwrix Auditor to detect behavior anomalies in your IT environment, such as activity
surges or mass deletions of archived data. As you investigate suspicious activity and review
incidents, you can identify intruders or in-house bad actors who keep violating your company's
security policies.
The behavior anomalies assessment extends the alerting functionality and provides both a high-level
-visualization and a detailed history of malicious user activity. While alerts notify you on a single
+visualization and a detailed history of malicious user activity. While alerts notify you of a single
or repetitive action almost immediately, the Behavior Anomalies dashboard accumulates this data over
-time and thus gives you the bird's eye view of activity patterns. With Behavior Anomalies, you can
-step beyond individual actions and investigate more complicated user behavior scenarios that might
-otherwise stay concealed for a long time.
+time and gives you a broad view of activity patterns. With Behavior Anomalies, you can go beyond
+individual actions and investigate more complicated user behavior scenarios that might otherwise
+stay concealed for a long time.
-On a high level, your behavior anomalies assessment workflow can be described as follows:
+At a high level, your behavior anomalies assessment workflow works like this:
1. You create alerts on threat patterns specific to your company. You include these alerts in
- Behavior Anomalies assessment and associate a risk score with each alert. The score, that is
- between 1 and 100 points, reflects how critical the action is for your organization.
- [Risk Score](/docs/auditor/10.9/admin/alertsettings/create/create.md)how to set a risk score for an alert.
-
- Although Netwrix industry experts suggest risk scores for alerts that are provided
- out-of-the-box, you can easily tailor these scores to your organization needs and priorities.
- You can always adjust risk scores over time as you become more aware of behavior patterns and
- anomalous actions in your environment.
-
-2. Each action that provokes an alert is treated as anomaly. Once the anomaly is detected, it
- appears on a dashboard's timeline and its risk score is added to the user's total score.
-3. Every now and then, you review the Behavior Anomalies dashboard—the risk score timeline with
- anomaly surges, and the most active users. The general rule of thumb is: the more risk score
- points the user has the more he or she merits your attention.
+ Behavior Anomalies assessment and associate a risk score with each alert. The score, which is
+ between 1 and 100 points, reflects how critical the action is for your organization. See the
+ [Risk Score](/docs/auditor/10.9/admin/alertsettings/create/create.md) topic for information on
+ how to set a risk score for an alert.
+
+ Although Netwrix industry experts suggest risk scores for predefined alerts, you can tailor
+ these scores to your organization's needs and priorities. You can always adjust risk scores
+ over time as you become more aware of behavior patterns and anomalous actions in your
+ environment.
+
+2. Auditor treats each action that provokes an alert as an anomaly. After Auditor detects the
+ anomaly, it appears on the dashboard's timeline, and Auditor adds its risk score to the user's
+ total score.
+3. Periodically review the Behavior Anomalies dashboard—the risk score timeline with anomaly
+ surges, and the most active users. In general, the more risk score points a user has, the more
+ attention that user merits. See the
[Review Behavior Anomalies Dashboard](/docs/auditor/10.9/admin/behavioranomalies/dashboard.md)
-4. To learn more about user activity, you can drill-down to a user profile to review all alerts
- provoked by this user. As you review anomalies and mitigate risks, the user's total score
- reduces. [Review User Profiles and Process Anomalies](/docs/auditor/10.9/admin/behavioranomalies/userprofile.md)
+ topic for more information.
+4. To investigate user activity further, open a user profile to review all alerts provoked by this
+ user. As you review anomalies and mitigate risks, the user's total score decreases. See the
+ [Review User Profiles and Process Anomalies](/docs/auditor/10.9/admin/behavioranomalies/userprofile.md)
+ topic for more information.
The purpose of the dashboard is to keep risks low and help you spot and address issues as they
-occur. The risk score assigned to a user does not qualify him or her as a bad actor but rather
-brings your attention to behavior patterns. Depending on the role in your organization, users might
-have different safe levels while you should make your priority to review the anomalies on time, stay
-focused, and proactively mitigate risks.
-
-[ Using Behavior Anomaly Discovery](https://www.netwrix.com/using_behavior_anomaly_discovery.html)
-page on Netwrix website.
+occur. The risk score assigned to a user doesn't qualify the user as a bad actor but rather brings
+your attention to behavior patterns. Depending on the role in your organization, users might have
+different acceptable risk levels. Prioritize reviewing anomalies promptly, staying focused, and
+proactively mitigating risks.
+
+For more information, see the
+[Using Behavior Anomaly Discovery](https://www.netwrix.com/using_behavior_anomaly_discovery.html)
+page on the Netwrix website.
diff --git a/docs/auditor/10.9/admin/behavioranomalies/tips.md b/docs/auditor/10.9/admin/behavioranomalies/tips.md
index 19581e80cb..0de5d4cf80 100644
--- a/docs/auditor/10.9/admin/behavioranomalies/tips.md
+++ b/docs/auditor/10.9/admin/behavioranomalies/tips.md
@@ -9,27 +9,27 @@ sidebar_position: 30
This topic contains various frequently asked questions as well as tips and tricks you might find
helpful when configuring scoring settings and reviewing behavior anomalies.
-- The user has a high score and keeps provoking same alerts almost every day.
+- The user has a high score and keeps provoking the same alerts almost every day.
- Drill-down to the user profile and then click Show user activity. Review user actions and
- compare them to his or her job responsibilities. Does the user seem trustworthy? Are there any
+ Go to the user profile and then click Show user activity. Review the user's actions and
+ compare them to the user's job responsibilities. Does the user seem trustworthy? Are there any
rights elevation or suspicious access attempts?
- Try to review user tasks—you may find out that the anomaly the user keeps provoking is a genuine
- part of his or her daily routine. For example, the office staff should not reset passwords for
- other accounts while this is a basic task for a system administrator. In this case, review your
- alert settings and exclude the user from the alert filters.
+ Try to review the user's tasks—you may find out that the anomaly the user keeps provoking is a
+ genuine part of the user's daily routine. For example, office staff shouldn't reset passwords
+ for other accounts, although this is a basic task for a system administrator. In this case,
+ review your alert settings and exclude the user from the alert filters.
-- Everyone in organization has a huge score
+- Everyone in the organization has a huge score
- Probably, you have configured too many alerts that turn behavior anomalies assessment into mess.
- It takes some time to learn what matters most to your organization and get accustomed to setting
- proper risk scores. Try to review your scoring settings regularly and adjust them when
+ You may have configured too many alerts, which makes behavior anomalies assessment difficult to
+ manage. It takes some time to learn what matters most to your organization and get accustomed to
+ setting proper risk scores. Review your scoring settings regularly and adjust them when
necessary.
-- Is anyone who is charge of "Failed..." anomaly a bad actor?
+- Is anyone who is in charge of a "Failed..." anomaly a bad actor?
- Anyone can forget a password or accidentally try to access some data in a wrong folder. Such
- users are not subject to immediate prosecution unless they do not provoke repetitive alerts. The
- best practice is to review user profile after some time and check if there are any threat
- patterns in user behavior.
+ Anyone can forget a password or accidentally try to access data in the wrong folder. Such users
+ aren't subject to immediate prosecution unless they provoke repetitive alerts. The best practice
+ is to review the user profile after some time and check if there are any threat patterns in user
+ behavior.
diff --git a/docs/auditor/10.9/admin/behavioranomalies/userprofile.md b/docs/auditor/10.9/admin/behavioranomalies/userprofile.md
index 378484db51..e02fc9ee8e 100644
--- a/docs/auditor/10.9/admin/behavioranomalies/userprofile.md
+++ b/docs/auditor/10.9/admin/behavioranomalies/userprofile.md
@@ -6,77 +6,79 @@ sidebar_position: 20
# Review User Profiles and Process Anomalies
-The user profile enables you to investigate user behavior and take a closer look at anomalies.
+Use the user profile to investigate user behavior and take a closer look at anomalies.
-To view a user profile
+To view a user profile:
-- On the Behavior Anomalies assessment dashboard, locate a user and click View Profile next to his
- or her name.
+- On the Behavior Anomalies assessment dashboard, locate a user and click View Profile next to the
+ user's name.
The user profile page contains the following sections:
- User data with the name and the total risk score. Click Show user activity below the total risk
- score, to launch the Interactive Search in a new window. Use it to see all user actions, including
- those that were not treated as anomalies.
+ score to launch the Interactive Search in a new window. Use it to see all user actions, including
+ those that weren't treated as anomalies.
- The Risk score timeline that demonstrates anomalous activity surges. Modify the timeframe to
narrow down the results.
- The Risk score by top five alerts chart that outlines the most frequent anomalies provoked by
- user. To see the chart, click the pie chart icon in the upper left corner of the page.
-- The anomalies list displays details for each anomaly: the alert that was triggered, the date and
- time, the risk score and anomaly status.
+ the user. To see the chart, click the pie chart icon in the upper left corner of the page.
+- The anomalies list displays details for each anomaly: the alert that triggered, the date and
+ time, the risk score, and anomaly status.
- Double-click an entry to see more details: who did what, when and where the action was made,
- etc. Navigate to Linked actions and click Show user activity or Show this activity record to
- invoke Interactive Search and see all user actions or a specific action correspondingly.
+ Double-click an entry to view additional details: who did what, when, and where the action took
+ place, etc. Navigate to Linked actions and click Show user activity or Show this activity record
+ to open Interactive Search and see all user actions or a specific action, respectively.
Netwrix Auditor shows only the top 2,000 anomalies. Modify the timeframe or hide reviewed anomalies,
-and then click Refresh to see more anomalies.
+and then click Refresh to display additional anomalies.
## Process Anomalies and Reduce Risk Score
-By default, the anomaly status is active and it indicates that the incident still requires some
-examination or is kept for further investigation. As you inspect anomalies and respond to threats,
-update statuses and add comments.
+By default, an anomaly's status is Active, which indicates that the incident still needs examination
+or further investigation. As you inspect anomalies and respond to threats, update statuses and add
+comments.
-To change an anomaly status
+To change an anomaly status:
1. Specify an anomaly from the list and click the Active link in the Status column.
2. In the Change Status dialog, set the status to _"reviewed"_ and provide a justification.
You can add comments without changing a status. This might be helpful if the anomaly remains
- active for a long period of time and you need even more time to examine it closely.
+ active for a long time and you need even more time to examine it closely.
-Once the anomaly is reviewed, it disappears from the timeline and chart, and its associated risk
-score is taken from user's total score. The reviewed anomalies supplement the status with the
-reviewer name and date (e.g., _Reviewed by CORP\Administrator (10/02/2017 10:12:03 AM)_).
+After you review the anomaly, it disappears from the timeline and chart, and Auditor deducts its
+associated risk score from the user's total score. The reviewed anomalies supplement the status
+with the reviewer name and date (e.g., _Reviewed by CORP\Administrator (10/02/2017 10:12:03 AM)_).
You can always revert changes and assign the Active status back.
-To process all anomalies
+To process all anomalies:
- In the Actions section, select Mark all as reviewed.
-In this case, all anomalies that are currently in view will be set to _"reviewed"_. Perform this
-operation only with a proper justification. Since Netwrix Auditor shows only the top 2,000
-anomalies, make sure to click Refresh to check if there are more anomalies to be reviewed.
+In this case, Auditor sets all anomalies that are in view to _"reviewed"_. Perform this
+operation only with a proper justification. Because Netwrix Auditor shows only the top 2,000
+anomalies, click Refresh to check whether there are more anomalies to review.
-The anomalies that are excluded from view by filters are not affected by the Mark all as reviewed
-action.
+The Mark all as reviewed action doesn't affect anomalies that filters exclude from view.
## Customize Anomalies List
By default, all anomalies are in view. The Filters section helps you show or hide anomalies.
-Click Customize view and clear the checkboxes next to alert names, if you do not want to see
+Click Customize view and clear the checkboxes next to alert names, if you don't want to see
anomalies associated with them.
-When you hide an alert from view, its associated anomalies will no longer be displayed on a
-timeline, chart, or in the list but the user total score will remain unchanged. Note that hidden
-anomalies cannot be reviewed in bulk with the Mark all as reviewed action.
+When you hide an alert from view, its associated anomalies no longer appear on the timeline, chart,
+or in the list, but the user's total score remains unchanged.
-Hide reviewed anomalies enables you to modify the anomalies list so that you can focus on active
-anomalies only. To see reviewed anomalies, click Show reviewed anomalies.
+:::note
+Hidden anomalies can't be reviewed in bulk with the Mark all as reviewed action.
+:::
+
+Use Hide reviewed anomalies to modify the anomalies list so you can focus on active anomalies only.
+To see reviewed anomalies, click Show reviewed anomalies.
diff --git a/docs/auditor/10.9/admin/healthstatus/dashboard/activityrecordstatistics.md b/docs/auditor/10.9/admin/healthstatus/dashboard/activityrecordstatistics.md
index ed31af0b3b..30954df657 100644
--- a/docs/auditor/10.9/admin/healthstatus/dashboard/activityrecordstatistics.md
+++ b/docs/auditor/10.9/admin/healthstatus/dashboard/activityrecordstatistics.md
@@ -6,21 +6,21 @@ sidebar_position: 10
# Activity Records Statistics
-Aggregated statistics on the activity records is provided in the Activity records by date widget.
-The chart shows the number of activity records produced by your data sources, collected and saved by
-Netwrix Auditor during the last 7 days. This data can help you to assess the activity records
+The Activity records by date widget provides aggregated statistics on the activity records.
+The chart shows the number of activity records your data sources produced and Netwrix Auditor
+collected and saved during the last 7 days. This data can help you to assess the activity records
generation intensity in your IT infrastructure, and product load.
-After you click View details, the Activity Records Statistics window will be displayed.
+After you click View details, Auditor displays the Activity Records Statistics window.
-By default, statistics on activity records processing is grouped by Monitoring plan and presented
-for the Last 7 days. To modify the timeframe, use the drop-down list in the upper right corner.
+By default, Auditor groups statistics on activity records processing by Monitoring plan and presents
+them for the Last 7 days. To modify the timeframe, use the dropdown list in the upper right corner.
Other fields provide the following information: data source that produces activity records, with
date and time of the last collected record, and the overall number of records collected and uploaded
to the corresponding Audit database during the specified timeframe.
-If the data sources processed by a monitoring plan did not produce any activity records during the
+If the data sources processed by a monitoring plan didn't produce any activity records during the
specified timeframe, this monitoring plan will not appear in the list.
diff --git a/docs/auditor/10.9/admin/healthstatus/dashboard/databasestatistics.md b/docs/auditor/10.9/admin/healthstatus/dashboard/databasestatistics.md
index a5ff5a556f..4020156029 100644
--- a/docs/auditor/10.9/admin/healthstatus/dashboard/databasestatistics.md
+++ b/docs/auditor/10.9/admin/healthstatus/dashboard/databasestatistics.md
@@ -12,9 +12,9 @@ adjust retention accordingly. The widget displays the name of default SQL Server
all Netwrix Auditor databases, the overall database capacity at the moment and its change over the
last day (24 hours).
-Transaction logs size is not included in the calculations.
+Transaction logs size isn't included in the calculations.
-After you click View details, the following information will be displayed for the specified SQL
+After you click View details, Auditor displays the following information for the specified SQL
Server instance:
@@ -34,10 +34,10 @@ instance of the SQL Server:
The following capacity metrics are displayed for each database:
- **State**—database state summary
-- **Size**—current database size (logs are not included)
+- **Size**—current database size (logs aren't included)
- **Activity records**—number of the activity records stored in the database at the moment
-After you expand the database node, the detailed database properties will be shown:
+After you expand the database node, Auditor shows the detailed database properties:
@@ -52,11 +52,11 @@ These properties are as follows:
| Failed to store data | Failed to store data to the database due to some issues. | |
| Unavailable | Failed to connect to the database. | |
| Upgrade in progress | Database is being upgraded. | |
-| Monitoring plans | _``_ | All monitoring plans for which this database is a target. Usually it is recommended to configure a dedicated database for each plan. |
+| Monitoring plans | _``_ | All monitoring plans for which this database is a target. Netwrix usually recommends configuring a dedicated database for each plan. |
You can use the Search field, or apply a filter to display the information you need. For example, in
the Apply Filters dialog you can select the Show only plans with issues to display only the
monitoring plans that require attention and corrective actions.
-This information will help you to troubleshoot the product operation, detect and eliminate the root
-cause of the monitoring errors, providing for auditing continuity and compliance.
+This information helps you troubleshoot product operation; detect and eliminate the root cause of
+monitoring errors; and maintain auditing continuity and compliance.
diff --git a/docs/auditor/10.9/admin/healthstatus/dashboard/healthlog.md b/docs/auditor/10.9/admin/healthstatus/dashboard/healthlog.md
index 8053563da0..6666be277a 100644
--- a/docs/auditor/10.9/admin/healthstatus/dashboard/healthlog.md
+++ b/docs/auditor/10.9/admin/healthstatus/dashboard/healthlog.md
@@ -11,7 +11,7 @@ shows how many events with different severity levels were written to the product
last 24 hours. To open the health log, click the **Open Health Log** link in the Health Status
dashboard. See the topic for additional information.
-If you want to clear Netwrix Auditor Health Log, son the computer where Auditor Server is installed,
+If you want to clear Netwrix Auditor Health Log, on the computer where Auditor Server is installed,
navigate to **EventViewer** -> **Application and Services Logs** and locate the **Netwrix Auditor
System Health log**. Then, follow the instructions provided by Microsoft. See the Microsoft article
for additional information on
@@ -27,7 +27,7 @@ proprietary Netwrix Auditor **System Health** event log.
You can review events directly in the product:
-- When issues encountered during data collection, click Details... in the Status column and select
+- When you encounter issues during data collection, click Details... in the Status column and select
View Health Log.
OR
@@ -42,7 +42,7 @@ There are three types of events that can be logged:
| Event Type | Description |
| ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Information | An event that describes the successful operation beginning or completion. For example, the product successfully completed data collection for a monitoring plan. |
-| Warning | An event that is not necessarily significant, but may indicate a possible future problem. For example, the product failed to process a domain controller. |
+| Warning | An event that isn't necessarily significant, but may indicate a possible future problem. For example, the product failed to process a domain controller. |
| Error | An event that indicates a significant problem such as loss of data or loss of functionality. For example, the product failed to retrieve settings for your data source. |
Review the following:
@@ -58,7 +58,7 @@ If you want to monitor Auditor health status in more depth, you can do the follo
## Inspect Events in Health Log
-Follow the steps o inspect events in Netwrix Auditor health log
+To inspect events in Netwrix Auditor health log:
**Step 1 –** On the main Auditor page, select the Health status tile, then in the Health log
dashboard widget click Open health log.
@@ -72,7 +72,7 @@ collection or events of an important monitoring plan.
### Filter Events
-Follow the steps to filter events.
+To filter events:
**Step 1 –** Select Filters in the upper part of the Netwrix Auditor Health Log window.
@@ -84,9 +84,9 @@ Follow the steps to filter events.
| Event level | Select level of the events that you want to be displayed. |
| Event source | Select services and applications whose events you want to view. |
| Monitoring plan | Select to display events from one or several monitoring plans. |
-| Item name | Select to display events from the certain item(s) you need. |
-| Event ID | Enter event ID number or range of event IDs separated by commas. For example, 1, 3, 5-99. You can also exclude unwanted event IDs from being displayed. Type the minus sign before selected event ID. For example, -76. |
+| Item name | Select to display events from the certain items you need. |
+| Event ID | Enter event ID number or range of event IDs separated by commas. For example, 1, 3, 5-99. You can also exclude unwanted event IDs from being displayed. Enter the minus sign before selected event ID. For example, -76. |
-The applied filters will be listed on the top of the screen under the window title.
+Applied filters appear at the top of the screen under the window title.
diff --git a/docs/auditor/10.9/admin/healthstatus/dashboard/monitoringoverview.md b/docs/auditor/10.9/admin/healthstatus/dashboard/monitoringoverview.md
index 746223e350..6d52559a4a 100644
--- a/docs/auditor/10.9/admin/healthstatus/dashboard/monitoringoverview.md
+++ b/docs/auditor/10.9/admin/healthstatus/dashboard/monitoringoverview.md
@@ -6,18 +6,18 @@ sidebar_position: 20
# Monitoring Overview
-Aggregated statistics on the monitoring plans is provided in the Monitoring overview widget. It
+The Monitoring overview widget provides aggregated statistics on the monitoring plans. It
displays current statuses of all monitoring plans:
- Ready (green indicator)—The monitoring plans (one or several) successfully processed the data
sources with all their items and are ready for the next run.
- Pay attention (yellow indicator)—The monitoring plans (one or several) require your attention, as
- some items were not processed completely but only partially. This status applies to the monitoring
- plans targeted at Logon Activity and Windows File Server. See the table below for details.
+ some items weren't processed completely but only partially. This status applies to the monitoring
+ plans targeted at Logon Activity and Windows File Server. See the following table for details.
- Take action (red indicator)—Any data source or item in the monitoring plan (one or several) was
processed with errors.
-After you click View details, the Monitoring Overview window will be displayed.
+After you click View details, Auditor displays the Monitoring Overview window.
@@ -27,21 +27,21 @@ and items their current status is depicted as follows:
| Entity | Status | Description |
| --------------- | ------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Data source | Disabled | A data source can be disabled manually via its settings (by switching Monitor this data source and collect activity data to OFF), or automatically, if the license is not valid any more (for example, the count of licensed objects was exceeded, or the trial period has expired). |
+| Data source | Disabled | A data source can be disabled manually via its settings (by switching Monitor this data source and collect activity data to OFF), or automatically, if the license isn't valid any more (for example, the count of licensed objects was exceeded, or the trial period has expired). |
| Empty | No items have been added to this data source yet. | |
| Enabled | Monitor this data source and collect activity data is set to ON in the data source settings. | |
-| Not available | The monitoring plan is corrupted and cannot process its data sources, so it is recommended to remove it and create anew. | |
-| Not responding | Data collector for this data source is not responding. The underlying items will not be displayed for such data source. | |
+| Not available | The monitoring plan is corrupted and can't process its data sources, so Netwrix recommends removing it and creating a new one. | |
+| Not responding | Data collector for this data source isn't responding. Auditor doesn't display the underlying items for this data source. | |
| Working | The data source is being processed at the moment. | |
| (not displayed) | The data source status is unknown. | |
-| Item | Pay attention | The item was processed with some issues (non-critical). This status applies to the monitoring plans targeted at Logon Activity and Windows File Server. It means that data collection from at least one entity completed with errors. For example, a MyFileServer item included in the File Server monitoring plan contains all CIFS shares hosted on the MyFileServer computer. If any of these shares was processed with errors while others were processed successfully, the processing of the whole MyFileServer item will be considered partially completed, and the monitoring plan will have a yellow indicator, requiring your attention. Click the Details link to examine the product log. |
+| Item | Pay attention | The item was processed with some issues (non-critical). This status applies to the monitoring plans targeted at Logon Activity and Windows File Server. It means that data collection from at least one entity completed with errors. For example, a MyFileServer item included in the File Server monitoring plan contains all CIFS shares hosted on the MyFileServer computer. If any of these shares was processed with errors while others were processed successfully, Auditor considers the processing of the whole MyFileServer item partially completed and gives the monitoring plan a yellow indicator, requiring your attention. Click the Details link to examine the product log. |
| Ready | The item was processed successfully and is ready for the next run of data collection. | |
-| Take action | Critical error(s) occurred while processing this item. Click the Details link to examine the product log. | |
+| Take action | Critical errors occurred while processing this item. Click the Details link to examine the product log. | |
| Working | The item is being processed at the moment. | |
You can use the Search field, or apply a filter to display the information you need. For example, in
the Apply Filters dialog you can select the Show only plans with issues to display only the
monitoring plans that require attention and corrective actions.
-This information will help you to troubleshoot the product operation, detect and eliminate the root
-cause of the monitoring errors, providing for auditing continuity and compliance.
+This information helps you troubleshoot product operation; detect and eliminate the root cause of
+monitoring errors; and maintain auditing continuity and compliance.
diff --git a/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md b/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md
index 75eff9284f..de28efbd94 100644
--- a/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md
+++ b/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md
@@ -9,16 +9,16 @@ sidebar_position: 10
New Health Status dashboard facilitates Auditor maintenance and troubleshooting tasks, providing IT
specialists with at-a-glance view on the most critical factors: data collection performance, product
health and storage capacity. The dashboard comprises a set of widgets that display the status of
-these aspects using aggregated statistics and charts. Nearly each widget allows you to drill down to
-the detailed information on the aspect you are interested in.
+these aspects using aggregated statistics and charts. Nearly every widget lets you explore
+detailed information about the aspect you're interested in.
To view the dashboard, on the main Auditor page, click the Health status tile located in the
Configuration section.
The dashboard includes the following widgets:
-- The Activity records by date chart—Shows the number of activity records produced by your data
- sources, collected and saved by Netwrix Auditor during the last 7 days. See the
+- The Activity records by date chart—Shows the number of activity records your data sources
+ produced and Netwrix Auditor collected and saved during the last 7 days. See the
[Activity Records Statistics](/docs/auditor/10.9/admin/healthstatus/dashboard/activityrecordstatistics.md) topic for additional information.
- The Monitoring overview widget—Shows aggregated statistics on the statuses of all monitoring plans
configured in Netwrix Auditor at the moment. See the [Monitoring Overview](/docs/auditor/10.9/admin/healthstatus/dashboard/monitoringoverview.md)
diff --git a/docs/auditor/10.9/admin/healthstatus/networktrafficcompression.md b/docs/auditor/10.9/admin/healthstatus/networktrafficcompression.md
index 90a2c98df8..bc1829b6b6 100644
--- a/docs/auditor/10.9/admin/healthstatus/networktrafficcompression.md
+++ b/docs/auditor/10.9/admin/healthstatus/networktrafficcompression.md
@@ -6,20 +6,20 @@ sidebar_position: 40
# Network Traffic Compression
-To reduce network traffic in distributed deployments, multi-site networks and other environments
-with remote locations that have limited bandwidth, it is recommended to use network traffic
-compression. For that purpose, special Netwrix utilities should be installed in the audited
-environment. These utilities will run on the target computers (depending on your monitoring plan),
-collect, pre-filter data and send it to Auditor Server in a highly compressed format.
+To reduce network traffic in distributed deployments, multi-site networks, and other environments
+with remote locations that have limited bandwidth, Netwrix recommends using network traffic
+compression. For that purpose, install special Netwrix utilities in the audited environment. These
+utilities run on the target computers (depending on your monitoring plan), collect and pre-filter
+data, and send it to Auditor Server in a highly compressed format.
-With network traffic compression, data from the target machines is collected simultaneously,
-providing for network load balance and minimizing data collection time. (Unlike that, without
-network traffic compression the target machines will be processed sequentially, i.e. one at a time.)
-So, network traffic compression helps to increase scalability and optimize network traffic.
+With network traffic compression, Auditor collects data from the target machines simultaneously,
+providing for network load balance and minimizing data collection time. (Without network traffic
+compression, Auditor processes the target machines sequentially, one at a time.) So, network
+traffic compression helps increase scalability and optimize network traffic.
Its key capabilities are as follows:
-- Allows Auditor to collect detailed metrics for the servers, log files, hardware and individual
+- Allows Auditor to collect detailed metrics for the servers, log files, hardware, and individual
processes
- Collects audit data with no recognizable load on the server
- Communicates with Netwrix Auditor Server at predefined intervals, relaying data back to a central
diff --git a/docs/auditor/10.9/admin/healthstatus/overview.md b/docs/auditor/10.9/admin/healthstatus/overview.md
index 284a654a32..528d368066 100644
--- a/docs/auditor/10.9/admin/healthstatus/overview.md
+++ b/docs/auditor/10.9/admin/healthstatus/overview.md
@@ -6,7 +6,7 @@ sidebar_position: 110
# Netwrix Auditor Operations and Health
-This topic describes how you can monitor Auditor operations, health and resource usage. See the
+This topic describes how you can monitor Auditor operations, health, and resource usage. See the
following topics for additional information:
- [Health Status Dashboard](/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md)
diff --git a/docs/auditor/10.9/admin/healthstatus/selfaudit.md b/docs/auditor/10.9/admin/healthstatus/selfaudit.md
index 83112c0bd4..0fbeff4bba 100644
--- a/docs/auditor/10.9/admin/healthstatus/selfaudit.md
+++ b/docs/auditor/10.9/admin/healthstatus/selfaudit.md
@@ -6,10 +6,10 @@ sidebar_position: 20
# Self-Audit
-Built-in Netwrix Auditor self-audit allows you to track changes to the product configuration,
-including monitoring plans, data sources, audit scope and details about it (before-after values).
-This helps you to ensure that monitoring scope is complete and changed only in line with the
-workflows adopted by our organization.
+Use built-in Netwrix Auditor self-audit to track changes to the product configuration,
+including monitoring plans, data sources, audit scope, and details about it (before-after values).
+This helps you ensure that monitoring scope is complete and changed only in line with the
+workflows your organization has adopted.
The corresponding option is available on the General tab of Netwrix AuditorSettings. By default, the
**Collect data for self-audit checkbox** is selected (enabled).
@@ -18,9 +18,9 @@ The corresponding option is available on the General tab of Netwrix AuditorSetti
### Search for Self-audit Results
-All Auditor self-audit Activity Records can be found quickly using AuditIntelligence Search.
+Find all Auditor self-audit Activity Records quickly using AuditIntelligence Search.
-Follow the steps to search for self-audit results.
+To search for self-audit results:
**Step 1 –** In Auditor, navigate to Search.
@@ -42,7 +42,7 @@ Also, there is a new Netwrix Auditor Self-Audit report available under Organizat
the predefined set of reports. This report shows detailed information on changes to Auditor
monitoring plans, data sources and audited items.
-Follow the steps to review the Self-audit report.
+To review the Self-audit report:
**Step 1 –** In Auditor, navigate to Reports > Organization Level Reports.
diff --git a/docs/auditor/10.9/admin/healthstatus/summaryemail.md b/docs/auditor/10.9/admin/healthstatus/summaryemail.md
index 293290f34b..87953b0469 100644
--- a/docs/auditor/10.9/admin/healthstatus/summaryemail.md
+++ b/docs/auditor/10.9/admin/healthstatus/summaryemail.md
@@ -7,8 +7,8 @@ sidebar_position: 30
# Health Summary Email
Auditor Health Summary email includes all statistics on the product operations and health for the
-last 24 hours; it also notifies you about license status. By default, this email is generated daily
-at 7:00 AM and delivered to the recipient specified in the
+last 24 hours; it also notifies you about license status. By default, Auditor generates this email
+daily at 7:00 AM and delivers it to the recipient specified in the
[Notifications](/docs/auditor/10.9/admin/settings/notifications.md) settings. Email content is very similar to data
presented in the [Health Status Dashboard](/docs/auditor/10.9/admin/healthstatus/dashboard/overview.md).
@@ -16,9 +16,9 @@ For greater usability, to depict overall product health state, the email include
in the topmost section: green means Auditor had no issues while auditing your IT infrastructure, and
red means there were some problems that require your attention.
-The email looks like shown below:
+The following example shows what the email looks like:
-The Monitoring Overview section of the email provides detail information only for the monitoring
-plans with issues. Successfully completed monitoring plans are not included.
+The Monitoring Overview section of the email provides detailed information only for the monitoring
+plans with issues; it doesn't include successfully completed monitoring plans.
diff --git a/docs/auditor/10.9/admin/healthstatus/troubleshooting.md b/docs/auditor/10.9/admin/healthstatus/troubleshooting.md
index 6ed3f860bd..da14042341 100644
--- a/docs/auditor/10.9/admin/healthstatus/troubleshooting.md
+++ b/docs/auditor/10.9/admin/healthstatus/troubleshooting.md
@@ -9,7 +9,7 @@ sidebar_position: 50
This section provides instructions on how to troubleshoot issues that you may encounter while using
Netwrix Auditor.
-If your issue is not listed in the table below, try searching
+If your issue isn't listed in the following table, try searching
[Netwrix Knowledge Base](https://helpcenter.netwrix.com/).
If you need assistance from the Technical Support team, you can open a ticket using the Customer
@@ -17,13 +17,13 @@ portal as described in the Creating a ticket with Customer portal section.
| Issue | Reason and solution |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| I cannot connect/logon to Auditor. | 1. You may have insufficient permissions. Contact your Auditor Global administrator to make sure that your account is delegated control of the product. 2. You are trying to connect to a remote Auditor specified by its IP address while the NTLM authentication is disabled. Try specifying a server by its name (e.g., EnterpriseWKS). |
-| I do not receive any results while searching audit data or generating reports, or I am sure that some data is missing. | 1. No changes were detected. 2. You do not have sufficient permissions to review intelligence data. Contact your Global administrator. 3. Review your filter settings and make sure that your filters are properly configured. Try modifying your search. 4. You are looking for changes that occurred more than 180 days ago. These changes are no longer available for reporting and running searches. Ask your Auditor Global administrator to import audit data for a required date range from the Long-Term Archive. 5. Data collection for this monitoring plan might not have been launched two times yet or there was no data collection after this change; therefore, audit data has not been written to the Audit Database yet. 6. Some settings in Auditor are configured incorrectly. Contact your Auditor administrator to make sure that: - The monitoring plan you want to audit is properly configured, and the monitoring is enabled for each data source individually. - Audit Database settings are properly configured for each data source individually and Disable security intelligence and make data available only in activity summaries is cleared. Netwrix recommends to store all audit data on the same default SQL Server instance. |
-| "No plans found" text in the Monitoring plan field. | Contact your Auditor Global administrator or Configurator to make sure that the monitoring plans exist and are properly configured. |
-| I see a blank window instead of a report. | Contact your Auditor Global administrator to make sure that you are granted sufficient permissions on the Report Server. To view reports in a web browser - Open a web browser and type the Report Manager URL (found under Settings>**Audit Database**). In the page that opens, navigate to the report you want to generate and click the report name. You can modify the report filters and click View Report to apply them. |
-| I configured report subscription to be uploaded to a file server, but cannot find it / cannot access it. | Subscriptions can be uploaded either to a file share (e.g., _\\filestorage\reports_) or to a folder on the computer where Auditor Server is installed. To access these reports, you must be granted the Read permission. |
-| When trying to collect event data from Active Directory domain, an error message like this appears in Netwrix Health Log: _Monitoring Plan: `` The following error has occurred while processing '``': Error collecting the security log of the domain ``. Failed to process the domain controller `` due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it_. | This may happen due to Secondary Logon Service disabled state. To collect event data from the domain, this service must be up and running. Open its properties and start the service. |
-| The 'Workstation' field in search, reports, and Activity Summary is reported as 'unknown' | For the full list of possible reasons, please refer to the following Netwrix Knowledge Base article: [Why is the "Workstation" field reported as "unknown"?](/docs/kb/auditor/reports-alerts-and-notifications/report-generation/workstation-field-reported-as-unknown) |
+| You can't connect or log on to Auditor. | 1. You may have insufficient permissions. Contact your Auditor Global administrator to ensure that your account is delegated control of the product. 2. You are trying to connect to a remote Auditor specified by its IP address while the NTLM authentication is disabled. Try specifying a server by its name (e.g., EnterpriseWKS). |
+| You don't receive any results while searching audit data or generating reports, or you are sure that some data is missing. | 1. No changes were detected. 2. You don't have sufficient permissions to review intelligence data. Contact your Global administrator. 3. Review your filter settings and ensure that your filters are properly configured. Try modifying your search. 4. You are looking for changes that occurred more than 180 days ago. These changes are no longer available for reporting and running searches. Ask your Auditor Global administrator to import audit data for a required date range from the Long-Term Archive. 5. Data collection for this monitoring plan might not have been launched two times yet or there was no data collection after this change; therefore, audit data has not been written to the Audit Database yet. 6. Some settings in Auditor are configured incorrectly. Contact your Auditor administrator to ensure that: - The monitoring plan you want to audit is properly configured, and the monitoring is enabled for each data source individually. - Audit Database settings are properly configured for each data source individually and Disable security intelligence and make data available only in activity summaries is cleared. Netwrix recommends to store all audit data on the same default SQL Server instance. |
+| "No plans found" text in the Monitoring plan field. | Contact your Auditor Global administrator or Configurator to ensure that the monitoring plans exist and are properly configured. |
+| You see a blank window instead of a report. | Contact your Auditor Global administrator to ensure that you are granted sufficient permissions on the Report Server. To view reports in a web browser - Open a web browser and enter the Report Manager URL (found under Settings>**Audit Database**). In the page that opens, navigate to the report you want to generate and click the report name. You can modify the report filters and click View Report to apply them. |
+| You configured a report subscription to upload to a file server, but can't find it or can't access it. | Subscriptions can be uploaded either to a file share (e.g., _\\filestorage\reports_) or to a folder on the computer where Auditor Server is installed. To access these reports, you must be granted the Read permission. |
+| When trying to collect event data from Active Directory domain, an error message like this appears in Netwrix Health Log: _Monitoring Plan: `